diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 0a69ff636f25..8c01b0592c2e 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -9,7 +9,7 @@ on:
     # optimistic, it can take longer to run.
     # To understand why `schedule` is used instead of other events, refer to
     # ./doc/contributing/commit-queue.md
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 561f8d56813f..b512153621d8 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -78,7 +78,7 @@ jobs:
     name: '${{ matrix.system }}: with shared libraries'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: ${{ inputs.repo || github.repository }}
           ref: refs/pull/${{ inputs.pr_id }}/merge
@@ -92,7 +92,7 @@ jobs:
         env:
           EXPECTED_SHA: ${{ inputs.commit }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -195,7 +195,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -211,7 +211,7 @@ jobs:
           merge-multiple: true
           path: raw-results
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/build-shared.yml b/.github/workflows/build-shared.yml
index 908116021c27..6b0ef92c3df7 100644
--- a/.github/workflows/build-shared.yml
+++ b/.github/workflows/build-shared.yml
@@ -53,7 +53,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index 248e64bab776..e173d4a544e0 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -76,7 +76,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -104,7 +104,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions/install-clang
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 23084c68ac5e..0b83c888ecdc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,19 +24,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: /language:${{matrix.language}}
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 896340ba3a82..5537d1e19c65 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -20,13 +20,13 @@ jobs:
         run: |
           echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
           echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
           persist-credentials: false
       - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commit message
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index a1d691e9e19f..600dadc17bc4 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -11,7 +11,7 @@ on:
   # be read-only, and the Action won't have access to any other repository
   # secrets, which it needs to access Jenkins API.
   schedule:
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -28,6 +28,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
+      aged_prs: ${{ steps.get_candidate_prs.outputs.aged_prs }}
       candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
       - name: Get Pull Request Candidates
@@ -50,6 +51,7 @@ jobs:
                   --search "-label:blocked")
           candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "aged_prs=$aged_prs" >> "$GITHUB_OUTPUT"
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
@@ -64,7 +66,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -93,6 +95,7 @@ jobs:
           curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
 
           numbers=
+          lacks_second_approval_prs=
           # shellcheck disable=SC2086
           for pr in $CANDIDATES; do
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
@@ -139,6 +142,14 @@ jobs:
             if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
               echo "pr ${pr} skipped, not ready to land"
               echo "reason codes: ${metadata_reason_codes}"
+              if jq -e '
+                    (.reasonCodes | index("wait-time")) and
+                    (.pullRequest.labels | index("lacks-second-approval") | not)
+                  ' "$metadata" > /dev/null; then
+                case " $AGED_PRS " in
+                  *" $pr "*) lacks_second_approval_prs="$lacks_second_approval_prs $pr" ;;
+                esac
+              fi
               continue
             fi
 
@@ -148,12 +159,28 @@ jobs:
           done
 
           numbers=$(echo "$numbers" | xargs)
+          lacks_second_approval_prs=$(echo "$lacks_second_approval_prs" | xargs)
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+          echo "lacks_second_approval_prs=$lacks_second_approval_prs" >> "$GITHUB_OUTPUT"
         env:
+          AGED_PRS: ${{ needs.get_candidate_prs.outputs.aged_prs }}
           CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
           GH_TOKEN: ${{ github.token }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - name: Label Pull Requests Lacking a Second Approval
+        if: steps.get_mergeable_prs.outputs.lacks_second_approval_prs != ''
+        run: |
+          # shellcheck disable=SC2086
+          for pr in $PULL_REQUESTS; do
+            if ! gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label 'lacks-second-approval'; then
+              echo "::warning::Failed to add lacks-second-approval to PR ${pr}"
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will
diff --git a/.github/workflows/contributor-guidance.yml b/.github/workflows/contributor-guidance.yml
new file mode 100644
index 000000000000..e9a99bcb6277
--- /dev/null
+++ b/.github/workflows/contributor-guidance.yml
@@ -0,0 +1,147 @@
+name: Contributor guidance
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  contributor:
+    name: Resolve contributor status
+    # Use the event only to exclude trusted associations, mannequins, and bots.
+    # Resolve every potentially external contributor with a privileged API request.
+    if: >-
+      github.run_attempt == 1 &&
+      github.repository == 'nodejs/node' &&
+      github.event.pull_request.user.type != 'Bot' &&
+      (github.event.pull_request.author_association == 'CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'FIRST_TIMER' ||
+      github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'NONE')
+    runs-on: ubuntu-slim
+    outputs:
+      is_first_time: ${{ steps.resolve.outputs.is_first_time }}
+      should_scan: ${{ steps.resolve.outputs.should_scan }}
+    steps:
+      - name: Check author association
+        id: resolve
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          started_at=$SECONDS
+          # TODO: Remove the retries once privileged API requests are confirmed
+          # to return the association immediately.
+          for delay in 0 15 30 60; do
+            sleep "$delay"
+            association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
+              --jq '.author_association')
+            elapsed=$((SECONDS - started_at))
+            echo "Author association after ${elapsed}s: $association"
+
+            case "$association" in
+              FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
+                echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              CONTRIBUTOR)
+                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              NONE)
+                ;;
+              COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
+                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=false' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              *)
+                echo "Unexpected author association: $association" >&2
+                exit 1
+                ;;
+            esac
+          done
+
+          # NONE is unresolved, not trusted. Scan without posting the welcome.
+          echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+          echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+
+  guidance:
+    name: Apply contributor guidance
+    needs: contributor
+    if: needs.contributor.outputs.should_scan == 'true'
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Scan contributor activity
+        id: agentscan
+        # The welcome should still be posted if this advisory scan fails.
+        continue-on-error: true
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
+        with:
+          github-token: ${{ github.token }}
+          mode: labels
+          scan-pull-requests: true
+          scan-issues: false
+          auto-close: false
+          honeypot: false
+
+      - name: Comment with contributor guidance
+        env:
+          ADD_CAUTION: >-
+            ${{
+              steps.agentscan.outputs.classification == 'mixed' ||
+              steps.agentscan.outputs.classification == 'automation' ||
+              steps.agentscan.outputs['community-flagged'] == 'true'
+            }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IS_FIRST_TIME: ${{ needs.contributor.outputs.is_first_time }}
+          NUMBER: ${{ github.event.pull_request.number }}
+          WELCOME_MESSAGE: >2-
+              Welcome to Node.js, and thank you for your first contribution!
+
+            Before review, please take a moment to read:
+
+              * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md)
+              * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md)
+              * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md)
+              * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md)
+              * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
+
+            Please make sure every commit is
+            [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit).
+            For a first pull request, GitHub Actions require collaborator
+            approval and Jenkins CI must be started by a collaborator or triager,
+            so an initial wait is normal.
+          CAUTION_MESSAGE: >-
+            > [!CAUTION]
+
+            > AgentScan found account activity patterns that may be consistent with
+            automation. This is a heuristic, not proof that this pull request was
+            opened by an agent or violates policy. AI-assisted contributions are
+            permitted, but automated tooling must not open pull requests without
+            advance approval, and contributors must personally understand, test,
+            verify, and take responsibility for every submitted change. See the
+            [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}),
+            [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md),
+            and
+            [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
+            for additional context.
+        run: |
+          if [[ "$IS_FIRST_TIME" == "true" && "$ADD_CAUTION" == "true" ]]; then
+            body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE"
+          elif [[ "$IS_FIRST_TIME" == "true" ]]; then
+            body="$WELCOME_MESSAGE"
+          elif [[ "$ADD_CAUTION" == "true" ]]; then
+            body="$CAUTION_MESSAGE"
+          else
+            exit 0
+          fi
+
+          printf '%s\n' "$body" |
+            gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 92c9f3b88217..7a73d69b70ec 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index e97b759bc6a4..79c6eaaebc91 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
index d0236cd7d609..5da225b17127 100644
--- a/.github/workflows/coverage-windows.yml
+++ b/.github/workflows/coverage-windows.yml
@@ -72,7 +72,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
index 883bb48b0df2..735b15ffd12f 100644
--- a/.github/workflows/create-release-proposal.yml
+++ b/.github/workflows/create-release-proposal.yml
@@ -33,14 +33,14 @@ jobs:
       RELEASE_LINE: ${{ inputs.release-line }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ env.STAGING_BRANCH }}
           persist-credentials: false
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 8dda0ff75d6e..043de271faa9 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -50,7 +50,7 @@ jobs:
         run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-arm64"))][0].version')" >> $GITHUB_ENV
       - name: Install Node.js
         id: setup-node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NIGHTLY || matrix.node-version }}
           check-latest: true
@@ -62,7 +62,7 @@ jobs:
           SHORT_SHA=$(node -p 'process.version.split(/-nightly\d{8}/)[1]')
           echo "NIGHTLY_REF=$(gh api /repos/nodejs/node/commits/$SHORT_SHA --jq '.sha')" >> $GITHUB_ENV
       - name: Checkout ${{ steps.setup-node.outputs.node-version }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ env.NIGHTLY_REF || steps.setup-node.outputs.node-version }}
@@ -78,7 +78,7 @@ jobs:
         run: rm -rf wpt
         working-directory: test/fixtures
       - name: Checkout epochs/daily WPT
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: web-platform-tests/wpt
           persist-credentials: false
@@ -109,7 +109,7 @@ jobs:
       # version-specific checkout above overwrites .github/actions/
       - name: Checkout undici WPT actions
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           sparse-checkout: |
             .github/actions/undici-wpt-current
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 6c4b2ec9a4be..b7a616e2df5d 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -16,11 +16,11 @@ jobs:
     if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build lto
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 6e5dfe732646..693d9ad3dd24 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -24,11 +24,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build
diff --git a/.github/workflows/find-inactive-collaborators.yml b/.github/workflows/find-inactive-collaborators.yml
index e6e0c7f54f69..8c74fda22428 100644
--- a/.github/workflows/find-inactive-collaborators.yml
+++ b/.github/workflows/find-inactive-collaborators.yml
@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/find-inactive-tsc.yml b/.github/workflows/find-inactive-tsc.yml
index c1804b78d378..d59f26b73b2b 100644
--- a/.github/workflows/find-inactive-tsc.yml
+++ b/.github/workflows/find-inactive-tsc.yml
@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Clone nodejs/TSC repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           path: .tmp
@@ -34,7 +34,7 @@ jobs:
           repository: nodejs/TSC
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/license-builder.yml b/.github/workflows/license-builder.yml
index a95ee13c45f4..3bdf3fc31dcc 100644
--- a/.github/workflows/license-builder.yml
+++ b/.github/workflows/license-builder.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - run: ./tools/license-builder.sh  # Run the license builder tool
diff --git a/.github/workflows/lint-release-proposal.yml b/.github/workflows/lint-release-proposal.yml
index e8ffab178458..027aee336ace 100644
--- a/.github/workflows/lint-release-proposal.yml
+++ b/.github/workflows/lint-release-proposal.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 2
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index 6917eb995c9e..848fffc117a1 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -25,11 +25,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint addon docs
@@ -38,7 +38,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -52,12 +52,12 @@ jobs:
     if: ${{ github.event.pull_request && github.event.pull_request.draft == false && github.base_ref == github.event.repository.default_branch }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -89,11 +89,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint JavaScript files
@@ -137,7 +137,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -163,7 +163,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -186,7 +186,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -202,7 +202,7 @@ jobs:
     # cannot use ubuntu-24.04-arm here because the docker image is x86 only
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f
@@ -212,7 +212,7 @@ jobs:
     if: ${{ github.event.pull_request }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -227,7 +227,7 @@ jobs:
   lint-readme:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index ed25798152e3..a56cea0936c4 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -45,7 +45,7 @@ jobs:
     name: '${{ matrix.system }}: dependencies diff'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -54,7 +54,7 @@ jobs:
             tools/nix/
           sparse-checkout-cone-mode: false
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -103,12 +103,12 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: '*.nix'
           sparse-checkout-cone-mode: false
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
       - name: Lint Nix files
         run: |
           nix-shell -I nixpkgs=./tools/nix/pkgs.nix -p 'nixfmt-tree' --run '
diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index e709df93a8d7..16bd91bccd2a 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -32,12 +32,15 @@ jobs:
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
   validateCommitMessage:
+    # If a commit is force-pushed out of the main branch, the `commits` array is
+    # empty and there are no checks to run.
+    if: github.event.commits[0]
     name: Notify on Push on `main` with invalid message
     # cannot use ubuntu-slim here because rtCamp/action-slack-notify is dockerized
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commits
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f84c91e1a381..5042342ca70c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 6f1e75813915..1c93d4ba3dda 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -54,7 +54,7 @@ jobs:
       SCCACHE_GHA_ENABLED: 'true'
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index 7052f014b200..08677618b3d6 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -47,7 +47,7 @@ jobs:
     if: (github.event_name == 'schedule' && github.repository == 'nodejs/node') || (github.event.pull_request && github.event.pull_request.draft == false)
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml
new file mode 100644
index 000000000000..70a92202c1c7
--- /dev/null
+++ b/.github/workflows/test-linux-perfetto.yml
@@ -0,0 +1,70 @@
+name: Test Linux (with Perfetto)
+
+on:
+  workflow_dispatch:
+  pull_request:
+    # Only targeting paths specific to the vendored version of Perfetto, `test-shared`
+    # is taking care of rest of the coverage.
+    paths:
+      - .github/workflows/test-linux-perfetto.yml
+      - common.gypi
+      - configure.py
+      - deps/perfetto/**
+      - node.gyp
+      - node.gypi
+      - tools/v8_gypfiles/v8.gyp
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: '3.14'
+  FLAKY_TESTS: keep_retrying
+  CLANG_VERSION: '19'
+  CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
+  CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++-19
+  SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
+  SCCACHE_IDLE_TIMEOUT: '0'
+  RUSTC_VERSION: '1.86'
+
+permissions:
+  contents: read
+
+jobs:
+  test-perfetto:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+          path: node
+      - name: Install Clang ${{ env.CLANG_VERSION }}
+        uses: ./node/.github/actions/install-clang
+        with:
+          clang-version: ${{ env.CLANG_VERSION }}
+      - name: Install Rust ${{ env.RUSTC_VERSION }}
+        run: |
+          rustup override set "$RUSTC_VERSION"
+          rustup --version
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          allow-prereleases: true
+      - name: Set up sccache
+        if: github.base_ref == 'main' || github.ref_name == 'main'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
+        with:
+          version: v0.17.0
+      - name: Build
+        working-directory: node
+        run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --with-perfetto"
+      - name: Test
+        working-directory: node
+        run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"
+      - name: Ensure running tests did not cause any change in the tree
+        working-directory: node
+        run: git add -A && git diff --name-only --exit-code --staged
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
index e1a05cf91859..70aa8d9b04d1 100644
--- a/.github/workflows/test-linux-quic.yml
+++ b/.github/workflows/test-linux-quic.yml
@@ -47,7 +47,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index 7681a176139d..408371f3313c 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -60,7 +60,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index c53bcde2851c..6954112115ef 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -85,7 +85,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 8a04fe4d74fc..f7483103016f 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -29,10 +29,13 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -82,10 +85,13 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -117,7 +123,7 @@ jobs:
     name: ${{ github.event_name == 'workflow_dispatch' && 'Skipped job' || 'Build slim tarball' }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -184,7 +190,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml
index 94961f8ae6ed..481c20da4e05 100644
--- a/.github/workflows/timezone-update.yml
+++ b/.github/workflows/timezone-update.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout nodejs/node
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout unicode-org/icu-data
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: icu-data
           persist-credentials: false
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index e80b65315a4a..097902102685 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -316,7 +316,7 @@ jobs:
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         with:
           persist-credentials: false
@@ -330,7 +330,7 @@ jobs:
           allow-prereleases: true
       - name: Set up Nix
         if: matrix.id == 'nixpkgs-unstable' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
       - run: ${{ matrix.run }}
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         env:
diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 49f0006526b0..10eb3289a1f7 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -15,7 +15,7 @@ jobs:
     # Cannot use ubuntu-slim here because the update script requires Docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Check and download new OpenSSL version
diff --git a/.github/workflows/update-v8.yml b/.github/workflows/update-v8.yml
index e365cf770174..8e71e563896b 100644
--- a/.github/workflows/update-v8.yml
+++ b/.github/workflows/update-v8.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Cache node modules and update-v8
@@ -30,7 +30,7 @@ jobs:
             ~/.npm
           key: ${{ runner.os }}-build-${{ env.cache-name }}
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
diff --git a/.github/workflows/update-wpt.yml b/.github/workflows/update-wpt.yml
index 4f752cc18985..7b59a2f137f3 100644
--- a/.github/workflows/update-wpt.yml
+++ b/.github/workflows/update-wpt.yml
@@ -27,12 +27,12 @@ jobs:
         subsystem: ${{ fromJSON(github.event.inputs.subsystems || '["url", "urlpattern", "WebCryptoAPI"]') }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.gitignore b/.gitignore
index 2a7ce3337021..9277cdf090f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -121,6 +121,7 @@ tools/*/*.i.tmp
 /*.xml
 /v8*-tap.json
 /node_trace.*.log
+/node_trace.*.pftrace
 # coverage related
 /gcovr
 /build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 617be56138e2..91690bacc4ff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.9.0">26.9.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.6.0">26.6.0</a><br/>
diff --git a/LICENSE b/LICENSE
index 9cc3315dd388..67cd2feb69a9 100644
--- a/LICENSE
+++ b/LICENSE
@@ -2600,29 +2600,6 @@ The externally maintained libraries used by Node.js are:
     WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
   """
 
-- large_pages, located at src/large_pages, is licensed as follows:
-  """
-     Copyright (C) 2018 Intel Corporation
-
-     Permission is hereby granted, free of charge, to any person obtaining a copy
-     of this software and associated documentation files (the "Software"),
-     to deal in the Software without restriction, including without limitation
-     the rights to use, copy, modify, merge, publish, distribute, sublicense,
-     and/or sell copies of the Software, and to permit persons to whom
-     the Software is furnished to do so, subject to the following conditions:
-
-     The above copyright notice and this permission notice shall be included
-     in all copies or substantial portions of the Software.
-
-     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-     OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
-     THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
-     OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-     ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-     OR OTHER DEALINGS IN THE SOFTWARE.
-  """
-
 - caja, located at lib/internal/freeze_intrinsics.js, is licensed as follows:
   """
      Adapted from SES/Caja - Copyright (C) 2011 Google Inc.
diff --git a/Makefile b/Makefile
index 4da0900c6fca..afa55b2da33e 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,8 @@
 
 BUILDTYPE ?= Release
 PYTHON ?= python3
+RUFF ?= tools/pip/site-packages/bin/ruff
+YAMLLINT ?= tools/pip/site-packages/bin/yamllint
 DESTDIR ?=
 SIGN ?=
 PREFIX ?= /usr/local
@@ -881,6 +883,11 @@ else ifeq ($(OSTYPE),os400)
 # TODO(@nodejs/web-infra): IBMi is currently hanging during HTML minification
 $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json:
 	@echo "Skipping $@ (not currently supported by $(OSTYPE) machines)"
+else ifeq ($(ARCHTYPE),riscv64)
+# Many riscv64 environments (except qemu) fail on the wasm steps here
+# https://github.com/nodejs/build/issues/4099#issuecomment-4038743335
+$(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json:
+	@echo "Skipping $@ (not currently supported by $(DESTCPU) machines)"
 else
 $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json &: $(apidoc_sources) tools/doc/node_modules | out/doc/api
 	@if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \
@@ -1312,10 +1319,13 @@ ifeq ($(SKIP_SHARED_DEPS), 1)
 	$(RM) -r $(TARNAME)/deps/ngtcp2
 	find $(TARNAME)/deps/openssl -maxdepth 1 -type f ! -name 'nodejs-openssl.cnf' -exec $(RM) {} +
 	find $(TARNAME)/deps/openssl -mindepth 1 -maxdepth 1 -type d -exec $(RM) -r {} +
+	$(RM) -r $(TARNAME)/deps/perfetto
 	$(RM) -r $(TARNAME)/deps/simdjson
 	$(RM) -r $(TARNAME)/deps/sqlite
 	$(RM) -r $(TARNAME)/deps/uv
 	$(RM) -r $(TARNAME)/deps/uvwasi
+	$(RM) -r $(TARNAME)/deps/v8/third_party/abseil-cpp
+	$(RM) -r $(TARNAME)/deps/v8/third_party/highway
 	$(RM) -r $(TARNAME)/deps/zlib
 	$(RM) -r $(TARNAME)/deps/zstd
 else
@@ -1528,7 +1538,8 @@ format-md: tools/lint-md/node_modules/remark-parse/package.json ## Format the ma
 LINT_JS_TARGETS = eslint.config.mjs benchmark doc lib test tools
 
 run-lint-js = tools/eslint/node_modules/eslint/bin/eslint.js --cache \
-	--max-warnings=0 --report-unused-disable-directives $(LINT_JS_TARGETS)
+	--max-warnings=0 --report-unused-disable-directives \
+	--concurrency auto $(LINT_JS_TARGETS)
 run-lint-js-fix = $(run-lint-js) --fix
 
 tools/eslint/node_modules/eslint/bin/eslint.js: tools/eslint/package-lock.json
@@ -1555,7 +1566,7 @@ jslint: lint-js
 
 run-lint-js-ci = tools/eslint/node_modules/eslint/bin/eslint.js \
   --max-warnings=0 --report-unused-disable-directives -f tap \
-	-o test-eslint.tap $(LINT_JS_TARGETS)
+  --concurrency auto -o test-eslint.tap $(LINT_JS_TARGETS)
 
 .PHONY: lint-js-ci
 # On the CI the output is emitted in the TAP format.
@@ -1693,15 +1704,15 @@ lint-py-build: ## Build resources needed to lint python files.
 		$(PYTHON) -m pip install --upgrade --system --target tools/pip/site-packages ruff==0.13.1
 
 .PHONY: lint-py lint-py-fix lint-py-fix-unsafe
-ifneq ("","$(wildcard tools/pip/site-packages/ruff)")
+ifneq ("","$(wildcard $(RUFF))")
 # Lint the Python code with ruff.
 lint-py:
 	$(info Running Python linter...)
-	tools/pip/site-packages/bin/ruff check .
+	$(RUFF) check .
 lint-py-fix:
-	tools/pip/site-packages/bin/ruff check . --fix
+	$(RUFF) check . --fix
 lint-py-fix-unsafe:
-	tools/pip/site-packages/bin/ruff check . --fix --unsafe-fixes
+	$(RUFF) check . --fix --unsafe-fixes
 else
 lint-py lint-py-fix lint-py-fix-unsafe:
 	$(warning Python linting with ruff is not available)
@@ -1717,14 +1728,15 @@ lint-yaml-build: ## Build resources needed to lint YAML files.
 		$(PYTHON) -m pip install --upgrade --system -t tools/pip/site-packages yamllint
 
 .PHONY: lint-yaml
+ifneq ("","$(wildcard $(YAMLLINT))")
 lint-yaml: ## Lint the YAML files with yamllint.
-	@if [ -d "tools/pip/site-packages/yamllint" ]; then \
-			$(info Running YAML linter...) \
-			PYTHONPATH=tools/pip $(PYTHON) -m yamllint .; \
-	else \
-		echo 'YAML linting with yamllint is not available'; \
-		echo "Run 'make lint-yaml-build'"; \
-	fi
+	$(info Running YAML linter...)
+	PYTHONPATH=tools/pip $(YAMLLINT) .
+else
+lint-yaml:
+	$(warning YAML linting with yamllint is not available)
+	$(warning Run 'make lint-yaml-build')
+endif
 
 .PHONY: lint
 .PHONY: lint-ci
diff --git a/README.md b/README.md
index 3827556a44fb..0376c0e9814c 100644
--- a/README.md
+++ b/README.md
@@ -800,7 +800,6 @@ that server.
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
 gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
 gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
 gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
diff --git a/SECURITY.md b/SECURITY.md
index b4239f5fda4e..17d35fd4432f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -124,12 +124,12 @@ This policy recognizes that experimental platforms may not compile, may not
 pass the test suite, and do not have the same level of testing and support
 infrastructure as Tier 1 and Tier 2 platforms.
 
-### Experimental features behind compile-time flags and V8 flags
+### Experimental features behind compile-time flags, experimental runtime flags, and V8 flags
 
 Node.js includes certain experimental features that are only available when
-Node.js is compiled with specific flags. These features are intended for
-development, debugging, or testing purposes and are not enabled in official
-releases.
+Node.js is compiled with specific flags or that are only enabled with experimental
+runtime flags. These features are intended for development, debugging, or testing
+purposes and are not enabled or supported in official releases.
 
 Node.js may also expose V8 features that are controlled by V8 command-line flags
 (e.g., `--js-staging`, `--max_old_space_size`). These flags
@@ -137,8 +137,30 @@ enable or modify V8-level JavaScript engine behavior that is not part of the
 ECMAScript specification that Node.js implements and is not part of the
 Node.js documented API surface.
 
+#### Runtime gated experimental features
+
+Experimental features behind runtime flags can fall into one of three
+[categories](https://github.com/nodejs/node/blob/main/doc/api/documentation.md?rgh-link-date=2026-08-21T20%3A28%3A33.000Z#stability-index):
+
+* 1.0 - Early development.
+* 1.1 - Active development.
+* 1.2 - Release candidate.
+
+Security vulnerabilities that only affect experimental features in either the
+1.0 or 1.1 stages, and that are gated with an `--experimental-*` runtime flag
+requiring explicit opt-in by the user to enable, will **not** be accepted as
+valid security issues unless the vulnerability can be exploited in a way that
+impacts the security of a stable feature when the associated `--experimental-*`
+flag is **not enabled**.
+
+Security vulnerabilities that affect experimental features in the 1.2 stage are
+acceptable as valid security issues.
+
+#### Compile-time gated experimental features and V8 flags
+
 * Security vulnerabilities that only affect features behind compile-time flags
-  or V8 flags will **not** be accepted as valid security issues.
+  or V8 flags _that are not enabled by default_ will **not** be accepted as valid
+  security issues.
 * Any issues with these features will be treated as normal bugs.
 * No CVEs will be issued for issues that only affect compile-time flag or V8 flag features.
 * Bug bounty rewards are not available for compile-time flag or V8 flag feature issues.
@@ -151,6 +173,28 @@ are not part of the Node.js documented API surface, are not enabled by
 default in production builds, and may have incomplete implementations or
 missing security hardening.
 
+### Security triage dispositions
+
+When triaging a report, the project classifies it into one of the following
+dispositions:
+
+* **Vulnerability**: A Node.js defect that is exploitable across a
+  Node.js-owned security boundary and meets the criteria under
+  [What constitutes a vulnerability](#what-constitutes-a-vulnerability),
+  including any applicable DoS criteria.
+* **Security-interest bug**: A real Node.js defect, or an API behavior likely
+  to cause security bugs in applications, that is not itself a vulnerability
+  under this threat model. These are fixed as regular bugs and do not
+  automatically receive a CVE, but should still be reported privately first
+  when they affect a common security control such as protocol interpretation,
+  permission enforcement, or certificate/TLS decisions.
+* **Common bug**: A correctness, robustness, or crash issue without a
+  Node.js-owned security boundary or a realistic cross-boundary attacker benefit.
+* **Invalid / out of scope**: A bug report that meets one of these criteria:
+  * Cannot be reproduced
+  * Is not a Node.js defect (e.g., an application bug)
+  * Is excluded by policy (e.g., experimental features)
+
 ### What constitutes a vulnerability
 
 Being able to cause the following through control of the elements that Node.js
@@ -329,6 +373,19 @@ the community they pose.
 * Code is trusted by Node.js. Therefore any scenario that requires a malicious
   third-party module cannot result in a vulnerability in Node.js.
 
+#### Same-process self-harm
+
+* Node.js trusts the code it is asked to run. A defect that can only be
+  triggered by JavaScript, WASM, native, addon, FFI, or dependency code already
+  executing in the target process is not a Node.js vulnerability merely because
+  that code can crash, corrupt, or confuse the process it already controls.
+  This includes forging an internal handle, reflecting or overwriting an
+  internal `Symbol()`, installing a `Symbol.hasInstance` hook, or reaching into
+  an internal binding.
+* Such issues may still be fixed as common bugs. They become vulnerabilities
+  only if the same defect is reachable from an element Node.js does not trust
+  without relying on an application-created boundary.
+
 #### Prototype Pollution Attacks (CWE-1321)
 
 * Node.js trusts the inputs provided to it by application code.
@@ -445,6 +502,21 @@ resources a Node.js process may access. It is designed to reduce the blast
 radius of mistakes in trusted application code, **not** to act as a security
 boundary against intentional misuse or a compromised process.
 
+Permission Model reports are triaged in three lanes:
+
+* **Vulnerability**: An element Node.js does not trust crosses a Node.js-owned
+  permission check without trusted code already executing in the protected
+  process.
+* **Security-interest bug**: Trusted application code uses documented, stable
+  APIs as intended, but Node.js fails to enforce a documented permission
+  invariant consistently — for example, one API enforces a check that an
+  equivalent API omits. These are fixed as hardening and are not automatically
+  CVE-class, because the Permission Model is not a sandbox against malicious
+  same-process code.
+* **Excluded**: Intentional misuse by code already running in the process,
+  operator-selected flags, a modified `execArgv`/`env`, or any expectation that
+  the Permission Model sandboxes malicious same-process code.
+
 The following are **not** vulnerabilities in Node.js:
 
 * **Operator-controlled flags**: Behavior unlocked by flags the operator
@@ -465,9 +537,23 @@ The following are **not** vulnerabilities in Node.js:
   symlinks that resolve within the allowed list are similarly not considered
   permission model bypasses.
 
-* **`worker_threads` with modified `execArgv`**: Workers inherit the permission
-  restrictions of their parent process. Passing an empty or modified `execArgv`
-  to a worker does not grant it additional permissions.
+* **`worker_threads` and the permission model**: Creating a worker is gated by
+  `--allow-worker`. A worker started with a modified `execArgv` or `env` may
+  start without inheriting the parent's permission configuration, so the
+  permission model does not reliably propagate to such workers. Because worker
+  creation already requires `--allow-worker`, and the Permission Model is not a
+  sandbox against intentional misuse by trusted code, this is not considered a
+  vulnerability. Applications that rely on the Permission Model must not grant
+  `--allow-worker` to code they do not trust.
+
+#### QUIC and HTTP/3
+
+The experimental QUIC and HTTP/3 implementation in Node.js is a complex new
+protocol stack and API that is still under active development and should not be
+used for production workloads. Reports that only affect QUIC or HTTP/3 are not
+considered Node.js vulnerabilities at this time. It is expected that the QUIC
+and HTTP/3 implementation will continue to evolve, and security issues will be
+addressed as the implementation matures.
 
 #### Virtual File System (`node:vfs`)
 
@@ -505,12 +591,6 @@ vulnerability. Node.js validates the structure of Early Hints per the HTTP spec
 but does not sanitize free-form application data passed to it; that is the
 application's responsibility.
 
-## Assessing experimental features reports
-
-Experimental features are eligible for security reports just like any other
-stable feature of Node.js. They may also receive the same severity score that a
-stable feature would.
-
 ## Receiving security updates
 
 Security notifications will be distributed via the following methods.
diff --git a/benchmark/README.md b/benchmark/README.md
index 2f52a44f251a..78a55fba453f 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -10,6 +10,7 @@ directory, see [the guide on benchmarks](../doc/contributing/writing-and-running
 ## Table of Contents
 
 * [File tree structure](#file-tree-structure)
+* [`node:bench` evaluation tools](#nodebench-evaluation-tools)
 * [Common API](#common-api)
 
 ## File tree structure
@@ -34,7 +35,7 @@ The actual benchmark scripts should be placed in their corresponding
 directories.
 
 * `_benchmark_progress.js`: implements the progress bar displayed
-  when running `compare.js`
+  when running `compare.js` and `scatter.js`
 * `_cli.js`: parses the command line arguments passed to `compare.js`,
   `run.js` and `scatter.js`
 * `_cli.R`: parses the command line arguments passed to `compare.R`
@@ -44,15 +45,92 @@ directories.
 * `common.js`: see [Common API](#common-api).
 * `compare.js`: command line tool for comparing performance between different
   Node.js binaries.
+* `compare-node-bench.js`: parallel comparison tool for explicit `node:bench`
+  files. It does not change or invoke `compare.js`.
 * `compare.R`: R script for statistically analyzing the output of
   `compare.js`
 * `run.js`: command line tool for running individual benchmark suite(s).
 * `scatter.js`: command line tool for comparing the performance
   between different parameters in benchmark configurations,
-  for example to analyze the time complexity.
+  for example to analyze the time complexity. Pass `--analyze` to
+  summarize the results without R.
+* `scatter-node-bench.js`: parallel scatter-data tool for an explicit
+  `node:bench` file. It does not change or invoke `scatter.js`.
 * `scatter.R`: R script for visualizing the output of `scatter.js` with
   scatter plots.
 
+## `node:bench` evaluation tools
+
+The `compare-node-bench.js` and `scatter-node-bench.js` tools run explicit
+`node:bench` files without changing the existing benchmark framework or its
+tools. Each repeated observation for a benchmark identity is collected by a
+separate process invocation with one measured sample. Benchmarks declared in
+the same file still execute serially in that process and can share JIT, garbage
+collector, heap, and cache state. This differs from legacy configuration-level
+process isolation and must be considered when comparing the frameworks.
+
+Compare two binaries and analyze the compatible CSV using `compare.R`:
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > compare-node-bench.csv
+Rscript benchmark/compare.R < compare-node-bench.csv
+```
+
+Pass `--analyze` to run the same Welch analysis inline. `--max-regression N`
+implies `--analyze` and makes the command fail only when the Holm-Bonferroni
+adjusted one-sided p-value against the `N%` threshold is below 0.05 and the full
+95% confidence interval is worse than `-N%`. Requiring both conditions prevents
+a noisy point estimate from failing a regression gate.
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 \
+  --max-regression 5 -- benchmark/crypto/_create-hash.node-bench.js
+```
+
+Collect parameter data for the parallel buffer benchmark and plot it using
+`scatter.R`:
+
+```console
+./node benchmark/scatter-node-bench.js --node ./node --runs 30 -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js \
+  > scatter-node-bench.csv
+Rscript benchmark/scatter.R --xaxis size --category method \
+  --plot scatter-node-bench.png < scatter-node-bench.csv
+```
+
+Pass `--analyze` with an x-axis parameter to summarize the samples without R.
+The output includes mean and median confidence intervals, skew warnings, an
+optional bar chart, and Mann-Whitney U and Cliff's delta comparisons between
+consecutive x-axis values. Use `--category` for a second grouping parameter and
+`--no-chart` to omit the chart.
+
+Because configurations in one file share a process, inline analysis averages
+aggregated configurations into one value per outer process. Consecutive
+x-axis comparisons use alternating, disjoint process sets so the unpaired
+Mann-Whitney test does not treat correlated values as independent samples.
+
+```console
+./node benchmark/scatter-node-bench.js --runs 30 --analyze \
+  --xaxis size --category method -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js
+```
+
+A file passed to `scatter-node-bench.js` must use one logical benchmark name.
+Parameter values distinguish its configurations. The tool rejects unstable
+identities and names or parameters that would merge unrelated CSV groups.
+
+The underscore-prefixed benchmark files are parallel ports used to compare the
+measurement frameworks. Legacy discovery ignores them, so the original files
+remain the source benchmarks for `run.js`, `compare.js`, and `scatter.js`. The
+ports use the platform-specific original relative filename as their benchmark
+name and preserve parameter column names to keep CSV grouping compatible. For
+a direct framework comparison, collect the same number of runs from an
+original benchmark with `scatter.js` and from its port with
+`scatter-node-bench.js`, then compare their rate distributions.
+
 ## Common API
 
 The common.js module is used by benchmarks for consistency across repeated
diff --git a/benchmark/_node-bench-analysis.js b/benchmark/_node-bench-analysis.js
new file mode 100644
index 000000000000..bf0f7402b791
--- /dev/null
+++ b/benchmark/_node-bench-analysis.js
@@ -0,0 +1,763 @@
+'use strict';
+
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('node:util');
+
+function createRateHistogram(rates, scale, figures) {
+  const histogram = createHistogram({ figures });
+  for (const rate of rates) {
+    const value = Math.max(1, Math.round(rate * scale));
+    if (!Number.isSafeInteger(value)) {
+      throw new RangeError('Benchmark rate is too large for the histogram scale');
+    }
+    histogram.record(value);
+  }
+  return histogram;
+}
+
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, index) => ({ index, p }))
+    .sort((a, b) => a.p - b.p);
+  const adjusted = new Array(order.length);
+  let running = 0;
+  for (let index = 0; index < order.length; index++) {
+    running = Math.max(
+      running,
+      Math.min(1, (order.length - index) * order[index].p),
+    );
+    adjusted[order[index].index] = running;
+  }
+  return adjusted;
+}
+
+function thresholdPValue(oldRates, newHistogram, scale, maxRegression) {
+  const factor = 1 - maxRegression / 100;
+  if (factor <= 0) return 1;
+  const thresholdHistogram = createRateHistogram(
+    oldRates.map((rate) => rate * factor), scale, 3);
+  const result = thresholdHistogram.welchTest(newHistogram);
+  if (Number.isNaN(result.pValue)) return 1;
+  return result.tStatistic > 0 ?
+    result.pValue / 2 : 1 - result.pValue / 2;
+}
+
+function isRegressionFailure(row, maxRegression) {
+  return row.pThresholdAdjusted < 0.05 &&
+         row.improvement + row.ci95 < -maxRegression;
+}
+
+function analyzeCompare(samples, scale, maxRegression) {
+  const groups = new Map();
+  for (const sample of samples) {
+    let group = groups.get(sample.identity);
+    if (group === undefined) {
+      const suffix = sample.configuration === '' ?
+        '' : ` ${sample.configuration}`;
+      group = {
+        name: `${sample.name}${suffix}`,
+        new: [],
+        old: [],
+      };
+      groups.set(sample.identity, group);
+    }
+    group[sample.binary].push(sample.rate);
+  }
+
+  const rows = [];
+  let skipped = 0;
+  for (const { name, old: oldRates, new: newRates } of groups.values()) {
+    if (oldRates.length < 2 || newRates.length < 2) {
+      skipped++;
+      continue;
+    }
+
+    const oldHistogram = createRateHistogram(oldRates, scale, 3);
+    const newHistogram = createRateHistogram(newRates, scale, 3);
+    const oldMean = oldRates.reduce((sum, rate) => sum + rate, 0) /
+      oldRates.length;
+    const newMean = newRates.reduce((sum, rate) => sum + rate, 0) /
+      newRates.length;
+    const improvement = ((newMean - oldMean) / oldMean) * 100;
+    const w95 = oldHistogram.welchTest(newHistogram, { confidence: 0.95 });
+    const w99 = oldHistogram.welchTest(newHistogram, { confidence: 0.99 });
+    const w999 = oldHistogram.welchTest(newHistogram, { confidence: 0.999 });
+    let stars = '';
+    if (w95.pValue < 0.001) stars = '***';
+    else if (w95.pValue < 0.01) stars = ' **';
+    else if (w95.pValue < 0.05) stars = '  *';
+    const ciPercent = (result) => {
+      const half = (result.confidenceInterval.upper -
+                    result.confidenceInterval.lower) / 2;
+      return (half / (oldMean * scale)) * 100;
+    };
+    const row = {
+      ci95: ciPercent(w95),
+      ci99: ciPercent(w99),
+      ci999: ciPercent(w999),
+      improvement,
+      name,
+      pValue: Number.isNaN(w95.pValue) ? 1 : w95.pValue,
+      stars,
+    };
+    if (maxRegression !== undefined) {
+      row.pThreshold = thresholdPValue(
+        oldRates, newHistogram, scale, maxRegression);
+    }
+    rows.push(row);
+  }
+
+  const adjusted = holmAdjust(rows.map(({ pValue }) => pValue));
+  const thresholdAdjusted = maxRegression === undefined ? null :
+    holmAdjust(rows.map(({ pThreshold }) => pThreshold));
+  let underpowered = 0;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    row.pAdjusted = adjusted[index];
+    if (thresholdAdjusted !== null) {
+      row.pThresholdAdjusted = thresholdAdjusted[index];
+    }
+    row.inconclusive = maxRegression > 0 &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > maxRegression;
+    if (row.inconclusive) underpowered++;
+  }
+
+  const output = [];
+  const maxNameLength = rows.reduce(
+    (maximum, { name }) => Math.max(maximum, name.length), 0);
+  const pad = (value, length) =>
+    value + ' '.repeat(Math.max(0, length - value.length));
+  const padStart = (value, length) =>
+    ' '.repeat(Math.max(0, length - value.length)) + value;
+  output.push(`${pad('', maxNameLength)}  confidence` +
+              '   improvement   accuracy (*)    (**)   (***)');
+  for (const row of rows) {
+    const improvement =
+      `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)} %`;
+    output.push(
+      `${pad(row.name, maxNameLength)}  ${pad(row.stars, 10)}` +
+      `  ${padStart(improvement, 11)}` +
+      `   ±${row.ci95.toFixed(2)}%` +
+      `  ±${row.ci99.toFixed(2)}%` +
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}`,
+    );
+  }
+
+  if (skipped > 0) {
+    output.push('');
+    output.push(
+      `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
+      ' skipped because Welch\'s t-test requires at least 2 samples per' +
+      ' binary. Use --runs 2 or higher.',
+    );
+  }
+  printCompareChart(output, rows, maxNameLength);
+
+  output.push('');
+  output.push(
+    `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).`,
+    'Use --scale to adjust precision if needed.',
+    '',
+  );
+  const significant = rows.filter(({ pAdjusted }) => pAdjusted < 0.05).length;
+  output.push(
+    'The confidence markers above are per-benchmark and uncorrected. ' +
+    `After Holm-Bonferroni correction across ${rows.length} comparison` +
+    `${rows.length === 1 ? '' : 's'}, ${significant} remain` +
+    `${significant === 1 ? 's' : ''} significant at 5%.`,
+  );
+  if (maxRegression !== undefined) {
+    output.push(
+      `For --max-regression, one-sided p-values against the ` +
+      `${maxRegression}% threshold were corrected separately.`,
+    );
+  }
+
+  if (maxRegression > 0 && underpowered > 0) {
+    output.push('');
+    output.push(
+      `Note: ${underpowered} of ${rows.length} comparison` +
+      `${rows.length === 1 ? '' : 's'} could not resolve an effect as small ` +
+      `as ${maxRegression}% and are marked (inconclusive). Raise --runs to ` +
+      'narrow their confidence intervals.',
+    );
+  }
+
+  const failures = maxRegression !== undefined ?
+    rows.filter((row) => isRegressionFailure(row, maxRegression)) : [];
+  if (failures.length > 0) {
+    output.push('');
+    output.push(
+      `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
+      ` regressed by more than ${maxRegression}% (the 95% interval excludes ` +
+      `the threshold and its one-sided test is family-wise corrected across ` +
+      `${rows.length} comparisons):`,
+    );
+    for (const failure of failures) {
+      output.push(
+        `  ${failure.name}  ${failure.improvement.toFixed(2)}% ` +
+        `(95% CI up to ${(failure.improvement + failure.ci95).toFixed(2)}%, ` +
+        `adjusted threshold p=` +
+        `${failure.pThresholdAdjusted.toExponential(2)})`,
+      );
+    }
+  }
+
+  return {
+    failed: failures.length > 0,
+    output: `${output.join('\n')}\n`,
+    rows,
+  };
+}
+
+function printCompareChart(output, rows, maxNameLength) {
+  if (rows.length === 0) return;
+  const width = 40;
+  const halfWidth = width / 2;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(maximum, Math.abs(row.improvement) + row.ci95);
+  }
+  if (maximum === 0) maximum = 1;
+  const left = `-${maximum.toFixed(1)}%`;
+  const right = `+${maximum.toFixed(1)}%`;
+  const centerLabel = '0%';
+  const labelPadding = maxNameLength + 5;
+  output.push('');
+  output.push(
+    ' '.repeat(labelPadding) + left +
+    ' '.repeat(Math.max(
+      0, halfWidth - left.length - Math.floor(centerLabel.length / 2))) +
+    centerLabel +
+    ' '.repeat(Math.max(
+      0, halfWidth - Math.ceil(centerLabel.length / 2) - right.length)) +
+    right,
+  );
+  for (const row of rows) {
+    const center = halfWidth;
+    const result = center + (row.improvement / maximum) * halfWidth;
+    const lower = center +
+      ((row.improvement - row.ci95) / maximum) * halfWidth;
+    const upper = center +
+      ((row.improvement + row.ci95) / maximum) * halfWidth;
+    let bar = '';
+    for (let index = 0; index < width; index++) {
+      const position = index + 0.5;
+      if (index === Math.floor(center)) {
+        bar += '|';
+      } else if ((row.improvement >= 0 &&
+                  position > center && position <= result) ||
+                 (row.improvement < 0 &&
+                  position < center && position >= result)) {
+        bar += row.stars === '' ? '▓' : '█';
+      } else if (position >= lower && position <= upper) {
+        bar += '░';
+      } else {
+        bar += ' ';
+      }
+    }
+    const label = `${row.improvement >= 0 ? '+' : ''}` +
+      `${row.improvement.toFixed(2)}%`;
+    output.push(
+      `${row.name.padEnd(maxNameLength)}  ${bar}  ${label} ${row.stars.trim()}`,
+    );
+  }
+}
+
+function histogramScale(rates) {
+  let minimum = Infinity;
+  let maximum = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < minimum) minimum = rate;
+    if (rate > maximum) maximum = rate;
+  }
+  if (!Number.isFinite(minimum) || maximum === 0) return 1;
+  let scale = 1;
+  while (minimum * scale < 1e6 && maximum * scale < 1e15) scale *= 10;
+  return scale;
+}
+
+function validateScatterParameters(samples, xAxis, category) {
+  if (category !== undefined && category === xAxis) {
+    throw new Error('--xaxis and --category must name different parameters');
+  }
+  for (const key of [xAxis, category]) {
+    if (key === undefined) continue;
+    if (samples.some(({ params }) =>
+      !Object.hasOwn(params, key))) {
+      const available = [...new Set(samples.flatMap(
+        ({ params }) => Object.keys(params)))].sort();
+      throw new Error(
+        `The variable '${key}' is not present in every configuration. ` +
+        `Available variables: ${available.join(', ')}`,
+      );
+    }
+  }
+}
+
+function analyzeScatter(samples, xAxis, category, showChart) {
+  validateScatterParameters(samples, xAxis, category);
+
+  const parameterNames = [...new Set(samples.flatMap(
+    ({ params }) => Object.keys(params)))];
+  const aggregated = parameterNames.filter((name) => {
+    if (name === xAxis || name === category) return false;
+    const first = samples[0].params[name];
+    return samples.some(({ params }) => params[name] !== first);
+  });
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.params[xAxis];
+    const categoryValue = category === undefined ?
+      undefined : sample.params[category];
+    const key = valueKey([xValue, categoryValue]);
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = {
+        categoryValue,
+        members: [],
+        observations: new Map(),
+        xValue,
+      };
+      groups.set(key, group);
+    }
+    group.members.push(sample);
+    let rates = group.observations.get(sample.observation);
+    if (rates === undefined) {
+      rates = [];
+      group.observations.set(sample.observation, rates);
+    }
+    rates.push(sample.rate);
+  }
+  for (const group of groups.values()) {
+    group.processRates = [...group.observations].map(([observation, rates]) => ({
+      observation,
+      rate: rates.reduce((sum, rate) => sum + rate, 0) / rates.length,
+    }));
+    group.rates = group.processRates.map(({ rate }) => rate);
+  }
+
+  const scale = histogramScale(samples.map(({ rate }) => rate));
+  const compareValues = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+  const rows = [...groups.values()]
+    .sort((a, b) => compareValues(a.xValue, b.xValue) ||
+                    compareValues(a.categoryValue, b.categoryValue))
+    .map((group) => {
+      const histogram = createRateHistogram(group.rates, scale, 5);
+      const count = group.rates.length;
+      const mean = group.rates.reduce((sum, rate) => sum + rate, 0) / count;
+      const meanInterval = histogram.meanCI();
+      const confidenceInterval = count > 1 ?
+        (meanInterval.upper - meanInterval.lower) / (2 * scale) : NaN;
+      const medianInterval = histogram.percentileCI(50);
+      const median = rawMedian(group.rates);
+      const skewed = count > 1 &&
+        (Math.abs(histogram.skewness) > 1 ||
+         Math.abs(median - mean) > confidenceInterval);
+      return {
+        ...group,
+        confidenceInterval,
+        count,
+        histogram,
+        mean,
+        median,
+        medianLower: medianInterval.lower / scale,
+        medianUpper: medianInterval.upper / scale,
+        skewed,
+      };
+    });
+
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'categoryValue', 'categoryLabel'));
+  }
+  const output = [];
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    const share = varianceShare([...groups.values()], variable);
+    contamination.set(variable, share);
+    const percent = share === 1 ?
+      '100' : (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' : ` (explains ${percent}% of within-group variance)`;
+    output.push(`aggregating variable: ${variable}${suffix}`);
+  }
+  const dominant = aggregated.filter(
+    (variable) => contamination.get(variable) > 0.5);
+  if (dominant.length > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `${dominant.join(', ')} ${dominant.length === 1 ? 'explains' : 'explain'} ` +
+      'most of the spread within each group. Pin the parameter or use it as ' +
+      '--category; increasing --runs will not remove this source of variance.',
+    );
+  }
+  if (aggregated.length > 0) output.push('');
+  printScatterTable(output, rows, xAxis, category);
+  if (showChart) printScatterChart(output, rows, xAxis, category);
+  printScatterComparisons(output, rows, xAxis, category);
+  if (legend.length > 0) {
+    output.push('', 'Abbreviated values:');
+    for (const { full, label } of legend) {
+      output.push(`  ${label}`, `    = ${full}`);
+    }
+  }
+  const singleSample = rows.filter(({ count }) => count < 2).length;
+  if (singleSample > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      'only one sample, so no confidence interval could be estimated. Use ' +
+      '--runs 2 or higher.',
+    );
+  }
+  if (rows.some(({ skewed }) => skewed)) {
+    output.push('');
+    wrapOutput(
+      output,
+      '(!) marks groups where the median falls outside the mean confidence ' +
+      'interval or the sample is strongly skewed. The median and its interval ' +
+      'describe the typical run better for those groups.',
+    );
+  }
+  return `${output.join('\n')}\n`;
+}
+
+function rawMedian(rates) {
+  const sorted = [...rates].sort((a, b) => a - b);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+}
+
+function valueKey(value) {
+  return JSON.stringify(value, (_, item) => {
+    if (typeof item === 'bigint') return { bigint: String(item) };
+    return item;
+  });
+}
+
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+  for (const group of groups) {
+    if (group.members.length < 2) continue;
+    const mean = group.members.reduce(
+      (sum, sample) => sum + sample.rate, 0) / group.members.length;
+    const levels = new Map();
+    for (const sample of group.members) {
+      const key = valueKey(sample.params[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { count: 0, sum: 0 };
+        levels.set(key, level);
+      }
+      level.count++;
+      level.sum += sample.rate;
+    }
+    for (const level of levels.values()) {
+      between += level.count * ((level.sum / level.count) - mean) ** 2;
+    }
+    for (const sample of group.members) total += (sample.rate - mean) ** 2;
+  }
+  return total === 0 ? NaN : Math.min(1, between / total);
+}
+
+function effectSizeLabel(delta) {
+  const absolute = Math.abs(delta);
+  if (absolute < 0.147) return 'negligible';
+  if (absolute < 0.33) return 'small';
+  if (absolute < 0.474) return 'medium';
+  return 'large';
+}
+
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(firstCount, secondCount) {
+  const key = `${firstCount},${secondCount}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor !== undefined) return floor;
+  const low = createHistogram({ figures: 5 });
+  const high = createHistogram({ figures: 5 });
+  for (let index = 0; index < firstCount; index++) low.record(10000 + index);
+  for (let index = 0; index < secondCount; index++) {
+    high.record(10000 + firstCount + index);
+  }
+  floor = high.mannWhitneyTest(low).pValue;
+  mannWhitneyFloors.set(key, floor);
+  return floor;
+}
+
+function printScatterComparisons(output, rows, xAxis, category) {
+  const usable = rows.filter(({ count }) => count > 1);
+  if (usable.length < 2) return;
+  const series = new Map();
+  for (const row of usable) {
+    const key = valueKey(row.categoryValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+  const sections = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+    const entries = [];
+    for (let index = 1; index < group.length; index++) {
+      const previous = group[index - 1];
+      const current = group[index];
+      // Configurations in one file share a process. Split consecutive groups
+      // across disjoint outer-process sets so the unpaired test does not treat
+      // correlated observations as independent.
+      const parity = index % 2;
+      const previousRates = previous.processRates
+        .filter(({ observation }) => observation % 2 === parity)
+        .map(({ rate }) => rate);
+      const currentRates = current.processRates
+        .filter(({ observation }) => observation % 2 !== parity)
+        .map(({ rate }) => rate);
+      if (previousRates.length === 0 || currentRates.length === 0) continue;
+      const comparisonScale = histogramScale([
+        ...previousRates,
+        ...currentRates,
+      ]);
+      const previousHistogram =
+        createRateHistogram(previousRates, comparisonScale, 5);
+      const currentHistogram =
+        createRateHistogram(currentRates, comparisonScale, 5);
+      const { pValue } = currentHistogram.mannWhitneyTest(previousHistogram);
+      const delta = currentHistogram.cliffsD(previousHistogram);
+      const previousMean = previousRates.reduce(
+        (sum, rate) => sum + rate, 0) / previousRates.length;
+      const currentMean = currentRates.reduce(
+        (sum, rate) => sum + rate, 0) / currentRates.length;
+      const change = ((currentMean - previousMean) / previousMean) * 100;
+      floor = Math.max(
+        floor, mannWhitneyFloor(previousRates.length, currentRates.length));
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previousMean > 0 && currentMean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(currentMean / previousMean) / Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+      entries.push(
+        `    ${previous.xLabel} -> ${current.xLabel}` +
+        `  ${change >= 0 ? '+' : ''}${change.toFixed(2)}%` +
+        (exponent === '' ? '' : `  ${ratio}  exponent=${exponent}`) +
+        `  p=${pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4)}` +
+        `  delta=${delta >= 0 ? '+' : ''}${delta.toFixed(3)}` +
+        ` (${effectSizeLabel(delta)})`,
+      );
+    }
+    if (entries.length > 0) {
+      sections.push({
+        entries,
+        heading: category === undefined ?
+          undefined : `${category}=${group[0].categoryLabel}`,
+      });
+    }
+  }
+  if (sections.length === 0) return;
+  output.push('', `Change between consecutive ${xAxis} values ` +
+                  `(Mann-Whitney U on disjoint process sets, Cliff's delta):`);
+  for (const section of sections) {
+    output.push('');
+    if (section.heading !== undefined) output.push(`  ${section.heading}`);
+    output.push(...section.entries);
+  }
+  if (floor >= 0.05) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      'significance. Raise --runs.',
+    );
+  } else if (floor >= 0.005) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. Raise --runs to strengthen non-significant ` +
+      'results.',
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    maximumFractionDigits: 1,
+    minimumFractionDigits: 1,
+  });
+}
+
+function displayWidth(value) {
+  return [...value].length;
+}
+
+function pad(value, width, right) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(value)));
+  return right ? padding + value : value + padding;
+}
+
+function truncateMiddle(value, maximum = 24) {
+  const characters = [...value];
+  if (characters.length <= maximum) return value;
+  const retained = maximum - 3;
+  const head = Math.ceil(retained / 2);
+  const tail = Math.floor(retained / 2);
+  return `${characters.slice(0, head).join('')}...` +
+         characters.slice(-tail).join('');
+}
+
+function assignLabels(rows, valueName, labelName) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+  for (const row of rows) {
+    const key = valueKey(row[valueName]);
+    let label = assigned.get(key);
+    if (label === undefined) {
+      const full = typeof row[valueName] === 'string' ?
+        inspect(row[valueName]) : String(row[valueName]);
+      const abbreviated = truncateMiddle(full);
+      const collisions = used.get(abbreviated) ?? 0;
+      used.set(abbreviated, collisions + 1);
+      label = collisions === 0 ?
+        abbreviated : `${abbreviated}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (label !== full) legend.push({ full, label });
+    }
+    row[labelName] = label;
+  }
+  return legend;
+}
+
+function printScatterTable(output, rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push(
+    'samples', 'rate', 'confidence.interval', 'median', 'median.interval', '');
+  const body = rows.map((row) => {
+    const values = [row.xLabel];
+    if (category !== undefined) values.push(row.categoryLabel);
+    const medianInterval = row.count > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+    values.push(
+      String(row.count),
+      formatRate(row.mean),
+      Number.isNaN(row.confidenceInterval) ?
+        'NA' :
+        `${formatRate(row.confidenceInterval)} ` +
+        `(±${((row.confidenceInterval / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return values;
+  });
+  const widths = header.map((value, index) => Math.max(
+    displayWidth(value),
+    ...body.map((values) => displayWidth(values[index])),
+  ));
+  const right = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    right.push(typeof rows[0].categoryValue === 'number');
+  }
+  right.push(true, true, true, true, true, false);
+  const format = (values) => values.map(
+    (value, index) => pad(value, widths[index], right[index])).join('  ').trimEnd();
+  output.push(format(header));
+  for (const values of body) output.push(format(values));
+}
+
+function printScatterChart(output, rows, xAxis, category) {
+  if (rows.length === 0) return;
+  const width = 40;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(
+      maximum,
+      row.mean + (Number.isNaN(row.confidenceInterval) ?
+        0 : row.confidenceInterval),
+    );
+  }
+  if (maximum === 0) return;
+  const labels = rows.map((row) => {
+    let label = `${xAxis}=${row.xLabel}`;
+    if (category !== undefined) label += ` ${category}=${row.categoryLabel}`;
+    return truncateMiddle(label, 44);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(...rows.map(({ mean }) =>
+    displayWidth(formatRate(mean))));
+  const axis = formatRate(maximum);
+  const indent = ' '.repeat(labelWidth + 2);
+  output.push(
+    '',
+    'Rate in operations/second; longer is faster. │ marks the mean and the',
+    'shaded band (░) is its 95% confidence interval.',
+    '',
+    `${indent}0${' '.repeat(Math.max(1, width - 1 - displayWidth(axis)))}${axis}`,
+    `${indent}+${'-'.repeat(width - 2)}+`,
+  );
+  let previous;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    if (previous !== undefined && previous !== row.xValue) output.push('');
+    previous = row.xValue;
+    const interval = Number.isNaN(row.confidenceInterval) ?
+      0 : row.confidenceInterval;
+    const end = (row.mean / maximum) * width;
+    const lower = ((row.mean - interval) / maximum) * width;
+    const upper = ((row.mean + interval) / maximum) * width;
+    const meanCell = Math.min(width - 1, Math.floor(end));
+    let bar = '';
+    for (let cell = 0; cell < width; cell++) {
+      const position = cell + 0.5;
+      if (cell === meanCell) bar += '│';
+      else if (position >= lower && position <= upper) bar += '░';
+      else if (position <= end) bar += '█';
+      else bar += ' ';
+    }
+    output.push(
+      `${pad(labels[index], labelWidth, false)}  ${bar}  ` +
+      pad(formatRate(row.mean), rateWidth, true),
+    );
+  }
+}
+
+function wrapOutput(output, text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') line = word;
+    else if (displayWidth(line) + displayWidth(word) + 1 <= width) {
+      line += ` ${word}`;
+    } else {
+      output.push(line);
+      line = word;
+    }
+  }
+  if (line !== '') output.push(line);
+}
+
+module.exports = {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+  validateScatterParameters,
+};
diff --git a/benchmark/_node-bench.js b/benchmark/_node-bench.js
new file mode 100644
index 000000000000..6c8d1acffdfa
--- /dev/null
+++ b/benchmark/_node-bench.js
@@ -0,0 +1,159 @@
+'use strict';
+
+const { spawn } = require('node:child_process');
+const path = require('node:path');
+const { inspect } = require('node:util');
+
+function parseInteger(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (!/^(?:0|[1-9]\d*)$/.test(value)) {
+    throw new TypeError(`${name} must be an integer`);
+  }
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function parseNumber(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (value.trim() === '') throw new TypeError(`${name} must be a number`);
+  const number = Number(value);
+  if (!Number.isFinite(number)) throw new TypeError(`${name} must be a number`);
+  if (number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function csvEncode(value) {
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  const string = String(value);
+  return `"${string.replace(/"/g, '""')}"`;
+}
+
+function formatConfiguration(params) {
+  return Object.keys(params)
+    .map((key) => `${key}=${inspect(params[key])}`)
+    .join(' ');
+}
+
+function durationToSeconds(duration) {
+  if (!/^\d+$/.test(duration)) {
+    throw new TypeError(`Invalid benchmark duration '${duration}'`);
+  }
+  const padded = duration.padStart(10, '0');
+  return `${padded.slice(0, -9)}.${padded.slice(-9)}`;
+}
+
+function runBenchmark(binary, file, options) {
+  const args = [
+    ...options.nodeArgs,
+    '--no-warnings',
+    '--bench',
+    '--bench-reporter=json',
+    '--bench-samples=1',
+    `--bench-warmup=${options.warmup}`,
+  ];
+  if (options.namePattern !== undefined) {
+    args.push(`--bench-name-pattern=${options.namePattern}`);
+  }
+  args.push('--', path.resolve(file));
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      env: process.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (data) => { stdout += data; });
+    child.stderr.on('data', (data) => { stderr += data; });
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      let records;
+      try {
+        records = stdout.trim().split('\n')
+          .filter((line) => line.length > 0)
+          .map((line) => JSON.parse(line));
+      } catch (error) {
+        reject(new Error(
+          `Could not parse benchmark output from '${binary}': ${error.message}`,
+          { cause: error },
+        ));
+        return;
+      }
+
+      const summary = records.findLast(
+        ({ type }) => type === 'bench:summary')?.data;
+      if (code !== 0 || signal !== null || summary?.success !== true) {
+        const diagnostics = records
+          .filter(({ type }) => type === 'bench:diagnostic')
+          .map(({ data }) => data.message)
+          .join('\n');
+        const status = signal === null ? `exit code ${code}` : `signal ${signal}`;
+        const details = stderr || diagnostics;
+        reject(new Error(
+          `Benchmark '${file}' failed with ${status}` +
+          (details ? `:\n${details}` : ''),
+        ));
+        return;
+      }
+
+      const samples = [];
+      for (const record of records) {
+        if (record.type !== 'bench:complete' ||
+            record.data.skip !== undefined) {
+          continue;
+        }
+        if (record.data.error !== undefined) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' failed: ` +
+            record.data.error.message,
+          ));
+          return;
+        }
+        if (record.data.samples.length !== 1) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' did not produce exactly one sample`,
+          ));
+          return;
+        }
+        const sample = record.data.samples[0];
+        if (!Number.isFinite(sample.rate)) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' produced a non-finite rate`,
+          ));
+          return;
+        }
+        samples.push({
+          configuration: formatConfiguration(record.data.params),
+          duration: durationToSeconds(sample.duration_ns),
+          identity: record.data.benchId,
+          logicalIdentity: JSON.stringify([
+            record.data.file,
+            record.data.parentId,
+            record.data.name,
+          ]),
+          name: record.data.name,
+          params: record.data.params,
+          rate: sample.rate,
+        });
+      }
+      resolve(samples);
+    });
+  });
+}
+
+module.exports = {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+};
diff --git a/benchmark/buffers/_buffer-compare-offset.node-bench.js b/benchmark/buffers/_buffer-compare-offset.node-bench.js
new file mode 100644
index 000000000000..b16c3a3da7db
--- /dev/null
+++ b/benchmark/buffers/_buffer-compare-offset.node-bench.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const path = require('node:path');
+
+const methods = ['offset', 'slice'];
+const sizes = [16, 512, 4096, 16386];
+const n = 1e6;
+const name = path.join('buffers', 'buffer-compare-offset.js');
+
+function compareUsingSlice(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    Buffer.compare(b0.slice(1, len), b1.slice(1, len));
+}
+
+function compareUsingOffset(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    b0.compare(b1, 1, len, 1, len);
+}
+
+for (const method of methods) {
+  for (const size of sizes) {
+    const compare = method === 'slice' ?
+      compareUsingSlice : compareUsingOffset;
+
+    bench(name, {
+      params: { method, n, size },
+    }, (b) => {
+      b.start();
+      compare(Buffer.alloc(size, 'a'),
+              Buffer.alloc(size, 'b'),
+              size >> 1,
+              n);
+      b.end(n);
+    });
+  }
+}
diff --git a/benchmark/compare-node-bench.js b/benchmark/compare-node-bench.js
new file mode 100644
index 000000000000..295f15f0fdc1
--- /dev/null
+++ b/benchmark/compare-node-bench.js
@@ -0,0 +1,118 @@
+'use strict';
+
+const path = require('node:path');
+const CLI = require('./_cli.js');
+const { analyzeCompare } = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node compare-node-bench.js [options] [--] <file> ...
+  Run explicit node:bench files repeatedly with two Node.js binaries. Each
+  observation runs in a fresh process. Output is compatible with compare.R,
+  or --analyze can summarize it directly.
+
+  --new          binary     new Node.js binary (required)
+  --old          binary     old Node.js binary (required)
+  --runs         30         observations per binary
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to both binaries (repeatable)
+  --analyze                 analyze with Welch's t-test instead of writing CSV
+  --scale        1000       rate multiplier used for histogram precision
+  --max-regression N        fail if a family-wise significant regression's
+                            95% confidence interval is entirely beyond N%
+                            (implies --analyze)
+`, { arrayArgs: ['node-arg'], boolArgs: ['analyze'] });
+
+if (!cli.optional.new || !cli.optional.old || cli.items.length === 0) {
+  cli.abort(cli.usage);
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const scale = parseInteger(cli.optional.scale, 1000, '--scale', 1);
+  const hasMaxRegression = cli.optional['max-regression'] !== undefined;
+  const maxRegression = parseNumber(
+    cli.optional['max-regression'], 0, '--max-regression', 0);
+  const analyze = !!cli.optional.analyze || hasMaxRegression;
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binaries = [
+    { label: 'old', path: cli.optional.old },
+    { label: 'new', path: cli.optional.new },
+  ];
+  const rows = [];
+  const counts = new Map();
+  const csvGroups = new Map();
+
+  for (const file of cli.items) {
+    const resolved = path.resolve(file);
+    for (let run = 0; run < runs; run++) {
+      const order = run % 2 === 0 ? binaries : [binaries[1], binaries[0]];
+      for (const binary of order) {
+        const samples = await runBenchmark(binary.path, resolved, options);
+        for (const sample of samples) {
+          const identity = JSON.stringify([resolved, sample.identity]);
+          const csvGroup = JSON.stringify([
+            sample.name,
+            sample.configuration,
+          ]);
+          const groupedIdentity = csvGroups.get(csvGroup);
+          if (groupedIdentity !== undefined && groupedIdentity !== identity) {
+            throw new Error(
+              `Distinct benchmarks would share the CSV group '${sample.name} ` +
+              `${sample.configuration}'`,
+            );
+          }
+          csvGroups.set(csvGroup, identity);
+          let count = counts.get(identity);
+          if (count === undefined) {
+            count = { name: sample.name, new: 0, old: 0 };
+            counts.set(identity, count);
+          }
+          count[binary.label]++;
+          rows.push({ binary: binary.label, ...sample });
+        }
+      }
+    }
+  }
+
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+  for (const count of counts.values()) {
+    if (count.old !== runs || count.new !== runs) {
+      throw new Error(
+        `Benchmark '${count.name}' was not reported by both binaries in every run`,
+      );
+    }
+  }
+
+  if (analyze) {
+    const result = analyzeCompare(
+      rows, scale, hasMaxRegression ? maxRegression : undefined);
+    process.stdout.write(result.output);
+    if (result.failed) process.exitCode = 1;
+    return;
+  }
+
+  const output = ['"binary","filename","configuration","rate","time"'];
+  for (const row of rows) {
+    output.push(`${csvEncode(row.binary)},${csvEncode(row.name)},` +
+                `${csvEncode(row.configuration)},${row.rate},${row.duration}`);
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/compare.js b/benchmark/compare.js
index 6aaaee7a9190..77874e8af6c1 100644
--- a/benchmark/compare.js
+++ b/benchmark/compare.js
@@ -159,6 +159,27 @@ if (showProgress) {
   });
 })(kStartOfQueue);
 
+// Holm-Bonferroni step-down adjustment. Controls the probability of *any*
+// false positive across the whole comparison set, which is what a pass/fail
+// gate needs: an uncorrected suite of 169 comparisons at 5% has a 99.98%
+// chance of flagging something that is not there. Uniformly more powerful
+// than plain Bonferroni, and makes no assumption about independence.
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, i) => ({ p, i }))
+    .sort((a, b) => a.p - b.p);
+  const m = order.length;
+  const adjusted = new Array(m);
+  let running = 0;
+  for (let k = 0; k < m; k++) {
+    // Step down, enforcing monotonicity so an adjusted value can never be
+    // smaller than one belonging to a more significant raw p-value.
+    running = Math.max(running, Math.min(1, (m - k) * order[k].p));
+    adjusted[order[k].i] = running;
+  }
+  return adjusted;
+}
+
 function printAnalysis(results, scale, maxRegression) {
   const { createHistogram } = require('node:perf_hooks');
 
@@ -217,6 +238,25 @@ function printAnalysis(results, scale, maxRegression) {
     if (name.length > maxNameLen) maxNameLen = name.length;
   }
 
+  // Adjust for the size of the comparison set. The raw p-value answers "is
+  // this one benchmark different", but a suite is read as a whole, so the
+  // relevant question is "is anything here different".
+  const adjusted = holmAdjust(rows.map((r) => r.pValue));
+  for (let i = 0; i < rows.length; i++) rows[i].pAdjusted = adjusted[i];
+
+  // A comparison can only rule out an effect it was able to resolve. Where no
+  // threshold has been given there is no definition of "worth detecting", so
+  // nothing is claimed. `maxRegression` is exactly such a declaration, so it
+  // is reused rather than inventing a second constant.
+  const resolution = maxRegression > 0 ? maxRegression : null;
+  let underpowered = 0;
+  for (const row of rows) {
+    row.inconclusive = resolution !== null &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > resolution;
+    if (row.inconclusive) underpowered++;
+  }
+
   // Print header.
   const pad = (s, n) => s + ' '.repeat(Math.max(0, n - s.length));
   const rpad = (s, n) => ' '.repeat(Math.max(0, n - s.length)) + s;
@@ -231,7 +271,8 @@ function printAnalysis(results, scale, maxRegression) {
       `  ${rpad(imp, 11)}` +
       `   ±${row.ci95.toFixed(2)}%` +
       `  ±${row.ci99.toFixed(2)}%` +
-      `  ±${row.ci999.toFixed(2)}%`,
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}`,
     );
   }
 
@@ -252,6 +293,7 @@ function printAnalysis(results, scale, maxRegression) {
     `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).\n` +
     `Use --scale to adjust precision if needed.\n`,
   );
+  const anyFamilyWise = rows.filter((r) => r.pAdjusted < 0.05).length;
   console.log(
     `Be aware that when doing many comparisons the risk of a false-positive\n` +
     `result increases. In this case, there are ${rows.length} comparisons, ` +
@@ -261,23 +303,56 @@ function printAnalysis(results, scale, maxRegression) {
     `  ${(rows.length * 0.01).toFixed(2)} false positives, when considering ` +
     `a   1% risk acceptance (**, ***),\n` +
     `  ${(rows.length * 0.001).toFixed(2)} false positives, when considering ` +
-    `a 0.1% risk acceptance (***)`,
+    `a 0.1% risk acceptance (***)\n` +
+    `\nThe stars above are per-benchmark and uncorrected. Adjusting for the ` +
+    `size of\nthis comparison set (Holm-Bonferroni), ${anyFamilyWise} ` +
+    `comparison${anyFamilyWise === 1 ? '' : 's'} remain${anyFamilyWise === 1 ? 's' : ''} ` +
+    `significant at 5%.\n--max-regression uses the corrected values.`,
   );
 
-  // Gate: exit with error if any significant regression exceeds the limit.
+  // Gate: exit with error if any regression is shown to exceed the limit.
   if (maxRegression > 0) {
+    if (underpowered > 0) {
+      console.log('');
+      console.log(
+        `Note: ${underpowered} of ${rows.length} comparison` +
+        `${rows.length === 1 ? '' : 's'} could not resolve an effect as ` +
+        `small as ${maxRegression}%, and are marked (inconclusive). They are ` +
+        `not\nevidence of no regression -- the samples are too noisy to tell. ` +
+        `Raise --runs,\nor pin cores with --set CPUSET, to narrow them.`,
+      );
+    }
+
+    // Two conditions, both required.
+    //
+    // The confidence interval must lie entirely beyond the threshold. A small
+    // p-value only says the effect is not exactly zero; claiming it exceeds
+    // `maxRegression` is a statement about magnitude, so the interval has to
+    // exclude that magnitude. Testing the point estimate instead systematically
+    // fires on the noisiest benchmarks, because a large point estimate is
+    // easiest to obtain when the interval is wide.
+    //
+    // The p-value must also survive adjustment for the size of the comparison
+    // set, so that a suite of hundreds of benchmarks does not fail purely
+    // because one of them drifted.
     const failures = rows.filter(
-      (r) => r.stars.trim() !== '' && r.improvement < -maxRegression,
+      (r) => r.pAdjusted < 0.05 && r.improvement + r.ci95 < -maxRegression,
     );
+
     if (failures.length > 0) {
       console.log('');
       console.log(
         `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
-        ` showed a statistically significant regression exceeding` +
-        ` ${maxRegression}%:`,
+        ` regressed by more than ${maxRegression}%` +
+        ` (interval excludes the threshold,\n` +
+        `family-wise corrected across ${rows.length} comparisons):`,
       );
       for (const f of failures) {
-        console.log(`  ${f.name}  ${f.improvement.toFixed(2)}%`);
+        console.log(
+          `  ${f.name}  ${f.improvement.toFixed(2)}% ` +
+          `(95% CI up to ${(f.improvement + f.ci95).toFixed(2)}%, ` +
+          `adjusted p=${f.pAdjusted.toExponential(2)})`,
+        );
       }
       process.exitCode = 1;
     }
diff --git a/benchmark/crypto/_create-hash.node-bench.js b/benchmark/crypto/_create-hash.node-bench.js
new file mode 100644
index 000000000000..4481bc6c6527
--- /dev/null
+++ b/benchmark/crypto/_create-hash.node-bench.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const assert = require('node:assert');
+const { bench } = require('node:bench');
+const { createHash } = require('node:crypto');
+const path = require('node:path');
+
+const n = 1e5;
+const name = path.join('crypto', 'create-hash.js');
+
+bench(name, { params: { n } }, (b) => {
+  const array = [];
+  for (let i = 0; i < n; ++i) array.push(null);
+  b.start();
+  for (let i = 0; i < n; ++i)
+    array[i] = createHash('sha1');
+  b.end(n);
+  assert.strictEqual(typeof array[n - 1], 'object');
+});
diff --git a/benchmark/crypto/class-construction.js b/benchmark/crypto/class-construction.js
new file mode 100644
index 000000000000..fe03b1a43cd2
--- /dev/null
+++ b/benchmark/crypto/class-construction.js
@@ -0,0 +1,86 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const dhPrime = crypto.getDiffieHellman('modp14').getPrime();
+const key = Buffer.alloc(32, 0x01);
+const keyObject = crypto.createSecretKey(key);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+
+const iterations = {
+  Certificate: 1e7,
+  Cipheriv: 1e5,
+  Decipheriv: 1e5,
+  DiffieHellman: 10,
+  DiffieHellmanGroup: 2e5,
+  ECDH: 2e5,
+  Hash: 1e5,
+  Hmac: 5e4,
+  KeyObject: 1e5,
+  Sign: 1e5,
+  Verify: 1e5,
+  CryptoKey: 5e4,
+  X509Certificate: 5e3,
+};
+
+const bench = common.createBenchmark(main, {
+  type: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ type, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[type] === n;
+  },
+});
+
+function construct(type) {
+  switch (type) {
+    case 'Certificate':
+      return new crypto.Certificate();
+    case 'Cipheriv':
+      return crypto.createCipheriv('aes-256-ctr', key, iv);
+    case 'Decipheriv':
+      return crypto.createDecipheriv('aes-256-ctr', key, iv);
+    case 'DiffieHellman':
+      return crypto.createDiffieHellman(dhPrime);
+    case 'DiffieHellmanGroup':
+      return crypto.getDiffieHellman('modp14');
+    case 'ECDH':
+      return crypto.createECDH('prime256v1');
+    case 'Hash':
+      return crypto.createHash('sha256');
+    case 'Hmac':
+      return crypto.createHmac('sha256', key);
+    case 'KeyObject':
+      return crypto.createSecretKey(key);
+    case 'Sign':
+      return crypto.createSign('sha256');
+    case 'Verify':
+      return crypto.createVerify('sha256');
+    case 'CryptoKey':
+      return keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages);
+    case 'X509Certificate':
+      return new crypto.X509Certificate(certificate);
+    default:
+      throw new Error(`Unsupported class: ${type}`);
+  }
+}
+
+function main({ type, n }) {
+  const instances = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    instances[i] = construct(type);
+  bench.end(n);
+
+  assert.strictEqual(typeof instances[n - 1], 'object');
+}
diff --git a/benchmark/crypto/class-methods.js b/benchmark/crypto/class-methods.js
new file mode 100644
index 000000000000..9db499b7d1a9
--- /dev/null
+++ b/benchmark/crypto/class-methods.js
@@ -0,0 +1,206 @@
+'use strict';
+
+const common = require('../common.js');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const key = Buffer.alloc(32, 0x01);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+const input = Buffer.alloc(16, 0x03);
+
+const iterations = {
+  'Cipheriv-update': 1e6,
+  'Decipheriv-update': 1e6,
+  'DiffieHellman-getGenerator': 2e5,
+  'DiffieHellmanGroup-getGenerator': 2e6,
+  'ECDH-getPrivateKey': 2e6,
+  'Hash-update': 5e6,
+  'Hmac-update': 5e6,
+  'KeyObject-equals': 2e6,
+  'KeyObject-symmetricKeySize-first': 1e5,
+  'KeyObject-type-first': 1e5,
+  'KeyObject-type': 1e8,
+  'Sign-update': 5e6,
+  'Verify-update': 5e6,
+  'CryptoKey-toKeyObject': 2e5,
+  'CryptoKey-algorithm-first': 1e5,
+  'CryptoKey-extractable-first': 1e5,
+  'CryptoKey-type-first': 1e5,
+  'CryptoKey-usages-first': 1e5,
+  'CryptoKey-type': 1e8,
+  'X509Certificate-checkHost': 1e6,
+  'X509Certificate-publicKey-first': 5e3,
+  'X509Certificate-publicKey': 1e8,
+  'X509Certificate-subject-first': 5e3,
+  'X509Certificate-subject': 1e8,
+};
+
+const bench = common.createBenchmark(main, {
+  operation: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ operation, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[operation] === n;
+  },
+});
+
+function setup(operation) {
+  switch (operation) {
+    case 'Cipheriv-update': {
+      const cipher = crypto.createCipheriv('aes-256-ctr', key, iv);
+      return {
+        run: () => cipher.update(input),
+        finish: () => cipher.final(),
+      };
+    }
+    case 'Decipheriv-update': {
+      const decipher = crypto.createDecipheriv('aes-256-ctr', key, iv);
+      return {
+        run: () => decipher.update(input),
+        finish: () => decipher.final(),
+      };
+    }
+    case 'DiffieHellman-getGenerator': {
+      const dh = crypto.createDiffieHellman(
+        crypto.getDiffieHellman('modp14').getPrime());
+      return { run: () => dh.getGenerator() };
+    }
+    case 'DiffieHellmanGroup-getGenerator': {
+      const dh = crypto.getDiffieHellman('modp14');
+      return { run: () => dh.getGenerator() };
+    }
+    case 'ECDH-getPrivateKey': {
+      const ecdh = crypto.createECDH('prime256v1');
+      ecdh.generateKeys();
+      return { run: () => ecdh.getPrivateKey() };
+    }
+    case 'Hash-update': {
+      const hash = crypto.createHash('sha256');
+      return {
+        run: () => hash.update(input),
+        finish: () => hash.digest(),
+      };
+    }
+    case 'Hmac-update': {
+      const hmac = crypto.createHmac('sha256', key);
+      return {
+        run: () => hmac.update(input),
+        finish: () => hmac.digest(),
+      };
+    }
+    case 'KeyObject-equals': {
+      const keyObject = crypto.createSecretKey(key);
+      return { run: () => keyObject.equals(keyObject) };
+    }
+    case 'KeyObject-symmetricKeySize-first': {
+      return { run: () => crypto.createSecretKey(key).symmetricKeySize };
+    }
+    case 'KeyObject-type-first': {
+      return { run: () => crypto.createSecretKey(key).type };
+    }
+    case 'KeyObject-type': {
+      const keyObjects = Array.from(
+        { length: 64 }, () => crypto.createSecretKey(key));
+      for (const keyObject of keyObjects) {
+        if (keyObject.type !== 'secret')
+          throw new Error('Unexpected KeyObject type');
+      }
+      let index = 0;
+      return { run: () => keyObjects[index++ & 63].type };
+    }
+    case 'Sign-update': {
+      const sign = crypto.createSign('sha256');
+      return { run: () => sign.update(input) };
+    }
+    case 'Verify-update': {
+      const verify = crypto.createVerify('sha256');
+      return { run: () => verify.update(input) };
+    }
+    case 'CryptoKey-toKeyObject': {
+      const keyObject = crypto.createSecretKey(key);
+      const cryptoKey = keyObject.toCryptoKey(
+        hmacAlgorithm, true, keyUsages);
+      return { run: () => crypto.KeyObject.from(cryptoKey) };
+    }
+    case 'CryptoKey-algorithm-first':
+    case 'CryptoKey-extractable-first':
+    case 'CryptoKey-type-first':
+    case 'CryptoKey-usages-first': {
+      const keyObject = crypto.createSecretKey(key);
+      const property = operation.slice('CryptoKey-'.length, -'-first'.length);
+      return {
+        run: () => keyObject.toCryptoKey(
+          hmacAlgorithm, true, keyUsages)[property],
+      };
+    }
+    case 'CryptoKey-type': {
+      const keyObject = crypto.createSecretKey(key);
+      const cryptoKeys = Array.from(
+        { length: 64 },
+        () => keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages));
+      for (const cryptoKey of cryptoKeys) {
+        if (cryptoKey.type !== 'secret')
+          throw new Error('Unexpected CryptoKey type');
+      }
+      let index = 0;
+      return { run: () => cryptoKeys[index++ & 63].type };
+    }
+    case 'X509Certificate-checkHost': {
+      const x509 = new crypto.X509Certificate(certificate);
+      return { run: () => x509.checkHost('agent1') };
+    }
+    case 'X509Certificate-publicKey-first': {
+      return {
+        run: () => new crypto.X509Certificate(certificate).publicKey,
+      };
+    }
+    case 'X509Certificate-publicKey': {
+      const certificates = Array.from(
+        { length: 64 }, () => new crypto.X509Certificate(certificate));
+      for (const x509 of certificates) {
+        if (x509.publicKey === undefined)
+          throw new Error('Missing certificate public key');
+      }
+      let index = 0;
+      return { run: () => certificates[index++ & 63].publicKey };
+    }
+    case 'X509Certificate-subject-first': {
+      return {
+        run: () => new crypto.X509Certificate(certificate).subject,
+      };
+    }
+    case 'X509Certificate-subject': {
+      const certificates = Array.from(
+        { length: 64 }, () => new crypto.X509Certificate(certificate));
+      for (const x509 of certificates) {
+        if (x509.subject === undefined)
+          throw new Error('Missing certificate subject');
+      }
+      let index = 0;
+      return { run: () => certificates[index++ & 63].subject };
+    }
+    default:
+      throw new Error(`Unsupported operation: ${operation}`);
+  }
+}
+
+function main({ operation, n }) {
+  const state = setup(operation);
+  let result;
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = state.run();
+  bench.end(n);
+
+  if (state.finish)
+    state.finish();
+  if (result === state)
+    throw new Error('Unexpected benchmark result');
+}
diff --git a/benchmark/crypto/create-cipheriv.js b/benchmark/crypto/create-cipheriv.js
new file mode 100644
index 000000000000..7774e393b403
--- /dev/null
+++ b/benchmark/crypto/create-cipheriv.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('node:crypto');
+
+const configurations = {
+  'aes-128-cbc': { keyLength: 16, ivLength: 16 },
+  'aes-128-gcm': { keyLength: 16, ivLength: 12 },
+  'aes-128-cbc-cts': { keyLength: 16, ivLength: 16 },
+  'aes-128-wrap-inv': { keyLength: 16, ivLength: 8 },
+  'aes128-wrap-inv': {
+    keyLength: 16,
+    ivLength: 8,
+    warmupCipher: 'aes-128-wrap-inv',
+  },
+};
+
+const ciphers = ['aes-128-cbc', 'aes-128-gcm'];
+const availableCiphers = new Set(getCiphers());
+for (const cipher of [
+  'aes-128-cbc-cts',
+  'aes-128-wrap-inv',
+  'aes128-wrap-inv',
+]) {
+  if (availableCiphers.has(cipher)) {
+    ciphers.push(cipher);
+  }
+}
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  cipher: ciphers,
+  operation: ['encrypt', 'decrypt'],
+});
+
+function main({ n, cipher, operation }) {
+  const {
+    keyLength,
+    ivLength,
+    warmupCipher = cipher,
+  } = configurations[cipher];
+  const key = Buffer.alloc(keyLength);
+  const iv = Buffer.alloc(ivLength);
+  const results = new Array(n);
+  const method = operation === 'encrypt' ? createCipheriv : createDecipheriv;
+
+  const warmup = method(warmupCipher, key, iv);
+  assert.strictEqual(typeof warmup, 'object');
+
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    results[i] = method(cipher, key, iv);
+  }
+  bench.end(n);
+
+  assert.strictEqual(typeof results[n - 1], 'object');
+}
diff --git a/benchmark/crypto/ecdh-compute-secret.js b/benchmark/crypto/ecdh-compute-secret.js
new file mode 100644
index 000000000000..3061c5b2cc36
--- /dev/null
+++ b/benchmark/crypto/ecdh-compute-secret.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const kCurve = 'prime256v1';
+const kPeerPoolSize = 32;
+const scenarios = [
+  'first-after-generate',
+  'full-lifecycle',
+  'reused-local-same-peer',
+  'reused-local-peer-pool',
+];
+
+const bench = common.createBenchmark(main, {
+  scenario: scenarios,
+  n: [5_000],
+}, {
+  test: { scenario: 'first-after-generate', n: 1 },
+});
+
+function generateContext() {
+  const context = crypto.createECDH(kCurve);
+  context.generateKeys();
+  return context;
+}
+
+function verifySecret(secret, local, peer) {
+  assert.deepStrictEqual(secret, peer.computeSecret(local.getPublicKey()));
+}
+
+function firstAfterGenerate(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = Array.from({ length: n }, generateContext);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = locals[i].computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function fullLifecycle(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = new Array(n);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const local = locals[i] = generateContext();
+    secrets[i] = local.computeSecret(peerPublicKey);
+  }
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function reusedLocalSamePeer(n) {
+  const local = generateContext();
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  local.computeSecret(peerPublicKey);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], local, peer);
+}
+
+function reusedLocalPeerPool(n) {
+  const local = generateContext();
+  const peers = Array.from(
+    { length: Math.min(n, kPeerPoolSize) },
+    generateContext);
+  const peerPublicKeys = peers.map((peer) => peer.getPublicKey());
+  local.computeSecret(peerPublicKeys[0]);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKeys[i % peers.length]);
+  bench.end(n);
+
+  const lastPeer = peers[(n - 1) % peers.length];
+  verifySecret(secrets[n - 1], local, lastPeer);
+}
+
+function main({ scenario, n }) {
+  switch (scenario) {
+    case 'first-after-generate':
+      return firstAfterGenerate(n);
+    case 'full-lifecycle':
+      return fullLifecycle(n);
+    case 'reused-local-same-peer':
+      return reusedLocalSamePeer(n);
+    case 'reused-local-peer-pool':
+      return reusedLocalPeerPool(n);
+    default:
+      throw new Error(`Unsupported scenario: ${scenario}`);
+  }
+}
diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
new file mode 100644
index 000000000000..d1028fa414e6
--- /dev/null
+++ b/benchmark/crypto/mac.js
@@ -0,0 +1,254 @@
+'use strict';
+
+const common = require('../common.js');
+const { hasOpenSSL } = require('../../test/common/crypto.js');
+const assert = require('node:assert');
+const {
+  createHmac,
+  createMac,
+  getMacs,
+} = require('node:crypto');
+
+if (!hasOpenSSL(3) ||
+    process.features.openssl_is_boringssl ||
+    typeof createMac !== 'function' ||
+    typeof getMacs !== 'function') {
+  console.log('Skipping: generic MAC API requires OpenSSL >= 3');
+  process.exit(0);
+}
+
+const operations = [
+  'get-macs-cold',
+  'get-macs-warm',
+  'create-cold',
+  'create-warm',
+  'hmac-lifecycle',
+  'mac-lifecycle',
+  'mac-stream-lifecycle',
+  'update',
+  'stream',
+  'final-buffer',
+  'final-hex',
+];
+const configurations = {
+  'hmac-sha256': {
+    algorithm: 'HMAC',
+    key: Buffer.alloc(32, 0x42),
+    options: { digest: 'SHA256' },
+  },
+  'kmac-128': {
+    algorithm: 'KMAC-128',
+    key: Buffer.alloc(32, 0x42),
+    options: { outputLength: 32 },
+  },
+};
+
+const bench = common.createBenchmark(main, {
+  operation: operations,
+  algorithm: Object.keys(configurations),
+  length: [0, 64, 4096],
+  n: [1, 10_000, 20_000, 500_000],
+}, {
+  combinationFilter({ operation, algorithm, length, n }) {
+    if (operation === 'get-macs-cold') {
+      return algorithm === 'hmac-sha256' && length === 0 && n === 1;
+    }
+    if (operation === 'get-macs-warm') {
+      return algorithm === 'hmac-sha256' && length === 0 && n === 500_000;
+    }
+    if (operation === 'create-cold')
+      return length === 0 && n === 1;
+    if (operation === 'create-warm')
+      return length === 0 && n === 20_000;
+    if (operation === 'hmac-lifecycle') {
+      return algorithm === 'hmac-sha256' && n === 10_000;
+    }
+    if (operation === 'mac-lifecycle' ||
+        operation === 'mac-stream-lifecycle') {
+      return n === 10_000;
+    }
+    if (operation === 'update' || operation === 'stream') {
+      return length === 64 && n === 500_000;
+    }
+    if (operation === 'final-buffer' || operation === 'final-hex') {
+      return algorithm === 'hmac-sha256' &&
+             length === 64 &&
+             n === 20_000;
+    }
+    return false;
+  },
+  test: {
+    operation: ['create-cold'],
+    algorithm: ['hmac-sha256'],
+    length: [0],
+    n: [1],
+  },
+});
+
+function main({ operation, algorithm, length, n }) {
+  const configuration = configurations[algorithm];
+  const data = Buffer.alloc(length, 0x61);
+
+  switch (operation) {
+    case 'get-macs-cold':
+      measureGetMacs(n, false);
+      break;
+    case 'get-macs-warm':
+      measureGetMacs(n, true);
+      break;
+    case 'create-cold':
+      measureCreate(configuration, n, false);
+      break;
+    case 'create-warm':
+      measureCreate(configuration, n, true);
+      break;
+    case 'hmac-lifecycle':
+      measureHmacLifecycle(configuration, data, n);
+      break;
+    case 'mac-lifecycle':
+      measureMacLifecycle(configuration, data, n);
+      break;
+    case 'mac-stream-lifecycle':
+      measureMacStreamLifecycle(configuration, data, n);
+      break;
+    case 'update':
+      measureUpdate(configuration, data, n);
+      break;
+    case 'stream':
+      measureStream(configuration, data, n);
+      break;
+    case 'final-buffer':
+      measureFinal(configuration, data, n);
+      break;
+    case 'final-hex':
+      measureFinal(configuration, data, n, 'hex');
+      break;
+    default:
+      throw new Error(`unknown operation: ${operation}`);
+  }
+}
+
+function measureGetMacs(n, warm) {
+  if (warm)
+    getMacs();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = getMacs();
+  bench.end(n);
+
+  assert(Array.isArray(result));
+}
+
+function measureCreate({ algorithm, key, options }, n, warm) {
+  if (warm)
+    createMac(algorithm, key, options).final();
+
+  const contexts = new Array(n);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    contexts[i] = createMac(algorithm, key, options);
+  bench.end(n);
+
+  assert.strictEqual(typeof contexts[n - 1], 'object');
+}
+
+function measureHmacLifecycle({ key, options }, data, n) {
+  createHmac(options.digest, key).update(data).digest();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = createHmac(options.digest, key).update(data).digest();
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureMacLifecycle({ algorithm, key, options }, data, n) {
+  createMac(algorithm, key, options).update(data).final();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = createMac(algorithm, key, options).update(data).final();
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureMacStreamLifecycle({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.end(data);
+  warmup.read();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    const context = createMac(algorithm, key, options);
+    context.end(data);
+    result = context.read();
+  }
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureUpdate({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.update(data).final();
+
+  const context = createMac(algorithm, key, options);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    context.update(data);
+  bench.end(n);
+
+  assert(Buffer.isBuffer(context.final()));
+}
+
+function measureStream({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.end(data);
+  warmup.read();
+
+  const context = createMac(algorithm, key, options);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    context.write(data);
+  bench.end(n);
+
+  context.end();
+  assert(Buffer.isBuffer(context.read()));
+}
+
+function measureFinal({ algorithm, key, options }, data, n, encoding) {
+  const warmup = createMac(algorithm, key, options).update(data);
+  if (encoding === undefined)
+    warmup.final();
+  else
+    warmup.final(encoding);
+
+  const contexts = new Array(n);
+  for (let i = 0; i < n; ++i)
+    contexts[i] = createMac(algorithm, key, options).update(data);
+
+  let result;
+  if (encoding === undefined) {
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      result = contexts[i].final();
+    bench.end(n);
+  } else {
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      result = contexts[i].final(encoding);
+    bench.end(n);
+  }
+
+  if (encoding === undefined)
+    assert(Buffer.isBuffer(result));
+  else
+    assert.strictEqual(typeof result, 'string');
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-promise.js b/benchmark/diagnostics_channel/tracing-channel-promise.js
new file mode 100644
index 000000000000..594043d63fe4
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-promise.js
@@ -0,0 +1,53 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+const thenable = {
+  then(onResolve) {
+    onResolve(undefined);
+  },
+};
+
+function returnThenable() {
+  return thenable;
+}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-sync.js b/benchmark/diagnostics_channel/tracing-channel-sync.js
new file mode 100644
index 000000000000..bfd9dd939cc0
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-sync.js
@@ -0,0 +1,43 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/ffi/add-64.js b/benchmark/ffi/add-64.js
index 1af3de2296a5..d3b8f9e21e03 100644
--- a/benchmark/ffi/add-64.js
+++ b/benchmark/ffi/add-64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-f32.js b/benchmark/ffi/add-f32.js
index a958e80c1819..afb42a4a48e5 100644
--- a/benchmark/ffi/add-f32.js
+++ b/benchmark/ffi/add-f32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-f64.js b/benchmark/ffi/add-f64.js
index f4e1dbac4ac3..a4aec85fa935 100644
--- a/benchmark/ffi/add-f64.js
+++ b/benchmark/ffi/add-f64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i16.js b/benchmark/ffi/add-i16.js
index 8cd6f989e180..0ce2530d5d33 100644
--- a/benchmark/ffi/add-i16.js
+++ b/benchmark/ffi/add-i16.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i32.js b/benchmark/ffi/add-i32.js
index 9a77a6f998f7..451c0c4e0836 100644
--- a/benchmark/ffi/add-i32.js
+++ b/benchmark/ffi/add-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i64.js b/benchmark/ffi/add-i64.js
index 753a300b4394..b72e399d4135 100644
--- a/benchmark/ffi/add-i64.js
+++ b/benchmark/ffi/add-i64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-i8.js b/benchmark/ffi/add-i8.js
index 9e506b2ad76f..b0b0111f88c7 100644
--- a/benchmark/ffi/add-i8.js
+++ b/benchmark/ffi/add-i8.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-u16.js b/benchmark/ffi/add-u16.js
index 2c1408a355a2..26161815bde7 100644
--- a/benchmark/ffi/add-u16.js
+++ b/benchmark/ffi/add-u16.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-u64.js b/benchmark/ffi/add-u64.js
index 260d24971610..6a021ad5c854 100644
--- a/benchmark/ffi/add-u64.js
+++ b/benchmark/ffi/add-u64.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/add-u8.js b/benchmark/ffi/add-u8.js
index 3525d4c3d263..3c9512a7869b 100644
--- a/benchmark/ffi/add-u8.js
+++ b/benchmark/ffi/add-u8.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-first-byte-direct.js b/benchmark/ffi/buffer-first-byte-direct.js
index 60370419edb7..d09706144702 100644
--- a/benchmark/ffi/buffer-first-byte-direct.js
+++ b/benchmark/ffi/buffer-first-byte-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-first-byte.js b/benchmark/ffi/buffer-first-byte.js
index 311cd8e89fac..02b8f190d5e9 100644
--- a/benchmark/ffi/buffer-first-byte.js
+++ b/benchmark/ffi/buffer-first-byte.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-sum-direct.js b/benchmark/ffi/buffer-sum-direct.js
index 73b6d149cb76..425832330047 100644
--- a/benchmark/ffi/buffer-sum-direct.js
+++ b/benchmark/ffi/buffer-sum-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/buffer-sum.js b/benchmark/ffi/buffer-sum.js
index e4108db09a65..fd5ba47363d0 100644
--- a/benchmark/ffi/buffer-sum.js
+++ b/benchmark/ffi/buffer-sum.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/get-function.js b/benchmark/ffi/get-function.js
index 3c1e2e974ce6..939c1630ab64 100644
--- a/benchmark/ffi/get-function.js
+++ b/benchmark/ffi/get-function.js
@@ -16,8 +16,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 const bench = common.createBenchmark(main, {
   signature: ['fast', 'slow'],
   n: [1e3],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/getpid.js b/benchmark/ffi/getpid.js
index 8008f407305e..3463a4afe807 100644
--- a/benchmark/ffi/getpid.js
+++ b/benchmark/ffi/getpid.js
@@ -5,8 +5,6 @@ const ffi = require('node:ffi');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 const { lib, functions } = ffi.dlopen(null, {
diff --git a/benchmark/ffi/identity-i32.js b/benchmark/ffi/identity-i32.js
index 0014d652777f..388645e328a2 100644
--- a/benchmark/ffi/identity-i32.js
+++ b/benchmark/ffi/identity-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/invoke-function.js b/benchmark/ffi/invoke-function.js
index ae8d5b2ef795..9e461680b7ee 100644
--- a/benchmark/ffi/invoke-function.js
+++ b/benchmark/ffi/invoke-function.js
@@ -23,7 +23,7 @@ const bench = common.createBenchmark(main, {
   n: [1e7],
   symbol: ['call_int_callback', 'sum_8_i32'],
 }, {
-  flags: ['--experimental-ffi', '--no-warnings'],
+  flags: ['--no-warnings'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/many-args.js b/benchmark/ffi/many-args.js
index bc269ace0c3e..7cd5a4d685ce 100644
--- a/benchmark/ffi/many-args.js
+++ b/benchmark/ffi/many-args.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/noop-void.js b/benchmark/ffi/noop-void.js
index b9dd68636254..ff606ebb8586 100644
--- a/benchmark/ffi/noop-void.js
+++ b/benchmark/ffi/noop-void.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-bigint.js b/benchmark/ffi/pointer-bigint.js
index 9ea01d28490e..6be9577f45b7 100644
--- a/benchmark/ffi/pointer-bigint.js
+++ b/benchmark/ffi/pointer-bigint.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-buffer-direct.js b/benchmark/ffi/pointer-buffer-direct.js
index 681800c6e02d..0813e732d6ae 100644
--- a/benchmark/ffi/pointer-buffer-direct.js
+++ b/benchmark/ffi/pointer-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-buffer.js b/benchmark/ffi/pointer-buffer.js
index 4aa038558367..e19a1a035388 100644
--- a/benchmark/ffi/pointer-buffer.js
+++ b/benchmark/ffi/pointer-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/pointer-null.js b/benchmark/ffi/pointer-null.js
index c9836b12604e..975e03b739f4 100644
--- a/benchmark/ffi/pointer-null.js
+++ b/benchmark/ffi/pointer-null.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-equals-hello-buffer-direct.js b/benchmark/ffi/string-equals-hello-buffer-direct.js
index 0a4ea8b97112..a05902a54f1f 100644
--- a/benchmark/ffi/string-equals-hello-buffer-direct.js
+++ b/benchmark/ffi/string-equals-hello-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-equals-hello-buffer.js b/benchmark/ffi/string-equals-hello-buffer.js
index 7757586d472c..eb7839d48508 100644
--- a/benchmark/ffi/string-equals-hello-buffer.js
+++ b/benchmark/ffi/string-equals-hello-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-first-char-buffer-direct.js b/benchmark/ffi/string-first-char-buffer-direct.js
index 693705c94587..641084cdf632 100644
--- a/benchmark/ffi/string-first-char-buffer-direct.js
+++ b/benchmark/ffi/string-first-char-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-first-char-buffer.js b/benchmark/ffi/string-first-char-buffer.js
index e8a79ac41ad6..cac665039390 100644
--- a/benchmark/ffi/string-first-char-buffer.js
+++ b/benchmark/ffi/string-first-char-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-buffer-direct.js b/benchmark/ffi/string-length-buffer-direct.js
index cfbb819d8026..b2de28b209e8 100644
--- a/benchmark/ffi/string-length-buffer-direct.js
+++ b/benchmark/ffi/string-length-buffer-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-buffer.js b/benchmark/ffi/string-length-buffer.js
index 3b0ea8aef13a..36d11db86420 100644
--- a/benchmark/ffi/string-length-buffer.js
+++ b/benchmark/ffi/string-length-buffer.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-string-direct.js b/benchmark/ffi/string-length-string-direct.js
index cfbb819d8026..b2de28b209e8 100644
--- a/benchmark/ffi/string-length-string-direct.js
+++ b/benchmark/ffi/string-length-string-direct.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/string-length-string.js b/benchmark/ffi/string-length-string.js
index 9cddfdf4e950..23284973405d 100644
--- a/benchmark/ffi/string-length-string.js
+++ b/benchmark/ffi/string-length-string.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-3-i32.js b/benchmark/ffi/sum-3-i32.js
index 174979183819..9e3f842b54ca 100644
--- a/benchmark/ffi/sum-3-i32.js
+++ b/benchmark/ffi/sum-3-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-5-i32.js b/benchmark/ffi/sum-5-i32.js
index ecc784a3d045..490691ad2b33 100644
--- a/benchmark/ffi/sum-5-i32.js
+++ b/benchmark/ffi/sum-5-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-8-i32.js b/benchmark/ffi/sum-8-i32.js
index 8c740030307a..b1d53d693bfa 100644
--- a/benchmark/ffi/sum-8-i32.js
+++ b/benchmark/ffi/sum-8-i32.js
@@ -6,8 +6,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 
 const bench = common.createBenchmark(main, {
   n: [1e7],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/ffi/sum-buffer.js b/benchmark/ffi/sum-buffer.js
index 60e25a854185..da87aa28ebd4 100644
--- a/benchmark/ffi/sum-buffer.js
+++ b/benchmark/ffi/sum-buffer.js
@@ -7,8 +7,6 @@ const { libraryPath, ensureFixtureLibrary } = require('./common.js');
 const bench = common.createBenchmark(main, {
   size: [64, 1024, 16384],
   n: [1e6],
-}, {
-  flags: ['--experimental-ffi'],
 });
 
 ensureFixtureLibrary();
diff --git a/benchmark/fs/bench-cp.js b/benchmark/fs/bench-cp.js
new file mode 100644
index 000000000000..ffaeb87705f5
--- /dev/null
+++ b/benchmark/fs/bench-cp.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// fs.promises.cp() of a directory tree.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../../test/common/tmpdir');
+
+const bench = common.createBenchmark(main, {
+  files: [500],
+  n: [3],
+});
+
+function prepareSource(files) {
+  const src = tmpdir.resolve('cp-src');
+  for (let i = 0; i < files; i++) {
+    const dir = path.join(src, `dir-${i % 10}`, `sub-${i % 7}`);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, `file-${i}.js`), 'x'.repeat(1024 + (i % 512)));
+  }
+  return src;
+}
+
+async function main({ files, n }) {
+  tmpdir.refresh();
+  const src = prepareSource(files);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    await fs.promises.cp(src, tmpdir.resolve(`cp-dest-${i}`), { recursive: true });
+  }
+  bench.end(n);
+}
diff --git a/benchmark/fs/bench-glob.js b/benchmark/fs/bench-glob.js
index 74612701e218..4652a48f5241 100644
--- a/benchmark/fs/bench-glob.js
+++ b/benchmark/fs/bench-glob.js
@@ -16,6 +16,7 @@ const configs = {
   dir: ['lib'],
   pattern: ['**/*', '*.js', '**/**.js'],
   mode: ['sync', 'promise', 'callback'],
+  maxDepth: ['default', '2'],
   recursive: ['true', 'false'],
 };
 
@@ -23,8 +24,11 @@ const bench = common.createBenchmark(main, configs);
 
 async function main(config) {
   const fullPath = path.resolve(benchmarkDirectory, config.dir);
-  const { pattern, recursive, mode } = config;
+  const { pattern, recursive, mode, maxDepth } = config;
   const options = { cwd: fullPath, recursive };
+  if (maxDepth !== 'default') {
+    options.maxDepth = Number(maxDepth);
+  }
   const callback = (resolve, reject) => {
     glob(pattern, options, (err, matches) => {
       if (err) {
@@ -44,7 +48,10 @@ async function main(config) {
         noDead = globSync(pattern, options);
         break;
       case 'promise':
-        noDead = await globAsync(pattern, options);
+        noDead = [];
+        for await (const match of globAsync(pattern, options)) {
+          noDead.push(match);
+        }
         break;
       case 'callback':
         noDead = await new Promise(callback);
diff --git a/benchmark/fs/bench-readdir-recursive.js b/benchmark/fs/bench-readdir-recursive.js
new file mode 100644
index 000000000000..6ed56995dcea
--- /dev/null
+++ b/benchmark/fs/bench-readdir-recursive.js
@@ -0,0 +1,47 @@
+'use strict';
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+const bench = common.createBenchmark(main, {
+  n: [10],
+  dir: ['lib', 'test/parallel', 'test'],
+  mode: ['sync', 'callback', 'promise'],
+  withFileTypes: ['true', 'false'],
+});
+
+async function main({ n, dir, mode, withFileTypes }) {
+  withFileTypes = withFileTypes === 'true';
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  const options = { recursive: true, withFileTypes };
+  let entries;
+
+  bench.start();
+  switch (mode) {
+    case 'sync':
+      for (let i = 0; i < n; i++) {
+        entries = fs.readdirSync(fullPath, options);
+      }
+      break;
+    case 'callback':
+      for (let i = 0; i < n; i++) {
+        entries = await new Promise((resolve, reject) => {
+          fs.readdir(fullPath, options, (err, result) => {
+            if (err) reject(err);
+            else resolve(result);
+          });
+        });
+      }
+      break;
+    case 'promise':
+      for (let i = 0; i < n; i++) {
+        entries = await fs.promises.readdir(fullPath, options);
+      }
+      break;
+  }
+  bench.end(n);
+
+  assert.ok(entries.length > 0);
+}
diff --git a/benchmark/fs/bench-readdir.js b/benchmark/fs/bench-readdir.js
index e276653f4584..8fa0e7a3cbdc 100644
--- a/benchmark/fs/bench-readdir.js
+++ b/benchmark/fs/bench-readdir.js
@@ -8,18 +8,16 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   (function r(cntr) {
     if (cntr-- <= 0)
       return bench.end(n);
-    fs.readdir(fullPath, { withFileTypes, recursive }, () => {
+    fs.readdir(fullPath, { withFileTypes }, () => {
       r(cntr);
     });
   }(n));
diff --git a/benchmark/fs/bench-readdirSync.js b/benchmark/fs/bench-readdirSync.js
index ce34e083cb53..8ae1d061d1f1 100644
--- a/benchmark/fs/bench-readdirSync.js
+++ b/benchmark/fs/bench-readdirSync.js
@@ -8,17 +8,15 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   for (let i = 0; i < n; i++) {
-    fs.readdirSync(fullPath, { withFileTypes, recursive });
+    fs.readdirSync(fullPath, { withFileTypes });
   }
   bench.end(n);
 }
diff --git a/benchmark/fs/bench-watch-recursive.js b/benchmark/fs/bench-watch-recursive.js
new file mode 100644
index 000000000000..45ed0871718e
--- /dev/null
+++ b/benchmark/fs/bench-watch-recursive.js
@@ -0,0 +1,23 @@
+'use strict';
+
+// Setting up (and tearing down) a recursive fs.watch() on a directory tree.
+// On Linux and other platforms without a native recursive watcher this is
+// implemented in JavaScript on top of per-directory watchers.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+
+const bench = common.createBenchmark(main, {
+  n: [5],
+  dir: ['lib', 'test/fixtures'],
+});
+
+function main({ n, dir }) {
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    fs.watch(fullPath, { recursive: true }).close();
+  }
+  bench.end(n);
+}
diff --git a/benchmark/http2/full-duplex.js b/benchmark/http2/full-duplex.js
new file mode 100644
index 000000000000..d2fec719f95a
--- /dev/null
+++ b/benchmark/http2/full-duplex.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+
+const bench = common.createBenchmark(main, {
+  n: [100],
+  streams: [2],
+  size: [4 * 1024 * 1024],
+  // Use the HTTP/2 protocol default.
+  window: [65535],
+}, {
+  test: { size: 128 * 1024, window: 65535 },
+});
+
+function main({ n, streams, size, window }) {
+  const http2 = require('http2');
+  const payload = Buffer.alloc(size);
+  const server = http2.createSecureServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+    settings: { initialWindowSize: window },
+  });
+
+  let completed = 0;
+  let batches = 0;
+
+  function onTransferComplete() {
+    if (++completed !== streams * 2)
+      return;
+
+    if (++batches === n) {
+      // Report combined upload and download throughput in MiB/s.
+      bench.end(n * streams * size * 2 / (1024 * 1024));
+      client.close();
+      server.close();
+      return;
+    }
+
+    startBatch();
+  }
+
+  server.on('stream', (stream) => {
+    stream.resume();
+    stream.on('end', onTransferComplete);
+    stream.respond();
+    stream.end(payload);
+  });
+
+  let client;
+  function startBatch() {
+    completed = 0;
+    for (let i = 0; i < streams; i++) {
+      const request = client.request({ ':method': 'POST' });
+      request.resume();
+      request.on('end', onTransferComplete);
+      request.end(payload);
+    }
+  }
+
+  server.listen(0, () => {
+    client = http2.connect(`https://localhost:${server.address().port}`, {
+      rejectUnauthorized: false,
+      settings: { initialWindowSize: window },
+    });
+    client.on('connect', () => {
+      bench.start();
+      startBatch();
+    });
+  });
+}
diff --git a/benchmark/misc/startup-core.js b/benchmark/misc/startup-core.js
index 414b00176ad2..d673d415b505 100644
--- a/benchmark/misc/startup-core.js
+++ b/benchmark/misc/startup-core.js
@@ -64,6 +64,7 @@ function main({ n, script, mode }) {
   const warmup = 3;
   const state = { n, finished: -warmup };
   if (mode === 'worker') {
+    // eslint-disable-next-line no-global-assign
     Worker = require('worker_threads').Worker;
     spawnWorker(script, bench, state);
   } else {
diff --git a/benchmark/module/module-require-source-map.js b/benchmark/module/module-require-source-map.js
new file mode 100644
index 000000000000..8353ab39fc82
--- /dev/null
+++ b/benchmark/module/module-require-source-map.js
@@ -0,0 +1,77 @@
+'use strict';
+
+// Loading modules that carry source maps, with source map support enabled.
+// This is the cost paid at startup by applications bundled or transpiled with
+// source maps; the maps are only consulted if a stack trace is generated.
+
+const fs = require('fs');
+const path = require('path');
+const common = require('../common.js');
+const tmpdir = require('../../test/common/tmpdir');
+const benchmarkDirectory = tmpdir.resolve('nodejs-benchmark-module-source-map');
+
+const bench = common.createBenchmark(main, {
+  sourceMap: ['none', 'inline', 'external'],
+  n: [1000],
+}, {
+  setup(configs) {
+    tmpdir.refresh();
+    const maxN = configs.reduce((max, c) => Math.max(max, c.n), 0);
+    createModules(maxN);
+  },
+});
+
+function moduleSource(i) {
+  const methods = [];
+  for (let m = 0; m < 40; m++) {
+    methods.push(`  method${m}(input) { return [].concat(input).map((item) => ({ item, m: ${m}, service: ${i} })); }`);
+  }
+  return `'use strict';
+class Service${i} {
+  constructor(options = {}) { this.options = { retries: 3, ...options }; }
+${methods.join('\n')}
+}
+function helper${i}(list) { return list.filter(Boolean).slice(0, ${i % 7}); }
+module.exports = { Service${i}, helper${i} };
+`;
+}
+
+function sourceMapFor(i, source) {
+  return JSON.stringify({
+    version: 3,
+    file: `${i}.js`,
+    sources: [`../src/${i}.ts`],
+    sourcesContent: [source],
+    names: [],
+    mappings: 'AAAA;' + 'AACA,MAAM;'.repeat(44),
+  });
+}
+
+function createModules(n) {
+  for (const kind of ['none', 'inline', 'external']) {
+    const dir = path.join(benchmarkDirectory, kind);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let i = 0; i < n; i++) {
+      const source = moduleSource(i);
+      let trailer = '';
+      if (kind === 'inline') {
+        const data = Buffer.from(sourceMapFor(i, source)).toString('base64');
+        trailer = `//# sourceMappingURL=data:application/json;base64,${data}\n`;
+      } else if (kind === 'external') {
+        fs.writeFileSync(path.join(dir, `${i}.js.map`), sourceMapFor(i, source));
+        trailer = `//# sourceMappingURL=${i}.js.map\n`;
+      }
+      fs.writeFileSync(path.join(dir, `${i}.js`), source + trailer);
+    }
+  }
+}
+
+function main({ sourceMap, n }) {
+  process.setSourceMapsEnabled(true);
+  const dir = path.join(benchmarkDirectory, sourceMap);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    require(path.join(dir, `${i}.js`));
+  }
+  bench.end(n);
+}
diff --git a/benchmark/quic/h3-request.js b/benchmark/quic/h3-request.js
new file mode 100644
index 000000000000..f96a18407ae1
--- /dev/null
+++ b/benchmark/quic/h3-request.js
@@ -0,0 +1,150 @@
+'use strict';
+
+// Measures a complete HTTP/3 exchange: establish a session, send one request
+// and read the whole response. Run in two modes, so the cost of a resumed
+// 0-RTT session can be compared against a full handshake.
+//
+// The 0-RTT mode needs a session ticket, which can only come from an earlier
+// connection. That first connection is made during warmup, outside the
+// measured region, so what is timed is only the resumed exchange.
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+const { createPrivateKey } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  // '0rtt' resumes from a ticket and sends the request in the very first
+  // flight; '1rtt' is a fresh session each time. 0-RTT is listed first so
+  // that it is the mode the benchmark CI test exercises.
+  mode: ['0rtt', '1rtt'],
+  n: [500],
+}, { flags: ['--experimental-quic', '--experimental-stream-iter',
+             '--no-warnings'] });
+
+async function main({ mode, n }) {
+  const { listen, connect } = require('node:quic');
+  const { bytes } = require('stream/iter');
+
+  const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+  const cert = fixtures.readKey('agent1-cert.pem');
+  const body = new TextEncoder().encode('x'.repeat(256));
+  const decoder = new TextDecoder();
+
+  const request = {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  };
+
+  const endpoint = await listen((session) => {
+    session.opened.catch(() => {});
+    session.closed.catch(() => {});
+    session.onstream = (stream) => { stream.closed.catch(() => {}); };
+  }, {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onheaders() {
+      this.sendHeaders({ ':status': '200' });
+      this.writer.writeSync(body);
+      this.writer.endSync();
+    },
+    endpoint: {
+      maxConnectionsPerHost: 0xFFFF,
+      maxConnectionsTotal: 0xFFFF,
+      sessionCreationRate: 1_000_000,
+      sessionCreationBurst: 1_000_000,
+    },
+  });
+
+  const address = endpoint.address;
+  let received = 0;
+  const onheaders = () => { received++; };
+
+  // A full handshake, one request, one response. When resume is supplied the
+  // request goes out in the first flight, before the handshake completes.
+  async function exchange(resume) {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      ...resume,
+    });
+    const stream = await session.createBidirectionalStream({
+      headers: request,
+      onheaders,
+    });
+    if (resume === undefined) await session.opened;
+    const response = decoder.decode(await bytes(stream));
+    if (response.length !== body.length) {
+      throw new Error(`short response: ${response.length}`);
+    }
+    session.close();
+    await session.closed.catch(() => {});
+    return session;
+  }
+
+  // Collect a ticket for the 0-RTT mode from a connection that is not timed.
+  let resume;
+  if (mode === '0rtt') {
+    const { promise, resolve } = Promise.withResolvers();
+    let ticket;
+    let token;
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      onsessionticket(value) {
+        ticket ??= value;
+        if (token !== undefined) resolve();
+      },
+      onnewtoken(value) {
+        token ??= value;
+        if (ticket !== undefined) resolve();
+      },
+    });
+    await session.opened;
+    await promise;
+    session.close();
+    await session.closed.catch(() => {});
+    resume = { sessionTicket: ticket, token };
+  }
+
+  // The timed 0-RTT exchanges deliberately never await session.opened, since
+  // waiting for the handshake is exactly what 0-RTT avoids. That leaves no
+  // opportunity to notice early data being refused, so check separately -
+  // otherwise a ticket the server stopped accepting would quietly turn this
+  // into a measurement of the 1-RTT path.
+  async function checkEarlyDataAccepted() {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      ...resume,
+    });
+    const stream = await session.createBidirectionalStream({
+      headers: request,
+      onheaders,
+    });
+    const info = await session.opened;
+    await bytes(stream);
+    session.close();
+    await session.closed.catch(() => {});
+    if (!info.earlyDataAccepted) {
+      throw new Error('0-RTT was not accepted, benchmark would be invalid');
+    }
+  }
+
+  for (let i = 0; i < 20; i++) await exchange(resume);
+  if (mode === '0rtt') await checkEarlyDataAccepted();
+
+  received = 0;
+  bench.start();
+  for (let i = 0; i < n; i++) await exchange(resume);
+  bench.end(n);
+
+  if (received !== n) throw new Error(`missing responses: ${received}/${n}`);
+  // The ticket is reused for every iteration, so confirm it was still being
+  // accepted at the end of the run and not just at the start.
+  if (mode === '0rtt') await checkEarlyDataAccepted();
+  await endpoint.close();
+}
diff --git a/benchmark/quic/handshake.js b/benchmark/quic/handshake.js
new file mode 100644
index 000000000000..9f0404008e03
--- /dev/null
+++ b/benchmark/quic/handshake.js
@@ -0,0 +1,74 @@
+'use strict';
+
+// Measures the cost of establishing QUIC sessions: how many complete
+// handshakes per second a single endpoint can serve, for raw QUIC and for
+// HTTP/3. Nothing is sent on the session beyond what the protocol itself
+// requires, so this isolates connection setup rather than data transfer.
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+const { createPrivateKey } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  // 'raw' negotiates a non-HTTP ALPN and does no application work.
+  // 'h3' negotiates HTTP/3, so the server also builds an nghttp3 connection
+  // and its control/QPACK streams for every session.
+  protocol: ['raw', 'h3'],
+  concurrency: [1, 10],
+  n: [1000],
+}, { flags: ['--experimental-quic', '--no-warnings'] });
+
+async function main({ protocol, concurrency, n }) {
+  const { listen, connect } = require('node:quic');
+
+  const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+  const cert = fixtures.readKey('agent1-cert.pem');
+  const alpn = protocol === 'h3' ? 'h3' : 'quic-bench';
+
+  const endpoint = await listen((session) => {
+    // A benchmark peer never reads these; swallow so a torn-down session
+    // cannot produce an unhandled rejection.
+    session.opened.catch(() => {});
+    session.closed.catch(() => {});
+  }, {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    alpn: [alpn],
+    // The defaults rate-limit session creation per host, which a benchmark
+    // hammering a single address would otherwise trip.
+    endpoint: {
+      maxConnectionsPerHost: 0xFFFF,
+      maxConnectionsTotal: 0xFFFF,
+      sessionCreationRate: 1_000_000,
+      sessionCreationBurst: 1_000_000,
+    },
+  });
+
+  const address = endpoint.address;
+
+  async function handshake() {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn,
+    });
+    await session.opened;
+    session.close();
+    await session.closed.catch(() => {});
+  }
+
+  async function run(count) {
+    for (let i = 0; i < count; i += concurrency) {
+      const batch = Math.min(concurrency, count - i);
+      await Promise.all(Array.from({ length: batch }, handshake));
+    }
+  }
+
+  // Warm up the TLS and QUIC machinery before measuring.
+  await run(Math.min(100, n));
+
+  bench.start();
+  await run(n);
+  bench.end(n);
+
+  await endpoint.close();
+}
diff --git a/benchmark/scatter-node-bench.js b/benchmark/scatter-node-bench.js
new file mode 100644
index 000000000000..4527ecc6b8b4
--- /dev/null
+++ b/benchmark/scatter-node-bench.js
@@ -0,0 +1,131 @@
+'use strict';
+
+const CLI = require('./_cli.js');
+const {
+  analyzeScatter,
+  validateScatterParameters,
+} = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node scatter-node-bench.js [options] [--] <file>
+  Run an explicit node:bench file repeatedly and output each independent
+  observation with its benchmark parameters as CSV, or summarize the results
+  directly with --analyze.
+
+  --node         ./node     Node.js binary
+  --runs         30         number of observations
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to the binary (repeatable)
+  --analyze                 print a statistical summary instead of CSV
+  --xaxis        parameter  parameter to group by with --analyze (required)
+  --category     parameter  optional second grouping parameter
+  --no-chart                omit the analysis bar chart
+`, {
+  arrayArgs: ['node-arg'],
+  boolArgs: ['analyze', 'no-chart'],
+});
+
+if (cli.items.length !== 1) cli.abort(cli.usage);
+if (cli.optional.analyze && cli.optional.xaxis === undefined) {
+  cli.abort('--analyze requires --xaxis <parameter>');
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binary = cli.optional.node || process.execPath;
+  const rows = [];
+  const paramNames = new Set();
+  const csvGroups = new Map();
+  let expectedIdentities;
+  let logicalIdentity;
+
+  for (let run = 0; run < runs; run++) {
+    const samples = await runBenchmark(binary, cli.items[0], options);
+    if (run === 0 && cli.optional.analyze) {
+      validateScatterParameters(
+        samples, cli.optional.xaxis, cli.optional.category);
+    }
+    const identities = new Set();
+    for (const sample of samples) {
+      if (logicalIdentity !== undefined &&
+          logicalIdentity !== sample.logicalIdentity) {
+        throw new Error(
+          'scatter-node-bench.js requires one logical benchmark name per file',
+        );
+      }
+      logicalIdentity = sample.logicalIdentity;
+      if (identities.has(sample.identity)) {
+        throw new Error(`Benchmark '${sample.name}' was reported more than once`);
+      }
+      identities.add(sample.identity);
+      const csvGroup = JSON.stringify([sample.name, sample.params]);
+      const groupedIdentity = csvGroups.get(csvGroup);
+      if (groupedIdentity !== undefined &&
+          groupedIdentity !== sample.identity) {
+        throw new Error(
+          `Distinct benchmarks would share the CSV group '${sample.name}'`,
+        );
+      }
+      csvGroups.set(csvGroup, sample.identity);
+      rows.push({ ...sample, observation: run });
+      for (const name of Object.keys(sample.params)) paramNames.add(name);
+    }
+    if (expectedIdentities === undefined) {
+      expectedIdentities = identities;
+    } else if (identities.size !== expectedIdentities.size ||
+               ![...identities].every((id) => expectedIdentities.has(id))) {
+      throw new Error('The set of reported benchmarks changed between runs');
+    }
+  }
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+
+  const params = [...paramNames].sort();
+  if (cli.optional.analyze) {
+    const output = analyzeScatter(
+      rows,
+      cli.optional.xaxis,
+      cli.optional.category,
+      !cli.optional['no-chart'],
+    );
+    process.stdout.write(output);
+    return;
+  }
+
+  for (const name of params) {
+    if (name === 'filename' || name === 'rate' || name === 'time') {
+      throw new Error(`Benchmark parameter '${name}' is reserved in scatter CSV`);
+    }
+  }
+  const header = ['filename', ...params, 'rate', 'time']
+    .map(csvEncode)
+    .join(',');
+  const output = [header];
+  for (const row of rows) {
+    const values = [
+      csvEncode(row.name),
+      ...params.map((name) => csvEncode(row.params[name] ?? '')),
+      row.rate,
+      row.duration,
+    ];
+    output.push(values.join(','));
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/scatter.js b/benchmark/scatter.js
index 858169d7d68c..cb1df965b70f 100644
--- a/benchmark/scatter.js
+++ b/benchmark/scatter.js
@@ -1,62 +1,167 @@
 'use strict';
 
-const fork = require('child_process').fork;
+const { spawn, fork } = require('node:child_process');
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('util');
 const path = require('path');
 const CLI = require('./_cli.js');
+const BenchmarkProgress = require('./_benchmark_progress.js');
 
 //
 // Parse arguments
 //
 const cli = new CLI(`usage: ./node scatter.js [options] [--] <filename>
   Run the benchmark script <filename> many times and output the rate (ops/s)
-  together with the benchmark variables as a csv.
+  together with the benchmark variables as a csv, which can be processed using
+  for example 'scatter.R'. Use --analyze to summarize the results directly
+  without R.
 
   --runs 30              number of samples
   --set  variable=value  set benchmark variable (can be repeated)
-`, { arrayArgs: ['set'] });
+  --no-progress          don't show benchmark progress indicator
+  --analyze              print a statistical summary (mean rate and confidence
+                         interval per group) instead of csv output
+  --xaxis     variable   variable to group by when using --analyze (required
+                         by --analyze)
+  --category  variable   additional variable to group by when using --analyze
+  --no-chart             don't print the bar chart when using --analyze
+
+  Examples:
+    --set CPUSET=0            Runs benchmarks on CPU core 0.
+    --set CPUSET=0-2          Specifies that benchmarks should run on CPU cores 0 to 2.
+
+  Note: The CPUSET format should match the specifications of the 'taskset' command
+`, {
+  arrayArgs: ['set'],
+  boolArgs: ['no-progress', 'analyze', 'no-chart'],
+});
 
 if (cli.items.length !== 1) {
   cli.abort(cli.usage);
 }
 
-// Create queue from the benchmarks list such both node versions are tested
-// `runs` amount of times each.
 const filepath = path.resolve(cli.items[0]);
-const name = filepath.slice(__dirname.length + 1);
+const name = path.relative(__dirname, filepath);
 const runs = cli.optional.runs ? parseInt(cli.optional.runs, 10) : 30;
+const analyze = !!cli.optional.analyze;
+const showChart = !cli.optional['no-chart'];
+const xAxis = cli.optional.xaxis;
+const category = cli.optional.category;
+
+// Grouping is what makes the summary meaningful, so --analyze needs to know
+// which variable is the independent one. There is no sensible default: the
+// answer depends entirely on what is being measured.
+if (analyze && !xAxis) {
+  cli.abort(
+    `--analyze requires --xaxis <variable>
+
+  --xaxis names the benchmark variable to summarize against; --category
+  optionally breaks each point down by a second variable. Both must be
+  configuration variables of this benchmark -- the keys passed to
+  createBenchmark() at the top of the benchmark file. Nearly every
+  benchmark defines 'n'; parameter sweeps add a size or mode variable
+  such as 'len', 'size' or 'encoding'.
+
+  Example:
+    ./node benchmark/scatter.js --analyze --xaxis n ${name}
+`,
+  );
+}
+
+// When --analyze is set, collect results rather than streaming csv.
+const samples = analyze ? [] : null;
 
 let printHeader = true;
 
 function csvEncodeValue(value) {
-  if (typeof value === 'number') {
+  // Benchmark configuration values are numbers, booleans or strings
+  // (see the config parsing in common.js). Only strings need quoting,
+  // but anything unexpected is stringified rather than crashing the run.
+  if (typeof value === 'number' || typeof value === 'boolean') {
     return value.toString();
   }
-  return `"${value.replace(/"/g, '""')}"`;
+  return `"${String(value).replace(/"/g, '""')}"`;
+}
+
+// Note: BenchmarkProgress reports progress per file; scatter.js only ever
+// runs one file, so every queue entry shares the same filename.
+const queue = [];
+for (let iter = 0; iter < runs; iter++) {
+  queue.push({ filename: name, iter });
+}
+
+const kStartOfQueue = 0;
+
+const showProgress = !cli.optional['no-progress'];
+let progress;
+if (showProgress) {
+  progress = new BenchmarkProgress(queue, [name], { analyze });
+  progress.startQueue(kStartOfQueue);
 }
 
 (function recursive(i) {
-  const child = fork(path.resolve(__dirname, filepath), cli.optional.set);
+  const cpuCore = cli.getCpuCoreSetting();
+  let child;
+  if (cpuCore !== null) {
+    const spawnArgs = ['-c', cpuCore, process.execPath, filepath, ...cli.optional.set];
+    child = spawn('taskset', spawnArgs, {
+      env: process.env,
+      stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+    });
+  } else {
+    child = fork(filepath, cli.optional.set);
+  }
 
   child.on('message', (data) => {
-    if (data.type !== 'report') {
+    if (data.type === 'config') {
+      if (showProgress) {
+        progress.startSubqueue(data, i);
+      }
       return;
     }
 
-    // print csv header
-    if (printHeader) {
-      const confHeader = Object.keys(data.conf)
-        .map(csvEncodeValue)
-        .join(', ');
-      console.log(`"filename", ${confHeader}, "rate", "time"`);
-      printHeader = false;
+    if (data.type !== 'report') {
+      return;
     }
 
-    // print data row
-    const confData = Object.keys(data.conf)
-      .map((key) => csvEncodeValue(data.conf[key]))
-      .join(', ');
+    if (analyze) {
+      // Validate the grouping variables against the first result rather than
+      // at the end. A typo in --xaxis is otherwise not reported until the
+      // whole run has finished, which can be many minutes of wasted work.
+      if (samples.length === 0) {
+        const confKeys = Object.keys(data.conf);
+        for (const key of [xAxis, category]) {
+          if (key !== undefined && !confKeys.includes(key)) {
+            child.kill();
+            cli.abort(
+              `The variable "${key}" is not a configuration of ${name}.\n` +
+              `Available variables: ${confKeys.join(', ')}`,
+            );
+          }
+        }
+      }
+      samples.push(data);
+    } else {
+      // print csv header
+      if (printHeader) {
+        const confHeader = Object.keys(data.conf)
+          .map(csvEncodeValue)
+          .join(',');
+        console.log(`"filename",${confHeader},"rate","time"`);
+        printHeader = false;
+      }
+
+      // print data row
+      const confData = Object.keys(data.conf)
+        .map((key) => csvEncodeValue(data.conf[key]))
+        .join(',');
 
-    console.log(`"${name}", ${confData}, ${data.rate}, ${data.time}`);
+      console.log(`"${name}",${confData},${data.rate},${data.time}`);
+    }
+
+    if (showProgress) {
+      progress.completeConfig(data);
+    }
   });
 
   child.once('close', (code) => {
@@ -64,10 +169,768 @@ function csvEncodeValue(value) {
       process.exit(code);
       return;
     }
+    if (showProgress) {
+      progress.completeRun(queue[i]);
+    }
 
     // If there are more benchmarks execute the next
     if (i + 1 < runs) {
       recursive(i + 1);
+    } else if (analyze) {
+      printAnalysis(samples, xAxis, category);
     }
   });
-})(0);
+})(kStartOfQueue);
+
+//
+// Statistics
+//
+// scatter.R obtains the t quantile from R's qt(); without R it has to be
+// computed here. The Student's t tail probability is an incomplete beta
+// function, which is evaluated directly, and the quantile is recovered by
+// bisecting it. Bisection rather than an inverse-beta routine because the
+// cost is irrelevant at this scale and the error bound is explicit.
+//
+
+// Lanczos approximation, g=7, n=9.
+function logGamma(x) {
+  const g = [
+    676.5203681218851, -1259.1392167224028, 771.32342877765313,
+    -176.61502916214059, 12.507343278686905, -0.13857109526572012,
+    9.9843695780195716e-6, 1.5056327351493116e-7,
+  ];
+  if (x < 0.5) {
+    // Reflection formula.
+    return Math.log(Math.PI / Math.sin(Math.PI * x)) - logGamma(1 - x);
+  }
+  x -= 1;
+  let a = 0.99999999999980993;
+  const t = x + 7.5;
+  for (let i = 0; i < g.length; i++) {
+    a += g[i] / (x + i + 1);
+  }
+  return 0.5 * Math.log(2 * Math.PI) + (x + 0.5) * Math.log(t) - t + Math.log(a);
+}
+
+// Continued fraction for the incomplete beta function (Lentz's algorithm).
+function betaContinuedFraction(x, a, b) {
+  const tiny = 1e-30;
+  const qab = a + b;
+  const qap = a + 1;
+  const qam = a - 1;
+  let c = 1;
+  let d = 1 - qab * x / qap;
+  if (Math.abs(d) < tiny) d = tiny;
+  d = 1 / d;
+  let h = d;
+  for (let m = 1; m <= 300; m++) {
+    const m2 = 2 * m;
+    let aa = m * (b - m) * x / ((qam + m2) * (a + m2));
+    d = 1 + aa * d;
+    if (Math.abs(d) < tiny) d = tiny;
+    c = 1 + aa / c;
+    if (Math.abs(c) < tiny) c = tiny;
+    d = 1 / d;
+    h *= d * c;
+    aa = -(a + m) * (qab + m) * x / ((a + m2) * (qap + m2));
+    d = 1 + aa * d;
+    if (Math.abs(d) < tiny) d = tiny;
+    c = 1 + aa / c;
+    if (Math.abs(c) < tiny) c = tiny;
+    d = 1 / d;
+    const del = d * c;
+    h *= del;
+    if (Math.abs(del - 1) < 1e-14) break;
+  }
+  return h;
+}
+
+// Regularized incomplete beta function I_x(a, b).
+function incompleteBeta(x, a, b) {
+  if (x <= 0) return 0;
+  if (x >= 1) return 1;
+  const lbeta = logGamma(a + b) - logGamma(a) - logGamma(b);
+  // Use the continued fraction on whichever side converges quickly.
+  if (x < (a + 1) / (a + b + 2)) {
+    return Math.exp(lbeta + a * Math.log(x) + b * Math.log(1 - x)) *
+           betaContinuedFraction(x, a, b) / a;
+  }
+  return 1 - Math.exp(lbeta + b * Math.log(1 - x) + a * Math.log(x)) *
+             betaContinuedFraction(1 - x, b, a) / b;
+}
+
+// Two-tailed probability P(|T| > t) for Student's t with v degrees of freedom.
+function tTailProbability(t, v) {
+  return incompleteBeta(v / (v + t * t), v / 2, 0.5);
+}
+
+// Quantile of Student's t: the value q with P(T <= q) = p, for p > 0.5.
+// Equivalent to R's qt(p, v). Accurate to ~1e-6 over the range used here.
+function tQuantile(p, v) {
+  const alpha = 2 * (1 - p);
+  let lo = 0;
+  let hi = 1e3;
+  for (let i = 0; i < 200; i++) {
+    const mid = (lo + hi) / 2;
+    if (tTailProbability(mid, v) > alpha) {
+      lo = mid;
+    } else {
+      hi = mid;
+    }
+  }
+  return (lo + hi) / 2;
+}
+
+function printAnalysis(samples, xAxis, category) {
+  if (samples.length === 0) {
+    console.error('No benchmark results were reported.');
+    process.exitCode = 1;
+    return;
+  }
+
+  // The grouping variables were already validated against the first result.
+  const confKeys = Object.keys(samples[0].conf);
+
+  // Every variable that is neither a grouping variable nor constant across
+  // the run is averaged over. Report them: an aggregated variable can hide a
+  // real effect, and the reader has no other way to know it happened.
+  const aggregated = confKeys.filter((key) => {
+    if (key === xAxis || key === category) return false;
+    const first = samples[0].conf[key];
+    return samples.some((s) => s.conf[key] !== first);
+  });
+
+  // Group by the grouping variables. The full sample is retained, not just
+  // the rate, so the aggregated variables can be accounted for below.
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.conf[xAxis];
+    const catValue = category === undefined ? undefined : sample.conf[category];
+    const key = `${String(xValue)}\u0000${String(catValue)}`;
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = { xValue, catValue, rates: [], members: [] };
+      groups.set(key, group);
+    }
+    group.rates.push(sample.rate);
+    group.members.push(sample);
+  }
+
+  // Naming an aggregated variable is not enough: if it drives most of the
+  // spread within a group, every interval below is reporting that variable
+  // rather than the benchmark's noise, and no number of --runs will shrink
+  // it. Quantify the share so the reader can tell those cases apart.
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    contamination.set(variable, varianceShare([...groups.values()], variable));
+  }
+
+  for (const variable of aggregated) {
+    const share = contamination.get(variable);
+    // Rounding 99.7% up to "100%" would claim the residual noise is zero.
+    const percent = share === 1 ?
+      '100' :
+      (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' :
+      ` (explains ${percent}% of within-group variance)`;
+    console.log(`aggregating variable: ${variable}${suffix}`);
+  }
+
+  // Aggregation that dominates the spread is the single most common reason
+  // for uselessly wide intervals, and the usual reaction -- raising --runs --
+  // cannot help, because the spread is a real effect of a variable that has
+  // been averaged over rather than sampling noise.
+  const dominant = aggregated.filter((v) => contamination.get(v) > 0.5);
+  if (dominant.length > 0) {
+    console.log('');
+    const one = dominant.length === 1;
+    printWrapped(
+      `Note: ${dominant.join(', ')} ${one ? 'explains' : 'explain'} most of ` +
+      `the spread within each group, so the intervals below describe ` +
+      `${one ? 'that variable' : 'those variables'} rather than the ` +
+      `benchmark's own noise, and more --runs will not narrow them. Pin ` +
+      `${one ? 'it' : 'them'} with --set ${dominant[0]}=<value>, or pass as ` +
+      `--category, for intervals that can be acted on.`,
+    );
+  }
+
+  if (aggregated.length > 0) {
+    console.log('');
+  }
+
+  const compare = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+
+  const scale = histogramScale(samples.map((s) => s.rate));
+
+  const rows = [...groups.values()]
+    .sort((a, b) => compare(a.xValue, b.xValue) ||
+                    compare(a.catValue, b.catValue))
+    .map((group) => {
+      const rates = group.rates;
+      const n = rates.length;
+      const mean = rates.reduce((a, b) => a + b, 0) / n;
+
+      // Confidence interval of the mean, matching scatter.R: the sample
+      // standard error scaled by the t quantile at 97.5%. Computed from the
+      // raw samples rather than the histogram, which stores bucketed values.
+      // Undefined for a single sample, where there is no spread to estimate.
+      let ci = NaN;
+      if (n > 1) {
+        const variance =
+          rates.reduce((sum, r) => sum + (r - mean) ** 2, 0) / (n - 1);
+        ci = Math.sqrt(variance / n) * tQuantile(0.975, n - 1);
+      }
+
+      // The histogram supplies the statistics that have no closed form here:
+      // an exact-binomial interval on the median, and the shape measures used
+      // to decide whether the mean is worth trusting.
+      const histogram = createHistogram({ figures: 5 });
+      for (const rate of rates) {
+        histogram.record(Math.max(1, Math.round(rate * scale)));
+      }
+
+      const medianCI = histogram.percentileCI(50);
+      const median = medianCI.value / scale;
+      const skewness = n > 1 ? histogram.skewness : NaN;
+
+      // A summary is suspect when the two estimates of the centre disagree by
+      // more than the uncertainty claimed for one of them, or when the sample
+      // is badly asymmetric. Either way the mean is being moved by the tail
+      // rather than describing the bulk of the runs.
+      const skewed = n > 1 &&
+        (Math.abs(skewness) > 1 || Math.abs(median - mean) > ci);
+
+      return {
+        ...group,
+        n,
+        mean,
+        ci,
+        histogram,
+        median,
+        medianLower: medianCI.lower / scale,
+        medianUpper: medianCI.upper / scale,
+        skewness,
+        skewed,
+      };
+    });
+
+  // Values are rendered through short labels so that long or non-printable
+  // configuration values cannot break the layout.
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'catValue', 'catLabel'));
+  }
+
+  printTable(rows, xAxis, category);
+
+  if (showChart) {
+    printChart(rows, xAxis, category);
+  }
+
+  printComparisons(rows, xAxis, category);
+  printLegend(legend);
+
+  const singleSample = rows.filter((r) => r.n < 2).length;
+  if (singleSample > 0) {
+    console.log('');
+    printWrapped(
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      `only one sample, so no confidence interval could be estimated. ` +
+      `Use --runs 2 or higher.`,
+    );
+  }
+
+  if (rows.some((r) => r.skewed)) {
+    console.log('');
+    printWrapped(
+      `(!) marks groups where the median falls outside the mean's confidence ` +
+      `interval, or the sample is strongly skewed (|skewness| > 1). For those ` +
+      `rows the mean is being pulled by a few slow or fast runs, so the ` +
+      `median and its interval describe the typical run better. This is ` +
+      `usually GC or JIT tiering; more --runs will not necessarily make it ` +
+      `go away.`,
+    );
+  }
+}
+
+// HdrHistogram records positive integers with a fixed number of significant
+// figures, so precision is relative and large rates need no scaling at all.
+// Small rates do: without scaling, anything below 1 op/s rounds to the same
+// bucket and the group collapses to a single value. Scale up until the
+// smallest rate carries enough digits for rounding to be irrelevant.
+function histogramScale(rates) {
+  let min = Infinity;
+  let max = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < min) min = rate;
+    if (rate > max) max = rate;
+  }
+  if (!Number.isFinite(min) || max === 0) return 1;
+
+  let scale = 1;
+  while (min * scale < 1e6 && max * scale < 1e15) {
+    scale *= 10;
+  }
+  return scale;
+}
+
+// Share of the within-group variance attributable to one aggregated
+// variable, pooled over groups. This is a one-way eta squared: the spread
+// between that variable's levels divided by the total spread inside the
+// group. Computed per variable and independently, so when two aggregated
+// variables are correlated their shares overlap and do not sum to one.
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+
+  for (const group of groups) {
+    const members = group.members;
+    if (members.length < 2) continue;
+
+    const groupMean =
+      members.reduce((sum, s) => sum + s.rate, 0) / members.length;
+
+    // Partition the group by the level of this variable.
+    const levels = new Map();
+    for (const sample of members) {
+      const key = String(sample.conf[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { sum: 0, count: 0 };
+        levels.set(key, level);
+      }
+      level.sum += sample.rate;
+      level.count++;
+    }
+
+    // A variable with a single level inside this group explains nothing
+    // here, but the group still contributes to the total spread.
+    for (const level of levels.values()) {
+      const levelMean = level.sum / level.count;
+      between += level.count * (levelMean - groupMean) ** 2;
+    }
+    for (const sample of members) {
+      total += (sample.rate - groupMean) ** 2;
+    }
+  }
+
+  if (total === 0) return NaN;
+  return Math.min(1, between / total);
+}
+
+// The smallest p-value the Mann-Whitney implementation can return for these
+// sample sizes, found by giving it perfectly separated groups. Below a
+// certain size that floor sits above 0.05, meaning no effect of any
+// magnitude can be reported as significant; a non-significant result then
+// says nothing at all. Derived from the implementation rather than the exact
+// combinatorial bound because it uses a normal approximation.
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(nA, nB) {
+  const key = `${nA},${nB}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor === undefined) {
+    // Values must stay distinct after the histogram's 5-significant-figure
+    // rounding, or they collapse into ties and the tie correction reports a
+    // floor lower than the test can actually reach. The 10000 range is exact
+    // at that precision, and the two runs cannot overlap.
+    const low = createHistogram({ figures: 5 });
+    const high = createHistogram({ figures: 5 });
+    for (let i = 0; i < nA; i++) low.record(10000 + i);
+    for (let i = 0; i < nB; i++) high.record(10000 + nA + i);
+    floor = high.mannWhitneyTest(low).pValue;
+    mannWhitneyFloors.set(key, floor);
+  }
+  return floor;
+}
+
+// Cliff's delta magnitude thresholds (Romano et al.), the conventional
+// reading of the statistic.
+function effectSizeLabel(delta) {
+  const d = Math.abs(delta);
+  if (d < 0.147) return 'negligible';
+  if (d < 0.33) return 'small';
+  if (d < 0.474) return 'medium';
+  return 'large';
+}
+
+// The question scatter.js exists to answer is whether a parameter changes the
+// rate, which the per-group table only hints at through overlapping intervals.
+// Compare consecutive x-axis values directly, holding the category fixed.
+// Mann-Whitney rather than a t-test because a parameter sweep routinely
+// changes the shape and spread of the distribution, not just its centre.
+function printComparisons(rows, xAxis, category) {
+  const usable = rows.filter((row) => row.n > 1);
+  if (usable.length < 2) return;
+
+  // Partition by category so each series is a sweep over the x-axis alone.
+  const series = new Map();
+  for (const row of usable) {
+    const key = String(row.catValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+
+  const lines = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+
+    const entries = [];
+    for (let i = 1; i < group.length; i++) {
+      const previous = group[i - 1];
+      const current = group[i];
+      const { pValue } = current.histogram.mannWhitneyTest(previous.histogram);
+      const delta = current.histogram.cliffsD(previous.histogram);
+      const change = ((current.mean - previous.mean) / previous.mean) * 100;
+
+      floor = Math.max(floor, mannWhitneyFloor(previous.n, current.n));
+
+      // How the rate scales with the parameter over this step, which is the
+      // complexity question these sweeps are usually run to answer. Reported
+      // per step rather than as one fit across the whole sweep: a single
+      // exponent spanning a curve that changes regime describes neither.
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previous.mean > 0 && current.mean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(current.mean / previous.mean) /
+                      Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+
+      entries.push({
+        transition: `${previous.xLabel} -> ${current.xLabel}`,
+        change: `${change >= 0 ? '+' : ''}${change.toFixed(2)}%`,
+        ratio,
+        exponent,
+        pValue: pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4),
+        delta: `${delta >= 0 ? '+' : ''}${delta.toFixed(3)}`,
+        label: effectSizeLabel(delta),
+      });
+    }
+
+    if (entries.length > 0) {
+      lines.push({
+        heading: category === undefined ?
+          null :
+          `${category}=${group[0].catLabel}`,
+        entries,
+      });
+    }
+  }
+
+  if (lines.length === 0) return;
+
+  const all = lines.flatMap((l) => l.entries);
+  const widths = {
+    transition: Math.max(...all.map((e) => displayWidth(e.transition))),
+    change: Math.max(...all.map((e) => displayWidth(e.change))),
+    ratio: Math.max(...all.map((e) => displayWidth(e.ratio))),
+    exponent: Math.max(...all.map((e) => displayWidth(e.exponent))),
+    pValue: Math.max(...all.map((e) => displayWidth(e.pValue))),
+    delta: Math.max(...all.map((e) => displayWidth(e.delta))),
+  };
+  const rpad = (s, n) => padTo(s, n, true);
+  const pad = (s, n) => padTo(s, n, false);
+
+  console.log('');
+  console.log(`Change between consecutive ${xAxis} values ` +
+              `(Mann-Whitney U, Cliff's delta):`);
+
+  for (const { heading, entries } of lines) {
+    console.log('');
+    if (heading !== null) {
+      console.log(`  ${heading}`);
+    }
+    for (const entry of entries) {
+      console.log(
+        `    ${pad(entry.transition, widths.transition)}` +
+        `  ${rpad(entry.change, widths.change)}` +
+        (widths.exponent > 0 ?
+          `  ${rpad(entry.ratio, widths.ratio)}` +
+          `  exponent=${rpad(entry.exponent, widths.exponent)}` :
+          '') +
+        `  p=${rpad(entry.pValue, widths.pValue)}` +
+        `  delta=${rpad(entry.delta, widths.delta)} (${entry.label})`,
+      );
+    }
+  }
+
+  // A p-value has to be read against what the test could have produced. Below
+  // a certain sample size the floor sits above the threshold, and "not
+  // significant" then carries no information whatsoever.
+  if (floor >= 0.05) {
+    console.log('');
+    printWrapped(
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      `significance however large the real effect is. Treat every p-value ` +
+      `here as uninformative and raise --runs.`,
+    );
+  } else if (floor >= 0.005) {
+    console.log('');
+    printWrapped(
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. A non-significant result above is therefore ` +
+      `weak evidence of no change rather than evidence of none; raise ` +
+      `--runs to strengthen it.`,
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    minimumFractionDigits: 1,
+    maximumFractionDigits: 1,
+  });
+}
+
+// Widest a single variable value may be before it is abbreviated. Benchmark
+// values are usually short (`16`, `'ascii'`), but some are long enough to
+// destroy the layout on their own, so there has to be a ceiling.
+const kMaxValueWidth = 24;
+
+// Widest a composed chart label may be, since it can hold two values.
+const kMaxChartLabelWidth = 44;
+
+// Widths are measured in code points, not UTF-16 code units: several
+// benchmarks use emoji and CJK in their configurations, and counting those
+// as two would misalign every column to their right.
+function displayWidth(text) {
+  return [...text].length;
+}
+
+function padTo(text, width, alignRight) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(text)));
+  return alignRight ? padding + text : text + padding;
+}
+
+// Drop out the middle rather than the tail: benchmark values that share a
+// long prefix are common, and a head-only truncation would render them
+// identical. Slicing by code point rather than by index so that an astral
+// character cannot be cut in half into a lone surrogate.
+function truncateMiddle(text, maxWidth) {
+  const chars = [...text];
+  if (chars.length <= maxWidth) return text;
+  const keep = maxWidth - 3;
+  const head = Math.ceil(keep / 2);
+  const tail = Math.floor(keep / 2);
+  return `${chars.slice(0, head).join('')}...` +
+         `${chars.slice(chars.length - tail).join('')}`;
+}
+
+// Configuration values are not guaranteed to be printable: strings may carry
+// newlines or tabs (see benchmark/mime/mimetype-instantiation.js), which
+// would otherwise split a table row across several lines. inspect() escapes
+// them and quotes strings, matching how compare.js renders configurations.
+function displayValue(value) {
+  const text = typeof value === 'string' ? inspect(value) : String(value);
+  return { text: truncateMiddle(text, kMaxValueWidth), full: text };
+}
+
+// Assigns a short, unique, printable label to every distinct value of one
+// grouping variable, and collects the abbreviated ones for a legend so the
+// full value is still recoverable from the output.
+function assignLabels(rows, valueField, labelField) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+
+  for (const row of rows) {
+    const key = String(row[valueField]);
+    let label = assigned.get(key);
+
+    if (label === undefined) {
+      const { text, full } = displayValue(row[valueField]);
+      // Two different values can abbreviate to the same text; keep them
+      // distinguishable so the table cannot show one group twice.
+      const collisions = used.get(text) ?? 0;
+      used.set(text, collisions + 1);
+      label = collisions === 0 ? text : `${text}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (text !== full) legend.push({ label, full });
+    }
+
+    row[labelField] = label;
+  }
+
+  return legend;
+}
+
+// Notes interpolate variable names and sample sizes, so their length is not
+// known when they are written. Wrapping here rather than hand-placing
+// newlines, which overflow as soon as an interpolated value is longer than
+// the author guessed.
+function printWrapped(text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') {
+      line = word;
+    } else if (displayWidth(line) + 1 + displayWidth(word) <= width) {
+      line += ` ${word}`;
+    } else {
+      console.log(line);
+      line = word;
+    }
+  }
+  if (line !== '') console.log(line);
+}
+
+function printLegend(legend) {
+  if (legend.length === 0) return;
+  console.log('');
+  console.log('Abbreviated values:');
+  for (const { label, full } of legend) {
+    console.log(`  ${label}`);
+    console.log(`    = ${full}`);
+  }
+}
+
+function printTable(rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push('samples', 'rate', 'confidence.interval',
+              'median', 'median.interval', '');
+
+  // Numbers line up on the right, text reads better on the left. The grouping
+  // columns can be either, so they follow the type of the underlying value.
+  const alignRight = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    alignRight.push(typeof rows[0].catValue === 'number');
+  }
+  alignRight.push(true, true, true, true, true, false);
+
+  const body = rows.map((row) => {
+    const cells = [row.xLabel];
+    if (category !== undefined) cells.push(row.catLabel);
+
+    // The median interval is asymmetric, so it is shown as a relative range
+    // rather than a single half-width.
+    const medianInterval = row.n > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+
+    cells.push(
+      String(row.n),
+      formatRate(row.mean),
+      // Absolute for parity with scatter.R, relative because that is what
+      // tells you whether the rate beside it is worth reading. Kept in one
+      // column so every column has a header of its own.
+      Number.isNaN(row.ci) ?
+        'NA' :
+        `${formatRate(row.ci)} (±${((row.ci / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return cells;
+  });
+
+  const widths = header.map((_, col) => Math.max(
+    displayWidth(header[col]),
+    ...body.map((cells) => displayWidth(cells[col])),
+  ));
+
+  const line = (cells) => cells
+    .map((cell, col) => padTo(cell, widths[col], alignRight[col]))
+    .join('  ')
+    .trimEnd();
+
+  console.log(line(header));
+  for (const cells of body) {
+    console.log(line(cells));
+  }
+}
+
+function printChart(rows, xAxis, category) {
+  if (rows.length === 0) return;
+
+  const barWidth = 40;
+  // Bars are drawn from zero so that the visual length is proportional to the
+  // rate. A truncated axis would exaggerate small differences.
+  let maxRate = 0;
+  for (const row of rows) {
+    const extent = row.mean + (Number.isNaN(row.ci) ? 0 : row.ci);
+    if (extent > maxRate) maxRate = extent;
+  }
+  if (maxRate === 0) return;
+
+  const labels = rows.map((row) => {
+    const parts = [`${xAxis}=${row.xLabel}`];
+    if (category !== undefined) parts.push(`${category}=${row.catLabel}`);
+    return truncateMiddle(parts.join(' '), kMaxChartLabelWidth);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(
+    ...rows.map((r) => displayWidth(formatRate(r.mean))));
+
+  const pad = (s, n) => padTo(s, n, false);
+  const rpad = (s, n) => padTo(s, n, true);
+
+  const axisRight = formatRate(maxRate);
+  const indent = ' '.repeat(labelWidth + 2);
+
+  console.log('');
+  console.log('Rate in operations/second; longer is faster. \u2502 marks the ' +
+              'mean and the');
+  console.log('shaded band (\u2591) is its 95% confidence interval, so bars ' +
+              'whose bands');
+  console.log('overlap are not clearly different.');
+  console.log('');
+  console.log(
+    `${indent}0` +
+    `${' '.repeat(Math.max(1, barWidth - 1 - displayWidth(axisRight)))}` +
+    `${axisRight}`,
+  );
+  console.log(`${indent}+${'-'.repeat(Math.max(0, barWidth - 2))}+`);
+
+  let previousX;
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i];
+
+    // A blank line between x-axis values, so the categories being compared at
+    // each point stay visually grouped.
+    if (previousX !== undefined && row.xValue !== previousX) {
+      console.log('');
+    }
+    previousX = row.xValue;
+
+    const barEnd = (row.mean / maxRate) * barWidth;
+    const ci = Number.isNaN(row.ci) ? 0 : row.ci;
+    const ciLeft = ((row.mean - ci) / maxRate) * barWidth;
+    const ciRight = ((row.mean + ci) / maxRate) * barWidth;
+
+    // Without an explicit marker the mean is invisible, because the shaded
+    // interval is drawn over the solid bar and straddles it.
+    const meanCell = Math.min(barWidth - 1, Math.floor(barEnd));
+
+    let bar = '';
+    for (let x = 0; x < barWidth; x++) {
+      const pos = x + 0.5; // Center of this character cell.
+      if (x === meanCell) {
+        bar += '\u2502'; // The mean itself.
+      } else if (pos >= ciLeft && pos <= ciRight) {
+        bar += '\u2591'; // Light shade marks the confidence interval.
+      } else if (pos <= barEnd) {
+        bar += '\u2588';
+      } else {
+        bar += ' ';
+      }
+    }
+
+    console.log(
+      `${pad(labels[i], labelWidth)}  ${bar}  ` +
+      `${rpad(formatRate(row.mean), rateWidth)}`,
+    );
+  }
+}
diff --git a/benchmark/vfs/module-graph.js b/benchmark/vfs/module-graph.js
new file mode 100644
index 000000000000..aee5e8616198
--- /dev/null
+++ b/benchmark/vfs/module-graph.js
@@ -0,0 +1,62 @@
+'use strict';
+const path = require('path');
+const { pathToFileURL } = require('url');
+const common = require('../common.js');
+
+const bench = common.createBenchmark(main, {
+  type: ['cjs', 'esm'],
+  files: [1e2, 1e3],
+  n: [10],
+}, { flags: ['--experimental-vfs', '--no-warnings'] });
+
+// Builds a module graph of `files` packages, each with its own package.json,
+// an index requiring a package-local file and a shared root module, and an
+// entry point that pulls in every package.
+function buildGraph(layer, files, type) {
+  const entryRequires = [];
+  if (type === 'esm') {
+    layer.writeFileSync('/package.json', '{"type":"module"}');
+  }
+  layer.writeFileSync('/shared.js',
+                      type === 'cjs' ? 'module.exports = 0;' : 'export default 0;');
+  for (let i = 0; i < files; i++) {
+    layer.mkdirSync(`/${i}`, { recursive: true });
+    if (type === 'cjs') {
+      layer.writeFileSync(`/${i}/package.json`, '{"main":"index.js"}');
+      layer.writeFileSync(`/${i}/lib.js`, 'module.exports = 1;');
+      layer.writeFileSync(
+        `/${i}/index.js`,
+        'require("./lib.js"); require("../shared.js"); module.exports = __filename;');
+      entryRequires.push(`require('./${i}/');`);
+    } else {
+      layer.writeFileSync(`/${i}/package.json`, '{"type":"module"}');
+      layer.writeFileSync(`/${i}/lib.js`, 'export default 1;');
+      layer.writeFileSync(
+        `/${i}/index.js`,
+        'import "./lib.js"; import "../shared.js"; export default import.meta.url;');
+      entryRequires.push(`import './${i}/index.js';`);
+    }
+  }
+  layer.writeFileSync('/entry.js', entryRequires.join('\n'));
+}
+
+async function main({ n, type, files }) {
+  const vfs = require('node:vfs');
+  const layer = vfs.create();
+  buildGraph(layer, files, type);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const mountPoint = layer.mount();
+    const entry = path.join(mountPoint, 'entry.js');
+    if (type === 'cjs') {
+      require(entry);
+    } else {
+      await import(pathToFileURL(entry).href);
+    }
+    // Unmounting purges the module caches for the mount prefix, so every
+    // iteration is a cold load of the full graph.
+    layer.unmount();
+  }
+  bench.end(n * files);
+}
diff --git a/benchmark/webstreams/adapters.js b/benchmark/webstreams/adapters.js
new file mode 100644
index 000000000000..ae97e4928f88
--- /dev/null
+++ b/benchmark/webstreams/adapters.js
@@ -0,0 +1,106 @@
+'use strict';
+const common = require('../common.js');
+const {
+  Readable,
+  Writable,
+} = require('node:stream');
+const {
+  ReadableStream,
+  WritableStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  kind: [
+    'readable-to-web',
+    'readable-from-web',
+    'writable-to-web',
+    'writable-from-web',
+  ],
+});
+
+async function readableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const streamReadable = new Readable({
+    read() {
+      if (i++ < n)
+        this.push(chunk);
+      else
+        this.push(null);
+    },
+  });
+  const reader = Readable.toWeb(streamReadable).getReader();
+  bench.start();
+  while (!(await reader.read()).done);
+  bench.end(n);
+}
+
+function readableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const readableStream = new ReadableStream({
+    pull(controller) {
+      if (i++ < n)
+        controller.enqueue(chunk);
+      else
+        controller.close();
+    },
+  });
+  const streamReadable = Readable.fromWeb(readableStream);
+  bench.start();
+  streamReadable.on('data', () => {});
+  streamReadable.on('end', () => bench.end(n));
+}
+
+async function writableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const streamWritable = new Writable({
+    write(chunk, encoding, callback) {
+      callback();
+    },
+  });
+  const writer = Writable.toWeb(streamWritable).getWriter();
+  bench.start();
+  for (let i = 0; i < n; i++)
+    await writer.write(chunk);
+  await writer.close();
+  bench.end(n);
+}
+
+function writableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const writableStream = new WritableStream({
+    write() {},
+  });
+  const streamWritable = Writable.fromWeb(writableStream);
+  bench.start();
+  let i = 0;
+  function writeLoop() {
+    while (i++ < n) {
+      if (!streamWritable.write(chunk)) {
+        streamWritable.once('drain', writeLoop);
+        return;
+      }
+    }
+    streamWritable.end(() => bench.end(n));
+  }
+  writeLoop();
+}
+
+function main({ n, kind }) {
+  switch (kind) {
+    case 'readable-to-web':
+      readableToWeb(n);
+      break;
+    case 'readable-from-web':
+      readableFromWeb(n);
+      break;
+    case 'writable-to-web':
+      writableToWeb(n);
+      break;
+    case 'writable-from-web':
+      writableFromWeb(n);
+      break;
+  }
+}
diff --git a/common.gypi b/common.gypi
index a83523286a91..e6a17d3505a5 100644
--- a/common.gypi
+++ b/common.gypi
@@ -17,6 +17,7 @@
     'emulator%': [],
 
     'node_shared%': 'false',
+    'node_enable_v8debughelper%': 'false',
     'node_enable_experimentals%': 'false',
     'force_dynamic_crt%': 0,
     'node_use_v8_platform%': 'true',
@@ -42,7 +43,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.28',
+    'v8_embedder_string': '-node.32',
 
     ##### V8 defaults for Node.js #####
 
@@ -611,6 +612,10 @@
                 'cflags': [ '-m64', '-march=z14' ],
                 'ldflags': [ '-m64', '-march=z14' ],
               }],
+              [ 'host_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
           ['_toolset=="target"', {
@@ -636,6 +641,10 @@
                 'cflags': [ '-m64', '-march=z14' ],
                 'ldflags': [ '-m64', '-march=z14' ],
               }],
+              [ 'target_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
         ],
@@ -646,7 +655,9 @@
             'cflags!': [ '-pthread' ],
             'ldflags!': [ '-pthread' ],
           }],
-          [ 'node_shared=="true"', {
+          # The V8 static libraries get linked into libv8_debug_helper, so they
+          # have to be position independent too.
+          [ 'node_shared=="true" or node_enable_v8debughelper=="true"', {
             'cflags': [ '-fPIC' ],
             'ldflags': [ '-fPIC' ],
           }],
diff --git a/configure.py b/configure.py
index b663ba85f58e..84a688917efe 100755
--- a/configure.py
+++ b/configure.py
@@ -282,6 +282,28 @@
     help='Use the specified path to system CA (PEM format) in addition to '
          'the OpenSSL supplied CA store or compiled-in Mozilla CA copy.')
 
+shared_optgroup.add_argument('--shared-abseil',
+    action='store_true',
+    dest='shared_abseil',
+    default=None,
+    help='link to a shared Abseil DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-abseil-includes',
+    action='store',
+    dest='shared_abseil_includes',
+    help='directory containing Abseil header files')
+
+shared_optgroup.add_argument('--shared-abseil-libname',
+    action='store',
+    dest='shared_abseil_libname',
+    default=None,
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-abseil-libpath',
+    action='store',
+    dest='shared_abseil_libpath',
+    help='a directory to search for the shared Abseil DLL')
+
 shared_optgroup.add_argument('--shared-gtest',
     action='store_true',
     dest='shared_gtest',
@@ -326,11 +348,27 @@
     dest='shared_hdr_histogram_libpath',
     help='a directory to search for the shared HdrHistogram DLL')
 
-parser.add_argument('--experimental-http-parser',
+shared_optgroup.add_argument('--shared-highway',
     action='store_true',
-    dest='experimental_http_parser',
+    dest='shared_highway',
     default=None,
-    help='(no-op)')
+    help='link to a shared Highway (hwy) DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-highway-includes',
+    action='store',
+    dest='shared_highway_includes',
+    help='directory containing Highway header files')
+
+shared_optgroup.add_argument('--shared-highway-libname',
+    action='store',
+    dest='shared_highway_libname',
+    default='hwy',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-highway-libpath',
+    action='store',
+    dest='shared_highway_libpath',
+    help='a directory to search for the shared Highway DLL')
 
 shared_optgroup.add_argument('--shared-http-parser',
     action='store_true',
@@ -508,6 +546,29 @@
     dest='shared_openssl_libpath',
     help='a directory to search for the shared OpenSSL DLLs')
 
+shared_optgroup.add_argument('--shared-perfetto',
+    action='store_true',
+    dest='shared_perfetto',
+    default=None,
+    help='link to a shared perfetto SDK instead of the one in deps/perfetto '
+         '(requires --with-perfetto)')
+
+shared_optgroup.add_argument('--shared-perfetto-includes',
+    action='store',
+    dest='shared_perfetto_includes',
+    help='directory containing perfetto header files')
+
+shared_optgroup.add_argument('--shared-perfetto-libname',
+    action='store',
+    dest='shared_perfetto_libname',
+    default='perfetto',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-perfetto-libpath',
+    action='store',
+    dest='shared_perfetto_libpath',
+    help='a directory to search for the shared perfetto DLL')
+
 shared_optgroup.add_argument('--shared-uvwasi',
     action='store_true',
     dest='shared_uvwasi',
@@ -812,6 +873,13 @@
     default=None,
     help=argparse.SUPPRESS)  # Undocumented.
 
+parser.add_argument('--enable-v8debughelper',
+    action='store_true',
+    dest='enable_v8debughelper',
+    default=None,
+    help='Build V8\'s debug helper as a shared library, loadable by a debugger '
+         'extension.')
+
 parser.add_argument('--enable-trace-maps',
     action='store_true',
     dest='trace_maps',
@@ -834,7 +902,7 @@
     action='store_true',
     dest='pointer_compression_shared_cage',
     default=None,
-    help='[Experimental] Use V8 pointer compression with shared cage (requires --experimental-enable-pointer-compression)')
+    help='[Experimental] Use V8 pointer compression with a shared cage and enable the V8 sandbox (requires --experimental-enable-pointer-compression)')
 
 parser.add_argument('--v8-options',
     action='store',
@@ -884,13 +952,13 @@
     action='store_true',
     dest='node_use_large_pages',
     default=None,
-    help='This option has no effect. --use-largepages is now a runtime option.')
+    help='This option is no longer supported and a no-op.')
 
 parser.add_argument('--use-largepages-script-lld',
     action='store_true',
     dest='node_use_large_pages_script_lld',
     default=None,
-    help='This option has no effect. --use-largepages is now a runtime option.')
+    help='This option is no longer supported and a no-op.')
 
 parser.add_argument('--use-section-ordering-file',
     action='store',
@@ -1022,33 +1090,12 @@
     default=None,
     help='enable Control Flow Guard (CFG)')
 
-# Dummy option for backwards compatibility
-parser.add_argument('--without-report',
-    action='store_true',
-    dest='unused_without_report',
-    default=None,
-    help=argparse.SUPPRESS)
-
-parser.add_argument('--with-snapshot',
-    action='store_true',
-    dest='unused_with_snapshot',
-    default=None,
-    help=argparse.SUPPRESS)
-
-parser.add_argument('--without-snapshot',
-    action='store_true',
-    dest='unused_without_snapshot',
-    default=None,
-    help=argparse.SUPPRESS)
-
 parser.add_argument('--without-siphash',
     action='store_true',
     dest='without_siphash',
     default=None,
     help=argparse.SUPPRESS)
 
-# End dummy list.
-
 parser.add_argument('--without-ssl',
     action='store_true',
     dest='without_ssl',
@@ -1079,6 +1126,12 @@
     default=None,
     help='build with experimental QUIC support')
 
+parser.add_argument('--experimental-dtls',
+    action='store_true',
+    dest='experimental_dtls',
+    default=None,
+    help='build with experimental DTLS support')
+
 parser.add_argument('--ninja',
     action='store_true',
     dest='use_ninja',
@@ -1900,8 +1953,6 @@ def configure_node(o):
                      else target_arch != host_arch)
   if cross_compiling:
     os.environ['GYP_CROSSCOMPILE'] = "1"
-  if options.unused_without_snapshot:
-    warn('building --without-snapshot is no longer possible')
 
   o['variables']['want_separate_host_toolset'] = int(cross_compiling)
 
@@ -2041,10 +2092,8 @@ def configure_node(o):
 
   if options.node_use_large_pages or options.node_use_large_pages_script_lld:
     warn('''The `--use-largepages` and `--use-largepages-script-lld` options
-         have no effect during build time. Support for mapping to large pages is
-         now a runtime option of Node.js. Run `node --use-largepages` or add
-         `--use-largepages` to the `NODE_OPTIONS` environment variable once
-         Node.js is built to enable mapping to large pages.''')
+         have no effect. Mapping the Node.js static code to large pages is
+         no longer supported.''')
 
   if options.no_ifaddrs:
     o['defines'] += ['SUNOS_NO_IFADDRS']
@@ -2195,16 +2244,10 @@ def configure_v8(o, configs):
                                          flavor not in ('aix', 'os400', 'zos') and
                                          o['variables']['target_arch'] in maglev_enabled_architectures)
   o['variables']['v8_enable_pointer_compression'] = 1 if options.enable_pointer_compression else 0
-  # Using the sandbox requires always allocating array buffer backing stores in the sandbox.
-  # We currently have many backing stores tied to pointers from C++ land that are not
-  # even necessarily dynamic (e.g. in static storage) for fast communication between JS and C++.
-  # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
-  # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
-  # so this can be broken at any time.
-  o['variables']['v8_enable_sandbox'] = 0
-  # We set v8_enable_pointer_compression_shared_cage to 0 always, even when
-  # pointer compression is enabled so that we don't accidentally enable shared
-  # cage mode when pointer compression is on.
+  # Like V8's own default, the sandbox goes with the shared pointer compression
+  # cage. Multi-cage builds give every IsolateGroup its own sandbox, which the
+  # array buffer allocator does not know about yet.
+  o['variables']['v8_enable_sandbox'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
@@ -2229,6 +2272,7 @@ def configure_v8(o, configs):
   o['variables']['force_dynamic_crt'] = 1 if options.shared else 0
   o['variables']['node_enable_d8'] = b(options.enable_d8)
   o['variables']['node_enable_v8windbg'] = b(options.enable_v8windbg)
+  o['variables']['node_enable_v8debughelper'] = b(options.enable_v8debughelper)
   if options.enable_d8:
     o['variables']['test_isolation_mode'] = 'noop'  # Needed by d8.gyp.
   if options.without_bundled_v8:
@@ -2236,6 +2280,8 @@ def configure_v8(o, configs):
       raise Exception('--enable-d8 is incompatible with --without-bundled-v8.')
     if options.enable_v8windbg:
       raise Exception('--enable-v8windbg is incompatible with --without-bundled-v8.')
+    if options.enable_v8debughelper:
+      raise Exception('--enable-v8debughelper is incompatible with --without-bundled-v8.')
     (pkg_libs, pkg_cflags, pkg_libpath, _) = pkg_config("v8")
     if pkg_libs and pkg_libpath:
       output['libraries'] += [pkg_libpath] + pkg_libs.split()
@@ -2343,6 +2389,15 @@ def configure_lief(o):
 
   configure_library('lief', o, pkgname='LIEF')
 
+def configure_perfetto(o):
+  if not options.with_perfetto:
+    if options.shared_perfetto:
+      error('--shared-perfetto requires --with-perfetto')
+    o['variables']['node_shared_perfetto'] = b(False)
+    return
+
+  configure_library('perfetto', o)
+
 def configure_sqlite(o):
   o['variables']['node_use_sqlite'] = b(not options.without_sqlite)
   if options.without_sqlite:
@@ -2398,6 +2453,10 @@ def configure_quic(o):
   o['variables']['node_use_quic'] = b(options.experimental_quic and
                                       not options.without_ssl)
 
+def configure_dtls(o):
+  o['variables']['node_use_dtls'] = b(options.experimental_dtls and
+                                      not options.without_ssl)
+
 def configure_static(o):
   if options.fully_static or options.partly_static:
     if flavor == 'mac':
@@ -2835,6 +2894,71 @@ def make_bin_override():
 configure_library('zlib', output)
 configure_library('http_parser', output, pkgname='libllhttp')
 configure_library('libuv', output)
+configure_library('abseil', output, pkgname=[
+  'absl_absl_check',
+  'absl_absl_log',
+  'absl_absl_vlog_is_on',
+  'absl_algorithm_container',
+  'absl_algorithm',
+  'absl_any_invocable',
+  'absl_base',
+  'absl_bind_front',
+  'absl_bits',
+  'absl_btree',
+  'absl_charset',
+  'absl_cleanup',
+  'absl_config',
+  'absl_cord',
+  'absl_core_headers',
+  'absl_die_if_null',
+  'absl_dynamic_annotations',
+  'absl_failure_signal_handler',
+  'absl_fast_type_id',
+  'absl_fixed_array',
+  'absl_flat_hash_map',
+  'absl_flat_hash_set',
+  'absl_function_ref',
+  'absl_has_ostream_operator',
+  'absl_hash_container_defaults',
+  'absl_hash',
+  'absl_inlined_vector',
+  'absl_int128',
+  'absl_layout',
+  'absl_leak_check',
+  'absl_linked_hash_map',
+  'absl_linked_hash_set',
+  'absl_log_entry',
+  'absl_log_globals',
+  'absl_log_initialize',
+  'absl_log_severity',
+  'absl_log_sink_registry',
+  'absl_log_sink',
+  'absl_memory',
+  'absl_no_destructor',
+  'absl_node_hash_map',
+  'absl_node_hash_set',
+  'absl_nullability',
+  'absl_optional',
+  'absl_overload',
+  'absl_prefetch',
+  'absl_random_bit_gen_ref',
+  'absl_random_distributions',
+  'absl_random_random',
+  'absl_raw_logging_internal',
+  'absl_span',
+  'absl_stacktrace',
+  'absl_status',
+  'absl_statusor',
+  'absl_str_format',
+  'absl_string_view',
+  'absl_strings',
+  'absl_symbolize',
+  'absl_synchronization',
+  'absl_time',
+  'absl_type_traits',
+  'absl_utility',
+  'absl_variant',
+])
 configure_library('ada', output)
 configure_library('simdjson', output)
 configure_library('simdutf', output)
@@ -2842,12 +2966,14 @@ def make_bin_override():
 configure_library('cares', output, pkgname='libcares')
 configure_library('gtest', output)
 configure_library('hdr_histogram', output)
+configure_library('highway', output, pkgname='libhwy')
 configure_library('merve', output)
 configure_library('nbytes', output)
 configure_library('nghttp2', output, pkgname='libnghttp2')
 configure_library('nghttp3', output, pkgname='libnghttp3')
 configure_library('ngtcp2', output, pkgname='libngtcp2')
 configure_lief(output);
+configure_perfetto(output);
 configure_sqlite(output);
 configure_ffi(output);
 configure_library('temporal_capi', output)
@@ -2856,6 +2982,7 @@ def make_bin_override():
 configure_v8(output, configurations)
 configure_openssl(output)
 configure_quic(output)
+configure_dtls(output)
 configure_intl(output)
 configure_static(output)
 configure_inspector(output)
diff --git a/deps/brotli/unofficial.gni b/deps/brotli/unofficial.gni
index 91001fa43ea4..0c6a7bd8c450 100644
--- a/deps/brotli/unofficial.gni
+++ b/deps/brotli/unofficial.gni
@@ -4,36 +4,49 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("brotli_gn_build") {
-  config("brotli_config") {
-    include_dirs = [ "c/include" ]
-  }
+import("../../node.gni")
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("brotli.gyp") ],
-                            "scope",
-                            [ "brotli.gyp" ])
-
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":brotli_config" ]
-    sources = gypi_values.brotli_sources
-    if (is_linux) {
-      defines = [ "OS_LINUX" ]
-    } else if (is_mac) {
-      defines = [ "OS_MACOSX" ]
-    } else if (target_os == "freebsd") {
-      defines = [ "OS_FREEBSD" ]
+template("brotli_gn_build") {
+  if (node_shared_brotli) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("brotli_config") {
+      packages = [ "libbrotlidec", "libbrotlienc" ]
     }
-    if (is_linux) {
-      libs = [ "m" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-      ]
+  } else {
+    config("brotli_config") {
+      include_dirs = [ "c/include" ]
+    }
+
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("brotli.gyp") ],
+                              "scope",
+                              [ "brotli.gyp" ])
+
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
+      sources = gypi_values.brotli_sources
+      if (is_linux) {
+        defines = [ "OS_LINUX" ]
+      } else if (is_mac) {
+        defines = [ "OS_MACOSX" ]
+      } else if (target_os == "freebsd") {
+        defines = [ "OS_FREEBSD" ]
+      }
+      if (is_linux) {
+        libs = [ "m" ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+        ]
+      }
     }
   }
 }
diff --git a/deps/cares/unofficial.gni b/deps/cares/unofficial.gni
index e02d7f425194..364df1f312e2 100644
--- a/deps/cares/unofficial.gni
+++ b/deps/cares/unofficial.gni
@@ -4,78 +4,91 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("cares_gn_build") {
-  config("cares_config") {
-    include_dirs = [ "include" ]
-    if (!is_component_build) {
-      defines = [ "CARES_STATICLIB" ]
-    }
-  }
-
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("cares.gyp") ],
-                            "scope",
-                            [ "cares.gyp" ])
+import("../../node.gni")
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":cares_config" ]
-    if (is_component_build) {
-      defines = [ "CARES_BUILDING_LIBRARY" ]
-    } else {
-      defines = []
+template("cares_gn_build") {
+  if (node_shared_cares) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("cares_config") {
+      packages = [ "libcares" ]
     }
-    if (is_win) {
-      defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
     }
-    if (is_posix) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-        "_GNU_SOURCE",
-        "HAVE_CONFIG_H",
-      ]
+  } else {
+    config("cares_config") {
+      include_dirs = [ "include" ]
+      if (!is_component_build) {
+        defines = [ "CARES_STATICLIB" ]
+      }
     }
 
-    include_dirs = [
-      "src/lib",
-      "src/lib/include",
-    ]
-    if (is_win) {
-      include_dirs += [ "config/win32" ]
-    } else if (is_linux) {
-      include_dirs += [ "config/linux" ]
-    } else if (is_mac) {
-      include_dirs += [ "config/darwin" ]
-    }
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("cares.gyp") ],
+                              "scope",
+                              [ "cares.gyp" ])
 
-    if (is_win) {
-      libs = [
-        "ws2_32.lib",
-        "iphlpapi.lib",
-      ]
-    }
+    component(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
+      if (is_component_build) {
+        defines = [ "CARES_BUILDING_LIBRARY" ]
+      } else {
+        defines = []
+      }
+      if (is_win) {
+        defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+      }
+      if (is_posix) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+          "_GNU_SOURCE",
+          "HAVE_CONFIG_H",
+        ]
+      }
 
-    sources = gypi_values.cares_sources_common
-    if (is_linux) {
-      sources += [ "config/linux/ares_config.h" ]
-    }
-    if (is_mac) {
-      sources += gypi_values.cares_sources_mac
-    }
+      include_dirs = [
+        "src/lib",
+        "src/lib/include",
+      ]
+      if (is_win) {
+        include_dirs += [ "config/win32" ]
+      } else if (is_linux) {
+        include_dirs += [ "config/linux" ]
+      } else if (is_mac) {
+        include_dirs += [ "config/darwin" ]
+      }
 
-    if (is_clang) {
       if (is_win) {
-        cflags_c = [
-          "-Wno-macro-redefined",
-        ]
-      } else {
-        cflags_c = [
-          "-Wno-implicit-fallthrough",
-          "-Wno-unreachable-code",
+        libs = [
+          "ws2_32.lib",
+          "iphlpapi.lib",
         ]
       }
+
+      sources = gypi_values.cares_sources_common
+      if (is_linux) {
+        sources += [ "config/linux/ares_config.h" ]
+      }
+      if (is_mac) {
+        sources += gypi_values.cares_sources_mac
+      }
+
+      if (is_clang) {
+        if (is_win) {
+          cflags_c = [
+            "-Wno-macro-redefined",
+          ]
+        } else {
+          cflags_c = [
+            "-Wno-implicit-fallthrough",
+            "-Wno-unreachable-code",
+          ]
+        }
+      }
     }
   }
 }
diff --git a/deps/corepack/CHANGELOG.md b/deps/corepack/CHANGELOG.md
index be8dfa5c8cb8..c90032328ab3 100644
--- a/deps/corepack/CHANGELOG.md
+++ b/deps/corepack/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.36.0](https://github.com/nodejs/corepack/compare/v0.35.0...v0.36.0) (2026-08-28)
+
+
+### Features
+
+* add `COREPACK_ON_UNVERIFIED_DOWNLOAD` env variable ([#856](https://github.com/nodejs/corepack/issues/856)) ([0125d89](https://github.com/nodejs/corepack/commit/0125d89ac904672bb42bc48bb6612d137beeccda))
+* fall back to package-root metadata when dist.signatures is missing on the version endpoint ([#870](https://github.com/nodejs/corepack/issues/870)) ([b26c9d5](https://github.com/nodejs/corepack/commit/b26c9d52fdbc5db326e631de3f6557f7e1b7e55d))
+* only load closest env file, for every commands ([#891](https://github.com/nodejs/corepack/issues/891)) ([b856c51](https://github.com/nodejs/corepack/commit/b856c516c3d0a92ded6b3f9cbbaa0d3f3eb094f1))
+* update package manager versions ([#852](https://github.com/nodejs/corepack/issues/852)) ([7e613b8](https://github.com/nodejs/corepack/commit/7e613b84b079411cb9eab1f90b254597fb9ef70c))
+* use range from `devEngines` when no `packageManager` is set ([#892](https://github.com/nodejs/corepack/issues/892)) ([dec830b](https://github.com/nodejs/corepack/commit/dec830b035f540d1b4ebc516e81fbf43c5e0ffcf))
+
+
+### Bug Fixes
+
+* **npmRegistryUtils:** env vars names in integrity check fail error message ([#854](https://github.com/nodejs/corepack/issues/854)) ([8ca01c3](https://github.com/nodejs/corepack/commit/8ca01c3fbeed6c8b5d1bb94df1aacb3fe6cff846))
+* strip trailing slashes from COREPACK_NPM_REGISTRY ([#871](https://github.com/nodejs/corepack/issues/871)) ([b81e92c](https://github.com/nodejs/corepack/commit/b81e92c2338ed6c4c38cfe1239002a261e47e6d5))
+
 ## [0.35.0](https://github.com/nodejs/corepack/compare/v0.34.7...v0.35.0) (2026-05-15)
 
 
diff --git a/deps/corepack/README.md b/deps/corepack/README.md
index dd32b4ad09f1..e2adeb94958c 100644
--- a/deps/corepack/README.md
+++ b/deps/corepack/README.md
@@ -127,9 +127,9 @@ Depending on the value of `devEngines.packageManager.onFail`:
   of mismatch.
 
 If the top-level `packageManager` field is missing, Corepack will use the
-package manager defined in `devEngines.packageManager` – in which case you must
-provide a specific version in `devEngines.packageManager.version`, ideally with
-a hash, as explained in the previous section:
+package manager defined in `devEngines.packageManager`. You should provide a
+specific version in `devEngines.packageManager.version`, ideally with a hash, as
+explained in the previous section:
 
 ```json
 {
@@ -142,6 +142,16 @@ a hash, as explained in the previous section:
 }
 ```
 
+When `devEngines.packageManager.version` is a range rather than a specific
+version, Corepack resolves it the same way as when a range is given on the
+command line: the latest version matching the range is looked up on the npm
+registry, which means the resolution requires network access (or a cache
+containing a matching version, see [Offline Workflow](#offline-workflow)), and
+may change over time. Set `COREPACK_ENABLE_AUTO_PIN=1` to have Corepack add the
+resolved version to the `packageManager` field. When
+`devEngines.packageManager.version` is missing, Corepack falls back to its
+[Known Good Release](#known-good-releases) for that package manager.
+
 ## Known Good Releases
 
 When running Corepack within projects that don't list a supported package
@@ -349,6 +359,19 @@ same major line. Should you need to upgrade to a new major, use an explicit
   environment variables are required and as plain text. If you want to send an
   empty password, explicitly set `COREPACK_NPM_PASSWORD` to an empty string.
 
+- `COREPACK_ON_UNVERIFIED_DOWNLOAD` can be set to:
+  - `warn` (case insensitive): attempting to download an unsigned version without
+    providing a hash will emit a warning to stderr.
+  - `error` (case insensitive): attempting to download an unsigned version without
+    providing a hash will fail with an error, and nothing gets downloaded.
+  - `strict-warn` (case insensitive): same as `warn`, and additionally emits a
+    warning when downloading a version that is not pinned by a hash, even when
+    its signature can be verified.
+  - `strict-error` (case insensitive): same as `error`, and additionally fails
+    when downloading a version that is not pinned by a hash, even when its
+    signature can be verified.
+  - `ignore` (or any other unsupported value): disables that security feature.
+
 - `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are supported through
   [`NODE_USE_ENV_PROXY=1`](https://nodejs.org/api/cli.html#node_use_env_proxy1).
 
diff --git a/deps/corepack/dist/lib/corepack.cjs b/deps/corepack/dist/lib/corepack.cjs
index 478389c3e2d0..ff66960d4aee 100644
--- a/deps/corepack/dist/lib/corepack.cjs
+++ b/deps/corepack/dist/lib/corepack.cjs
@@ -5,11 +5,20 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn2, res) => function __init() {
-  return fn2 && (res = (0, fn2[__getOwnPropNames(fn2)[0]])(fn2 = 0)), res;
+var __esm = (fn2, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn2 && (res = (0, fn2[__getOwnPropNames(fn2)[0]])(fn2 = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name2 in all)
@@ -3240,32 +3249,44 @@ var require_semver = __commonJS({
     var { safeRe: re, t } = require_re();
     var parseOptions = require_parse_options();
     var { compareIdentifiers } = require_identifiers();
+    var isPrereleaseIdentifier = (prerelease, identifier) => {
+      const identifiers = identifier.split(".");
+      if (identifiers.length > prerelease.length) {
+        return false;
+      }
+      for (let i = 0; i < identifiers.length; i++) {
+        if (compareIdentifiers(prerelease[i], identifiers[i]) !== 0) {
+          return false;
+        }
+      }
+      return true;
+    };
     var SemVer3 = class _SemVer {
-      constructor(version2, options) {
+      constructor(version, options) {
         options = parseOptions(options);
-        if (version2 instanceof _SemVer) {
-          if (version2.loose === !!options.loose && version2.includePrerelease === !!options.includePrerelease) {
-            return version2;
+        if (version instanceof _SemVer) {
+          if (version.loose === !!options.loose && version.includePrerelease === !!options.includePrerelease) {
+            return version;
           } else {
-            version2 = version2.version;
+            version = version.version;
           }
-        } else if (typeof version2 !== "string") {
-          throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version2}".`);
+        } else if (typeof version !== "string") {
+          throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);
         }
-        if (version2.length > MAX_LENGTH) {
+        if (version.length > MAX_LENGTH) {
           throw new TypeError(
             `version is longer than ${MAX_LENGTH} characters`
           );
         }
-        debug("SemVer", version2, options);
+        debug("SemVer", version, options);
         this.options = options;
         this.loose = !!options.loose;
         this.includePrerelease = !!options.includePrerelease;
-        const m = version2.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
+        const m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
         if (!m) {
-          throw new TypeError(`Invalid Version: ${version2}`);
+          throw new TypeError(`Invalid Version: ${version}`);
         }
-        this.raw = version2;
+        this.raw = version;
         this.major = +m[1];
         this.minor = +m[2];
         this.patch = +m[3];
@@ -3486,8 +3507,9 @@ var require_semver = __commonJS({
               if (identifierBase === false) {
                 prerelease = [identifier];
               }
-              if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
-                if (isNaN(this.prerelease[1])) {
+              if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+                const prereleaseBase = this.prerelease[identifier.split(".").length];
+                if (isNaN(prereleaseBase)) {
                   this.prerelease = prerelease;
                 }
               } else {
@@ -3535,12 +3557,12 @@ var require_parse = __commonJS({
   "node_modules/semver/functions/parse.js"(exports2, module2) {
     "use strict";
     var SemVer3 = require_semver();
-    var parse4 = (version2, options, throwErrors = false) => {
-      if (version2 instanceof SemVer3) {
-        return version2;
+    var parse4 = (version, options, throwErrors = false) => {
+      if (version instanceof SemVer3) {
+        return version;
       }
       try {
-        return new SemVer3(version2, options);
+        return new SemVer3(version, options);
       } catch (er) {
         if (!throwErrors) {
           return null;
@@ -3557,8 +3579,8 @@ var require_valid = __commonJS({
   "node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
     var parse4 = require_parse();
-    var valid = (version2, options) => {
-      const v = parse4(version2, options);
+    var valid = (version, options) => {
+      const v = parse4(version, options);
       return v ? v.version : null;
     };
     module2.exports = valid;
@@ -3762,19 +3784,19 @@ var require_comparator = __commonJS({
       toString() {
         return this.value;
       }
-      test(version2) {
-        debug("Comparator.test", version2, this.options.loose);
-        if (this.semver === ANY || version2 === ANY) {
+      test(version) {
+        debug("Comparator.test", version, this.options.loose);
+        if (this.semver === ANY || version === ANY) {
           return true;
         }
-        if (typeof version2 === "string") {
+        if (typeof version === "string") {
           try {
-            version2 = new SemVer3(version2, this.options);
+            version = new SemVer3(version, this.options);
           } catch (er) {
             return false;
           }
         }
-        return cmp(version2, this.operator, this.semver, this.options);
+        return cmp(version, this.operator, this.semver, this.options);
       }
       intersects(comp, options) {
         if (!(comp instanceof _Comparator)) {
@@ -3896,6 +3918,7 @@ var require_range = __commonJS({
         return this.range;
       }
       parseRange(range) {
+        range = range.replace(BUILDSTRIPRE, "");
         const memoOpts = (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) | (this.options.loose && FLAG_LOOSE);
         const memoKey = memoOpts + ":" + range;
         const cached = cache2.get(memoKey);
@@ -3950,19 +3973,19 @@ var require_range = __commonJS({
         });
       }
       // if ANY of the sets match ALL of its comparators, then pass
-      test(version2) {
-        if (!version2) {
+      test(version) {
+        if (!version) {
           return false;
         }
-        if (typeof version2 === "string") {
+        if (typeof version === "string") {
           try {
-            version2 = new SemVer3(version2, this.options);
+            version = new SemVer3(version, this.options);
           } catch (er) {
             return false;
           }
         }
         for (let i = 0; i < this.set.length; i++) {
-          if (testSet(this.set[i], version2, this.options)) {
+          if (testSet(this.set[i], version, this.options)) {
             return true;
           }
         }
@@ -3978,12 +4001,14 @@ var require_range = __commonJS({
     var SemVer3 = require_semver();
     var {
       safeRe: re,
+      src,
       t,
       comparatorTrimReplace,
       tildeTrimReplace,
       caretTrimReplace
     } = require_re();
     var { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require_constants2();
+    var BUILDSTRIPRE = new RegExp(src[t.BUILD], "g");
     var isNullSet = (c) => c.value === "<0.0.0-0";
     var isAny = (c) => c.value === "";
     var isSatisfiable = (comparators, options) => {
@@ -4012,20 +4037,22 @@ var require_range = __commonJS({
       return comp;
     };
     var isX = (id) => !id || id.toLowerCase() === "x" || id === "*";
+    var invalidXRangeOrder = (M, m, p) => isX(M) && !isX(m) || isX(m) && p && !isX(p);
     var replaceTildes = (comp, options) => {
       return comp.trim().split(/\s+/).map((c) => replaceTilde(c, options)).join(" ");
     };
     var replaceTilde = (comp, options) => {
       const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
+      const z = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("tilde", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0 <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
-          ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`;
+          ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
         } else if (pr) {
           debug("replaceTilde pr", pr);
           ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
@@ -4071,9 +4098,9 @@ var require_range = __commonJS({
           debug("no pr");
           if (M === "0") {
             if (m === "0") {
-              ret = `>=${M}.${m}.${p}${z} <${M}.${m}.${+p + 1}-0`;
+              ret = `>=${M}.${m}.${p} <${M}.${m}.${+p + 1}-0`;
             } else {
-              ret = `>=${M}.${m}.${p}${z} <${M}.${+m + 1}.0-0`;
+              ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
             }
           } else {
             ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -4092,6 +4119,9 @@ var require_range = __commonJS({
       const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
       return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
         debug("xRange", comp, ret, gtlt, M, m, p, pr);
+        if (invalidXRangeOrder(M, m, p)) {
+          return comp;
+        }
         const xM = isX(M);
         const xm = xM || isX(m);
         const xp = xm || isX(p);
@@ -4177,13 +4207,13 @@ var require_range = __commonJS({
       }
       return `${from} ${to}`.trim();
     };
-    var testSet = (set, version2, options) => {
+    var testSet = (set, version, options) => {
       for (let i = 0; i < set.length; i++) {
-        if (!set[i].test(version2)) {
+        if (!set[i].test(version)) {
           return false;
         }
       }
-      if (version2.prerelease.length && !options.includePrerelease) {
+      if (version.prerelease.length && !options.includePrerelease) {
         for (let i = 0; i < set.length; i++) {
           debug(set[i].semver);
           if (set[i].semver === Comparator.ANY) {
@@ -4191,7 +4221,7 @@ var require_range = __commonJS({
           }
           if (set[i].semver.prerelease.length > 0) {
             const allowed = set[i].semver;
-            if (allowed.major === version2.major && allowed.minor === version2.minor && allowed.patch === version2.patch) {
+            if (allowed.major === version.major && allowed.minor === version.minor && allowed.patch === version.patch) {
               return true;
             }
           }
@@ -4707,7 +4737,10 @@ function envForceColor() {
   if (env.FORCE_COLOR.length === 0) {
     return 1;
   }
-  const level = Math.min(Number.parseInt(env.FORCE_COLOR, 10), 3);
+  if (!new RegExp("^\\d+$", "v").test(env.FORCE_COLOR)) {
+    return;
+  }
+  const level = Math.min(Number(env.FORCE_COLOR), 3);
   if (![0, 1, 2, 3].includes(level)) {
     return;
   }
@@ -4741,6 +4774,9 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
       return 2;
     }
   }
+  if (forceColor !== void 0 && new RegExp("^\\d+$", "v").test(env.FORCE_COLOR)) {
+    return forceColor;
+  }
   if ("TF_BUILD" in env && "AGENT_NAME" in env) {
     return 1;
   }
@@ -4759,16 +4795,16 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return 1;
   }
   if ("CI" in env) {
-    if (["GITHUB_ACTIONS", "GITEA_ACTIONS", "CIRCLECI"].some((key) => key in env)) {
+    if (["GITHUB_ACTIONS", "GITEA_ACTIONS", "CIRCLECI"].some((key) => Object.hasOwn(env, key))) {
       return 3;
     }
-    if (["TRAVIS", "APPVEYOR", "GITLAB_CI", "BUILDKITE", "DRONE"].some((sign) => sign in env) || env.CI_NAME === "codeship") {
+    if (["TRAVIS", "APPVEYOR", "GITLAB_CI", "BUILDKITE", "DRONE"].some((sign) => Object.hasOwn(env, sign)) || env.CI_NAME === "codeship") {
       return 1;
     }
     return min;
   }
   if ("TEAMCITY_VERSION" in env) {
-    return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
+    return new RegExp("^(?:9\\.0*[1-9]\\d*\\.|\\d{2,}\\.)", "v").test(env.TEAMCITY_VERSION) ? 1 : 0;
   }
   if (env.COLORTERM === "truecolor") {
     return 3;
@@ -4783,20 +4819,20 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return 3;
   }
   if ("TERM_PROGRAM" in env) {
-    const version2 = Number.parseInt((env.TERM_PROGRAM_VERSION || "").split(".")[0], 10);
+    const version = Number((env.TERM_PROGRAM_VERSION || "").split(".", 1)[0]);
     switch (env.TERM_PROGRAM) {
       case "iTerm.app": {
-        return version2 >= 3 ? 3 : 2;
+        return version >= 3 ? 3 : 2;
       }
       case "Apple_Terminal": {
         return 2;
       }
     }
   }
-  if (/-256(color)?$/i.test(env.TERM)) {
+  if (new RegExp("-256(?:color)?$", "iv").test(env.TERM)) {
     return 2;
   }
-  if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
+  if (new RegExp("^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux", "iv").test(env.TERM)) {
     return 1;
   }
   if ("COLORTERM" in env) {
@@ -6879,10 +6915,22 @@ var init_large_numbers = __esm({
 });
 
 // node_modules/tar/dist/esm/types.js
-var isCode, name, code;
+var isCode, normalFsTypes, name, code;
 var init_types = __esm({
   "node_modules/tar/dist/esm/types.js"() {
     isCode = (c) => name.has(c);
+    normalFsTypes = /* @__PURE__ */ new Set([
+      "0",
+      "",
+      "1",
+      "2",
+      "3",
+      "4",
+      "5",
+      "6",
+      "7",
+      "D"
+    ]);
     name = /* @__PURE__ */ new Map([
       ["0", "File"],
       // same as File
@@ -6927,12 +6975,13 @@ var init_types = __esm({
 });
 
 // node_modules/tar/dist/esm/header.js
-var import_node_path, Header, splitPrefix, decString, decDate, numToDate, decNumber, nanUndef, decSmallNumber, MAXNUM, encNumber, encSmallNumber, octalString, padOctal, encDate, NULLS, encString;
+var import_node_path, notNegative, Header, splitPrefix, decString, decDate, numToDate, decNumber, nanUndef, decSmallNumber, MAXNUM, encNumber, encSmallNumber, octalString, padOctal, encDate, NULLS, encString;
 var init_header = __esm({
   "node_modules/tar/dist/esm/header.js"() {
     import_node_path = require("node:path");
     init_large_numbers();
     init_types();
+    notNegative = (n) => n === void 0 || n < 0 ? void 0 : n;
     Header = class {
       cksumValid = false;
       needPax = false;
@@ -6969,18 +7018,21 @@ var init_header = __esm({
         if (!buf || !(buf.length >= off + 512)) {
           throw new Error("need 512 bytes for header");
         }
-        this.path = ex?.path ?? decString(buf, off, 100);
-        this.mode = ex?.mode ?? gex?.mode ?? decNumber(buf, off + 100, 8);
-        this.uid = ex?.uid ?? gex?.uid ?? decNumber(buf, off + 108, 8);
-        this.gid = ex?.gid ?? gex?.gid ?? decNumber(buf, off + 116, 8);
-        this.size = ex?.size ?? gex?.size ?? decNumber(buf, off + 124, 12);
-        this.mtime = ex?.mtime ?? gex?.mtime ?? decDate(buf, off + 136, 12);
-        this.cksum = decNumber(buf, off + 148, 12);
-        if (gex)
-          this.#slurp(gex, true);
-        if (ex)
-          this.#slurp(ex);
         const t = decString(buf, off + 156, 1);
+        const isNormalFS = normalFsTypes.has(t);
+        const exForFields = isNormalFS ? ex : void 0;
+        const gexForFields = isNormalFS ? gex : void 0;
+        this.path = exForFields?.path ?? decString(buf, off, 100);
+        this.mode = exForFields?.mode ?? gexForFields?.mode ?? decNumber(buf, off + 100, 8);
+        this.uid = exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
+        this.gid = exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
+        this.size = notNegative(exForFields?.size ?? gexForFields?.size ?? decNumber(buf, off + 124, 12));
+        this.mtime = exForFields?.mtime ?? gexForFields?.mtime ?? decDate(buf, off + 136, 12);
+        this.cksum = decNumber(buf, off + 148, 12);
+        if (gexForFields)
+          this.#slurp(gexForFields, true);
+        if (exForFields)
+          this.#slurp(exForFields);
         if (isCode(t)) {
           this.#type = t || "0";
         }
@@ -6992,10 +7044,10 @@ var init_header = __esm({
         }
         this.linkpath = decString(buf, off + 157, 100);
         if (buf.subarray(off + 257, off + 265).toString() === "ustar\x0000") {
-          this.uname = ex?.uname ?? gex?.uname ?? decString(buf, off + 265, 32);
-          this.gname = ex?.gname ?? gex?.gname ?? decString(buf, off + 297, 32);
-          this.devmaj = ex?.devmaj ?? gex?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
-          this.devmin = ex?.devmin ?? gex?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
+          this.uname = exForFields?.uname ?? gexForFields?.uname ?? decString(buf, off + 265, 32);
+          this.gname = exForFields?.gname ?? gexForFields?.gname ?? decString(buf, off + 297, 32);
+          this.devmaj = exForFields?.devmaj ?? gexForFields?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
+          this.devmin = exForFields?.devmin ?? gexForFields?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
           if (buf[off + 475] !== 0) {
             const prefix = decString(buf, off + 345, 155);
             this.path = prefix + "/" + this.path;
@@ -7022,7 +7074,7 @@ var init_header = __esm({
       }
       #slurp(ex, gex = false) {
         Object.assign(this, Object.fromEntries(Object.entries(ex).filter(([k, v]) => {
-          return !(v === null || v === void 0 || k === "path" && gex || k === "linkpath" && gex || k === "global");
+          return !(v === null || v === void 0 || k === "size" && Number(v) < 0 || k === "path" && gex || k === "linkpath" && gex || k === "global");
         })));
       }
       encode(buf, off = 0) {
@@ -7253,8 +7305,36 @@ var init_pax = __esm({
         return set;
       }
       const k = r.replace(/^SCHILY\.(dev|ino|nlink)/, "$1");
-      const v = kv.join("=");
-      set[k] = /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(k) ? new Date(Number(v) * 1e3) : /^[0-9]+$/.test(v) ? +v : v;
+      const v = kv.join("=").replace(/\0.*/, "");
+      switch (k) {
+        case "path":
+        case "linkpath":
+        case "type":
+        case "charset":
+        case "comment":
+        case "gname":
+        case "uname":
+          set[k] = v;
+          break;
+        case "ctime":
+        case "atime":
+        case "mtime":
+          set[k] = new Date(Number(v) * 1e3);
+          break;
+        case "size":
+          const s = +v;
+          if (s >= 0)
+            set[k] = s;
+          break;
+        case "gid":
+        case "uid":
+        case "dev":
+        case "ino":
+        case "nlink":
+        case "mode":
+          set[k] = +v;
+          break;
+      }
       return set;
     };
   }
@@ -7265,7 +7345,7 @@ var platform, normalizeWindowsPath;
 var init_normalize_windows_path = __esm({
   "node_modules/tar/dist/esm/normalize-windows-path.js"() {
     platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
-    normalizeWindowsPath = platform !== "win32" ? (p) => p : (p) => p && p.replaceAll(/\\/g, "/");
+    normalizeWindowsPath = platform !== "win32" ? (p) => String(p) : (p) => String(p).replaceAll(/\\/g, "/");
   }
 });
 
@@ -7422,7 +7502,7 @@ var init_warn_method = __esm({
 });
 
 // node_modules/tar/dist/esm/parse.js
-var import_events3, maxMetaEntrySize, gzipHeader, zstdHeader, ZIP_HEADER_LEN, STATE, WRITEENTRY, READENTRY, NEXTENTRY, PROCESSENTRY, EX, GEX, META, EMITMETA, BUFFER2, QUEUE, ENDED, EMITTEDEND, EMIT, UNZIP, CONSUMECHUNK, CONSUMECHUNKSUB, CONSUMEBODY, CONSUMEMETA, CONSUMEHEADER, CONSUMING, BUFFERCONCAT, MAYBEEND, WRITING, ABORTED2, DONE, SAW_VALID_ENTRY, SAW_NULL_BLOCK, SAW_EOF, CLOSESTREAM, noop2, Parser;
+var import_events3, maxMetaEntrySize, gzipHeader, zstdHeader, ZIP_HEADER_LEN, STATE, WRITEENTRY, READENTRY, NEXTENTRY, PROCESSENTRY, EX, GEX, META, EMITMETA, BUFFER2, QUEUE, ENDED, EMITTEDEND, EMIT, UNZIP, CONSUMECHUNK, CONSUMECHUNKSUB, CONSUMEBODY, CONSUMEMETA, CONSUMEHEADER, CONSUMING, BUFFERCONCAT, MAYBEEND, WRITING, ABORTED2, DONE, SAW_VALID_ENTRY, SAW_NULL_BLOCK, SAW_EOF, CLOSESTREAM, MAX_DECOMPRESSION_RATIO, COMPRESSEDBYTESREAD, DECOMPRESSEDBYTESREAD, CHECKDECOMPRESSIONRATIO, noop2, Parser;
 var init_parse = __esm({
   "node_modules/tar/dist/esm/parse.js"() {
     import_events3 = require("events");
@@ -7465,6 +7545,10 @@ var init_parse = __esm({
     SAW_NULL_BLOCK = /* @__PURE__ */ Symbol("sawNullBlock");
     SAW_EOF = /* @__PURE__ */ Symbol("sawEOF");
     CLOSESTREAM = /* @__PURE__ */ Symbol("closeStream");
+    MAX_DECOMPRESSION_RATIO = 1e3;
+    COMPRESSEDBYTESREAD = /* @__PURE__ */ Symbol("compressedBytesRead");
+    DECOMPRESSEDBYTESREAD = /* @__PURE__ */ Symbol("decompressedBytesRead");
+    CHECKDECOMPRESSIONRATIO = /* @__PURE__ */ Symbol("checkDecompressionRatio");
     noop2 = () => true;
     Parser = class extends import_events3.EventEmitter {
       file;
@@ -7473,6 +7557,7 @@ var init_parse = __esm({
       filter;
       brotli;
       zstd;
+      maxDecompressionRatio;
       writable = true;
       readable = false;
       [QUEUE] = [];
@@ -7492,6 +7577,8 @@ var init_parse = __esm({
       [WRITING] = false;
       [CONSUMING] = false;
       [EMITTEDEND] = false;
+      [COMPRESSEDBYTESREAD] = 0;
+      [DECOMPRESSEDBYTESREAD] = 0;
       constructor(opt = {}) {
         super();
         this.file = opt.file || "";
@@ -7510,6 +7597,7 @@ var init_parse = __esm({
           });
         }
         this.strict = !!opt.strict;
+        this.maxDecompressionRatio = typeof opt.maxDecompressionRatio === "number" ? opt.maxDecompressionRatio : MAX_DECOMPRESSION_RATIO;
         this.maxMetaEntrySize = opt.maxMetaEntrySize || maxMetaEntrySize;
         this.filter = typeof opt.filter === "function" ? opt.filter : noop2;
         const isTBR = opt.file && (opt.file.endsWith(".tar.br") || opt.file.endsWith(".tbr"));
@@ -7710,10 +7798,29 @@ var init_parse = __esm({
         }
       }
       abort(error) {
+        if (this[ABORTED2]) {
+          return;
+        }
+        if (this[UNZIP]) {
+          const u = this[UNZIP];
+          u.write = () => true;
+          u.end = () => u;
+          u.emit = () => false;
+          u.destroy?.();
+        }
         this[ABORTED2] = true;
         this.emit("abort", error);
         this.warn("TAR_ABORT", error, { recoverable: false });
       }
+      [CHECKDECOMPRESSIONRATIO](chunk) {
+        this[DECOMPRESSEDBYTESREAD] += chunk.length;
+        const ratio = this[DECOMPRESSEDBYTESREAD] / this[COMPRESSEDBYTESREAD];
+        if (ratio > this.maxDecompressionRatio) {
+          this.abort(new Error(`max decompression ratio exceeded: ${ratio.toFixed(2)} > ${this.maxDecompressionRatio}`));
+          return false;
+        }
+        return true;
+      }
       write(chunk, encoding, cb) {
         if (typeof encoding === "function") {
           cb = encoding;
@@ -7779,13 +7886,22 @@ var init_parse = __esm({
             const ended = this[ENDED];
             this[ENDED] = false;
             this[UNZIP] = this[UNZIP] === void 0 ? new Unzip({}) : isZstd ? new ZstdDecompress({}) : new BrotliDecompress({});
-            this[UNZIP].on("data", (chunk2) => this[CONSUMECHUNK](chunk2));
-            this[UNZIP].on("error", (er) => this.abort(er));
+            this[UNZIP].on("data", (chunk2) => {
+              if (this[CHECKDECOMPRESSIONRATIO](chunk2)) {
+                this[CONSUMECHUNK](chunk2);
+              }
+            });
+            this[UNZIP].on("error", (er) => {
+              if (!this[ABORTED2]) {
+                this.abort(er);
+              }
+            });
             this[UNZIP].on("end", () => {
               this[ENDED] = true;
               this[CONSUMECHUNK]();
             });
             this[WRITING] = true;
+            this[COMPRESSEDBYTESREAD] += chunk.length;
             const ret2 = !!this[UNZIP][ended ? "end" : "write"](chunk);
             this[WRITING] = false;
             cb?.();
@@ -7794,6 +7910,7 @@ var init_parse = __esm({
         }
         this[WRITING] = true;
         if (this[UNZIP]) {
+          this[COMPRESSEDBYTESREAD] += chunk.length;
           this[UNZIP].write(chunk);
         } else {
           this[CONSUMECHUNK](chunk);
@@ -7815,7 +7932,7 @@ var init_parse = __esm({
         if (this[ENDED] && !this[EMITTEDEND] && !this[ABORTED2] && !this[CONSUMING]) {
           this[EMITTEDEND] = true;
           const entry = this[WRITEENTRY];
-          if (entry && entry.blockRemain) {
+          if (entry?.blockRemain) {
             const have = this[BUFFER2] ? this[BUFFER2].length : 0;
             this.warn("TAR_BAD_ARCHIVE", `Truncated input (needed ${entry.blockRemain} more bytes, only ${have} available)`, { entry });
             if (this[BUFFER2]) {
@@ -7895,8 +8012,10 @@ var init_parse = __esm({
           this.once("finish", cb);
         if (!this[ABORTED2]) {
           if (this[UNZIP]) {
-            if (chunk)
+            if (chunk) {
+              this[COMPRESSEDBYTESREAD] += chunk.length;
               this[UNZIP].write(chunk);
+            }
             this[UNZIP].end();
           } else {
             this[ENDED] = true;
@@ -7954,14 +8073,19 @@ var init_list = __esm({
     filesFilter = (opt, files) => {
       const map = new Map(files.map((f) => [stripTrailingSlashes(f), true]));
       const filter = opt.filter;
-      const mapHas = (file, r = "") => {
+      const MAX2 = 100;
+      const mapHas = (file, r = "", depth = 0) => {
+        if (depth >= MAX2) {
+          map.set(file, false);
+          return false;
+        }
         const root = r || (0, import_path2.parse)(file).root || ".";
         let ret;
         if (file === root)
           ret = false;
         else {
           const m = map.get(file);
-          ret = m !== void 0 ? m : mapHas((0, import_path2.dirname)(file), root);
+          ret = m !== void 0 ? m : mapHas((0, import_path2.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
@@ -8660,7 +8784,7 @@ var init_unpack = __esm({
           this.gid = void 0;
           this.setOwner = false;
         }
-        this.preserveOwner = opt.preserveOwner === void 0 && typeof opt.uid !== "number" ? !!(process.getuid && process.getuid() === 0) : !!opt.preserveOwner;
+        this.preserveOwner = opt.preserveOwner === void 0 && typeof opt.uid !== "number" ? !!(process.getuid?.() === 0) : !!opt.preserveOwner;
         this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0;
         this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0;
         this.maxDepth = typeof opt.maxDepth === "number" ? opt.maxDepth : DEFAULT_MAX_DEPTH;
@@ -8819,7 +8943,7 @@ var init_unpack = __esm({
         }
       }
       [MKDIR](dir, mode, cb) {
-        mkdir(normalizeWindowsPath(dir), {
+        void mkdir(normalizeWindowsPath(dir), {
           uid: this.uid,
           gid: this.gid,
           processUid: this.processUid,
@@ -9574,8 +9698,8 @@ var require_v8_compile_cache = __commonJS({
       }
       const dirname2 = typeof process.getuid === "function" ? "v8-compile-cache-" + process.getuid() : "v8-compile-cache";
       const arch = process.arch;
-      const version2 = typeof process.versions.v8 === "string" ? process.versions.v8 : typeof process.versions.chakracore === "string" ? "chakracore-" + process.versions.chakracore : "node-" + process.version;
-      const cacheDir = path16.join(os3.tmpdir(), dirname2, arch, version2);
+      const version = typeof process.versions.v8 === "string" ? process.versions.v8 : typeof process.versions.chakracore === "string" ? "chakracore-" + process.versions.chakracore : "node-" + process.version;
+      const cacheDir = path16.join(os3.tmpdir(), dirname2, arch, version);
       return cacheDir;
     }
     function getMainName() {
@@ -9613,13 +9737,13 @@ var require_satisfies = __commonJS({
   "node_modules/semver/functions/satisfies.js"(exports2, module2) {
     "use strict";
     var Range3 = require_range();
-    var satisfies = (version2, range, options) => {
+    var satisfies = (version, range, options) => {
       try {
         range = new Range3(range, options);
       } catch (er) {
         return false;
       }
-      return range.test(version2);
+      return range.test(version);
     };
     module2.exports = satisfies;
   }
@@ -12003,7 +12127,6 @@ var init_pack = __esm({
     init_esm();
     init_esm3();
     init_esm5();
-    init_read_entry();
     init_warn_method();
     import_path10 = __toESM(require("path"), 1);
     init_normalize_windows_path();
@@ -12026,7 +12149,7 @@ var init_pack = __esm({
     ONSTAT = /* @__PURE__ */ Symbol("onStat");
     ENDED3 = /* @__PURE__ */ Symbol("ended");
     QUEUE2 = /* @__PURE__ */ Symbol("queue");
-    PENDINGLINKS = /* @__PURE__ */ Symbol("queue");
+    PENDINGLINKS = /* @__PURE__ */ Symbol("pendingLinks");
     CURRENT = /* @__PURE__ */ Symbol("current");
     PROCESS2 = /* @__PURE__ */ Symbol("process");
     PROCESSING = /* @__PURE__ */ Symbol("processing");
@@ -12175,10 +12298,10 @@ var init_pack = __esm({
         if (this[ENDED3]) {
           throw new Error("write after end");
         }
-        if (path16 instanceof ReadEntry) {
-          this[ADDTARENTRY](path16);
-        } else {
+        if (typeof path16 === "string") {
           this[ADDFSENTRY](path16);
+        } else {
+          this[ADDTARENTRY](path16);
         }
         return this.flowing;
       }
@@ -12563,7 +12686,99 @@ module.exports = __toCommonJS(lib_exports2);
 var import_clipanion17 = __toESM(require_advanced());
 
 // package.json
-var version = "0.35.0";
+var package_default = {
+  name: "corepack",
+  version: "0.36.0",
+  homepage: "https://github.com/nodejs/corepack#readme",
+  bugs: {
+    url: "https://github.com/nodejs/corepack/issues"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/nodejs/corepack.git"
+  },
+  engines: {
+    node: "^22.22.2 || ^24.15.0 || >=26.0.0"
+  },
+  exports: {
+    "./package.json": "./package.json"
+  },
+  license: "MIT",
+  packageManager: "yarn@4.18.0+sha224.5707fce90df5d8720fae4e85a07ab55e90aa20fded8914893e2ba225",
+  devDependencies: {
+    "@types/debug": "^4.1.5",
+    "@types/node": "^22.0.0",
+    "@types/proxy-from-env": "^1",
+    "@types/semver": "^7.1.0",
+    "@types/which": "^3.0.0",
+    "@yarnpkg/eslint-config": "^3.1.1",
+    "@yarnpkg/fslib": "^3.0.0-rc.48",
+    "@zkochan/cmd-shim": "^6.0.0",
+    clipanion: "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch",
+    debug: "^4.1.1",
+    esbuild: "^0.28.0",
+    eslint: "^10.8.1",
+    semver: "^7.6.3",
+    "supports-color": "^11.0.0",
+    tar: "^7.5.11",
+    typescript: "^5.7.3",
+    "v8-compile-cache": "^2.3.0",
+    vitest: "^4.0.5",
+    which: "^7.0.0"
+  },
+  dependenciesMeta: {
+    esbuild: {
+      built: true
+    }
+  },
+  scripts: {
+    build: "run clean && run build:bundle && node ./mkshims.ts",
+    "build:bundle": "esbuild ./sources/_lib.ts --bundle --platform=node --target=node22.22.2 --external:corepack --outfile='./dist/lib/corepack.cjs' --resolve-extensions='.ts,.mjs,.js'",
+    clean: "run rimraf dist shims",
+    corepack: "node ./sources/_cli.ts",
+    lint: "eslint",
+    prepack: "yarn build",
+    postpack: "run clean",
+    rimraf: "node -e 'for(let i=2;i<process.argv.length;i++)fs.rmSync(process.argv[i],{recursive:true,force:true});'",
+    typecheck: "tsc --noEmit",
+    test: "vitest"
+  },
+  files: [
+    "dist",
+    "shims",
+    "LICENSE.md"
+  ],
+  publishConfig: {
+    bin: {
+      corepack: "./dist/corepack.js",
+      pnpm: "./dist/pnpm.js",
+      pnpx: "./dist/pnpx.js",
+      yarn: "./dist/yarn.js",
+      yarnpkg: "./dist/yarnpkg.js"
+    },
+    executableFiles: [
+      "./dist/npm.js",
+      "./dist/npx.js",
+      "./dist/pnpm.js",
+      "./dist/pnpx.js",
+      "./dist/yarn.js",
+      "./dist/yarnpkg.js",
+      "./dist/corepack.js",
+      "./shims/npm",
+      "./shims/npm.ps1",
+      "./shims/npx",
+      "./shims/npx.ps1",
+      "./shims/pnpm",
+      "./shims/pnpm.ps1",
+      "./shims/pnpx",
+      "./shims/pnpx.ps1",
+      "./shims/yarn",
+      "./shims/yarn.ps1",
+      "./shims/yarnpkg",
+      "./shims/yarnpkg.ps1"
+    ]
+  }
+};
 
 // sources/Engine.ts
 var import_clipanion5 = __toESM(require_advanced());
@@ -12578,7 +12793,7 @@ var import_valid4 = __toESM(require_valid2());
 var config_default = {
   definitions: {
     npm: {
-      default: "11.14.1+sha1.4a6839650da0005f323fec6abd39d77ee24f842f",
+      default: "12.0.2+sha1.788d93dc8869000b1078e0395c60748a0aadc4f1",
       fetchLatestFrom: {
         type: "npm",
         package: "npm"
@@ -12615,7 +12830,7 @@ var config_default = {
       }
     },
     pnpm: {
-      default: "11.1.2+sha1.ed39d701687311ce9345771c62376f9fe7286694",
+      default: "11.24.0+sha1.a042a648b5e519c43c5b2c3ff99901448190cd66",
       fetchLatestFrom: {
         type: "npm",
         package: "pnpm"
@@ -12696,7 +12911,7 @@ var config_default = {
         package: "yarn"
       },
       transparent: {
-        default: "4.14.1+sha224.88b7a7244bbd9040380c417f7eb556d85c67640b651f113cb4c72113",
+        default: "4.18.0+sha224.5707fce90df5d8720fae4e85a07ab55e90aa20fded8914893e2ba225",
         commands: [
           [
             "yarn",
@@ -12846,8 +13061,8 @@ var DEFAULT_HEADERS = {
   [`Accept`]: `application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8`
 };
 var DEFAULT_NPM_REGISTRY_URL = `https://registry.npmjs.org`;
-async function fetchAsJson2(packageName, version2) {
-  const npmRegistryUrl = process.env.COREPACK_NPM_REGISTRY || DEFAULT_NPM_REGISTRY_URL;
+async function fetchAsJson2(packageName, version) {
+  const npmRegistryUrl = (process.env.COREPACK_NPM_REGISTRY || DEFAULT_NPM_REGISTRY_URL).replace(/\/+$/, ``);
   if (process.env.COREPACK_ENABLE_NETWORK === `0`)
     throw new import_clipanion2.UsageError(`Network access disabled by the environment; can't reach npm repository ${npmRegistryUrl}`);
   const headers = { ...DEFAULT_HEADERS };
@@ -12857,9 +13072,13 @@ async function fetchAsJson2(packageName, version2) {
     const encodedCreds = Buffer.from(`${process.env.COREPACK_NPM_USERNAME}:${process.env.COREPACK_NPM_PASSWORD}`, `utf8`).toString(`base64`);
     headers.authorization = `Basic ${encodedCreds}`;
   }
-  return fetchAsJson(`${npmRegistryUrl}/${packageName}${version2 ? `/${version2}` : ``}`, { headers });
+  return fetchAsJson(`${npmRegistryUrl}/${packageName}${version ? `/${version}` : ``}`, { headers });
 }
-function verifySignature({ signatures, integrity, packageName, version: version2 }) {
+async function verifySignature({ signatures, integrity, packageName, version }) {
+  if (!Array.isArray(signatures) || !signatures.length) {
+    const rootMetadata = await fetchAsJson2(packageName);
+    signatures = rootMetadata.versions?.[version]?.dist?.signatures;
+  }
   if (!Array.isArray(signatures) || !signatures.length) throw new Error(`No compatible signature found in package metadata`);
   const { npm: trustedKeys } = process.env.COREPACK_INTEGRITY_KEYS ? JSON.parse(process.env.COREPACK_INTEGRITY_KEYS) : config_default.keys;
   let signature;
@@ -12873,7 +13092,7 @@ function verifySignature({ signatures, integrity, packageName, version: version2
   }
   if (signature?.sig == null) throw new import_clipanion2.UsageError(`The package was not signed by any trusted keys: ${JSON.stringify({ signatures, trustedKeys }, void 0, 2)}`);
   const verifier = (0, import_crypto.createVerify)(`SHA256`);
-  verifier.end(`${packageName}@${version2}:${integrity}`);
+  verifier.end(`${packageName}@${version}:${integrity}`);
   const valid = verifier.verify(
     `-----BEGIN PUBLIC KEY-----
 ${key}
@@ -12887,20 +13106,20 @@ ${key}
 }
 async function fetchLatestStableVersion(packageName) {
   const metadata = await fetchAsJson2(packageName, `latest`);
-  const { version: version2, dist: { integrity, signatures, shasum } } = metadata;
+  const { version, dist: { integrity, signatures, shasum } } = metadata;
   if (!shouldSkipIntegrityCheck()) {
     try {
-      verifySignature({
+      await verifySignature({
         packageName,
-        version: version2,
+        version,
         integrity,
         signatures
       });
     } catch (cause) {
-      throw new Error(`Corepack cannot download the latest stable version of ${packageName}; you can disable signature verification by setting COREPACK_INTEGRITY_CHECK to 0 in your env, or instruct Corepack to use the latest stable release known by this version of Corepack by setting COREPACK_USE_LATEST to 0`, { cause });
+      throw new Error(`Corepack cannot download the latest stable version of ${packageName}; you can disable signature verification by setting COREPACK_INTEGRITY_KEYS to 0 in your env, or instruct Corepack to use the latest stable release known by this version of Corepack by setting COREPACK_DEFAULT_TO_LATEST to 0`, { cause });
     }
   }
-  return `${version2}+${integrity ? `sha512.${Buffer.from(integrity.slice(7), `base64`).toString(`hex`)}` : `sha1.${shasum}`}`;
+  return `${version}+${integrity ? `sha512.${Buffer.from(integrity.slice(7), `base64`).toString(`hex`)}` : `sha1.${shasum}`}`;
 }
 async function fetchAvailableTags(packageName) {
   const metadata = await fetchAsJson2(packageName);
@@ -12910,11 +13129,11 @@ async function fetchAvailableVersions(packageName) {
   const metadata = await fetchAsJson2(packageName);
   return Object.keys(metadata.versions);
 }
-async function fetchTarballURLAndSignature(packageName, version2) {
-  const versionMetadata = await fetchAsJson2(packageName, version2);
+async function fetchTarballURLAndSignature(packageName, version) {
+  const versionMetadata = await fetchAsJson2(packageName, version);
   const { tarball, signatures, integrity } = versionMetadata.dist;
   if (tarball === void 0 || !tarball.startsWith(`http`))
-    throw new Error(`${packageName}@${version2} does not have a valid tarball.`);
+    throw new Error(`${packageName}@${version} does not have a valid tarball.`);
   return { tarball, signatures, integrity };
 }
 
@@ -13179,8 +13398,8 @@ async function download(installTarget, url, algo, binPath = null) {
 async function installVersion(installTarget, locator, { spec }) {
   const locatorIsASupportedPackageManager = isSupportedPackageManagerLocator(locator);
   const locatorReference = locatorIsASupportedPackageManager ? (0, import_parse3.default)(locator.reference) : parseURLReference(locator);
-  const { version: version2, build } = locatorReference;
-  const installFolder = import_path3.default.join(installTarget, locator.name, version2);
+  const { version, build } = locatorReference;
+  const installFolder = import_path3.default.join(installTarget, locator.name, version);
   try {
     const corepackFile = import_path3.default.join(installFolder, `.corepack`);
     const corepackContent = await import_fs4.default.promises.readFile(corepackFile, `utf8`);
@@ -13196,16 +13415,34 @@ async function installVersion(installTarget, locator, { spec }) {
       throw err;
     }
   }
+  const registry = getRegistryFromPackageManagerSpec(spec);
+  const canVerifySignature = registry.type === `npm` && !registry.bin && !shouldSkipIntegrityCheck();
+  if (!build[1]) {
+    const { COREPACK_ON_UNVERIFIED_DOWNLOAD } = process.env;
+    log(`No hash provided${canVerifySignature ? `` : `, and signature cannot be verified`}; checking COREPACK_ON_UNVERIFIED_DOWNLOAD, set to: ${COREPACK_ON_UNVERIFIED_DOWNLOAD}`);
+    const mode = COREPACK_ON_UNVERIFIED_DOWNLOAD?.toUpperCase();
+    const isStrict = mode === `STRICT-ERROR` || mode === `STRICT-WARN`;
+    if (isStrict || !canVerifySignature) {
+      const reason = canVerifySignature ? `is not pinned by a hash` : `could not be verified`;
+      switch (mode) {
+        case `ERROR`:
+        case `STRICT-ERROR`:
+          throw new Error(`Integrity of ${locator.name}@${version} ${reason}. Downloading unverified versions is disabled by the COREPACK_ON_UNVERIFIED_DOWNLOAD env variable. Please provide a hash.`);
+        case `WARN`:
+        case `STRICT-WARN`:
+          console.warn(`Integrity of ${locator.name}@${version} ${reason}. Consider providing a hash. Set COREPACK_ON_UNVERIFIED_DOWNLOAD to 'ignore' to remove this warning.`);
+      }
+    }
+  }
   let url;
   let signatures;
   let integrity;
   let binPath = null;
   if (locatorIsASupportedPackageManager) {
-    url = spec.url.replace(`{}`, version2);
+    url = spec.url.replace(`{}`, version);
     if (process.env.COREPACK_NPM_REGISTRY) {
-      const registry = getRegistryFromPackageManagerSpec(spec);
       if (registry.type === `npm`) {
-        ({ tarball: url, signatures, integrity } = await fetchTarballURLAndSignature(registry.package, version2));
+        ({ tarball: url, signatures, integrity } = await fetchTarballURLAndSignature(registry.package, version));
         if (registry.bin) {
           binPath = registry.bin;
         }
@@ -13216,7 +13453,7 @@ async function installVersion(installTarget, locator, { spec }) {
       );
     }
   } else {
-    url = decodeURIComponent(version2);
+    url = decodeURIComponent(version);
     if (process.env.COREPACK_NPM_REGISTRY && url.startsWith(DEFAULT_NPM_REGISTRY_URL)) {
       url = url.replace(
         DEFAULT_NPM_REGISTRY_URL,
@@ -13224,7 +13461,7 @@ async function installVersion(installTarget, locator, { spec }) {
       );
     }
   }
-  log(`Installing ${locator.name}@${version2} from ${url}`);
+  log(`Installing ${locator.name}@${version} from ${url}`);
   const algo = build[0] ?? `sha512`;
   const { tmpFolder, outputFile, hash: actualHash } = await download(installTarget, url, algo, binPath);
   let bin;
@@ -13249,17 +13486,16 @@ async function installVersion(installTarget, locator, { spec }) {
       }
     }
   }
-  if (!build[1]) {
-    const registry = getRegistryFromPackageManagerSpec(spec);
-    if (registry.type === `npm` && !registry.bin && !shouldSkipIntegrityCheck()) {
-      if (signatures == null || integrity == null)
-        ({ signatures, integrity } = await fetchTarballURLAndSignature(registry.package, version2));
-      verifySignature({ signatures, integrity, packageName: registry.package, version: version2 });
-      build[1] = Buffer.from(integrity.slice(`sha512-`.length), `base64`).toString(`hex`);
-    }
+  if (!build[1] && canVerifySignature && registry.type === `npm`) {
+    if (signatures == null || integrity == null)
+      ({ signatures, integrity } = await fetchTarballURLAndSignature(registry.package, version));
+    verifySignature({ signatures, integrity, packageName: registry.package, version });
+    build[1] = Buffer.from(integrity.slice(`sha512-`.length), `base64`).toString(`hex`);
   }
-  if (build[1] && actualHash !== build[1])
+  if (build[1] && actualHash !== build[1]) {
+    await import_fs4.default.promises.rm(tmpFolder, { recursive: true, force: true });
     throw new Error(`Mismatch hashes. Expected ${build[1]}, got ${actualHash}`);
+  }
   const serializedHash = `${algo}.${actualHash}`;
   await import_fs4.default.promises.writeFile(import_path3.default.join(tmpFolder, `.corepack`), JSON.stringify({
     locator,
@@ -13365,18 +13601,18 @@ function shouldSkipIntegrityCheck() {
 // sources/semverUtils.ts
 var import_range2 = __toESM(require_range());
 var import_semver2 = __toESM(require_semver());
-function satisfiesWithPrereleases(version2, range, loose = false) {
+function satisfiesWithPrereleases(version, range, loose = false) {
   let semverRange;
   try {
     semverRange = new import_range2.default(range, loose);
   } catch (err) {
     return false;
   }
-  if (!version2)
+  if (!version)
     return false;
   let semverVersion;
   try {
-    semverVersion = new import_semver2.default(version2, semverRange.loose);
+    semverVersion = new import_semver2.default(version, semverRange.loose);
     if (semverVersion.prerelease) {
       semverVersion.prerelease = [];
     }
@@ -13403,19 +13639,13 @@ var import_valid2 = __toESM(require_valid2());
 var import_util = require("util");
 
 // sources/types.ts
-var SupportedPackageManagers = /* @__PURE__ */ ((SupportedPackageManagers3) => {
-  SupportedPackageManagers3["Npm"] = `npm`;
-  SupportedPackageManagers3["Pnpm"] = `pnpm`;
-  SupportedPackageManagers3["Yarn"] = `yarn`;
-  return SupportedPackageManagers3;
-})(SupportedPackageManagers || {});
+var supportedPackageManagersList = [`npm`, `pnpm`, `yarn`];
 var SupportedPackageManagerSet = new Set(
-  Object.values(SupportedPackageManagers)
+  supportedPackageManagersList
 );
 var SupportedPackageManagerSetWithoutNpm = new Set(
-  Object.values(SupportedPackageManagers)
+  supportedPackageManagersList.filter((pm) => pm !== `npm`)
 );
-SupportedPackageManagerSetWithoutNpm.delete("npm" /* Npm */);
 function isSupportedPackageManager(value) {
   return SupportedPackageManagerSet.has(value);
 }
@@ -13454,6 +13684,9 @@ function parseSpec(raw2, source, { enforceExactVersion = true } = {}) {
     range
   };
 }
+function devEnginesToDescriptor({ name: name2, version }) {
+  return { name: name2, range: version ?? `*` };
+}
 function warnOrThrow(errorMessage, onFail) {
   switch (onFail) {
     case `ignore`:
@@ -13471,44 +13704,45 @@ function parsePackageJSON(packageJSONContent) {
     const { packageManager } = packageJSONContent.devEngines;
     if (typeof packageManager !== `object`) {
       console.warn(`! Corepack only supports objects as valid value for devEngines.packageManager. The current value (${JSON.stringify(packageManager)}) will be ignored.`);
-      return pm;
+      return { packageManagerField: pm };
     }
     if (Array.isArray(packageManager)) {
       console.warn(`! Corepack does not currently support array values for devEngines.packageManager`);
-      return pm;
+      return { packageManagerField: pm };
     }
-    const { name: name2, version: version2, onFail } = packageManager;
+    const { name: name2, version, onFail } = packageManager;
     if (typeof name2 !== `string` || name2.includes(`@`)) {
       warnOrThrow(`The value of devEngines.packageManager.name ${JSON.stringify(name2)} is not a supported string value`, onFail);
-      return pm;
+      return { packageManagerField: pm };
     }
-    if (version2 != null && (typeof version2 !== `string` || !(0, import_valid2.default)(version2))) {
-      warnOrThrow(`The value of devEngines.packageManager.version ${JSON.stringify(version2)} is not a valid semver range`, onFail);
-      return pm;
+    if (version != null && (typeof version !== `string` || !(0, import_valid2.default)(version))) {
+      warnOrThrow(`The value of devEngines.packageManager.version ${JSON.stringify(version)} is not a valid semver range`, onFail);
+      return { packageManagerField: pm };
     }
-    log(`devEngines.packageManager defines that ${name2}@${version2} is the local package manager`);
+    log(`devEngines.packageManager defines that ${name2}${version ? `@${version}` : ``} should be the local package manager`);
     if (pm) {
-      if (!pm.startsWith?.(`${name2}@`))
+      if (!pm.startsWith?.(`${name2}@`)) {
         warnOrThrow(`"packageManager" field is set to ${JSON.stringify(pm)} which does not match the "devEngines.packageManager" field set to ${JSON.stringify(name2)}`, onFail);
-      else if (version2 != null && !(0, import_satisfies.default)(pm.slice(packageManager.name.length + 1), version2))
-        warnOrThrow(`"packageManager" field is set to ${JSON.stringify(pm)} which does not match the value defined in "devEngines.packageManager" for ${JSON.stringify(name2)} of ${JSON.stringify(version2)}`, onFail);
-      return pm;
+      } else if (version != null && !(0, import_satisfies.default)(pm.slice(name2.length + 1), version)) {
+        warnOrThrow(`"packageManager" field is set to ${JSON.stringify(pm)} which does not match the value defined in "devEngines.packageManager" for ${JSON.stringify(name2)} of ${JSON.stringify(version)}`, onFail);
+      }
     }
-    return `${name2}@${version2 ?? `*`}`;
+    return { packageManagerField: pm, devEnginesPackageManager: { name: name2, version, onFail } };
   }
-  return pm;
+  return { packageManagerField: pm };
 }
 async function setLocalPackageManager(cwd, info) {
-  const lookup = await loadSpec(cwd);
-  const range = `range` in lookup && lookup.range;
-  if (range) {
-    if (info.locator.name !== range.name || !(0, import_satisfies.default)(info.locator.reference, range.range)) {
-      warnOrThrow(`The requested version of ${info.locator.name}@${info.locator.reference} does not match the devEngines specification (${range.name}@${range.range})`, range.onFail);
+  const lookup = await loadSpecAndEnv(cwd);
+  const projectFound = lookup.type !== `NoProject`;
+  const devEnginesValue = projectFound ? lookup.devEnginesValue : void 0;
+  if (devEnginesValue) {
+    if (info.locator.name !== devEnginesValue.name || devEnginesValue.version != null && !(0, import_satisfies.default)(info.locator.reference, devEnginesValue.version)) {
+      warnOrThrow(`The requested version of ${info.locator.name}@${info.locator.reference} does not match the devEngines specification (${devEnginesValue.name}@${devEnginesValue.version ?? `*`})`, devEnginesValue.onFail);
     }
   }
-  const content = lookup.type !== `NoProject` ? await import_fs5.default.promises.readFile(lookup.target, `utf8`) : ``;
+  const content = projectFound ? await import_fs5.default.promises.readFile(lookup.target, `utf8`) : ``;
   const { data, indent } = readPackageJson(content);
-  const previousPackageManager = data.packageManager ?? (range ? `${range.name}@${range.range}` : `unknown`);
+  const previousPackageManager = data.packageManager ?? (devEnginesValue ? `${devEnginesValue.name}@${devEnginesValue.version ?? `*`}` : `unknown`);
   data.packageManager = `${info.locator.name}@${info.locator.reference}`;
   const newContent = normalizeLineEndings(content, `${JSON.stringify(data, null, indent)}
 `);
@@ -13517,15 +13751,43 @@ async function setLocalPackageManager(cwd, info) {
     previousPackageManager
   };
 }
-async function loadSpec(initialCwd) {
+async function loadEnvFileIfExists(cwd) {
+  const envFilePath = import_path4.default.resolve(cwd, process.env.COREPACK_ENV_FILE ?? `.corepack.env`);
+  if (process.env.COREPACK_ENV_FILE == `0`) {
+    log(`Skipping env file as configured with COREPACK_ENV_FILE`);
+    return void 0;
+  }
+  log(`Checking ${envFilePath}`);
+  try {
+    const localEnv = {
+      ...Object.fromEntries(Object.entries((0, import_util.parseEnv)(await import_fs5.default.promises.readFile(envFilePath, `utf8`))).filter((e) => e[0].startsWith(`COREPACK_`))),
+      ...process.env
+    };
+    log(`Successfully loaded env file found at ${envFilePath}`);
+    return { env: localEnv, path: envFilePath };
+  } catch (err) {
+    if (err?.code !== `ENOENT`)
+      throw err;
+    log(`No env file found at ${envFilePath}`);
+  }
+  return void 0;
+}
+async function loadSpecAndEnv(initialCwd, { envOnly } = { envOnly: false }) {
   let nextCwd = initialCwd;
   let currCwd = ``;
   let selection = null;
+  let localEnv = void 0;
   while (nextCwd !== currCwd && (!selection || !selection.data.packageManager)) {
     currCwd = nextCwd;
     nextCwd = import_path4.default.dirname(currCwd);
     if (nodeModulesRegExp.test(currCwd))
       continue;
+    if (process.env.COREPACK_ENV_FILE !== `0` && !localEnv)
+      localEnv = await loadEnvFileIfExists(currCwd);
+    if (envOnly) {
+      if (localEnv) break;
+      continue;
+    }
     const manifestPath = import_path4.default.join(currCwd, `package.json`);
     log(`Checking ${manifestPath}`);
     let content;
@@ -13541,54 +13803,42 @@ async function loadSpec(initialCwd) {
     } catch {
     }
     if (typeof data !== `object` || data === null)
-      throw new import_clipanion4.UsageError(`Invalid package.json in ${import_path4.default.relative(initialCwd, manifestPath)}`);
-    let localEnv;
-    const envFilePath2 = import_path4.default.resolve(currCwd, process.env.COREPACK_ENV_FILE ?? `.corepack.env`);
-    if (process.env.COREPACK_ENV_FILE == `0`) {
-      log(`Skipping env file as configured with COREPACK_ENV_FILE`);
-      localEnv = process.env;
-    } else if (typeof import_util.parseEnv !== `function`) {
-      log(`Skipping env file as it is not supported by the current version of Node.js`);
-      localEnv = process.env;
-    } else {
-      log(`Checking ${envFilePath2}`);
-      try {
-        localEnv = {
-          ...Object.fromEntries(Object.entries((0, import_util.parseEnv)(await import_fs5.default.promises.readFile(envFilePath2, `utf8`))).filter((e) => e[0].startsWith(`COREPACK_`))),
-          ...process.env
-        };
-        log(`Successfully loaded env file found at ${envFilePath2}`);
-      } catch (err) {
-        if (err?.code !== `ENOENT`)
-          throw err;
-        log(`No env file found at ${envFilePath2}`);
-        localEnv = process.env;
-      }
-    }
-    selection = { data, manifestPath, localEnv, envFilePath: envFilePath2 };
+      throw new import_clipanion4.UsageError(`Invalid package.json in ${import_path4.default.relative(currCwd, manifestPath)}`);
+    selection = { data, manifestPath };
   }
+  if (localEnv)
+    process.env = localEnv.env;
   if (selection === null)
-    return { type: `NoProject`, target: import_path4.default.join(initialCwd, `package.json`) };
-  let envFilePath;
-  if (selection.localEnv !== process.env) {
-    envFilePath = selection.envFilePath;
-    process.env = selection.localEnv;
-  }
-  const rawPmSpec = parsePackageJSON(selection.data);
-  if (typeof rawPmSpec === `undefined`)
-    return { type: `NoSpec`, target: selection.manifestPath };
-  log(`${selection.manifestPath} defines ${rawPmSpec} as local package manager`);
+    return { type: `NoProject`, target: import_path4.default.join(initialCwd, `package.json`), envFilePath: localEnv?.path };
+  const { packageManagerField, devEnginesPackageManager } = parsePackageJSON(selection.data);
+  if (devEnginesPackageManager != null && !packageManagerField) {
+    const { name: name2, version } = devEnginesPackageManager;
+    if (!version || !(0, import_valid.default)(version)) {
+      log(`${selection.manifestPath} defines ${name2} as local package manager using devEngines.packageManager, without an exact version`);
+      return { type: `NoSpec`, target: selection.manifestPath, envFilePath: localEnv?.path, devEnginesValue: devEnginesPackageManager };
+    }
+    log(`${selection.manifestPath} defines ${name2}@${version} as local package manager using devEngines.packageManager`);
+    return {
+      type: `Found`,
+      target: selection.manifestPath,
+      field: `devEngines.packageManager`,
+      envFilePath: localEnv?.path,
+      devEnginesValue: devEnginesPackageManager,
+      // Lazy-loading it so we do not throw errors on commands that do not need valid spec.
+      getSpec: ({ enforceExactVersion = true } = {}) => parseSpec(`${name2}@${version}`, import_path4.default.relative(initialCwd, selection.manifestPath), { enforceExactVersion })
+    };
+  }
+  if (packageManagerField === void 0)
+    return { type: `NoSpec`, target: selection.manifestPath, envFilePath: localEnv?.path };
+  log(`${selection.manifestPath} defines ${packageManagerField} as local package manager using the packageManager field`);
   return {
     type: `Found`,
     target: selection.manifestPath,
-    envFilePath,
-    range: selection.data.devEngines?.packageManager?.version && {
-      name: selection.data.devEngines.packageManager.name,
-      range: selection.data.devEngines.packageManager.version,
-      onFail: selection.data.devEngines.packageManager.onFail
-    },
+    field: `packageManager`,
+    envFilePath: localEnv?.path,
+    devEnginesValue: devEnginesPackageManager,
     // Lazy-loading it so we do not throw errors on commands that do not need valid spec.
-    getSpec: ({ enforceExactVersion = true } = {}) => parseSpec(rawPmSpec, import_path4.default.relative(initialCwd, selection.manifestPath), { enforceExactVersion })
+    getSpec: ({ enforceExactVersion = true } = {}) => parseSpec(packageManagerField, import_path4.default.relative(initialCwd, selection.manifestPath), { enforceExactVersion })
   };
 }
 
@@ -13652,10 +13902,10 @@ async function activatePackageManager(lastKnownGood, locator) {
   await createLastKnownGoodFile(lastKnownGood);
 }
 var Engine = class {
+  config;
   constructor(config = config_default) {
     this.config = config;
   }
-  config;
   getPackageManagerFor(binaryName) {
     for (const packageManager of SupportedPackageManagerSet) {
       for (const rangeDefinition of Object.values(this.config.definitions[packageManager].ranges)) {
@@ -13782,7 +14032,7 @@ var Engine = class {
     if (import_process3.default.env.COREPACK_ENABLE_STRICT === `0`)
       transparent = true;
     while (true) {
-      const result = await loadSpec(initialCwd);
+      const result = await loadSpecAndEnv(initialCwd);
       switch (result.type) {
         case `NoProject`: {
           if (typeof locator.reference === `function`)
@@ -13791,7 +14041,13 @@ var Engine = class {
           return fallbackDescriptor;
         }
         case `NoSpec`: {
-          if (typeof locator.reference === `function`)
+          const { devEnginesValue } = result;
+          const nameMatches = devEnginesValue != null && devEnginesValue.name === fallbackDescriptor.name;
+          if (devEnginesValue != null && !nameMatches && !transparent)
+            warnOrThrow(`This project is configured to use ${devEnginesValue.name} because ${result.target} has a "devEngines.packageManager" field`, devEnginesValue.onFail);
+          if (nameMatches && devEnginesValue.version)
+            fallbackDescriptor.range = devEnginesValue.version;
+          else if (typeof locator.reference === `function`)
             fallbackDescriptor.range = await locator.reference();
           if (import_process3.default.env.COREPACK_ENABLE_AUTO_PIN === `1`) {
             const resolved = await this.resolveDescriptor(fallbackDescriptor, { allowTags: true });
@@ -13815,7 +14071,7 @@ var Engine = class {
               log(`Falling back to ${fallbackDescriptor.name}@${fallbackDescriptor.range} in a ${spec.name}@${spec.range} project`);
               return fallbackDescriptor;
             } else {
-              throw new import_clipanion5.UsageError(`This project is configured to use ${spec.name} because ${result.target} has a "packageManager" field`);
+              throw new import_clipanion5.UsageError(`This project is configured to use ${spec.name} because ${result.target} has a "${result.field}" field`);
             }
           } else {
             log(`Using ${spec.name}@${spec.range} as defined in project manifest ${result.target}`);
@@ -13892,7 +14148,7 @@ var Engine = class {
       const packageManagerSpec = definition.ranges[range];
       const registry = getRegistryFromPackageManagerSpec(packageManagerSpec);
       const versions2 = await fetchAvailableVersions2(registry);
-      return versions2.filter((version2) => satisfiesWithPrereleases(version2, finalDescriptor.range));
+      return versions2.filter((version) => satisfiesWithPrereleases(version, finalDescriptor.range));
     }));
     const highestVersion = [...new Set(versions.flat())].sort(import_rcompare.default);
     if (highestVersion.length === 0)
@@ -14084,16 +14340,23 @@ var BaseCommand = class extends import_clipanion9.Command {
   async resolvePatternsToDescriptors({ patterns }) {
     const resolvedSpecs = patterns.map((pattern) => parseSpec(pattern, `CLI arguments`, { enforceExactVersion: false }));
     if (resolvedSpecs.length === 0) {
-      const lookup = await loadSpec(this.context.cwd);
+      const lookup = await loadSpecAndEnv(this.context.cwd);
       switch (lookup.type) {
         case `NoProject`:
           throw new import_clipanion9.UsageError(`Couldn't find a project in the local directory - please specify the package manager to pack, or run this command from a valid project`);
-        case `NoSpec`:
-          throw new import_clipanion9.UsageError(`The local project doesn't feature a 'packageManager' field nor a 'devEngines.packageManager' field - please specify the package manager to pack, or update the manifest to reference it`);
+        case `NoSpec`: {
+          const { devEnginesValue } = lookup;
+          if (devEnginesValue?.version)
+            return [devEnginesToDescriptor(devEnginesValue)];
+          throw new import_clipanion9.UsageError(`The local project doesn't feature a 'packageManager' field ${devEnginesValue ? `` : `nor a 'devEngines.packageManager' field `}- please specify the package manager to pack, or update the manifest to reference it`);
+        }
         default: {
-          return [lookup.range ?? lookup.getSpec()];
+          const { devEnginesValue } = lookup;
+          return [devEnginesValue?.version ? devEnginesToDescriptor(devEnginesValue) : lookup.getSpec()];
         }
       }
+    } else {
+      await loadSpecAndEnv(this.context.cwd, { envOnly: true });
     }
     return resolvedSpecs;
   }
@@ -14457,16 +14720,24 @@ var PrepareCommand = class extends import_clipanion16.Command {
     const specs = this.specs;
     const installLocations = [];
     if (specs.length === 0) {
-      const lookup = await loadSpec(this.context.cwd);
+      const lookup = await loadSpecAndEnv(this.context.cwd);
       switch (lookup.type) {
         case `NoProject`:
           throw new import_clipanion16.UsageError(`Couldn't find a project in the local directory - please specify the package manager to pack, or run this command from a valid project`);
-        case `NoSpec`:
-          throw new import_clipanion16.UsageError(`The local project doesn't feature a 'packageManager' field - please specify the package manager to pack, or update the manifest to reference it`);
+        case `NoSpec`: {
+          const { devEnginesValue } = lookup;
+          if (devEnginesValue?.version) {
+            specs.push(devEnginesToDescriptor(devEnginesValue));
+            break;
+          }
+          throw new import_clipanion16.UsageError(`The local project doesn't feature a 'packageManager' field ${devEnginesValue ? `` : `nor a 'devEngines.packageManager' field `}- please specify the package manager to pack, or update the manifest to reference it`);
+        }
         default: {
           specs.push(lookup.getSpec());
         }
       }
+    } else {
+      await loadSpecAndEnv(this.context.cwd, { envOnly: true });
     }
     for (const request of specs) {
       const spec = typeof request === `string` ? parseSpec(request, `CLI arguments`, { enforceExactVersion: false }) : request;
@@ -14512,6 +14783,7 @@ var PrepareCommand = class extends import_clipanion16.Command {
 };
 
 // sources/main.ts
+var { version: corepackVersion } = package_default;
 function getPackageManagerRequestFromCli(parameter, engine) {
   if (!parameter)
     return null;
@@ -14538,7 +14810,7 @@ async function runMain(argv) {
     const cli = new import_clipanion17.Cli({
       binaryLabel: `Corepack`,
       binaryName: `corepack`,
-      binaryVersion: version
+      binaryVersion: corepackVersion
     });
     cli.register(import_clipanion17.Builtins.HelpCommand);
     cli.register(import_clipanion17.Builtins.VersionCommand);
diff --git a/deps/corepack/package.json b/deps/corepack/package.json
index 279475fb9cec..170b48449fc7 100644
--- a/deps/corepack/package.json
+++ b/deps/corepack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "corepack",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "homepage": "https://github.com/nodejs/corepack#readme",
   "bugs": {
     "url": "https://github.com/nodejs/corepack/issues"
@@ -16,24 +16,23 @@
     "./package.json": "./package.json"
   },
   "license": "MIT",
-  "packageManager": "yarn@4.14.1+sha224.88b7a7244bbd9040380c417f7eb556d85c67640b651f113cb4c72113",
+  "packageManager": "yarn@4.18.0+sha224.5707fce90df5d8720fae4e85a07ab55e90aa20fded8914893e2ba225",
   "devDependencies": {
     "@types/debug": "^4.1.5",
     "@types/node": "^22.0.0",
     "@types/proxy-from-env": "^1",
     "@types/semver": "^7.1.0",
     "@types/which": "^3.0.0",
-    "@yarnpkg/eslint-config": "^3.0.0",
+    "@yarnpkg/eslint-config": "^3.1.1",
     "@yarnpkg/fslib": "^3.0.0-rc.48",
     "@zkochan/cmd-shim": "^6.0.0",
     "clipanion": "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch",
     "debug": "^4.1.1",
     "esbuild": "^0.28.0",
-    "eslint": "^9.22.0",
+    "eslint": "^10.8.1",
     "semver": "^7.6.3",
-    "supports-color": "^10.0.0",
+    "supports-color": "^11.0.0",
     "tar": "^7.5.11",
-    "tsx": "^4.16.2",
     "typescript": "^5.7.3",
     "v8-compile-cache": "^2.3.0",
     "vitest": "^4.0.5",
@@ -45,11 +44,11 @@
     }
   },
   "scripts": {
-    "build": "run clean && run build:bundle && tsx ./mkshims.ts",
+    "build": "run clean && run build:bundle && node ./mkshims.ts",
     "build:bundle": "esbuild ./sources/_lib.ts --bundle --platform=node --target=node22.22.2 --external:corepack --outfile='./dist/lib/corepack.cjs' --resolve-extensions='.ts,.mjs,.js'",
     "clean": "run rimraf dist shims",
-    "corepack": "tsx ./sources/_cli.ts",
-    "lint": "eslint .",
+    "corepack": "node ./sources/_cli.ts",
+    "lint": "eslint",
     "prepack": "yarn build",
     "postpack": "run clean",
     "rimraf": "node -e 'for(let i=2;i<process.argv.length;i++)fs.rmSync(process.argv[i],{recursive:true,force:true});'",
diff --git a/deps/googletest/include/gtest/gtest-param-test.h b/deps/googletest/include/gtest/gtest-param-test.h
index 9e023f96dc60..64c60da8ac40 100644
--- a/deps/googletest/include/gtest/gtest-param-test.h
+++ b/deps/googletest/include/gtest/gtest-param-test.h
@@ -552,7 +552,7 @@ auto ConvertGenerator(Gen&& gen, Func&& f) {
 
 #define INSTANTIATE_TEST_SUITE_P(prefix, test_suite_name, ...)                \
   static ::testing::internal::ParamGenerator<test_suite_name::ParamType>      \
-      gtest_##prefix##test_suite_name##_EvalGenerator_() {                    \
+  gtest_##prefix##test_suite_name##_EvalGenerator_() {                        \
     return GTEST_EXPAND_(GTEST_GET_FIRST_(__VA_ARGS__, DUMMY_PARAM_));        \
   }                                                                           \
   static ::std::string gtest_##prefix##test_suite_name##_EvalGenerateName_(   \
@@ -562,7 +562,7 @@ auto ConvertGenerator(Gen&& gen, Func&& f) {
           __VA_ARGS__,                                                        \
           ::testing::internal::DefaultParamName<test_suite_name::ParamType>,  \
           DUMMY_PARAM_)));                                                    \
-      auto t = std::make_tuple(__VA_ARGS__);                                  \
+      const auto t = std::make_tuple(__VA_ARGS__);                            \
       static_assert(std::tuple_size<decltype(t)>::value <= 2,                 \
                     "Too Many Args!");                                        \
     }                                                                         \
diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index 69c9fec3ca95..f647ee691263 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -522,17 +522,14 @@ inline void PrintTo(bool x, ::std::ostream* os) {
 GTEST_API_ void PrintTo(wchar_t wc, ::std::ostream* os);
 
 GTEST_API_ void PrintTo(char32_t c, ::std::ostream* os);
-inline void PrintTo(char16_t c, ::std::ostream* os) {
-  // TODO(b/418738869): Incorrect for values not representing valid codepoints.
-  // Also see https://github.com/google/googletest/issues/4762.
-  PrintTo(static_cast<char32_t>(c), os);
-}
+
+// Overloads for the UTF-8 and UTF-16 code unit types.  A code unit that
+// encodes a code point all by itself is printed with the U+XXXX notation;
+// one that does not (any non-ASCII char8_t, and the UTF-16 surrogates) is
+// printed as a code unit instead, the way wchar_t is.
+GTEST_API_ void PrintTo(char16_t c, ::std::ostream* os);
 #ifdef __cpp_lib_char8_t
-inline void PrintTo(char8_t c, ::std::ostream* os) {
-  // TODO(b/418738869): Incorrect for values not representing valid codepoints.
-  // Also see https://github.com/google/googletest/issues/4762.
-  PrintTo(static_cast<char32_t>(c), os);
-}
+GTEST_API_ void PrintTo(char8_t c, ::std::ostream* os);
 #endif
 
 // gcc/clang __{u,}int128_t
@@ -674,12 +671,12 @@ inline void PrintTo(char32_t* s, ::std::ostream* os) {
   PrintTo(ImplicitCast_<const char32_t*>(s), os);
 }
 
-// MSVC can be configured to define wchar_t as a typedef of unsigned
-// short.  It defines _NATIVE_WCHAR_T_DEFINED when wchar_t is a native
-// type.  When wchar_t is a typedef, defining an overload for const
-// wchar_t* would cause unsigned short* be printed as a wide string,
-// possibly causing invalid memory accesses.
-#if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+// Only add an overload for printing wchar_t* if:
+// 1. Wide string support is enabled.
+// 2. wchar_t is a distinct native type. (If it's a typedef, the overload could
+//    cause a pointer to the underlying type to be mistakenly treated as a
+//    string.)
+#if GTEST_HAS_STD_WSTRING && GTEST_HAS_NATIVE_WCHAR
 // Overloads for wide C strings
 GTEST_API_ void PrintTo(const wchar_t* s, ::std::ostream* os);
 inline void PrintTo(wchar_t* s, ::std::ostream* os) {
diff --git a/deps/googletest/include/gtest/gtest.h b/deps/googletest/include/gtest/gtest.h
index 089b10e9f7a9..9fe7fb44239e 100644
--- a/deps/googletest/include/gtest/gtest.h
+++ b/deps/googletest/include/gtest/gtest.h
@@ -71,7 +71,7 @@
 #include "gtest/gtest-typed-test.h"  // IWYU pragma: export
 #include "gtest/gtest_pred_impl.h"  // IWYU pragma: export
 #include "gtest/gtest_prod.h"  // IWYU pragma: export
-#include "gtest/internal/gtest-internal.h"
+#include "gtest/internal/gtest-internal.h"  // IWYU pragma: export
 #include "gtest/internal/gtest-string.h"
 
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(4251 \
@@ -1514,6 +1514,8 @@ GTEST_API_ AssertionResult CmpHelperSTRCASENE(const char* s1_expression,
                                               const char* s2_expression,
                                               const char* s1, const char* s2);
 
+#if GTEST_HAS_STD_WSTRING
+
 // Helper function for *_STREQ on wide strings.
 //
 // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM.
@@ -1528,6 +1530,8 @@ GTEST_API_ AssertionResult CmpHelperSTRNE(const char* s1_expression,
                                           const char* s2_expression,
                                           const wchar_t* s1, const wchar_t* s2);
 
+#endif  // GTEST_HAS_STD_WSTRING
+
 }  // namespace internal
 
 // IsSubstring() and IsNotSubstring() are intended to be used as the
@@ -1542,18 +1546,10 @@ GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
                                        const char* haystack_expr,
                                        const char* needle,
                                        const char* haystack);
-GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
-                                       const char* haystack_expr,
-                                       const wchar_t* needle,
-                                       const wchar_t* haystack);
 GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
                                           const char* haystack_expr,
                                           const char* needle,
                                           const char* haystack);
-GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
-                                          const char* haystack_expr,
-                                          const wchar_t* needle,
-                                          const wchar_t* haystack);
 GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
                                        const char* haystack_expr,
                                        const ::std::string& needle,
@@ -1564,6 +1560,14 @@ GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
                                           const ::std::string& haystack);
 
 #if GTEST_HAS_STD_WSTRING
+GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
+                                       const char* haystack_expr,
+                                       const wchar_t* needle,
+                                       const wchar_t* haystack);
+GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
+                                          const char* haystack_expr,
+                                          const wchar_t* needle,
+                                          const wchar_t* haystack);
 GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
                                        const char* haystack_expr,
                                        const ::std::wstring& needle,
diff --git a/deps/googletest/include/gtest/internal/gtest-internal.h b/deps/googletest/include/gtest/internal/gtest-internal.h
index 55e9966720bf..f845ffed298e 100644
--- a/deps/googletest/include/gtest/internal/gtest-internal.h
+++ b/deps/googletest/include/gtest/internal/gtest-internal.h
@@ -39,7 +39,7 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_
 #define GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_
 
-#include "gtest/internal/gtest-port.h"
+#include "gtest/internal/gtest-port.h"  // IWYU pragma: export
 
 #ifdef GTEST_OS_LINUX
 #include <stdlib.h>
@@ -1516,8 +1516,9 @@ class [[nodiscard]] NeverThrown {
               parent_class>::GetSetUpCaseOrSuite(__FILE__, __LINE__),          \
           ::testing::internal::SuiteApiResolver<                               \
               parent_class>::GetTearDownCaseOrSuite(__FILE__, __LINE__),       \
-          new ::testing::internal::TestFactoryImpl<GTEST_TEST_CLASS_NAME_(     \
-              test_suite_name, test_name)>);                                   \
+          ::std::make_unique<::testing::internal::TestFactoryImpl<             \
+              GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)>>()           \
+              .release());                                                     \
   void GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)::TestBody()
 
 #endif  // GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 051228553449..94a56ce3dd9b 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -500,6 +500,17 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #endif  // defined(_MSC_VER) || defined(__BORLANDC__)
 #endif  // GTEST_HAS_EXCEPTIONS
 
+// MSVC either defines wchar_t as a typedef of unsigned short, or as a native
+// type (in which case, it defines _NATIVE_WCHAR_T_DEFINED). When wchar_t is a
+// typedef, defining an overload for const wchar_t* would cause unsigned short*
+// be printed as a wide string, possibly causing invalid memory accesses, so we
+// omit wchar_t overloads in that case.
+#if defined(_MSC_VER) && !defined(_NATIVE_WCHAR_T_DEFINED)
+#define GTEST_HAS_NATIVE_WCHAR 0
+#else
+#define GTEST_HAS_NATIVE_WCHAR 1
+#endif
+
 // 1. Calculate default GTEST_HAS_STD_WSTRING values based on STL capabilities.
 #if defined(_MSVC_STL_VERSION)
 // Microsoft's STL implementation always supports ::std::wstring.
@@ -2185,7 +2196,13 @@ GTEST_DISABLE_DEPRECATED_PUSH_()
     !defined(GTEST_OS_WINDOWS_RT) && !defined(GTEST_OS_WINDOWS_GAMES) &&     \
     !defined(GTEST_OS_ESP8266) && !defined(GTEST_OS_XTENSA) &&               \
     !defined(GTEST_OS_QURT)
-inline int ChDir(const char* dir) { return chdir(dir); }
+inline int ChDir(const char* dir) {
+#ifdef GTEST_OS_WINDOWS
+  return _chdir(dir);
+#else
+  return chdir(dir);
+#endif
+}
 #endif
 inline FILE* FOpen(const char* path, const char* mode) {
 #if defined(GTEST_OS_WINDOWS) && !defined(GTEST_OS_WINDOWS_MINGW)
@@ -2202,17 +2219,37 @@ inline FILE* FOpen(const char* path, const char* mode) {
 inline FILE* FReopen(const char* path, const char* mode, FILE* stream) {
   return freopen(path, mode, stream);
 }
-inline FILE* FDOpen(int fd, const char* mode) { return fdopen(fd, mode); }
+inline FILE* FDOpen(int fd, const char* mode) {
+#ifdef GTEST_OS_WINDOWS
+  return _fdopen(fd, mode);
+#else
+  return fdopen(fd, mode);
+#endif
+}
 #endif  // !GTEST_OS_WINDOWS_MOBILE && !GTEST_OS_QURT
 inline int FClose(FILE* fp) { return fclose(fp); }
 #if !defined(GTEST_OS_WINDOWS_MOBILE) && !defined(GTEST_OS_QURT)
 inline int Read(int fd, void* buf, unsigned int count) {
+#ifdef GTEST_OS_WINDOWS
+  return static_cast<int>(_read(fd, buf, count));
+#else
   return static_cast<int>(read(fd, buf, count));
+#endif
 }
 inline int Write(int fd, const void* buf, unsigned int count) {
+#ifdef GTEST_OS_WINDOWS
+  return static_cast<int>(_write(fd, buf, count));
+#else
   return static_cast<int>(write(fd, buf, count));
+#endif
+}
+inline int Close(int fd) {
+#ifdef GTEST_OS_WINDOWS
+  return _close(fd);
+#else
+  return close(fd);
+#endif
 }
-inline int Close(int fd) { return close(fd); }
 #endif  // !GTEST_OS_WINDOWS_MOBILE && !GTEST_OS_QURT
 #endif  // GTEST_HAS_FILE_SYSTEM
 
diff --git a/deps/googletest/src/gtest-port.cc b/deps/googletest/src/gtest-port.cc
index 433586f3b711..5aa800305c7a 100644
--- a/deps/googletest/src/gtest-port.cc
+++ b/deps/googletest/src/gtest-port.cc
@@ -1085,7 +1085,14 @@ bool EndsWithPathSeparator(const std::string& path) {
 class CapturedStream {
  public:
   // The ctor redirects the stream to a temporary file.
-  explicit CapturedStream(int fd) : fd_(fd), uncaptured_fd_(dup(fd)) {
+  explicit CapturedStream(int fd)
+      : fd_(fd),
+#ifdef GTEST_OS_WINDOWS
+        uncaptured_fd_(_dup(fd))
+#else
+        uncaptured_fd_(dup(fd))
+#endif
+  {
 #ifdef GTEST_OS_WINDOWS
     char temp_dir_path[MAX_PATH + 1] = {'\0'};   // NOLINT
     char temp_file_path[MAX_PATH + 1] = {'\0'};  // NOLINT
@@ -1097,7 +1104,7 @@ class CapturedStream {
     GTEST_CHECK_(success != 0)
         << "Failed to create temporary file in " << temp_dir_path
         << " with error " << ::GetLastError();
-    const int captured_fd = creat(temp_file_path, _S_IREAD | _S_IWRITE);
+    const int captured_fd = _creat(temp_file_path, _S_IREAD | _S_IWRITE);
     GTEST_CHECK_(captured_fd != -1)
         << "Failed to open temporary file " << temp_file_path << " with error "
         << ::GetLastError();
@@ -1167,8 +1174,12 @@ class CapturedStream {
     filename_ = std::move(name_template);
 #endif  // GTEST_OS_WINDOWS
     fflush(nullptr);
+#ifdef GTEST_OS_WINDOWS
+    _dup2(captured_fd, fd_);
+#else
     dup2(captured_fd, fd_);
-    close(captured_fd);
+#endif
+    posix::Close(captured_fd);
   }
 
   ~CapturedStream() { remove(filename_.c_str()); }
@@ -1177,8 +1188,12 @@ class CapturedStream {
     if (uncaptured_fd_ != -1) {
       // Restores the original stream.
       fflush(nullptr);
+#ifdef GTEST_OS_WINDOWS
+      _dup2(uncaptured_fd_, fd_);
+#else
       dup2(uncaptured_fd_, fd_);
-      close(uncaptured_fd_);
+#endif
+      posix::Close(uncaptured_fd_);
       uncaptured_fd_ = -1;
     }
 
diff --git a/deps/googletest/src/gtest-printers.cc b/deps/googletest/src/gtest-printers.cc
index 975ebb829876..17ac19f691c5 100644
--- a/deps/googletest/src/gtest-printers.cc
+++ b/deps/googletest/src/gtest-printers.cc
@@ -286,6 +286,28 @@ void PrintTo(char32_t c, ::std::ostream* os) {
       << static_cast<uint32_t>(c);
 }
 
+// char8_t and char16_t hold code units, not code points, so the U+XXXX
+// notation only applies to the values that encode a code point on their own.
+// The rest -- non-ASCII char8_t, which are always part of a multi-unit UTF-8
+// sequence, and the UTF-16 surrogates -- are printed as code units.
+void PrintTo(char16_t c, ::std::ostream* os) {
+  if (c >= 0xD800 && c <= 0xDFFF) {
+    PrintCharAndCodeTo(c, os);
+  } else {
+    PrintTo(static_cast<char32_t>(c), os);
+  }
+}
+
+#ifdef __cpp_lib_char8_t
+void PrintTo(char8_t c, ::std::ostream* os) {
+  if (c >= 0x80) {
+    PrintCharAndCodeTo(c, os);
+  } else {
+    PrintTo(static_cast<char32_t>(c), os);
+  }
+}
+#endif
+
 // gcc/clang __{u,}int128_t
 #if defined(__SIZEOF_INT128__)
 void PrintTo(__uint128_t v, ::std::ostream* os) {
@@ -468,16 +490,9 @@ void PrintTo(const char16_t* s, ostream* os) { PrintCStringTo(s, os); }
 
 void PrintTo(const char32_t* s, ostream* os) { PrintCStringTo(s, os); }
 
-// MSVC compiler can be configured to define whar_t as a typedef
-// of unsigned short. Defining an overload for const wchar_t* in that case
-// would cause pointers to unsigned shorts be printed as wide strings,
-// possibly accessing more memory than intended and causing invalid
-// memory accesses. MSVC defines _NATIVE_WCHAR_T_DEFINED symbol when
-// wchar_t is implemented as a native type.
-#if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
-// Prints the given wide C string to the ostream.
+#if GTEST_HAS_STD_WSTRING && GTEST_HAS_NATIVE_WCHAR
 void PrintTo(const wchar_t* s, ostream* os) { PrintCStringTo(s, os); }
-#endif  // wchar_t is native
+#endif
 
 namespace {
 
diff --git a/deps/googletest/src/gtest.cc b/deps/googletest/src/gtest.cc
index 3c855468268f..30a2bb7de0bc 100644
--- a/deps/googletest/src/gtest.cc
+++ b/deps/googletest/src/gtest.cc
@@ -1876,11 +1876,13 @@ bool IsSubstringPred(const char* needle, const char* haystack) {
   return strstr(haystack, needle) != nullptr;
 }
 
+#if GTEST_HAS_STD_WSTRING
 bool IsSubstringPred(const wchar_t* needle, const wchar_t* haystack) {
   if (needle == nullptr || haystack == nullptr) return needle == haystack;
 
   return wcsstr(haystack, needle) != nullptr;
 }
+#endif  // GTEST_HAS_STD_WSTRING
 
 // StringType here can be either ::std::string or ::std::wstring.
 template <typename StringType>
@@ -1922,23 +1924,12 @@ AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
   return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack);
 }
 
-AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
-                            const wchar_t* needle, const wchar_t* haystack) {
-  return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack);
-}
-
 AssertionResult IsNotSubstring(const char* needle_expr,
                                const char* haystack_expr, const char* needle,
                                const char* haystack) {
   return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack);
 }
 
-AssertionResult IsNotSubstring(const char* needle_expr,
-                               const char* haystack_expr, const wchar_t* needle,
-                               const wchar_t* haystack) {
-  return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack);
-}
-
 AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
                             const ::std::string& needle,
                             const ::std::string& haystack) {
@@ -1953,6 +1944,17 @@ AssertionResult IsNotSubstring(const char* needle_expr,
 }
 
 #if GTEST_HAS_STD_WSTRING
+AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
+                            const wchar_t* needle, const wchar_t* haystack) {
+  return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack);
+}
+
+AssertionResult IsNotSubstring(const char* needle_expr,
+                               const char* haystack_expr, const wchar_t* needle,
+                               const wchar_t* haystack) {
+  return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack);
+}
+
 AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
                             const ::std::wstring& needle,
                             const ::std::wstring& haystack) {
@@ -2182,6 +2184,7 @@ bool String::WideCStringEquals(const wchar_t* lhs, const wchar_t* rhs) {
   return wcscmp(lhs, rhs) == 0;
 }
 
+#if GTEST_HAS_STD_WSTRING
 // Helper function for *_STREQ on wide strings.
 AssertionResult CmpHelperSTREQ(const char* lhs_expression,
                                const char* rhs_expression, const wchar_t* lhs,
@@ -2206,6 +2209,7 @@ AssertionResult CmpHelperSTRNE(const char* s1_expression,
          << "Expected: (" << s1_expression << ") != (" << s2_expression
          << "), actual: " << PrintToString(s1) << " vs " << PrintToString(s2);
 }
+#endif  // GTEST_HAS_STD_WSTRING
 
 // Compares two C strings, ignoring case.  Returns true if and only if they have
 // the same content.
diff --git a/deps/histogram/unofficial.gni b/deps/histogram/unofficial.gni
index 1173ab298ae7..fd8c3a276bcb 100644
--- a/deps/histogram/unofficial.gni
+++ b/deps/histogram/unofficial.gni
@@ -4,29 +4,42 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("histogram_gn_build") {
-  config("histogram_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_hdr_histogram) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("histogram_config") {
+      packages = [ "hdr_histogram" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+    }
+  } else {
+    config("histogram_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("histogram.gyp") ],
-                            "scope",
-                            [ "histogram.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("histogram.gyp") ],
+                              "scope",
+                              [ "histogram.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":histogram_config" ]
-    sources = gypi_values.histogram_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-atomic-alignment",
-        "-Wno-incompatible-pointer-types",
-        "-Wno-unused-function",
-      ]
-    }
-    if (is_linux) {
-      libs = [ "atomic" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+      sources = gypi_values.histogram_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-atomic-alignment",
+          "-Wno-incompatible-pointer-types",
+          "-Wno-unused-function",
+        ]
+      }
+      if (is_linux) {
+        libs = [ "atomic" ]
+      }
     }
   }
 }
diff --git a/deps/llhttp/unofficial.gni b/deps/llhttp/unofficial.gni
index fdce32e59764..28257dcb33ae 100644
--- a/deps/llhttp/unofficial.gni
+++ b/deps/llhttp/unofficial.gni
@@ -4,26 +4,39 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("llhttp_gn_build") {
-  config("llhttp_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_http_parser) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("llhttp_config") {
+      packages = [ "libllhttp" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+    }
+  } else {
+    config("llhttp_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("llhttp.gyp") ],
-                            "scope",
-                            [ "llhttp.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("llhttp.gyp") ],
+                              "scope",
+                              [ "llhttp.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":llhttp_config" ]
-    include_dirs = [ "include" ]
-    sources = gypi_values.llhttp_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-      ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+      include_dirs = [ "include" ]
+      sources = gypi_values.llhttp_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+        ]
+      }
     }
   }
 }
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index fb7446578f57..20f22e614525 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -14,9 +14,11 @@
 #endif
 #include <algorithm>
 #include <array>
+#include <atomic>
 #include <climits>
 #include <cstring>
 #include <string_view>
+#include <vector>
 #if OPENSSL_VERSION_MAJOR >= 3
 #include <openssl/core_names.h>
 #include <openssl/params.h>
@@ -129,6 +131,31 @@ struct OpenSSLBufferDeleter {
 };
 using OpenSSLBufferPointer =
     std::unique_ptr<unsigned char, OpenSSLBufferDeleter>;
+
+struct RsaOtherPrimeParamNames {
+  const char* factor;
+  const char* exponent;
+  const char* coefficient;
+};
+
+#define RSA_OTHER_PRIME_PARAM_NAMES(prime, coefficient)                        \
+  {                                                                            \
+    OSSL_PKEY_PARAM_RSA_FACTOR #prime, OSSL_PKEY_PARAM_RSA_EXPONENT #prime,    \
+        OSSL_PKEY_PARAM_RSA_COEFFICIENT #coefficient                           \
+  }
+
+constexpr std::array<RsaOtherPrimeParamNames, 8> kRsaOtherPrimeParamNames = {{
+    RSA_OTHER_PRIME_PARAM_NAMES(3, 2),
+    RSA_OTHER_PRIME_PARAM_NAMES(4, 3),
+    RSA_OTHER_PRIME_PARAM_NAMES(5, 4),
+    RSA_OTHER_PRIME_PARAM_NAMES(6, 5),
+    RSA_OTHER_PRIME_PARAM_NAMES(7, 6),
+    RSA_OTHER_PRIME_PARAM_NAMES(8, 7),
+    RSA_OTHER_PRIME_PARAM_NAMES(9, 8),
+    RSA_OTHER_PRIME_PARAM_NAMES(10, 9),
+}};
+
+#undef RSA_OTHER_PRIME_PARAM_NAMES
 #endif
 
 static constexpr int kX509NameFlagsRFC2253WithinUtf8JSON =
@@ -507,23 +534,43 @@ DataPointer DataPointer::resize(size_t len) {
 }
 
 // ============================================================================
-bool isFipsEnabled() {
-  ClearErrorOnReturn clear_error_on_return;
+namespace {
+// This generation only coordinates cache invalidation. It does not make
+// OpenSSL default property changes safe to race with crypto operations.
+std::atomic<uint64_t> fips_state_generation{0};
+
+bool isFipsEnabledRaw() {
 #if OPENSSL_VERSION_MAJOR >= 3
   return EVP_default_properties_is_fips_enabled(nullptr) == 1;
 #else
   return FIPS_mode() == 1;
 #endif
 }
+}  // namespace
+
+bool isFipsEnabled() {
+  ClearErrorOnReturn clear_error_on_return;
+  return isFipsEnabledRaw();
+}
 
 bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
-  if (isFipsEnabled() == enable) return true;
+  const bool was_enabled = isFipsEnabled();
+  if (was_enabled == enable) return true;
   ClearErrorOnReturn clearErrorOnReturn(errors);
 #if OPENSSL_VERSION_MAJOR >= 3
-  return EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
+  const bool success =
+      EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
 #else
-  return FIPS_mode_set(enable ? 1 : 0) == 1;
+  const bool success = FIPS_mode_set(enable ? 1 : 0) == 1;
 #endif
+  if (success && isFipsEnabledRaw() != was_enabled) {
+    fips_state_generation.fetch_add(1, std::memory_order_release);
+  }
+  return success;
+}
+
+uint64_t getFipsStateGeneration() {
+  return fips_state_generation.load(std::memory_order_acquire);
 }
 
 bool testFipsEnabled() {
@@ -3060,6 +3107,19 @@ EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
             bld.get(), OSSL_PKEY_PARAM_RSA_COEFFICIENT1, private_key.qi) != 1) {
       return {};
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (other_prime_infos.size() > kRsaOtherPrimeParamNames.size()) return {};
+    for (size_t i = 0; i < other_prime_infos.size(); i++) {
+      const auto& info = other_prime_infos[i];
+      const auto& names = kRsaOtherPrimeParamNames[i];
+      if (info.r == nullptr || info.d == nullptr || info.t == nullptr ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.factor, info.r) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.exponent, info.d) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.coefficient, info.t) != 1) {
+        return {};
+      }
+    }
     selection = EVP_PKEY_KEYPAIR;
   }
 
@@ -4406,13 +4466,211 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
 
 // ============================================================================
 
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+namespace {
+constexpr char AsciiToLower(char c) {
+  return c >= 'A' && c <= 'Z' ? c + ('a' - 'A') : c;
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+constexpr auto kUnsupportedCipherFlags =
+    EVP_CIPH_FLAG_CIPHER_WITH_MAC | EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK;
+
+bool HasUnsupportedCipherFlags(const EVP_CIPHER* cipher) {
+  return (EVP_CIPHER_get_flags(cipher) & kUnsupportedCipherFlags) != 0;
+}
+
+bool IsSupportedLegacyCipher(const EVP_CIPHER* cipher) {
+  return cipher != nullptr && cipher != EVP_enc_null() &&
+         !HasUnsupportedCipherFlags(cipher);
+}
+
+bool IsSupportedFetchedCipher(const EVP_CIPHER* cipher) {
+  if (cipher == nullptr || EVP_CIPHER_is_a(cipher, "NULL") ||
+      HasUnsupportedCipherFlags(cipher)) {
+    return false;
+  }
+
+#ifdef OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC
+  int encrypt_then_mac = 0;
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC,
+                               &encrypt_then_mac),
+      OSSL_PARAM_construct_end(),
+  };
+  if (EVP_CIPHER_get_params(const_cast<EVP_CIPHER*>(cipher), params) == 1 &&
+      encrypt_then_mac != 0) {
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+void PushAlgorithmAlias(const char* name, void* arg) {
+  if (name == nullptr) return;
+  static_cast<std::vector<std::string>*>(arg)->emplace_back(name);
+}
+#endif
+}  // namespace
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
 Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
     : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
 #endif
 
+size_t CaseInsensitiveNameHash::operator()(
+    std::string_view name) const noexcept {
+  size_t hash = 5381;
+  for (char c : name) hash = ((hash << 5) + hash) ^ AsciiToLower(c);
+  return hash;
+}
+
+bool CaseInsensitiveNameEqual::operator()(std::string_view lhs,
+                                          std::string_view rhs) const noexcept {
+  if (lhs.size() != rhs.size()) return false;
+  for (size_t n = 0; n < lhs.size(); n++) {
+    if (AsciiToLower(lhs[n]) != AsciiToLower(rhs[n])) return false;
+  }
+  return true;
+}
+
+DigestCache::Result DigestCache::lookup(const char* name,
+                                        uint64_t generation) const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation) return {};
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return {};
+  return lookup(it->second, generation);
+#else
+  static_cast<void>(name);
+  static_cast<void>(generation);
+  return {};
+#endif
+}
+
+DigestCache::Result DigestCache::insert(const char* name,
+                                        const EVP_MD* digest,
+                                        uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation || name == nullptr || digest == nullptr) {
+    return {};
+  }
+
+  const char* canonical_name = EVP_MD_get0_name(digest);
+  const OSSL_PROVIDER* provider = EVP_MD_get0_provider(digest);
+  if (canonical_name == nullptr || provider == nullptr) return {};
+
+  for (size_t index = 0; index < digests_.size(); index++) {
+    const EVP_MD* cached = digests_[index].get();
+    if (cached == nullptr) continue;
+    const char* cached_name = EVP_MD_get0_name(cached);
+    if (EVP_MD_get0_provider(cached) == provider && cached_name != nullptr &&
+        CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+      const int32_t id = static_cast<int32_t>(first_id_ + index);
+      aliases_.insert_or_assign(name, id);
+      return {cached, id};
+    }
+  }
+
+  if (next_id_ == UINT32_MAX ||
+      EVP_MD_up_ref(const_cast<EVP_MD*>(digest)) != 1) {
+    return {};
+  }
+
+  digests_.emplace_back(const_cast<EVP_MD*>(digest));
+  const int32_t id = static_cast<int32_t>(next_id_++);
+  const size_t index = digests_.size() - 1;
+
+  std::vector<std::string> aliases;
+  EVP_MD_names_do_all(digests_[index].get(), PushAlgorithmAlias, &aliases);
+  for (const std::string& alias : aliases) aliases_.emplace(alias, id);
+  aliases_.insert_or_assign(name, id);
+
+  return {digests_[index].get(), id};
+#else
+  static_cast<void>(name);
+  static_cast<void>(digest);
+  static_cast<void>(generation);
+  return {};
+#endif
+}
+
+void DigestCache::reset(uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ == generation) return;
+  aliases_.clear();
+  digests_.clear();
+  first_id_ = next_id_;
+#endif
+  generation_ = generation;
+}
+
+const DigestCache::AliasMap& DigestCache::aliases() const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return aliases_;
+#else
+  static const AliasMap empty;
+  return empty;
+#endif
+}
+
+const EVP_CIPHER* CipherCache::lookup(const char* name, uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation) {
+    aliases_.clear();
+    ciphers_.clear();
+    generation_ = generation;
+  }
+
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return nullptr;
+  if (it->second >= ciphers_.size()) return nullptr;
+  return ciphers_[it->second].get();
+#else
+  static_cast<void>(name);
+  static_cast<void>(generation);
+  return nullptr;
+#endif
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+const EVP_CIPHER* CipherCache::insert(
+    const char* name,
+    DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
+    uint64_t generation) {
+  if (generation_ != generation || cipher == nullptr) return nullptr;
+
+  const char* canonical_name = EVP_CIPHER_get0_name(cipher.get());
+  const OSSL_PROVIDER* provider = EVP_CIPHER_get0_provider(cipher.get());
+  if (canonical_name != nullptr && provider != nullptr) {
+    for (size_t id = 0; id < ciphers_.size(); id++) {
+      const EVP_CIPHER* cached = ciphers_[id].get();
+      const char* cached_name = EVP_CIPHER_get0_name(cached);
+      if (EVP_CIPHER_get0_provider(cached) == provider &&
+          cached_name != nullptr &&
+          CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+        aliases_.insert_or_assign(name, id);
+        return cached;
+      }
+    }
+  }
+
+  ciphers_.emplace_back(std::move(cipher));
+  const size_t id = ciphers_.size() - 1;
+
+  std::vector<std::string> aliases;
+  EVP_CIPHER_names_do_all(ciphers_[id].get(), PushAlgorithmAlias, &aliases);
+  for (const std::string& alias : aliases) {
+    aliases_.emplace(alias, id);
+  }
+  aliases_.insert_or_assign(name, id);
+
+  return ciphers_[id].get();
+}
+#endif
+
 Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (other.fetched_cipher_ != nullptr) {
     if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
       fetched_cipher_.reset(other.fetched_cipher_.get());
@@ -4425,7 +4683,7 @@ Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
 
 Cipher& Cipher::operator=(const Cipher& other) {
   if (this == &other) return *this;
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (other.fetched_cipher_ != nullptr) {
     if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
       fetched_cipher_.reset(other.fetched_cipher_.get());
@@ -4442,40 +4700,59 @@ Cipher& Cipher::operator=(const Cipher& other) {
   return *this;
 }
 
-const Cipher Cipher::FromName(const char* name) {
+const Cipher Cipher::FromName(const char* name, CipherCache* cache) {
   const EVP_CIPHER* cipher = EVP_get_cipherbyname(name);
-  if (cipher != nullptr) return Cipher(cipher);
+  if (cipher != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsSupportedLegacyCipher(cipher)) return Cipher();
+#endif
+    return Cipher(cipher);
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // A resolution that overlaps a FIPS transition may use either property
+  // state. The cache retains the generation observed here, so the first
+  // resolution begun after the transition clears any stale entries.
+  const uint64_t generation = getFipsStateGeneration();
+  if (cache != nullptr) {
+    if (const EVP_CIPHER* cached = cache->lookup(name, generation)) {
+      return Cipher(cached);
+    }
+  }
 
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
   MarkPopErrorOnReturn mark_pop_error_on_return;
   DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
       EVP_CIPHER_fetch(nullptr, name, nullptr));
-  if (fetched == nullptr) return Cipher();
+  if (!IsSupportedFetchedCipher(fetched.get())) return Cipher();
 
-  const int mode = EVP_CIPHER_mode(fetched.get());
-  const bool is_siv_mode =
-#if OPENSSL_WITH_AES_SIV
-      mode == EVP_CIPH_SIV_MODE ||
-#endif
-#if OPENSSL_WITH_AES_GCM_SIV
-      mode == EVP_CIPH_GCM_SIV_MODE ||
-#endif
-      false;
-  if (is_siv_mode) return Cipher(std::move(fetched));
+  if (cache != nullptr && generation == getFipsStateGeneration()) {
+    if (const EVP_CIPHER* cached =
+            cache->insert(name, std::move(fetched), generation)) {
+      return Cipher(cached);
+    }
+  }
 
-  return Cipher();
+  return Cipher(std::move(fetched));
 #else
+  static_cast<void>(cache);
   return Cipher();
 #endif
 }
 
-const Cipher Cipher::FromNid(int nid) {
+const Cipher Cipher::FromNid(int nid, CipherCache* cache) {
   const EVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
-  if (cipher != nullptr) return Cipher(cipher);
+  if (cipher != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsSupportedLegacyCipher(cipher)) return Cipher();
+#endif
+    return Cipher(cipher);
+  }
 
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   const char* name = OBJ_nid2sn(nid);
-  if (name != nullptr) return FromName(name);
+  if (name != nullptr) return FromName(name, cache);
+#else
+  static_cast<void>(cache);
 #endif
 
   return Cipher();
@@ -4485,27 +4762,79 @@ const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
   return Cipher(GetCipherCtxCipher(ctx.get()));
 }
 
-const Cipher Cipher::EMPTY = Cipher();
-const Cipher Cipher::AES_128_CBC = Cipher::FromNid(NID_aes_128_cbc);
-const Cipher Cipher::AES_192_CBC = Cipher::FromNid(NID_aes_192_cbc);
-const Cipher Cipher::AES_256_CBC = Cipher::FromNid(NID_aes_256_cbc);
-const Cipher Cipher::AES_128_CTR = Cipher::FromNid(NID_aes_128_ctr);
-const Cipher Cipher::AES_192_CTR = Cipher::FromNid(NID_aes_192_ctr);
-const Cipher Cipher::AES_256_CTR = Cipher::FromNid(NID_aes_256_ctr);
-const Cipher Cipher::AES_128_GCM = Cipher::FromNid(NID_aes_128_gcm);
-const Cipher Cipher::AES_192_GCM = Cipher::FromNid(NID_aes_192_gcm);
-const Cipher Cipher::AES_256_GCM = Cipher::FromNid(NID_aes_256_gcm);
-const Cipher Cipher::AES_128_KW = Cipher::FromNid(NID_id_aes128_wrap);
-const Cipher Cipher::AES_192_KW = Cipher::FromNid(NID_id_aes192_wrap);
-const Cipher Cipher::AES_256_KW = Cipher::FromNid(NID_id_aes256_wrap);
+namespace {
+template <int nid>
+const Cipher& GetPredefinedCipher() {
+  static const Cipher cipher = Cipher::FromNid(nid);
+  return cipher;
+}
+}  // namespace
+
+const Cipher& Cipher::AES_128_CBC() {
+  return GetPredefinedCipher<NID_aes_128_cbc>();
+}
+
+const Cipher& Cipher::AES_192_CBC() {
+  return GetPredefinedCipher<NID_aes_192_cbc>();
+}
+
+const Cipher& Cipher::AES_256_CBC() {
+  return GetPredefinedCipher<NID_aes_256_cbc>();
+}
+
+const Cipher& Cipher::AES_128_CTR() {
+  return GetPredefinedCipher<NID_aes_128_ctr>();
+}
+
+const Cipher& Cipher::AES_192_CTR() {
+  return GetPredefinedCipher<NID_aes_192_ctr>();
+}
+
+const Cipher& Cipher::AES_256_CTR() {
+  return GetPredefinedCipher<NID_aes_256_ctr>();
+}
+
+const Cipher& Cipher::AES_128_GCM() {
+  return GetPredefinedCipher<NID_aes_128_gcm>();
+}
+
+const Cipher& Cipher::AES_192_GCM() {
+  return GetPredefinedCipher<NID_aes_192_gcm>();
+}
+
+const Cipher& Cipher::AES_256_GCM() {
+  return GetPredefinedCipher<NID_aes_256_gcm>();
+}
+
+const Cipher& Cipher::AES_128_KW() {
+  return GetPredefinedCipher<NID_id_aes128_wrap>();
+}
+
+const Cipher& Cipher::AES_192_KW() {
+  return GetPredefinedCipher<NID_id_aes192_wrap>();
+}
+
+const Cipher& Cipher::AES_256_KW() {
+  return GetPredefinedCipher<NID_id_aes256_wrap>();
+}
 
 #ifndef OPENSSL_IS_BORINGSSL
-const Cipher Cipher::AES_128_OCB = Cipher::FromNid(NID_aes_128_ocb);
-const Cipher Cipher::AES_192_OCB = Cipher::FromNid(NID_aes_192_ocb);
-const Cipher Cipher::AES_256_OCB = Cipher::FromNid(NID_aes_256_ocb);
+const Cipher& Cipher::AES_128_OCB() {
+  return GetPredefinedCipher<NID_aes_128_ocb>();
+}
+
+const Cipher& Cipher::AES_192_OCB() {
+  return GetPredefinedCipher<NID_aes_192_ocb>();
+}
+
+const Cipher& Cipher::AES_256_OCB() {
+  return GetPredefinedCipher<NID_aes_256_ocb>();
+}
 #endif
 
-const Cipher Cipher::CHACHA20_POLY1305 = Cipher::FromNid(NID_chacha20_poly1305);
+const Cipher& Cipher::CHACHA20_POLY1305() {
+  return GetPredefinedCipher<NID_chacha20_poly1305>();
+}
 
 bool Cipher::isGcmMode() const {
   if (!cipher_) return false;
@@ -4527,6 +4856,15 @@ bool Cipher::isCcmMode() const {
   return getMode() == EVP_CIPH_CCM_MODE;
 }
 
+bool Cipher::isCtsMode() const {
+  if (!cipher_) return false;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return (EVP_CIPHER_get_flags(cipher_) & EVP_CIPH_FLAG_CTS) != 0;
+#else
+  return false;
+#endif
+}
+
 bool Cipher::isOcbMode() const {
   if (!cipher_) return false;
   return getMode() == EVP_CIPH_OCB_MODE;
@@ -4631,7 +4969,7 @@ const char* Cipher::getName() const {
     const char* name = OBJ_nid2sn(nid);
     if (name != nullptr) return name;
   }
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   return EVP_CIPHER_get0_name(cipher_);
 #else
   return {};
@@ -4728,11 +5066,57 @@ bool CipherCtxPointer::setAeadTagLength(size_t length) {
       ctx_.get(), EVP_CTRL_AEAD_SET_TAG, length, nullptr);
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+// OSSL_CIPHER_PARAM_XTS_STANDARD is not defined by OpenSSL 3.0. Use its
+// parameter name directly so custom 3.0 providers can advertise it too.
+constexpr char kCipherParamXtsStandard[] = "xts_standard";
+
+bool SetCipherCtxStringParam(EVP_CIPHER_CTX* ctx,
+                             const char* key,
+                             const char* value) {
+  if (ctx == nullptr || value == nullptr) return false;
+
+  const OSSL_PARAM* settable = EVP_CIPHER_CTX_settable_params(ctx);
+  const OSSL_PARAM* descriptor =
+      settable == nullptr ? nullptr : OSSL_PARAM_locate_const(settable, key);
+  if (descriptor == nullptr ||
+      descriptor->data_type != OSSL_PARAM_UTF8_STRING) {
+    return false;
+  }
+
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_utf8_string(key, const_cast<char*>(value), 0),
+      OSSL_PARAM_END,
+  };
+  return EVP_CIPHER_CTX_set_params(ctx, params) == 1;
+}
+}  // namespace
+#endif
+
+bool CipherCtxPointer::setCtsMode(const char* mode) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return SetCipherCtxStringParam(ctx_.get(), OSSL_CIPHER_PARAM_CTS_MODE, mode);
+#else
+  static_cast<void>(mode);
+  return false;
+#endif
+}
+
 bool CipherCtxPointer::setPadding(bool padding) {
   if (!ctx_) return false;
   return EVP_CIPHER_CTX_set_padding(ctx_.get(), padding);
 }
 
+bool CipherCtxPointer::setXtsStandard(const char* standard) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return SetCipherCtxStringParam(ctx_.get(), kCipherParamXtsStandard, standard);
+#else
+  static_cast<void>(standard);
+  return false;
+#endif
+}
+
 int CipherCtxPointer::getBlockSize() const {
   if (!ctx_) return 0;
   return EVP_CIPHER_CTX_block_size(ctx_.get());
@@ -4758,6 +5142,16 @@ bool CipherCtxPointer::isCcmMode() const {
   return getMode() == EVP_CIPH_CCM_MODE;
 }
 
+bool CipherCtxPointer::isCtsMode() const {
+  if (!ctx_) return false;
+  return Cipher::FromCtx(*this).isCtsMode();
+}
+
+bool CipherCtxPointer::isXtsMode() const {
+  if (!ctx_) return false;
+  return getMode() == EVP_CIPH_XTS_MODE;
+}
+
 bool CipherCtxPointer::isWrapMode() const {
   if (!ctx_) return false;
   return getMode() == EVP_CIPH_WRAP_MODE;
@@ -5779,6 +6173,11 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
 }
 }  // namespace
 
+Rsa::OtherPrimeInfoPointer::OtherPrimeInfoPointer(BignumPointer&& r,
+                                                  BignumPointer&& d,
+                                                  BignumPointer&& t)
+    : r(r.release()), d(d.release()), t(t.release()) {}
+
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
 namespace {
 int DigestAlgorithmIdentifierToNid(const unsigned char* data, size_t size) {
@@ -6007,6 +6406,19 @@ Rsa::Rsa(const EVP_PKEY* pkey) : Rsa() {
     return;
   }
 
+  for (const auto& names : kRsaOtherPrimeParamNames) {
+    OtherPrimeInfoPointer info;
+    if (!GetOptionalPKeyBnParam(pkey, names.factor, &info.r) ||
+        !GetOptionalPKeyBnParam(pkey, names.exponent, &info.d) ||
+        !GetOptionalPKeyBnParam(pkey, names.coefficient, &info.t)) {
+      return;
+    }
+
+    if (!info.r && !info.d && !info.t) break;
+    if (!info.r || !info.d || !info.t) return;
+    other_prime_infos_.push_back(std::move(info));
+  }
+
   if (type == EVP_PKEY_RSA_PSS) {
     MarkPopErrorOnReturn pop_errors;
     PssParams params;
@@ -6045,6 +6457,35 @@ const Rsa::PrivateKey Rsa::getPrivateKey() const {
 #endif
 }
 
+const Rsa::OtherPrimeInfos Rsa::getOtherPrimeInfos() const {
+  OtherPrimeInfos infos;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  infos.reserve(other_prime_infos_.size());
+  for (const auto& info : other_prime_infos_) {
+    infos.push_back({info.r.get(), info.d.get(), info.t.get()});
+  }
+#elif NCRYPTO_USE_LEGACY_OPENSSL
+  if (rsa_ == nullptr) return infos;
+  const int count = RSA_get_multi_prime_extra_count(rsa_);
+  if (count <= 0) return infos;
+
+  std::vector<const BIGNUM*> factors(count);
+  std::vector<const BIGNUM*> exponents(count);
+  std::vector<const BIGNUM*> coefficients(count);
+  if (RSA_get0_multi_prime_factors(rsa_, factors.data()) != 1 ||
+      RSA_get0_multi_prime_crt_params(
+          rsa_, exponents.data(), coefficients.data()) != 1) {
+    return {};
+  }
+
+  infos.reserve(count);
+  for (int i = 0; i < count; i++) {
+    infos.push_back({factors[i], exponents[i], coefficients[i]});
+  }
+#endif
+  return infos;
+}
+
 const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return pss_params_;
@@ -6146,15 +6587,20 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
                         BignumPointer&& p,
                         BignumPointer&& dp,
                         BignumPointer&& dq,
-                        BignumPointer&& qi) {
+                        BignumPointer&& qi,
+                        OtherPrimeInfoPointers&& other_prime_infos) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!d || !q || !p || !dp || !dq || !qi) return false;
+  for (const auto& info : other_prime_infos) {
+    if (!info.r || !info.d || !info.t) return false;
+  }
   d_.reset(d.release());
   q_.reset(q.release());
   p_.reset(p.release());
   dp_.reset(dp.release());
   dq_.reset(dq.release());
   qi_.reset(qi.release());
+  other_prime_infos_ = std::move(other_prime_infos);
   rsa_ = n_ != nullptr && e_ != nullptr;
   return rsa_;
 #else
@@ -6176,6 +6622,37 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
   dp.release();
   dq.release();
   qi.release();
+
+#if NCRYPTO_USE_LEGACY_OPENSSL
+  if (!other_prime_infos.empty()) {
+    std::vector<BIGNUM*> factors;
+    std::vector<BIGNUM*> exponents;
+    std::vector<BIGNUM*> coefficients;
+    factors.reserve(other_prime_infos.size());
+    exponents.reserve(other_prime_infos.size());
+    coefficients.reserve(other_prime_infos.size());
+    for (const auto& info : other_prime_infos) {
+      if (!info.r || !info.d || !info.t) return false;
+      factors.push_back(info.r.get());
+      exponents.push_back(info.d.get());
+      coefficients.push_back(info.t.get());
+    }
+    if (RSA_set0_multi_prime_params(const_cast<RSA*>(rsa_),
+                                    factors.data(),
+                                    exponents.data(),
+                                    coefficients.data(),
+                                    static_cast<int>(factors.size())) != 1) {
+      return false;
+    }
+    for (auto& info : other_prime_infos) {
+      info.r.release();
+      info.d.release();
+      info.t.release();
+    }
+  }
+#else
+  if (!other_prime_infos.empty()) return false;
+#endif
   return true;
 #endif
 }
@@ -6229,23 +6706,7 @@ struct CipherCallbackContext {
   void operator()(const char* name) { cb(name); }
 };
 
-#if OPENSSL_WITH_AES_SIV
-constexpr const char* kProviderOnlyAesSivCiphers[] = {
-    "aes-128-siv",
-    "aes-192-siv",
-    "aes-256-siv",
-};
-#endif
-
-#if OPENSSL_WITH_AES_GCM_SIV
-constexpr const char* kProviderOnlyAesGcmSivCiphers[] = {
-    "aes-128-gcm-siv",
-    "aes-192-gcm-siv",
-    "aes-256-gcm-siv",
-};
-#endif
-
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
 template <class TypeName,
           TypeName* fetch_type(OSSL_LIB_CTX*, const char*, const char*),
           void free_type(TypeName*),
@@ -6269,13 +6730,49 @@ void array_push_back(const TypeName* evp_ref,
   // instance if the algorithm is supported by the public OpenSSL APIs (some
   // algorithms are used internally by OpenSSL and are also passed to this
   // callback).
-  TypeName* fetched = fetch_type(nullptr, real_name, nullptr);
-  if (fetched == nullptr) return;
+  DeleteFnPtr<TypeName, free_type> fetched(
+      fetch_type(nullptr, real_name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return;
 
-  free_type(fetched);
   auto& cb = *(static_cast<CipherCallbackContext*>(arg));
   cb(from);
 }
+
+void array_push_back_provider_name(const char* name, void* arg) {
+  if (name == nullptr) return;
+
+  const std::string_view name_view(name);
+  const bool is_dotted_decimal =
+      name_view.find('.') != std::string_view::npos &&
+      std::all_of(name_view.begin(), name_view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized_name(name_view);
+  std::transform(normalized_name.begin(),
+                 normalized_name.end(),
+                 normalized_name.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+  auto& cb = *(static_cast<CipherCallbackContext*>(arg));
+  cb(normalized_name.c_str());
+}
+
+void array_push_back_provider(EVP_CIPHER* cipher, void* arg) {
+  const char* name = EVP_CIPHER_get0_name(cipher);
+  if (name == nullptr) return;
+
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
+      EVP_CIPHER_fetch(nullptr, name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return;
+
+  EVP_CIPHER_names_do_all(fetched.get(), array_push_back_provider_name, arg);
+}
 #else
 template <class TypeName>
 void array_push_back(const TypeName* evp_ref,
@@ -6301,7 +6798,7 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
   }
 #else
   EVP_CIPHER_do_all_sorted(
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
       array_push_back<EVP_CIPHER,
                       EVP_CIPHER_fetch,
                       EVP_CIPHER_free,
@@ -6311,23 +6808,8 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
       array_push_back<EVP_CIPHER>,
 #endif
       &context);
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
-  auto maybe_push_provider_only_cipher = [&](const char* name) {
-    EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
-    if (cipher == nullptr) return;
-    EVP_CIPHER_free(cipher);
-    context.cb(name);
-  };
-#endif
-#if OPENSSL_WITH_AES_SIV
-  for (const char* name : kProviderOnlyAesSivCiphers) {
-    maybe_push_provider_only_cipher(name);
-  }
-#endif
-#if OPENSSL_WITH_AES_GCM_SIV
-  for (const char* name : kProviderOnlyAesGcmSivCiphers) {
-    maybe_push_provider_only_cipher(name);
-  }
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  EVP_CIPHER_do_all_provided(nullptr, array_push_back_provider, &context);
 #endif
 #endif
 }
@@ -6479,11 +6961,19 @@ EVP_MD_CTX* EVPMDCtxPointer::release() {
   return ctx_.release();
 }
 
-bool EVPMDCtxPointer::digestInit(const Digest& digest) {
+bool EVPMDCtxPointer::digestInit(const EVP_MD* digest) {
   if (!ctx_) return false;
   return EVP_DigestInit_ex(ctx_.get(), digest, nullptr) > 0;
 }
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+bool EVPMDCtxPointer::digestInit(const EVP_MD* digest,
+                                 const OSSL_PARAM* params) {
+  if (!ctx_) return false;
+  return EVP_DigestInit_ex2(ctx_.get(), digest, params) > 0;
+}
+#endif
+
 bool EVPMDCtxPointer::digestUpdate(const Buffer<const void>& in) {
   if (!ctx_) return false;
   return EVP_DigestUpdate(ctx_.get(), in.data, in.len) > 0;
@@ -6832,6 +7322,79 @@ EVPMacPointer EVPMacPointer::Fetch(const char* algorithm) {
   return EVPMacPointer(EVP_MAC_fetch(nullptr, algorithm, nullptr));
 }
 
+MacKind MacCache::GetKind(EVP_MAC* mac) {
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_HMAC)) return MacKind::kHmac;
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_CMAC)) return MacKind::kCmac;
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_GMAC)) return MacKind::kGmac;
+  return MacKind::kOther;
+}
+
+MacCache::Result MacCache::lookup(const char* name, uint64_t generation) const {
+  if (generation_ != generation || name == nullptr) return {};
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return {};
+  return lookup(it->second, generation);
+}
+
+MacCache::Result MacCache::insert(const char* name,
+                                  EVPMacPointer&& mac,
+                                  uint64_t generation) {
+  if (generation_ != generation || generation != getFipsStateGeneration() ||
+      name == nullptr || mac == nullptr) {
+    return {};
+  }
+
+  const char* canonical_name = EVP_MAC_get0_name(mac.get());
+  const OSSL_PROVIDER* provider = EVP_MAC_get0_provider(mac.get());
+  if (canonical_name == nullptr || provider == nullptr) return {};
+
+  for (size_t index = 0; index < macs_.size(); index++) {
+    EVP_MAC* cached = macs_[index].mac.get();
+    if (cached == nullptr) continue;
+    const char* cached_name = EVP_MAC_get0_name(cached);
+    if (EVP_MAC_get0_provider(cached) == provider && cached_name != nullptr &&
+        CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+      if (generation != getFipsStateGeneration()) return {};
+      const int32_t id = static_cast<int32_t>(first_id_ + index);
+      aliases_.insert_or_assign(name, id);
+      return {cached, id, macs_[index].kind};
+    }
+  }
+
+  if (next_id_ == UINT32_MAX) return {};
+
+  std::vector<std::string> aliases;
+  {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+    if (EVP_MAC_names_do_all(mac.get(), PushAlgorithmAlias, &aliases) != 1) {
+      return {};
+    }
+  }
+  if (generation != getFipsStateGeneration()) return {};
+
+  const MacKind kind = GetKind(mac.get());
+  macs_.push_back({std::move(mac), kind});
+  const int32_t id = static_cast<int32_t>(next_id_++);
+  const size_t index = macs_.size() - 1;
+
+  for (const std::string& alias : aliases) aliases_.emplace(alias, id);
+  aliases_.insert_or_assign(name, id);
+
+  return {macs_[index].mac.get(), id, kind};
+}
+
+void MacCache::reset(uint64_t generation) {
+  if (generation_ == generation) return;
+  aliases_.clear();
+  macs_.clear();
+  first_id_ = next_id_;
+  generation_ = generation;
+}
+
+const MacCache::AliasMap& MacCache::aliases() const {
+  return aliases_;
+}
+
 EVPMacCtxPointer::EVPMacCtxPointer(EVP_MAC_CTX* ctx) : ctx_(ctx) {}
 
 EVPMacCtxPointer::EVPMacCtxPointer(EVPMacCtxPointer&& other) noexcept
@@ -6859,22 +7422,42 @@ EVP_MAC_CTX* EVPMacCtxPointer::release() {
 bool EVPMacCtxPointer::init(const Buffer<const void>& key,
                             const OSSL_PARAM* params) {
   if (!ctx_) return false;
-  return EVP_MAC_init(ctx_.get(),
-                      static_cast<const unsigned char*>(key.data),
-                      key.len,
-                      params) == 1;
+
+  static constexpr unsigned char kEmptyKey = 0;
+  const unsigned char* key_data = static_cast<const unsigned char*>(key.data);
+  if (key_data == nullptr) {
+    if (key.len != 0) return false;
+    key_data = &kEmptyKey;
+  }
+
+  return EVP_MAC_init(ctx_.get(), key_data, key.len, params) == 1;
 }
 
 bool EVPMacCtxPointer::update(const Buffer<const void>& data) {
   if (!ctx_) return false;
+  if (data.len == 0) return true;
+  if (data.data == nullptr) return false;
   return EVP_MAC_update(ctx_.get(),
                         static_cast<const unsigned char*>(data.data),
                         data.len) == 1;
 }
 
+size_t EVPMacCtxPointer::getSize() const {
+  return ctx_ ? EVP_MAC_CTX_get_mac_size(ctx_.get()) : 0;
+}
+
+const OSSL_PARAM* EVPMacCtxPointer::getSettableParams() const {
+  return ctx_ ? EVP_MAC_CTX_settable_params(ctx_.get()) : nullptr;
+}
+
 DataPointer EVPMacCtxPointer::final(size_t length) {
   if (!ctx_) return {};
-  auto buf = DataPointer::Alloc(length);
+
+  // DataPointer uses a null allocation to represent failure. Retain a
+  // one-byte allocation for a successful zero-length result while passing the
+  // requested zero capacity to OpenSSL. A non-null output pointer is required
+  // to actually finalize; nullptr only queries the output length.
+  auto buf = DataPointer::Alloc(length == 0 ? 1 : length);
   if (!buf) return {};
 
   size_t result_len = length;
@@ -6884,8 +7467,9 @@ DataPointer EVPMacCtxPointer::final(size_t length) {
                     length) != 1) {
     return {};
   }
+  if (result_len > length) return {};
 
-  return buf;
+  return buf.resize(result_len);
 }
 
 EVPMacCtxPointer EVPMacCtxPointer::New(EVP_MAC* mac) {
@@ -7009,7 +7593,10 @@ DataPointer xofHashDigest(const Buffer<const unsigned char>& buf,
   if (ctx.digestInit(md) != 1) {
     return {};
   }
-  if (ctx.digestUpdate(reinterpret_cast<const Buffer<const void>&>(buf)) != 1) {
+  if (ctx.digestUpdate(Buffer<const void>{
+          .data = buf.data,
+          .len = buf.len,
+      }) != 1) {
     return {};
   }
   return ctx.digestFinal(output_length);
@@ -7145,14 +7732,86 @@ size_t Digest::size() const {
   return EVP_MD_size(md_);
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+Digest::Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md)
+    : md_(md.get()), fetched_md_(std::move(md)) {}
+#endif
+
+Digest::Digest(const Digest& other) : md_(other.md_) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_md_ != nullptr) {
+    if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
+      fetched_md_.reset(other.fetched_md_.get());
+    } else {
+      md_ = nullptr;
+    }
+  }
+#endif
+}
+
+Digest& Digest::operator=(const Digest& other) {
+  if (this == &other) return *this;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_md_ != nullptr) {
+    if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
+      fetched_md_.reset(other.fetched_md_.get());
+    } else {
+      fetched_md_.reset();
+      md_ = nullptr;
+      return *this;
+    }
+  } else {
+    fetched_md_.reset();
+  }
+#endif
+  md_ = other.md_;
+  return *this;
+}
+
 const Digest Digest::MD5 = Digest(EVP_md5());
 const Digest Digest::SHA1 = Digest(EVP_sha1());
 const Digest Digest::SHA256 = Digest(EVP_sha256());
 const Digest Digest::SHA384 = Digest(EVP_sha384());
 const Digest Digest::SHA512 = Digest(EVP_sha512());
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+bool IsSupportedDigest(const EVP_MD* md) {
+  if (md == nullptr || EVP_MD_is_a(md, "NULL")) return false;
+
+  // OpenSSL currently crashes when ML-DSA-MU finalizes an empty input. Keep it
+  // unavailable until the provider implementation is fixed.
+  // https://github.com/openssl/openssl/issues/32445
+  if (EVP_MD_is_a(md, "ML-DSA-MU")) return false;
+
+  return true;
+}
+}  // namespace
+#endif
+
 const Digest Digest::FromName(const char* name) {
-  return ncrypto::getDigestByName(name);
+  const EVP_MD* md = ncrypto::getDigestByName(name);
+  if (md != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (md == EVP_md_null()) return Digest();
+#endif
+    return Digest(md);
+  }
+
+  return Fetch(name);
+}
+
+const Digest Digest::Fetch(const char* name) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_MD, EVP_MD_free> fetched(
+      EVP_MD_fetch(nullptr, name, nullptr));
+  if (IsSupportedDigest(fetched.get())) {
+    return Digest(std::move(fetched));
+  }
+#endif
+
+  return Digest();
 }
 
 // ============================================================================
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 58e32cc18fc7..6b1edceed061 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -13,12 +13,15 @@
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 #include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <list>
 #include <memory>
 #include <optional>
 #include <string>
 #include <string_view>
+#include <unordered_map>
+#include <vector>
 #if defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT &&                 \
     !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
@@ -363,6 +366,7 @@ class DataPointer;
 class DHPointer;
 class ECKeyPointer;
 class EVPKeyPointer;
+class MacCache;
 class EVPMacCtxPointer;
 class EVPMacPointer;
 class EVPMDCtxPointer;
@@ -397,9 +401,12 @@ class Digest final {
   static constexpr size_t MAX_SIZE = EVP_MAX_MD_SIZE;
   Digest() = default;
   Digest(const EVP_MD* md) : md_(md) {}
-  Digest(const Digest&) = default;
-  Digest& operator=(const Digest&) = default;
+  Digest(const Digest& other);
+  Digest& operator=(const Digest& other);
   inline Digest& operator=(const EVP_MD* md) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    fetched_md_.reset();
+#endif
     md_ = md;
     return *this;
   }
@@ -418,9 +425,72 @@ class Digest final {
   static const Digest SHA512;
 
   static const Digest FromName(const char* name);
+  static const Digest Fetch(const char* name);
 
  private:
   const EVP_MD* md_ = nullptr;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  explicit Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md);
+  DeleteFnPtr<EVP_MD, EVP_MD_free> fetched_md_;
+#endif
+};
+
+struct CaseInsensitiveNameHash {
+  using is_transparent = void;
+  size_t operator()(std::string_view name) const noexcept;
+};
+
+struct CaseInsensitiveNameEqual {
+  using is_transparent = void;
+  bool operator()(std::string_view lhs, std::string_view rhs) const noexcept;
+};
+
+class DigestCache final {
+ public:
+  struct Result {
+    const EVP_MD* digest = nullptr;
+    int32_t id = -1;
+  };
+
+  using AliasMap = std::unordered_map<std::string,
+                                      int32_t,
+                                      CaseInsensitiveNameHash,
+                                      CaseInsensitiveNameEqual>;
+
+  DigestCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(DigestCache)
+
+  Result lookup(const char* name, uint64_t generation) const;
+  inline Result lookup(int32_t id, uint64_t generation) const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (generation_ != generation || id == -1) return {};
+    const uint32_t unsigned_id = static_cast<uint32_t>(id);
+    if (unsigned_id < first_id_) return {};
+    const size_t index = unsigned_id - first_id_;
+    if (index >= digests_.size()) return {};
+    return {digests_[index].get(), id};
+#else
+    static_cast<void>(id);
+    static_cast<void>(generation);
+    return {};
+#endif
+  }
+  Result insert(const char* name, const EVP_MD* digest, uint64_t generation);
+  void reset(uint64_t generation);
+  const AliasMap& aliases() const;
+
+ private:
+  uint64_t generation_ = 0;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
+
+  // IDs are not reused across generations because JavaScript caches them
+  // independently in each Realm.
+  uint32_t first_id_ = 0;
+  uint32_t next_id_ = 0;
+  std::vector<EVPMDPointer> digests_;
+  AliasMap aliases_;
+#endif
 };
 
 // Computes a fixed-length digest.
@@ -431,6 +501,32 @@ DataPointer xofHashDigest(const Buffer<const unsigned char>& data,
                           const EVP_MD* md,
                           size_t length);
 
+class CipherCache final {
+ public:
+  CipherCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(CipherCache)
+
+  const EVP_CIPHER* lookup(const char* name, uint64_t generation);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const EVP_CIPHER* insert(const char* name,
+                           DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
+                           uint64_t generation);
+#endif
+
+ private:
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  using EVPCipherPointer = DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>;
+
+  uint64_t generation_ = 0;
+  std::vector<EVPCipherPointer> ciphers_;
+  std::unordered_map<std::string,
+                     size_t,
+                     CaseInsensitiveNameHash,
+                     CaseInsensitiveNameEqual>
+      aliases_;
+#endif
+};
+
 class Cipher final {
  public:
   static constexpr size_t MAX_KEY_LENGTH = EVP_MAX_KEY_LENGTH;
@@ -452,7 +548,7 @@ class Cipher final {
   Cipher(const Cipher& other);
   Cipher& operator=(const Cipher& other);
   inline Cipher& operator=(const EVP_CIPHER* cipher) {
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
     fetched_cipher_.reset();
 #endif
     cipher_ = cipher;
@@ -476,6 +572,7 @@ class Cipher final {
   bool isWrapMode() const;
   bool isCtrMode() const;
   bool isCcmMode() const;
+  bool isCtsMode() const;
   bool isOcbMode() const;
   bool isSivMode() const;
   bool isGcmSivMode() const;
@@ -489,8 +586,8 @@ class Cipher final {
                  unsigned char* key,
                  unsigned char* iv) const;
 
-  static const Cipher FromName(const char* name);
-  static const Cipher FromNid(int nid);
+  static const Cipher FromName(const char* name, CipherCache* cache = nullptr);
+  static const Cipher FromNid(int nid, CipherCache* cache = nullptr);
   static const Cipher FromCtx(const CipherCtxPointer& ctx);
 
   using CipherNameCallback = std::function<void(const char* name)>;
@@ -499,28 +596,24 @@ class Cipher final {
   // is able to do so.
   static void ForEach(CipherNameCallback callback);
 
-  // Utilities to get various ciphers by type. If the underlying
-  // implementation does not support the requested cipher, then
-  // the result will be an empty Cipher object whose bool operator
-  // will return false.
-
-  static const Cipher EMPTY;
-  static const Cipher AES_128_CBC;
-  static const Cipher AES_192_CBC;
-  static const Cipher AES_256_CBC;
-  static const Cipher AES_128_CTR;
-  static const Cipher AES_192_CTR;
-  static const Cipher AES_256_CTR;
-  static const Cipher AES_128_GCM;
-  static const Cipher AES_192_GCM;
-  static const Cipher AES_256_GCM;
-  static const Cipher AES_128_KW;
-  static const Cipher AES_192_KW;
-  static const Cipher AES_256_KW;
-  static const Cipher AES_128_OCB;
-  static const Cipher AES_192_OCB;
-  static const Cipher AES_256_OCB;
-  static const Cipher CHACHA20_POLY1305;
+  // Lazily resolves common ciphers. If the underlying implementation does not
+  // support the requested cipher, the returned Cipher will be empty.
+  static const Cipher& AES_128_CBC();
+  static const Cipher& AES_192_CBC();
+  static const Cipher& AES_256_CBC();
+  static const Cipher& AES_128_CTR();
+  static const Cipher& AES_192_CTR();
+  static const Cipher& AES_256_CTR();
+  static const Cipher& AES_128_GCM();
+  static const Cipher& AES_192_GCM();
+  static const Cipher& AES_256_GCM();
+  static const Cipher& AES_128_KW();
+  static const Cipher& AES_192_KW();
+  static const Cipher& AES_256_KW();
+  static const Cipher& AES_128_OCB();
+  static const Cipher& AES_192_OCB();
+  static const Cipher& AES_256_OCB();
+  static const Cipher& CHACHA20_POLY1305();
 
   struct CipherParams {
     int padding;
@@ -550,7 +643,7 @@ class Cipher final {
 
  private:
   const EVP_CIPHER* cipher_ = nullptr;
-#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   explicit Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
   DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
 #endif
@@ -631,6 +724,23 @@ class Rsa final {
     const BIGNUM* dq;
     const BIGNUM* qi;
   };
+  struct OtherPrimeInfo {
+    const BIGNUM* r;
+    const BIGNUM* d;
+    const BIGNUM* t;
+  };
+  struct OtherPrimeInfoPointer {
+    OtherPrimeInfoPointer() = default;
+    OtherPrimeInfoPointer(BignumPointer&& r,
+                          BignumPointer&& d,
+                          BignumPointer&& t);
+
+    DeleteFnPtr<BIGNUM, BN_clear_free> r;
+    DeleteFnPtr<BIGNUM, BN_clear_free> d;
+    DeleteFnPtr<BIGNUM, BN_clear_free> t;
+  };
+  using OtherPrimeInfos = std::vector<OtherPrimeInfo>;
+  using OtherPrimeInfoPointers = std::vector<OtherPrimeInfoPointer>;
   struct PssParams {
     std::string_view digest = "sha1";
     std::optional<std::string_view> mgf1_digest = "sha1";
@@ -639,6 +749,7 @@ class Rsa final {
 
   const PublicKey getPublicKey() const;
   const PrivateKey getPrivateKey() const;
+  const OtherPrimeInfos getOtherPrimeInfos() const;
   const std::optional<PssParams> getPssParams() const;
 
   bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
@@ -647,7 +758,8 @@ class Rsa final {
                      BignumPointer&& p,
                      BignumPointer&& dp,
                      BignumPointer&& dq,
-                     BignumPointer&& qi);
+                     BignumPointer&& qi,
+                     OtherPrimeInfoPointers&& other_prime_infos = {});
 
   using CipherParams = Cipher::CipherParams;
 
@@ -672,6 +784,7 @@ class Rsa final {
   DeleteFnPtr<BIGNUM, BN_clear_free> dp_;
   DeleteFnPtr<BIGNUM, BN_clear_free> dq_;
   DeleteFnPtr<BIGNUM, BN_clear_free> qi_;
+  OtherPrimeInfoPointers other_prime_infos_;
   std::optional<PssParams> pss_params_;
 #else
   OSSL3_CONST RSA* rsa_;
@@ -940,7 +1053,9 @@ class CipherCtxPointer final {
   bool setIvLength(size_t length);
   bool setAeadTag(const Buffer<const char>& tag);
   bool setAeadTagLength(size_t length);
+  bool setCtsMode(const char* mode);
   bool setPadding(bool padding);
+  bool setXtsStandard(const char* standard);
   bool init(const Cipher& cipher,
             bool encrypt,
             const unsigned char* key = nullptr,
@@ -953,6 +1068,8 @@ class CipherCtxPointer final {
   bool isGcmMode() const;
   bool isOcbMode() const;
   bool isCcmMode() const;
+  bool isCtsMode() const;
+  bool isXtsMode() const;
   bool isWrapMode() const;
   bool isSivMode() const;
   bool isGcmSivMode() const;
@@ -1690,7 +1807,16 @@ class EVPMDCtxPointer final {
   void reset(EVP_MD_CTX* ctx = nullptr);
   EVP_MD_CTX* release();
 
-  bool digestInit(const Digest& digest);
+  bool digestInit(const EVP_MD* digest);
+  inline bool digestInit(const Digest& digest) {
+    return digestInit(digest.get());
+  }
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+  bool digestInit(const EVP_MD* digest, const OSSL_PARAM* params);
+  inline bool digestInit(const Digest& digest, const OSSL_PARAM* params) {
+    return digestInit(digest.get(), params);
+  }
+#endif
   bool digestUpdate(const Buffer<const void>& in);
   DataPointer digestFinal(size_t length);
   bool digestFinalInto(Buffer<void>* buf);
@@ -1782,6 +1908,61 @@ class EVPMacPointer final {
   DeleteFnPtr<EVP_MAC, EVP_MAC_free> mac_;
 };
 
+enum class MacKind : uint8_t {
+  kOther,
+  kHmac,
+  kCmac,
+  kGmac,
+};
+
+class MacCache final {
+ public:
+  struct Result {
+    // Borrowed from the cache and valid until the cache is reset. Creating an
+    // EVP_MAC_CTX takes an independent reference to the method.
+    EVP_MAC* mac = nullptr;
+    int32_t id = -1;
+    MacKind kind = MacKind::kOther;
+  };
+
+  using AliasMap = std::unordered_map<std::string,
+                                      int32_t,
+                                      CaseInsensitiveNameHash,
+                                      CaseInsensitiveNameEqual>;
+
+  MacCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(MacCache)
+
+  Result lookup(const char* name, uint64_t generation) const;
+  inline Result lookup(int32_t id, uint64_t generation) const {
+    if (generation_ != generation || id == -1) return {};
+    const uint32_t unsigned_id = static_cast<uint32_t>(id);
+    if (unsigned_id < first_id_) return {};
+    const size_t index = unsigned_id - first_id_;
+    if (index >= macs_.size()) return {};
+    return {macs_[index].mac.get(), id, macs_[index].kind};
+  }
+  Result insert(const char* name, EVPMacPointer&& mac, uint64_t generation);
+  void reset(uint64_t generation);
+  const AliasMap& aliases() const;
+  static MacKind GetKind(EVP_MAC* mac);
+
+ private:
+  struct Entry {
+    EVPMacPointer mac;
+    MacKind kind;
+  };
+
+  uint64_t generation_ = 0;
+
+  // IDs are not reused across generations because JavaScript may cache them
+  // independently in each Realm.
+  uint32_t first_id_ = 0;
+  uint32_t next_id_ = 0;
+  std::vector<Entry> macs_;
+  AliasMap aliases_;
+};
+
 class EVPMacCtxPointer final {
  public:
   EVPMacCtxPointer() = default;
@@ -1800,6 +1981,8 @@ class EVPMacCtxPointer final {
 
   bool init(const Buffer<const void>& key, const OSSL_PARAM* params = nullptr);
   bool update(const Buffer<const void>& data);
+  size_t getSize() const;
+  const OSSL_PARAM* getSettableParams() const;
   DataPointer final(size_t length);
 
   static EVPMacCtxPointer New(EVP_MAC* mac);
@@ -1836,6 +2019,14 @@ class HMACCtxPointer final {
 };
 #endif  // OPENSSL_WITH_EVP_MAC
 
+#if !OPENSSL_WITH_EVP_MAC
+class MacCache final {
+ public:
+  MacCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(MacCache)
+};
+#endif
+
 #ifndef OPENSSL_NO_ENGINE
 class EnginePointer final {
  public:
@@ -1880,6 +2071,8 @@ bool isFipsEnabled();
 
 bool setFipsEnabled(bool enabled, CryptoErrorList* errors);
 
+uint64_t getFipsStateGeneration();
+
 bool testFipsEnabled();
 
 // ============================================================================
diff --git a/deps/nghttp2/unofficial.gni b/deps/nghttp2/unofficial.gni
index 4558fbbf5e5f..d37754f59124 100644
--- a/deps/nghttp2/unofficial.gni
+++ b/deps/nghttp2/unofficial.gni
@@ -4,40 +4,53 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("nghttp2_gn_build") {
-  config("nghttp2_config") {
-    include_dirs = [ "lib/includes" ]
-    if (!is_component_build) {
-      defines = [ "NGHTTP2_STATICLIB" ]
+  if (node_shared_nghttp2) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("nghttp2_config") {
+      packages = [ "libnghttp2" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":nghttp2_config" ]
+    }
+  } else {
+    config("nghttp2_config") {
+      include_dirs = [ "lib/includes" ]
+      if (!is_component_build) {
+        defines = [ "NGHTTP2_STATICLIB" ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("nghttp2.gyp") ],
-                            "scope",
-                            [ "nghttp2.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("nghttp2.gyp") ],
+                              "scope",
+                              [ "nghttp2.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    public_configs = [ ":nghttp2_config" ]
-    defines = [
-      "_U_",
-      "HAVE_CONFIG_H"
-    ]
-    if (is_component_build) {
-      defines += [ "BUILDING_NGHTTP2" ]
-    }
+      public_configs = [ ":nghttp2_config" ]
+      defines = [
+        "_U_",
+        "HAVE_CONFIG_H"
+      ]
+      if (is_component_build) {
+        defines += [ "BUILDING_NGHTTP2" ]
+      }
 
-    sources = gypi_values.nghttp2_sources
+      sources = gypi_values.nghttp2_sources
 
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        # Ref https://github.com/nghttp2/nghttp2/pull/2258
-        # This can be removed when the above PR is ingested.
-        "-Wno-extra-semi",
-      ]
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          # Ref https://github.com/nghttp2/nghttp2/pull/2258
+          # This can be removed when the above PR is ingested.
+          "-Wno-extra-semi",
+        ]
+      }
     }
   }
 }
diff --git a/deps/npm/docs/content/commands/npm-ls.md b/deps/npm/docs/content/commands/npm-ls.md
index 24746c173b7c..b38603c203fc 100644
--- a/deps/npm/docs/content/commands/npm-ls.md
+++ b/deps/npm/docs/content/commands/npm-ls.md
@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```
diff --git a/deps/npm/docs/content/commands/npm.md b/deps/npm/docs/content/commands/npm.md
index 769bb262064e..75157bd7b598 100644
--- a/deps/npm/docs/content/commands/npm.md
+++ b/deps/npm/docs/content/commands/npm.md
@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.19.0
+11.19.1
 
 ### Description
 
diff --git a/deps/npm/docs/output/commands/npm-access.html b/deps/npm/docs/output/commands/npm-access.html
index 2a044ef5ed59..ac6df64b960b 100644
--- a/deps/npm/docs/output/commands/npm-access.html
+++ b/deps/npm/docs/output/commands/npm-access.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----11190">
+<h1 id="----npm-access----11191">
     <span>npm-access</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-adduser.html b/deps/npm/docs/output/commands/npm-adduser.html
index c59e21d94298..29aec6314e96 100644
--- a/deps/npm/docs/output/commands/npm-adduser.html
+++ b/deps/npm/docs/output/commands/npm-adduser.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-adduser----11190">
+<h1 id="----npm-adduser----11191">
     <span>npm-adduser</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Add a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-approve-scripts.html b/deps/npm/docs/output/commands/npm-approve-scripts.html
index 55c9db2b2a2b..3d61cc8ea23a 100644
--- a/deps/npm/docs/output/commands/npm-approve-scripts.html
+++ b/deps/npm/docs/output/commands/npm-approve-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-approve-scripts----11190">
+<h1 id="----npm-approve-scripts----11191">
     <span>npm-approve-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Approve install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-audit.html b/deps/npm/docs/output/commands/npm-audit.html
index 438891b03cbc..9117faa9bed5 100644
--- a/deps/npm/docs/output/commands/npm-audit.html
+++ b/deps/npm/docs/output/commands/npm-audit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----11190">
+<h1 id="----npm-audit----11191">
     <span>npm-audit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-bugs.html b/deps/npm/docs/output/commands/npm-bugs.html
index eb7a91c9457f..63f4c29210a2 100644
--- a/deps/npm/docs/output/commands/npm-bugs.html
+++ b/deps/npm/docs/output/commands/npm-bugs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----11190">
+<h1 id="----npm-bugs----11191">
     <span>npm-bugs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-cache.html b/deps/npm/docs/output/commands/npm-cache.html
index 374878c8d04e..3377b00cc56c 100644
--- a/deps/npm/docs/output/commands/npm-cache.html
+++ b/deps/npm/docs/output/commands/npm-cache.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----11190">
+<h1 id="----npm-cache----11191">
     <span>npm-cache</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ci.html b/deps/npm/docs/output/commands/npm-ci.html
index 0a91d5159b12..edde5bbdef66 100644
--- a/deps/npm/docs/output/commands/npm-ci.html
+++ b/deps/npm/docs/output/commands/npm-ci.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----11190">
+<h1 id="----npm-ci----11191">
     <span>npm-ci</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-completion.html b/deps/npm/docs/output/commands/npm-completion.html
index dc927a82868a..b5a6f445d451 100644
--- a/deps/npm/docs/output/commands/npm-completion.html
+++ b/deps/npm/docs/output/commands/npm-completion.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-completion----11190">
+<h1 id="----npm-completion----11191">
     <span>npm-completion</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Tab Completion for npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-config.html b/deps/npm/docs/output/commands/npm-config.html
index 5b4e3e1204bc..c9ea9080cf78 100644
--- a/deps/npm/docs/output/commands/npm-config.html
+++ b/deps/npm/docs/output/commands/npm-config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-config----11190">
+<h1 id="----npm-config----11191">
     <span>npm-config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage the npm configuration files</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dedupe.html b/deps/npm/docs/output/commands/npm-dedupe.html
index 0f08ae285737..abe4a229e77c 100644
--- a/deps/npm/docs/output/commands/npm-dedupe.html
+++ b/deps/npm/docs/output/commands/npm-dedupe.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dedupe----11190">
+<h1 id="----npm-dedupe----11191">
     <span>npm-dedupe</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Reduce duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deny-scripts.html b/deps/npm/docs/output/commands/npm-deny-scripts.html
index 8b82b3684feb..3a56f32dc977 100644
--- a/deps/npm/docs/output/commands/npm-deny-scripts.html
+++ b/deps/npm/docs/output/commands/npm-deny-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deny-scripts----11190">
+<h1 id="----npm-deny-scripts----11191">
     <span>npm-deny-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deny install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deprecate.html b/deps/npm/docs/output/commands/npm-deprecate.html
index 489345c280bc..90f45466cad9 100644
--- a/deps/npm/docs/output/commands/npm-deprecate.html
+++ b/deps/npm/docs/output/commands/npm-deprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deprecate----11190">
+<h1 id="----npm-deprecate----11191">
     <span>npm-deprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-diff.html b/deps/npm/docs/output/commands/npm-diff.html
index 3bb3d244a198..fba245e3b33a 100644
--- a/deps/npm/docs/output/commands/npm-diff.html
+++ b/deps/npm/docs/output/commands/npm-diff.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-diff----11190">
+<h1 id="----npm-diff----11191">
     <span>npm-diff</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The registry diff command</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dist-tag.html b/deps/npm/docs/output/commands/npm-dist-tag.html
index 9f3aafdf4314..2d42ee8e3e84 100644
--- a/deps/npm/docs/output/commands/npm-dist-tag.html
+++ b/deps/npm/docs/output/commands/npm-dist-tag.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dist-tag----11190">
+<h1 id="----npm-dist-tag----11191">
     <span>npm-dist-tag</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Modify package distribution tags</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-docs.html b/deps/npm/docs/output/commands/npm-docs.html
index fbdd0ad2b626..98295c7943e0 100644
--- a/deps/npm/docs/output/commands/npm-docs.html
+++ b/deps/npm/docs/output/commands/npm-docs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-docs----11190">
+<h1 id="----npm-docs----11191">
     <span>npm-docs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open documentation for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-doctor.html b/deps/npm/docs/output/commands/npm-doctor.html
index b7dc5d2caf84..096f12bf3b80 100644
--- a/deps/npm/docs/output/commands/npm-doctor.html
+++ b/deps/npm/docs/output/commands/npm-doctor.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-doctor----11190">
+<h1 id="----npm-doctor----11191">
     <span>npm-doctor</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check the health of your npm environment</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-edit.html b/deps/npm/docs/output/commands/npm-edit.html
index 3aed53c2677a..7a555a8f39a4 100644
--- a/deps/npm/docs/output/commands/npm-edit.html
+++ b/deps/npm/docs/output/commands/npm-edit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-edit----11190">
+<h1 id="----npm-edit----11191">
     <span>npm-edit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Edit an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-exec.html b/deps/npm/docs/output/commands/npm-exec.html
index a5ea0d54c343..94e8e68c05f1 100644
--- a/deps/npm/docs/output/commands/npm-exec.html
+++ b/deps/npm/docs/output/commands/npm-exec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-exec----11190">
+<h1 id="----npm-exec----11191">
     <span>npm-exec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explain.html b/deps/npm/docs/output/commands/npm-explain.html
index bce1694bcf08..ccf68b227121 100644
--- a/deps/npm/docs/output/commands/npm-explain.html
+++ b/deps/npm/docs/output/commands/npm-explain.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explain----11190">
+<h1 id="----npm-explain----11191">
     <span>npm-explain</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Explain installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explore.html b/deps/npm/docs/output/commands/npm-explore.html
index 872892c9f1d5..7b4d6a2ed2c4 100644
--- a/deps/npm/docs/output/commands/npm-explore.html
+++ b/deps/npm/docs/output/commands/npm-explore.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explore----11190">
+<h1 id="----npm-explore----11191">
     <span>npm-explore</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Browse an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-find-dupes.html b/deps/npm/docs/output/commands/npm-find-dupes.html
index b71cbeb015db..19b5ae4ffcfa 100644
--- a/deps/npm/docs/output/commands/npm-find-dupes.html
+++ b/deps/npm/docs/output/commands/npm-find-dupes.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-find-dupes----11190">
+<h1 id="----npm-find-dupes----11191">
     <span>npm-find-dupes</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Find duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-fund.html b/deps/npm/docs/output/commands/npm-fund.html
index 9f04fd7ea66b..c657d182afd3 100644
--- a/deps/npm/docs/output/commands/npm-fund.html
+++ b/deps/npm/docs/output/commands/npm-fund.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-fund----11190">
+<h1 id="----npm-fund----11191">
     <span>npm-fund</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Retrieve funding information</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-get.html b/deps/npm/docs/output/commands/npm-get.html
index 94a56fd4a81b..59eaf5e577cb 100644
--- a/deps/npm/docs/output/commands/npm-get.html
+++ b/deps/npm/docs/output/commands/npm-get.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-get----11190">
+<h1 id="----npm-get----11191">
     <span>npm-get</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get a value from the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help-search.html b/deps/npm/docs/output/commands/npm-help-search.html
index d3666992d1e9..d4abfb29c360 100644
--- a/deps/npm/docs/output/commands/npm-help-search.html
+++ b/deps/npm/docs/output/commands/npm-help-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help-search----11190">
+<h1 id="----npm-help-search----11191">
     <span>npm-help-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search npm help documentation</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help.html b/deps/npm/docs/output/commands/npm-help.html
index e7fa1b32e601..d4fe535e8bd0 100644
--- a/deps/npm/docs/output/commands/npm-help.html
+++ b/deps/npm/docs/output/commands/npm-help.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help----11190">
+<h1 id="----npm-help----11191">
     <span>npm-help</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get help on npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-init.html b/deps/npm/docs/output/commands/npm-init.html
index 265ee78ad2cf..af686f90a7ac 100644
--- a/deps/npm/docs/output/commands/npm-init.html
+++ b/deps/npm/docs/output/commands/npm-init.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-init----11190">
+<h1 id="----npm-init----11191">
     <span>npm-init</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a package.json file</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-ci-test.html b/deps/npm/docs/output/commands/npm-install-ci-test.html
index 94d4e4a663b8..bdf779e2eef8 100644
--- a/deps/npm/docs/output/commands/npm-install-ci-test.html
+++ b/deps/npm/docs/output/commands/npm-install-ci-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-ci-test----11190">
+<h1 id="----npm-install-ci-test----11191">
     <span>npm-install-ci-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a project with a clean slate and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-scripts.html b/deps/npm/docs/output/commands/npm-install-scripts.html
index d78f5efc1653..8174e90a5094 100644
--- a/deps/npm/docs/output/commands/npm-install-scripts.html
+++ b/deps/npm/docs/output/commands/npm-install-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-scripts----11190">
+<h1 id="----npm-install-scripts----11191">
     <span>npm-install-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage install-script approvals for dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-test.html b/deps/npm/docs/output/commands/npm-install-test.html
index c55b06547a9d..e75fb52d3239 100644
--- a/deps/npm/docs/output/commands/npm-install-test.html
+++ b/deps/npm/docs/output/commands/npm-install-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-test----11190">
+<h1 id="----npm-install-test----11191">
     <span>npm-install-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install package(s) and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install.html b/deps/npm/docs/output/commands/npm-install.html
index 80af90cc3db9..ed78f6576bb7 100644
--- a/deps/npm/docs/output/commands/npm-install.html
+++ b/deps/npm/docs/output/commands/npm-install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install----11190">
+<h1 id="----npm-install----11191">
     <span>npm-install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-link.html b/deps/npm/docs/output/commands/npm-link.html
index 3a5795b866f5..aa01ff7a259a 100644
--- a/deps/npm/docs/output/commands/npm-link.html
+++ b/deps/npm/docs/output/commands/npm-link.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-link----11190">
+<h1 id="----npm-link----11191">
     <span>npm-link</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Symlink a package folder</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ll.html b/deps/npm/docs/output/commands/npm-ll.html
index 601f99e91029..f8df2515bfa4 100644
--- a/deps/npm/docs/output/commands/npm-ll.html
+++ b/deps/npm/docs/output/commands/npm-ll.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ll----11190">
+<h1 id="----npm-ll----11191">
     <span>npm-ll</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-login.html b/deps/npm/docs/output/commands/npm-login.html
index 33d44e488838..1c6d938ec6c1 100644
--- a/deps/npm/docs/output/commands/npm-login.html
+++ b/deps/npm/docs/output/commands/npm-login.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-login----11190">
+<h1 id="----npm-login----11191">
     <span>npm-login</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Login to a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-logout.html b/deps/npm/docs/output/commands/npm-logout.html
index 0be803c18ae7..cf319a086f89 100644
--- a/deps/npm/docs/output/commands/npm-logout.html
+++ b/deps/npm/docs/output/commands/npm-logout.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-logout----11190">
+<h1 id="----npm-logout----11191">
     <span>npm-logout</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Log out of the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ls.html b/deps/npm/docs/output/commands/npm-ls.html
index bda454a04c77..b733762be373 100644
--- a/deps/npm/docs/output/commands/npm-ls.html
+++ b/deps/npm/docs/output/commands/npm-ls.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ls----11190">
+<h1 id="----npm-ls----11191">
     <span>npm-ls</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
@@ -209,7 +209,7 @@ <h3 id="description">Description</h3>
 <p>Positional arguments are <code>name@version-range</code> identifiers, which will limit the results to only the paths to the packages named.
 Note that nested packages will <em>also</em> show the paths to the specified packages.
 For example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@11.19.0 /path/to/npm
+<pre><code class="language-bash">npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
diff --git a/deps/npm/docs/output/commands/npm-org.html b/deps/npm/docs/output/commands/npm-org.html
index 32df155d69ce..6a2c22951a60 100644
--- a/deps/npm/docs/output/commands/npm-org.html
+++ b/deps/npm/docs/output/commands/npm-org.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-org----11190">
+<h1 id="----npm-org----11191">
     <span>npm-org</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage orgs</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-outdated.html b/deps/npm/docs/output/commands/npm-outdated.html
index 5355d7dd09aa..b85880371cdf 100644
--- a/deps/npm/docs/output/commands/npm-outdated.html
+++ b/deps/npm/docs/output/commands/npm-outdated.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-outdated----11190">
+<h1 id="----npm-outdated----11191">
     <span>npm-outdated</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check for outdated packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-owner.html b/deps/npm/docs/output/commands/npm-owner.html
index 7dc17627f50a..6b8afff7ba36 100644
--- a/deps/npm/docs/output/commands/npm-owner.html
+++ b/deps/npm/docs/output/commands/npm-owner.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-owner----11190">
+<h1 id="----npm-owner----11191">
     <span>npm-owner</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage package owners</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pack.html b/deps/npm/docs/output/commands/npm-pack.html
index 3f92c3ff7579..d7f148d92ed7 100644
--- a/deps/npm/docs/output/commands/npm-pack.html
+++ b/deps/npm/docs/output/commands/npm-pack.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pack----11190">
+<h1 id="----npm-pack----11191">
     <span>npm-pack</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a tarball from a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ping.html b/deps/npm/docs/output/commands/npm-ping.html
index 84d634064212..3c49a0713166 100644
--- a/deps/npm/docs/output/commands/npm-ping.html
+++ b/deps/npm/docs/output/commands/npm-ping.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ping----11190">
+<h1 id="----npm-ping----11191">
     <span>npm-ping</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Ping npm registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pkg.html b/deps/npm/docs/output/commands/npm-pkg.html
index cf995cca7679..d80ac21f9af3 100644
--- a/deps/npm/docs/output/commands/npm-pkg.html
+++ b/deps/npm/docs/output/commands/npm-pkg.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pkg----11190">
+<h1 id="----npm-pkg----11191">
     <span>npm-pkg</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manages your package.json</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prefix.html b/deps/npm/docs/output/commands/npm-prefix.html
index 0336ac659020..1592a1d3048d 100644
--- a/deps/npm/docs/output/commands/npm-prefix.html
+++ b/deps/npm/docs/output/commands/npm-prefix.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prefix----11190">
+<h1 id="----npm-prefix----11191">
     <span>npm-prefix</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display prefix</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-profile.html b/deps/npm/docs/output/commands/npm-profile.html
index 8c0d0a337c8c..24f5db6d7f37 100644
--- a/deps/npm/docs/output/commands/npm-profile.html
+++ b/deps/npm/docs/output/commands/npm-profile.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-profile----11190">
+<h1 id="----npm-profile----11191">
     <span>npm-profile</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Change settings on your registry profile</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prune.html b/deps/npm/docs/output/commands/npm-prune.html
index d340e0fd84a6..736620c0a24a 100644
--- a/deps/npm/docs/output/commands/npm-prune.html
+++ b/deps/npm/docs/output/commands/npm-prune.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prune----11190">
+<h1 id="----npm-prune----11191">
     <span>npm-prune</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove extraneous packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-publish.html b/deps/npm/docs/output/commands/npm-publish.html
index d1ee0efa5d16..a20d56b8d10e 100644
--- a/deps/npm/docs/output/commands/npm-publish.html
+++ b/deps/npm/docs/output/commands/npm-publish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-publish----11190">
+<h1 id="----npm-publish----11191">
     <span>npm-publish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Publish a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-query.html b/deps/npm/docs/output/commands/npm-query.html
index a8347390a34a..a74342cf2782 100644
--- a/deps/npm/docs/output/commands/npm-query.html
+++ b/deps/npm/docs/output/commands/npm-query.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-query----11190">
+<h1 id="----npm-query----11191">
     <span>npm-query</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency selector query</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-rebuild.html b/deps/npm/docs/output/commands/npm-rebuild.html
index 8c2277d8a914..39403a70941d 100644
--- a/deps/npm/docs/output/commands/npm-rebuild.html
+++ b/deps/npm/docs/output/commands/npm-rebuild.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-rebuild----11190">
+<h1 id="----npm-rebuild----11191">
     <span>npm-rebuild</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Rebuild a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-repo.html b/deps/npm/docs/output/commands/npm-repo.html
index b60cd8bc1ddd..5337679c8248 100644
--- a/deps/npm/docs/output/commands/npm-repo.html
+++ b/deps/npm/docs/output/commands/npm-repo.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-repo----11190">
+<h1 id="----npm-repo----11191">
     <span>npm-repo</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open package repository page in the browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-restart.html b/deps/npm/docs/output/commands/npm-restart.html
index 960530ad2975..0786bdc34a54 100644
--- a/deps/npm/docs/output/commands/npm-restart.html
+++ b/deps/npm/docs/output/commands/npm-restart.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-restart----11190">
+<h1 id="----npm-restart----11191">
     <span>npm-restart</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Restart a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-root.html b/deps/npm/docs/output/commands/npm-root.html
index b5ad8c5c1389..165223c6fdb6 100644
--- a/deps/npm/docs/output/commands/npm-root.html
+++ b/deps/npm/docs/output/commands/npm-root.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-root----11190">
+<h1 id="----npm-root----11191">
     <span>npm-root</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm root</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-run.html b/deps/npm/docs/output/commands/npm-run.html
index 985df67fddef..15ca998eb8a8 100644
--- a/deps/npm/docs/output/commands/npm-run.html
+++ b/deps/npm/docs/output/commands/npm-run.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-run----11190">
+<h1 id="----npm-run----11191">
     <span>npm-run</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run arbitrary package scripts</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-sbom.html b/deps/npm/docs/output/commands/npm-sbom.html
index db72c21adc4f..fe84c36327a6 100644
--- a/deps/npm/docs/output/commands/npm-sbom.html
+++ b/deps/npm/docs/output/commands/npm-sbom.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-sbom----11190">
+<h1 id="----npm-sbom----11191">
     <span>npm-sbom</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Generate a Software Bill of Materials (SBOM)</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-search.html b/deps/npm/docs/output/commands/npm-search.html
index f4764833e25a..98006e7d2253 100644
--- a/deps/npm/docs/output/commands/npm-search.html
+++ b/deps/npm/docs/output/commands/npm-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-search----11190">
+<h1 id="----npm-search----11191">
     <span>npm-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search for packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-set.html b/deps/npm/docs/output/commands/npm-set.html
index d0fe94ba7e98..6202cdf7b3cd 100644
--- a/deps/npm/docs/output/commands/npm-set.html
+++ b/deps/npm/docs/output/commands/npm-set.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-set----11190">
+<h1 id="----npm-set----11191">
     <span>npm-set</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set a value in the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-shrinkwrap.html b/deps/npm/docs/output/commands/npm-shrinkwrap.html
index 85fb2b99986f..abb9c216e6da 100644
--- a/deps/npm/docs/output/commands/npm-shrinkwrap.html
+++ b/deps/npm/docs/output/commands/npm-shrinkwrap.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrap----11190">
+<h1 id="----npm-shrinkwrap----11191">
     <span>npm-shrinkwrap</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Lock down dependency versions for publication</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stage.html b/deps/npm/docs/output/commands/npm-stage.html
index 225d4970fad3..74c4f7acddf0 100644
--- a/deps/npm/docs/output/commands/npm-stage.html
+++ b/deps/npm/docs/output/commands/npm-stage.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stage----11190">
+<h1 id="----npm-stage----11191">
     <span>npm-stage</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stage packages for publishing</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-star.html b/deps/npm/docs/output/commands/npm-star.html
index 5521c413462c..4ba2f61b1797 100644
--- a/deps/npm/docs/output/commands/npm-star.html
+++ b/deps/npm/docs/output/commands/npm-star.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-star----11190">
+<h1 id="----npm-star----11191">
     <span>npm-star</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Mark your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stars.html b/deps/npm/docs/output/commands/npm-stars.html
index 9f497020875d..a1c7c0a4fd9d 100644
--- a/deps/npm/docs/output/commands/npm-stars.html
+++ b/deps/npm/docs/output/commands/npm-stars.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stars----11190">
+<h1 id="----npm-stars----11191">
     <span>npm-stars</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View packages marked as favorites</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-start.html b/deps/npm/docs/output/commands/npm-start.html
index 4a6ec9e7e2c8..063ac6b3d809 100644
--- a/deps/npm/docs/output/commands/npm-start.html
+++ b/deps/npm/docs/output/commands/npm-start.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-start----11190">
+<h1 id="----npm-start----11191">
     <span>npm-start</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Start a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stop.html b/deps/npm/docs/output/commands/npm-stop.html
index 243f702c961e..b4e84d2488de 100644
--- a/deps/npm/docs/output/commands/npm-stop.html
+++ b/deps/npm/docs/output/commands/npm-stop.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stop----11190">
+<h1 id="----npm-stop----11191">
     <span>npm-stop</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stop a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-team.html b/deps/npm/docs/output/commands/npm-team.html
index 0baf06db4b1a..c9a7504b91fa 100644
--- a/deps/npm/docs/output/commands/npm-team.html
+++ b/deps/npm/docs/output/commands/npm-team.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-team----11190">
+<h1 id="----npm-team----11191">
     <span>npm-team</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage organization teams and team memberships</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-test.html b/deps/npm/docs/output/commands/npm-test.html
index 2d46aafd0b14..bbb30678ba8c 100644
--- a/deps/npm/docs/output/commands/npm-test.html
+++ b/deps/npm/docs/output/commands/npm-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-test----11190">
+<h1 id="----npm-test----11191">
     <span>npm-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Test a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-token.html b/deps/npm/docs/output/commands/npm-token.html
index 58a528ce2180..680c2aa534f8 100644
--- a/deps/npm/docs/output/commands/npm-token.html
+++ b/deps/npm/docs/output/commands/npm-token.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-token----11190">
+<h1 id="----npm-token----11191">
     <span>npm-token</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage your authentication tokens</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-trust.html b/deps/npm/docs/output/commands/npm-trust.html
index 429e22957b18..6d531484035c 100644
--- a/deps/npm/docs/output/commands/npm-trust.html
+++ b/deps/npm/docs/output/commands/npm-trust.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-trust----11190">
+<h1 id="----npm-trust----11191">
     <span>npm-trust</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage trusted publishing relationships between packages and CI/CD providers</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-undeprecate.html b/deps/npm/docs/output/commands/npm-undeprecate.html
index 67b6d048c079..d5239ca0cac0 100644
--- a/deps/npm/docs/output/commands/npm-undeprecate.html
+++ b/deps/npm/docs/output/commands/npm-undeprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-undeprecate----11190">
+<h1 id="----npm-undeprecate----11191">
     <span>npm-undeprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Undeprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-uninstall.html b/deps/npm/docs/output/commands/npm-uninstall.html
index 8197d3646c62..26991d034bd4 100644
--- a/deps/npm/docs/output/commands/npm-uninstall.html
+++ b/deps/npm/docs/output/commands/npm-uninstall.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-uninstall----11190">
+<h1 id="----npm-uninstall----11191">
     <span>npm-uninstall</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unpublish.html b/deps/npm/docs/output/commands/npm-unpublish.html
index 21b698cad72e..4fda332a9615 100644
--- a/deps/npm/docs/output/commands/npm-unpublish.html
+++ b/deps/npm/docs/output/commands/npm-unpublish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unpublish----11190">
+<h1 id="----npm-unpublish----11191">
     <span>npm-unpublish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package from the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unstar.html b/deps/npm/docs/output/commands/npm-unstar.html
index 2564643c7435..25db54715ddb 100644
--- a/deps/npm/docs/output/commands/npm-unstar.html
+++ b/deps/npm/docs/output/commands/npm-unstar.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unstar----11190">
+<h1 id="----npm-unstar----11191">
     <span>npm-unstar</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove an item from your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-update.html b/deps/npm/docs/output/commands/npm-update.html
index c89bc400aa3c..fff2f70073cd 100644
--- a/deps/npm/docs/output/commands/npm-update.html
+++ b/deps/npm/docs/output/commands/npm-update.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-update----11190">
+<h1 id="----npm-update----11191">
     <span>npm-update</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Update packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-version.html b/deps/npm/docs/output/commands/npm-version.html
index 2cb36d263256..310abe5db903 100644
--- a/deps/npm/docs/output/commands/npm-version.html
+++ b/deps/npm/docs/output/commands/npm-version.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-version----11190">
+<h1 id="----npm-version----11191">
     <span>npm-version</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Bump a package version</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-view.html b/deps/npm/docs/output/commands/npm-view.html
index 2356b4e79166..18f28fe17077 100644
--- a/deps/npm/docs/output/commands/npm-view.html
+++ b/deps/npm/docs/output/commands/npm-view.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-view----11190">
+<h1 id="----npm-view----11191">
     <span>npm-view</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View registry info</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-whoami.html b/deps/npm/docs/output/commands/npm-whoami.html
index bd768a237695..91a7d6e2288d 100644
--- a/deps/npm/docs/output/commands/npm-whoami.html
+++ b/deps/npm/docs/output/commands/npm-whoami.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-whoami----11190">
+<h1 id="----npm-whoami----11191">
     <span>npm-whoami</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm username</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm.html b/deps/npm/docs/output/commands/npm.html
index cc749dc6e59a..99674e1362df 100644
--- a/deps/npm/docs/output/commands/npm.html
+++ b/deps/npm/docs/output/commands/npm.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm----11190">
+<h1 id="----npm----11191">
     <span>npm</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">javascript package manager</span>
 </header>
@@ -203,7 +203,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>11.19.0</p>
+<p>11.19.1</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.
 It puts modules in place so that node can find them, and manages dependency conflicts intelligently.</p>
diff --git a/deps/npm/docs/output/commands/npx.html b/deps/npm/docs/output/commands/npx.html
index 8abb0349d715..d3cb1e00cc5b 100644
--- a/deps/npm/docs/output/commands/npx.html
+++ b/deps/npm/docs/output/commands/npx.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npx----11190">
+<h1 id="----npx----11191">
     <span>npx</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/folders.html b/deps/npm/docs/output/configuring-npm/folders.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/folders.html
+++ b/deps/npm/docs/output/configuring-npm/folders.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/install.html b/deps/npm/docs/output/configuring-npm/install.html
index d607ef84697b..610fc057a134 100644
--- a/deps/npm/docs/output/configuring-npm/install.html
+++ b/deps/npm/docs/output/configuring-npm/install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----install----11190">
+<h1 id="----install----11191">
     <span>Install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Download and install node and npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-global.html b/deps/npm/docs/output/configuring-npm/npm-global.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/npm-global.html
+++ b/deps/npm/docs/output/configuring-npm/npm-global.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-json.html b/deps/npm/docs/output/configuring-npm/npm-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/npm-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
index f26ba837f409..134524b16af6 100644
--- a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrapjson----11190">
+<h1 id="----npm-shrinkwrapjson----11191">
     <span>npm-shrinkwrap.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A publishable lockfile</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npmrc.html b/deps/npm/docs/output/configuring-npm/npmrc.html
index 6e88197b3fbf..a5eb291b57ca 100644
--- a/deps/npm/docs/output/configuring-npm/npmrc.html
+++ b/deps/npm/docs/output/configuring-npm/npmrc.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npmrc----11190">
+<h1 id="----npmrc----11191">
     <span>.npmrc</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The npm config files</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-json.html b/deps/npm/docs/output/configuring-npm/package-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/package-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-lock-json.html b/deps/npm/docs/output/configuring-npm/package-lock-json.html
index 68476b2f14e4..9a4f1631b337 100644
--- a/deps/npm/docs/output/configuring-npm/package-lock-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-lock-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-lockjson----11190">
+<h1 id="----package-lockjson----11191">
     <span>package-lock.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A manifestation of the manifest</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/config.html b/deps/npm/docs/output/using-npm/config.html
index 9d288a3a2e86..ac5829fba75d 100644
--- a/deps/npm/docs/output/using-npm/config.html
+++ b/deps/npm/docs/output/using-npm/config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----config----11190">
+<h1 id="----config----11191">
     <span>Config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">About npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/dependency-selectors.html b/deps/npm/docs/output/using-npm/dependency-selectors.html
index 80acfdd6ea80..c56b5e6c4027 100644
--- a/deps/npm/docs/output/using-npm/dependency-selectors.html
+++ b/deps/npm/docs/output/using-npm/dependency-selectors.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----dependency-selectors----11190">
+<h1 id="----dependency-selectors----11191">
     <span>Dependency Selectors</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency Selector Syntax &amp; Querying</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/developers.html b/deps/npm/docs/output/using-npm/developers.html
index 5457f4a7943b..984f28bfe7b2 100644
--- a/deps/npm/docs/output/using-npm/developers.html
+++ b/deps/npm/docs/output/using-npm/developers.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----developers----11190">
+<h1 id="----developers----11191">
     <span>Developers</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Developer guide</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/logging.html b/deps/npm/docs/output/using-npm/logging.html
index 62b819e82646..f6f6dd742f12 100644
--- a/deps/npm/docs/output/using-npm/logging.html
+++ b/deps/npm/docs/output/using-npm/logging.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----logging----11190">
+<h1 id="----logging----11191">
     <span>Logging</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Why, What &amp; How we Log</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/orgs.html b/deps/npm/docs/output/using-npm/orgs.html
index 39559c361b78..f579fcbbac1f 100644
--- a/deps/npm/docs/output/using-npm/orgs.html
+++ b/deps/npm/docs/output/using-npm/orgs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----organizations----11190">
+<h1 id="----organizations----11191">
     <span>Organizations</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with teams &amp; organizations</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/package-spec.html b/deps/npm/docs/output/using-npm/package-spec.html
index 82b8d1d9ad2e..620f470d109b 100644
--- a/deps/npm/docs/output/using-npm/package-spec.html
+++ b/deps/npm/docs/output/using-npm/package-spec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-spec----11190">
+<h1 id="----package-spec----11191">
     <span>Package spec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Package name specifier</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/registry.html b/deps/npm/docs/output/using-npm/registry.html
index b3d34df82033..e61715c22e4b 100644
--- a/deps/npm/docs/output/using-npm/registry.html
+++ b/deps/npm/docs/output/using-npm/registry.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----registry----11190">
+<h1 id="----registry----11191">
     <span>Registry</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The JavaScript Package Registry</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/removal.html b/deps/npm/docs/output/using-npm/removal.html
index b85ee02590cc..07ee6c06bc40 100644
--- a/deps/npm/docs/output/using-npm/removal.html
+++ b/deps/npm/docs/output/using-npm/removal.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----removal----11190">
+<h1 id="----removal----11191">
     <span>Removal</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Cleaning the slate</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scope.html b/deps/npm/docs/output/using-npm/scope.html
index f2e733bc9ebf..a08571ebfda3 100644
--- a/deps/npm/docs/output/using-npm/scope.html
+++ b/deps/npm/docs/output/using-npm/scope.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scope----11190">
+<h1 id="----scope----11191">
     <span>Scope</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Scoped packages</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scripts.html b/deps/npm/docs/output/using-npm/scripts.html
index c2a9641f62d2..4e852304a114 100644
--- a/deps/npm/docs/output/using-npm/scripts.html
+++ b/deps/npm/docs/output/using-npm/scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scripts----11190">
+<h1 id="----scripts----11191">
     <span>Scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">How npm handles the "scripts" field</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/workspaces.html b/deps/npm/docs/output/using-npm/workspaces.html
index 3a9986755339..ec3d3abed055 100644
--- a/deps/npm/docs/output/using-npm/workspaces.html
+++ b/deps/npm/docs/output/using-npm/workspaces.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----workspaces----11190">
+<h1 id="----workspaces----11191">
     <span>Workspaces</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with workspaces</span>
 </header>
diff --git a/deps/npm/lib/commands/pack.js b/deps/npm/lib/commands/pack.js
index be4a1b240bea..9c4b59657f4a 100644
--- a/deps/npm/lib/commands/pack.js
+++ b/deps/npm/lib/commands/pack.js
@@ -45,6 +45,7 @@ class Pack extends BaseCommand {
       ) ? { ...this.npm.flatOptions, before: null } : this.npm.flatOptions
       const manifest = await pacote.manifest(spec, {
         ...options,
+        ...(spec.type === 'directory' && { allowDirectory: 'all' }),
         Arborist,
         preferOnline: true,
         _isRoot: true,
diff --git a/deps/npm/man/man1/npm-access.1 b/deps/npm/man/man1/npm-access.1
index 3b7d77d8962f..435819623db2 100644
--- a/deps/npm/man/man1/npm-access.1
+++ b/deps/npm/man/man1/npm-access.1
@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ACCESS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-access\fR - Set access level on published packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-adduser.1 b/deps/npm/man/man1/npm-adduser.1
index 53ed267a0aa4..5cc628784241 100644
--- a/deps/npm/man/man1/npm-adduser.1
+++ b/deps/npm/man/man1/npm-adduser.1
@@ -1,4 +1,4 @@
-.TH "NPM-ADDUSER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ADDUSER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-adduser\fR - Add a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-approve-scripts.1 b/deps/npm/man/man1/npm-approve-scripts.1
index 943459b20562..f874e752ab97 100644
--- a/deps/npm/man/man1/npm-approve-scripts.1
+++ b/deps/npm/man/man1/npm-approve-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-APPROVE-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-APPROVE-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-approve-scripts\fR - Approve install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-audit.1 b/deps/npm/man/man1/npm-audit.1
index 77fbcbe595ef..8c9815292aee 100644
--- a/deps/npm/man/man1/npm-audit.1
+++ b/deps/npm/man/man1/npm-audit.1
@@ -1,4 +1,4 @@
-.TH "NPM-AUDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-AUDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-audit\fR - Run a security audit
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-bugs.1 b/deps/npm/man/man1/npm-bugs.1
index 05a37e504c7e..0113cf310fdb 100644
--- a/deps/npm/man/man1/npm-bugs.1
+++ b/deps/npm/man/man1/npm-bugs.1
@@ -1,4 +1,4 @@
-.TH "NPM-BUGS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-BUGS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-bugs\fR - Report bugs for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-cache.1 b/deps/npm/man/man1/npm-cache.1
index fd725dd57fe2..71eaeccf613d 100644
--- a/deps/npm/man/man1/npm-cache.1
+++ b/deps/npm/man/man1/npm-cache.1
@@ -1,4 +1,4 @@
-.TH "NPM-CACHE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CACHE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-cache\fR - Manipulates packages cache
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ci.1 b/deps/npm/man/man1/npm-ci.1
index bbae51d8e983..2e544d6dfa80 100644
--- a/deps/npm/man/man1/npm-ci.1
+++ b/deps/npm/man/man1/npm-ci.1
@@ -1,4 +1,4 @@
-.TH "NPM-CI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ci\fR - Clean install a project
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-completion.1 b/deps/npm/man/man1/npm-completion.1
index d01c54ab63af..d5cefe61d0c7 100644
--- a/deps/npm/man/man1/npm-completion.1
+++ b/deps/npm/man/man1/npm-completion.1
@@ -1,4 +1,4 @@
-.TH "NPM-COMPLETION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-COMPLETION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-completion\fR - Tab Completion for npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-config.1 b/deps/npm/man/man1/npm-config.1
index 34b79e9d1c57..b0ef989fe726 100644
--- a/deps/npm/man/man1/npm-config.1
+++ b/deps/npm/man/man1/npm-config.1
@@ -1,4 +1,4 @@
-.TH "NPM-CONFIG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CONFIG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-config\fR - Manage the npm configuration files
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dedupe.1 b/deps/npm/man/man1/npm-dedupe.1
index 0b11deb4d467..1fa8e34027fb 100644
--- a/deps/npm/man/man1/npm-dedupe.1
+++ b/deps/npm/man/man1/npm-dedupe.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEDUPE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEDUPE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dedupe\fR - Reduce duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deny-scripts.1 b/deps/npm/man/man1/npm-deny-scripts.1
index d8a41f57479e..70fb96d6fcd2 100644
--- a/deps/npm/man/man1/npm-deny-scripts.1
+++ b/deps/npm/man/man1/npm-deny-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-DENY-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DENY-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deny-scripts\fR - Deny install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deprecate.1 b/deps/npm/man/man1/npm-deprecate.1
index c45dd75584ec..e07bd5829ef7 100644
--- a/deps/npm/man/man1/npm-deprecate.1
+++ b/deps/npm/man/man1/npm-deprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deprecate\fR - Deprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-diff.1 b/deps/npm/man/man1/npm-diff.1
index 45efb60c236c..42c3903bd468 100644
--- a/deps/npm/man/man1/npm-diff.1
+++ b/deps/npm/man/man1/npm-diff.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIFF" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIFF" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-diff\fR - The registry diff command
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dist-tag.1 b/deps/npm/man/man1/npm-dist-tag.1
index 989a2c64d307..8ebc625273cc 100644
--- a/deps/npm/man/man1/npm-dist-tag.1
+++ b/deps/npm/man/man1/npm-dist-tag.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIST-TAG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIST-TAG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR - Modify package distribution tags
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-docs.1 b/deps/npm/man/man1/npm-docs.1
index ee614b710885..26fa80d54d5d 100644
--- a/deps/npm/man/man1/npm-docs.1
+++ b/deps/npm/man/man1/npm-docs.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-docs\fR - Open documentation for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-doctor.1 b/deps/npm/man/man1/npm-doctor.1
index 5344645b17ed..f5b750fd6a3b 100644
--- a/deps/npm/man/man1/npm-doctor.1
+++ b/deps/npm/man/man1/npm-doctor.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCTOR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCTOR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-doctor\fR - Check the health of your npm environment
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-edit.1 b/deps/npm/man/man1/npm-edit.1
index bca15e054f60..5055e6feaa5d 100644
--- a/deps/npm/man/man1/npm-edit.1
+++ b/deps/npm/man/man1/npm-edit.1
@@ -1,4 +1,4 @@
-.TH "NPM-EDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-edit\fR - Edit an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-exec.1 b/deps/npm/man/man1/npm-exec.1
index 4b580f484bc1..5ae0a77e2880 100644
--- a/deps/npm/man/man1/npm-exec.1
+++ b/deps/npm/man/man1/npm-exec.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXEC" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXEC" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-exec\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explain.1 b/deps/npm/man/man1/npm-explain.1
index 20374a8fbb37..7869082b6c6f 100644
--- a/deps/npm/man/man1/npm-explain.1
+++ b/deps/npm/man/man1/npm-explain.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLAIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLAIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explain\fR - Explain installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explore.1 b/deps/npm/man/man1/npm-explore.1
index bee110155bd5..df1fd2dc6517 100644
--- a/deps/npm/man/man1/npm-explore.1
+++ b/deps/npm/man/man1/npm-explore.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLORE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLORE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explore\fR - Browse an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-find-dupes.1 b/deps/npm/man/man1/npm-find-dupes.1
index a1cfc3abd0d2..f1f3970dd1d7 100644
--- a/deps/npm/man/man1/npm-find-dupes.1
+++ b/deps/npm/man/man1/npm-find-dupes.1
@@ -1,4 +1,4 @@
-.TH "NPM-FIND-DUPES" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FIND-DUPES" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-find-dupes\fR - Find duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-fund.1 b/deps/npm/man/man1/npm-fund.1
index ec516b28396d..88bfe299c31f 100644
--- a/deps/npm/man/man1/npm-fund.1
+++ b/deps/npm/man/man1/npm-fund.1
@@ -1,4 +1,4 @@
-.TH "NPM-FUND" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FUND" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-fund\fR - Retrieve funding information
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-get.1 b/deps/npm/man/man1/npm-get.1
index d4763eb28c8c..7982d28e324a 100644
--- a/deps/npm/man/man1/npm-get.1
+++ b/deps/npm/man/man1/npm-get.1
@@ -1,4 +1,4 @@
-.TH "NPM-GET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-GET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-get\fR - Get a value from the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help-search.1 b/deps/npm/man/man1/npm-help-search.1
index 63213fa4188a..e7c7d97ebcea 100644
--- a/deps/npm/man/man1/npm-help-search.1
+++ b/deps/npm/man/man1/npm-help-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help-search\fR - Search npm help documentation
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help.1 b/deps/npm/man/man1/npm-help.1
index 59f2f1df9436..7725a82d09c1 100644
--- a/deps/npm/man/man1/npm-help.1
+++ b/deps/npm/man/man1/npm-help.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help\fR - Get help on npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-init.1 b/deps/npm/man/man1/npm-init.1
index cf4c37761d14..bd984db7d203 100644
--- a/deps/npm/man/man1/npm-init.1
+++ b/deps/npm/man/man1/npm-init.1
@@ -1,4 +1,4 @@
-.TH "NPM-INIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-init\fR - Create a package.json file
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-ci-test.1 b/deps/npm/man/man1/npm-install-ci-test.1
index e30140015a1c..b477b4a8b0eb 100644
--- a/deps/npm/man/man1/npm-install-ci-test.1
+++ b/deps/npm/man/man1/npm-install-ci-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-CI-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-CI-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-ci-test\fR - Install a project with a clean slate and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-scripts.1 b/deps/npm/man/man1/npm-install-scripts.1
index 907b48c50ff5..b634903e3ecc 100644
--- a/deps/npm/man/man1/npm-install-scripts.1
+++ b/deps/npm/man/man1/npm-install-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-scripts\fR - Manage install-script approvals for dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-test.1 b/deps/npm/man/man1/npm-install-test.1
index 88e0ed187377..d6774940ea2f 100644
--- a/deps/npm/man/man1/npm-install-test.1
+++ b/deps/npm/man/man1/npm-install-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-test\fR - Install package(s) and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index b1ccd245238d..c6ca10ab642c 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install\fR - Install a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
index d124bcf66a33..ea482b872b86 100644
--- a/deps/npm/man/man1/npm-link.1
+++ b/deps/npm/man/man1/npm-link.1
@@ -1,4 +1,4 @@
-.TH "NPM-LINK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LINK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-link\fR - Symlink a package folder
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ll.1 b/deps/npm/man/man1/npm-ll.1
index 982d8ee3a6c7..136777491e0f 100644
--- a/deps/npm/man/man1/npm-ll.1
+++ b/deps/npm/man/man1/npm-ll.1
@@ -1,4 +1,4 @@
-.TH "NPM-LL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ll\fR - List installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-login.1 b/deps/npm/man/man1/npm-login.1
index 392c5b25d84d..ecc47d745dee 100644
--- a/deps/npm/man/man1/npm-login.1
+++ b/deps/npm/man/man1/npm-login.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-login\fR - Login to a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-logout.1 b/deps/npm/man/man1/npm-logout.1
index 7ca6be27366c..22d86e96586e 100644
--- a/deps/npm/man/man1/npm-logout.1
+++ b/deps/npm/man/man1/npm-logout.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGOUT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGOUT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-logout\fR - Log out of the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index 6fe6245988fe..52224d908c20 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -1,4 +1,4 @@
-.TH "NPM-LS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ls\fR - List installed packages
 .SS "Synopsis"
@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
 .P
 .RS 2
 .nf
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 .fi
diff --git a/deps/npm/man/man1/npm-org.1 b/deps/npm/man/man1/npm-org.1
index 50e94a589d49..4b7592722da4 100644
--- a/deps/npm/man/man1/npm-org.1
+++ b/deps/npm/man/man1/npm-org.1
@@ -1,4 +1,4 @@
-.TH "NPM-ORG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ORG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-org\fR - Manage orgs
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-outdated.1 b/deps/npm/man/man1/npm-outdated.1
index a2ecbcc50b5c..f83acac0d642 100644
--- a/deps/npm/man/man1/npm-outdated.1
+++ b/deps/npm/man/man1/npm-outdated.1
@@ -1,4 +1,4 @@
-.TH "NPM-OUTDATED" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OUTDATED" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-outdated\fR - Check for outdated packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-owner.1 b/deps/npm/man/man1/npm-owner.1
index 3815d60d8b2b..68a98e734ef5 100644
--- a/deps/npm/man/man1/npm-owner.1
+++ b/deps/npm/man/man1/npm-owner.1
@@ -1,4 +1,4 @@
-.TH "NPM-OWNER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OWNER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-owner\fR - Manage package owners
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pack.1 b/deps/npm/man/man1/npm-pack.1
index f5f159779bdc..58b82df26634 100644
--- a/deps/npm/man/man1/npm-pack.1
+++ b/deps/npm/man/man1/npm-pack.1
@@ -1,4 +1,4 @@
-.TH "NPM-PACK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PACK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pack\fR - Create a tarball from a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ping.1 b/deps/npm/man/man1/npm-ping.1
index e44d02e67e88..4df93fbd993a 100644
--- a/deps/npm/man/man1/npm-ping.1
+++ b/deps/npm/man/man1/npm-ping.1
@@ -1,4 +1,4 @@
-.TH "NPM-PING" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PING" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ping\fR - Ping npm registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pkg.1 b/deps/npm/man/man1/npm-pkg.1
index ad4adfa8c654..ad11f73873aa 100644
--- a/deps/npm/man/man1/npm-pkg.1
+++ b/deps/npm/man/man1/npm-pkg.1
@@ -1,4 +1,4 @@
-.TH "NPM-PKG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PKG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pkg\fR - Manages your package.json
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prefix.1 b/deps/npm/man/man1/npm-prefix.1
index a810bc8c0140..6c990176088b 100644
--- a/deps/npm/man/man1/npm-prefix.1
+++ b/deps/npm/man/man1/npm-prefix.1
@@ -1,4 +1,4 @@
-.TH "NPM-PREFIX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PREFIX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prefix\fR - Display prefix
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-profile.1 b/deps/npm/man/man1/npm-profile.1
index 0593fa483958..0d5d54620f73 100644
--- a/deps/npm/man/man1/npm-profile.1
+++ b/deps/npm/man/man1/npm-profile.1
@@ -1,4 +1,4 @@
-.TH "NPM-PROFILE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PROFILE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-profile\fR - Change settings on your registry profile
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prune.1 b/deps/npm/man/man1/npm-prune.1
index c62e7d6bd395..8f67ca9384f8 100644
--- a/deps/npm/man/man1/npm-prune.1
+++ b/deps/npm/man/man1/npm-prune.1
@@ -1,4 +1,4 @@
-.TH "NPM-PRUNE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PRUNE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prune\fR - Remove extraneous packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-publish.1 b/deps/npm/man/man1/npm-publish.1
index 62676301d5ab..4e738ab0bbd7 100644
--- a/deps/npm/man/man1/npm-publish.1
+++ b/deps/npm/man/man1/npm-publish.1
@@ -1,4 +1,4 @@
-.TH "NPM-PUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-publish\fR - Publish a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-query.1 b/deps/npm/man/man1/npm-query.1
index 3ca4eb1b659f..334fc20660e4 100644
--- a/deps/npm/man/man1/npm-query.1
+++ b/deps/npm/man/man1/npm-query.1
@@ -1,4 +1,4 @@
-.TH "NPM-QUERY" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-QUERY" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-query\fR - Dependency selector query
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-rebuild.1 b/deps/npm/man/man1/npm-rebuild.1
index b0710049573e..6a09726529b4 100644
--- a/deps/npm/man/man1/npm-rebuild.1
+++ b/deps/npm/man/man1/npm-rebuild.1
@@ -1,4 +1,4 @@
-.TH "NPM-REBUILD" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REBUILD" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-rebuild\fR - Rebuild a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-repo.1 b/deps/npm/man/man1/npm-repo.1
index 46fdc0cb111e..5ff08e9eeb4d 100644
--- a/deps/npm/man/man1/npm-repo.1
+++ b/deps/npm/man/man1/npm-repo.1
@@ -1,4 +1,4 @@
-.TH "NPM-REPO" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REPO" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-repo\fR - Open package repository page in the browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-restart.1 b/deps/npm/man/man1/npm-restart.1
index b552a5e2a86a..d4f5f0d3df1f 100644
--- a/deps/npm/man/man1/npm-restart.1
+++ b/deps/npm/man/man1/npm-restart.1
@@ -1,4 +1,4 @@
-.TH "NPM-RESTART" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RESTART" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-restart\fR - Restart a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-root.1 b/deps/npm/man/man1/npm-root.1
index 9d701e336bff..ecd0c64ef6bb 100644
--- a/deps/npm/man/man1/npm-root.1
+++ b/deps/npm/man/man1/npm-root.1
@@ -1,4 +1,4 @@
-.TH "NPM-ROOT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ROOT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-root\fR - Display npm root
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-run.1 b/deps/npm/man/man1/npm-run.1
index 185111dbafbb..8aadcceff7c1 100644
--- a/deps/npm/man/man1/npm-run.1
+++ b/deps/npm/man/man1/npm-run.1
@@ -1,4 +1,4 @@
-.TH "NPM-RUN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RUN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-run\fR - Run arbitrary package scripts
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-sbom.1 b/deps/npm/man/man1/npm-sbom.1
index a8a74f9e02c6..f694d642f9ad 100644
--- a/deps/npm/man/man1/npm-sbom.1
+++ b/deps/npm/man/man1/npm-sbom.1
@@ -1,4 +1,4 @@
-.TH "NPM-SBOM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SBOM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-sbom\fR - Generate a Software Bill of Materials (SBOM)
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-search.1 b/deps/npm/man/man1/npm-search.1
index 2a0fbbc58709..969d0e784902 100644
--- a/deps/npm/man/man1/npm-search.1
+++ b/deps/npm/man/man1/npm-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-search\fR - Search for packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-set.1 b/deps/npm/man/man1/npm-set.1
index 4333006b47ff..4deaf8e01aca 100644
--- a/deps/npm/man/man1/npm-set.1
+++ b/deps/npm/man/man1/npm-set.1
@@ -1,4 +1,4 @@
-.TH "NPM-SET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-set\fR - Set a value in the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-shrinkwrap.1 b/deps/npm/man/man1/npm-shrinkwrap.1
index 0fc20a6ccaeb..35caa20c3dc0 100644
--- a/deps/npm/man/man1/npm-shrinkwrap.1
+++ b/deps/npm/man/man1/npm-shrinkwrap.1
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap\fR - Lock down dependency versions for publication
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stage.1 b/deps/npm/man/man1/npm-stage.1
index 9a677ba6b03e..8c2016052130 100644
--- a/deps/npm/man/man1/npm-stage.1
+++ b/deps/npm/man/man1/npm-stage.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAGE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAGE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stage\fR - Stage packages for publishing
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-star.1 b/deps/npm/man/man1/npm-star.1
index dbabe90b0bd6..a2191c120e35 100644
--- a/deps/npm/man/man1/npm-star.1
+++ b/deps/npm/man/man1/npm-star.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-star\fR - Mark your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stars.1 b/deps/npm/man/man1/npm-stars.1
index 2999dd8abbf0..aca98ed914a5 100644
--- a/deps/npm/man/man1/npm-stars.1
+++ b/deps/npm/man/man1/npm-stars.1
@@ -1,4 +1,4 @@
-.TH "NPM-STARS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STARS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stars\fR - View packages marked as favorites
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-start.1 b/deps/npm/man/man1/npm-start.1
index c8966bd38a68..d2f3b4d87cc8 100644
--- a/deps/npm/man/man1/npm-start.1
+++ b/deps/npm/man/man1/npm-start.1
@@ -1,4 +1,4 @@
-.TH "NPM-START" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-START" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-start\fR - Start a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stop.1 b/deps/npm/man/man1/npm-stop.1
index c900d58437f5..7896dd6acd17 100644
--- a/deps/npm/man/man1/npm-stop.1
+++ b/deps/npm/man/man1/npm-stop.1
@@ -1,4 +1,4 @@
-.TH "NPM-STOP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STOP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stop\fR - Stop a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-team.1 b/deps/npm/man/man1/npm-team.1
index 4de50f8c6b06..21ccc530ad81 100644
--- a/deps/npm/man/man1/npm-team.1
+++ b/deps/npm/man/man1/npm-team.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEAM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEAM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-team\fR - Manage organization teams and team memberships
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-test.1 b/deps/npm/man/man1/npm-test.1
index 311ba399498b..8cae879d8291 100644
--- a/deps/npm/man/man1/npm-test.1
+++ b/deps/npm/man/man1/npm-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-test\fR - Test a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-token.1 b/deps/npm/man/man1/npm-token.1
index 4b1cbae98b24..fc82daf8d0cf 100644
--- a/deps/npm/man/man1/npm-token.1
+++ b/deps/npm/man/man1/npm-token.1
@@ -1,4 +1,4 @@
-.TH "NPM-TOKEN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TOKEN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-token\fR - Manage your authentication tokens
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-trust.1 b/deps/npm/man/man1/npm-trust.1
index f8de6022c0f0..fce69eb33b75 100644
--- a/deps/npm/man/man1/npm-trust.1
+++ b/deps/npm/man/man1/npm-trust.1
@@ -1,4 +1,4 @@
-.TH "NPM-TRUST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TRUST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-trust\fR - Manage trusted publishing relationships between packages and CI/CD providers
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-undeprecate.1 b/deps/npm/man/man1/npm-undeprecate.1
index 1a26688b4530..11f91ee9b913 100644
--- a/deps/npm/man/man1/npm-undeprecate.1
+++ b/deps/npm/man/man1/npm-undeprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNDEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNDEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-undeprecate\fR - Undeprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-uninstall.1 b/deps/npm/man/man1/npm-uninstall.1
index 39791e588e7e..b9ff997229dc 100644
--- a/deps/npm/man/man1/npm-uninstall.1
+++ b/deps/npm/man/man1/npm-uninstall.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNINSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNINSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-uninstall\fR - Remove a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unpublish.1 b/deps/npm/man/man1/npm-unpublish.1
index f839376efe0f..5bbb86e8c8f3 100644
--- a/deps/npm/man/man1/npm-unpublish.1
+++ b/deps/npm/man/man1/npm-unpublish.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNPUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNPUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unpublish\fR - Remove a package from the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unstar.1 b/deps/npm/man/man1/npm-unstar.1
index 555868c3fb68..0d0e2f2c9e6a 100644
--- a/deps/npm/man/man1/npm-unstar.1
+++ b/deps/npm/man/man1/npm-unstar.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNSTAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNSTAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unstar\fR - Remove an item from your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-update.1 b/deps/npm/man/man1/npm-update.1
index 55b4191e801b..4f5e015b20d7 100644
--- a/deps/npm/man/man1/npm-update.1
+++ b/deps/npm/man/man1/npm-update.1
@@ -1,4 +1,4 @@
-.TH "NPM-UPDATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UPDATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-update\fR - Update packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-version.1 b/deps/npm/man/man1/npm-version.1
index fd261b5cd42a..c15a0d19acfa 100644
--- a/deps/npm/man/man1/npm-version.1
+++ b/deps/npm/man/man1/npm-version.1
@@ -1,4 +1,4 @@
-.TH "NPM-VERSION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VERSION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-version\fR - Bump a package version
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-view.1 b/deps/npm/man/man1/npm-view.1
index a150ce2d979d..b9210c424cd2 100644
--- a/deps/npm/man/man1/npm-view.1
+++ b/deps/npm/man/man1/npm-view.1
@@ -1,4 +1,4 @@
-.TH "NPM-VIEW" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VIEW" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-view\fR - View registry info
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-whoami.1 b/deps/npm/man/man1/npm-whoami.1
index 920d19146bd3..5d44c35a7f48 100644
--- a/deps/npm/man/man1/npm-whoami.1
+++ b/deps/npm/man/man1/npm-whoami.1
@@ -1,4 +1,4 @@
-.TH "NPM-WHOAMI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-WHOAMI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-whoami\fR - Display npm username
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 9791f5f274f5..25a9e19288c9 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm\fR - javascript package manager
 .SS "Synopsis"
@@ -12,7 +12,7 @@ npm
 Note: This command is unaware of workspaces.
 .SS "Version"
 .P
-11.19.0
+11.19.1
 .SS "Description"
 .P
 npm is the package manager for the Node JavaScript platform. It puts modules in place so that node can find them, and manages dependency conflicts intelligently.
diff --git a/deps/npm/man/man1/npx.1 b/deps/npm/man/man1/npx.1
index 3c4afb8aec51..39fcb358f7ce 100644
--- a/deps/npm/man/man1/npx.1
+++ b/deps/npm/man/man1/npx.1
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpx\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man5/folders.5 b/deps/npm/man/man5/folders.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/folders.5
+++ b/deps/npm/man/man5/folders.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/install.5 b/deps/npm/man/man5/install.5
index 200dcc3dfd3a..b54f427c5da9 100644
--- a/deps/npm/man/man5/install.5
+++ b/deps/npm/man/man5/install.5
@@ -1,4 +1,4 @@
-.TH "INSTALL" "5" "July 2026" "NPM@11.19.0" ""
+.TH "INSTALL" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBInstall\fR - Download and install node and npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-global.5 b/deps/npm/man/man5/npm-global.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/npm-global.5
+++ b/deps/npm/man/man5/npm-global.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-json.5 b/deps/npm/man/man5/npm-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/npm-json.5
+++ b/deps/npm/man/man5/npm-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-shrinkwrap-json.5 b/deps/npm/man/man5/npm-shrinkwrap-json.5
index 9f3d7597d161..1af7bf467c03 100644
--- a/deps/npm/man/man5/npm-shrinkwrap-json.5
+++ b/deps/npm/man/man5/npm-shrinkwrap-json.5
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap.json\fR - A publishable lockfile
 .SS "Description"
diff --git a/deps/npm/man/man5/npmrc.5 b/deps/npm/man/man5/npmrc.5
index 83578c624089..9d2361126088 100644
--- a/deps/npm/man/man5/npmrc.5
+++ b/deps/npm/man/man5/npmrc.5
@@ -1,4 +1,4 @@
-.TH ".NPMRC" "5" "July 2026" "NPM@11.19.0" ""
+.TH ".NPMRC" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fB.npmrc\fR - The npm config files
 .SS "Description"
diff --git a/deps/npm/man/man5/package-json.5 b/deps/npm/man/man5/package-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/package-json.5
+++ b/deps/npm/man/man5/package-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/package-lock-json.5 b/deps/npm/man/man5/package-lock-json.5
index 7bc632269f50..ace3d4d69594 100644
--- a/deps/npm/man/man5/package-lock-json.5
+++ b/deps/npm/man/man5/package-lock-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE-LOCK.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE-LOCK.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage-lock.json\fR - A manifestation of the manifest
 .SS "Description"
diff --git a/deps/npm/man/man7/config.7 b/deps/npm/man/man7/config.7
index b68980abc38f..684663e33757 100644
--- a/deps/npm/man/man7/config.7
+++ b/deps/npm/man/man7/config.7
@@ -1,4 +1,4 @@
-.TH "CONFIG" "7" "July 2026" "NPM@11.19.0" ""
+.TH "CONFIG" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBConfig\fR - About npm configuration
 .SS "Description"
diff --git a/deps/npm/man/man7/dependency-selectors.7 b/deps/npm/man/man7/dependency-selectors.7
index 4d242ab6e6c4..ec08ce0750b3 100644
--- a/deps/npm/man/man7/dependency-selectors.7
+++ b/deps/npm/man/man7/dependency-selectors.7
@@ -1,4 +1,4 @@
-.TH "SELECTORS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SELECTORS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBSelectors\fR - Dependency Selector Syntax & Querying
 .SS "Description"
diff --git a/deps/npm/man/man7/developers.7 b/deps/npm/man/man7/developers.7
index 201aedc081dd..aebb1f99a74a 100644
--- a/deps/npm/man/man7/developers.7
+++ b/deps/npm/man/man7/developers.7
@@ -1,4 +1,4 @@
-.TH "DEVELOPERS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "DEVELOPERS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBDevelopers\fR - Developer guide
 .SS "Description"
diff --git a/deps/npm/man/man7/logging.7 b/deps/npm/man/man7/logging.7
index be1e6ea6fffa..7fab6e089256 100644
--- a/deps/npm/man/man7/logging.7
+++ b/deps/npm/man/man7/logging.7
@@ -1,4 +1,4 @@
-.TH "LOGGING" "7" "July 2026" "NPM@11.19.0" ""
+.TH "LOGGING" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBLogging\fR - Why, What & How we Log
 .SS "Description"
diff --git a/deps/npm/man/man7/orgs.7 b/deps/npm/man/man7/orgs.7
index 43732ecdb5cb..975eded22dfc 100644
--- a/deps/npm/man/man7/orgs.7
+++ b/deps/npm/man/man7/orgs.7
@@ -1,4 +1,4 @@
-.TH "ORGANIZATIONS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "ORGANIZATIONS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBOrganizations\fR - Working with teams & organizations
 .SS "Description"
diff --git a/deps/npm/man/man7/package-spec.7 b/deps/npm/man/man7/package-spec.7
index d76da151b48e..a68e9b8f7e74 100644
--- a/deps/npm/man/man7/package-spec.7
+++ b/deps/npm/man/man7/package-spec.7
@@ -1,4 +1,4 @@
-.TH "SPEC" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SPEC" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBspec\fR - Package name specifier
 .SS "Description"
diff --git a/deps/npm/man/man7/registry.7 b/deps/npm/man/man7/registry.7
index 16e295f6ac11..a91c60c14565 100644
--- a/deps/npm/man/man7/registry.7
+++ b/deps/npm/man/man7/registry.7
@@ -1,4 +1,4 @@
-.TH "REGISTRY" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REGISTRY" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRegistry\fR - The JavaScript Package Registry
 .SS "Description"
diff --git a/deps/npm/man/man7/removal.7 b/deps/npm/man/man7/removal.7
index 1e0a0ddd0cf3..bb4d7a8d4365 100644
--- a/deps/npm/man/man7/removal.7
+++ b/deps/npm/man/man7/removal.7
@@ -1,4 +1,4 @@
-.TH "REMOVAL" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REMOVAL" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRemoval\fR - Cleaning the slate
 .SS "Synopsis"
diff --git a/deps/npm/man/man7/scope.7 b/deps/npm/man/man7/scope.7
index 6bb685d20984..f2744feb1343 100644
--- a/deps/npm/man/man7/scope.7
+++ b/deps/npm/man/man7/scope.7
@@ -1,4 +1,4 @@
-.TH "SCOPE" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCOPE" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScope\fR - Scoped packages
 .SS "Description"
diff --git a/deps/npm/man/man7/scripts.7 b/deps/npm/man/man7/scripts.7
index 797e70b65138..4af3522042ba 100644
--- a/deps/npm/man/man7/scripts.7
+++ b/deps/npm/man/man7/scripts.7
@@ -1,4 +1,4 @@
-.TH "SCRIPTS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCRIPTS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScripts\fR - How npm handles the "scripts" field
 .SS "Description"
diff --git a/deps/npm/man/man7/workspaces.7 b/deps/npm/man/man7/workspaces.7
index fb9807cdfe4c..b31d897d2f3d 100644
--- a/deps/npm/man/man7/workspaces.7
+++ b/deps/npm/man/man7/workspaces.7
@@ -1,4 +1,4 @@
-.TH "WORKSPACES" "7" "July 2026" "NPM@11.19.0" ""
+.TH "WORKSPACES" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBWorkspaces\fR - Working with workspaces
 .SS "Description"
diff --git a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
index e4e5bd87666d..869a6bee2380 100644
--- a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = require("balanced-match");
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -19,6 +19,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+exports.EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -68,7 +79,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -78,7 +89,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -92,25 +103,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = (0, balanced_match_1.balanced)('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -123,89 +225,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/dist/esm/index.js b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
index b2d2aa91bb1c..fd68f5702920 100644
--- a/deps/npm/node_modules/brace-expansion/dist/esm/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
@@ -15,6 +15,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 export const EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+export const EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -64,7 +75,7 @@ export function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = EXPANSION_MAX } = options;
+    const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -74,7 +85,7 @@ export function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -88,25 +99,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = balanced('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -119,89 +221,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/package.json b/deps/npm/node_modules/brace-expansion/package.json
index a5142f2787b6..4376400796c9 100644
--- a/deps/npm/node_modules/brace-expansion/package.json
+++ b/deps/npm/node_modules/brace-expansion/package.json
@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.7",
+  "version": "5.0.9",
   "files": [
     "dist"
   ],
@@ -46,7 +46,7 @@
   },
   "license": "MIT",
   "engines": {
-    "node": "18 || 20 || >=22"
+    "node": "20 || >=22"
   },
   "tshy": {
     "exports": {
diff --git a/deps/npm/node_modules/ip-address/dist/common.js b/deps/npm/node_modules/ip-address/dist/common.js
index 6b76e051b44e..0c15d21e3a39 100644
--- a/deps/npm/node_modules/ip-address/dist/common.js
+++ b/deps/npm/node_modules/ip-address/dist/common.js
@@ -1,23 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isInSubnet = isInSubnet;
+exports.isHostInSubnet = isHostInSubnet;
 exports.isCorrect = isCorrect;
 exports.prefixLengthFromMask = prefixLengthFromMask;
+exports.assertByteArray = assertByteArray;
 exports.numberToPaddedHex = numberToPaddedHex;
 exports.stringToPaddedHex = stringToPaddedHex;
 exports.testBit = testBit;
 const address_error_1 = require("./address-error");
+/**
+ * Returns whether this address's *network* is contained within `address`,
+ * i.e. whether every address this one can represent also falls inside
+ * `address`. A network wider than `address` is not contained in it, so
+ * `10.0.0.0/8` is not in `10.0.0.0/16`.
+ *
+ * To ask whether the address itself falls inside a range, ignoring any CIDR
+ * suffix it was written with, use {@link isHostInSubnet} instead. That is the
+ * question the special-use classifiers ask.
+ */
 function isInSubnet(address) {
     if (this.subnetMask < address.subnetMask) {
         return false;
     }
-    if (this.mask(address.subnetMask) === address.mask()) {
-        return true;
-    }
-    return false;
+    return isHostInSubnet.call(this, address);
+}
+/**
+ * Returns whether this address's host bits fall inside `address`, ignoring
+ * this address's own subnet mask.
+ *
+ * This is the primitive the special-use classifiers (`isLoopback`,
+ * `isPrivate`, `isLinkLocal`, `getType`, …) are built on: they answer a
+ * question about the address, so the answer must not change with the CIDR
+ * suffix the caller happened to write. Use this rather than
+ * {@link isInSubnet} when classifying a single address — notably when the
+ * address came from untrusted input and the result backs a trust-boundary
+ * decision such as an SSRF allow/deny filter.
+ */
+function isHostInSubnet(address) {
+    return this.mask(address.subnetMask) === address.mask();
 }
 function isCorrect(defaultBits) {
-    return function () {
+    return function isCorrectForm() {
         if (this.addressMinusSuffix !== this.correctForm()) {
             return false;
         }
@@ -46,6 +70,21 @@ function prefixLengthFromMask(value, totalBits) {
     }
     return firstZero;
 }
+/**
+ * Throws `AddressError` unless `bytes` holds exactly `byteCount` integers,
+ * each from `minimum` to 255. Pass a `minimum` of `-128` where signed bytes
+ * are accepted and folded to unsigned, and `0` where they are not.
+ */
+function assertByteArray(bytes, byteCount, family, minimum) {
+    if (bytes.length !== byteCount) {
+        throw new address_error_1.AddressError(`${family} addresses require exactly ${byteCount} bytes`);
+    }
+    for (let i = 0; i < bytes.length; i++) {
+        if (!Number.isInteger(bytes[i]) || bytes[i] < minimum || bytes[i] > 255) {
+            throw new address_error_1.AddressError(`All bytes must be integers between ${minimum} and 255`);
+        }
+    }
+}
 function numberToPaddedHex(number) {
     return number.toString(16).padStart(2, '0');
 }
diff --git a/deps/npm/node_modules/ip-address/dist/ipv4.js b/deps/npm/node_modules/ip-address/dist/ipv4.js
index 2c0fd182086d..1360e1836a0d 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv4.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv4.js
@@ -35,6 +35,7 @@ const isCorrect4 = common.isCorrect(constants.BITS);
  */
 class Address4 {
     constructor(address) {
+        this.addressMinusSuffix = '';
         this.groups = constants.GROUPS;
         this.parsedAddress = [];
         this.parsedSubnet = '';
@@ -51,6 +52,15 @@ class Address4 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         this.address = address;
         const subnet = constants.RE_SUBNET_STRING.exec(address);
         if (subnet) {
@@ -78,7 +88,7 @@ class Address4 {
             new Address4(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -90,6 +100,11 @@ class Address4 {
      */
     parse(address) {
         const groups = address.split('.');
+        // Checked before the general match so the error names the actual problem.
+        // Address6 rejects the same notation on its v4-in-v6 path.
+        if (groups.some((group) => /^0\d/.test(group))) {
+            throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
+        }
         if (!address.match(constants.RE_ADDRESS)) {
             throw new address_error_1.AddressError('Invalid IPv4 address.');
         }
@@ -128,7 +143,6 @@ class Address4 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address4(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants.BITS);
         return new Address4(`${address}/${bits}`);
@@ -328,32 +342,32 @@ class Address4 {
      * @returns {Address4}
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > 0xffffffffn) {
+        if (bigInt < BigInt(0) || bigInt > BigInt(0xffffffff)) {
             throw new address_error_1.AddressError('IPv4 BigInt must be in the range 0 to 2**32 - 1');
         }
         return Address4.fromHex(bigInt.toString(16).padStart(8, '0'));
     }
     /**
-     * Convert a byte array to an Address4 object.
+     * Convert a byte array to an Address4 object. Throws `AddressError` unless
+     * given exactly 4 integers from 0 to 255. Signed bytes are rejected, so
+     * this differs from `Address6.fromByteArray`, which folds them; the two
+     * contracts converge on this stricter form in the next major version.
      *
      * To convert from a Node.js `Buffer`, spread it: `Address4.fromByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 bytes (0-255)
      * @returns {Address4}
      */
     static fromByteArray(bytes) {
-        if (bytes.length !== 4) {
-            throw new address_error_1.AddressError('IPv4 addresses require exactly 4 bytes');
-        }
-        // Validate that all bytes are within valid range (0-255)
-        for (let i = 0; i < bytes.length; i++) {
-            if (!Number.isInteger(bytes[i]) || bytes[i] < 0 || bytes[i] > 255) {
-                throw new address_error_1.AddressError('All bytes must be integers between 0 and 255');
-            }
-        }
+        common.assertByteArray(bytes, 4, 'IPv4', 0);
         return this.fromUnsignedByteArray(bytes);
     }
     /**
-     * Convert an unsigned byte array to an Address4 object
+     * Convert an unsigned byte array to an Address4 object. Throws
+     * `AddressError` unless given exactly 4 bytes, and rejects values outside
+     * 0 to 255 when parsing the resulting address.
+     *
+     * To convert from a Node.js `Buffer`, spread it:
+     * `Address4.fromUnsignedByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 unsigned bytes (0-255)
      * @returns {Address4}
      */
@@ -383,7 +397,8 @@ class Address4 {
         return this.binaryZeroPad().slice(start, end);
     }
     /**
-     * Return the reversed ip6.arpa form of the address
+     * Return the reversed in-addr.arpa form of the address, e.g.
+     * `42.2.0.192.in-addr.arpa.` for `192.0.2.42`.
      * @param {Object} options
      * @param {boolean} options.omitSuffix - omit the "in-addr.arpa" suffix
      * @returns {String}
@@ -403,49 +418,49 @@ class Address4 {
      * @returns {boolean}
      */
     isMulticast() {
-        return this.isInSubnet(MULTICAST_V4);
+        return this.isHostInSubnet(MULTICAST_V4);
     }
     /**
      * Returns true if the address is in one of the [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private address ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).
      * @returns {boolean}
      */
     isPrivate() {
-        return PRIVATE_V4.some((subnet) => this.isInSubnet(subnet));
+        return PRIVATE_V4.some((subnet) => this.isHostInSubnet(subnet));
     }
     /**
      * Returns true if the address is in the loopback range `127.0.0.0/8` ([RFC 1122](https://datatracker.ietf.org/doc/html/rfc1122)).
      * @returns {boolean}
      */
     isLoopback() {
-        return this.isInSubnet(LOOPBACK_V4);
+        return this.isHostInSubnet(LOOPBACK_V4);
     }
     /**
      * Returns true if the address is in the link-local range `169.254.0.0/16` ([RFC 3927](https://datatracker.ietf.org/doc/html/rfc3927)).
      * @returns {boolean}
      */
     isLinkLocal() {
-        return this.isInSubnet(LINK_LOCAL_V4);
+        return this.isHostInSubnet(LINK_LOCAL_V4);
     }
     /**
      * Returns true if the address is the unspecified address `0.0.0.0`.
      * @returns {boolean}
      */
     isUnspecified() {
-        return this.isInSubnet(UNSPECIFIED_V4);
+        return this.isHostInSubnet(UNSPECIFIED_V4);
     }
     /**
      * Returns true if the address is the limited broadcast address `255.255.255.255` ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)).
      * @returns {boolean}
      */
     isBroadcast() {
-        return this.isInSubnet(BROADCAST_V4);
+        return this.isHostInSubnet(BROADCAST_V4);
     }
     /**
      * Returns true if the address is in the carrier-grade NAT range `100.64.0.0/10` ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)).
      * @returns {boolean}
      */
     isCGNAT() {
-        return this.isInSubnet(CGNAT_V4);
+        return this.isHostInSubnet(CGNAT_V4);
     }
     /**
      * Returns a zero-padded base-2 string representation of the address
@@ -458,12 +473,17 @@ class Address4 {
         return this._binaryZeroPad;
     }
     /**
-     * Groups an IPv4 address for inclusion at the end of an IPv6 address
+     * Groups an IPv4 address for inclusion at the end of an IPv6 address.
+     *
+     * Returns an HTML fragment: each half of the address is wrapped in a
+     * `<span>` carrying the group classes an address-inspector UI hovers on.
+     * The address content is HTML-escaped; anything you concatenate around it
+     * is your responsibility.
      * @returns {String}
      */
     groupForV6() {
         const segments = this.parsedAddress;
-        return this.address.replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
+        return this.correctForm().replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
             .slice(0, 2)
             .join('.')}</span>.<span class="hover-group group-v4 group-7">${segments
             .slice(2, 4)
diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
index a78020ee7886..d5f4fdb9c87a 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
@@ -73,7 +73,6 @@ function paddedHex(octet) {
     return parseInt(octet, 16).toString(16).padStart(4, '0');
 }
 function unsignByte(b) {
-    // eslint-disable-next-line no-bitwise
     return b & 0xff;
 }
 /**
@@ -97,6 +96,15 @@ class Address6 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         /**
          * Returns true if the address is correct, false otherwise
          * @returns {boolean}
@@ -121,7 +129,10 @@ class Address6 {
             }
             address = address.replace(constants6.RE_SUBNET_STRING, '');
         }
-        else if (/\//.test(address)) {
+        // RE_SUBNET_STRING anchors on the end of the address, so it strips only
+        // the trailing suffix. A second one left behind (`::/0/1`) is malformed
+        // and must be rejected rather than parsed as an address group.
+        if (/\//.test(address)) {
             throw new address_error_1.AddressError('Invalid subnet mask.');
         }
         const zone = constants6.RE_ZONE_STRING.exec(address);
@@ -145,7 +156,7 @@ class Address6 {
             new Address6(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -160,7 +171,7 @@ class Address6 {
      * address.correctForm(); // '::e8:d4a5:1000'
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > (1n << BigInt(constants6.BITS)) - 1n) {
+        if (bigInt < BigInt(0) || bigInt > (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1)) {
             throw new address_error_1.AddressError('IPv6 BigInt must be in the range 0 to 2**128 - 1');
         }
         const hex = bigInt.toString(16).padStart(32, '0');
@@ -181,46 +192,36 @@ class Address6 {
      * addressAndPort.port; // 8080
      */
     static fromURL(url) {
+        var _a;
         let host;
         let port = null;
         let result;
+        let error;
+        // Remove the protocol prefix, if any
+        const stripped = url.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
         // If we have brackets parse them and find a port
-        if (url.indexOf('[') !== -1 && url.indexOf(']:') !== -1) {
-            result = constants6.RE_URL_WITH_PORT.exec(url);
+        if (stripped.indexOf('[') !== -1 && stripped.indexOf(']:') !== -1) {
+            error = 'failed to parse address with port';
+            result = constants6.RE_URL_WITH_PORT.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address with port',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
             host = result[1];
             port = result[2];
-            // If there's a URL extract the address
         }
-        else if (url.indexOf('/') !== -1) {
-            // Remove the protocol prefix
-            url = url.replace(/^[a-z0-9]+:\/\//, '');
-            // Parse the address
-            result = constants6.RE_URL.exec(url);
+        else {
+            error = 'failed to parse address from URL';
+            result = constants6.RE_URL.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address from URL',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
-            host = result[1];
-            // Otherwise just assign the URL to the host and let the library parse it
-        }
-        else {
-            host = url;
+            host = (_a = result[1]) !== null && _a !== void 0 ? _a : result[2];
         }
         // If there's a port convert it to an integer
         if (port) {
             port = parseInt(port, 10);
-            // squelch out of range ports
-            if (port < 0 || port > 65536) {
+            // squelch out of range ports (valid ports are 0-65535)
+            if (port < 0 || port > 65535) {
                 port = null;
             }
         }
@@ -228,10 +229,17 @@ class Address6 {
             // Standardize `undefined` to `null`
             port = null;
         }
-        return {
-            address: new Address6(host),
-            port,
-        };
+        // The URL character class is a superset of valid IPv6, so a host the
+        // regex accepted (an IPv4 literal, bare punctuation, too many groups)
+        // can still be rejected by the parser
+        let address;
+        try {
+            address = new Address6(host);
+        }
+        catch {
+            return { error, address: null, port: null };
+        }
+        return { address, port };
     }
     /**
      * Construct an `Address6` from an address and a hex subnet mask given as
@@ -258,7 +266,6 @@ class Address6 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address6(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants6.BITS);
         return new Address6(`${address}/${bits}`);
@@ -493,7 +500,7 @@ class Address6 {
     getType() {
         for (let i = 0; i < TYPE_SUBNETS.length; i++) {
             const entry = TYPE_SUBNETS[i];
-            if (this.isInSubnet(entry[0])) {
+            if (this.isHostInSubnet(entry[0])) {
                 return entry[1];
             }
         }
@@ -635,20 +642,27 @@ class Address6 {
         }
         const groups = address.split(':');
         const lastGroup = groups.slice(-1)[0];
+        // RE_ADDRESS rejects octets with a leading zero, so a dotted-quad tail is
+        // matched permissively first: that way this notation still gets its own
+        // message with the offending octet highlighted, rather than falling
+        // through as an unrecognized group.
+        const v4Octets = lastGroup.split('.');
+        if (v4Octets.length === constants4.GROUPS &&
+            v4Octets.every((octet) => /^\d{1,3}$/.test(octet))) {
+            if (v4Octets.some((octet) => /^0\d/.test(octet))) {
+                // The prefix groups haven't been through the bad-character check
+                // yet, so escape them before including in the error HTML.
+                const highlighted = v4Octets.map(spanLeadingZeroes4).join('.');
+                const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
+                const separator = groups.length > 1 ? ':' : '';
+                throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
+            }
+        }
         const address4 = lastGroup.match(constants4.RE_ADDRESS);
         if (address4) {
             this.parsedAddress4 = address4[0];
-            this.address4 = new ipv4_1.Address4(this.parsedAddress4);
-            for (let i = 0; i < this.address4.groups; i++) {
-                if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
-                    // The prefix groups haven't been through the bad-character check
-                    // yet, so escape them before including in the error HTML.
-                    const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
-                    const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
-                    const separator = groups.length > 1 ? ':' : '';
-                    throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
-                }
-            }
+            const v4Suffix = this.subnetMask >= 96 ? `/${this.subnetMask - 96}` : '';
+            this.address4 = new ipv4_1.Address4(`${this.parsedAddress4}${v4Suffix}`);
             this.v4 = true;
             groups[groups.length - 1] = this.address4.toGroup6();
             address = groups.join(':');
@@ -734,7 +748,11 @@ class Address6 {
         return BigInt(`0x${this.parsedAddress.map(paddedHex).join('')}`);
     }
     /**
-     * Return the last two groups of this address as an IPv4 address string
+     * Return the last two groups of this address as an IPv4 address string.
+     * If this address carries a CIDR prefix that covers the trailing 32 bits
+     * (i.e. `subnetMask >= 96`), the resulting `Address4` inherits the
+     * corresponding v4 prefix (`subnetMask - 96`); otherwise it defaults to
+     * `/32`.
      * @returns {Address4}
      * @example
      * var address = new Address6('2001:4860:4001::1825:bf11');
@@ -742,7 +760,18 @@ class Address6 {
      */
     to4() {
         const binary = this.binaryZeroPad().split('');
-        return ipv4_1.Address4.fromHex(BigInt(`0b${binary.slice(96, 128).join('')}`).toString(16).padStart(8, '0'));
+        const hex = BigInt(`0b${binary.slice(96, 128).join('')}`)
+            .toString(16)
+            .padStart(8, '0');
+        if (this.subnetMask >= 96) {
+            const v4Mask = this.subnetMask - 96;
+            const groups = [];
+            for (let i = 0; i < 8; i += 2) {
+                groups.push(parseInt(hex.slice(i, i + 2), 16));
+            }
+            return new ipv4_1.Address4(`${groups.join('.')}/${v4Mask}`);
+        }
+        return ipv4_1.Address4.fromHex(hex);
     }
     /**
      * Return the v4-in-v6 form of the address
@@ -756,7 +785,7 @@ class Address6 {
         if (!/:$/.test(correct)) {
             infix = ':';
         }
-        return correct + infix + address4.address;
+        return correct + infix + address4.correctForm();
     }
     /**
      * Decodes the Teredo tunneling fields embedded in this address. Returns the
@@ -788,11 +817,9 @@ class Address6 {
         */
         const prefix = this.getBitsBase16(0, 32);
         const bitsForUdpPort = this.getBits(80, 96);
-        // eslint-disable-next-line no-bitwise
         const udpPort = (bitsForUdpPort ^ BigInt('0xffff')).toString();
         const server4 = ipv4_1.Address4.fromHex(this.getBitsBase16(32, 64));
         const bitsForClient4 = this.getBits(96, 128);
-        // eslint-disable-next-line no-bitwise
         const client4 = ipv4_1.Address4.fromHex((bitsForClient4 ^ BigInt('0xffffffff')).toString(16).padStart(8, '0'));
         const flagsBase2 = this.getBitsBase2(64, 80);
         const coneNat = (0, common_1.testBit)(flagsBase2, 15);
@@ -874,12 +901,14 @@ class Address6 {
         }
         else {
             const beforeU = 64 - pl;
-            bits =
-                prefixBits.slice(0, pl) +
-                    v4Bits.slice(0, beforeU) +
-                    '00000000' +
-                    v4Bits.slice(beforeU) +
-                    '0'.repeat(128 - 72 - (32 - beforeU));
+            bits = [
+                prefixBits.slice(0, pl),
+                v4Bits.slice(0, beforeU),
+                // Bits 64 to 71 are the reserved u octet and are always zero.
+                '00000000',
+                v4Bits.slice(beforeU),
+                '0'.repeat(128 - 72 - (32 - beforeU)),
+            ].join('');
         }
         const hex = BigInt(`0b${bits}`).toString(16).padStart(32, '0');
         const groups = [];
@@ -902,7 +931,7 @@ class Address6 {
         if (pl !== 32 && pl !== 40 && pl !== 48 && pl !== 56 && pl !== 64 && pl !== 96) {
             throw new address_error_1.AddressError('NAT64 prefix length must be 32, 40, 48, 56, 64, or 96');
         }
-        if (!this.isInSubnet(prefix6)) {
+        if (!this.isHostInSubnet(prefix6)) {
             return null;
         }
         const bits = this.binaryZeroPad();
@@ -927,9 +956,9 @@ class Address6 {
      * @returns {Array}
      */
     toByteArray() {
-        const valueWithoutPadding = this.bigInt().toString(16);
-        const leadingPad = '0'.repeat(valueWithoutPadding.length % 2);
-        const value = `${leadingPad}${valueWithoutPadding}`;
+        const value = this.bigInt()
+            .toString(16)
+            .padStart(constants6.BITS / 4, '0');
         const bytes = [];
         for (let i = 0, length = value.length; i < length; i += 2) {
             bytes.push(parseInt(value.substring(i, i + 2), 16));
@@ -943,24 +972,39 @@ class Address6 {
      * @returns {Array}
      */
     toUnsignedByteArray() {
+        // toByteArray() emits 0 to 255, so unsigning it is an identity mapping and
+        // the two methods return equal arrays. 11.0.0 keeps one of them and makes
+        // this a deprecated alias; test/common-test.ts fails at that version.
         return this.toByteArray().map(unsignByte);
     }
     /**
      * Convert a byte array to an Address6 object.
      *
+     * Accepts unsigned bytes (0 to 255) or signed bytes (-128 to 127, as an
+     * `Int8Array` or a Java `byte[]` holds them), folding signed values to their
+     * unsigned equivalent. Throws `AddressError` unless given exactly 16
+     * integers from -128 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromByteArray(bytes) {
+        // Address4.fromByteArray takes unsigned bytes only. 11.0.0 aligns this
+        // method with it, at which point the -128 floor here, unsignByte, and the
+        // mapping below all go; test/common-test.ts fails at that version.
+        common.assertByteArray(bytes, 16, 'IPv6', -128);
         return this.fromUnsignedByteArray(bytes.map(unsignByte));
     }
     /**
      * Convert an unsigned byte array to an Address6 object.
      *
+     * Throws `AddressError` unless given exactly 16 integers from 0 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromUnsignedByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromUnsignedByteArray(bytes) {
+        common.assertByteArray(bytes, 16, 'IPv6', 0);
         const BYTE_MAX = BigInt('256');
         let result = BigInt('0');
         let multiplier = BigInt('1');
@@ -982,7 +1026,11 @@ class Address6 {
      * @returns {boolean}
      */
     isLinkLocal() {
-        // Zeroes are required, i.e. we can't check isInSubnet with 'fe80::/10'
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLinkLocal();
+        }
+        // Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'
         if (this.getBitsBase2(0, 64) ===
             '1111111010000000000000000000000000000000000000000000000000000000') {
             return true;
@@ -994,6 +1042,10 @@ class Address6 {
      * @returns {boolean}
      */
     isMulticast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isMulticast();
+        }
         const type = this.getType();
         return type === 'Multicast' || type.startsWith('Multicast ');
     }
@@ -1016,27 +1068,54 @@ class Address6 {
      * @returns {boolean}
      */
     isMapped4() {
-        return this.isInSubnet(IPV4_MAPPED_SUBNET);
+        return this.isHostInSubnet(IPV4_MAPPED_SUBNET);
+    }
+    /**
+     * If this address embeds a routable IPv4 address — i.e. it is IPv4-mapped
+     * (`::ffff:0:0/96`) or sits in the NAT64 well-known prefix (`64:ff9b::/96`,
+     * [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052)) — return that
+     * embedded address as an {@link Address4}; otherwise return null.
+     *
+     * The special-property checks (`isLoopback`, `isLinkLocal`, `isMulticast`,
+     * `isUnspecified`, `isPrivate`, `isCGNAT`, `isBroadcast`) call this first and
+     * delegate to the embedded {@link Address4} when present, so a literal such as
+     * `::ffff:127.0.0.1` is classified by what it actually reaches (loopback)
+     * rather than by its IPv6 wrapper (which `getType()` reports as IPv4-mapped).
+     * This matters wherever the checks back a trust-boundary decision (e.g. an
+     * SSRF allow/deny filter): without normalization, `::ffff:10.0.0.1`,
+     * `::ffff:169.254.169.254`, `64:ff9b::7f00:1`, etc. would all read as
+     * non-internal.
+     * @returns {Address4 | null}
+     */
+    embeddedIPv4() {
+        if (this.isMapped4() || this.isHostInSubnet(NAT64_WELL_KNOWN_SUBNET)) {
+            return this.to4();
+        }
+        return null;
     }
     /**
      * Returns true if the address is a Teredo address, false otherwise
      * @returns {boolean}
      */
     isTeredo() {
-        return this.isInSubnet(TEREDO_SUBNET);
+        return this.isHostInSubnet(TEREDO_SUBNET);
     }
     /**
      * Returns true if the address is a 6to4 address, false otherwise
      * @returns {boolean}
      */
     is6to4() {
-        return this.isInSubnet(SIX_TO_FOUR_SUBNET);
+        return this.isHostInSubnet(SIX_TO_FOUR_SUBNET);
     }
     /**
      * Returns true if the address is a loopback address, false otherwise
      * @returns {boolean}
      */
     isLoopback() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLoopback();
+        }
         return this.getType() === 'Loopback';
     }
     /**
@@ -1044,13 +1123,64 @@ class Address6 {
      * @returns {boolean}
      */
     isULA() {
-        return this.isInSubnet(ULA_SUBNET);
+        return this.isHostInSubnet(ULA_SUBNET);
+    }
+    /**
+     * Returns true if the address is private, i.e. a Unique Local Address in
+     * `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)) or an
+     * IPv4-mapped / NAT64 address whose embedded IPv4 address is in one of the
+     * [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private ranges
+     * (e.g. `::ffff:10.0.0.1`). This is the IPv6 counterpart to
+     * {@link Address4.isPrivate}; use it instead of {@link isULA} when you need to
+     * catch mapped RFC 1918 addresses as well as native ULAs.
+     * @returns {boolean}
+     */
+    isPrivate() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isPrivate();
+        }
+        return this.isULA();
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is in the carrier-grade NAT range `100.64.0.0/10`
+     * ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)), false
+     * otherwise. There is no native IPv6 CGNAT range, so this only ever returns
+     * true for an embedded IPv4 address (e.g. `::ffff:100.64.0.1`).
+     * @returns {boolean}
+     */
+    isCGNAT() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isCGNAT();
+        }
+        return false;
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is the limited broadcast address `255.255.255.255`
+     * ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)), false otherwise.
+     * There is no IPv6 broadcast, so this only ever returns true for an embedded
+     * IPv4 address (e.g. `::ffff:255.255.255.255`).
+     * @returns {boolean}
+     */
+    isBroadcast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isBroadcast();
+        }
+        return false;
     }
     /**
      * Returns true if the address is the unspecified address `::`.
      * @returns {boolean}
      */
     isUnspecified() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isUnspecified();
+        }
         return this.getType() === 'Unspecified';
     }
     /**
@@ -1058,7 +1188,7 @@ class Address6 {
      * @returns {boolean}
      */
     isDocumentation() {
-        return this.isInSubnet(DOCUMENTATION_SUBNET);
+        return this.isHostInSubnet(DOCUMENTATION_SUBNET);
     }
     // #endregion
     // #region HTML
@@ -1111,7 +1241,12 @@ class Address6 {
         return `<a href="${safeHref}">${safeForm}</a>`;
     }
     /**
-     * Groups an address
+     * Groups an address.
+     *
+     * Returns an HTML fragment: each group is wrapped in a `<span>` carrying
+     * the group classes an address-inspector UI hovers on. The address content
+     * is HTML-escaped; anything you concatenate around it is your
+     * responsibility.
      * @returns {String}
      */
     group() {
@@ -1214,4 +1349,5 @@ const SIX_TO_FOUR_SUBNET = new Address6('2002::/16');
 const ULA_SUBNET = new Address6('fc00::/7');
 const DOCUMENTATION_SUBNET = new Address6('2001:db8::/32');
 const IPV4_MAPPED_SUBNET = new Address6('::ffff:0:0/96');
+const NAT64_WELL_KNOWN_SUBNET = new Address6('64:ff9b::/96');
 //# sourceMappingURL=ipv6.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v4/constants.js b/deps/npm/node_modules/ip-address/dist/v4/constants.js
index 6fa2518f9649..158288b7de65 100644
--- a/deps/npm/node_modules/ip-address/dist/v4/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v4/constants.js
@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
 exports.BITS = 32;
 exports.GROUPS = 4;
-exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g;
+// Each octet is 0-255 written without a leading zero. A leading zero is
+// octal to the WHATWG URL parser, inet_aton, and getaddrinfo, but decimal to
+// parseInt(part, 10), so accepting the notation would make this library
+// disagree with the network stack about which host a string names.
+exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g;
 exports.RE_SUBNET_STRING = /\/\d{1,2}$/;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v6/constants.js b/deps/npm/node_modules/ip-address/dist/v6/constants.js
index 1a8cd1dd616e..4616cad66b6a 100644
--- a/deps/npm/node_modules/ip-address/dist/v6/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v6/constants.js
@@ -44,6 +44,7 @@ exports.TYPES = {
     'ff05::1:3/128': 'Multicast (All DHCP servers in this site)',
     '::/128': 'Unspecified',
     '::1/128': 'Loopback',
+    '::ffff:0:0/96': 'IPv4-mapped',
     'ff00::/8': 'Multicast',
     'fe80::/10': 'Link-local unicast',
     'fc00::/7': 'Unique local',
@@ -76,6 +77,6 @@ exports.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/;
  * @static
  */
 exports.RE_ZONE_STRING = /%.*$/;
-exports.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/;
-exports.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
+exports.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i;
+exports.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
index 47d109ec6f34..6ea2d24bd62b 100644
--- a/deps/npm/node_modules/ip-address/package.json
+++ b/deps/npm/node_modules/ip-address/package.json
@@ -16,7 +16,7 @@
     "bigint",
     "browser"
   ],
-  "version": "10.2.0",
+  "version": "10.5.0",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",
@@ -25,6 +25,9 @@
     "docs": "tsx scripts/build-readme.ts",
     "build": "rm -rf dist; mkdir dist; tsc",
     "prepack": "npm run docs && npm run build",
+    "prepare": "git config core.hooksPath hooks || true",
+    "lint": "prettier --check . && eslint . --ext .ts,.js --max-warnings 0",
+    "lint:fix": "prettier --write . && eslint . --ext .ts,.js --max-warnings 0 --fix",
     "test-ci": "c8 --experimental-monocart mocha",
     "test": "mocha",
     "watch": "mocha --watch"
@@ -54,7 +57,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git://github.com/beaugunderson/ip-address.git"
+    "url": "https://github.com/beaugunderson/ip-address.git"
   },
   "overrides": {
     "diff": "^8.0.3",
@@ -70,11 +73,10 @@
     "chai": "^6.2.2",
     "eslint": "^8.57.1",
     "eslint_d": "^14.0.4",
-    "eslint-config-airbnb": "^19.0.4",
+    "eslint-config-airbnb-base": "^15.0.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-filenames": "^1.3.2",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-sort-imports-es6-autofix": "^0.6.0",
     "mocha": "^11.7.5",
diff --git a/deps/npm/node_modules/libnpmpack/lib/index.js b/deps/npm/node_modules/libnpmpack/lib/index.js
index 6c8ee3fd6334..ce6707938bb3 100644
--- a/deps/npm/node_modules/libnpmpack/lib/index.js
+++ b/deps/npm/node_modules/libnpmpack/lib/index.js
@@ -12,6 +12,11 @@ async function pack (spec = 'file:.', opts = {}) {
   // gets spec
   spec = npa(spec)
 
+  // An explicit directory is the package being packed, not a dependency fetch.
+  if (spec.type === 'directory') {
+    opts = { ...opts, allowDirectory: 'all' }
+  }
+
   const manifest = await pacote.manifest(spec, { ...opts, Arborist, _isRoot: true })
 
   const stdio = opts.foregroundScripts ? 'inherit' : 'pipe'
diff --git a/deps/npm/node_modules/libnpmpack/package.json b/deps/npm/node_modules/libnpmpack/package.json
index 5741c8522c19..54c31fccd635 100644
--- a/deps/npm/node_modules/libnpmpack/package.json
+++ b/deps/npm/node_modules/libnpmpack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.12",
+  "version": "9.1.13",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
diff --git a/deps/npm/node_modules/tar/dist/commonjs/index.min.js b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
index 1a229a01e5a5..c1fe035f48f3 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/index.min.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
@@ -1,4 +1,4 @@
-"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),y=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[y]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[y])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[y])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[y]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[y]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[y])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[y]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==y&&this[y])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[y])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(y,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(y,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(y,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(y,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,E)=>{o=E,n=u,this.once(y,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(y,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(y,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[y])return e?this.emit("error",e):this.emit(y),this;this[y]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(y),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.dealias=b.isNoFile=b.isFile=b.isAsync=b.isSync=b.isAsyncNoFile=b.isSyncNoFile=b.isAsyncFile=b.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;b.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;b.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;b.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;b.isAsyncNoFile=Go;var Zo=s=>!!s.sync;b.isSync=Zo;var Yo=s=>!s.sync;b.isAsync=Yo;var Ko=s=>!!s.file;b.isFile=Ko;var Vo=s=>!s.file;b.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};b.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
+"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),E=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[E]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[E])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[E])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[E]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[E]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[E])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[E]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==E&&this[E])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[E])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(E,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(E,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(E,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(E,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,b)=>{o=b,n=u,this.once(E,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(E,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(E,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[E])return e?this.emit("error",e):this.emit(E),this;this[E]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(E),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.dealias=S.isNoFile=S.isFile=S.isAsync=S.isSync=S.isAsyncNoFile=S.isSyncNoFile=S.isAsyncFile=S.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;S.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;S.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;S.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;S.isAsyncNoFile=Go;var Zo=s=>!!s.sync;S.isSync=Zo;var Yo=s=>!s.sync;S.isAsync=Yo;var Ko=s=>!!s.file;S.isFile=Ko;var Vo=s=>!s.file;S.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};S.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(e,t,i=!1){return new s(Aa(Ia(e),t),i)}};ii.Pax=Is;var Aa=(s,e)=>e?Object.assign({},e,s):s,Ia=s=>s.replace(/\n$/,"").split(`
-`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),S=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[S];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){this[ne]||(this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1}))}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[S]===void 0||this.brotli===void 0&&this[S]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[S]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[S]=!1);let o=!1;if(this[S]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[S]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[S]===void 0||this[S]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[S]=this[S]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[S].on("data",c=>{this[nn](c)&&this[li](c)}),this[S].on("error",c=>{this[ne]||this.abort(c)}),this[S].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[S][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[S]?(this[Ot]+=e.length,this[S].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[S]?(e&&(this[Ot]+=e.length,this[S].write(e)),this[S].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(n=>[(0,Gs.stripTrailingSlashes)(n),!0])),i=s.filter,r=(n,o="")=>{let a=o||(0,on.parse)(n).root||".",h;if(n===a)h=!1;else{let l=t.get(n);h=l!==void 0?l:r((0,on.dirname)(n),a)}return t.set(n,h),h};s.filter=i?(n,o)=>i(n,o)&&r((0,Gs.stripTrailingSlashes)(n)):n=>r((0,Gs.stripTrailingSlashes)(n))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),E=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>E(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,E);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>E(null,w??void 0),E);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,E)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,E=>E?m.default.utimes(h,c,u,D=>o(D&&E)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,E=>E?m.default.chown(h,c,u,D=>o(D&&E)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),E=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,E);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,E)};q.default.read(n,u,0,512,l,E)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,E)=>{if(u)return q.default.close(c,()=>o(u));i(c,E.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
+`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),y=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[y];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){if(!this[ne]){if(this[y]){let t=this[y];t.write=()=>!0,t.end=()=>t,t.emit=()=>!1,t.destroy?.()}this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1})}}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[y]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[y]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[y]=this[y]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[y].on("data",c=>{this[nn](c)&&this[li](c)}),this[y].on("error",c=>{this[ne]||this.abort(c)}),this[y].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[y][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[y]?(this[Ot]+=e.length,this[y].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[y]?(e&&(this[Ot]+=e.length,this[y].write(e)),this[y].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(o=>[(0,Gs.stripTrailingSlashes)(o),!0])),i=s.filter,r=100,n=(o,a="",h=0)=>{if(h>=r)return t.set(o,!1),!1;let l=a||(0,on.parse)(o).root||".",c;if(o===l)c=!1;else{let u=t.get(o);c=u!==void 0?u:n((0,on.dirname)(o),l,h+1)}return t.set(o,c),c};s.filter=i?(o,a)=>i(o,a)&&n((0,Gs.stripTrailingSlashes)(o)):o=>n((0,Gs.stripTrailingSlashes)(o))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),b=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>b(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,b);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>b(null,w??void 0),b);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,b)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,b=>b?m.default.utimes(h,c,u,D=>o(D&&b)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,b=>b?m.default.chown(h,c,u,D=>o(D&&b)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),b=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,b);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,b)};q.default.read(n,u,0,512,l,b)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,b)=>{if(u)return q.default.close(c,()=>o(u));i(c,b.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/commonjs/list.js b/deps/npm/node_modules/tar/dist/commonjs/list.js
index 700030a0ac10..5dfdb985cd78 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/list.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/list.js
@@ -59,14 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root);
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/commonjs/parse.js b/deps/npm/node_modules/tar/dist/commonjs/parse.js
index 2968e861ee68..6ab1e333458c 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/parse.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/parse.js
@@ -376,6 +376,16 @@ class Parser extends events_1.EventEmitter {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/dist/esm/index.min.js b/deps/npm/node_modules/tar/dist/esm/index.min.js
index bf4036b4115e..9d9044ce85e3 100644
--- a/deps/npm/node_modules/tar/dist/esm/index.min.js
+++ b/deps/npm/node_modules/tar/dist/esm/index.min.js
@@ -1,4 +1,4 @@
-var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),w=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[w]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[w])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[w])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[w]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[w]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[w])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[w]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==w&&this[w])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[w])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(w,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(w,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(w,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(w,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,S)=>{o=S,n=d,this.once(w,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(w,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(w,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[w])return t?this.emit("error",t):this.emit(w),this;this[w]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(w),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),u=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[u];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[u]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[u]=="number"?this[zt]():this[at]()}get fd(){return this[u]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[u]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[u],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[u]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[u],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[u];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[u]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[u]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[u]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[u]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[u]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[u]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[u],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[u],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[u],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var mn=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=mn(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=un(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},un=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
+var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),S=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[S]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[S])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[S])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[S]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[S]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[S])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[S]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==S&&this[S])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[S])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(S,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(S,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(S,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(S,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,y)=>{o=y,n=d,this.once(S,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(S,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(S,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[S])return t?this.emit("error",t):this.emit(S),this;this[S]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(S),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),m=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[m];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[m]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[m]=="number"?this[zt]():this[at]()}get fd(){return this[m]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[m]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[m],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[m]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[m],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[m];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[m]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[m]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[m]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[m]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[m]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[m]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[m],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[m],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[m],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var un=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=un(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=mn(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},mn=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(t,e,i=!1){return new s(On(Tn(t),e),i)}},On=(s,t)=>t?Object.assign({},t,s):s,Tn=s=>s.replace(/\n$/,"").split(`
-`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),mt=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),y=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[mt]=!1;[y];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){this[$]||(this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1}))}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[y]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[y]===!1&&h)if(t.length<512)if(this[mt])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let a=this[mt];this[mt]=!1,this[y]=this[y]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[y].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[y].on("error",c=>{this[$]||this.abort(c)}),this[y].on("end",()=>{this[mt]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[y][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[y]?(this[le]+=t.length,this[y].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[mt]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[mt])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[y]?(t&&(this[le]+=t.length,this[y].write(t)),this[y].end()):(this[mt]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var ut=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(n=>[ut(n),!0])),i=s.filter,r=(n,o="")=>{let h=o||kn(n).root||".",a;if(n===h)a=!1;else{let l=e.get(n);a=l!==void 0?l:r(Fn(n),h)}return e.set(n,a),a};s.filter=i?(n,o)=>i(n,o)&&r(ut(n)):n=>r(ut(n))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import ui from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),ut(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new me(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new me(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new me(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var me=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),ue=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),ms=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),mi=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[mi];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[ue]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[mi]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[ue]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[ue]=!0,this[Ft](),i&&i(),this}write(t){if(this[ue])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";ui[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[ms](t){t.pending=!0,this[G]+=1,ui.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[ue]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[ms](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[mi](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[mi]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,ui[e](t.absolute))}[ms](t){this[fi](t,ui.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import m from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:mr,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,ur=!Er&&typeof mr=="number"?mr|Sr|wr|yr:null,us=ur!==null?()=>ur:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),S=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>S(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,S);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>S(null,E??void 0),S);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,S)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>ut(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",mo=1024,uo=(s,t)=>{if(!Te)return m.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");m.rename(s,e,i=>{if(i)return t(i);m.unlink(e,t)})},po=s=>{if(!Te)return m.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");m.renameSync(s,t),m.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:mo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:us(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&m.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&m.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&m.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;m.futimes(l,c,d,S=>S?m.utimes(a,c,d,T=>o(T&&S)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&m.fchown(l,c,d,S=>S?m.chown(a,c,d,T=>o(T&&S)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,m.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,m.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);m.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{m.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?m.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return m.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);uo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){m[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>m.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{m.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>m.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{m.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=m.openSync(String(t.absolute),us(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{m.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{m.futimesSync(n,a,l)}catch(c){try{m.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{m.fchownSync(n,Number(a),Number(l))}catch(c){try{m.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{m.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{m.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>m.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{m[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),S=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,S);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,S)};v.read(n,d,0,512,l,S)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,S)=>{if(d)return v.close(c,()=>o(d));i(c,S.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
+`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),ut=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),w=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[ut]=!1;[w];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){if(!this[$]){if(this[w]){let e=this[w];e.write=()=>!0,e.end=()=>e,e.emit=()=>!1,e.destroy?.()}this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1})}}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[w]===void 0||this.brotli===void 0&&this[w]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[w]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[w]=!1);let o=!1;if(this[w]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[w]===!1&&h)if(t.length<512)if(this[ut])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[w]===void 0||this[w]===!1&&(this.brotli||o)){let a=this[ut];this[ut]=!1,this[w]=this[w]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[w].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[w].on("error",c=>{this[$]||this.abort(c)}),this[w].on("end",()=>{this[ut]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[w][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[w]?(this[le]+=t.length,this[w].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[ut]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[ut])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[w]?(t&&(this[le]+=t.length,this[w].write(t)),this[w].end()):(this[ut]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var mt=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(o=>[mt(o),!0])),i=s.filter,r=100,n=(o,h="",a=0)=>{if(a>=r)return e.set(o,!1),!1;let l=h||kn(o).root||".",c;if(o===l)c=!1;else{let d=e.get(o);c=d!==void 0?d:n(Fn(o),l,a+1)}return e.set(o,c),c};s.filter=i?(o,h)=>i(o,h)&&n(mt(o)):o=>n(mt(o))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import mi from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),mt(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new ue(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new ue(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new ue(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ue=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),me=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),us=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),ui=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[ui];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[me]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[ui]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[me]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[me]=!0,this[Ft](),i&&i(),this}write(t){if(this[me])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";mi[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[us](t){t.pending=!0,this[G]+=1,mi.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[me]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[us](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[ui](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[ui]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,mi[e](t.absolute))}[us](t){this[fi](t,mi.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import u from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:ur,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,mr=!Er&&typeof ur=="number"?ur|Sr|wr|yr:null,ms=mr!==null?()=>mr:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),y=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>y(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,y);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>y(null,E??void 0),y);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,y)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>mt(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",uo=1024,mo=(s,t)=>{if(!Te)return u.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");u.rename(s,e,i=>{if(i)return t(i);u.unlink(e,t)})},po=s=>{if(!Te)return u.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");u.renameSync(s,t),u.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:uo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:ms(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&u.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&u.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&u.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;u.futimes(l,c,d,y=>y?u.utimes(a,c,d,T=>o(T&&y)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&u.fchown(l,c,d,y=>y?u.chown(a,c,d,T=>o(T&&y)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,u.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,u.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);u.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{u.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?u.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return u.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);mo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){u[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>u.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{u.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>u.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{u.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=u.openSync(String(t.absolute),ms(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{u.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{u.futimesSync(n,a,l)}catch(c){try{u.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{u.fchownSync(n,Number(a),Number(l))}catch(c){try{u.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{u.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{u.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>u.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{u[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),y=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,y);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,y)};v.read(n,d,0,512,l,y)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,y)=>{if(d)return v.close(c,()=>o(d));i(c,y.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/esm/list.js b/deps/npm/node_modules/tar/dist/esm/list.js
index 4c3af58192ec..08bdbe4ad85c 100644
--- a/deps/npm/node_modules/tar/dist/esm/list.js
+++ b/deps/npm/node_modules/tar/dist/esm/list.js
@@ -20,14 +20,22 @@ const onReadEntryFunction = (opt) => {
 export const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [stripTrailingSlashes(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || parse(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas(dirname(file), root);
+            ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/esm/parse.js b/deps/npm/node_modules/tar/dist/esm/parse.js
index fb303a5171be..92add3a903fd 100644
--- a/deps/npm/node_modules/tar/dist/esm/parse.js
+++ b/deps/npm/node_modules/tar/dist/esm/parse.js
@@ -373,6 +373,16 @@ export class Parser extends EE {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/package.json b/deps/npm/node_modules/tar/package.json
index 9d082e440494..f19ece377d9d 100644
--- a/deps/npm/node_modules/tar/package.json
+++ b/deps/npm/node_modules/tar/package.json
@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.19",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"
diff --git a/deps/npm/node_modules/undici/lib/core/request.js b/deps/npm/node_modules/undici/lib/core/request.js
index 4da60667ec29..8e7ecc73084b 100644
--- a/deps/npm/node_modules/undici/lib/core/request.js
+++ b/deps/npm/node_modules/undici/lib/core/request.js
@@ -350,7 +350,13 @@ function processHeader (request, key, val) {
       } else if (typeof val[i] === 'object') {
         throw new InvalidArgumentError(`invalid ${key} header`)
       } else {
-        arr.push(`${val[i]}`)
+        // Coerce primitives (and reject unsafe coercions such as functions
+        // with a crafted toString/Symbol.toPrimitive).
+        const str = `${val[i]}`
+        if (!isValidHeaderValue(str)) {
+          throw new InvalidArgumentError(`invalid ${key} header`)
+        }
+        arr.push(str)
       }
     }
     val = arr
@@ -361,7 +367,12 @@ function processHeader (request, key, val) {
   } else if (val === null) {
     val = ''
   } else {
+    // Coerce primitives (and reject unsafe coercions such as functions
+    // with a crafted toString/Symbol.toPrimitive).
     val = `${val}`
+    if (!isValidHeaderValue(val)) {
+      throw new InvalidArgumentError(`invalid ${key} header`)
+    }
   }
 
   if (headerName === 'host') {
diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
index 9455517a19b1..a801ecb36046 100644
--- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
+++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
@@ -10,6 +10,7 @@ const {
   RequestContentLengthMismatchError,
   ResponseContentLengthMismatchError,
   RequestAbortedError,
+  InvalidArgumentError,
   HeadersTimeoutError,
   HeadersOverflowError,
   SocketError,
@@ -993,8 +994,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }
 
   if (body && typeof body.read === 'function') {
diff --git a/deps/npm/node_modules/undici/lib/handler/retry-handler.js b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
index 5d1ccf005387..c62a2409f3ae 100644
--- a/deps/npm/node_modules/undici/lib/handler/retry-handler.js
+++ b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
@@ -15,6 +15,28 @@ function calculateRetryAfterHeader (retryAfter) {
   return new Date(retryAfter).getTime() - current
 }
 
+function validatePartialResponseContentLength (headers, range, statusCode, retryCount) {
+  const contentLength = headers['content-length']
+  if (contentLength == null) {
+    return null
+  }
+
+  if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+    return null
+  }
+
+  const length = Number(contentLength)
+  const expectedLength = range.end - range.start + 1
+  if (!Number.isFinite(length) || length !== expectedLength) {
+    return new RequestRetryError('Content-Length mismatch', statusCode, {
+      headers,
+      data: { count: retryCount }
+    })
+  }
+
+  return null
+}
+
 class RetryHandler {
   constructor (opts, handlers) {
     const { retryOptions, ...dispatchOpts } = opts
@@ -229,6 +251,12 @@ class RetryHandler {
         return false
       }
 
+      const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount)
+      if (contentLengthError != null) {
+        this.abort(contentLengthError)
+        return false
+      }
+
       const { start, size, end = size - 1 } = contentRange
 
       assert(this.start === start, 'content-range mismatch')
@@ -252,6 +280,12 @@ class RetryHandler {
           )
         }
 
+        const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount)
+        if (contentLengthError != null) {
+          this.abort(contentLengthError)
+          return false
+        }
+
         const { start, size, end = size - 1 } = range
         assert(
           start != null && Number.isFinite(start),
diff --git a/deps/npm/node_modules/undici/lib/web/cookies/util.js b/deps/npm/node_modules/undici/lib/web/cookies/util.js
index 254f5419e905..ca408e153abb 100644
--- a/deps/npm/node_modules/undici/lib/web/cookies/util.js
+++ b/deps/npm/node_modules/undici/lib/web/cookies/util.js
@@ -105,7 +105,7 @@ function validateCookiePath (path) {
 
     if (
       code < 0x20 || // exclude CTLs (0-31)
-      code === 0x7F || // DEL
+      code > 0x7E || // exclude DEL and non-ascii
       code === 0x3B // ;
     ) {
       throw new Error('Invalid cookie path')
@@ -114,16 +114,80 @@ function validateCookiePath (path) {
 }
 
 /**
- * I have no idea why these values aren't allowed to be honest,
- * but Deno tests these. - Khafra
+ * <let-dig> ::= <letter> | <digit>
+ *
+ * <letter> ::= any one of the 52 alphabetic characters A through Z in
+ * upper case and a through z in lower case
+ *
+ * <digit> ::= any one of the ten digits 0 through 9r
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @param {number} code
+ */
+function isLetterOrDigit (code) {
+  return (
+    (code >= 0x30 && code <= 0x39) || // 0-9
+    (code >= 0x41 && code <= 0x5A) || // A-Z
+    (code >= 0x61 && code <= 0x7A) // a-z
+  )
+}
+
+/**
+ * Validates a cookie domain against the "preferred name syntax".
+ *
+ * <domain>      ::= <subdomain> | " "
+ * <subdomain>   ::= <label> | <subdomain> "." <label>
+ * <label>       ::= <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ * <ldh-str>     ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp> ::= <let-dig> | "-"
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @see https://www.rfc-editor.org/rfc/rfc1123#section-2.1
+ * @see https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4
  * @param {string} domain
  */
 function validateCookieDomain (domain) {
-  if (
-    domain.startsWith('-') ||
-    domain.endsWith('.') ||
-    domain.endsWith('-')
-  ) {
+  // <domain> ::= <subdomain> | " "
+  if (domain === ' ') {
+    return
+  }
+
+  if (domain.length > 255) {
+    throw new Error('Invalid cookie domain')
+  }
+
+  let labelLength = 0
+
+  for (let i = 0; i < domain.length; ++i) {
+    const code = domain.charCodeAt(i)
+
+    if (code === 0x2E) {
+      if (labelLength === 0) {
+        throw new Error('Invalid cookie domain')
+      }
+
+      if (domain.charCodeAt(i - 1) === 0x2D) { // "-"
+        throw new Error('Invalid cookie domain')
+      }
+
+      labelLength = 0
+      continue
+    }
+
+    if (labelLength === 0 && !isLetterOrDigit(code)) {
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (!isLetterOrDigit(code) && code !== 0x2D) { // "-"
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (++labelLength > 63) {
+      throw new Error('Invalid cookie domain')
+    }
+  }
+
+  if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 0x2D) { // "-"
     throw new Error('Invalid cookie domain')
   }
 }
@@ -266,7 +330,13 @@ function stringify (cookie) {
 
     const [key, ...value] = part.split('=')
 
-    out.push(`${key.trim()}=${value.join('=')}`)
+    const trimmedKey = key.trim()
+    const joinedValue = value.join('=')
+
+    validateCookieName(trimmedKey)
+    validateCookieValue(joinedValue)
+
+    out.push(`${trimmedKey}=${joinedValue}`)
   }
 
   return out.join('; ')
diff --git a/deps/npm/node_modules/undici/package.json b/deps/npm/node_modules/undici/package.json
index 3c2001f391e3..cd46deca2448 100644
--- a/deps/npm/node_modules/undici/package.json
+++ b/deps/npm/node_modules/undici/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "6.27.0",
+  "version": "6.28.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
diff --git a/deps/npm/package.json b/deps/npm/package.json
index 5ce61281a2b0..a67f34569558 100644
--- a/deps/npm/package.json
+++ b/deps/npm/package.json
@@ -1,5 +1,5 @@
 {
-  "version": "11.19.0",
+  "version": "11.19.1",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -81,7 +81,7 @@
     "libnpmexec": "^10.3.2",
     "libnpmfund": "^7.0.26",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.12",
+    "libnpmpack": "^9.1.13",
     "libnpmpublish": "^11.2.0",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",
@@ -110,7 +110,7 @@
     "spdx-expression-parse": "^4.0.0",
     "ssri": "^13.0.1",
     "supports-color": "^10.2.2",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^2.0.2",
     "treeverse": "^3.0.0",
diff --git a/deps/npm/test/lib/commands/pack.js b/deps/npm/test/lib/commands/pack.js
index 9805427de4f6..21d961ebef6e 100644
--- a/deps/npm/test/lib/commands/pack.js
+++ b/deps/npm/test/lib/commands/pack.js
@@ -113,6 +113,25 @@ t.test('dry run', async t => {
   t.throws(() => fs.statSync(path.resolve(npm.prefix, filename)))
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry run with allow-directory=${allowDirectory}`, async t => {
+    const { npm, outputs } = await loadMockNpm(t, {
+      prefixDir: {
+        'package.json': JSON.stringify({
+          name: 'test-package',
+          version: '1.0.0',
+        }),
+      },
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+      },
+    })
+    await npm.exec('pack', [])
+    t.strictSame(outputs, ['test-package-1.0.0.tgz'])
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { npm, outputs, logs } = await loadMockNpm(t, {
     prefixDir: {
diff --git a/deps/npm/test/lib/commands/publish.js b/deps/npm/test/lib/commands/publish.js
index b204f7452a65..98576b08ea30 100644
--- a/deps/npm/test/lib/commands/publish.js
+++ b/deps/npm/test/lib/commands/publish.js
@@ -151,6 +151,25 @@ t.test('dry-run', async t => {
   t.matchSnapshot(logs.notice)
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry-run with allow-directory=${allowDirectory}`, async t => {
+    const { joinedOutput, npm, registry } = await loadNpmWithRegistry(t, {
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+        ...auth,
+      },
+      prefixDir: {
+        'package.json': JSON.stringify(pkgJson, null, 2),
+      },
+      authorization: token,
+    })
+    registry.publish(pkg, { noPut: true })
+    await npm.exec('publish', [])
+    t.equal(joinedOutput(), `+ ${pkg}@1.0.0`)
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { outputs, npm, logs, registry } = await loadNpmWithRegistry(t, {
     config: {
diff --git a/deps/openssl/config/archs/BSD-x86/asm/configdata.pm b/deps/openssl/config/archs/BSD-x86/asm/configdata.pm
index 342baff185b4..794e2fbadfc0 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -230,7 +230,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -289,11 +289,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2255,6 +2255,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2291,6 +2294,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4949,6 +4955,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4985,6 +4994,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16437,6 +16461,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16449,6 +16474,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18560,6 +18586,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18572,6 +18599,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h
index 8fb459eda8aa..ad498bcd8698 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Wed Jun 17 17:24:13 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:29 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm b/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm
index 8da34b75ff22..6a5d9a71556e 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -230,7 +230,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -289,11 +289,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2255,6 +2255,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2291,6 +2294,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4949,6 +4955,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4985,6 +4994,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16437,6 +16461,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16449,6 +16474,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18560,6 +18586,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18572,6 +18599,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h
index aaf1250c2eb9..886d18c40c7a 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Wed Jun 17 17:24:28 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:44 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm b/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm
index 1abbedbdd1f2..594e50c9e1dd 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -229,7 +229,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -289,11 +289,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2197,6 +2197,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2233,6 +2236,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4891,6 +4897,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4927,6 +4936,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11230,6 +11242,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11266,6 +11281,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13924,6 +13942,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13960,6 +13981,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16357,6 +16381,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16369,6 +16394,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18477,6 +18503,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18489,6 +18516,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h
index 7194e465d77f..ffb93d229d90 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Wed Jun 17 17:24:40 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:58 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm
index 85988b43ff28..419e74c894d5 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -230,7 +230,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -289,11 +289,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86_64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2262,6 +2262,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2298,6 +2301,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4956,6 +4962,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4992,6 +5001,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11367,6 +11379,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11403,6 +11418,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14061,6 +14079,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14097,6 +14118,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16494,6 +16518,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16506,6 +16531,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18617,6 +18643,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18629,6 +18656,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h
index 90c939e43e74..53b792b74d2a 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Wed Jun 17 17:24:50 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:45:12 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm
index 0a29d771007c..e9b4820b24d3 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -230,7 +230,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -289,11 +289,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86_64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2262,6 +2262,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2298,6 +2301,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4956,6 +4962,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4992,6 +5001,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11367,6 +11379,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11403,6 +11418,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14061,6 +14079,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14097,6 +14118,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16494,6 +16518,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16506,6 +16531,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18617,6 +18643,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18629,6 +18656,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h
index 3844ec592bb9..9ead0cd60d51 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Wed Jun 17 17:25:05 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:45:34 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm
index 228a341abe41..22ca6435e306 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -229,7 +229,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -289,11 +289,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86_64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2198,6 +2198,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2234,6 +2237,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4892,6 +4898,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4928,6 +4937,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11231,6 +11243,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11267,6 +11282,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13925,6 +13943,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13961,6 +13982,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16358,6 +16382,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16370,6 +16395,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18478,6 +18504,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18490,6 +18517,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h
index 12358c812fdd..10b8da56e43e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Wed Jun 17 17:25:17 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:45:51 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm b/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm
index 80bcccf1ac5f..878ab12b42ec 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm
@@ -179,7 +179,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -241,7 +241,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -300,11 +300,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN32",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -319,7 +319,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x562840350400)",
+    "RANLIB" => "CODE(0x557949e58080)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2297,6 +2297,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2333,6 +2336,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4991,6 +4997,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -5027,6 +5036,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11362,6 +11374,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11398,6 +11413,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14056,6 +14074,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14092,6 +14113,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16505,6 +16529,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16517,6 +16542,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18634,6 +18660,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18646,6 +18673,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h
index b911d0bf0f48..7d155abc0f17 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Wed Jun 17 17:32:43 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:57:17 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm b/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm
index 187188b3bbeb..1d364782e66c 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm
@@ -179,7 +179,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -241,7 +241,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -300,11 +300,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN32",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -319,7 +319,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x5cdb439ab740)",
+    "RANLIB" => "CODE(0x5638823c9d80)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2297,6 +2297,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2333,6 +2336,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4991,6 +4997,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -5027,6 +5036,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11362,6 +11374,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11398,6 +11413,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14056,6 +14074,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14092,6 +14113,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16505,6 +16529,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16517,6 +16542,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18634,6 +18660,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18646,6 +18673,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h
index 75e1b25e955b..12162fc406ed 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Wed Jun 17 17:32:51 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:57:30 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm
index 008cef87f42b..6fbad93147c4 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm
@@ -177,7 +177,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -240,7 +240,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -300,11 +300,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN32",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -319,7 +319,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x5d62f9217618)",
+    "RANLIB" => "CODE(0x5602eb82b768)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2239,6 +2239,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2275,6 +2278,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4933,6 +4939,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4969,6 +4978,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11282,6 +11294,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11318,6 +11333,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13976,6 +13994,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14012,6 +14033,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16425,6 +16449,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16437,6 +16462,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18551,6 +18577,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18563,6 +18590,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h
index d1043a5a91ce..1076ee612fc8 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Wed Jun 17 17:33:00 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:57:43 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm
index c141dc5f2515..f70c0340bbfc 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm
@@ -177,7 +177,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -238,7 +238,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -298,11 +298,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64-ARM",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -315,7 +315,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x64360b888a98)",
+    "RANLIB" => "CODE(0x56183358b738)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2231,6 +2231,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2267,6 +2270,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4925,6 +4931,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4961,6 +4970,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11274,6 +11286,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11310,6 +11325,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13968,6 +13986,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14004,6 +14025,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16417,6 +16441,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16429,6 +16454,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18543,6 +18569,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18555,6 +18582,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h
index b23392930c57..bfad73d12312 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: VC-WIN64-ARM"
-#define DATE "built on: Wed Jun 17 17:33:08 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:57:55 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm
index 3705788690f3..3134fb366bd3 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm
@@ -181,7 +181,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -243,7 +243,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -302,11 +302,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64A",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -321,7 +321,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x5a2068d5ea10)",
+    "RANLIB" => "CODE(0x5592d548ade0)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2306,6 +2306,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2342,6 +2345,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -5000,6 +5006,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -5036,6 +5045,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11411,6 +11423,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11447,6 +11462,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14105,6 +14123,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14141,6 +14162,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16554,6 +16578,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16566,6 +16591,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18683,6 +18709,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18695,6 +18722,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h
index 506df0c1ddd6..705ec9d68ae9 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Wed Jun 17 17:32:08 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:56:25 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm
index cd968483272e..7d5bd45a75ea 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm
@@ -181,7 +181,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -243,7 +243,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -302,11 +302,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64A",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -321,7 +321,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x5d5b7ba1e5b0)",
+    "RANLIB" => "CODE(0x55f18d21c250)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2306,6 +2306,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2342,6 +2345,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -5000,6 +5006,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -5036,6 +5045,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11411,6 +11423,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11447,6 +11462,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14105,6 +14123,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14141,6 +14162,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16554,6 +16578,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16566,6 +16591,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18683,6 +18709,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18695,6 +18722,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h
index 4d7faba72e21..4de5fe8cb9d3 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Wed Jun 17 17:32:21 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:56:45 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm
index 492610f4d3a4..d59c1907066e 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm
@@ -179,7 +179,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -242,7 +242,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -302,11 +302,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64A",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "lib",
@@ -321,7 +321,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x604cad97f898)",
+    "RANLIB" => "CODE(0x562b96496f28)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -2242,6 +2242,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2278,6 +2281,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4936,6 +4942,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4972,6 +4981,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11285,6 +11297,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11321,6 +11336,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13979,6 +13997,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14015,6 +14036,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16428,6 +16452,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16440,6 +16465,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18554,6 +18580,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18566,6 +18593,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h
index 181d4009e5ba..501ff4ff3cea 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Wed Jun 17 17:32:34 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:57:05 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h
index 2ffd28f17e80..5baff3e0aff8 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h
index 0e7eb9dfb947..0614d70ba587 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm
index 68b9777e535f..1813e7209f1e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "aix64-gcc-as",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar -X64",
@@ -2238,6 +2238,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2274,6 +2277,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4932,6 +4938,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4968,6 +4977,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16437,6 +16461,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16449,6 +16474,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18560,6 +18586,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18572,6 +18599,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h
index 49891a932261..450ad65f9999 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: aix64-gcc-as"
-#define DATE "built on: Wed Jun 17 17:23:40 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:43:47 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm
index 67f115d1e503..dd38a916ea8a 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "aix64-gcc-as",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar -X64",
@@ -2238,6 +2238,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2274,6 +2277,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4932,6 +4938,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4968,6 +4977,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16437,6 +16461,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16449,6 +16474,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18560,6 +18586,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18572,6 +18599,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h
index 2459c161c06b..40dc642f2c0a 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: aix64-gcc-as"
-#define DATE "built on: Wed Jun 17 17:23:50 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:02 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm
index 7515010ba0f6..bf64eea2a7a4 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -232,7 +232,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "aix64-gcc-as",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar -X64",
@@ -2201,6 +2201,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2237,6 +2240,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4895,6 +4901,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4931,6 +4940,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11233,6 +11245,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11269,6 +11284,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13927,6 +13945,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13963,6 +13984,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16360,6 +16384,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16372,6 +16397,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18480,6 +18506,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18492,6 +18519,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h
index 1de51d59c916..e709d7858d94 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: aix64-gcc-as"
-#define DATE "built on: Wed Jun 17 17:24:01 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:16 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm
index c68598a373e0..8fde2f3d2912 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin-i386-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2258,6 +2258,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2294,6 +2297,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4952,6 +4958,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4988,6 +4997,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11303,6 +11315,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11339,6 +11354,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13997,6 +14015,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14033,6 +14054,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16416,6 +16440,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16428,6 +16453,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18531,6 +18557,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18543,6 +18570,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h
index 3015418c1d9b..488900f6e0de 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin-i386-cc"
-#define DATE "built on: Wed Jun 17 17:26:03 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:46:57 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm
index 89949092c2ad..0541cb93d1be 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin-i386-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2258,6 +2258,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2294,6 +2297,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4952,6 +4958,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4988,6 +4997,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11303,6 +11315,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11339,6 +11354,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13997,6 +14015,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14033,6 +14054,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16416,6 +16440,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16428,6 +16453,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18531,6 +18557,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18543,6 +18570,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h
index 674284362932..cfa0ce918396 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin-i386-cc"
-#define DATE "built on: Wed Jun 17 17:26:13 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:47:11 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm
index d367beb1611f..acc9d54be8c3 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -232,7 +232,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin-i386-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2200,6 +2200,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2236,6 +2239,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4894,6 +4900,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4930,6 +4939,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11223,6 +11235,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11259,6 +11274,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13917,6 +13935,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13953,6 +13974,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16336,6 +16360,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16348,6 +16373,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18448,6 +18474,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18460,6 +18487,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h
index 7fe0a213ae12..6971a07efd48 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin-i386-cc"
-#define DATE "built on: Wed Jun 17 17:26:23 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:47:25 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm
index 18e72b570827..c7b46331864a 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-arm64-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2248,6 +2248,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2284,6 +2287,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4942,6 +4948,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4978,6 +4987,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16423,6 +16447,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16435,6 +16460,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18640,6 +18666,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18652,6 +18679,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h
index d7ac04051dbb..e0599efb87c1 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-arm64-cc"
-#define DATE "built on: Wed Jun 17 17:26:32 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:47:38 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm
index b1b88d9f599f..b730f8b849ec 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-arm64-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2248,6 +2248,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2284,6 +2287,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4942,6 +4948,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4978,6 +4987,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16423,6 +16447,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16435,6 +16460,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18640,6 +18666,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18652,6 +18679,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h
index b7112ce03232..bf9b895cd76d 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-arm64-cc"
-#define DATE "built on: Wed Jun 17 17:26:43 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:47:53 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm
index ec97bafcbf5a..9711ee2febde 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -232,7 +232,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-arm64-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2200,6 +2200,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2236,6 +2239,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4894,6 +4900,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4930,6 +4939,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11223,6 +11235,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11259,6 +11274,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13917,6 +13935,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13953,6 +13974,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16336,6 +16360,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16348,6 +16373,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18448,6 +18474,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18460,6 +18487,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h
index 047c02b588f6..54a77bc2e6d1 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-arm64-cc"
-#define DATE "built on: Wed Jun 17 17:26:53 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:48:08 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm
index 6d2119f88862..78fbe9eec829 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-x86_64-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2264,6 +2264,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2300,6 +2303,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4958,6 +4964,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4994,6 +5003,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11359,6 +11371,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11395,6 +11410,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14053,6 +14071,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14089,6 +14110,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16472,6 +16496,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16484,6 +16509,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18587,6 +18613,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18599,6 +18626,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h
index 88213c33f1ee..ad100b5e3b1e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-x86_64-cc"
-#define DATE "built on: Wed Jun 17 17:25:26 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:46:05 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm
index ad77cb194c39..22291b6d0589 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-x86_64-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2264,6 +2264,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2300,6 +2303,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4958,6 +4964,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4994,6 +5003,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11359,6 +11371,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11395,6 +11410,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14053,6 +14071,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14089,6 +14110,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16472,6 +16496,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16484,6 +16509,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18587,6 +18613,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18599,6 +18626,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h
index d90eb97468f8..877b8f3a9121 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-x86_64-cc"
-#define DATE "built on: Wed Jun 17 17:25:41 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:46:26 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm
index dda82537bfc0..72197afbd741 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -232,7 +232,7 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -292,11 +292,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-x86_64-cc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2200,6 +2200,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2236,6 +2239,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4894,6 +4900,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4930,6 +4939,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11223,6 +11235,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11259,6 +11274,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13917,6 +13935,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13953,6 +13974,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16336,6 +16360,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16348,6 +16373,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18448,6 +18474,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18460,6 +18487,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h
index 6a5fce0c7151..3e9a7c66a960 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-x86_64-cc"
-#define DATE "built on: Wed Jun 17 17:25:54 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:46:44 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm b/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm
index 53580a00c598..19517b687bd0 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-aarch64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2254,6 +2254,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2290,6 +2293,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4948,6 +4954,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4984,6 +4993,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11325,6 +11337,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11361,6 +11376,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14019,6 +14037,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14055,6 +14076,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16452,6 +16476,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16464,6 +16489,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18677,6 +18703,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18689,6 +18716,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h
index 2c0d5e189850..76d4bb155478 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-aarch64"
-#define DATE "built on: Wed Jun 17 17:27:02 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:48:21 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm
index 35e13b93a44a..0c9c2f5403d8 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-aarch64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2254,6 +2254,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2290,6 +2293,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4948,6 +4954,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4984,6 +4993,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11325,6 +11337,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11361,6 +11376,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14019,6 +14037,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14055,6 +14076,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16452,6 +16476,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16464,6 +16489,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18677,6 +18703,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18689,6 +18716,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h
index 8ce8f7ee252d..edbc7ece42d0 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-aarch64"
-#define DATE "built on: Wed Jun 17 17:27:13 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:48:36 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm b/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm
index 5bcdf446bc82..d133979cc3cc 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-aarch64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2206,6 +2206,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2242,6 +2245,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4900,6 +4906,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4936,6 +4945,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11238,6 +11250,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11274,6 +11289,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13932,6 +13950,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13968,6 +13989,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16365,6 +16389,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16377,6 +16402,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18485,6 +18511,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18497,6 +18524,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h
index 9cc4269f8e23..a5b1c96dccdb 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-aarch64"
-#define DATE "built on: Wed Jun 17 17:27:23 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:48:50 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-armv4/asm/configdata.pm b/deps/openssl/config/archs/linux-armv4/asm/configdata.pm
index 1039d43c9ffd..3534d799e04e 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-armv4/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-armv4",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2246,6 +2246,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2282,6 +2285,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4940,6 +4946,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4976,6 +4985,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11303,6 +11315,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11339,6 +11354,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13997,6 +14015,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14033,6 +14054,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16430,6 +16454,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16442,6 +16467,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18637,6 +18663,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18649,6 +18676,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h
index 5b6eb7fc345d..0088f27d20aa 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-armv4"
-#define DATE "built on: Wed Jun 17 17:27:32 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:49:04 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm
index b894c96a36ab..4382ec4ff6f8 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-armv4",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2246,6 +2246,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2282,6 +2285,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4940,6 +4946,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4976,6 +4985,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11303,6 +11315,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11339,6 +11354,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13997,6 +14015,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14033,6 +14054,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16430,6 +16454,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16442,6 +16467,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18637,6 +18663,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18649,6 +18676,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h
index bfca03890a51..694d5dd4bce1 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-armv4"
-#define DATE "built on: Wed Jun 17 17:27:42 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:49:18 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm b/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm
index 965dcc5e2322..48297dc7b2ba 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-armv4",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2206,6 +2206,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2242,6 +2245,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4900,6 +4906,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4936,6 +4945,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11238,6 +11250,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11274,6 +11289,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13932,6 +13950,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13968,6 +13989,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16365,6 +16389,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16377,6 +16402,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18485,6 +18511,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18497,6 +18524,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h
index 87edc618bf22..70714ad7ccc9 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-armv4"
-#define DATE "built on: Wed Jun 17 17:27:52 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:49:32 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-elf/asm/configdata.pm b/deps/openssl/config/archs/linux-elf/asm/configdata.pm
index a0dc413841aa..bbf0dd64cf3a 100644
--- a/deps/openssl/config/archs/linux-elf/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-elf/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-elf",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2263,6 +2263,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2299,6 +2302,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4957,6 +4963,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4993,6 +5002,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11317,6 +11329,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11353,6 +11368,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14011,6 +14029,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14047,6 +14068,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16444,6 +16468,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16456,6 +16481,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18567,6 +18593,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18579,6 +18606,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h
index b36a4c6ed908..3060d629350a 100644
--- a/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-elf"
-#define DATE "built on: Wed Jun 17 17:28:02 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:49:45 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm
index a57f3f37e757..5acf92d026dc 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-elf",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2263,6 +2263,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2299,6 +2302,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4957,6 +4963,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4993,6 +5002,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11317,6 +11329,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11353,6 +11368,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14011,6 +14029,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14047,6 +14068,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16444,6 +16468,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16456,6 +16481,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18567,6 +18593,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18579,6 +18606,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h
index 0fbc959d01b0..e86d4f39b307 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-elf"
-#define DATE "built on: Wed Jun 17 17:28:12 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:50:00 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm b/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm
index 249f67471a85..de38e67b0756 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-elf",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2205,6 +2205,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2241,6 +2244,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4899,6 +4905,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4935,6 +4944,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11237,6 +11249,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11273,6 +11288,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13931,6 +13949,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13967,6 +13988,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16364,6 +16388,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16376,6 +16401,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18484,6 +18510,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18496,6 +18523,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h
index 1bf2e2f40ee5..f47815f86eb1 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-elf"
-#define DATE "built on: Wed Jun 17 17:28:23 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:50:14 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm
index 2bf558c9f1aa..863432756e7c 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-ppc64le",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2243,6 +2243,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2279,6 +2282,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4937,6 +4943,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4973,6 +4982,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11318,6 +11330,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11354,6 +11369,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14012,6 +14030,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14048,6 +14069,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16445,6 +16469,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16457,6 +16482,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18568,6 +18594,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18580,6 +18607,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h
index ca635890a4e8..ad73a66a551b 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-ppc64le"
-#define DATE "built on: Wed Jun 17 17:29:08 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:51:20 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm
index 026b0728c464..e541e8d3eb5d 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-ppc64le",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2243,6 +2243,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2279,6 +2282,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4937,6 +4943,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4973,6 +4982,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11318,6 +11330,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11354,6 +11369,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14012,6 +14030,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14048,6 +14069,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16445,6 +16469,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16457,6 +16482,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18568,6 +18594,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18580,6 +18607,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h
index d9eab19ca46c..78b4fa43f2da 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-ppc64le"
-#define DATE "built on: Wed Jun 17 17:29:18 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:51:35 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm
index cf9b991eb823..5a93fb38646e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-ppc64le",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2206,6 +2206,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2242,6 +2245,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4900,6 +4906,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4936,6 +4945,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11238,6 +11250,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11274,6 +11289,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13932,6 +13950,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13968,6 +13989,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16365,6 +16389,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16377,6 +16402,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18485,6 +18511,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18497,6 +18524,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h
index f05cfd182212..7ac124b79570 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-ppc64le"
-#define DATE "built on: Wed Jun 17 17:29:28 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:51:49 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm b/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm
index 62de96113048..f1817b2e9fdf 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-x86_64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2271,6 +2271,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2307,6 +2310,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4965,6 +4971,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -5001,6 +5010,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11375,6 +11387,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11411,6 +11426,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14069,6 +14087,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14105,6 +14126,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16502,6 +16526,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16514,6 +16539,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18625,6 +18651,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18637,6 +18664,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h
index 1f31e3e4f1b3..c2e696451484 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-x86_64"
-#define DATE "built on: Wed Jun 17 17:28:32 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:50:28 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm
index a52b4ec774f2..4b2823833816 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-x86_64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2271,6 +2271,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2307,6 +2310,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4965,6 +4971,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -5001,6 +5010,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11375,6 +11387,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11411,6 +11426,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14069,6 +14087,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14105,6 +14126,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16502,6 +16526,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16514,6 +16539,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18625,6 +18651,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18637,6 +18664,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h
index 182f8f215900..73438ec9c159 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-x86_64"
-#define DATE "built on: Wed Jun 17 17:28:47 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:50:50 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm b/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm
index b06017d24af8..0e809e3b15ca 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-x86_64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2207,6 +2207,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2243,6 +2246,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4901,6 +4907,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4937,6 +4946,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11239,6 +11251,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11275,6 +11290,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13933,6 +13951,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13969,6 +13990,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16366,6 +16390,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16378,6 +16403,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18486,6 +18512,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18498,6 +18525,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h
index 484fde68a038..808eaf319cc3 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-x86_64"
-#define DATE "built on: Wed Jun 17 17:28:59 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:51:07 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm b/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm
index 1ca1ae6b921f..a8198c6bb7e7 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux32-s390x",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2253,6 +2253,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2289,6 +2292,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4947,6 +4953,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4983,6 +4992,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11301,6 +11313,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11337,6 +11352,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13995,6 +14013,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14031,6 +14052,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16428,6 +16452,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16440,6 +16465,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18605,6 +18631,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18617,6 +18644,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h
index f3dda714dde6..2aef9d8766f6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux32-s390x"
-#define DATE "built on: Wed Jun 17 17:29:37 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:52:02 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm
index b3f1fb9ba076..0ff37a363aa6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux32-s390x",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2253,6 +2253,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2289,6 +2292,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4947,6 +4953,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4983,6 +4992,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11301,6 +11313,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11337,6 +11352,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13995,6 +14013,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14031,6 +14052,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16428,6 +16452,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16440,6 +16465,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18605,6 +18631,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18617,6 +18644,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h
index 068dfd372cef..0bae9c825baf 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux32-s390x"
-#define DATE "built on: Wed Jun 17 17:29:47 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:52:17 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm b/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm
index e4ce267208cc..5968eb75b569 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux32-s390x",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2206,6 +2206,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2242,6 +2245,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4900,6 +4906,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4936,6 +4945,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11238,6 +11250,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11274,6 +11289,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13932,6 +13950,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13968,6 +13989,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16365,6 +16389,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16377,6 +16402,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18485,6 +18511,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18497,6 +18524,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h
index 38d1d5cc558f..3b7b6bb8692f 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux32-s390x"
-#define DATE "built on: Wed Jun 17 17:29:56 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:52:31 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm
index fd88a5822293..04b12ee98c38 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-loongarch64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2206,6 +2206,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2242,6 +2245,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4900,6 +4906,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4936,6 +4945,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11238,6 +11250,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11274,6 +11289,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13932,6 +13950,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13968,6 +13989,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16365,6 +16389,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16377,6 +16402,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18485,6 +18511,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18497,6 +18524,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h
index 5e6994fc6589..bd7564e8b5d2 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-loongarch64"
-#define DATE "built on: Wed Jun 17 17:33:25 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:58:07 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm b/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm
index 7e6e333b58fa..0afc617fcb7f 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm
@@ -177,7 +177,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -237,7 +237,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -296,11 +296,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-mips64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2231,6 +2231,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2267,6 +2270,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4925,6 +4931,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4961,6 +4970,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11272,6 +11284,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11308,6 +11323,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13966,6 +13984,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14002,6 +14023,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16399,6 +16423,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16411,6 +16436,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18561,6 +18587,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18573,6 +18600,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h
index 933e0c3ad0f4..f8c3ede48432 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-mips64"
-#define DATE "built on: Wed Jun 17 17:30:34 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:53:26 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm
index 44828e7e436f..fd7c115b97c5 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm
@@ -177,7 +177,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -237,7 +237,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -296,11 +296,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-mips64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2231,6 +2231,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2267,6 +2270,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4925,6 +4931,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4961,6 +4970,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11272,6 +11284,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11308,6 +11323,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13966,6 +13984,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14002,6 +14023,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16399,6 +16423,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16411,6 +16436,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18561,6 +18587,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18573,6 +18600,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h
index 0ce75e6089a5..1f69f13c454d 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-mips64"
-#define DATE "built on: Wed Jun 17 17:30:44 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:53:40 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm
index f5aff4b52e69..07db97ab6049 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-mips64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2207,6 +2207,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2243,6 +2246,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4901,6 +4907,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4937,6 +4946,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11239,6 +11251,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11275,6 +11290,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13933,6 +13951,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13969,6 +13990,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16366,6 +16390,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16378,6 +16403,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18486,6 +18512,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18498,6 +18525,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h
index 7ae8f2df59e6..6249246a84b4 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-mips64"
-#define DATE "built on: Wed Jun 17 17:30:53 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:53:53 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm
index 4431f75a1afd..f65899375e22 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-riscv64/asm/configdata.pm
@@ -18,7 +18,6 @@ our %config = (
     "ARFLAGS" => [
         "qc"
     ],
-    "AS" => "as",
     "ASFLAGS" => [],
     "CC" => "gcc",
     "CFLAGS" => [
@@ -34,7 +33,6 @@ our %config = (
     "FIPSKEY" => "f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813",
     "FIPS_VENDOR" => "OpenSSL FIPS Provider",
     "HASHBANGPERL" => "/usr/bin/env perl",
-    "LD" => "ld",
     "LDFLAGS" => [],
     "LDLIBS" => [],
     "OBJCOPY" => "objcopy",
@@ -176,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -236,10 +234,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
-    "perl_archname" => "x86_64-linux-thread-multi",
+    "patch" => "8",
+    "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.42.2",
+    "perl_version" => "5.34.0",
     "perlargv" => [
         "no-tests",
         "no-shared",
@@ -255,9 +253,9 @@ our %config = (
         "linux64-riscv64"
     ],
     "perlenv" => {
-        "AR" => "ar",
+        "AR" => undef,
         "ARFLAGS" => undef,
-        "AS" => "as",
+        "AS" => undef,
         "ASFLAGS" => undef,
         "BUILDFILE" => undef,
         "CC" => "gcc",
@@ -267,18 +265,18 @@ our %config = (
         "CPPFLAGS" => undef,
         "CPPINCLUDES" => undef,
         "CROSS_COMPILE" => undef,
-        "CXX" => "g++",
+        "CXX" => undef,
         "CXXFLAGS" => undef,
         "HASHBANGPERL" => undef,
-        "LD" => "ld",
+        "LD" => undef,
         "LDFLAGS" => undef,
         "LDLIBS" => undef,
         "MT" => undef,
         "MTFLAGS" => undef,
-        "OBJCOPY" => "objcopy",
+        "OBJCOPY" => undef,
         "OPENSSL_LOCAL_CONFIG_DIR" => undef,
         "PERL" => undef,
-        "RANLIB" => "ranlib",
+        "RANLIB" => undef,
         "RC" => undef,
         "RCFLAGS" => undef,
         "RM" => undef,
@@ -295,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-riscv64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2240,6 +2238,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2276,6 +2277,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4934,6 +4938,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4970,6 +4977,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11302,6 +11312,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11338,6 +11351,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13996,6 +14012,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14032,6 +14051,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16429,6 +16451,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16441,6 +16464,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18552,6 +18576,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18564,6 +18589,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h
index 132867b95c47..6fd695965dc1 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-riscv64/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-riscv64"
-#define DATE "built on: Tue Jun 30 04:15:54 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:54:06 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-riscv64/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm
index 0063924e8a2a..9464ee908127 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/configdata.pm
@@ -18,7 +18,6 @@ our %config = (
     "ARFLAGS" => [
         "qc"
     ],
-    "AS" => "as",
     "ASFLAGS" => [],
     "CC" => "../config/fake_gcc.pl",
     "CFLAGS" => [
@@ -34,7 +33,6 @@ our %config = (
     "FIPSKEY" => "f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813",
     "FIPS_VENDOR" => "OpenSSL FIPS Provider",
     "HASHBANGPERL" => "/usr/bin/env perl",
-    "LD" => "ld",
     "LDFLAGS" => [],
     "LDLIBS" => [],
     "OBJCOPY" => "objcopy",
@@ -176,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -236,10 +234,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
-    "perl_archname" => "x86_64-linux-thread-multi",
+    "patch" => "8",
+    "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.42.2",
+    "perl_version" => "5.34.0",
     "perlargv" => [
         "no-tests",
         "no-shared",
@@ -255,9 +253,9 @@ our %config = (
         "linux64-riscv64"
     ],
     "perlenv" => {
-        "AR" => "ar",
+        "AR" => undef,
         "ARFLAGS" => undef,
-        "AS" => "as",
+        "AS" => undef,
         "ASFLAGS" => undef,
         "BUILDFILE" => undef,
         "CC" => "../config/fake_gcc.pl",
@@ -267,18 +265,18 @@ our %config = (
         "CPPFLAGS" => undef,
         "CPPINCLUDES" => undef,
         "CROSS_COMPILE" => undef,
-        "CXX" => "g++",
+        "CXX" => undef,
         "CXXFLAGS" => undef,
         "HASHBANGPERL" => undef,
-        "LD" => "ld",
+        "LD" => undef,
         "LDFLAGS" => undef,
         "LDLIBS" => undef,
         "MT" => undef,
         "MTFLAGS" => undef,
-        "OBJCOPY" => "objcopy",
+        "OBJCOPY" => undef,
         "OPENSSL_LOCAL_CONFIG_DIR" => undef,
         "PERL" => undef,
-        "RANLIB" => "ranlib",
+        "RANLIB" => undef,
         "RC" => undef,
         "RCFLAGS" => undef,
         "RM" => undef,
@@ -295,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-riscv64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2240,6 +2238,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2276,6 +2277,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4934,6 +4938,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4970,6 +4977,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11302,6 +11312,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11338,6 +11351,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13996,6 +14012,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14032,6 +14051,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16429,6 +16451,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16441,6 +16464,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18552,6 +18576,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18564,6 +18589,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h
index 017783059eb5..b88360c4414d 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-riscv64"
-#define DATE "built on: Tue Jun 30 04:16:04 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:54:22 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-riscv64/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm
index 0afb9fe32895..30d3a517c15a 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-riscv64",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2206,6 +2206,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2242,6 +2245,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4900,6 +4906,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4936,6 +4945,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11238,6 +11250,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11274,6 +11289,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13932,6 +13950,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13968,6 +13989,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16365,6 +16389,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16377,6 +16402,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18485,6 +18511,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18497,6 +18524,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h
index 47ed00634a03..08f9dacf7afa 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-riscv64"
-#define DATE "built on: Wed Jun 17 17:33:16 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:54:36 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm b/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm
index bccf82d2ca5d..fde561ab9d43 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-s390x",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2258,6 +2258,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2294,6 +2297,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4952,6 +4958,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4988,6 +4997,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11320,6 +11332,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11356,6 +11371,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14014,6 +14032,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14050,6 +14071,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16447,6 +16471,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16459,6 +16484,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18624,6 +18650,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18636,6 +18663,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h
index 9f290c153834..85fcac954888 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-s390x"
-#define DATE "built on: Wed Jun 17 17:30:06 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:52:44 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm
index 076ce08f1495..db711f1f371f 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm
@@ -174,7 +174,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -234,7 +234,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-s390x",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2258,6 +2258,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2294,6 +2297,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4952,6 +4958,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4988,6 +4997,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11320,6 +11332,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11356,6 +11371,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14014,6 +14032,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14050,6 +14071,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16447,6 +16471,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16459,6 +16484,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18624,6 +18650,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18636,6 +18663,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h
index a0807d918574..dc47544122a9 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-s390x"
-#define DATE "built on: Wed Jun 17 17:30:16 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:52:59 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm
index 0768ef4d8eab..28d575ff8d60 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm
@@ -172,7 +172,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -233,7 +233,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -293,11 +293,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-s390x",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2207,6 +2207,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2243,6 +2246,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4901,6 +4907,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4937,6 +4946,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11239,6 +11251,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11275,6 +11290,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13933,6 +13951,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13969,6 +13990,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16366,6 +16390,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16378,6 +16403,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18486,6 +18512,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18498,6 +18525,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h
index b3ac1f765fc1..8ebaa83c9019 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-s390x"
-#define DATE "built on: Wed Jun 17 17:30:25 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:53:13 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm
index 7b3aba3a639d..2825259eeac5 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -231,7 +231,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -290,11 +290,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris-x86-gcc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2256,6 +2256,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2292,6 +2295,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4950,6 +4956,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4986,6 +4995,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16437,6 +16461,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16449,6 +16474,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18560,6 +18586,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18572,6 +18599,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h
index cb7b0c149cfc..e8bb3e6e170d 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris-x86-gcc"
-#define DATE "built on: Wed Jun 17 17:31:02 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:54:49 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm
index ee82a94dea37..1de2b1838d2d 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -231,7 +231,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -290,11 +290,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris-x86-gcc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2256,6 +2256,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2292,6 +2295,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4950,6 +4956,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4986,6 +4995,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11310,6 +11322,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11346,6 +11361,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14004,6 +14022,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14040,6 +14061,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16437,6 +16461,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16449,6 +16474,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18560,6 +18586,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18572,6 +18599,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h
index c536b621df14..79239580903c 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris-x86-gcc"
-#define DATE "built on: Wed Jun 17 17:31:13 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:55:04 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm
index 8f683123c4c5..cd239c07bc4e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -230,7 +230,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -290,11 +290,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris-x86-gcc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2198,6 +2198,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2234,6 +2237,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4892,6 +4898,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4928,6 +4937,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11230,6 +11242,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11266,6 +11281,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13924,6 +13942,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13960,6 +13981,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16357,6 +16381,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16369,6 +16394,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18477,6 +18503,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18489,6 +18516,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h
index 3aa35283d231..17c1ed5f0bd2 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris-x86-gcc"
-#define DATE "built on: Wed Jun 17 17:31:23 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:55:18 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm
index 2613cd196ae5..88b300eeeb7f 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -231,7 +231,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -290,11 +290,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris64-x86_64-gcc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2263,6 +2263,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2299,6 +2302,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4957,6 +4963,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4993,6 +5002,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11367,6 +11379,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11403,6 +11418,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14061,6 +14079,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14097,6 +14118,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16494,6 +16518,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16506,6 +16531,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18617,6 +18643,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18629,6 +18656,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h
index efe0be8ef0b3..32fc64cf8679 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris64-x86_64-gcc"
-#define DATE "built on: Wed Jun 17 17:31:32 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:55:32 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm
index a627e26f0630..3ddd4e30f92d 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm
@@ -171,7 +171,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -231,7 +231,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -290,11 +290,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris64-x86_64-gcc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2263,6 +2263,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2299,6 +2302,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4957,6 +4963,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4993,6 +5002,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11367,6 +11379,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11403,6 +11418,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -14061,6 +14079,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -14097,6 +14118,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16494,6 +16518,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16506,6 +16531,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18617,6 +18643,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18629,6 +18656,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h
index 3877782d03bf..cc8735d5c63e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris64-x86_64-gcc"
-#define DATE "built on: Wed Jun 17 17:31:47 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:55:54 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm
index 81a40f0be536..09125eacfd1a 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm
@@ -169,7 +169,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.5.7",
+    "full_version" => "3.5.8",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -230,7 +230,7 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips enable-zlib --with-zlib-include=../../zlib enable-brotli --with-brotli-include=../../brotli/c/include enable-zstd --with-zstd-include=../../zstd/lib no-afalgeng no-asan no-asm no-brotli-dynamic no-buildtest-c++ no-crypto-mdebug no-crypto-mdebug-backtrace no-demos no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fips-jitter no-fuzz-afl no-fuzz-libfuzzer no-h3demo no-hqinterop no-jitter no-ktls no-loadereng no-md2 no-msan no-pie no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-sslkeylog no-tests no-tfo no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-winstore no-zlib-dynamic no-zstd-dynamic",
-    "patch" => "7",
+    "patch" => "8",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
     "perl_version" => "5.34.0",
@@ -290,11 +290,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "9 Jun 2026",
+    "release_date" => "25 Aug 2026",
     "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris64-x86_64-gcc",
-    "version" => "3.5.7"
+    "version" => "3.5.8"
 );
 our %target = (
     "AR" => "ar",
@@ -2199,6 +2199,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -2235,6 +2238,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -4893,6 +4899,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -4929,6 +4938,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -11231,6 +11243,9 @@ our %unified_info = (
         "doc/html/man3/MDC2_Init.html" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/html/man3/NAME_CONSTRAINTS_check.html" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/html/man3/NCONF_new_ex.html" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -11267,6 +11282,9 @@ our %unified_info = (
         "doc/html/man3/OPENSSL_LH_stats.html" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/html/man3/OPENSSL_armcap.html" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/html/man3/OPENSSL_config.html" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -13925,6 +13943,9 @@ our %unified_info = (
         "doc/man/man3/MDC2_Init.3" => [
             "doc/man3/MDC2_Init.pod"
         ],
+        "doc/man/man3/NAME_CONSTRAINTS_check.3" => [
+            "doc/man3/NAME_CONSTRAINTS_check.pod"
+        ],
         "doc/man/man3/NCONF_new_ex.3" => [
             "doc/man3/NCONF_new_ex.pod"
         ],
@@ -13961,6 +13982,9 @@ our %unified_info = (
         "doc/man/man3/OPENSSL_LH_stats.3" => [
             "doc/man3/OPENSSL_LH_stats.pod"
         ],
+        "doc/man/man3/OPENSSL_armcap.3" => [
+            "doc/man3/OPENSSL_armcap.pod"
+        ],
         "doc/man/man3/OPENSSL_config.3" => [
             "doc/man3/OPENSSL_config.pod"
         ],
@@ -16358,6 +16382,7 @@ our %unified_info = (
             "doc/html/man3/HMAC.html",
             "doc/html/man3/MD5.html",
             "doc/html/man3/MDC2_Init.html",
+            "doc/html/man3/NAME_CONSTRAINTS_check.html",
             "doc/html/man3/NCONF_new_ex.html",
             "doc/html/man3/OBJ_nid2obj.html",
             "doc/html/man3/OCSP_REQUEST_new.html",
@@ -16370,6 +16395,7 @@ our %unified_info = (
             "doc/html/man3/OPENSSL_FILE.html",
             "doc/html/man3/OPENSSL_LH_COMPFUNC.html",
             "doc/html/man3/OPENSSL_LH_stats.html",
+            "doc/html/man3/OPENSSL_armcap.html",
             "doc/html/man3/OPENSSL_config.html",
             "doc/html/man3/OPENSSL_fork_prepare.html",
             "doc/html/man3/OPENSSL_gmtime.html",
@@ -18478,6 +18504,7 @@ our %unified_info = (
             "doc/man/man3/HMAC.3",
             "doc/man/man3/MD5.3",
             "doc/man/man3/MDC2_Init.3",
+            "doc/man/man3/NAME_CONSTRAINTS_check.3",
             "doc/man/man3/NCONF_new_ex.3",
             "doc/man/man3/OBJ_nid2obj.3",
             "doc/man/man3/OCSP_REQUEST_new.3",
@@ -18490,6 +18517,7 @@ our %unified_info = (
             "doc/man/man3/OPENSSL_FILE.3",
             "doc/man/man3/OPENSSL_LH_COMPFUNC.3",
             "doc/man/man3/OPENSSL_LH_stats.3",
+            "doc/man/man3/OPENSSL_armcap.3",
             "doc/man/man3/OPENSSL_config.3",
             "doc/man/man3/OPENSSL_fork_prepare.3",
             "doc/man/man3/OPENSSL_gmtime.3",
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h
index dcb67f8ce1fa..378b3b1efee2 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris64-x86_64-gcc"
-#define DATE "built on: Wed Jun 17 17:31:59 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:56:11 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h
index 8e9329bcc0dd..1555e59c04c6 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h
@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h
index eaeeea7d10b4..4460f0493d6e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h
@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/openssl/CHANGES.md b/deps/openssl/openssl/CHANGES.md
index c1c29eb55f04..b440f013313f 100644
--- a/deps/openssl/openssl/CHANGES.md
+++ b/deps/openssl/openssl/CHANGES.md
@@ -28,6 +28,237 @@ OpenSSL Releases
 OpenSSL 3.5
 -----------
 
+### Changes between 3.5.7 and 3.5.8 [25 Aug 2026]
+
+ * Fixed QUIC server being able to trigger double free when processing `INITIAL`
+   packet.
+
+   Severity: Moderate
+
+   Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
+   when channel creation fails for initial packet.
+
+   Impact summary: Double free leads to heap corruption, which typically results
+   in termination of QUIC server process, leading to a Denial of Service.
+   There is so far no evidence that this double free is exploitable for remote
+   code execution, thus it is considered highly improbable.
+
+   Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle,
+   and Feng Xue (ThreatBoon).
+
+   ([CVE-2026-18798])
+
+   *Alexandr Nedvědický*
+
+ * Fixed heap buffer overflow in CMS key unwrapping.
+
+   Severity: Moderate
+
+   Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer
+   based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap
+   primitive can write and cleanse more bytes than that query reports, causing
+   an 8-byte out-of-bounds heap write.
+
+   Impact summary: An attacker who supplies a crafted CMS message can trigger
+   a deterministic 8-byte out-of-bounds heap write when the victim decrypts it
+   with `CMS_decrypt()`, corrupting the heap and typically resulting in a Denial
+   of Service.
+
+   Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits).
+
+   ([CVE-2026-63072])
+
+   *Daniel Kubec*
+
+ * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`.
+
+   Severity: Moderate
+
+   Issue Summary: The OpenSSL Certificate Management Protocol (CMP)
+   password-based protection verification only checks whether
+   the `protectionAlg` parameter was not NULL and not its ASN.1 type,
+   before treating it as a `PBMParameter`.  A crafted message can contain
+   a parameter of a different type, which is then dereferenced as an invalid
+   pointer.
+
+   Impact summary: A remote, unauthenticated attacker can crash an application
+   acting as a CMP server that accepts PBM-protected messages, or a CMP client
+   talking to a malicious or intercepted CMP server, resulting in a Denial
+   of Service.
+
+   Reported by: Ying Dong and Bhabani Sankar Das.
+
+   ([CVE-2026-63076])
+
+   *Daniel Kubec*
+
+ * Fixed unbounded memory growth in QUIC server incoming channel queue.
+
+   Severity: Low
+
+   Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
+   valid QUIC Initial packets for unknown destination connection IDs, it can
+   allocate and queue new incoming channels without enforcing any limit.
+
+   Impact summary: A remote peer that can make many `INITIAL` packets reach
+   the server listener faster than the application accepts connections can
+   cause the memory allocated to store the per-channel state to grow
+   without any limits, potentially making the QUIC listener unavailable
+   and causing a Denial of Service.
+
+   Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.
+
+   ([CVE-2026-14456])
+   <!-- https://github.com/openssl/openssl/pull/32052 -->
+
+   *Filipe Casal*
+
+ * Fixed RPK server signature algorithm selection being able to dereference
+   a missing certificate.
+
+   Severity: Low
+
+   Issue summary: In a server or client configuration with [RFC 7250] Raw Public
+   Keys (RPKs) enabled, and only the private key (with no associated
+   certificate) configured locally, a NULL pointer dereference may occur
+   when the remote peer solicits raw public keys and also sends the typically
+   omitted `signature_algorithms_cert` TLS extension.
+
+   Impact summary: The impact is limited to a possible Denial of Service
+   as a result of an application abort, no data disclosure or remote command
+   execution are possible.
+
+   Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.
+
+   ([CVE-2026-14457])
+
+   *Viktor Dukhovni*
+
+ * Fixed excessive memory use buffering DTLS records for a future epoch.
+
+   Severity: Low
+
+   Issue summary: Receiving a DTLS record for a future epoch while a handshake
+   is in progress causes OpenSSL to buffer far more memory than the record
+   itself requires.
+
+   Impact summary: A peer can use a small amount of network traffic to make
+   an OpenSSL DTLS endpoint retain a disproportionately large amount of memory,
+   which may lead to a Denial of Service.
+
+   Reported by: Amazon Web Services.
+
+   ([CVE-2026-54874])
+
+   *Matt Caswell*
+
+ * Fixed untrusted Sender DN being used as a format string in CMP response
+   validation.
+
+   Severity: Low
+
+   Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response
+   validation passed an unexpected response sender distinguished name directly
+   as the format string to `ERR_raise_data()`.
+
+   Impact summary: A malicious or intercepted CMP endpoint can crash a CMP
+   client that enforces an expected sender or uses a pinned server certificate
+   whose subject becomes the default expected sender.
+
+   Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
+   Brandon Luo, and TrendAI Zero Day Initiative.
+
+   ([CVE-2026-63073])
+
+   *Filipe Casal*
+
+ * Fixed CMP indefinite cache growth of `extraCerts`.
+
+   Severity: Low
+
+   Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches
+   additional certificates (`extraCerts`) sent in a CMP message, but never
+   expunges them (for instance, if they are invalid).  If a server reuses
+   an `OSSL_CMP_CTX` object frequently, this cache of `extraCerts` may grow
+   unboundedly, and a malicious client may flood a CMP server with requests
+   driving this growth.
+
+   Impact Summary: Users utilizing a CMP server that reuses a single
+   `OSSL_CMP_CTX` object for the lifetime of a server process may observe
+   unbounded memory growth in the event a malicious client repeatedly sends
+   requests containing unique extra certificates, which may lead to OOM
+   conditions.
+
+   Reported by: Pavol Zacik (Red Hat).
+
+   ([CVE-2026-63074])
+
+   *Neil Horman*
+
+ * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
+
+   Severity: Low
+
+   Issue Summary: When OpenSSL processes QUIC traffic from a peer
+   that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only
+   responses, the QUIC stack can retain ACK-only packet metadata
+   for the lifetime of the connection.
+
+   Impact Summary: A remote peer that can complete a QUIC handshake can cause
+   connection-scoped memory growth, which may lead to a Denial of Service
+   through memory exhaustion, especially with sustained traffic or many
+   concurrent QUIC connections.
+
+   Reported by: Opal Wright (Trail of Bits).
+
+   ([CVE-2026-63075])
+
+   *Neil Horman*
+
+ * Fixed possibility of AEAD forgeries with empty ciphertext when using
+   `EVP_Cipher()`.
+
+   Severity: Low
+
+   Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty
+   ciphertext can report success without verifying the supplied authentication
+   tag when the operation is finalized by calling the `EVP_Cipher()` function.
+
+   Impact summary: Applications calling `EVP_Cipher()` on an empty ciphertext
+   and expecting the call to check the AEAD tag may accept forged messages.
+
+   Reported by: Billy Brumley (Rochester Institute of Technology).
+
+   ([CVE-2026-75803])
+   <!-- https://github.com/openssl/openssl/pull/32416 -->
+
+   *Billy Bob Brumley*
+
+ * Added `OPENSSL_armcap(3)` documentation page.
+   <!-- https://github.com/openssl/openssl/pull/31749 -->
+
+   *Paul Elliott*
+
+ * Added support for selecting assembly code paths for LLVM-based Intel's `icx`
+   compiler.
+   <!-- https://github.com/openssl/openssl/pull/31572 -->
+
+   *Wolfgang Beck*
+
+ * Updated compliance with TLS 1.3 session ticket lifetime requirements.
+   TLS 1.3 clients now cap `ticket_lifetime_hint` to 7 days (604800 seconds)
+   when processing new session ticket messages, in accordance
+   with [RFC 8446 Section 4.6.1].
+   <!-- https://github.com/openssl/openssl/pull/31174 -->
+
+   *Abel Thomas*
+
+ * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
+   in CCM cipher mode.
+   <!-- https://github.com/openssl/openssl/pull/32427 -->
+
+   *Mounir IDRASSI*
+
 ### Changes between 3.5.6 and 3.5.7 [9 Jun 2026]
 
  * Fixed heap use-after-free in `PKCS7_verify()`.
@@ -306,6 +537,21 @@ OpenSSL 3.5
 
    *Dmitry Belyavskiy (Red Hat)*
 
+ * Fixed excessive allocation of the handshake message buffer (aka HollowByte).
+
+   Previously, we would allocate a buffer large enough to hold the full size of
+   an incoming handshake message as advertised by the peer. This could be quite
+   large (although it is bounded, e.g. for ClientHello this is approximately
+   128 KiB). If the peer then fails to send the full handshake message, then the
+   endpoint is left waiting for the remainder of the message to arrive and the
+   memory is still allocated (i.e. a Slowloris attack). To prevent this, we
+   incrementally grow the buffer as we receive the data.
+
+   This issue was reported by Okta Red Team.
+   <!-- https://github.com/openssl/openssl/pull/30793 -->
+
+   *Matt Caswell*
+
  * Fixed TLS 1.3 server not sending `NewSessionTicket` message
    after ciphersuite mismatch.
    <!-- https://github.com/openssl/openssl/pull/30626 -->
@@ -22260,6 +22506,9 @@ ndif
 [CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673
 [CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
 [CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
+[CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456
+[CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457
+[CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798
 [CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795
 [CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796
 [CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387
@@ -22281,9 +22530,18 @@ ndif
 [CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
 [CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
 [CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
+[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
+[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
+[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
+[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
 [ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
 [RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
 [RFC 3211]: https://datatracker.ietf.org/doc/html/rfc3211
 [RFC 5297]: https://datatracker.ietf.org/doc/html/rfc5297
+[RFC 7250]: https://datatracker.ietf.org/doc/html/rfc7250
 [RFC 8446]: https://datatracker.ietf.org/doc/html/rfc8446
+[RFC 8446 Section 4.6.1]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1
 [RFC 8452]: https://datatracker.ietf.org/doc/html/rfc8452
diff --git a/deps/openssl/openssl/CONTRIBUTING.md b/deps/openssl/openssl/CONTRIBUTING.md
index 06dfbaeff1fe..8a0d40524ddb 100644
--- a/deps/openssl/openssl/CONTRIBUTING.md
+++ b/deps/openssl/openssl/CONTRIBUTING.md
@@ -70,7 +70,37 @@ guidelines:
         git push -f [<repository> [<branch>]]
     ```
 
- 2. All source files should start with the following text (with
+ 2. Similarly, if a non-trivial portion of a contribution was created
+    using an AI tool, you must declare which agent and model were used.
+    This is done by adding `Assisted-by: {agent}:{model}` below the commit
+    message:
+
+    ```
+        One-line summary of change with AI-generated portions
+
+        Assisted-by: Claude:claude-sonnet-4-6
+    ```
+
+    Multiple Assisted-by trailers can be included if multiple tools were used:
+
+    ```
+        Assisted-by: Claude:claude-sonnet-4-6
+        Assisted-by: ChatGPT:gpt-4o
+        Assisted-by: GitHub Copilot:gpt-4.1
+    ```
+
+    You will need to have signed a v1.1 or later CLA in order to
+    include AI-generated content in your contribution. CLAs signed
+    after June 2026 will have the requisite clauses.
+
+    Consult the [OpenSSL AI Code and Documentation Contribution
+    Policy] if an AI model assisted with the creation of your
+    contribution.
+
+    [OpenSSL AI Code and Documentation Contribution
+    Policy]: <https://openssl-library.org/policies/general/ai-policy/>
+
+ 3. All source files should start with the following text (with
     appropriate comment characters at the start of each line and the
     year(s) updated):
 
@@ -83,11 +113,11 @@ guidelines:
         https://www.openssl.org/source/license.html
     ```
 
- 3. Patches should be as current as possible; expect to have to rebase
+ 4. Patches should be as current as possible; expect to have to rebase
     often. We do not accept merge commits, you will have to remove them
     (usually by rebasing) before it will be acceptable.
 
- 4. Code provided should follow our [coding style] and [documentation policy]
+ 5. Code provided should follow our [coding style] and [documentation policy]
     and compile without warnings.
     There is a [Perl tool](util/check-format.pl) that helps
     finding code formatting mistakes and other coding style nits.
@@ -100,16 +130,16 @@ guidelines:
     [coding style]: https://openssl-library.org/policies/technical/coding-style/
     [documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
 
- 5. When at all possible, code contributions should include tests. These can
+ 6. When at all possible, code contributions should include tests. These can
     either be added to an existing test, or completely new.  Please see
     [test/README.md](test/README.md) for information on the test framework.
 
- 6. New features or changed functionality must include
+ 7. New features or changed functionality must include
     documentation. Please look at the `.pod` files in `doc/man[1357]` for
     examples of our style. Run `make doc-nits` to make sure that your
     documentation changes are clean.
 
- 7. For user visible changes (API changes, behaviour changes, ...),
+ 8. For user visible changes (API changes, behaviour changes, ...),
     consider adding a note in [CHANGES.md](CHANGES.md).
     This could be a summarising description of the change, and could
     explain the grander details.
@@ -120,5 +150,5 @@ guidelines:
     with a specific release without having to sift through the higher
     noise ratio in git-log.
 
- 8. Guidelines on how to integrate error output of new crypto library modules
+ 9. Guidelines on how to integrate error output of new crypto library modules
     can be found in [crypto/err/README.md](crypto/err/README.md).
diff --git a/deps/openssl/openssl/NEWS.md b/deps/openssl/openssl/NEWS.md
index 04d0bd72c7f5..329b1772c348 100644
--- a/deps/openssl/openssl/NEWS.md
+++ b/deps/openssl/openssl/NEWS.md
@@ -23,6 +23,50 @@ OpenSSL Releases
 OpenSSL 3.5
 -----------
 
+### Major changes between OpenSSL 3.5.7 and OpenSSL 3.5.8 [25 Aug 2026]
+
+OpenSSL 3.5.8 is a security patch release.  The most severe CVE fixed
+in this release is Moderate.
+
+This release incorporates the following bug fixes and mitigations:
+
+  * Fixed QUIC server being able to trigger double free when processing
+    `INITIAL` packet.
+    ([CVE-2026-18798])
+
+  * Fixed heap buffer overflow in CMS key unwrapping.
+    ([CVE-2026-63072])
+
+  * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`.
+    ([CVE-2026-63076])
+
+  * Fixed unbounded memory growth in QUIC server incoming channel queue.
+    ([CVE-2026-14456])
+
+  * Fixed RPK server signature algorithm selection being able to dereference
+    a missing certificate.
+    ([CVE-2026-14457])
+
+  * Fixed excessive memory use buffering DTLS records for a future epoch.
+    ([CVE-2026-54874])
+
+  * Fixed untrusted Sender DN being used as a format string in CMP response
+    validation.
+    ([CVE-2026-63073])
+
+  * Fixed CMP indefinite cache growth of `extraCerts`.
+    ([CVE-2026-63074])
+
+  * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
+    ([CVE-2026-63075])
+
+  * Fixed possibility of AEAD forgeries with empty ciphertext when using
+    `EVP_Cipher()`.
+    ([CVE-2026-75803])
+
+  * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
+    in CCM cipher mode.
+
 ### Major changes between OpenSSL 3.5.6 and OpenSSL 3.5.7 [9 Jun 2026]
 
 OpenSSL 3.5.7 is a security patch release.  The most severe CVE fixed
@@ -78,6 +122,8 @@ This release incorporates the following bug fixes and mitigations:
     and AES-SIV modes.
     ([CVE-2026-45446])
 
+  * Fixed excessive allocation of the handshake message buffer (aka HollowByte).
+
 ### Major changes between OpenSSL 3.5.5 and OpenSSL 3.5.6 [7 Apr 2026]
 
 OpenSSL 3.5.6 is a security patch release. The most severe CVE fixed in this
@@ -2267,6 +2313,9 @@ OpenSSL 0.9.x
 [CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673
 [CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
 [CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
+[CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456
+[CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457
+[CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798
 [CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795
 [CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796
 [CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387
@@ -2288,6 +2337,13 @@ OpenSSL 0.9.x
 [CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
 [CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
 [CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
+[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
+[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
+[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
+[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
 [ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
 [OpenSSL Guide]: https://www.openssl.org/docs/manmaster/man7/ossl-guide-introduction.html
 [README-QUIC.md]: ./README-QUIC.md
diff --git a/deps/openssl/openssl/README-FIPS.md b/deps/openssl/openssl/README-FIPS.md
index b31f8c65304b..feb6892a2c47 100644
--- a/deps/openssl/openssl/README-FIPS.md
+++ b/deps/openssl/openssl/README-FIPS.md
@@ -32,11 +32,15 @@ Installing the FIPS provider
 ============================
 
 In order to be FIPS compliant you must only use FIPS validated source code.
-Refer to <https://www.openssl.org/source/> for information related to
+Refer to <https://openssl-library.org/source/> for information related to
 which versions are FIPS validated. The instructions given below build OpenSSL
-just using the FIPS validated source code.  Any FIPS validated version may be
-used with any other openssl library.  Please see <https://www.openssl.org/source/>
-To determine which FIPS validated library version may be appropriate for you.
+just using the FIPS validated source code.  A FIPS provider built from any
+validated version may be used together with an OpenSSL library built from any
+supported release from OpenSSL 3.0 onwards; provider compatibility is
+maintained backward and forward across these releases, including future major
+release series, for as long as the module remains supported.  Please see
+<https://openssl-library.org/source/>
+to determine which FIPS validated library version may be appropriate for you.
 
 If you want to use a validated FIPS provider, but also want to use the latest
 OpenSSL release to build everything else, then refer to the next section.
diff --git a/deps/openssl/openssl/VERSION.dat b/deps/openssl/openssl/VERSION.dat
index a297eee91e17..bf654c1a7713 100644
--- a/deps/openssl/openssl/VERSION.dat
+++ b/deps/openssl/openssl/VERSION.dat
@@ -1,7 +1,7 @@
 MAJOR=3
 MINOR=5
-PATCH=7
+PATCH=8
 PRE_RELEASE_TAG=
 BUILD_METADATA=
-RELEASE_DATE="9 Jun 2026"
+RELEASE_DATE="25 Aug 2026"
 SHLIB_VERSION=3
diff --git a/deps/openssl/openssl/apps/lib/apps.c b/deps/openssl/openssl/apps/lib/apps.c
index e5a2b162b4ef..29dd6514f6d9 100644
--- a/deps/openssl/openssl/apps/lib/apps.c
+++ b/deps/openssl/openssl/apps/lib/apps.c
@@ -1688,11 +1688,18 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
         goto err;
 
 #ifndef OPENSSL_NO_POSIX_IO
-    BIO_get_fp(in, &dbfp);
-    if (fstat(fileno(dbfp), &dbst) == -1) {
-        ERR_raise_data(ERR_LIB_SYS, errno,
-            "calling fstat(%s)", dbfile);
-        goto err;
+    if (BIO_get_fp(in, &dbfp) > 0 && dbfp != NULL) {
+        if (fstat(fileno(dbfp), &dbst) == -1) {
+            ERR_raise_data(ERR_LIB_SYS, errno,
+                "calling fstat(%s)", dbfile);
+            goto err;
+        }
+    } else {
+        if (stat(dbfile, &dbst) == -1) {
+            ERR_raise_data(ERR_LIB_SYS, errno,
+                "calling stat(%s)", dbfile);
+            goto err;
+        }
     }
 #endif
 
@@ -1722,8 +1729,14 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
     }
 
     retdb->dbfname = OPENSSL_strdup(dbfile);
-    if (retdb->dbfname == NULL)
+    if (retdb->dbfname == NULL) {
+        TXT_DB_free(retdb->db);
+        retdb->db = NULL;
+        OPENSSL_free(retdb);
+        retdb = NULL;
+        ERR_raise_data(ERR_LIB_SYS, errno, "Out of memory while copying filename: %s", dbfile);
         goto err;
+    }
 
 #ifndef OPENSSL_NO_POSIX_IO
     retdb->dbst = dbst;
diff --git a/deps/openssl/openssl/apps/lib/s_cb.c b/deps/openssl/openssl/apps/lib/s_cb.c
index 80b5c6555424..760ad010988b 100644
--- a/deps/openssl/openssl/apps/lib/s_cb.c
+++ b/deps/openssl/openssl/apps/lib/s_cb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -1461,10 +1461,7 @@ static STRINT_PAIR callback_types[] = {
     { "Signature Algorithm mask", SSL_SECOP_SIGALG_MASK },
     { "Certificate chain EE key", SSL_SECOP_EE_KEY },
     { "Certificate chain CA key", SSL_SECOP_CA_KEY },
-    { "Peer Chain EE key", SSL_SECOP_PEER_EE_KEY },
-    { "Peer Chain CA key", SSL_SECOP_PEER_CA_KEY },
     { "Certificate chain CA digest", SSL_SECOP_CA_MD },
-    { "Peer chain CA digest", SSL_SECOP_PEER_CA_MD },
     { "SSL compression", SSL_SECOP_COMPRESSION },
     { "Session ticket", SSL_SECOP_TICKET },
     { NULL }
@@ -1498,7 +1495,6 @@ static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
         show_nm = 0;
         break;
     case SSL_SECOP_CA_MD:
-    case SSL_SECOP_PEER_CA_MD:
         cert_md = 1;
         break;
     case SSL_SECOP_SIGALG_SUPPORTED:
diff --git a/deps/openssl/openssl/apps/lib/vms_term_sock.c b/deps/openssl/openssl/apps/lib/vms_term_sock.c
index faceb05d0145..15bc6665694d 100644
--- a/deps/openssl/openssl/apps/lib/vms_term_sock.c
+++ b/deps/openssl/openssl/apps/lib/vms_term_sock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright 2016 VMS Software, Inc. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -230,6 +230,7 @@ int TerminalSocket(int FunctionCode, int *ReturnSocket)
             LogMessage("TerminalSocket: SYS$QIO () - %08X", status);
             close(TerminalSocketPair[0]);
             close(TerminalSocketPair[1]);
+            sys$dassgn(TerminalDeviceChan);
             return TERM_SOCK_FAILURE;
         }
 
@@ -248,6 +249,7 @@ int TerminalSocket(int FunctionCode, int *ReturnSocket)
             LogMessage("TerminalSocket: SYS$CANCEL () - %08X", status);
             close(TerminalSocketPair[0]);
             close(TerminalSocketPair[1]);
+            sys$dassgn(TerminalDeviceChan);
             return TERM_SOCK_FAILURE;
         }
 
diff --git a/deps/openssl/openssl/apps/s_client.c b/deps/openssl/openssl/apps/s_client.c
index 9b88d6dfbc86..b3f333a6993c 100644
--- a/deps/openssl/openssl/apps/s_client.c
+++ b/deps/openssl/openssl/apps/s_client.c
@@ -2846,11 +2846,9 @@ int s_client_main(int argc, char **argv)
         }
         /*
          * According to RFC 5804 § 2.2, response codes are case-
-         * insensitive, make it uppercase but preserve the response.
+         * insensitive.
          */
-        strncpy(sbuf, mbuf, 2);
-        make_uppercase(sbuf);
-        if (!HAS_PREFIX(sbuf, "OK")) {
+        if (OPENSSL_strncasecmp(mbuf, "OK", 2) != 0) {
             BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);
             goto shut;
         }
@@ -3349,29 +3347,32 @@ int s_client_main(int argc, char **argv)
         print_stuff(bio_c_out, con, full_log);
     do_ssl_shutdown(con);
 
-    /*
-     * If we ended with an alert being sent, but still with data in the
-     * network buffer to be read, then calling BIO_closesocket() will
-     * result in a TCP-RST being sent. On some platforms (notably
-     * Windows) then this will result in the peer immediately abandoning
-     * the connection including any buffered alert data before it has
-     * had a chance to be read. Shutting down the sending side first,
-     * and then closing the socket sends TCP-FIN first followed by
-     * TCP-RST. This seems to allow the peer to read the alert data.
-     */
-    shutdown(SSL_get_fd(con), 1); /* SHUT_WR */
-    /*
-     * We just said we have nothing else to say, but it doesn't mean that
-     * the other side has nothing. It's even recommended to consume incoming
-     * data. [In testing context this ensures that alerts are passed on...]
-     */
-    timeout.tv_sec = 0;
-    timeout.tv_usec = 500000; /* some extreme round-trip */
-    do {
-        FD_ZERO(&readfds);
-        openssl_fdset(sock, &readfds);
-    } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
-        && BIO_read(sbio, sbuf, BUFSIZZ) > 0);
+    /* The following half-close/drain workaround is TCP-specific. */
+    if (!isdtls && !isquic) {
+        /*
+         * If we ended with an alert being sent, but still with data in the
+         * network buffer to be read, then calling BIO_closesocket() will
+         * result in a TCP-RST being sent. On some platforms (notably
+         * Windows) then this will result in the peer immediately abandoning
+         * the connection including any buffered alert data before it has
+         * had a chance to be read. Shutting down the sending side first,
+         * and then closing the socket sends TCP-FIN first followed by
+         * TCP-RST. This seems to allow the peer to read the alert data.
+         */
+        shutdown(SSL_get_fd(con), 1); /* SHUT_WR */
+        /*
+         * We just said we have nothing else to say, but it doesn't mean that
+         * the other side has nothing. It's even recommended to consume incoming
+         * data. [In testing context this ensures that alerts are passed on...]
+         */
+        timeout.tv_sec = 0;
+        timeout.tv_usec = 500000; /* some extreme round-trip */
+        do {
+            FD_ZERO(&readfds);
+            openssl_fdset(sock, &readfds);
+        } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
+            && BIO_read(sbio, sbuf, BUFSIZZ) > 0);
+    }
 
     BIO_closesocket(SSL_get_fd(con));
 end:
diff --git a/deps/openssl/openssl/crypto/aes/aes_x86core.c b/deps/openssl/openssl/crypto/aes/aes_x86core.c
deleted file mode 100644
index 0fa994871b27..000000000000
--- a/deps/openssl/openssl/crypto/aes/aes_x86core.c
+++ /dev/null
@@ -1,867 +0,0 @@
-/*
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * This is experimental x86[_64] derivative. It assumes little-endian
- * byte order and expects CPU to sustain unaligned memory references.
- * It is used as playground for cache-time attack mitigations and
- * serves as reference C implementation for x86[_64] as well as some
- * other assembly modules.
- */
-
-/**
- * rijndael-alg-fst.c
- *
- * @version 3.0 (December 2000)
- *
- * Optimised ANSI C code for the Rijndael cipher (now AES)
- *
- * @author Vincent Rijmen
- * @author Antoon Bosselaers
- * @author Paulo Barreto
- *
- * This code is hereby placed in the public domain.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
- * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
- * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
- * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <assert.h>
-
-#include <stdlib.h>
-#include <openssl/aes.h>
-#include "aes_local.h"
-
-/*
- * These two parameters control which table, 256-byte or 2KB, is
- * referenced in outer and respectively inner rounds.
- */
-#define AES_COMPACT_IN_OUTER_ROUNDS
-#ifdef AES_COMPACT_IN_OUTER_ROUNDS
-/* AES_COMPACT_IN_OUTER_ROUNDS costs ~30% in performance, while
- * adding AES_COMPACT_IN_INNER_ROUNDS reduces benchmark *further*
- * by factor of ~2. */
-#undef AES_COMPACT_IN_INNER_ROUNDS
-#endif
-
-#if 1
-static void prefetch256(const void *table)
-{
-    volatile unsigned long *t = (void *)table, ret;
-    unsigned long sum;
-    int i;
-
-    /* 32 is common least cache-line size */
-    for (sum = 0, i = 0; i < 256 / sizeof(t[0]); i += 32 / sizeof(t[0]))
-        sum ^= t[i];
-
-    ret = sum;
-}
-#else
-#define prefetch256(t)
-#endif
-
-#undef GETU32
-#define GETU32(p) (*((u32 *)(p)))
-
-#if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
-#define U64(C) C##UI64
-#elif defined(__arch64__)
-#define U64(C) C##UL
-#else
-#define U64(C) C##ULL
-#endif
-
-#undef ROTATE
-#if defined(_MSC_VER)
-#define ROTATE(a, n) _lrotl(a, n)
-#elif defined(__ICC)
-#define ROTATE(a, n) _rotl(a, n)
-#elif defined(__GNUC__) && __GNUC__ >= 2
-#if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
-#define ROTATE(a, n) ({        \
-    register unsigned int ret; \
-    asm(                       \
-        "roll %1,%0"           \
-        : "=r"(ret)            \
-        : "I"(n), "0"(a)       \
-        : "cc");               \
-    ret;                       \
-})
-#endif
-#endif
-/*-
-Te [x] = S [x].[02, 01, 01, 03, 02, 01, 01, 03];
-Te0[x] = S [x].[02, 01, 01, 03];
-Te1[x] = S [x].[03, 02, 01, 01];
-Te2[x] = S [x].[01, 03, 02, 01];
-Te3[x] = S [x].[01, 01, 03, 02];
-*/
-#define Te0 (u32)((u64 *)((u8 *)Te + 0))
-#define Te1 (u32)((u64 *)((u8 *)Te + 3))
-#define Te2 (u32)((u64 *)((u8 *)Te + 2))
-#define Te3 (u32)((u64 *)((u8 *)Te + 1))
-/*-
-Td [x] = Si[x].[0e, 09, 0d, 0b, 0e, 09, 0d, 0b];
-Td0[x] = Si[x].[0e, 09, 0d, 0b];
-Td1[x] = Si[x].[0b, 0e, 09, 0d];
-Td2[x] = Si[x].[0d, 0b, 0e, 09];
-Td3[x] = Si[x].[09, 0d, 0b, 0e];
-Td4[x] = Si[x].[01];
-*/
-#define Td0 (u32)((u64 *)((u8 *)Td + 0))
-#define Td1 (u32)((u64 *)((u8 *)Td + 3))
-#define Td2 (u32)((u64 *)((u8 *)Td + 2))
-#define Td3 (u32)((u64 *)((u8 *)Td + 1))
-
-static const u64 Te[256] = {
-    U64(0xa56363c6a56363c6), U64(0x847c7cf8847c7cf8),
-    U64(0x997777ee997777ee), U64(0x8d7b7bf68d7b7bf6),
-    U64(0x0df2f2ff0df2f2ff), U64(0xbd6b6bd6bd6b6bd6),
-    U64(0xb16f6fdeb16f6fde), U64(0x54c5c59154c5c591),
-    U64(0x5030306050303060), U64(0x0301010203010102),
-    U64(0xa96767cea96767ce), U64(0x7d2b2b567d2b2b56),
-    U64(0x19fefee719fefee7), U64(0x62d7d7b562d7d7b5),
-    U64(0xe6abab4de6abab4d), U64(0x9a7676ec9a7676ec),
-    U64(0x45caca8f45caca8f), U64(0x9d82821f9d82821f),
-    U64(0x40c9c98940c9c989), U64(0x877d7dfa877d7dfa),
-    U64(0x15fafaef15fafaef), U64(0xeb5959b2eb5959b2),
-    U64(0xc947478ec947478e), U64(0x0bf0f0fb0bf0f0fb),
-    U64(0xecadad41ecadad41), U64(0x67d4d4b367d4d4b3),
-    U64(0xfda2a25ffda2a25f), U64(0xeaafaf45eaafaf45),
-    U64(0xbf9c9c23bf9c9c23), U64(0xf7a4a453f7a4a453),
-    U64(0x967272e4967272e4), U64(0x5bc0c09b5bc0c09b),
-    U64(0xc2b7b775c2b7b775), U64(0x1cfdfde11cfdfde1),
-    U64(0xae93933dae93933d), U64(0x6a26264c6a26264c),
-    U64(0x5a36366c5a36366c), U64(0x413f3f7e413f3f7e),
-    U64(0x02f7f7f502f7f7f5), U64(0x4fcccc834fcccc83),
-    U64(0x5c3434685c343468), U64(0xf4a5a551f4a5a551),
-    U64(0x34e5e5d134e5e5d1), U64(0x08f1f1f908f1f1f9),
-    U64(0x937171e2937171e2), U64(0x73d8d8ab73d8d8ab),
-    U64(0x5331316253313162), U64(0x3f15152a3f15152a),
-    U64(0x0c0404080c040408), U64(0x52c7c79552c7c795),
-    U64(0x6523234665232346), U64(0x5ec3c39d5ec3c39d),
-    U64(0x2818183028181830), U64(0xa1969637a1969637),
-    U64(0x0f05050a0f05050a), U64(0xb59a9a2fb59a9a2f),
-    U64(0x0907070e0907070e), U64(0x3612122436121224),
-    U64(0x9b80801b9b80801b), U64(0x3de2e2df3de2e2df),
-    U64(0x26ebebcd26ebebcd), U64(0x6927274e6927274e),
-    U64(0xcdb2b27fcdb2b27f), U64(0x9f7575ea9f7575ea),
-    U64(0x1b0909121b090912), U64(0x9e83831d9e83831d),
-    U64(0x742c2c58742c2c58), U64(0x2e1a1a342e1a1a34),
-    U64(0x2d1b1b362d1b1b36), U64(0xb26e6edcb26e6edc),
-    U64(0xee5a5ab4ee5a5ab4), U64(0xfba0a05bfba0a05b),
-    U64(0xf65252a4f65252a4), U64(0x4d3b3b764d3b3b76),
-    U64(0x61d6d6b761d6d6b7), U64(0xceb3b37dceb3b37d),
-    U64(0x7b2929527b292952), U64(0x3ee3e3dd3ee3e3dd),
-    U64(0x712f2f5e712f2f5e), U64(0x9784841397848413),
-    U64(0xf55353a6f55353a6), U64(0x68d1d1b968d1d1b9),
-    U64(0x0000000000000000), U64(0x2cededc12cededc1),
-    U64(0x6020204060202040), U64(0x1ffcfce31ffcfce3),
-    U64(0xc8b1b179c8b1b179), U64(0xed5b5bb6ed5b5bb6),
-    U64(0xbe6a6ad4be6a6ad4), U64(0x46cbcb8d46cbcb8d),
-    U64(0xd9bebe67d9bebe67), U64(0x4b3939724b393972),
-    U64(0xde4a4a94de4a4a94), U64(0xd44c4c98d44c4c98),
-    U64(0xe85858b0e85858b0), U64(0x4acfcf854acfcf85),
-    U64(0x6bd0d0bb6bd0d0bb), U64(0x2aefefc52aefefc5),
-    U64(0xe5aaaa4fe5aaaa4f), U64(0x16fbfbed16fbfbed),
-    U64(0xc5434386c5434386), U64(0xd74d4d9ad74d4d9a),
-    U64(0x5533336655333366), U64(0x9485851194858511),
-    U64(0xcf45458acf45458a), U64(0x10f9f9e910f9f9e9),
-    U64(0x0602020406020204), U64(0x817f7ffe817f7ffe),
-    U64(0xf05050a0f05050a0), U64(0x443c3c78443c3c78),
-    U64(0xba9f9f25ba9f9f25), U64(0xe3a8a84be3a8a84b),
-    U64(0xf35151a2f35151a2), U64(0xfea3a35dfea3a35d),
-    U64(0xc0404080c0404080), U64(0x8a8f8f058a8f8f05),
-    U64(0xad92923fad92923f), U64(0xbc9d9d21bc9d9d21),
-    U64(0x4838387048383870), U64(0x04f5f5f104f5f5f1),
-    U64(0xdfbcbc63dfbcbc63), U64(0xc1b6b677c1b6b677),
-    U64(0x75dadaaf75dadaaf), U64(0x6321214263212142),
-    U64(0x3010102030101020), U64(0x1affffe51affffe5),
-    U64(0x0ef3f3fd0ef3f3fd), U64(0x6dd2d2bf6dd2d2bf),
-    U64(0x4ccdcd814ccdcd81), U64(0x140c0c18140c0c18),
-    U64(0x3513132635131326), U64(0x2fececc32fececc3),
-    U64(0xe15f5fbee15f5fbe), U64(0xa2979735a2979735),
-    U64(0xcc444488cc444488), U64(0x3917172e3917172e),
-    U64(0x57c4c49357c4c493), U64(0xf2a7a755f2a7a755),
-    U64(0x827e7efc827e7efc), U64(0x473d3d7a473d3d7a),
-    U64(0xac6464c8ac6464c8), U64(0xe75d5dbae75d5dba),
-    U64(0x2b1919322b191932), U64(0x957373e6957373e6),
-    U64(0xa06060c0a06060c0), U64(0x9881811998818119),
-    U64(0xd14f4f9ed14f4f9e), U64(0x7fdcdca37fdcdca3),
-    U64(0x6622224466222244), U64(0x7e2a2a547e2a2a54),
-    U64(0xab90903bab90903b), U64(0x8388880b8388880b),
-    U64(0xca46468cca46468c), U64(0x29eeeec729eeeec7),
-    U64(0xd3b8b86bd3b8b86b), U64(0x3c1414283c141428),
-    U64(0x79dedea779dedea7), U64(0xe25e5ebce25e5ebc),
-    U64(0x1d0b0b161d0b0b16), U64(0x76dbdbad76dbdbad),
-    U64(0x3be0e0db3be0e0db), U64(0x5632326456323264),
-    U64(0x4e3a3a744e3a3a74), U64(0x1e0a0a141e0a0a14),
-    U64(0xdb494992db494992), U64(0x0a06060c0a06060c),
-    U64(0x6c2424486c242448), U64(0xe45c5cb8e45c5cb8),
-    U64(0x5dc2c29f5dc2c29f), U64(0x6ed3d3bd6ed3d3bd),
-    U64(0xefacac43efacac43), U64(0xa66262c4a66262c4),
-    U64(0xa8919139a8919139), U64(0xa4959531a4959531),
-    U64(0x37e4e4d337e4e4d3), U64(0x8b7979f28b7979f2),
-    U64(0x32e7e7d532e7e7d5), U64(0x43c8c88b43c8c88b),
-    U64(0x5937376e5937376e), U64(0xb76d6ddab76d6dda),
-    U64(0x8c8d8d018c8d8d01), U64(0x64d5d5b164d5d5b1),
-    U64(0xd24e4e9cd24e4e9c), U64(0xe0a9a949e0a9a949),
-    U64(0xb46c6cd8b46c6cd8), U64(0xfa5656acfa5656ac),
-    U64(0x07f4f4f307f4f4f3), U64(0x25eaeacf25eaeacf),
-    U64(0xaf6565caaf6565ca), U64(0x8e7a7af48e7a7af4),
-    U64(0xe9aeae47e9aeae47), U64(0x1808081018080810),
-    U64(0xd5baba6fd5baba6f), U64(0x887878f0887878f0),
-    U64(0x6f25254a6f25254a), U64(0x722e2e5c722e2e5c),
-    U64(0x241c1c38241c1c38), U64(0xf1a6a657f1a6a657),
-    U64(0xc7b4b473c7b4b473), U64(0x51c6c69751c6c697),
-    U64(0x23e8e8cb23e8e8cb), U64(0x7cdddda17cdddda1),
-    U64(0x9c7474e89c7474e8), U64(0x211f1f3e211f1f3e),
-    U64(0xdd4b4b96dd4b4b96), U64(0xdcbdbd61dcbdbd61),
-    U64(0x868b8b0d868b8b0d), U64(0x858a8a0f858a8a0f),
-    U64(0x907070e0907070e0), U64(0x423e3e7c423e3e7c),
-    U64(0xc4b5b571c4b5b571), U64(0xaa6666ccaa6666cc),
-    U64(0xd8484890d8484890), U64(0x0503030605030306),
-    U64(0x01f6f6f701f6f6f7), U64(0x120e0e1c120e0e1c),
-    U64(0xa36161c2a36161c2), U64(0x5f35356a5f35356a),
-    U64(0xf95757aef95757ae), U64(0xd0b9b969d0b9b969),
-    U64(0x9186861791868617), U64(0x58c1c19958c1c199),
-    U64(0x271d1d3a271d1d3a), U64(0xb99e9e27b99e9e27),
-    U64(0x38e1e1d938e1e1d9), U64(0x13f8f8eb13f8f8eb),
-    U64(0xb398982bb398982b), U64(0x3311112233111122),
-    U64(0xbb6969d2bb6969d2), U64(0x70d9d9a970d9d9a9),
-    U64(0x898e8e07898e8e07), U64(0xa7949433a7949433),
-    U64(0xb69b9b2db69b9b2d), U64(0x221e1e3c221e1e3c),
-    U64(0x9287871592878715), U64(0x20e9e9c920e9e9c9),
-    U64(0x49cece8749cece87), U64(0xff5555aaff5555aa),
-    U64(0x7828285078282850), U64(0x7adfdfa57adfdfa5),
-    U64(0x8f8c8c038f8c8c03), U64(0xf8a1a159f8a1a159),
-    U64(0x8089890980898909), U64(0x170d0d1a170d0d1a),
-    U64(0xdabfbf65dabfbf65), U64(0x31e6e6d731e6e6d7),
-    U64(0xc6424284c6424284), U64(0xb86868d0b86868d0),
-    U64(0xc3414182c3414182), U64(0xb0999929b0999929),
-    U64(0x772d2d5a772d2d5a), U64(0x110f0f1e110f0f1e),
-    U64(0xcbb0b07bcbb0b07b), U64(0xfc5454a8fc5454a8),
-    U64(0xd6bbbb6dd6bbbb6d), U64(0x3a16162c3a16162c)
-};
-
-static const u8 Te4[256] = {
-    0x63U, 0x7cU, 0x77U, 0x7bU, 0xf2U, 0x6bU, 0x6fU, 0xc5U,
-    0x30U, 0x01U, 0x67U, 0x2bU, 0xfeU, 0xd7U, 0xabU, 0x76U,
-    0xcaU, 0x82U, 0xc9U, 0x7dU, 0xfaU, 0x59U, 0x47U, 0xf0U,
-    0xadU, 0xd4U, 0xa2U, 0xafU, 0x9cU, 0xa4U, 0x72U, 0xc0U,
-    0xb7U, 0xfdU, 0x93U, 0x26U, 0x36U, 0x3fU, 0xf7U, 0xccU,
-    0x34U, 0xa5U, 0xe5U, 0xf1U, 0x71U, 0xd8U, 0x31U, 0x15U,
-    0x04U, 0xc7U, 0x23U, 0xc3U, 0x18U, 0x96U, 0x05U, 0x9aU,
-    0x07U, 0x12U, 0x80U, 0xe2U, 0xebU, 0x27U, 0xb2U, 0x75U,
-    0x09U, 0x83U, 0x2cU, 0x1aU, 0x1bU, 0x6eU, 0x5aU, 0xa0U,
-    0x52U, 0x3bU, 0xd6U, 0xb3U, 0x29U, 0xe3U, 0x2fU, 0x84U,
-    0x53U, 0xd1U, 0x00U, 0xedU, 0x20U, 0xfcU, 0xb1U, 0x5bU,
-    0x6aU, 0xcbU, 0xbeU, 0x39U, 0x4aU, 0x4cU, 0x58U, 0xcfU,
-    0xd0U, 0xefU, 0xaaU, 0xfbU, 0x43U, 0x4dU, 0x33U, 0x85U,
-    0x45U, 0xf9U, 0x02U, 0x7fU, 0x50U, 0x3cU, 0x9fU, 0xa8U,
-    0x51U, 0xa3U, 0x40U, 0x8fU, 0x92U, 0x9dU, 0x38U, 0xf5U,
-    0xbcU, 0xb6U, 0xdaU, 0x21U, 0x10U, 0xffU, 0xf3U, 0xd2U,
-    0xcdU, 0x0cU, 0x13U, 0xecU, 0x5fU, 0x97U, 0x44U, 0x17U,
-    0xc4U, 0xa7U, 0x7eU, 0x3dU, 0x64U, 0x5dU, 0x19U, 0x73U,
-    0x60U, 0x81U, 0x4fU, 0xdcU, 0x22U, 0x2aU, 0x90U, 0x88U,
-    0x46U, 0xeeU, 0xb8U, 0x14U, 0xdeU, 0x5eU, 0x0bU, 0xdbU,
-    0xe0U, 0x32U, 0x3aU, 0x0aU, 0x49U, 0x06U, 0x24U, 0x5cU,
-    0xc2U, 0xd3U, 0xacU, 0x62U, 0x91U, 0x95U, 0xe4U, 0x79U,
-    0xe7U, 0xc8U, 0x37U, 0x6dU, 0x8dU, 0xd5U, 0x4eU, 0xa9U,
-    0x6cU, 0x56U, 0xf4U, 0xeaU, 0x65U, 0x7aU, 0xaeU, 0x08U,
-    0xbaU, 0x78U, 0x25U, 0x2eU, 0x1cU, 0xa6U, 0xb4U, 0xc6U,
-    0xe8U, 0xddU, 0x74U, 0x1fU, 0x4bU, 0xbdU, 0x8bU, 0x8aU,
-    0x70U, 0x3eU, 0xb5U, 0x66U, 0x48U, 0x03U, 0xf6U, 0x0eU,
-    0x61U, 0x35U, 0x57U, 0xb9U, 0x86U, 0xc1U, 0x1dU, 0x9eU,
-    0xe1U, 0xf8U, 0x98U, 0x11U, 0x69U, 0xd9U, 0x8eU, 0x94U,
-    0x9bU, 0x1eU, 0x87U, 0xe9U, 0xceU, 0x55U, 0x28U, 0xdfU,
-    0x8cU, 0xa1U, 0x89U, 0x0dU, 0xbfU, 0xe6U, 0x42U, 0x68U,
-    0x41U, 0x99U, 0x2dU, 0x0fU, 0xb0U, 0x54U, 0xbbU, 0x16U
-};
-
-static const u64 Td[256] = {
-    U64(0x50a7f45150a7f451), U64(0x5365417e5365417e),
-    U64(0xc3a4171ac3a4171a), U64(0x965e273a965e273a),
-    U64(0xcb6bab3bcb6bab3b), U64(0xf1459d1ff1459d1f),
-    U64(0xab58faacab58faac), U64(0x9303e34b9303e34b),
-    U64(0x55fa302055fa3020), U64(0xf66d76adf66d76ad),
-    U64(0x9176cc889176cc88), U64(0x254c02f5254c02f5),
-    U64(0xfcd7e54ffcd7e54f), U64(0xd7cb2ac5d7cb2ac5),
-    U64(0x8044352680443526), U64(0x8fa362b58fa362b5),
-    U64(0x495ab1de495ab1de), U64(0x671bba25671bba25),
-    U64(0x980eea45980eea45), U64(0xe1c0fe5de1c0fe5d),
-    U64(0x02752fc302752fc3), U64(0x12f04c8112f04c81),
-    U64(0xa397468da397468d), U64(0xc6f9d36bc6f9d36b),
-    U64(0xe75f8f03e75f8f03), U64(0x959c9215959c9215),
-    U64(0xeb7a6dbfeb7a6dbf), U64(0xda595295da595295),
-    U64(0x2d83bed42d83bed4), U64(0xd3217458d3217458),
-    U64(0x2969e0492969e049), U64(0x44c8c98e44c8c98e),
-    U64(0x6a89c2756a89c275), U64(0x78798ef478798ef4),
-    U64(0x6b3e58996b3e5899), U64(0xdd71b927dd71b927),
-    U64(0xb64fe1beb64fe1be), U64(0x17ad88f017ad88f0),
-    U64(0x66ac20c966ac20c9), U64(0xb43ace7db43ace7d),
-    U64(0x184adf63184adf63), U64(0x82311ae582311ae5),
-    U64(0x6033519760335197), U64(0x457f5362457f5362),
-    U64(0xe07764b1e07764b1), U64(0x84ae6bbb84ae6bbb),
-    U64(0x1ca081fe1ca081fe), U64(0x942b08f9942b08f9),
-    U64(0x5868487058684870), U64(0x19fd458f19fd458f),
-    U64(0x876cde94876cde94), U64(0xb7f87b52b7f87b52),
-    U64(0x23d373ab23d373ab), U64(0xe2024b72e2024b72),
-    U64(0x578f1fe3578f1fe3), U64(0x2aab55662aab5566),
-    U64(0x0728ebb20728ebb2), U64(0x03c2b52f03c2b52f),
-    U64(0x9a7bc5869a7bc586), U64(0xa50837d3a50837d3),
-    U64(0xf2872830f2872830), U64(0xb2a5bf23b2a5bf23),
-    U64(0xba6a0302ba6a0302), U64(0x5c8216ed5c8216ed),
-    U64(0x2b1ccf8a2b1ccf8a), U64(0x92b479a792b479a7),
-    U64(0xf0f207f3f0f207f3), U64(0xa1e2694ea1e2694e),
-    U64(0xcdf4da65cdf4da65), U64(0xd5be0506d5be0506),
-    U64(0x1f6234d11f6234d1), U64(0x8afea6c48afea6c4),
-    U64(0x9d532e349d532e34), U64(0xa055f3a2a055f3a2),
-    U64(0x32e18a0532e18a05), U64(0x75ebf6a475ebf6a4),
-    U64(0x39ec830b39ec830b), U64(0xaaef6040aaef6040),
-    U64(0x069f715e069f715e), U64(0x51106ebd51106ebd),
-    U64(0xf98a213ef98a213e), U64(0x3d06dd963d06dd96),
-    U64(0xae053eddae053edd), U64(0x46bde64d46bde64d),
-    U64(0xb58d5491b58d5491), U64(0x055dc471055dc471),
-    U64(0x6fd406046fd40604), U64(0xff155060ff155060),
-    U64(0x24fb981924fb9819), U64(0x97e9bdd697e9bdd6),
-    U64(0xcc434089cc434089), U64(0x779ed967779ed967),
-    U64(0xbd42e8b0bd42e8b0), U64(0x888b8907888b8907),
-    U64(0x385b19e7385b19e7), U64(0xdbeec879dbeec879),
-    U64(0x470a7ca1470a7ca1), U64(0xe90f427ce90f427c),
-    U64(0xc91e84f8c91e84f8), U64(0x0000000000000000),
-    U64(0x8386800983868009), U64(0x48ed2b3248ed2b32),
-    U64(0xac70111eac70111e), U64(0x4e725a6c4e725a6c),
-    U64(0xfbff0efdfbff0efd), U64(0x5638850f5638850f),
-    U64(0x1ed5ae3d1ed5ae3d), U64(0x27392d3627392d36),
-    U64(0x64d90f0a64d90f0a), U64(0x21a65c6821a65c68),
-    U64(0xd1545b9bd1545b9b), U64(0x3a2e36243a2e3624),
-    U64(0xb1670a0cb1670a0c), U64(0x0fe757930fe75793),
-    U64(0xd296eeb4d296eeb4), U64(0x9e919b1b9e919b1b),
-    U64(0x4fc5c0804fc5c080), U64(0xa220dc61a220dc61),
-    U64(0x694b775a694b775a), U64(0x161a121c161a121c),
-    U64(0x0aba93e20aba93e2), U64(0xe52aa0c0e52aa0c0),
-    U64(0x43e0223c43e0223c), U64(0x1d171b121d171b12),
-    U64(0x0b0d090e0b0d090e), U64(0xadc78bf2adc78bf2),
-    U64(0xb9a8b62db9a8b62d), U64(0xc8a91e14c8a91e14),
-    U64(0x8519f1578519f157), U64(0x4c0775af4c0775af),
-    U64(0xbbdd99eebbdd99ee), U64(0xfd607fa3fd607fa3),
-    U64(0x9f2601f79f2601f7), U64(0xbcf5725cbcf5725c),
-    U64(0xc53b6644c53b6644), U64(0x347efb5b347efb5b),
-    U64(0x7629438b7629438b), U64(0xdcc623cbdcc623cb),
-    U64(0x68fcedb668fcedb6), U64(0x63f1e4b863f1e4b8),
-    U64(0xcadc31d7cadc31d7), U64(0x1085634210856342),
-    U64(0x4022971340229713), U64(0x2011c6842011c684),
-    U64(0x7d244a857d244a85), U64(0xf83dbbd2f83dbbd2),
-    U64(0x1132f9ae1132f9ae), U64(0x6da129c76da129c7),
-    U64(0x4b2f9e1d4b2f9e1d), U64(0xf330b2dcf330b2dc),
-    U64(0xec52860dec52860d), U64(0xd0e3c177d0e3c177),
-    U64(0x6c16b32b6c16b32b), U64(0x99b970a999b970a9),
-    U64(0xfa489411fa489411), U64(0x2264e9472264e947),
-    U64(0xc48cfca8c48cfca8), U64(0x1a3ff0a01a3ff0a0),
-    U64(0xd82c7d56d82c7d56), U64(0xef903322ef903322),
-    U64(0xc74e4987c74e4987), U64(0xc1d138d9c1d138d9),
-    U64(0xfea2ca8cfea2ca8c), U64(0x360bd498360bd498),
-    U64(0xcf81f5a6cf81f5a6), U64(0x28de7aa528de7aa5),
-    U64(0x268eb7da268eb7da), U64(0xa4bfad3fa4bfad3f),
-    U64(0xe49d3a2ce49d3a2c), U64(0x0d9278500d927850),
-    U64(0x9bcc5f6a9bcc5f6a), U64(0x62467e5462467e54),
-    U64(0xc2138df6c2138df6), U64(0xe8b8d890e8b8d890),
-    U64(0x5ef7392e5ef7392e), U64(0xf5afc382f5afc382),
-    U64(0xbe805d9fbe805d9f), U64(0x7c93d0697c93d069),
-    U64(0xa92dd56fa92dd56f), U64(0xb31225cfb31225cf),
-    U64(0x3b99acc83b99acc8), U64(0xa77d1810a77d1810),
-    U64(0x6e639ce86e639ce8), U64(0x7bbb3bdb7bbb3bdb),
-    U64(0x097826cd097826cd), U64(0xf418596ef418596e),
-    U64(0x01b79aec01b79aec), U64(0xa89a4f83a89a4f83),
-    U64(0x656e95e6656e95e6), U64(0x7ee6ffaa7ee6ffaa),
-    U64(0x08cfbc2108cfbc21), U64(0xe6e815efe6e815ef),
-    U64(0xd99be7bad99be7ba), U64(0xce366f4ace366f4a),
-    U64(0xd4099fead4099fea), U64(0xd67cb029d67cb029),
-    U64(0xafb2a431afb2a431), U64(0x31233f2a31233f2a),
-    U64(0x3094a5c63094a5c6), U64(0xc066a235c066a235),
-    U64(0x37bc4e7437bc4e74), U64(0xa6ca82fca6ca82fc),
-    U64(0xb0d090e0b0d090e0), U64(0x15d8a73315d8a733),
-    U64(0x4a9804f14a9804f1), U64(0xf7daec41f7daec41),
-    U64(0x0e50cd7f0e50cd7f), U64(0x2ff691172ff69117),
-    U64(0x8dd64d768dd64d76), U64(0x4db0ef434db0ef43),
-    U64(0x544daacc544daacc), U64(0xdf0496e4df0496e4),
-    U64(0xe3b5d19ee3b5d19e), U64(0x1b886a4c1b886a4c),
-    U64(0xb81f2cc1b81f2cc1), U64(0x7f5165467f516546),
-    U64(0x04ea5e9d04ea5e9d), U64(0x5d358c015d358c01),
-    U64(0x737487fa737487fa), U64(0x2e410bfb2e410bfb),
-    U64(0x5a1d67b35a1d67b3), U64(0x52d2db9252d2db92),
-    U64(0x335610e9335610e9), U64(0x1347d66d1347d66d),
-    U64(0x8c61d79a8c61d79a), U64(0x7a0ca1377a0ca137),
-    U64(0x8e14f8598e14f859), U64(0x893c13eb893c13eb),
-    U64(0xee27a9ceee27a9ce), U64(0x35c961b735c961b7),
-    U64(0xede51ce1ede51ce1), U64(0x3cb1477a3cb1477a),
-    U64(0x59dfd29c59dfd29c), U64(0x3f73f2553f73f255),
-    U64(0x79ce141879ce1418), U64(0xbf37c773bf37c773),
-    U64(0xeacdf753eacdf753), U64(0x5baafd5f5baafd5f),
-    U64(0x146f3ddf146f3ddf), U64(0x86db447886db4478),
-    U64(0x81f3afca81f3afca), U64(0x3ec468b93ec468b9),
-    U64(0x2c3424382c342438), U64(0x5f40a3c25f40a3c2),
-    U64(0x72c31d1672c31d16), U64(0x0c25e2bc0c25e2bc),
-    U64(0x8b493c288b493c28), U64(0x41950dff41950dff),
-    U64(0x7101a8397101a839), U64(0xdeb30c08deb30c08),
-    U64(0x9ce4b4d89ce4b4d8), U64(0x90c1566490c15664),
-    U64(0x6184cb7b6184cb7b), U64(0x70b632d570b632d5),
-    U64(0x745c6c48745c6c48), U64(0x4257b8d04257b8d0)
-};
-static const u8 Td4[256] = {
-    0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
-    0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
-    0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
-    0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
-    0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
-    0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
-    0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
-    0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
-    0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
-    0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
-    0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
-    0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
-    0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
-    0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
-    0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
-    0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
-    0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
-    0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
-    0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
-    0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
-    0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
-    0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
-    0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
-    0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
-    0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
-    0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
-    0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
-    0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
-    0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
-    0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
-    0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
-    0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU
-};
-
-static const u32 rcon[] = {
-    0x00000001U,
-    0x00000002U,
-    0x00000004U,
-    0x00000008U,
-    0x00000010U,
-    0x00000020U,
-    0x00000040U,
-    0x00000080U,
-    0x0000001bU,
-    0x00000036U, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
-};
-
-/**
- * Expand the cipher key into the encryption key schedule.
- */
-int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
-    AES_KEY *key)
-{
-
-    u32 *rk;
-    int i = 0;
-    u32 temp;
-
-    if (!userKey || !key)
-        return -1;
-    if (bits != 128 && bits != 192 && bits != 256)
-        return -2;
-
-    rk = key->rd_key;
-
-    if (bits == 128)
-        key->rounds = 10;
-    else if (bits == 192)
-        key->rounds = 12;
-    else
-        key->rounds = 14;
-
-    rk[0] = GETU32(userKey);
-    rk[1] = GETU32(userKey + 4);
-    rk[2] = GETU32(userKey + 8);
-    rk[3] = GETU32(userKey + 12);
-    if (bits == 128) {
-        while (1) {
-            temp = rk[3];
-            rk[4] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i];
-            rk[5] = rk[1] ^ rk[4];
-            rk[6] = rk[2] ^ rk[5];
-            rk[7] = rk[3] ^ rk[6];
-            if (++i == 10) {
-                return 0;
-            }
-            rk += 4;
-        }
-    }
-    rk[4] = GETU32(userKey + 16);
-    rk[5] = GETU32(userKey + 20);
-    if (bits == 192) {
-        while (1) {
-            temp = rk[5];
-            rk[6] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i];
-            rk[7] = rk[1] ^ rk[6];
-            rk[8] = rk[2] ^ rk[7];
-            rk[9] = rk[3] ^ rk[8];
-            if (++i == 8) {
-                return 0;
-            }
-            rk[10] = rk[4] ^ rk[9];
-            rk[11] = rk[5] ^ rk[10];
-            rk += 6;
-        }
-    }
-    rk[6] = GETU32(userKey + 24);
-    rk[7] = GETU32(userKey + 28);
-    if (bits == 256) {
-        while (1) {
-            temp = rk[7];
-            rk[8] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i];
-            rk[9] = rk[1] ^ rk[8];
-            rk[10] = rk[2] ^ rk[9];
-            rk[11] = rk[3] ^ rk[10];
-            if (++i == 7) {
-                return 0;
-            }
-            temp = rk[11];
-            rk[12] = rk[4] ^ ((u32)Te4[(temp) & 0xff]) ^ ((u32)Te4[(temp >> 8) & 0xff] << 8) ^ ((u32)Te4[(temp >> 16) & 0xff] << 16) ^ ((u32)Te4[(temp >> 24)] << 24);
-            rk[13] = rk[5] ^ rk[12];
-            rk[14] = rk[6] ^ rk[13];
-            rk[15] = rk[7] ^ rk[14];
-
-            rk += 8;
-        }
-    }
-    return 0;
-}
-
-/**
- * Expand the cipher key into the decryption key schedule.
- */
-int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
-    AES_KEY *key)
-{
-
-    u32 *rk;
-    int i, j, status;
-    u32 temp;
-
-    /* first, start with an encryption schedule */
-    status = AES_set_encrypt_key(userKey, bits, key);
-    if (status < 0)
-        return status;
-
-    rk = key->rd_key;
-
-    /* invert the order of the round keys: */
-    for (i = 0, j = 4 * (key->rounds); i < j; i += 4, j -= 4) {
-        temp = rk[i];
-        rk[i] = rk[j];
-        rk[j] = temp;
-        temp = rk[i + 1];
-        rk[i + 1] = rk[j + 1];
-        rk[j + 1] = temp;
-        temp = rk[i + 2];
-        rk[i + 2] = rk[j + 2];
-        rk[j + 2] = temp;
-        temp = rk[i + 3];
-        rk[i + 3] = rk[j + 3];
-        rk[j + 3] = temp;
-    }
-    /* apply the inverse MixColumn transform to all round keys but the first and the last: */
-    for (i = 1; i < (key->rounds); i++) {
-        rk += 4;
-#if 1
-        for (j = 0; j < 4; j++) {
-            u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
-
-            tp1 = rk[j];
-            m = tp1 & 0x80808080;
-            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-            m = tp2 & 0x80808080;
-            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-            m = tp4 & 0x80808080;
-            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-            tp9 = tp8 ^ tp1;
-            tpb = tp9 ^ tp2;
-            tpd = tp9 ^ tp4;
-            tpe = tp8 ^ tp4 ^ tp2;
-#if defined(ROTATE)
-            rk[j] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24);
-#else
-            rk[j] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24);
-#endif
-        }
-#else
-        rk[0] = Td0[Te2[(rk[0]) & 0xff] & 0xff] ^ Td1[Te2[(rk[0] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[0] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[0] >> 24)] & 0xff];
-        rk[1] = Td0[Te2[(rk[1]) & 0xff] & 0xff] ^ Td1[Te2[(rk[1] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[1] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[1] >> 24)] & 0xff];
-        rk[2] = Td0[Te2[(rk[2]) & 0xff] & 0xff] ^ Td1[Te2[(rk[2] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[2] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[2] >> 24)] & 0xff];
-        rk[3] = Td0[Te2[(rk[3]) & 0xff] & 0xff] ^ Td1[Te2[(rk[3] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[3] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[3] >> 24)] & 0xff];
-#endif
-    }
-    return 0;
-}
-
-/*
- * Encrypt a single block
- * in and out can overlap
- */
-void AES_encrypt(const unsigned char *in, unsigned char *out,
-    const AES_KEY *key)
-{
-
-    const u32 *rk;
-    u32 s0, s1, s2, s3, t[4];
-    int r;
-
-    assert(in && out && key);
-    rk = key->rd_key;
-
-    /*
-     * map byte array block to cipher state
-     * and add initial round key:
-     */
-    s0 = GETU32(in) ^ rk[0];
-    s1 = GETU32(in + 4) ^ rk[1];
-    s2 = GETU32(in + 8) ^ rk[2];
-    s3 = GETU32(in + 12) ^ rk[3];
-
-#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
-    prefetch256(Te4);
-
-    t[0] = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24;
-    t[1] = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24;
-    t[2] = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24;
-    t[3] = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24;
-
-    /* now do the linear transform using words */
-    {
-        int i;
-        u32 r0, r1, r2;
-
-        for (i = 0; i < 4; i++) {
-            r0 = t[i];
-            r1 = r0 & 0x80808080;
-            r2 = ((r0 & 0x7f7f7f7f) << 1) ^ ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
-#if defined(ROTATE)
-            t[i] = r2 ^ ROTATE(r2, 24) ^ ROTATE(r0, 24) ^ ROTATE(r0, 16) ^ ROTATE(r0, 8);
-#else
-            t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^ (r0 << 16) ^ (r0 >> 16) ^ (r0 << 8) ^ (r0 >> 24);
-#endif
-            t[i] ^= rk[4 + i];
-        }
-    }
-#else
-    t[0] = Te0[(s0) & 0xff] ^ Te1[(s1 >> 8) & 0xff] ^ Te2[(s2 >> 16) & 0xff] ^ Te3[(s3 >> 24)] ^ rk[4];
-    t[1] = Te0[(s1) & 0xff] ^ Te1[(s2 >> 8) & 0xff] ^ Te2[(s3 >> 16) & 0xff] ^ Te3[(s0 >> 24)] ^ rk[5];
-    t[2] = Te0[(s2) & 0xff] ^ Te1[(s3 >> 8) & 0xff] ^ Te2[(s0 >> 16) & 0xff] ^ Te3[(s1 >> 24)] ^ rk[6];
-    t[3] = Te0[(s3) & 0xff] ^ Te1[(s0 >> 8) & 0xff] ^ Te2[(s1 >> 16) & 0xff] ^ Te3[(s2 >> 24)] ^ rk[7];
-#endif
-    s0 = t[0];
-    s1 = t[1];
-    s2 = t[2];
-    s3 = t[3];
-
-    /*
-     * Nr - 2 full rounds:
-     */
-    for (rk += 8, r = key->rounds - 2; r > 0; rk += 4, r--) {
-#if defined(AES_COMPACT_IN_INNER_ROUNDS)
-        t[0] = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24;
-        t[1] = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24;
-        t[2] = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24;
-        t[3] = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24;
-
-        /* now do the linear transform using words */
-        {
-            int i;
-            u32 r0, r1, r2;
-
-            for (i = 0; i < 4; i++) {
-                r0 = t[i];
-                r1 = r0 & 0x80808080;
-                r2 = ((r0 & 0x7f7f7f7f) << 1) ^ ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
-#if defined(ROTATE)
-                t[i] = r2 ^ ROTATE(r2, 24) ^ ROTATE(r0, 24) ^ ROTATE(r0, 16) ^ ROTATE(r0, 8);
-#else
-                t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^ (r0 << 16) ^ (r0 >> 16) ^ (r0 << 8) ^ (r0 >> 24);
-#endif
-                t[i] ^= rk[i];
-            }
-        }
-#else
-        t[0] = Te0[(s0) & 0xff] ^ Te1[(s1 >> 8) & 0xff] ^ Te2[(s2 >> 16) & 0xff] ^ Te3[(s3 >> 24)] ^ rk[0];
-        t[1] = Te0[(s1) & 0xff] ^ Te1[(s2 >> 8) & 0xff] ^ Te2[(s3 >> 16) & 0xff] ^ Te3[(s0 >> 24)] ^ rk[1];
-        t[2] = Te0[(s2) & 0xff] ^ Te1[(s3 >> 8) & 0xff] ^ Te2[(s0 >> 16) & 0xff] ^ Te3[(s1 >> 24)] ^ rk[2];
-        t[3] = Te0[(s3) & 0xff] ^ Te1[(s0 >> 8) & 0xff] ^ Te2[(s1 >> 16) & 0xff] ^ Te3[(s2 >> 24)] ^ rk[3];
-#endif
-        s0 = t[0];
-        s1 = t[1];
-        s2 = t[2];
-        s3 = t[3];
-    }
-    /*
-     * apply last round and
-     * map cipher state to byte array block:
-     */
-#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
-    prefetch256(Te4);
-
-    *(u32 *)(out + 0) = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24 ^ rk[0];
-    *(u32 *)(out + 4) = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24 ^ rk[1];
-    *(u32 *)(out + 8) = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24 ^ rk[2];
-    *(u32 *)(out + 12) = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24 ^ rk[3];
-#else
-    *(u32 *)(out + 0) = (Te2[(s0) & 0xff] & 0x000000ffU) ^ (Te3[(s1 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s2 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s3 >> 24)] & 0xff000000U) ^ rk[0];
-    *(u32 *)(out + 4) = (Te2[(s1) & 0xff] & 0x000000ffU) ^ (Te3[(s2 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s3 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s0 >> 24)] & 0xff000000U) ^ rk[1];
-    *(u32 *)(out + 8) = (Te2[(s2) & 0xff] & 0x000000ffU) ^ (Te3[(s3 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s0 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s1 >> 24)] & 0xff000000U) ^ rk[2];
-    *(u32 *)(out + 12) = (Te2[(s3) & 0xff] & 0x000000ffU) ^ (Te3[(s0 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s1 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s2 >> 24)] & 0xff000000U) ^ rk[3];
-#endif
-}
-
-/*
- * Decrypt a single block
- * in and out can overlap
- */
-void AES_decrypt(const unsigned char *in, unsigned char *out,
-    const AES_KEY *key)
-{
-
-    const u32 *rk;
-    u32 s0, s1, s2, s3, t[4];
-    int r;
-
-    assert(in && out && key);
-    rk = key->rd_key;
-
-    /*
-     * map byte array block to cipher state
-     * and add initial round key:
-     */
-    s0 = GETU32(in) ^ rk[0];
-    s1 = GETU32(in + 4) ^ rk[1];
-    s2 = GETU32(in + 8) ^ rk[2];
-    s3 = GETU32(in + 12) ^ rk[3];
-
-#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
-    prefetch256(Td4);
-
-    t[0] = (u32)Td4[(s0) & 0xff] ^ (u32)Td4[(s3 >> 8) & 0xff] << 8 ^ (u32)Td4[(s2 >> 16) & 0xff] << 16 ^ (u32)Td4[(s1 >> 24)] << 24;
-    t[1] = (u32)Td4[(s1) & 0xff] ^ (u32)Td4[(s0 >> 8) & 0xff] << 8 ^ (u32)Td4[(s3 >> 16) & 0xff] << 16 ^ (u32)Td4[(s2 >> 24)] << 24;
-    t[2] = (u32)Td4[(s2) & 0xff] ^ (u32)Td4[(s1 >> 8) & 0xff] << 8 ^ (u32)Td4[(s0 >> 16) & 0xff] << 16 ^ (u32)Td4[(s3 >> 24)] << 24;
-    t[3] = (u32)Td4[(s3) & 0xff] ^ (u32)Td4[(s2 >> 8) & 0xff] << 8 ^ (u32)Td4[(s1 >> 16) & 0xff] << 16 ^ (u32)Td4[(s0 >> 24)] << 24;
-
-    /* now do the linear transform using words */
-    {
-        int i;
-        u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
-
-        for (i = 0; i < 4; i++) {
-            tp1 = t[i];
-            m = tp1 & 0x80808080;
-            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-            m = tp2 & 0x80808080;
-            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-            m = tp4 & 0x80808080;
-            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-            tp9 = tp8 ^ tp1;
-            tpb = tp9 ^ tp2;
-            tpd = tp9 ^ tp4;
-            tpe = tp8 ^ tp4 ^ tp2;
-#if defined(ROTATE)
-            t[i] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24);
-#else
-            t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24);
-#endif
-            t[i] ^= rk[4 + i];
-        }
-    }
-#else
-    t[0] = Td0[(s0) & 0xff] ^ Td1[(s3 >> 8) & 0xff] ^ Td2[(s2 >> 16) & 0xff] ^ Td3[(s1 >> 24)] ^ rk[4];
-    t[1] = Td0[(s1) & 0xff] ^ Td1[(s0 >> 8) & 0xff] ^ Td2[(s3 >> 16) & 0xff] ^ Td3[(s2 >> 24)] ^ rk[5];
-    t[2] = Td0[(s2) & 0xff] ^ Td1[(s1 >> 8) & 0xff] ^ Td2[(s0 >> 16) & 0xff] ^ Td3[(s3 >> 24)] ^ rk[6];
-    t[3] = Td0[(s3) & 0xff] ^ Td1[(s2 >> 8) & 0xff] ^ Td2[(s1 >> 16) & 0xff] ^ Td3[(s0 >> 24)] ^ rk[7];
-#endif
-    s0 = t[0];
-    s1 = t[1];
-    s2 = t[2];
-    s3 = t[3];
-
-    /*
-     * Nr - 2 full rounds:
-     */
-    for (rk += 8, r = key->rounds - 2; r > 0; rk += 4, r--) {
-#if defined(AES_COMPACT_IN_INNER_ROUNDS)
-        t[0] = (u32)Td4[(s0) & 0xff] ^ (u32)Td4[(s3 >> 8) & 0xff] << 8 ^ (u32)Td4[(s2 >> 16) & 0xff] << 16 ^ (u32)Td4[(s1 >> 24)] << 24;
-        t[1] = (u32)Td4[(s1) & 0xff] ^ (u32)Td4[(s0 >> 8) & 0xff] << 8 ^ (u32)Td4[(s3 >> 16) & 0xff] << 16 ^ (u32)Td4[(s2 >> 24)] << 24;
-        t[2] = (u32)Td4[(s2) & 0xff] ^ (u32)Td4[(s1 >> 8) & 0xff] << 8 ^ (u32)Td4[(s0 >> 16) & 0xff] << 16 ^ (u32)Td4[(s3 >> 24)] << 24;
-        t[3] = (u32)Td4[(s3) & 0xff] ^ (u32)Td4[(s2 >> 8) & 0xff] << 8 ^ (u32)Td4[(s1 >> 16) & 0xff] << 16 ^ (u32)Td4[(s0 >> 24)] << 24;
-
-        /* now do the linear transform using words */
-        {
-            int i;
-            u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
-
-            for (i = 0; i < 4; i++) {
-                tp1 = t[i];
-                m = tp1 & 0x80808080;
-                tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-                m = tp2 & 0x80808080;
-                tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-                m = tp4 & 0x80808080;
-                tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
-                tp9 = tp8 ^ tp1;
-                tpb = tp9 ^ tp2;
-                tpd = tp9 ^ tp4;
-                tpe = tp8 ^ tp4 ^ tp2;
-#if defined(ROTATE)
-                t[i] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24);
-#else
-                t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24);
-#endif
-                t[i] ^= rk[i];
-            }
-        }
-#else
-        t[0] = Td0[(s0) & 0xff] ^ Td1[(s3 >> 8) & 0xff] ^ Td2[(s2 >> 16) & 0xff] ^ Td3[(s1 >> 24)] ^ rk[0];
-        t[1] = Td0[(s1) & 0xff] ^ Td1[(s0 >> 8) & 0xff] ^ Td2[(s3 >> 16) & 0xff] ^ Td3[(s2 >> 24)] ^ rk[1];
-        t[2] = Td0[(s2) & 0xff] ^ Td1[(s1 >> 8) & 0xff] ^ Td2[(s0 >> 16) & 0xff] ^ Td3[(s3 >> 24)] ^ rk[2];
-        t[3] = Td0[(s3) & 0xff] ^ Td1[(s2 >> 8) & 0xff] ^ Td2[(s1 >> 16) & 0xff] ^ Td3[(s0 >> 24)] ^ rk[3];
-#endif
-        s0 = t[0];
-        s1 = t[1];
-        s2 = t[2];
-        s3 = t[3];
-    }
-    /*
-     * apply last round and
-     * map cipher state to byte array block:
-     */
-    prefetch256(Td4);
-
-    *(u32 *)(out + 0) = ((u32)Td4[(s0) & 0xff]) ^ ((u32)Td4[(s3 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s2 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s1 >> 24)] << 24) ^ rk[0];
-    *(u32 *)(out + 4) = ((u32)Td4[(s1) & 0xff]) ^ ((u32)Td4[(s0 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s3 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s2 >> 24)] << 24) ^ rk[1];
-    *(u32 *)(out + 8) = ((u32)Td4[(s2) & 0xff]) ^ ((u32)Td4[(s1 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s0 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s3 >> 24)] << 24) ^ rk[2];
-    *(u32 *)(out + 12) = ((u32)Td4[(s3) & 0xff]) ^ ((u32)Td4[(s2 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s1 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s0 >> 24)] << 24) ^ rk[3];
-}
diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl
index dde15b1ef7ee..87ed95cdf33c 100644
--- a/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/aesni-mb-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -80,6 +80,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
index 4e8fa1d753d7..bc08da946064 100644
--- a/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2011-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -111,6 +111,9 @@
 	   $1>=10);
 $avx=1 if (!$avx && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|.*based on LLVM) ([0-9]+\.[0-9]+)/ && $2>=3.0);
 
+$avx=1 if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` =~ /#define __clang_major__.([0-9]+)/ &&
+	   $1>=11); #icx started with clang 11
+
 $shaext=1;	### set to zero if compiling for 1.0.1
 
 $stitched_decrypt=0;
diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
index 39d29ddbb022..6715ba2e11a7 100644
--- a/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -75,6 +75,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 $shaext=$avx;	### set to zero if compiling for 1.0.1
 $avx=1		if (!$shaext && $avx);
 
diff --git a/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl b/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl
index d89564112e31..16f2bbe78964 100644
--- a/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl
+++ b/deps/openssl/openssl/crypto/aes/asm/aesni-xts-avx512.pl
@@ -59,6 +59,13 @@
     }
 }
 
+if (!$avx512vaes && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avx512vaes = ($1>=11); #icx started with clang 11
+    }
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/armcap.c b/deps/openssl/openssl/crypto/armcap.c
index 03e47dc5bbfb..3005d295cfd0 100644
--- a/deps/openssl/openssl/crypto/armcap.c
+++ b/deps/openssl/openssl/crypto/armcap.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -408,14 +408,38 @@ void OPENSSL_cpuid_setup(void)
     if (OPENSSL_armcap_P & ARMV8_CPUID)
         OPENSSL_arm_midr = _armv8_cpuid_probe();
 
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N1)) && (OPENSSL_armcap_P & ARMV7_NEON)) {
+    if ((OPENSSL_armcap_P & ARMV7_NEON)
+        && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N1)))
         OPENSSL_armv8_rsa_neonized = 1;
-    }
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N2) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_COBALT_100) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) && (OPENSSL_armcap_P & ARMV8_SHA3))
+
+    if ((OPENSSL_armcap_P & ARMV8_SHA3)
+        && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N2)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_COBALT_100)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2)
+            || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE))
         OPENSSL_armcap_P |= ARMV8_UNROLL8_EOR3;
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) && (OPENSSL_armcap_P & ARMV8_SHA3))
+
+    if ((OPENSSL_armcap_P & ARMV8_SHA3)
+        && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2)
+            || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE))
         OPENSSL_armcap_P |= ARMV8_UNROLL12_EOR3;
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX)) && (OPENSSL_armcap_P & ARMV8_SHA3))
+
+    if ((OPENSSL_armcap_P & ARMV8_SHA3)
+        && (MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_PRO)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_PRO)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX)
+            || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX)))
         OPENSSL_armcap_P |= ARMV8_HAVE_SHA3_AND_WORTH_USING;
 #endif
 }
diff --git a/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c b/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c
index a23dea8ebda2..19595683ef98 100644
--- a/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c
+++ b/deps/openssl/openssl/crypto/asn1/a_d2i_fp.c
@@ -139,7 +139,20 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
             }
             i = BIO_read(in, &(b->data[len]), want);
             if (i <= 0) {
-                ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
+                /*
+                 * A read error (i < 0), an EOF in the middle of an object
+                 * (diff != 0, some bytes already buffered), or an EOF while
+                 * still inside an indefinite-length constructed value awaiting
+                 * its end-of-contents octets (eos != 0) all mean the input is
+                 * truncated.  Only a clean EOF at a top-level object boundary
+                 * (i == 0, diff == 0, eos == 0) is the normal end of input:
+                 * fail without queuing an error so that callers looping over
+                 * concatenated DER values (e.g. the libcrypto d2i_*_bio()
+                 * consumers in CPython's ssl module) terminate cleanly instead
+                 * of seeing a spurious ASN1_R_NOT_ENOUGH_DATA.
+                 */
+                if (i < 0 || diff != 0 || eos != 0)
+                    ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
                 goto err;
             }
             if (i > 0) {
diff --git a/deps/openssl/openssl/crypto/asn1/a_mbstr.c b/deps/openssl/openssl/crypto/asn1/a_mbstr.c
index ce5618dfd48b..9a61f7f1e051 100644
--- a/deps/openssl/openssl/crypto/asn1/a_mbstr.c
+++ b/deps/openssl/openssl/crypto/asn1/a_mbstr.c
@@ -51,12 +51,24 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
     unsigned char *p;
     int nchar;
     int (*cpyfunc)(unsigned long, void *) = NULL;
-    if (len == -1)
-        len = strlen((const char *)in);
+    if (len == -1) {
+        size_t len_s = strlen((const char *)in);
+
+        if (len_s >= INT_MAX) {
+            ERR_raise(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG);
+            return -1;
+        }
+        len = (int)len_s;
+    }
     if (!mask)
         mask = DIRSTRING_TYPE;
-    if (len < 0)
+    if (len < 0) {
+        ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_INVALID_ARGUMENT);
+        return -1;
+    } else if (len >= INT_MAX) {
+        ERR_raise(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG);
         return -1;
+    }
 
     /* First do a string check and work out the number of characters */
     switch (inform) {
@@ -294,7 +306,7 @@ static int out_utf8(unsigned long value, void *arg)
         return len;
     }
     outlen = arg;
-    if (*outlen > INT_MAX - len) {
+    if (*outlen >= INT_MAX - len) {
         ERR_raise(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG);
         return -1;
     }
diff --git a/deps/openssl/openssl/crypto/asn1/asn1_gen.c b/deps/openssl/openssl/crypto/asn1/asn1_gen.c
index 1c8d3d585940..69fbd6f89e58 100644
--- a/deps/openssl/openssl/crypto/asn1/asn1_gen.c
+++ b/deps/openssl/openssl/crypto/asn1/asn1_gen.c
@@ -426,8 +426,11 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
                 depth + 1, perr);
             if (!typ)
                 goto bad;
-            if (!sk_ASN1_TYPE_push(sk, typ))
+
+            if (!sk_ASN1_TYPE_push(sk, typ)) {
+                ASN1_TYPE_free(typ);
                 goto bad;
+            }
         }
     }
 
diff --git a/deps/openssl/openssl/crypto/bio/bss_file.c b/deps/openssl/openssl/crypto/bio/bss_file.c
index 6b8daeb95f90..023bb458ce5f 100644
--- a/deps/openssl/openssl/crypto/bio/bss_file.c
+++ b/deps/openssl/openssl/crypto/bio/bss_file.c
@@ -312,7 +312,13 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
         /* the ptr parameter is actually a FILE ** in this case. */
         if (ptr != NULL) {
             fpp = (FILE **)ptr;
-            *fpp = (FILE *)b->ptr;
+            if (BIO_FLAGS_UPLINK_INTERNAL == 0
+                || b->flags & BIO_FLAGS_UPLINK_INTERNAL) {
+                *fpp = (FILE *)b->ptr;
+            } else { /* avoid returning internal FILE * to the app */
+                *fpp = NULL;
+                ret = 0;
+            }
         }
         break;
     case BIO_CTRL_GET_CLOSE:
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl
index 27f2e9b4b938..6c0cb566f9d7 100644
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avx512.pl
@@ -1,4 +1,4 @@
-# Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2020, Intel Corporation. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -64,6 +64,13 @@
     }
 }
 
+if (!$avx512ifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avx512ifma = ($1>=11); #icx started with clang 11
+    }
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl
index b84a3e4f1954..52d9781834d6 100644
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl
@@ -39,6 +39,13 @@
     $avxifma = ($ver>=16.0);
 }
 
+if (!$avxifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avxifma = ($1>=16);
+    }
+}
+
 if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
        `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) {
     my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl
index b2ed3e8ca7cf..fe5b1ebefab6 100644
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avx512.pl
@@ -1,4 +1,4 @@
-# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2021, Intel Corporation. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -63,6 +63,13 @@
     }
 }
 
+if (!$avx512ifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avx512ifma = ($1>=11); #icx started with clang 11
+    }
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl
index 1948d726b38b..aa11c546af6d 100644
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl
@@ -38,6 +38,13 @@
     $avxifma = ($ver>=16.0);
 }
 
+if (!$avxifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avxifma = ($1>=16);
+    }
+}
+
 if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
        `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) {
     $avxifma = ($1>2.16) + ($1==2.16 && ((!defined($2) && !defined($3)) || (defined($2))));
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl
index b76ab5904c88..b07180f6feca 100644
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avx512.pl
@@ -1,4 +1,4 @@
-# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2021, Intel Corporation. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -63,6 +63,13 @@
     }
 }
 
+if (!$avx512ifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avx512ifma = ($1>=11); #icx started with clang 11
+    }
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl
index 9f299430cefc..28a447800d0d 100644
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl
@@ -38,6 +38,13 @@
     $avxifma = ($ver>=16.0);
 }
 
+if (!$avxifma && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avxifma = ($1>=16);
+    }
+}
+
 if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
        `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) {
     $avxifma = ($1>2.16) + ($1==2.16 && ((!defined($2) && !defined($3)) || (defined($2))));
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl
index 59b9c89b5be2..29243a7c0b76 100755
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-avx2.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2012, Intel Corporation. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -73,6 +73,14 @@
 	$addx = ($ver>=3.03);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$addx = ($1>=11); #icx started with clang 11
+		$avx = ($1>=11);
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT = *OUT;
diff --git a/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl b/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl
index 64acf8f0d84d..3ceacea1d338 100755
--- a/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/rsaz-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2012, Intel Corporation. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -90,6 +90,13 @@
 	$addx = ($ver>=3.03);
 }
 
+if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$addx = ($1>=11); #icx started with clang 11
+	}
+}
+
 ($out, $inp, $mod) = ("%rdi", "%rsi", "%rbp");	# common internal API
 {
 my ($out,$inp,$mod,$n0,$times) = ("%rdi","%rsi","%rdx","%rcx","%r8d");
diff --git a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl
index 140072b899dc..9c7b3091f434 100755
--- a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2005-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2005-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -82,6 +82,13 @@
 	$addx = ($ver>=3.03);
 }
 
+if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$addx = ($1>=11); #icx started with clang 11
+	}
+}
+
 # int bn_mul_mont(
 $rp="%rdi";	# BN_ULONG *rp,
 $ap="%rsi";	# const BN_ULONG *ap,
diff --git a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl
index e06d13d74aea..52f95a485317 100755
--- a/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/x86_64-mont5.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2011-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -69,6 +69,13 @@
 	$addx = ($ver>=3.03);
 }
 
+if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$addx = ($1>=11); #icx started with clang 11
+	}
+}
+
 # int bn_mul_mont_gather5(
 $rp="%rdi";	# BN_ULONG *rp,
 $ap="%rsi";	# const BN_ULONG *ap,
diff --git a/deps/openssl/openssl/crypto/bn/bn_add.c b/deps/openssl/openssl/crypto/bn/bn_add.c
index 38de39d1b8ac..9c028269840c 100644
--- a/deps/openssl/openssl/crypto/bn/bn_add.c
+++ b/deps/openssl/openssl/crypto/bn/bn_add.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -97,6 +97,8 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         return 0;
 
     r->top = max;
+    if (max == 0)
+        goto end;
 
     ap = a->d;
     bp = b->d;
@@ -116,6 +118,7 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     *rp = carry;
     r->top += carry;
 
+end:
     r->neg = 0;
     bn_check_top(r);
     return 1;
@@ -143,6 +146,9 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     if (bn_wexpand(r, max) == NULL)
         return 0;
 
+    if (max == 0)
+        goto end;
+
     ap = a->d;
     bp = b->d;
     rp = r->d;
@@ -162,6 +168,7 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     while (max && *--rp == 0)
         max--;
 
+end:
     r->top = max;
     r->neg = 0;
     bn_pollute(r);
diff --git a/deps/openssl/openssl/crypto/bn/bn_exp.c b/deps/openssl/openssl/crypto/bn/bn_exp.c
index 44931f803802..ddcd89e2d4bc 100644
--- a/deps/openssl/openssl/crypto/bn/bn_exp.c
+++ b/deps/openssl/openssl/crypto/bn/bn_exp.c
@@ -552,7 +552,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
             BN_ULONG acc = 0;
 
             for (j = 0; j < width; j++) {
-                acc |= table[j] & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
+                acc |= table[j] & value_barrier_bn((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
             }
 
             b->d[i] = acc;
@@ -573,8 +573,9 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
             BN_ULONG acc = 0;
 
             for (j = 0; j < xstride; j++) {
-                acc |= ((table[j + 0 * xstride] & y0) | (table[j + 1 * xstride] & y1) | (table[j + 2 * xstride] & y2) | (table[j + 3 * xstride] & y3))
-                    & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
+                acc |= ((table[j + 0 * xstride] & value_barrier_bn(y0)) | (table[j + 1 * xstride] & value_barrier_bn(y1))
+                           | (table[j + 2 * xstride] & value_barrier_bn(y2)) | (table[j + 3 * xstride] & value_barrier_bn(y3)))
+                    & value_barrier_bn((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
             }
 
             b->d[i] = acc;
diff --git a/deps/openssl/openssl/crypto/bn/bn_lib.c b/deps/openssl/openssl/crypto/bn/bn_lib.c
index 93d54fd0a6ed..7961906f9ae7 100644
--- a/deps/openssl/openssl/crypto/bn/bn_lib.c
+++ b/deps/openssl/openssl/crypto/bn/bn_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -707,19 +707,37 @@ int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
     int i;
     BN_ULONG t1, t2, *ap, *bp;
 
+    /*
+     * As it is a public API function, we should handle NULL parameters in
+     * some way. The function can’t return an error, so let’s define that NULL
+     * is less than any BIGNUM.
+     */
+    if (!ossl_assert(a != NULL && b != NULL))
+        return (b == NULL) - (a == NULL);
+
     ap = a->d;
     bp = b->d;
 
     if (BN_get_flags(a, BN_FLG_CONSTTIME)
-        && a->top == b->top) {
+        || BN_get_flags(b, BN_FLG_CONSTTIME)) {
         int res = 0;
+        int min_top = a->top < b->top ? a->top : b->top;
 
-        for (i = 0; i < b->top; i++) {
+        for (i = 0; i < min_top; i++) {
             res = constant_time_select_int(constant_time_lt_bn(ap[i], bp[i]),
                 -1, res);
             res = constant_time_select_int(constant_time_lt_bn(bp[i], ap[i]),
                 1, res);
         }
+
+        for (i = min_top; i < a->top; ++i)
+            res = constant_time_select_int((int)constant_time_is_zero_bn(ap[i]),
+                res, 1);
+
+        for (i = min_top; i < b->top; ++i)
+            res = constant_time_select_int((int)constant_time_is_zero_bn(bp[i]),
+                res, -1);
+
         return res;
     }
 
@@ -948,11 +966,11 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
 
     condition = ((~condition & ((condition - 1))) >> (BN_BITS2 - 1)) - 1;
 
-    t = (a->top ^ b->top) & condition;
+    t = (a->top ^ b->top) & value_barrier_bn(condition);
     a->top ^= t;
     b->top ^= t;
 
-    t = (a->neg ^ b->neg) & condition;
+    t = (a->neg ^ b->neg) & value_barrier_bn(condition);
     a->neg ^= t;
     b->neg ^= t;
 
@@ -980,13 +998,13 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
 
 #define BN_CONSTTIME_SWAP_FLAGS (BN_FLG_CONSTTIME | BN_FLG_FIXED_TOP)
 
-    t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & condition;
+    t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & value_barrier_bn(condition);
     a->flags ^= t;
     b->flags ^= t;
 
     /* conditionally swap the data */
     for (i = 0; i < nwords; i++) {
-        t = (a->d[i] ^ b->d[i]) & condition;
+        t = (a->d[i] ^ b->d[i]) & value_barrier_bn(condition);
         a->d[i] ^= t;
         b->d[i] ^= t;
     }
diff --git a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl
index a1ea4ea461b0..b95d4df37979 100755
--- a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl
+++ b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -64,6 +64,10 @@
 		`$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/ &&
 		$2>=3.0);	# first version supporting AVX
 
+$ymm=1 if ($xmm && !$ymm &&
+		`$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` =~ /#define __clang_major__.([0-9]+)/ &&
+		$1>=11); #icx started with clang 11
+
 $a="eax";
 ($b,$b_)=("ebx","ebp");
 ($c,$c_)=("ecx","esi");
diff --git a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl
index d46bc03b3eec..69e5319ad43e 100755
--- a/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl
+++ b/deps/openssl/openssl/crypto/chacha/asm/chacha-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -91,6 +91,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/cmp/cmp_protect.c b/deps/openssl/openssl/crypto/cmp/cmp_protect.c
index 1c8d2135fdab..110693b84038 100644
--- a/deps/openssl/openssl/crypto/cmp/cmp_protect.c
+++ b/deps/openssl/openssl/crypto/cmp/cmp_protect.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright Nokia 2007-2019
  * Copyright Siemens AG 2015-2019
  *
@@ -66,7 +66,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
             ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
             return NULL;
         }
-        if (ppval == NULL) {
+        if (pptype != V_ASN1_SEQUENCE || ppval == NULL) {
             ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
             return NULL;
         }
diff --git a/deps/openssl/openssl/crypto/cmp/cmp_vfy.c b/deps/openssl/openssl/crypto/cmp/cmp_vfy.c
index eaa700d139d1..e79adb09d387 100644
--- a/deps/openssl/openssl/crypto/cmp/cmp_vfy.c
+++ b/deps/openssl/openssl/crypto/cmp/cmp_vfy.c
@@ -64,8 +64,10 @@ static int verify_signature(const OSSL_CMP_CTX *cmp_ctx,
 sig_err:
     res = ossl_x509_print_ex_brief(bio, cert, X509_FLAG_NO_EXTENSIONS);
     ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_VALIDATING_SIGNATURE);
-    if (res)
-        ERR_add_error_mem_bio("\n", bio);
+    if (res) {
+        ERR_add_error_txt(NULL, "\n");
+        ERR_add_error_mem_bio(NULL, bio);
+    }
     res = 0;
 
 end:
@@ -387,7 +389,7 @@ static int check_msg_with_certs(OSSL_CMP_CTX *ctx, const STACK_OF(X509) *certs,
     int i;
 
     if (sk_X509_num(certs) <= 0) {
-        ossl_cmp_log1(WARN, ctx, "no %s", desc);
+        ossl_cmp_log1(INFO, ctx, "no %s", desc);
         return 0;
     }
 
@@ -407,7 +409,7 @@ static int check_msg_with_certs(OSSL_CMP_CTX *ctx, const STACK_OF(X509) *certs,
         }
     }
     if (in_extraCerts && n_acceptable_certs == 0)
-        ossl_cmp_warn(ctx, "no acceptable cert in extraCerts");
+        ossl_cmp_log1(WARN, ctx, "no acceptable %s", desc);
     return 0;
 }
 
@@ -502,14 +504,14 @@ static int check_msg_find_cert(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg)
 
     res = check_msg_all_certs(ctx, msg, 0 /* using ctx->trusted */)
         || check_msg_all_certs(ctx, msg, 1 /* 3gpp */);
-    ctx->log_cb = backup_log_cb;
-    if (res) {
-        /* discard any diagnostic information on trying to use certs */
-        (void)ERR_pop_to_mark();
+
+    ctx->log_cb = backup_log_cb; /* re-enable logging */
+    /* discard any previous diagnostic information on trying to use certs */
+    (void)ERR_pop_to_mark();
+
+    if (res)
         goto end;
-    }
     /* failed finding a sender cert that verifies the message signature */
-    (void)ERR_clear_last_mark();
 
     sname = X509_NAME_oneline(sender->d.directoryName, NULL, 0);
     skid_str = skid == NULL ? NULL : i2s_ASN1_OCTET_STRING(NULL, skid);
@@ -732,7 +734,7 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
                 "expected sender", expected_sender)) {
             str = X509_NAME_oneline(actual_sender, NULL, 0);
             ERR_raise_data(ERR_LIB_CMP, CMP_R_UNEXPECTED_SENDER,
-                str != NULL ? str : "<unknown>");
+                "%s", str != NULL ? str : "<unknown>");
             OPENSSL_free(str);
             return 0;
         }
@@ -776,8 +778,13 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
     res = 1; /* support more aggressive fuzzing by letting invalid msg pass */
 #endif
 
-    /* remove extraCerts again if not caching */
-    if (ctx->noCacheExtraCerts)
+    /*
+     * remove extraCerts again if not caching
+     * or if we failed validation above, lest a remote user
+     * starts sending us lots of certificates in invalid messages
+     * leading to a DOS from unbounded certificate stack growth
+     */
+    if (ctx->noCacheExtraCerts || res != 1)
         while (num_added-- > 0)
             X509_free(sk_X509_shift(ctx->untrusted));
 
diff --git a/deps/openssl/openssl/crypto/cms/cms_asn1.c b/deps/openssl/openssl/crypto/cms/cms_asn1.c
index fb87f6c6ad27..b3c103699031 100644
--- a/deps/openssl/openssl/crypto/cms/cms_asn1.c
+++ b/deps/openssl/openssl/crypto/cms/cms_asn1.c
@@ -245,9 +245,9 @@ ASN1_NDEF_SEQUENCE(CMS_AuthEnvelopedData) = {
     ASN1_IMP_OPT(CMS_AuthEnvelopedData, originatorInfo, CMS_OriginatorInfo, 0),
     ASN1_SET_OF(CMS_AuthEnvelopedData, recipientInfos, CMS_RecipientInfo),
     ASN1_SIMPLE(CMS_AuthEnvelopedData, authEncryptedContentInfo, CMS_EncryptedContentInfo),
-    ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, authAttrs, X509_ALGOR, 2),
+    ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, authAttrs, X509_ATTRIBUTE, 1),
     ASN1_SIMPLE(CMS_AuthEnvelopedData, mac, ASN1_OCTET_STRING),
-    ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, unauthAttrs, X509_ALGOR, 3)
+    ASN1_IMP_SET_OF_OPT(CMS_AuthEnvelopedData, unauthAttrs, X509_ATTRIBUTE, 2)
 } ASN1_NDEF_SEQUENCE_END(CMS_AuthEnvelopedData)
 
 ASN1_NDEF_SEQUENCE(CMS_AuthenticatedData) = {
@@ -257,9 +257,9 @@ ASN1_NDEF_SEQUENCE(CMS_AuthenticatedData) = {
     ASN1_SIMPLE(CMS_AuthenticatedData, macAlgorithm, X509_ALGOR),
     ASN1_IMP(CMS_AuthenticatedData, digestAlgorithm, X509_ALGOR, 1),
     ASN1_SIMPLE(CMS_AuthenticatedData, encapContentInfo, CMS_EncapsulatedContentInfo),
-    ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, authAttrs, X509_ALGOR, 2),
+    ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, authAttrs, X509_ATTRIBUTE, 2),
     ASN1_SIMPLE(CMS_AuthenticatedData, mac, ASN1_OCTET_STRING),
-    ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, unauthAttrs, X509_ALGOR, 3)
+    ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, unauthAttrs, X509_ATTRIBUTE, 3)
 } static_ASN1_NDEF_SEQUENCE_END(CMS_AuthenticatedData)
 
 ASN1_NDEF_SEQUENCE(CMS_CompressedData)
diff --git a/deps/openssl/openssl/crypto/cms/cms_env.c b/deps/openssl/openssl/crypto/cms/cms_env.c
index a8ecabb64ed7..ee86ae71d3ed 100644
--- a/deps/openssl/openssl/crypto/cms/cms_env.c
+++ b/deps/openssl/openssl/crypto/cms/cms_env.c
@@ -928,6 +928,7 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
     CMS_EncryptedContentInfo *ec;
     CMS_KEKRecipientInfo *kekri;
     unsigned char *ukey = NULL;
+    size_t ukey_alloc_len = 0;
     int ukeylen;
     int r = 0, wrap_nid;
     EVP_CIPHER *cipher = NULL;
@@ -965,7 +966,8 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
         goto err;
     }
 
-    ukey = OPENSSL_malloc(kekri->encryptedKey->length - 8);
+    ukey_alloc_len = (size_t)kekri->encryptedKey->length - 8;
+    ukey = OPENSSL_malloc(ukey_alloc_len);
     if (ukey == NULL)
         goto err;
 
@@ -994,7 +996,7 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
 err:
     EVP_CIPHER_free(cipher);
     if (!r)
-        OPENSSL_free(ukey);
+        OPENSSL_clear_free(ukey, ukey_alloc_len);
     EVP_CIPHER_CTX_free(ctx);
 
     return r;
@@ -1204,6 +1206,35 @@ BIO *ossl_cms_EnvelopedData_init_bio(CMS_ContentInfo *cms)
     return cms_EnvelopedData_Decryption_init_bio(cms);
 }
 
+/* The DER encoding of authAttrs, with the universal SET OF tag, is the AAD */
+static int cms_AuthEnvelopedData_set_aad(BIO *b,
+    STACK_OF(X509_ATTRIBUTE) *authAttrs)
+{
+    EVP_CIPHER_CTX *ctx;
+    unsigned char *aad = NULL;
+    int aadlen, outl, ok = 0;
+    const ASN1_ITEM *item;
+
+    if (!BIO_get_cipher_ctx(b, &ctx))
+        return 0;
+    item = EVP_CIPHER_CTX_is_encrypting(ctx)
+        ? ASN1_ITEM_rptr(CMS_Attributes_AadEncrypt)
+        : ASN1_ITEM_rptr(CMS_Attributes_AadDecrypt);
+    aadlen = ASN1_item_i2d((ASN1_VALUE *)authAttrs, &aad, item);
+    if (aadlen <= 0 || aad == NULL) {
+        ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
+        goto err;
+    }
+    if (EVP_CipherUpdate(ctx, NULL, &outl, aad, aadlen) <= 0) {
+        ERR_raise(ERR_LIB_CMS, CMS_R_CTRL_FAILURE);
+        goto err;
+    }
+    ok = 1;
+err:
+    OPENSSL_free(aad);
+    return ok;
+}
+
 BIO *ossl_cms_AuthEnvelopedData_init_bio(CMS_ContentInfo *cms)
 {
     CMS_EncryptedContentInfo *ec;
@@ -1220,9 +1251,16 @@ BIO *ossl_cms_AuthEnvelopedData_init_bio(CMS_ContentInfo *cms)
         ec->taglen = aenv->mac->length;
     }
     ret = ossl_cms_EncryptedContent_init_bio(ec, ossl_cms_get0_cmsctx(cms), 1);
+    if (ret == NULL)
+        return NULL;
+
+    /* authAttrs, if present, are the AEAD associated data */
+    if (aenv->authAttrs != NULL
+        && !cms_AuthEnvelopedData_set_aad(ret, aenv->authAttrs))
+        goto err;
 
-    /* If error or no cipher end of processing */
-    if (ret == NULL || ec->cipher == NULL)
+    /* If no cipher end of processing */
+    if (ec->cipher == NULL)
         return ret;
 
     /* Now encrypt content key according to each RecipientInfo type */
diff --git a/deps/openssl/openssl/crypto/cms/cms_kari.c b/deps/openssl/openssl/crypto/cms/cms_kari.c
index eb5b5d786285..459991525f09 100644
--- a/deps/openssl/openssl/crypto/cms/cms_kari.c
+++ b/deps/openssl/openssl/crypto/cms/cms_kari.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -216,7 +216,9 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
     size_t keklen;
     int rv = 0;
     unsigned char *out = NULL;
+    size_t out_alloc_len = 0;
     int outlen;
+    size_t outsize;
 
     keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx);
     if (keklen > EVP_MAX_KEY_LENGTH)
@@ -230,10 +232,17 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
     /* obtain output length of ciphered key */
     if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen))
         goto err;
-    out = OPENSSL_malloc(outlen);
+    /*
+     * On its integrity-failure paths that primitive writes and cleanses up to
+     * inlen bytes of the output buffer. Size the buffer for that worst case so
+     * a failed unwrap cannot write past the allocation.
+     */
+    outsize = (size_t)outlen < inlen ? inlen : (size_t)outlen;
+    out = OPENSSL_malloc(outsize);
     if (out == NULL)
         goto err;
-    if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, inlen))
+    out_alloc_len = (size_t)outlen;
+    if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, (int)inlen))
         goto err;
     *pout = out;
     *poutlen = (size_t)outlen;
@@ -242,7 +251,7 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
 err:
     OPENSSL_cleanse(kek, keklen);
     if (!rv)
-        OPENSSL_free(out);
+        OPENSSL_clear_free(out, out_alloc_len);
     EVP_CIPHER_CTX_reset(kari->ctx);
     /* FIXME: WHY IS kari->pctx freed here?  /RL */
     EVP_PKEY_CTX_free(kari->pctx);
diff --git a/deps/openssl/openssl/crypto/cms/cms_local.h b/deps/openssl/openssl/crypto/cms/cms_local.h
index 94496b3823ef..55f41af054be 100644
--- a/deps/openssl/openssl/crypto/cms/cms_local.h
+++ b/deps/openssl/openssl/crypto/cms/cms_local.h
@@ -371,6 +371,9 @@ DECLARE_ASN1_ITEM(CMS_EncryptedContentInfo)
 DECLARE_ASN1_ITEM(CMS_IssuerAndSerialNumber)
 DECLARE_ASN1_ITEM(CMS_Attributes_Sign)
 DECLARE_ASN1_ITEM(CMS_Attributes_Verify)
+/* The authAttrs AAD encoding matches the signed-attributes one */
+#define CMS_Attributes_AadEncrypt_it CMS_Attributes_Sign_it
+#define CMS_Attributes_AadDecrypt_it CMS_Attributes_Verify_it
 DECLARE_ASN1_ITEM(CMS_RecipientInfo)
 DECLARE_ASN1_ITEM(CMS_PasswordRecipientInfo)
 DECLARE_ASN1_ALLOC_FUNCTIONS(CMS_IssuerAndSerialNumber)
diff --git a/deps/openssl/openssl/crypto/cms/cms_pwri.c b/deps/openssl/openssl/crypto/cms/cms_pwri.c
index 54f0eda2a2d8..de59c74fdd6e 100644
--- a/deps/openssl/openssl/crypto/cms/cms_pwri.c
+++ b/deps/openssl/openssl/crypto/cms/cms_pwri.c
@@ -315,6 +315,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms,
     EVP_CIPHER *kekcipher;
     unsigned char *key = NULL;
     size_t keylen;
+    size_t key_alloc_len = 0;
     const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
 
     ec = ossl_cms_get0_env_enc_content(cms);
@@ -391,6 +392,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms,
 
         if (key == NULL)
             goto err;
+        key_alloc_len = keylen;
 
         if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, kekctx, cms_ctx))
             goto err;
@@ -400,6 +402,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms,
         key = OPENSSL_malloc(pwri->encryptedKey->length);
         if (key == NULL)
             goto err;
+        key_alloc_len = (size_t)pwri->encryptedKey->length;
         if (!kek_unwrap_key(key, &keylen,
                 pwri->encryptedKey->data,
                 pwri->encryptedKey->length, kekctx)) {
@@ -419,7 +422,7 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms,
     EVP_CIPHER_CTX_free(kekctx);
 
     if (!r)
-        OPENSSL_free(key);
+        OPENSSL_clear_free(key, key_alloc_len);
     X509_ALGOR_free(kekalg);
 
     return r;
diff --git a/deps/openssl/openssl/crypto/cms/cms_smime.c b/deps/openssl/openssl/crypto/cms/cms_smime.c
index 4b5009b9d5bf..dea1df084764 100644
--- a/deps/openssl/openssl/crypto/cms/cms_smime.c
+++ b/deps/openssl/openssl/crypto/cms/cms_smime.c
@@ -36,6 +36,7 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
     unsigned char buf[4096];
     int r = 0, i;
     BIO *tmpout;
+    BIO *aeadbuf = NULL;
 
     tmpout = cms_get_text_bio(out, flags);
 
@@ -44,6 +45,33 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
         goto err;
     }
 
+    /*
+     * For AEAD content (AuthEnvelopedData) the integrity tag is only verified
+     * once all the ciphertext has been processed, by the
+     * BIO_get_cipher_status() call below. RFC 5083 requires that the plaintext
+     * is not released to the caller until that verification succeeds, so
+     * buffer it in memory and only forward it to the output BIO once the tag
+     * has been checked. When CMS_TEXT is set tmpout is already a memory BIO
+     * that is flushed only on success, so the extra buffering is not needed.
+     */
+    if (tmpout == out && BIO_method_type(in) == BIO_TYPE_CIPHER) {
+        EVP_CIPHER_CTX *ctx = NULL;
+
+        if (BIO_get_cipher_ctx(in, &ctx) > 0 && ctx != NULL
+            && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
+                   & EVP_CIPH_FLAG_AEAD_CIPHER)
+                != 0) {
+            aeadbuf = BIO_new(BIO_s_mem());
+            if (aeadbuf == NULL) {
+                ERR_raise(ERR_LIB_CMS, ERR_R_BIO_LIB);
+                goto err;
+            }
+            /* Return 0 (EOF) rather than a retryable -1 once drained. */
+            BIO_set_mem_eof_return(aeadbuf, 0);
+            tmpout = aeadbuf;
+        }
+    }
+
     /* Read all content through chain to process digest, decrypt etc */
     for (;;) {
         i = BIO_read(in, buf, sizeof(buf));
@@ -66,6 +94,17 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
             ERR_raise(ERR_LIB_CMS, CMS_R_SMIME_TEXT_ERROR);
             goto err;
         }
+    } else if (aeadbuf != NULL) {
+        /* Forward the AEAD BIO to out BIO as the tag has been verified. */
+        for (;;) {
+            i = BIO_read(aeadbuf, buf, sizeof(buf));
+            if (i < 0)
+                goto err;
+            if (i == 0)
+                break;
+            if (BIO_write(out, buf, i) != i)
+                goto err;
+        }
     }
 
     r = 1;
diff --git a/deps/openssl/openssl/crypto/ct/ct_b64.c b/deps/openssl/openssl/crypto/ct/ct_b64.c
index e7eb9740ee08..01bd8fc508d6 100644
--- a/deps/openssl/openssl/crypto/ct/ct_b64.c
+++ b/deps/openssl/openssl/crypto/ct/ct_b64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -84,7 +84,7 @@ SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64,
 
     declen = ct_base64_decode(logid_base64, &dec);
     if (declen < 0) {
-        ERR_raise(ERR_LIB_CT, X509_R_BASE64_DECODE_ERROR);
+        ERR_raise(ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR);
         goto err;
     }
     if (!SCT_set0_log_id(sct, dec, declen))
@@ -93,7 +93,7 @@ SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64,
 
     declen = ct_base64_decode(extensions_base64, &dec);
     if (declen < 0) {
-        ERR_raise(ERR_LIB_CT, X509_R_BASE64_DECODE_ERROR);
+        ERR_raise(ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR);
         goto err;
     }
     SCT_set0_extensions(sct, dec, declen);
@@ -101,7 +101,7 @@ SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64,
 
     declen = ct_base64_decode(signature_base64, &dec);
     if (declen < 0) {
-        ERR_raise(ERR_LIB_CT, X509_R_BASE64_DECODE_ERROR);
+        ERR_raise(ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR);
         goto err;
     }
 
diff --git a/deps/openssl/openssl/crypto/ctype.c b/deps/openssl/openssl/crypto/ctype.c
index 686fe64165fc..4f19d6002c5e 100644
--- a/deps/openssl/openssl/crypto/ctype.c
+++ b/deps/openssl/openssl/crypto/ctype.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -226,7 +226,7 @@ static const unsigned short ctype_char_map[128] = {
 #ifdef CHARSET_EBCDIC
 int ossl_toascii(int c)
 {
-    if (c < -128 || c > 256 || c == EOF)
+    if (c < -128 || c >= 256 || c == EOF)
         return c;
     /*
      * Adjust negatively signed characters.
@@ -241,7 +241,7 @@ int ossl_toascii(int c)
 
 int ossl_fromascii(int c)
 {
-    if (c < -128 || c > 256 || c == EOF)
+    if (c < -128 || c >= 256 || c == EOF)
         return c;
     if (c < 0)
         c += 256;
diff --git a/deps/openssl/openssl/crypto/dh/dh_backend.c b/deps/openssl/openssl/crypto/dh/dh_backend.c
index f68429862cd5..77b0b3257fb7 100644
--- a/deps/openssl/openssl/crypto/dh/dh_backend.c
+++ b/deps/openssl/openssl/crypto/dh/dh_backend.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -232,7 +232,7 @@ DH *ossl_dh_key_from_pkcs8(const PKCS8_PRIV_KEY_INFO *p8inf,
     goto done;
 
 decerr:
-    ERR_raise(ERR_LIB_DH, EVP_R_DECODE_ERROR);
+    ERR_raise(ERR_LIB_DH, DH_R_DECODE_ERROR);
 dherr:
     DH_free(dh);
     dh = NULL;
diff --git a/deps/openssl/openssl/crypto/dh/dh_check.c b/deps/openssl/openssl/crypto/dh/dh_check.c
index 3002609b68f5..8787945f8a1c 100644
--- a/deps/openssl/openssl/crypto/dh/dh_check.c
+++ b/deps/openssl/openssl/crypto/dh/dh_check.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -74,6 +74,14 @@ int DH_check_params(const DH *dh, int *ret)
     BN_CTX *ctx = NULL;
 
     *ret = 0;
+    /*
+     * A DH with no modulus or generator cannot be checked.  Report
+     * the failure via |*ret| rather than dereferencing NULL below.
+     */
+    if (dh->params.p == NULL || dh->params.g == NULL) {
+        *ret = DH_NOT_SUITABLE_GENERATOR | DH_CHECK_P_NOT_PRIME;
+        return 1;
+    }
     ctx = BN_CTX_new_ex(dh->libctx);
     if (ctx == NULL)
         goto err;
@@ -150,6 +158,11 @@ int DH_check(const DH *dh, int *ret)
     int nid = DH_get_nid((DH *)dh);
 
     *ret = 0;
+    /* A DH with no modulus or generator cannot be checked. */
+    if (dh->params.p == NULL || dh->params.g == NULL) {
+        *ret = DH_NOT_SUITABLE_GENERATOR | DH_CHECK_P_NOT_PRIME;
+        return 1;
+    }
     if (nid != NID_undef)
         return 1;
 
@@ -250,6 +263,15 @@ int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key)
  */
 int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
 {
+    *ret = 0;
+    /*
+     * Without a modulus we cannot check anything; signal failure via
+     * |*ret| rather than crashing in BN_num_bits below.
+     */
+    if (dh->params.p == NULL) {
+        *ret = DH_CHECK_PUBKEY_INVALID;
+        return 1;
+    }
     /* Don't do any checks at all with an excessively large modulus */
     if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
         ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE);
diff --git a/deps/openssl/openssl/crypto/dsa/dsa_key.c b/deps/openssl/openssl/crypto/dsa/dsa_key.c
index aa69c3eea8fb..738915cc4f3d 100644
--- a/deps/openssl/openssl/crypto/dsa/dsa_key.c
+++ b/deps/openssl/openssl/crypto/dsa/dsa_key.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -198,7 +198,6 @@ static int dsa_keygen(DSA *dsa)
         ok = dsa_keygen_pairwise_test(dsa, cb, cbarg)
             && dsa_keygen_knownanswer_test(dsa, ctx, cb, cbarg);
         if (!ok) {
-            ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
             BN_free(dsa->pub_key);
             BN_clear_free(dsa->priv_key);
             dsa->pub_key = NULL;
diff --git a/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl b/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl
index 4da9a149a99a..12a104b5ec0f 100755
--- a/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl
+++ b/deps/openssl/openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2014-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2014-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2014, Intel Corporation. All Rights Reserved.
 # Copyright (c) 2015 CloudFlare, Inc.
 #
@@ -80,6 +80,14 @@
 	$addx = ($ver>=3.03);
 }
 
+if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+		$addx = ($1>=11);
+	}
+}
+
 $code.=<<___;
 .text
 .extern	OPENSSL_ia32cap_P
diff --git a/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl b/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl
index d2285269a308..204c51854813 100755
--- a/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl
+++ b/deps/openssl/openssl/crypto/ec/asm/x25519-x86_64.pl
@@ -1,5 +1,5 @@
 #!/usr/bin/env perl
-# Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -97,6 +97,13 @@
 	$addx = ($ver>=3.03);
 }
 
+if (!$addx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$addx = ($1>=11); #icx started with clang 11
+	}
+}
+
 $code.=<<___;
 .text
 
diff --git a/deps/openssl/openssl/crypto/ec/ec_key.c b/deps/openssl/openssl/crypto/ec/ec_key.c
index 8723ead41e0e..71f1c63e2ab6 100644
--- a/deps/openssl/openssl/crypto/ec/ec_key.c
+++ b/deps/openssl/openssl/crypto/ec/ec_key.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -236,56 +236,6 @@ int ossl_ec_key_gen(EC_KEY *eckey)
     return ret;
 }
 
-/*
- * Refer: FIPS 140-3 IG 10.3.A Additional Comment 1
- * Perform a KAT by duplicating the public key generation.
- *
- * NOTE: This issue requires a background understanding, provided in a separate
- * document; the current IG 10.3.A AC1 is insufficient regarding the PCT for
- * the key agreement scenario.
- *
- * Currently IG 10.3.A requires PCT in the mode of use prior to use of the
- * key pair, citing the PCT defined in the associated standard. For key
- * agreement, the only PCT defined in SP 800-56A is that of Section 5.6.2.4:
- * the comparison of the original public key to a newly calculated public key.
- */
-static int ecdsa_keygen_knownanswer_test(EC_KEY *eckey, BN_CTX *ctx,
-    OSSL_CALLBACK *cb, void *cbarg)
-{
-    int len, ret = 0;
-    OSSL_SELF_TEST *st = NULL;
-    unsigned char bytes[512] = { 0 };
-    EC_POINT *pub_key2 = NULL;
-
-    st = OSSL_SELF_TEST_new(cb, cbarg);
-    if (st == NULL)
-        return 0;
-
-    OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_PCT_KAT,
-        OSSL_SELF_TEST_DESC_PCT_ECDSA);
-
-    if ((pub_key2 = EC_POINT_new(eckey->group)) == NULL)
-        goto err;
-
-    /* pub_key = priv_key * G (where G is a point on the curve) */
-    if (!EC_POINT_mul(eckey->group, pub_key2, eckey->priv_key, NULL, NULL, ctx))
-        goto err;
-
-    if (BN_num_bytes(pub_key2->X) > (int)sizeof(bytes))
-        goto err;
-    len = BN_bn2bin(pub_key2->X, bytes);
-    if (OSSL_SELF_TEST_oncorrupt_byte(st, bytes)
-        && BN_bin2bn(bytes, len, pub_key2->X) == NULL)
-        goto err;
-    ret = !EC_POINT_cmp(eckey->group, eckey->pub_key, pub_key2, ctx);
-
-err:
-    OSSL_SELF_TEST_onend(st, ret);
-    OSSL_SELF_TEST_free(st);
-    EC_POINT_free(pub_key2);
-    return ret;
-}
-
 /*
  * ECC Key generation.
  * See SP800-56AR3 5.6.1.2.2 "Key Pair Generation by Testing Candidates"
@@ -382,13 +332,11 @@ static int ec_generate_key(EC_KEY *eckey, int pairwise_test)
         void *cbarg = NULL;
 
         OSSL_SELF_TEST_get_callback(eckey->libctx, &cb, &cbarg);
-        ok = ecdsa_keygen_pairwise_test(eckey, cb, cbarg)
-            && ecdsa_keygen_knownanswer_test(eckey, ctx, cb, cbarg);
+        ok = ecdsa_keygen_pairwise_test(eckey, cb, cbarg);
     }
 err:
     /* Step (9): If there is an error return an invalid keypair. */
     if (!ok) {
-        ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
         BN_clear(eckey->priv_key);
         if (eckey->pub_key != NULL)
             EC_POINT_set_to_infinity(group, eckey->pub_key);
diff --git a/deps/openssl/openssl/crypto/err/openssl.txt b/deps/openssl/openssl/crypto/err/openssl.txt
index 5b2ea1c4a4e6..be65c1767ec6 100644
--- a/deps/openssl/openssl/crypto/err/openssl.txt
+++ b/deps/openssl/openssl/crypto/err/openssl.txt
@@ -1861,6 +1861,7 @@ X509_R_CANT_CHECK_DH_KEY:114:can't check dh key
 X509_R_CERTIFICATE_VERIFICATION_FAILED:139:certificate verification failed
 X509_R_CERT_ALREADY_IN_HASH_TABLE:101:cert already in hash table
 X509_R_CRL_ALREADY_DELTA:127:crl already delta
+X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH:147:crl signature algorithm mismatch
 X509_R_CRL_VERIFY_FAILURE:131:crl verify failure
 X509_R_DUPLICATE_ATTRIBUTE:140:duplicate attribute
 X509_R_ERROR_GETTING_MD_BY_NID:141:error getting md by nid
diff --git a/deps/openssl/openssl/crypto/evp/exchange.c b/deps/openssl/openssl/crypto/evp/exchange.c
index 088d2fdc6e73..30299d67defd 100644
--- a/deps/openssl/openssl/crypto/evp/exchange.c
+++ b/deps/openssl/openssl/crypto/evp/exchange.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -287,7 +287,9 @@ int EVP_PKEY_derive_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[])
          * iteration we're on.
          */
         EVP_KEYEXCH_free(exchange);
+        exchange = NULL;
         EVP_KEYMGMT_free(tmp_keymgmt);
+        tmp_keymgmt = NULL;
 
         switch (iter) {
         case 1:
diff --git a/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c b/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c
index 969cca76f999..94b1602dd28e 100644
--- a/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c
+++ b/deps/openssl/openssl/crypto/ffc/ffc_params_generate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -77,6 +77,13 @@ static int ffc_validate_LN(size_t L, size_t N, int type, int verify)
         ERR_raise(ERR_LIB_DH, DH_R_BAD_FFC_PARAMETERS);
 #endif
     } else if (type == FFC_PARAM_TYPE_DSA) {
+        if (N > 512) {
+#ifndef OPENSSL_NO_DSA
+            ERR_raise_data(ERR_LIB_DSA, DSA_R_BAD_FFC_PARAMETERS,
+                "N is %zu, but the maximum supported N is 512", N);
+#endif
+            return 0;
+        }
         if (L >= 3072 && N >= 256)
             return 128;
         if (L >= 2048 && N >= 224)
diff --git a/deps/openssl/openssl/crypto/hmac/hmac.c b/deps/openssl/openssl/crypto/hmac/hmac.c
index c5d42db82020..77b97b6bef6a 100644
--- a/deps/openssl/openssl/crypto/hmac/hmac.c
+++ b/deps/openssl/openssl/crypto/hmac/hmac.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -50,9 +50,11 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         return 0;
 
 #ifdef OPENSSL_HMAC_S390X
-    rv = s390x_HMAC_init(ctx, key, len, impl);
-    if (rv >= 1)
-        return rv;
+    {
+        int ret = s390x_HMAC_init(ctx, key, len, impl);
+        if (ret != -1) /* -1 means SW fallback */
+            return ret;
+    }
 #endif
 
     if (key != NULL) {
diff --git a/deps/openssl/openssl/crypto/http/http_lib.c b/deps/openssl/openssl/crypto/http/http_lib.c
index 05bf4be78856..d7227f5df248 100644
--- a/deps/openssl/openssl/crypto/http/http_lib.c
+++ b/deps/openssl/openssl/crypto/http/http_lib.c
@@ -21,6 +21,7 @@
 #define NI_MAXHOST 255
 #endif
 #include "crypto/ctype.h" /* for ossl_isspace() */
+#define OSSL_URL_SCHEME_SUFFIX "://"
 
 static void init_pstring(char **pstr)
 {
@@ -79,16 +80,20 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost,
         return 0;
     }
 
-    /* check for optional prefix "<scheme>://" */
-    scheme = scheme_end = url;
-    p = strstr(url, "://");
-    if (p == NULL) {
-        p = url;
-    } else {
-        scheme_end = p;
-        if (scheme_end == scheme)
-            goto parse_err;
-        p += strlen("://");
+    /* check for optional prefix "<scheme>://" as per RFC 3986: */
+    scheme = scheme_end = p = url;
+    if (ossl_isalpha(*p)) {
+        while (*p != '\0'
+            && (ossl_isalpha(*p)
+                || ossl_isdigit(*p)
+                || strchr("+-.", *p) != NULL))
+            p++;
+        if (HAS_PREFIX(p, OSSL_URL_SCHEME_SUFFIX)) {
+            scheme_end = p;
+            p += sizeof(OSSL_URL_SCHEME_SUFFIX) - 1;
+        } else {
+            p = url;
+        }
     }
 
     /* parse optional "userinfo@" */
@@ -105,7 +110,7 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost,
     /* parse hostname/address as far as needed here */
     if (host[0] == '[') {
         /* IPv6 literal, which may include ':' */
-        host_end = strchr(host + 1, ']');
+        host_end = memchr(host + 1, ']', authority_end - host - 1);
         if (host_end == NULL)
             goto parse_err;
         p = ++host_end;
diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c
index 00e2b1772cf9..9ebe5ae02d9b 100644
--- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c
+++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_encoders.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -932,6 +932,9 @@ int ossl_ml_dsa_sig_encode(const ML_DSA_SIG *sig, const ML_DSA_PARAMS *params,
     ret = 1;
 err:
     WPACKET_finish(&pkt);
+    /* Erase any partial signature output on failure */
+    if (ret == 0)
+        OPENSSL_cleanse(out, params->sig_len);
     return ret;
 }
 
diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c
index e999b6c08d09..66e2ff2b61a0 100644
--- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c
+++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_key.c
@@ -346,10 +346,15 @@ static int public_from_private(const ML_DSA_KEY *key, EVP_MD_CTX *md_ctx,
     /* Compress t */
     vector_power2_round(&t, t1, t0);
 
-    /* Zeroize secret */
-    vector_zero(&s1_ntt);
     ret = 1;
 err:
+    /*
+     * The low bits of |t| are private and |s1_ntt| is secret, wipe both.
+     * The trailing |a_ntt| matrix is not wiped: per FIPS 204 section 3.6.3
+     * the matrix A is easily computed from the public key and does not
+     * require any special protections.
+     */
+    OPENSSL_cleanse(polys, (k + l) * sizeof(*polys));
     OPENSSL_free(polys);
     return ret;
 }
@@ -370,6 +375,7 @@ int ossl_ml_dsa_key_public_from_private(ML_DSA_KEY *key)
         && shake_xof(md_ctx, key->shake256_md,
             key->pub_encoding, key->params->pk_len,
             key->tr, sizeof(key->tr));
+    vector_zero(&t0);
     vector_free(&t0);
     EVP_MD_CTX_free(md_ctx);
     return ret;
@@ -401,7 +407,7 @@ int ossl_ml_dsa_key_pairwise_check(const ML_DSA_KEY *key)
     ret = vector_equal(&t1, &key->t1) && vector_equal(&t0, &key->t0);
 err:
     EVP_MD_CTX_free(md_ctx);
-    OPENSSL_free(polys);
+    OPENSSL_clear_free(polys, 2 * k * sizeof(*polys));
     return ret;
 }
 
@@ -489,7 +495,7 @@ int ossl_ml_dsa_generate_key(ML_DSA_KEY *out)
                 "explicit %s private key does not match seed",
                 out->params->alg);
         }
-        OPENSSL_free(sk);
+        OPENSSL_clear_free(sk, out->params->sk_len);
     }
     return ret;
 }
diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c
index c7ff59845217..94fd16936c8b 100644
--- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c
+++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_matrix.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -7,6 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
+#include <openssl/crypto.h>
 #include "ml_dsa_local.h"
 #include "ml_dsa_vector.h"
 #include "ml_dsa_matrix.h"
@@ -25,15 +26,16 @@ void ossl_ml_dsa_matrix_mult_vector(const MATRIX *a, const VECTOR *s,
 {
     size_t i, j;
     POLY *poly = a->m_poly;
+    POLY product;
 
     vector_zero(t);
 
     for (i = 0; i < a->k; i++) {
         for (j = 0; j < a->l; j++) {
-            POLY product;
-
             ossl_ml_dsa_poly_ntt_mult(poly++, &s->poly[j], &product);
             poly_add(&product, &t->poly[i], &t->poly[i]);
         }
     }
+
+    OPENSSL_cleanse(&product, sizeof(product));
 }
diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c
index 6fae4c4a0de5..f8ce638dc229 100644
--- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c
+++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sample.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -8,6 +8,7 @@
  */
 
 #include <openssl/byteorder.h>
+#include <openssl/crypto.h>
 #include "ml_dsa_local.h"
 #include "ml_dsa_vector.h"
 #include "ml_dsa_matrix.h"
@@ -159,13 +160,14 @@ static int rej_bounded_poly(EVP_MD_CTX *h_ctx, const EVP_MD *md,
     COEFF_FROM_NIBBLE_FUNC *coef_from_nibble,
     const uint8_t *seed, size_t seed_len, POLY *out)
 {
+    int ret = 0;
     int j = 0;
     uint32_t z0, z1;
     uint8_t blocks[SHAKE256_BLOCKSIZE], *b, *end = blocks + sizeof(blocks);
 
     /* Instead of just squeezing 1 byte at a time, we grab a whole block */
     if (!shake_xof(h_ctx, md, seed, seed_len, blocks, sizeof(blocks)))
-        return 0;
+        goto err;
 
     while (1) {
         for (b = blocks; b < end; b++) {
@@ -173,15 +175,22 @@ static int rej_bounded_poly(EVP_MD_CTX *h_ctx, const EVP_MD *md,
             z1 = *b >> 4; /* high nibble of byte */
 
             if (coef_from_nibble(z0, &out->coeff[j])
-                && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS)
-                return 1;
+                && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS) {
+                ret = 1;
+                goto err;
+            }
             if (coef_from_nibble(z1, &out->coeff[j])
-                && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS)
-                return 1;
+                && ++j >= ML_DSA_NUM_POLY_COEFFICIENTS) {
+                ret = 1;
+                goto err;
+            }
         }
         if (!EVP_DigestSqueeze(h_ctx, blocks, sizeof(blocks)))
-            return 0;
+            goto err;
     }
+err:
+    OPENSSL_cleanse(blocks, sizeof(blocks));
+    return ret;
 }
 
 /**
@@ -205,6 +214,13 @@ int ossl_ml_dsa_matrix_expand_A(EVP_MD_CTX *g_ctx, const EVP_MD *md,
     uint8_t derived_seed[ML_DSA_RHO_BYTES + 2];
     POLY *poly = out->m_poly;
 
+    /*
+     * The seeds derived below and the sampling buffers in rej_ntt_poly() are
+     * not cleansed: per FIPS 204 section 3.6.3 the matrix A is easily
+     * computed from the public key and does not require any special
+     * protections.
+     */
+
     /* The seed used for each matrix element is rho + column_index + row_index */
     memcpy(derived_seed, rho, ML_DSA_RHO_BYTES);
 
@@ -274,6 +290,7 @@ int ossl_ml_dsa_vector_expand_S(EVP_MD_CTX *h_ctx, const EVP_MD *md, int eta,
     }
     ret = 1;
 err:
+    OPENSSL_cleanse(derived_seed, sizeof(derived_seed));
     return ret;
 }
 
@@ -284,9 +301,11 @@ int ossl_ml_dsa_poly_expand_mask(POLY *out, const uint8_t *seed, size_t seed_len
 {
     uint8_t buf[32 * 20];
     size_t buf_len = 32 * (gamma1 == ML_DSA_GAMMA1_TWO_POWER_19 ? 20 : 18);
-
-    return shake_xof(h_ctx, md, seed, seed_len, buf, buf_len)
+    int ret = shake_xof(h_ctx, md, seed, seed_len, buf, buf_len)
         && ossl_ml_dsa_poly_decode_expand_mask(out, buf, buf_len, gamma1);
+
+    OPENSSL_cleanse(buf, sizeof(buf));
+    return ret;
 }
 
 /*
@@ -311,13 +330,14 @@ int ossl_ml_dsa_poly_sample_in_ball(POLY *out_c, const uint8_t *seed, int seed_l
     uint64_t signs;
     int offset = 8;
     size_t end;
+    int ret = 0;
 
     /*
      * Rather than squeeze 8 bytes followed by lots of 1 byte squeezes
      * the SHAKE blocksize is squeezed each time and buffered into 'block'.
      */
     if (!shake_xof(h_ctx, md, seed, seed_len, block, sizeof(block)))
-        return 0;
+        goto err;
 
     /*
      * grab the first 64 bits - since tau < 64
@@ -336,7 +356,7 @@ int ossl_ml_dsa_poly_sample_in_ball(POLY *out_c, const uint8_t *seed, int seed_l
             if (offset == sizeof(block)) {
                 /* squeeze another block if the bytes from block have been used */
                 if (!EVP_DigestSqueeze(h_ctx, block, sizeof(block)))
-                    return 0;
+                    goto err;
                 offset = 0;
             }
 
@@ -354,5 +374,8 @@ int ossl_ml_dsa_poly_sample_in_ball(POLY *out_c, const uint8_t *seed, int seed_l
         out_c->coeff[index] = mod_sub(1, 2 * (signs & 1));
         signs >>= 1; /* grab the next random bit */
     }
-    return 1;
+    ret = 1;
+err:
+    OPENSSL_cleanse(block, sizeof(block));
+    return ret;
 }
diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c
index 71eccf875963..166a604bcd57 100644
--- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c
+++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_sign.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -197,6 +197,7 @@ static int ml_dsa_sign_internal(const ML_DSA_KEY *priv, int msg_is_mu,
     EVP_MD_CTX_free(md_ctx);
     OPENSSL_clear_free(alloc, alloc_len);
     OPENSSL_cleanse(rho_prime, sizeof(rho_prime));
+    OPENSSL_cleanse(c_tilde, sizeof(c_tilde));
     return ret;
 }
 
@@ -387,7 +388,13 @@ int ossl_ml_dsa_sign(const ML_DSA_KEY *priv, int msg_is_mu,
                 alloced_m = m;
         }
         ret = ml_dsa_sign_internal(priv, msg_is_mu, m, m_len, rand, rand_len, sig);
-        OPENSSL_free(alloced_m);
+        /* The encoded message may contain confidential message content */
+        if (m != msg) {
+            if (m != m_tmp)
+                OPENSSL_clear_free(alloced_m, m_len);
+            else
+                OPENSSL_cleanse(m_tmp, sizeof(m_tmp));
+        }
     }
     if (sig_len != NULL)
         *sig_len = priv->params->sig_len;
@@ -424,6 +431,12 @@ int ossl_ml_dsa_verify(const ML_DSA_KEY *pub, int msg_is_mu,
     }
 
     ret = ml_dsa_verify_internal(pub, msg_is_mu, m, m_len, sig, sig_len);
-    OPENSSL_free(alloced_m);
+    /* The encoded message may contain confidential message content */
+    if (m != msg) {
+        if (m != m_tmp)
+            OPENSSL_clear_free(alloced_m, m_len);
+        else
+            OPENSSL_cleanse(m_tmp, sizeof(m_tmp));
+    }
     return ret;
 }
diff --git a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h
index d24bf031a292..1f3e6a03299c 100644
--- a/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h
+++ b/deps/openssl/openssl/crypto/ml_dsa/ml_dsa_vector.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -8,6 +8,7 @@
  */
 
 #include <assert.h>
+#include <openssl/crypto.h>
 #include "ml_dsa_poly.h"
 
 struct vector_st {
@@ -153,6 +154,7 @@ vector_expand_mask(VECTOR *out, const uint8_t *rho_prime, size_t rho_prime_len,
         poly_expand_mask(out->poly + i, derived_seed, sizeof(derived_seed),
             gamma1, h_ctx, md);
     }
+    OPENSSL_cleanse(derived_seed, sizeof(derived_seed));
 }
 
 /* Scale back previously rounded value */
diff --git a/deps/openssl/openssl/crypto/ml_kem/ml_kem.c b/deps/openssl/openssl/crypto/ml_kem/ml_kem.c
index dd8a39197ac8..6c3141ca2d32 100644
--- a/deps/openssl/openssl/crypto/ml_kem/ml_kem.c
+++ b/deps/openssl/openssl/crypto/ml_kem/ml_kem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -1310,6 +1310,12 @@ static __owur int matrix_expand(EVP_MD_CTX *mdctx, ML_KEM_KEY *key)
     int rank = key->vinfo->rank;
     int i, j;
 
+    /*
+     * The seeds derived below and the sampling buffers in sample_scalar()
+     * are not cleansed: per FIPS 203 section 3.3 the matrix A is easily
+     * computed from the public encapsulation key and does not require any
+     * special protections.
+     */
     memcpy(input, key->rho, ML_KEM_RANDOM_BYTES);
     for (i = 0; i < rank; i++) {
         for (j = 0; j < rank; j++) {
@@ -1340,8 +1346,10 @@ static __owur int cbd_2(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1],
     uint16_t value, mask;
     uint8_t b;
 
-    if (!prf(randbuf, sizeof(randbuf), in, mdctx, key))
+    if (!prf(randbuf, sizeof(randbuf), in, mdctx, key)) {
+        OPENSSL_cleanse((void *)randbuf, sizeof(randbuf));
         return 0;
+    }
 
     do {
         b = *r++;
@@ -1363,6 +1371,8 @@ static __owur int cbd_2(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1],
         mask = constish_time_non_zero(value >> 15);
         *curr++ = value + (kPrime & mask);
     } while (curr < end);
+
+    OPENSSL_cleanse((void *)randbuf, sizeof(randbuf));
     return 1;
 }
 
@@ -1380,8 +1390,10 @@ static __owur int cbd_3(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1],
     uint8_t b1, b2, b3;
     uint16_t value, mask;
 
-    if (!prf(randbuf, sizeof(randbuf), in, mdctx, key))
+    if (!prf(randbuf, sizeof(randbuf), in, mdctx, key)) {
+        OPENSSL_cleanse((void *)randbuf, sizeof(randbuf));
         return 0;
+    }
 
     do {
         b1 = *r++;
@@ -1415,6 +1427,8 @@ static __owur int cbd_3(scalar *out, uint8_t in[ML_KEM_RANDOM_BYTES + 1],
         mask = constish_time_non_zero(value >> 15);
         *curr++ = value + (kPrime & mask);
     } while (curr < end);
+
+    OPENSSL_cleanse((void *)randbuf, sizeof(randbuf));
     return 1;
 }
 
@@ -1427,14 +1441,19 @@ static __owur int gencbd_vector(scalar *out, CBD_FUNC cbd, uint8_t *counter,
     EVP_MD_CTX *mdctx, const ML_KEM_KEY *key)
 {
     uint8_t input[ML_KEM_RANDOM_BYTES + 1];
+    int ret = 0;
 
     memcpy(input, seed, ML_KEM_RANDOM_BYTES);
     do {
         input[ML_KEM_RANDOM_BYTES] = (*counter)++;
         if (!cbd(out++, input, mdctx, key))
-            return 0;
+            goto end;
     } while (--rank > 0);
-    return 1;
+    ret = 1;
+
+end:
+    OPENSSL_cleanse((void *)input, sizeof(input));
+    return ret;
 }
 
 /*
@@ -1445,15 +1464,20 @@ static __owur int gencbd_vector_ntt(scalar *out, CBD_FUNC cbd, uint8_t *counter,
     EVP_MD_CTX *mdctx, const ML_KEM_KEY *key)
 {
     uint8_t input[ML_KEM_RANDOM_BYTES + 1];
+    int ret = 0;
 
     memcpy(input, seed, ML_KEM_RANDOM_BYTES);
     do {
         input[ML_KEM_RANDOM_BYTES] = (*counter)++;
         if (!cbd(out, input, mdctx, key))
-            return 0;
+            goto end;
         scalar_ntt(out++);
     } while (--rank > 0);
-    return 1;
+    ret = 1;
+
+end:
+    OPENSSL_cleanse((void *)input, sizeof(input));
+    return ret;
 }
 
 /* The |ETA1| value for ML-KEM-512 is 3, the rest and all ETA2 values are 2. */
@@ -1492,10 +1516,11 @@ static __owur int encrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES],
     uint8_t counter = 0;
     int du = vinfo->du;
     int dv = vinfo->dv;
+    int ret = 0;
 
     /* FIPS 203 "y" vector */
     if (!gencbd_vector_ntt(y, cbd_1, &counter, r, rank, mdctx, key))
-        return 0;
+        goto end;
     /* FIPS 203 "v" scalar */
     inner_product(&v, key->t, y, rank);
     scalar_inverse_ntt(&v);
@@ -1504,7 +1529,7 @@ static __owur int encrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES],
 
     /* All done with |y|, now free to reuse tmp[0] for FIPS 203 |e1| */
     if (!gencbd_vector(e1, cbd_2, &counter, r, rank, mdctx, key))
-        return 0;
+        goto end;
     vector_add(u, e1, rank);
     vector_compress(u, du, rank);
     vector_encode(out, u, du, rank);
@@ -1513,14 +1538,19 @@ static __owur int encrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES],
     memcpy(input, r, ML_KEM_RANDOM_BYTES);
     input[ML_KEM_RANDOM_BYTES] = counter;
     if (!cbd_2(e2, input, mdctx, key))
-        return 0;
+        goto end;
     scalar_add(&v, e2);
 
     /* Combine message with |v| */
     scalar_decode_decompress_add(&v, message);
     scalar_compress(&v, dv);
     scalar_encode(out + vinfo->u_vector_bytes, &v, dv);
-    return 1;
+    ret = 1;
+
+end:
+    OPENSSL_cleanse((void *)input, sizeof(input));
+    OPENSSL_cleanse((void *)&v, sizeof(v));
+    return ret;
 }
 
 /*
@@ -1544,6 +1574,9 @@ decrypt_cpa(uint8_t out[ML_KEM_SHARED_SECRET_BYTES],
     scalar_sub(&v, &mask);
     scalar_compress(&v, 1);
     scalar_encode_1(out, &v);
+
+    OPENSSL_cleanse((void *)&v, sizeof(v));
+    OPENSSL_cleanse((void *)&mask, sizeof(mask));
 }
 
 /*-
@@ -1737,8 +1770,8 @@ static __owur int genkey(const uint8_t seed[ML_KEM_SEED_BYTES],
 
     ret = 1;
 end:
-    OPENSSL_cleanse((void *)augmented_seed, ML_KEM_RANDOM_BYTES);
-    OPENSSL_cleanse((void *)sigma, ML_KEM_RANDOM_BYTES);
+    OPENSSL_cleanse((void *)augmented_seed, sizeof(augmented_seed));
+    OPENSSL_cleanse((void *)hashed, sizeof(hashed));
     if (ret == 0) {
         ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR,
             "internal error while generating %s private key",
@@ -1776,6 +1809,7 @@ static int encap(uint8_t *ctext, uint8_t secret[ML_KEM_SHARED_SECRET_BYTES],
         ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR,
             "internal error while performing %s encapsulation",
             key->vinfo->algorithm_name);
+    OPENSSL_cleanse((void *)Kr, sizeof(Kr));
     return ret;
 }
 
@@ -1822,6 +1856,7 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES],
         ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR,
             "internal error while performing %s decapsulation",
             vinfo->algorithm_name);
+        OPENSSL_cleanse(failure_key, sizeof(failure_key));
         return 0;
     }
     decrypt_cpa(decrypted, ctext, tmp, key);
@@ -1830,6 +1865,8 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES],
         || !encrypt_cpa(tmp_ctext, decrypted, r, tmp, mdctx, key)) {
         memcpy(secret, failure_key, ML_KEM_SHARED_SECRET_BYTES);
         OPENSSL_cleanse(decrypted, ML_KEM_SHARED_SECRET_BYTES);
+        OPENSSL_cleanse(Kr, sizeof(Kr));
+        OPENSSL_cleanse(failure_key, sizeof(failure_key));
         return 1;
     }
     mask = constant_time_eq_int_8(0,
@@ -1838,6 +1875,7 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES],
         secret[i] = constant_time_select_8(mask, Kr[i], failure_key[i]);
     OPENSSL_cleanse(decrypted, ML_KEM_SHARED_SECRET_BYTES);
     OPENSSL_cleanse(Kr, sizeof(Kr));
+    OPENSSL_cleanse(failure_key, sizeof(failure_key));
     return 1;
 }
 
@@ -1845,7 +1883,7 @@ static int decap(uint8_t secret[ML_KEM_SHARED_SECRET_BYTES],
  * After allocating storage for public or private key data, update the key
  * component pointers to reference that storage.
  */
-static __owur int add_storage(scalar *p, int private, ML_KEM_KEY *key)
+static __owur int add_storage(scalar *p, int private, int dup, ML_KEM_KEY *key)
 {
     int rank = key->vinfo->rank;
 
@@ -1854,9 +1892,12 @@ static __owur int add_storage(scalar *p, int private, ML_KEM_KEY *key)
 
     /*
      * We're adding key material, the seed buffer will now hold |rho| and
-     * |pkhash|.
+     * |pkhash|.  Zero the key hash when creating fresh keys; when
+     * duplicating, |key| was memdup'd from the source so |seedbuf|
+     * already carries the correct |rho|/|pkhash| bytes — preserve them.
      */
-    memset(key->seedbuf, 0, sizeof(key->seedbuf));
+    if (dup == 0)
+        memset(key->seedbuf, 0, sizeof(key->seedbuf));
     key->rho = key->seedbuf;
     key->pkhash = key->seedbuf + ML_KEM_RANDOM_BYTES;
     key->d = key->z = NULL;
@@ -1980,18 +2021,18 @@ ML_KEM_KEY *ossl_ml_kem_key_dup(const ML_KEM_KEY *key, int selection)
         selection = 0;
     else if (!ossl_ml_kem_have_prvkey(key))
         selection &= ~OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
+    else if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
+        selection &= ~OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
 
     switch (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) {
     case 0:
         ok = 1;
         break;
     case OSSL_KEYMGMT_SELECT_PUBLIC_KEY:
-        ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->puballoc), 0, ret);
-        ret->rho = ret->seedbuf;
-        ret->pkhash = ret->rho + ML_KEM_RANDOM_BYTES;
+        ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->puballoc), 0, 1, ret);
         break;
     case OSSL_KEYMGMT_SELECT_PRIVATE_KEY:
-        ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->prvalloc), 1, ret);
+        ok = add_storage(OPENSSL_memdup(key->t, key->vinfo->prvalloc), 1, 1, ret);
         /* Duplicated keys retain |d|, if available */
         if (key->d != NULL)
             ret->d = ret->z + ML_KEM_RANDOM_BYTES;
@@ -2111,7 +2152,7 @@ int ossl_ml_kem_parse_public_key(const uint8_t *in, size_t len, ML_KEM_KEY *key)
         || (mdctx = EVP_MD_CTX_new()) == NULL)
         return 0;
 
-    if (add_storage(OPENSSL_malloc(vinfo->puballoc), 0, key))
+    if (add_storage(OPENSSL_malloc(vinfo->puballoc), 0, 0, key))
         ret = parse_pubkey(in, mdctx, key);
 
     if (!ret)
@@ -2139,7 +2180,7 @@ int ossl_ml_kem_parse_private_key(const uint8_t *in, size_t len,
         || (mdctx = EVP_MD_CTX_new()) == NULL)
         return 0;
 
-    if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, key))
+    if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, 0, key))
         ret = parse_prvkey(in, mdctx, key);
 
     if (!ret)
@@ -2187,7 +2228,7 @@ int ossl_ml_kem_genkey(uint8_t *pubenc, size_t publen, ML_KEM_KEY *key)
      */
     CONSTTIME_SECRET(seed, ML_KEM_SEED_BYTES);
 
-    if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, key))
+    if (add_storage(OPENSSL_malloc(vinfo->prvalloc), 1, 0, key))
         ret = genkey(seed, mdctx, pubenc, key);
     OPENSSL_cleanse(seed, sizeof(seed));
 
@@ -2196,6 +2237,9 @@ int ossl_ml_kem_genkey(uint8_t *pubenc, size_t publen, ML_KEM_KEY *key)
 
     EVP_MD_CTX_free(mdctx);
     if (!ret) {
+        /* Erase any partial public key output */
+        if (pubenc != NULL)
+            OPENSSL_cleanse(pubenc, vinfo->pubkey_bytes);
         ossl_ml_kem_key_reset(key);
         return 0;
     }
@@ -2254,6 +2298,10 @@ int ossl_ml_kem_encap_seed(uint8_t *ctext, size_t clen,
     }
 #undef case_encap_seed
 
+    /* Erase any partial ciphertext output on failure */
+    if (!ret)
+        OPENSSL_cleanse(ctext, clen);
+
     /* Declassify secret inputs and derived outputs before returning control */
     CONSTTIME_DECLASSIFY(entropy, elen);
     CONSTTIME_DECLASSIFY(ctext, clen);
@@ -2268,6 +2316,7 @@ int ossl_ml_kem_encap_rand(uint8_t *ctext, size_t clen,
     const ML_KEM_KEY *key)
 {
     uint8_t r[ML_KEM_RANDOM_BYTES];
+    int ret;
 
     if (key == NULL)
         return 0;
@@ -2277,8 +2326,11 @@ int ossl_ml_kem_encap_rand(uint8_t *ctext, size_t clen,
         < 1)
         return 0;
 
-    return ossl_ml_kem_encap_seed(ctext, clen, shared_secret, slen,
+    ret = ossl_ml_kem_encap_seed(ctext, clen, shared_secret, slen,
         r, sizeof(r), key);
+
+    OPENSSL_cleanse((void *)r, sizeof(r));
+    return ret;
 }
 
 int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen,
@@ -2293,11 +2345,13 @@ int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen,
 #endif
 
     /* Need a private key here */
-    if (!ossl_ml_kem_have_prvkey(key))
+    if (!ossl_ml_kem_have_prvkey(key)
+        || shared_secret == NULL
+        || slen < ML_KEM_SHARED_SECRET_BYTES)
         return 0;
     vinfo = key->vinfo;
 
-    if (shared_secret == NULL || slen != ML_KEM_SHARED_SECRET_BYTES
+    if (slen != ML_KEM_SHARED_SECRET_BYTES
         || ctext == NULL || clen != vinfo->ctext_bytes
         || (mdctx = EVP_MD_CTX_new()) == NULL) {
         (void)RAND_bytes_ex(key->libctx, shared_secret,
@@ -2326,6 +2380,7 @@ int ossl_ml_kem_decap(uint8_t *shared_secret, size_t slen,
                                                                   \
         ret = decap(shared_secret, ctext, cbuf, tmp, mdctx, key); \
         OPENSSL_cleanse((void *)tmp, sizeof(tmp));                \
+        OPENSSL_cleanse((void *)cbuf, sizeof(cbuf));              \
         break;                                                    \
     }
     switch (vinfo->evp_type) {
diff --git a/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl b/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl
index 054672bb6b9b..3da7c69cb985 100644
--- a/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl
+++ b/deps/openssl/openssl/crypto/modes/asm/aes-gcm-avx512.pl
@@ -1,4 +1,4 @@
-# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright (c) 2021, Intel Corporation. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -72,6 +72,13 @@
     }
 }
 
+if (!$avx512vaes && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+    =~ /#define __clang_major__.([0-9]+)/) {
+    if ($1) {
+        $avx512vaes = ($1>=11); #icx started with clang 11
+    }
+}
+
 open OUT, "| \"$^X\" \"$xlate\" $flavour \"$output\""
   or die "can't call $xlate: $!";
 *STDOUT = *OUT;
diff --git a/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl b/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl
index c63570bae42f..202883dac35e 100644
--- a/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl
+++ b/deps/openssl/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -73,6 +73,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl b/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl
index 6ef8e555d0a2..181793c5523c 100644
--- a/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl
+++ b/deps/openssl/openssl/crypto/modes/asm/ghash-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2010-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2010-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -121,6 +121,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/pem/pvkfmt.c b/deps/openssl/openssl/crypto/pem/pvkfmt.c
index 9bfbb01e430a..8b81f66e0e3b 100644
--- a/deps/openssl/openssl/crypto/pem/pvkfmt.c
+++ b/deps/openssl/openssl/crypto/pem/pvkfmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2005-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2005-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -893,13 +893,13 @@ static void *do_PVK_body_key(const unsigned char **in,
                 (unsigned char *)psbuf, inlen, libctx, propq))
             goto err;
         p += saltlen;
-        /* Copy BLOBHEADER across, decrypt rest */
-        memcpy(enctmp, p, 8);
-        p += 8;
         if (keylen < 8) {
             ERR_raise(ERR_LIB_PEM, PEM_R_PVK_TOO_SHORT);
             goto err;
         }
+        /* Copy BLOBHEADER across, decrypt rest */
+        memcpy(enctmp, p, 8);
+        p += 8;
         inlen = keylen - 8;
         q = enctmp + 8;
         if ((rc4 = EVP_CIPHER_fetch(libctx, "RC4", propq)) == NULL)
diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_add.c b/deps/openssl/openssl/crypto/pkcs12/p12_add.c
index 4750974d6044..977aa8b65835 100644
--- a/deps/openssl/openssl/crypto/pkcs12/p12_add.c
+++ b/deps/openssl/openssl/crypto/pkcs12/p12_add.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -222,6 +222,6 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12)
     }
     return p7s;
 err:
-    sk_PKCS7_free(p7s);
+    sk_PKCS7_pop_free(p7s, PKCS7_free);
     return NULL;
 }
diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_decr.c b/deps/openssl/openssl/crypto/pkcs12/p12_decr.c
index 0d415e755a18..31766989fc4a 100644
--- a/deps/openssl/openssl/crypto/pkcs12/p12_decr.c
+++ b/deps/openssl/openssl/crypto/pkcs12/p12_decr.c
@@ -55,7 +55,8 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor,
     if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
             & EVP_CIPH_FLAG_CIPHER_WITH_MAC)
         != 0) {
-        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) < 0) {
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len)
+            <= 0) {
             ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
             goto err;
         }
@@ -70,7 +71,7 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor,
             inlen -= mac_len;
             if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
                     (int)mac_len, (unsigned char *)in + inlen)
-                < 0) {
+                <= 0) {
                 ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR);
                 goto err;
             }
diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_utl.c b/deps/openssl/openssl/crypto/pkcs12/p12_utl.c
index a6f3248c554c..f252fd1a0061 100644
--- a/deps/openssl/openssl/crypto/pkcs12/p12_utl.c
+++ b/deps/openssl/openssl/crypto/pkcs12/p12_utl.c
@@ -186,6 +186,8 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
     /* string must contain an even number of bytes */
     if (unilen & 1)
         return NULL;
+    if (unilen < 0)
+        return NULL;
 
     for (asclen = 0, i = 0; i < unilen;) {
         j = bmp_to_utf8(NULL, uni + i, unilen - i);
diff --git a/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c b/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c
index 1ec7895fc197..aaf3c19aaeae 100644
--- a/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c
+++ b/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c
@@ -1200,7 +1200,7 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_get_issuer_and_serial(PKCS7 *p7, int idx)
     rsk = p7->d.signed_and_enveloped->recipientinfo;
     if (rsk == NULL)
         return NULL;
-    if (sk_PKCS7_RECIP_INFO_num(rsk) <= idx)
+    if (idx < 0 || sk_PKCS7_RECIP_INFO_num(rsk) <= idx)
         return NULL;
     ri = sk_PKCS7_RECIP_INFO_value(rsk, idx);
     return ri->issuer_and_serial;
diff --git a/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c b/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c
index 6cd0c3f025c5..2fd753e873d0 100644
--- a/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c
+++ b/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c
@@ -537,7 +537,7 @@ int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md)
     }
 
     ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
-    return 1;
+    return 0;
 }
 
 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
@@ -727,6 +727,10 @@ int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
         break;
 
     case NID_pkcs7_signedAndEnveloped:
+        if (p7->d.signed_and_enveloped == NULL || p7->d.signed_and_enveloped->enc_data == NULL) {
+            ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
+            break;
+        }
         os = p7->d.signed_and_enveloped->enc_data->enc_data;
         if (os == NULL) {
             os = ASN1_OCTET_STRING_new();
@@ -735,6 +739,10 @@ int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
         break;
 
     case NID_pkcs7_enveloped:
+        if (p7->d.enveloped == NULL || p7->d.enveloped->enc_data == NULL) {
+            ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
+            break;
+        }
         os = p7->d.enveloped->enc_data->enc_data;
         if (os == NULL) {
             os = ASN1_OCTET_STRING_new();
@@ -747,7 +755,13 @@ int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
             ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
             break;
         }
-        os = p7->d.sign->contents->d.data;
+
+        if (!PKCS7_type_is_data(p7->d.sign->contents)) {
+            ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
+            break;
+        }
+
+        os = PKCS7_get_octet_string(p7->d.sign->contents);
         break;
 
     default:
diff --git a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl
index c91d01fb3ba4..6d367d858da7 100755
--- a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl
+++ b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -73,6 +73,13 @@
 	if (!$avx && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/) {
 		$avx = ($2>=3.0) + ($2>3.0);
 	}
+
+	if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+		=~ /#define __clang_major__.([0-9]+)/) {
+		if ($1) {
+			$avx = ($1>=11); #icx started with clang 11
+		}
+	}
 }
 
 ########################################################################
diff --git a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl
index 305099ca0308..081fe4117ad9 100755
--- a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl
+++ b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -95,6 +95,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/rand/rand_lib.c b/deps/openssl/openssl/crypto/rand/rand_lib.c
index f03bb2967c43..df70d1c2b1da 100644
--- a/deps/openssl/openssl/crypto/rand/rand_lib.c
+++ b/deps/openssl/openssl/crypto/rand/rand_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -674,7 +674,6 @@ static EVP_RAND_CTX *rand_new_drbg(OSSL_LIB_CTX *libctx, EVP_RAND_CTX *parent,
     EVP_RAND_CTX *ctx;
     OSSL_PARAM params[9], *p = params;
     const OSSL_PARAM *settables;
-    const char *prov_name;
     char *name, *cipher;
     int use_df = 1;
 
@@ -686,7 +685,6 @@ static EVP_RAND_CTX *rand_new_drbg(OSSL_LIB_CTX *libctx, EVP_RAND_CTX *parent,
         ERR_raise(ERR_LIB_RAND, RAND_R_UNABLE_TO_FETCH_DRBG);
         return NULL;
     }
-    prov_name = ossl_provider_name(EVP_RAND_get0_provider(rand));
     ctx = EVP_RAND_CTX_new(rand, parent);
     EVP_RAND_free(rand);
     if (ctx == NULL) {
@@ -704,9 +702,6 @@ static EVP_RAND_CTX *rand_new_drbg(OSSL_LIB_CTX *libctx, EVP_RAND_CTX *parent,
         && OSSL_PARAM_locate_const(settables, OSSL_DRBG_PARAM_DIGEST))
         *p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_DIGEST,
             dgbl->rng_digest, 0);
-    if (prov_name != NULL)
-        *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PROV_PARAM_CORE_PROV_NAME,
-            (char *)prov_name, 0);
     if (dgbl->rng_propq != NULL)
         *p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_PROPERTIES,
             dgbl->rng_propq, 0);
@@ -864,7 +859,10 @@ static EVP_RAND_CTX *rand_get0_public(OSSL_LIB_CTX *ctx, RAND_GLOBAL *dgbl)
             return NULL;
         rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
             SECONDARY_RESEED_TIME_INTERVAL);
-        CRYPTO_THREAD_set_local(&dgbl->public, rand);
+        if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
+            EVP_RAND_CTX_free(rand);
+            rand = NULL;
+        }
     }
     return rand;
 }
@@ -903,7 +901,10 @@ static EVP_RAND_CTX *rand_get0_private(OSSL_LIB_CTX *ctx, RAND_GLOBAL *dgbl)
             return NULL;
         rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
             SECONDARY_RESEED_TIME_INTERVAL);
-        CRYPTO_THREAD_set_local(&dgbl->private, rand);
+        if (!CRYPTO_THREAD_set_local(&dgbl->private, rand)) {
+            EVP_RAND_CTX_free(rand);
+            rand = NULL;
+        }
     }
     return rand;
 }
diff --git a/deps/openssl/openssl/crypto/rsa/rsa_gen.c b/deps/openssl/openssl/crypto/rsa/rsa_gen.c
index 554f9d349b85..777a485422dd 100644
--- a/deps/openssl/openssl/crypto/rsa/rsa_gen.c
+++ b/deps/openssl/openssl/crypto/rsa/rsa_gen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -636,7 +636,6 @@ static int rsa_keygen(OSSL_LIB_CTX *libctx, RSA *rsa, int bits, int primes,
         OSSL_SELF_TEST_get_callback(libctx, &stcb, &stcbarg);
         ok = rsa_keygen_pairwise_test(rsa, stcb, stcbarg);
         if (!ok) {
-            ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
             /* Clear intermediate results */
             BN_clear_free(rsa->d);
             BN_clear_free(rsa->p);
diff --git a/deps/openssl/openssl/crypto/rsa/rsa_ossl.c b/deps/openssl/openssl/crypto/rsa/rsa_ossl.c
index 2fcf02a9ab05..73a4b7c20a47 100644
--- a/deps/openssl/openssl/crypto/rsa/rsa_ossl.c
+++ b/deps/openssl/openssl/crypto/rsa/rsa_ossl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -160,6 +160,14 @@ static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
      * See SP800-56Br2, section 7.1.1.1
      * RSAEP: 1 < f < (n – 1).
      * (where f is the plaintext).
+     *
+     * This bound is somewhat overkill here.  RSASVE.GENERATE (7.2.1.2)
+     * regenerates z until 1 < z < n-1, so on that path the plaintext is in
+     * range unconditionally.  On the OAEP path the leading 0x00 octet of the
+     * encoding forces m < n-1 unconditionally, while m = 0 or 1 is only
+     * cryptographically negligible, not impossible.  The check is kept to
+     * mirror the RSADP bound in rsa_ossl_private_decrypt() and to keep RSAEP
+     * faithful to 7.1.1 of the SP; nothing in the SP relies on it here.
      */
     if (padding == RSA_NO_PADDING) {
         BIGNUM *nminus1 = BN_CTX_get(ctx);
@@ -572,6 +580,12 @@ static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,
      * See SP800-56Br2, section 7.1.2.1
      * RSADP: 1 < f < (n – 1)
      * (where f is the ciphertext).
+     *
+     * Kept under FIPS_MODULE because SP 800-56B KTS-OAEP (section 9.2) also
+     * decrypts through RSADP and needs this bound in a FIPS build, and there
+     * is no KTS-OAEP-specific path to attach it to.  The non-FIPS RSASVE path
+     * applies the same 1 < c < n-1 in rsasve_recover()
+     * (providers/implementations/kem/rsa_kem.c); keep the two in step.
      */
     if (padding == RSA_NO_PADDING) {
         BIGNUM *nminus1 = BN_CTX_get(ctx);
diff --git a/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl b/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl
index 00350324a117..81c3658b0adf 100644
--- a/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl
+++ b/deps/openssl/openssl/crypto/sha/asm/sha1-586.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 1998-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 1998-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -146,6 +146,9 @@
 $ymm=1 if ($xmm && !$ymm && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/ &&
 		$2>=3.0);	# first version supporting AVX
 
+$ymm=1 if ($xmm && !$ymm && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__` =~ /#define __clang_major__.([0-9]+)/ &&
+		$1>=11); #icx started with clang 11
+
 $shaext=$xmm;	### set to zero if compiling for 1.0.1
 
 &external_label("OPENSSL_ia32cap_P") if ($xmm);
diff --git a/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl
index d9d1630d16db..59042c90b2fe 100644
--- a/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl
+++ b/deps/openssl/openssl/crypto/sha/asm/sha1-mb-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -76,6 +76,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl
index 30c545cf419a..829fe16a8272 100755
--- a/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl
+++ b/deps/openssl/openssl/crypto/sha/asm/sha1-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -124,6 +124,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 $shaext=1;	### set to zero if compiling for 1.0.1
 $avx=1		if (!$shaext && $avx);
 
diff --git a/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl b/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl
index 8e19cd875e3f..3983e55ff9e8 100644
--- a/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl
+++ b/deps/openssl/openssl/crypto/sha/asm/sha256-586.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -99,6 +99,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if ($xmm && !$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 $shaext=$xmm;	### set to zero if compiling for 1.0.1
 
 $unroll_after = 64*4;	# If pre-evicted from L1P cache first spin of
diff --git a/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl
index 9398b7954a7f..e53517d787f6 100644
--- a/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl
+++ b/deps/openssl/openssl/crypto/sha/asm/sha256-mb-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2013-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2013-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -77,6 +77,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
     or die "can't call $xlate: $!";
 *STDOUT=*OUT;
diff --git a/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl b/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl
index b37058ae03fa..cbdd7df67561 100755
--- a/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl
+++ b/deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2005-2024 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2005-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -140,6 +140,13 @@
 	$avx = ($2>=3.0) + ($2>3.0);
 }
 
+if (!$avx && `$ENV{CC} -x c /dev/null -dM -E|grep __clang_major__`
+	=~ /#define __clang_major__.([0-9]+)/) {
+	if ($1) {
+		$avx = ($1>=11); #icx started with clang 11
+	}
+}
+
 $shaext=1;	### set to zero if compiling for 1.0.1
 $avx=1		if (!$shaext && $avx);
 
diff --git a/deps/openssl/openssl/crypto/sha/sha_riscv.c b/deps/openssl/openssl/crypto/sha/sha_riscv.c
index 61ceaa22a4bd..dad1b1187671 100644
--- a/deps/openssl/openssl/crypto/sha/sha_riscv.c
+++ b/deps/openssl/openssl/crypto/sha/sha_riscv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -17,9 +17,9 @@
 void sha256_block_data_order_zvkb_zvknha_or_zvknhb(void *ctx, const void *in,
     size_t num);
 void sha256_block_data_order_c(void *ctx, const void *in, size_t num);
-void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num);
+void sha256_block_data_order(void *ctx, const void *in, size_t num);
 
-void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num)
+void sha256_block_data_order(void *ctx, const void *in, size_t num)
 {
     if (RISCV_HAS_ZVKB() && (RISCV_HAS_ZVKNHA() || RISCV_HAS_ZVKNHB()) && riscv_vlen() >= 128) {
         sha256_block_data_order_zvkb_zvknha_or_zvknhb(ctx, in, num);
@@ -30,9 +30,9 @@ void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num)
 
 void sha512_block_data_order_zvkb_zvknhb(void *ctx, const void *in, size_t num);
 void sha512_block_data_order_c(void *ctx, const void *in, size_t num);
-void sha512_block_data_order(SHA512_CTX *ctx, const void *in, size_t num);
+void sha512_block_data_order(void *ctx, const void *in, size_t num);
 
-void sha512_block_data_order(SHA512_CTX *ctx, const void *in, size_t num)
+void sha512_block_data_order(void *ctx, const void *in, size_t num)
 {
     if (RISCV_HAS_ZVKB_AND_ZVKNHB() && riscv_vlen() >= 128) {
         sha512_block_data_order_zvkb_zvknhb(ctx, in, num);
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c
index 41fc494048b4..4cf75089920a 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa.c
@@ -8,6 +8,7 @@
  */
 #include <stddef.h>
 #include <string.h>
+#include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/proverr.h>
 #include "slh_dsa_local.h"
@@ -122,8 +123,13 @@ static int slh_sign_internal(SLH_DSA_HASH_CTX *hctx,
 err:
     if (!WPACKET_finish(wpkt))
         ret = 0;
+    OPENSSL_cleanse(m_digest, sizeof(m_digest));
+    OPENSSL_cleanse(pk_fors, sizeof(pk_fors));
     if (ret)
         *sig_len = sig_len_expected;
+    else
+        /* Erase any partial signature output */
+        OPENSSL_cleanse(sig, sig_len_expected);
     return ret;
 }
 
@@ -148,6 +154,7 @@ static int slh_verify_internal(SLH_DSA_HASH_CTX *hctx,
     const uint8_t *msg, size_t msg_len,
     const uint8_t *sig, size_t sig_len)
 {
+    int ret = 0;
     const SLH_DSA_KEY *pub = hctx->key;
     SLH_HASH_FUNC_DECLARE(pub, hashf);
     SLH_ADRS_FUNC_DECLARE(pub, adrsf);
@@ -185,7 +192,7 @@ static int slh_verify_internal(SLH_DSA_HASH_CTX *hctx,
 
     if (!hashf->H_MSG(hctx, r, pk_seed, pk_root, msg, msg_len,
             m_digest, sizeof(m_digest)))
-        return 0;
+        goto err;
 
     /*
      * Get md (the first md_len bytes of m_digest to use in
@@ -195,16 +202,20 @@ static int slh_verify_internal(SLH_DSA_HASH_CTX *hctx,
     if (!PACKET_buf_init(m_digest_rpkt, m_digest, sizeof(m_digest))
         || !PACKET_get_bytes(m_digest_rpkt, &md, md_len)
         || !get_tree_ids(m_digest_rpkt, params, &tree_id, &leaf_id))
-        return 0;
+        goto err;
 
     adrsf->set_tree_address(adrs, tree_id);
     adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_FORS_TREE);
     adrsf->set_keypair_address(adrs, leaf_id);
-    return ossl_slh_fors_pk_from_sig(hctx, sig_rpkt, md, pk_seed, adrs,
-               pk_fors, sizeof(pk_fors))
+    ret = ossl_slh_fors_pk_from_sig(hctx, sig_rpkt, md, pk_seed, adrs,
+              pk_fors, sizeof(pk_fors))
         && ossl_slh_ht_verify(hctx, pk_fors, sig_rpkt, pk_seed,
             tree_id, leaf_id, pk_root)
         && PACKET_remaining(sig_rpkt) == 0;
+err:
+    OPENSSL_cleanse(m_digest, sizeof(m_digest));
+    OPENSSL_cleanse(pk_fors, sizeof(pk_fors));
+    return ret;
 }
 
 /**
@@ -292,8 +303,13 @@ int ossl_slh_dsa_sign(SLH_DSA_HASH_CTX *slh_ctx,
             return 0;
     }
     ret = slh_sign_internal(slh_ctx, m, m_len, sig, siglen, sigsize, add_rand);
-    if (m != msg && m != m_tmp)
-        OPENSSL_free(m);
+    /* The encoded message may contain confidential message content */
+    if (m != msg) {
+        if (m != m_tmp)
+            OPENSSL_clear_free(m, m_len);
+        else
+            OPENSSL_cleanse(m_tmp, sizeof(m_tmp));
+    }
     return ret;
 }
 
@@ -317,8 +333,13 @@ int ossl_slh_dsa_verify(SLH_DSA_HASH_CTX *slh_ctx,
         return 0;
 
     ret = slh_verify_internal(slh_ctx, m, m_len, sig, sig_len);
-    if (m != msg && m != m_tmp)
-        OPENSSL_free(m);
+    /* The encoded message may contain confidential message content */
+    if (m != msg) {
+        if (m != m_tmp)
+            OPENSSL_clear_free(m, m_len);
+        else
+            OPENSSL_cleanse(m_tmp, sizeof(m_tmp));
+    }
     return ret;
 }
 
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c
index 9dca01acf5ff..513f7f7dafc1 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -109,5 +109,6 @@ void ossl_slh_dsa_hash_ctx_free(SLH_DSA_HASH_CTX *ctx)
     if (ctx->md_big_ctx != ctx->md_ctx)
         EVP_MD_CTX_free(ctx->md_big_ctx);
     EVP_MAC_CTX_free(ctx->hmac_ctx);
-    OPENSSL_free(ctx);
+    /* Erases the |scratch| hash intermediates */
+    OPENSSL_clear_free(ctx, sizeof(*ctx));
 }
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c
index 6d778a39f46d..9e980bf1bfb0 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_key.c
@@ -313,6 +313,12 @@ int ossl_slh_dsa_key_fromdata(SLH_DSA_KEY *key, const OSSL_PARAM params[],
     key->pub = p;
     return 1;
 err:
+    /*
+     * A private key of unexpected length may have been copied into |priv|
+     * before |has_priv| was set, in which case the reset below would not
+     * erase it, so cleanse unconditionally.
+     */
+    OPENSSL_cleanse(key->priv, sizeof(key->priv));
     ossl_slh_dsa_key_reset(key);
     return 0;
 }
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h
index 57dfc1eb1301..d2eccdd08a9a 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_dsa_local.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -45,12 +45,24 @@
  * NOTE: Any changes to this structure will need updating in
  * ossl_slh_dsa_hash_ctx_dup().
  */
+/* A SHA-512 digest plus two |n| byte node values */
+#define SLH_DSA_HASH_SCRATCH_LEN (64 + 2 * SLH_MAX_N)
+
 struct slh_dsa_hash_ctx_st {
     const SLH_DSA_KEY *key; /* This key is not owned by this object */
     EVP_MD_CTX *md_ctx; /* Either SHAKE OR SHA-256 */
     EVP_MD_CTX *md_big_ctx; /* Either SHA-512 or points to |md_ctx| for SHA-256*/
     EVP_MAC_CTX *hmac_ctx; /* required by SHA algorithms for PRFmsg() */
     int hmac_digest_used; /* Used for lazy init of hmac_ctx digest */
+    /*
+     * Working storage for the SHA2 hash function intermediates, used in
+     * place of local stack copies, so that potentially sensitive
+     * intermediate data lives in one place and is erased when this object
+     * is freed (FIPS 205 section 3.1).  The SHAKE hash functions write
+     * their output directly to the caller's buffer and need no scratch.
+     * Not used concurrently.
+     */
+    uint8_t scratch[SLH_DSA_HASH_SCRATCH_LEN];
 };
 
 __owur int ossl_slh_wots_pk_gen(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed,
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c b/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c
index 78587589db42..7c8854cc9b38 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_fors.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -17,8 +17,8 @@
 /* a = 6, 8, 9, 12 or 14  - There are (2^a) merkle trees */
 #define SLH_MAX_A 9
 
-#define SLH_MAX_K_TIMES_A (SLH_MAX_A * SLH_MAX_K)
-#define SLH_MAX_ROOTS (SLH_MAX_K_TIMES_A * SLH_MAX_N)
+/* The FORS public key is computed from the roots of k Merkle trees */
+#define SLH_MAX_ROOTS (SLH_MAX_K * SLH_MAX_N)
 
 static void slh_base_2b(const uint8_t *in, uint32_t b, uint32_t *out, size_t out_len);
 
@@ -87,25 +87,25 @@ static int slh_fors_node(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed,
 
     if (height == 0) {
         /* Gets here for leaf nodes */
-        if (!slh_fors_sk_gen(ctx, sk_seed, pk_seed, adrs, node_id, sk, sizeof(sk)))
-            return 0;
-        adrsf->set_tree_height(adrs, 0);
-        adrsf->set_tree_index(adrs, node_id);
-        ret = key->hash_func->F(ctx, pk_seed, adrs, sk, n, node, node_len);
+        if (slh_fors_sk_gen(ctx, sk_seed, pk_seed, adrs, node_id, sk, sizeof(sk))) {
+            adrsf->set_tree_height(adrs, 0);
+            adrsf->set_tree_index(adrs, node_id);
+            ret = key->hash_func->F(ctx, pk_seed, adrs, sk, n, node, node_len);
+        }
         OPENSSL_cleanse(sk, n);
-        return ret;
     } else {
-        if (!slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id, height - 1,
-                lnode, sizeof(rnode))
-            || !slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id + 1,
-                height - 1, rnode, sizeof(rnode)))
-            return 0;
-        adrsf->set_tree_height(adrs, height);
-        adrsf->set_tree_index(adrs, node_id);
-        if (!key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, node, node_len))
-            return 0;
+        if (slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id, height - 1,
+                lnode, sizeof(lnode))
+            && slh_fors_node(ctx, sk_seed, pk_seed, adrs, 2 * node_id + 1,
+                height - 1, rnode, sizeof(rnode))) {
+            adrsf->set_tree_height(adrs, height);
+            adrsf->set_tree_index(adrs, node_id);
+            ret = key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, node, node_len);
+        }
+        OPENSSL_cleanse(lnode, sizeof(lnode));
+        OPENSSL_cleanse(rnode, sizeof(rnode));
     }
-    return 1;
+    return ret;
 }
 
 /**
@@ -132,6 +132,7 @@ int ossl_slh_fors_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *md,
     const uint8_t *sk_seed, const uint8_t *pk_seed,
     uint8_t *adrs, WPACKET *sig_wpkt)
 {
+    int ret = 0;
     const SLH_DSA_KEY *key = ctx->key;
     uint32_t tree_id, layer, s, tree_offset;
     uint32_t ids[SLH_MAX_K];
@@ -165,7 +166,7 @@ int ossl_slh_fors_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *md,
         if (!slh_fors_sk_gen(ctx, sk_seed, pk_seed, adrs,
                 node_id + tree_id_times_two_power_a, out, sizeof(out))
             || !WPACKET_memcpy(sig_wpkt, out, n))
-            return 0;
+            goto err;
 
         /*
          * Traverse from the bottom of the tree (layer = 0)
@@ -178,15 +179,18 @@ int ossl_slh_fors_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *md,
             s = node_id ^ 1; /* XOR gets the index of the other child in a binary tree */
             if (!slh_fors_node(ctx, sk_seed, pk_seed, adrs,
                     s + tree_offset, layer, out, sizeof(out)))
-                return 0;
+                goto err;
             node_id >>= 1; /* Get the parent node id */
             tree_offset >>= 1; /* Each layer up has half as many nodes */
             if (!WPACKET_memcpy(sig_wpkt, out, n))
-                return 0;
+                goto err;
         }
         tree_id_times_two_power_a += two_power_a;
     }
-    return 1;
+    ret = 1;
+err:
+    OPENSSL_cleanse(out, sizeof(out));
+    return ret;
 }
 
 /**
@@ -288,6 +292,8 @@ int ossl_slh_fors_pk_from_sig(SLH_DSA_HASH_CTX *ctx, PACKET *fors_sig_rpkt,
 err:
     if (!WPACKET_finish(wroot_pkt))
         ret = 0;
+    /* At most one |n| byte root per tree was written */
+    OPENSSL_cleanse(roots, k * n);
     return ret;
 }
 
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c b/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c
index bd112f1cb0db..b0023c955c3e 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_hash.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -92,12 +92,15 @@ slh_prf_msg_shake(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_prf,
     const uint8_t *opt_rand, const uint8_t *msg, size_t msg_len,
     WPACKET *pkt)
 {
+    int ret;
     unsigned char out[SLH_MAX_N];
     const SLH_DSA_PARAMS *params = ctx->key->params;
     size_t n = params->n;
 
-    return xof_digest_3(ctx->md_ctx, sk_prf, n, opt_rand, n, msg, msg_len, out, n)
+    ret = xof_digest_3(ctx->md_ctx, sk_prf, n, opt_rand, n, msg, msg_len, out, n)
         && WPACKET_memcpy(pkt, out, n);
+    OPENSSL_cleanse(out, sizeof(out));
+    return ret;
 }
 
 static int
@@ -151,6 +154,7 @@ slh_hmsg_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *r, const uint8_t *pk_seed,
     const uint8_t *pk_root, const uint8_t *msg, size_t msg_len,
     uint8_t *out, size_t out_len)
 {
+    int ret;
     const SLH_DSA_PARAMS *params = hctx->key->params;
     size_t m = params->m;
     size_t n = params->n;
@@ -163,9 +167,11 @@ slh_hmsg_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *r, const uint8_t *pk_seed,
 
     memcpy(seed, r, n);
     memcpy(seed + n, pk_seed, n);
-    return digest_4(hctx->md_big_ctx, r, n, pk_seed, n, pk_root, n, msg, msg_len,
-               seed + 2 * n)
+    ret = digest_4(hctx->md_big_ctx, r, n, pk_seed, n, pk_root, n, msg, msg_len,
+              seed + 2 * n)
         && (PKCS1_MGF1(out, m, seed, seed_len, hctx->key->md_big) == 0);
+    OPENSSL_cleanse(seed, sizeof(seed));
+    return ret;
 }
 
 static int
@@ -205,16 +211,23 @@ slh_prf_msg_sha2(SLH_DSA_HASH_CTX *hctx,
         && EVP_MAC_update(mctx, msg, msg_len) == 1
         && EVP_MAC_final(mctx, mac, NULL, sizeof(mac)) == 1
         && WPACKET_memcpy(pkt, mac, n); /* Truncate output to n bytes */
+    OPENSSL_cleanse(mac, sizeof(mac));
     return ret;
 }
 
+/*
+ * The |digest| scratch storage in the hash context is used in place of a
+ * local stack buffer, and is erased when the hash context is freed
+ * (FIPS 205 section 3.1).  On the PRF path it holds a derived chain secret.
+ */
 static ossl_inline int
-do_hash(EVP_MD_CTX *ctx, size_t n, const uint8_t *pk_seed, const uint8_t *adrs,
+do_hash(SLH_DSA_HASH_CTX *hctx, EVP_MD_CTX *ctx, size_t n,
+    const uint8_t *pk_seed, const uint8_t *adrs,
     const uint8_t *m, size_t m_len, size_t b, uint8_t *out, size_t out_len)
 {
     int ret;
     uint8_t zeros[128] = { 0 };
-    uint8_t digest[MAX_DIGEST_SIZE];
+    uint8_t *digest = hctx->scratch;
 
     ret = digest_4(ctx, pk_seed, n, zeros, b - n, adrs, SLH_ADRSC_SIZE,
         m, m_len, digest);
@@ -230,7 +243,7 @@ slh_prf_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed,
 {
     size_t n = hctx->key->params->n;
 
-    return do_hash(hctx->md_ctx, n, pk_seed, adrs, sk_seed, n,
+    return do_hash(hctx, hctx->md_ctx, n, pk_seed, adrs, sk_seed, n,
         OSSL_SLH_DSA_SHA2_NUM_ZEROS_H_AND_T_BOUND1, out, out_len);
 }
 
@@ -238,21 +251,22 @@ static int
 slh_f_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, const uint8_t *adrs,
     const uint8_t *m1, size_t m1_len, uint8_t *out, size_t out_len)
 {
-    return do_hash(hctx->md_ctx, hctx->key->params->n, pk_seed, adrs, m1, m1_len,
-        OSSL_SLH_DSA_SHA2_NUM_ZEROS_H_AND_T_BOUND1, out, out_len);
+    return do_hash(hctx, hctx->md_ctx, hctx->key->params->n, pk_seed, adrs,
+        m1, m1_len, OSSL_SLH_DSA_SHA2_NUM_ZEROS_H_AND_T_BOUND1, out, out_len);
 }
 
 static int
 slh_h_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, const uint8_t *adrs,
     const uint8_t *m1, const uint8_t *m2, uint8_t *out, size_t out_len)
 {
-    uint8_t m[SLH_MAX_N * 2];
+    /* The concatenated children go in the scratch after the digest */
+    uint8_t *m = hctx->scratch + MAX_DIGEST_SIZE;
     const SLH_DSA_PARAMS *prms = hctx->key->params;
     size_t n = prms->n;
 
     memcpy(m, m1, n);
     memcpy(m + n, m2, n);
-    return do_hash(hctx->md_big_ctx, n, pk_seed, adrs, m, 2 * n,
+    return do_hash(hctx, hctx->md_big_ctx, n, pk_seed, adrs, m, 2 * n,
         prms->sha2_h_and_t_bound, out, out_len);
 }
 
@@ -262,7 +276,7 @@ slh_t_sha2(SLH_DSA_HASH_CTX *hctx, const uint8_t *pk_seed, const uint8_t *adrs,
 {
     const SLH_DSA_PARAMS *prms = hctx->key->params;
 
-    return do_hash(hctx->md_big_ctx, prms->n, pk_seed, adrs, ml, ml_len,
+    return do_hash(hctx, hctx->md_big_ctx, prms->n, pk_seed, adrs, ml, ml_len,
         prms->sha2_h_and_t_bound, out, out_len);
 }
 
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c b/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c
index bc352bf5bc3a..e1e2901ce5f3 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_hypertree.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -8,6 +8,7 @@
  */
 
 #include <string.h>
+#include <openssl/crypto.h>
 #include "slh_dsa_local.h"
 #include "slh_dsa_key.h"
 
@@ -33,6 +34,7 @@ int ossl_slh_ht_sign(SLH_DSA_HASH_CTX *ctx,
     const uint8_t *pk_seed,
     uint64_t tree_id, uint32_t leaf_id, WPACKET *sig_wpkt)
 {
+    int ret = 0;
     const SLH_DSA_KEY *key = ctx->key;
     SLH_ADRS_FUNC_DECLARE(key, adrsf);
     SLH_ADRS_DECLARE(adrs);
@@ -70,7 +72,7 @@ int ossl_slh_ht_sign(SLH_DSA_HASH_CTX *ctx,
         psig = WPACKET_get_curr(sig_wpkt);
         if (!ossl_slh_xmss_sign(ctx, root, sk_seed, leaf_id, pk_seed, adrs,
                 sig_wpkt))
-            return 0;
+            goto err;
         /*
          * On the last loop it skips getting the public key since it is not needed
          * to calculate another signature. If this was called it should equal
@@ -79,15 +81,18 @@ int ossl_slh_ht_sign(SLH_DSA_HASH_CTX *ctx,
         if (layer < d - 1) {
             if (!PACKET_buf_init(xmss_sig_rpkt, psig,
                     WPACKET_get_curr(sig_wpkt) - psig))
-                return 0;
+                goto err;
             if (!ossl_slh_xmss_pk_from_sig(ctx, leaf_id, xmss_sig_rpkt, root,
                     pk_seed, adrs, root, sizeof(root)))
-                return 0;
+                goto err;
             leaf_id = tree_id & mask;
             tree_id >>= hm;
         }
     }
-    return 1;
+    ret = 1;
+err:
+    OPENSSL_cleanse(root, sizeof(root));
+    return ret;
 }
 
 /**
@@ -108,6 +113,7 @@ int ossl_slh_ht_verify(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg, PACKET *sig_pk
     const uint8_t *pk_seed, uint64_t tree_id, uint32_t leaf_id,
     const uint8_t *pk_root)
 {
+    int ret = 0;
     const SLH_DSA_KEY *key = ctx->key;
     SLH_ADRS_FUNC_DECLARE(key, adrsf);
     SLH_ADRS_DECLARE(adrs);
@@ -127,9 +133,12 @@ int ossl_slh_ht_verify(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg, PACKET *sig_pk
         adrsf->set_tree_address(adrs, tree_id);
         if (!ossl_slh_xmss_pk_from_sig(ctx, leaf_id, sig_pkt, node,
                 pk_seed, adrs, node, sizeof(node)))
-            return 0;
+            goto err;
         leaf_id = tree_id & mask;
         tree_id >>= tree_height;
     }
-    return (memcmp(node, pk_root, n) == 0);
+    ret = (memcmp(node, pk_root, n) == 0);
+err:
+    OPENSSL_cleanse(node, sizeof(node));
+    return ret;
 }
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c b/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c
index ea278fcd8412..79f3bca8747d 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_wots.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -244,6 +244,8 @@ int ossl_slh_wots_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg,
     }
     ret = 1;
 err:
+    OPENSSL_cleanse(sk, sizeof(sk));
+    OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles));
     return ret;
 }
 
@@ -311,5 +313,7 @@ int ossl_slh_wots_pk_from_sig(SLH_DSA_HASH_CTX *ctx,
 err:
     if (!WPACKET_finish(tmp_pkt))
         ret = 0;
+    OPENSSL_cleanse(tmp, sizeof(tmp));
+    OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles));
     return ret;
 }
diff --git a/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c b/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c
index dae036c6a218..a53a6c1e9911 100644
--- a/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c
+++ b/deps/openssl/openssl/crypto/slh_dsa/slh_xmss.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -8,6 +8,7 @@
  */
 
 #include <string.h>
+#include <openssl/crypto.h>
 #include "slh_dsa_local.h"
 #include "slh_dsa_key.h"
 
@@ -39,29 +40,31 @@ int ossl_slh_xmss_node(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed,
 {
     const SLH_DSA_KEY *key = ctx->key;
     SLH_ADRS_FUNC_DECLARE(key, adrsf);
+    int ret = 0;
 
     if (h == 0) {
         /* For leaf nodes generate the public key */
         adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_WOTS_HASH);
         adrsf->set_keypair_address(adrs, node_id);
-        if (!ossl_slh_wots_pk_gen(ctx, sk_seed, pk_seed, adrs,
+        if (ossl_slh_wots_pk_gen(ctx, sk_seed, pk_seed, adrs,
                 pk_out, pk_out_len))
-            return 0;
+            ret = 1;
     } else {
         uint8_t lnode[SLH_MAX_N], rnode[SLH_MAX_N];
 
-        if (!ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id, h - 1, pk_seed, adrs,
+        if (ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id, h - 1, pk_seed, adrs,
                 lnode, sizeof(lnode))
-            || !ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id + 1, h - 1,
-                pk_seed, adrs, rnode, sizeof(rnode)))
-            return 0;
-        adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_TREE);
-        adrsf->set_tree_height(adrs, h);
-        adrsf->set_tree_index(adrs, node_id);
-        if (!key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, pk_out, pk_out_len))
-            return 0;
+            && ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id + 1, h - 1,
+                pk_seed, adrs, rnode, sizeof(rnode))) {
+            adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_TREE);
+            adrsf->set_tree_height(adrs, h);
+            adrsf->set_tree_index(adrs, node_id);
+            ret = key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, pk_out, pk_out_len);
+        }
+        OPENSSL_cleanse(lnode, sizeof(lnode));
+        OPENSSL_cleanse(rnode, sizeof(rnode));
     }
-    return 1;
+    return ret;
 }
 
 /**
diff --git a/deps/openssl/openssl/crypto/threads_win.c b/deps/openssl/openssl/crypto/threads_win.c
index 2c0e27ce06eb..158aa2ea91c9 100644
--- a/deps/openssl/openssl/crypto/threads_win.c
+++ b/deps/openssl/openssl/crypto/threads_win.c
@@ -535,6 +535,20 @@ int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void))
         result = InterlockedCompareExchange(lock, ONCE_ININIT, ONCE_UNINITED);
         if (result == ONCE_UNINITED) {
             init();
+            /*
+             * On weakly ordered systems, it may happen that the write to *lock
+             * below completes prior to some writes in whatever the init()
+             * callback routine above may do.  In this case, other threads
+             * entering here may see unsynchronized data in whatever the init
+             * routine initializes, leading to erroneous behavior.
+             *
+             * We should use InitOnceExecuteOnce here to implement this, but
+             * doing so requires that we modify the definition of the
+             * CRYPTO_ONCE type, which is an ABI breakage.  So instead
+             * just insert a memory barrier here to ensure that any pending
+             * writes are flushed to memory prior to setting ONCE_DONE below
+             */
+            MemoryBarrier();
             *lock = ONCE_DONE;
             return 1;
         }
diff --git a/deps/openssl/openssl/crypto/x509/by_dir.c b/deps/openssl/openssl/crypto/x509/by_dir.c
index e8b7ca152b2c..df92e1d1d589 100644
--- a/deps/openssl/openssl/crypto/x509/by_dir.c
+++ b/deps/openssl/openssl/crypto/x509/by_dir.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -228,7 +228,7 @@ static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
         X509 st_x509;
         X509_CRL crl;
     } data;
-    int ok = 0;
+    int res, ok = 0;
     int i, j, k;
     unsigned long h;
     BUF_MEM *b = NULL;
@@ -320,25 +320,35 @@ static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
             }
 #ifndef OPENSSL_NO_POSIX_IO
 #ifdef _WIN32
+#define lstat _stat
 #define stat _stat
 #endif
             {
                 struct stat st;
-                if (stat(b->data, &st) < 0)
-                    break;
-            }
+                if (lstat(b->data, &st) < 0)
+                    break; /* file does not exist, not even a symlink */
+#ifndef _WIN32
+                if (stat(b->data, &st) < 0) {
+                    k++;
+                    continue; /* symlink is broken: following it went wrong */
+                }
 #endif
-            /* found one. */
-            if (type == X509_LU_X509) {
-                if ((X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx,
-                        propq))
-                    == 0)
-                    break;
-            } else if (type == X509_LU_CRL) {
-                if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
-                    break;
             }
+#endif
+            res = 0;
+            ERR_set_mark();
+            if (type == X509_LU_X509)
+                res = X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx, propq);
+            else if (type == X509_LU_CRL)
+                res = X509_load_crl_file(xl, b->data, ent->dir_type);
             /* else case will caught higher up */
+            ERR_pop_to_mark();
+            /* unless OPENSSL_NO_POSIX_IO, gracefully skip found file if cert/CRL fails to load. */
+#ifndef OPENSSL_NO_POSIX_IO
+            res = 1;
+#endif
+            if (res == 0)
+                break;
             k++;
         }
 
diff --git a/deps/openssl/openssl/crypto/x509/pcy_cache.c b/deps/openssl/openssl/crypto/x509/pcy_cache.c
index d1ee35377bda..b3b6a3da1a9a 100644
--- a/deps/openssl/openssl/crypto/x509/pcy_cache.c
+++ b/deps/openssl/openssl/crypto/x509/pcy_cache.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2004-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -134,6 +134,7 @@ static int policy_cache_new(X509 *x)
         /* If not absent some problem with extension */
         if (i != -1)
             goto bad_cache;
+        POLICY_CONSTRAINTS_free(ext_pcons);
         return 1;
     }
 
@@ -141,8 +142,10 @@ static int policy_cache_new(X509 *x)
 
     /* NB: ext_cpols freed by policy_cache_set_policies */
 
-    if (i <= 0)
+    if (i <= 0) {
+        POLICY_CONSTRAINTS_free(ext_pcons);
         return i;
+    }
 
     ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL);
 
diff --git a/deps/openssl/openssl/crypto/x509/v3_akid.c b/deps/openssl/openssl/crypto/x509/v3_akid.c
index 08c751b77cfd..9721518ecc0d 100644
--- a/deps/openssl/openssl/crypto/x509/v3_akid.c
+++ b/deps/openssl/openssl/crypto/x509/v3_akid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -173,7 +173,9 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
         i = X509_get_ext_by_NID(issuer_cert, NID_subject_key_identifier, -1);
         if (i >= 0 && (ext = X509_get_ext(issuer_cert, i)) != NULL
             && !(same_issuer && !ss)) {
-            ikeyid = X509V3_EXT_d2i(ext);
+            if ((ikeyid = X509V3_EXT_d2i(ext)) == NULL)
+                goto err;
+
             if (ASN1_STRING_length(ikeyid) == 0) /* indicating "none" */ {
                 ASN1_OCTET_STRING_free(ikeyid);
                 ikeyid = NULL;
diff --git a/deps/openssl/openssl/crypto/x509/v3_ncons.c b/deps/openssl/openssl/crypto/x509/v3_ncons.c
index 2d4b23685b0e..a0b97bb7081e 100644
--- a/deps/openssl/openssl/crypto/x509/v3_ncons.c
+++ b/deps/openssl/openssl/crypto/x509/v3_ncons.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2003-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2003-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -613,6 +613,12 @@ static int nc_dn(const X509_NAME *nm, const X509_NAME *base)
         return X509_V_ERR_OUT_OF_MEM;
     if (base->canon_enclen > nm->canon_enclen)
         return X509_V_ERR_PERMITTED_VIOLATION;
+    /*
+     * An empty base Name has no canonical encoding (canon_enc == NULL) and is
+     * a prefix of every Name, so it matches unconditionally.
+     */
+    if (base->canon_enclen == 0)
+        return X509_V_OK;
     if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))
         return X509_V_ERR_PERMITTED_VIOLATION;
     return X509_V_OK;
@@ -789,6 +795,7 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
     if (scheme == NULL || *scheme == '\0') {
         ERR_raise_data(ERR_LIB_X509V3, X509_V_ERR_UNSUPPORTED_NAME_SYNTAX,
             "x509: missing scheme in URI: %s\n", uri_copy);
+        OPENSSL_free(scheme);
         OPENSSL_free(uri_copy);
         ret = X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
         goto end;
diff --git a/deps/openssl/openssl/crypto/x509/x509_err.c b/deps/openssl/openssl/crypto/x509/x509_err.c
index 3d6e8768f8bf..7ed046fef493 100644
--- a/deps/openssl/openssl/crypto/x509/x509_err.c
+++ b/deps/openssl/openssl/crypto/x509/x509_err.c
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -26,6 +26,8 @@ static const ERR_STRING_DATA X509_str_reasons[] = {
     { ERR_PACK(ERR_LIB_X509, 0, X509_R_CERT_ALREADY_IN_HASH_TABLE),
         "cert already in hash table" },
     { ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_ALREADY_DELTA), "crl already delta" },
+    { ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH),
+        "crl signature algorithm mismatch" },
     { ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_VERIFY_FAILURE),
         "crl verify failure" },
     { ERR_PACK(ERR_LIB_X509, 0, X509_R_DUPLICATE_ATTRIBUTE),
diff --git a/deps/openssl/openssl/crypto/x509/x509_lu.c b/deps/openssl/openssl/crypto/x509/x509_lu.c
index af8035bce844..00fe2bbe0415 100644
--- a/deps/openssl/openssl/crypto/x509/x509_lu.c
+++ b/deps/openssl/openssl/crypto/x509/x509_lu.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -590,7 +590,12 @@ static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj)
 
     ret->type = obj->type;
     ret->data = obj->data;
-    X509_OBJECT_up_ref_count(ret);
+
+    if (!X509_OBJECT_up_ref_count(ret)) {
+        OPENSSL_free(ret);
+        return NULL;
+    }
+
     return ret;
 }
 
diff --git a/deps/openssl/openssl/crypto/x509/x509_vfy.c b/deps/openssl/openssl/crypto/x509/x509_vfy.c
index 0994c32ca533..b3df8c9b71e7 100644
--- a/deps/openssl/openssl/crypto/x509/x509_vfy.c
+++ b/deps/openssl/openssl/crypto/x509/x509_vfy.c
@@ -1364,6 +1364,12 @@ static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
     /* Invalid IDP cannot be processed */
     if ((crl->idp_flags & IDP_INVALID) != 0)
         return 0;
+    /*
+     * Reject delta CRLs unconditionally here. They are considered by
+     * get_delta_sk() after a base CRL is selected.
+     */
+    if (crl->base_crl_number != NULL)
+        return 0;
     /* Reason codes or indirect CRLs need extended CRL support */
     if ((ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT) == 0) {
         if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS))
@@ -1373,9 +1379,6 @@ static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
         if ((crl->idp_reasons & ~tmp_reasons) == 0)
             return 0;
     }
-    /* Don't process deltas at this stage */
-    else if (crl->base_crl_number != NULL)
-        return 0;
     /* If issuer name doesn't match certificate need indirect CRL */
     if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl)) != 0) {
         if ((crl->idp_flags & IDP_INDIRECT) == 0)
diff --git a/deps/openssl/openssl/crypto/x509/x_crl.c b/deps/openssl/openssl/crypto/x509/x_crl.c
index 4a93abb8ca3f..1b498ee6b57d 100644
--- a/deps/openssl/openssl/crypto/x509/x_crl.c
+++ b/deps/openssl/openssl/crypto/x509/x_crl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -404,6 +404,10 @@ int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x)
 
 static int def_crl_verify(X509_CRL *crl, EVP_PKEY *r)
 {
+    if (X509_ALGOR_cmp(&crl->sig_alg, &crl->crl.sig_alg) != 0) {
+        ERR_raise(ERR_LIB_X509, X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH);
+        return 0;
+    }
     return ASN1_item_verify_ex(ASN1_ITEM_rptr(X509_CRL_INFO),
         &crl->sig_alg, &crl->signature, &crl->crl, NULL,
         r, crl->libctx, crl->propq);
diff --git a/deps/openssl/openssl/crypto/x509/x_pubkey.c b/deps/openssl/openssl/crypto/x509/x_pubkey.c
index 03f532ab9cb3..8e0ee3a2197f 100644
--- a/deps/openssl/openssl/crypto/x509/x_pubkey.c
+++ b/deps/openssl/openssl/crypto/x509/x_pubkey.c
@@ -224,7 +224,7 @@ static int x509_pubkey_ex_d2i_ex(ASN1_VALUE **pval,
                      * bytes.
                      */
                     ERR_clear_last_mark();
-                    ERR_raise(ERR_LIB_ASN1, EVP_R_DECODE_ERROR);
+                    ERR_raise(ERR_LIB_ASN1, ASN1_R_DECODE_ERROR);
                     goto end;
                 }
             }
diff --git a/deps/openssl/openssl/doc/build.info b/deps/openssl/openssl/doc/build.info
index eb4492ba9c75..ce2125a4d3f3 100644
--- a/deps/openssl/openssl/doc/build.info
+++ b/deps/openssl/openssl/doc/build.info
@@ -1523,6 +1523,10 @@ DEPEND[html/man3/MDC2_Init.html]=man3/MDC2_Init.pod
 GENERATE[html/man3/MDC2_Init.html]=man3/MDC2_Init.pod
 DEPEND[man/man3/MDC2_Init.3]=man3/MDC2_Init.pod
 GENERATE[man/man3/MDC2_Init.3]=man3/MDC2_Init.pod
+DEPEND[html/man3/NAME_CONSTRAINTS_check.html]=man3/NAME_CONSTRAINTS_check.pod
+GENERATE[html/man3/NAME_CONSTRAINTS_check.html]=man3/NAME_CONSTRAINTS_check.pod
+DEPEND[man/man3/NAME_CONSTRAINTS_check.3]=man3/NAME_CONSTRAINTS_check.pod
+GENERATE[man/man3/NAME_CONSTRAINTS_check.3]=man3/NAME_CONSTRAINTS_check.pod
 DEPEND[html/man3/NCONF_new_ex.html]=man3/NCONF_new_ex.pod
 GENERATE[html/man3/NCONF_new_ex.html]=man3/NCONF_new_ex.pod
 DEPEND[man/man3/NCONF_new_ex.3]=man3/NCONF_new_ex.pod
@@ -1571,6 +1575,10 @@ DEPEND[html/man3/OPENSSL_LH_stats.html]=man3/OPENSSL_LH_stats.pod
 GENERATE[html/man3/OPENSSL_LH_stats.html]=man3/OPENSSL_LH_stats.pod
 DEPEND[man/man3/OPENSSL_LH_stats.3]=man3/OPENSSL_LH_stats.pod
 GENERATE[man/man3/OPENSSL_LH_stats.3]=man3/OPENSSL_LH_stats.pod
+DEPEND[html/man3/OPENSSL_armcap.html]=man3/OPENSSL_armcap.pod
+GENERATE[html/man3/OPENSSL_armcap.html]=man3/OPENSSL_armcap.pod
+DEPEND[man/man3/OPENSSL_armcap.3]=man3/OPENSSL_armcap.pod
+GENERATE[man/man3/OPENSSL_armcap.3]=man3/OPENSSL_armcap.pod
 DEPEND[html/man3/OPENSSL_config.html]=man3/OPENSSL_config.pod
 GENERATE[html/man3/OPENSSL_config.html]=man3/OPENSSL_config.pod
 DEPEND[man/man3/OPENSSL_config.3]=man3/OPENSSL_config.pod
@@ -3446,6 +3454,7 @@ html/man3/GENERAL_NAME.html \
 html/man3/HMAC.html \
 html/man3/MD5.html \
 html/man3/MDC2_Init.html \
+html/man3/NAME_CONSTRAINTS_check.html \
 html/man3/NCONF_new_ex.html \
 html/man3/OBJ_nid2obj.html \
 html/man3/OCSP_REQUEST_new.html \
@@ -3458,6 +3467,7 @@ html/man3/OPENSSL_Applink.html \
 html/man3/OPENSSL_FILE.html \
 html/man3/OPENSSL_LH_COMPFUNC.html \
 html/man3/OPENSSL_LH_stats.html \
+html/man3/OPENSSL_armcap.html \
 html/man3/OPENSSL_config.html \
 html/man3/OPENSSL_fork_prepare.html \
 html/man3/OPENSSL_gmtime.html \
@@ -4123,6 +4133,7 @@ man/man3/GENERAL_NAME.3 \
 man/man3/HMAC.3 \
 man/man3/MD5.3 \
 man/man3/MDC2_Init.3 \
+man/man3/NAME_CONSTRAINTS_check.3 \
 man/man3/NCONF_new_ex.3 \
 man/man3/OBJ_nid2obj.3 \
 man/man3/OCSP_REQUEST_new.3 \
@@ -4135,6 +4146,7 @@ man/man3/OPENSSL_Applink.3 \
 man/man3/OPENSSL_FILE.3 \
 man/man3/OPENSSL_LH_COMPFUNC.3 \
 man/man3/OPENSSL_LH_stats.3 \
+man/man3/OPENSSL_armcap.3 \
 man/man3/OPENSSL_config.3 \
 man/man3/OPENSSL_fork_prepare.3 \
 man/man3/OPENSSL_gmtime.3 \
diff --git a/deps/openssl/openssl/fuzz/provider.c b/deps/openssl/openssl/fuzz/provider.c
index 8234a7e8dca6..69905223fbb4 100644
--- a/deps/openssl/openssl/fuzz/provider.c
+++ b/deps/openssl/openssl/fuzz/provider.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,8 +32,11 @@
     {                                                                    \
         STACK_OF(evp) *obj_stack = stack;                                \
                                                                          \
-        if (sk_##evp##_push(obj_stack, obj) > 0)                         \
-            evp##_up_ref(obj);                                           \
+        if (!evp##_up_ref(obj))                                          \
+            return;                                                      \
+                                                                         \
+        if (sk_##evp##_push(obj_stack, obj) <= 0)                        \
+            evp##_free(obj);                                             \
     }                                                                    \
     static void init_##name(OSSL_LIB_CTX *libctx)                        \
     {                                                                    \
diff --git a/deps/openssl/openssl/include/internal/hashtable.h b/deps/openssl/openssl/include/internal/hashtable.h
index bc44e43678a3..8bfa53923616 100644
--- a/deps/openssl/openssl/include/internal/hashtable.h
+++ b/deps/openssl/openssl/include/internal/hashtable.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -272,7 +272,7 @@ static void ossl_unused ossl_ht_strcase(char *tgt, const char *src, int len)
     if (src == NULL)
         return;
 
-    for (i = 0; src[i] != '\0' && i < len; i++)
+    for (i = 0; i < len && src[i] != '\0'; i++)
         tgt[i] = case_adjust & src[i];
 }
 
diff --git a/deps/openssl/openssl/include/internal/list.h b/deps/openssl/openssl/include/internal/list.h
index 8bb0b741bed1..270e3f1dbb93 100644
--- a/deps/openssl/openssl/include/internal/list.h
+++ b/deps/openssl/openssl/include/internal/list.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -194,6 +194,35 @@
             list->omega = elem;                                                               \
         list->num_elems++;                                                                    \
     }                                                                                         \
+    static ossl_unused ossl_inline void                                                       \
+    ossl_list_##name##_join(OSSL_LIST(name) * lh, OSSL_LIST(name) * lt)                       \
+    {                                                                                         \
+        OSSL_LIST_DBG(type * _p); /* local variable '_p' when debug */                        \
+        if (lt == NULL || lh == NULL || lt->num_elems == 0 || lh == lt)                       \
+            return;                                                                           \
+        /*                                                                                    \
+         * let's be optimistic about size_t overflow here: it can not happen.                 \
+         */                                                                                   \
+        lh->num_elems += lt->num_elems;                                                       \
+        if (lh->omega == NULL) {                                                              \
+            assert(lh->alpha == NULL);                                                        \
+            lh->omega = lt->omega;                                                            \
+            lh->alpha = lt->alpha;                                                            \
+        } else {                                                                              \
+            if (lt->alpha != NULL)                                                            \
+                ((type *)lt->alpha)->ossl_list_##name.prev = lh->omega;                       \
+            ((type *)lh->omega)->ossl_list_##name.next = lt->alpha;                           \
+        }                                                                                     \
+        OSSL_LIST_DBG(for (_p = (type *)lt->alpha;                                            \
+                          assert(_p == NULL || _p->ossl_list_##name.list == lt), _p != NULL;  \
+                          _p = _p->ossl_list_##name.next)                                     \
+                          _p->ossl_list_##name.list                                           \
+            = lh);                                                                            \
+        lh->omega = lt->omega;                                                                \
+        lt->alpha = NULL;                                                                     \
+        lt->omega = NULL;                                                                     \
+        lt->num_elems = 0;                                                                    \
+    }                                                                                         \
     struct ossl_list_st_##name
 
 #define DEFINE_LIST_OF(name, type) \
diff --git a/deps/openssl/openssl/include/internal/quic_ackm.h b/deps/openssl/openssl/include/internal/quic_ackm.h
index c0617da4855f..5b325e166bd5 100644
--- a/deps/openssl/openssl/include/internal/quic_ackm.h
+++ b/deps/openssl/openssl/include/internal/quic_ackm.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -129,6 +129,11 @@ struct ossl_ackm_tx_pkt_st {
 };
 
 int ossl_ackm_on_tx_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt);
+
+/*
+ * Records transmission of a packet containing only ACK frames.
+ */
+int ossl_ackm_on_tx_ack_only_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt);
 int ossl_ackm_on_rx_datagram(OSSL_ACKM *ackm, size_t num_bytes);
 
 #define OSSL_ACKM_ECN_NONE 0
diff --git a/deps/openssl/openssl/include/internal/quic_port.h b/deps/openssl/openssl/include/internal/quic_port.h
index 5a2c9352378b..88fb126e9949 100644
--- a/deps/openssl/openssl/include/internal/quic_port.h
+++ b/deps/openssl/openssl/include/internal/quic_port.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -187,6 +187,10 @@ uint64_t ossl_quic_port_get_net_bio_epoch(const QUIC_PORT *port);
 void ossl_quic_port_raise_net_error(QUIC_PORT *port,
     QUIC_CHANNEL *triggering_ch);
 
+uint64_t ossl_quic_port_get_max_pending_channels(const QUIC_PORT *port);
+
+void ossl_quic_port_set_max_pending_channels(QUIC_PORT *port, uint64_t max_pending_channels);
+
 #endif
 
 #endif
diff --git a/deps/openssl/openssl/include/internal/quic_record_rx.h b/deps/openssl/openssl/include/internal/quic_record_rx.h
index 287837b2a561..a4e9e7cacd25 100644
--- a/deps/openssl/openssl/include/internal/quic_record_rx.h
+++ b/deps/openssl/openssl/include/internal/quic_record_rx.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -51,8 +51,9 @@ typedef struct ossl_qrx_args_st {
 OSSL_QRX *ossl_qrx_new(const OSSL_QRX_ARGS *args);
 
 /*
- * Frees the QRX. All packets obtained using ossl_qrx_read_pkt must already
- * have been released by calling ossl_qrx_release_pkt.
+ * Frees the QRX/reference to QRX. Frees the QRX object, if all references are
+ * gone. All packets obtained using ossl_qrx_read_pkt must already have been
+ * released by calling ossl_qrx_release_pkt.
  *
  * You do not need to call ossl_qrx_remove_dst_conn_id first; this function will
  * unregister the QRX from the demuxer for all registered destination connection
@@ -60,6 +61,12 @@ OSSL_QRX *ossl_qrx_new(const OSSL_QRX_ARGS *args);
  */
 void ossl_qrx_free(OSSL_QRX *qrx);
 
+/*
+ * Obtains a new reference to QRX object. Returns NULL if reference can not
+ * be obtained.
+ */
+OSSL_QRX *ossl_qrx_newref(OSSL_QRX *qrx);
+
 /* Setters for the msg_callback and msg_callback_arg */
 void ossl_qrx_set_msg_callback(OSSL_QRX *qrx, ossl_msg_cb msg_callback,
     SSL *msg_callback_ssl);
diff --git a/deps/openssl/openssl/include/internal/quic_ssl.h b/deps/openssl/openssl/include/internal/quic_ssl.h
index f714d1047716..a9c17e1087a3 100644
--- a/deps/openssl/openssl/include/internal/quic_ssl.h
+++ b/deps/openssl/openssl/include/internal/quic_ssl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -179,6 +179,7 @@ int ossl_quic_conn_poll_events(SSL *ssl, uint64_t events, int do_tick,
 int ossl_quic_get_notifier_fd(SSL *ssl);
 void ossl_quic_enter_blocking_section(SSL *ssl, QUIC_REACTOR_WAIT_CTX *wctx);
 void ossl_quic_leave_blocking_section(SSL *ssl, QUIC_REACTOR_WAIT_CTX *wctx);
+QUIC_PORT *ossl_quic_listener_get_port(SSL *s);
 
 #endif
 
diff --git a/deps/openssl/openssl/include/openssl/ssl.h.in b/deps/openssl/openssl/include/openssl/ssl.h.in
index e684f7c42975..90be33cb4f17 100644
--- a/deps/openssl/openssl/include/openssl/ssl.h.in
+++ b/deps/openssl/openssl/include/openssl/ssl.h.in
@@ -2441,6 +2441,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2688,8 +2689,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2728,12 +2739,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);
diff --git a/deps/openssl/openssl/include/openssl/x509err.h b/deps/openssl/openssl/include/openssl/x509err.h
index 7123a725e825..4bbff54a380e 100644
--- a/deps/openssl/openssl/include/openssl/x509err.h
+++ b/deps/openssl/openssl/include/openssl/x509err.h
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -27,6 +27,7 @@
 #define X509_R_CERTIFICATE_VERIFICATION_FAILED 139
 #define X509_R_CERT_ALREADY_IN_HASH_TABLE 101
 #define X509_R_CRL_ALREADY_DELTA 127
+#define X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH 147
 #define X509_R_CRL_VERIFY_FAILURE 131
 #define X509_R_DUPLICATE_ATTRIBUTE 140
 #define X509_R_ERROR_GETTING_MD_BY_NID 141
diff --git a/deps/openssl/openssl/providers/baseprov.c b/deps/openssl/openssl/providers/baseprov.c
index 16d2f91bb1ac..ad08765f006c 100644
--- a/deps/openssl/openssl/providers/baseprov.c
+++ b/deps/openssl/openssl/providers/baseprov.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -29,10 +29,6 @@ static OSSL_FUNC_provider_gettable_params_fn base_gettable_params;
 static OSSL_FUNC_provider_get_params_fn base_get_params;
 static OSSL_FUNC_provider_query_operation_fn base_query;
 
-/* Functions provided by the core */
-static OSSL_FUNC_core_gettable_params_fn *c_gettable_params = NULL;
-static OSSL_FUNC_core_get_params_fn *c_get_params = NULL;
-
 /* Parameters we provide to the core */
 static const OSSL_PARAM base_param_types[] = {
     OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0),
@@ -139,15 +135,13 @@ int ossl_base_provider_init(const OSSL_CORE_HANDLE *handle,
     void **provctx)
 {
     OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
+    OSSL_FUNC_core_get_params_fn *c_get_params = NULL;
     BIO_METHOD *corebiometh;
 
     if (!ossl_prov_bio_from_dispatch(in))
         return 0;
     for (; in->function_id != 0; in++) {
         switch (in->function_id) {
-        case OSSL_FUNC_CORE_GETTABLE_PARAMS:
-            c_gettable_params = OSSL_FUNC_core_gettable_params(in);
-            break;
         case OSSL_FUNC_CORE_GET_PARAMS:
             c_get_params = OSSL_FUNC_core_get_params(in);
             break;
diff --git a/deps/openssl/openssl/providers/defltprov.c b/deps/openssl/openssl/providers/defltprov.c
index a74a048d6f76..de2a46515e11 100644
--- a/deps/openssl/openssl/providers/defltprov.c
+++ b/deps/openssl/openssl/providers/defltprov.c
@@ -34,10 +34,6 @@ static OSSL_FUNC_provider_query_operation_fn deflt_query;
 #define ALGC(NAMES, FUNC, CHECK) { { NAMES, "provider=default", FUNC }, CHECK }
 #define ALG(NAMES, FUNC) ALGC(NAMES, FUNC, NULL)
 
-/* Functions provided by the core */
-static OSSL_FUNC_core_gettable_params_fn *c_gettable_params = NULL;
-static OSSL_FUNC_core_get_params_fn *c_get_params = NULL;
-
 /* Parameters we provide to the core */
 static const OSSL_PARAM deflt_param_types[] = {
     OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0),
@@ -733,6 +729,7 @@ int ossl_default_provider_init(const OSSL_CORE_HANDLE *handle,
     void **provctx)
 {
     OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
+    OSSL_FUNC_core_get_params_fn *c_get_params = NULL;
     BIO_METHOD *corebiometh;
 
     if (!ossl_prov_bio_from_dispatch(in)
@@ -740,9 +737,6 @@ int ossl_default_provider_init(const OSSL_CORE_HANDLE *handle,
         return 0;
     for (; in->function_id != 0; in++) {
         switch (in->function_id) {
-        case OSSL_FUNC_CORE_GETTABLE_PARAMS:
-            c_gettable_params = OSSL_FUNC_core_gettable_params(in);
-            break;
         case OSSL_FUNC_CORE_GET_PARAMS:
             c_get_params = OSSL_FUNC_core_get_params(in);
             break;
diff --git a/deps/openssl/openssl/providers/fips-sources.checksums b/deps/openssl/openssl/providers/fips-sources.checksums
index a2f5817e26de..85af251d79e2 100644
--- a/deps/openssl/openssl/providers/fips-sources.checksums
+++ b/deps/openssl/openssl/providers/fips-sources.checksums
@@ -20,12 +20,12 @@ f1d8b7a3da1ec053d38be4fc776fef1e4fba328bfa2bfd928c2a2cd3b14f08ff  crypto/aes/asm
 ee4e8cacef972942d2a89c1a83c984df9cad87c61a54383403c5c4864c403ba1  crypto/aes/asm/aes-sparcv9.pl
 391497550eaca253f64b2aba7ba2e53c6bae7dff01583bc6bfc12e930bb7e217  crypto/aes/asm/aes-x86_64.pl
 3b5ee174fa52d732d882ab4b2ffe59235d3bff66651714f32e743fcadaf1d970  crypto/aes/asm/aesfx-sparcv9.pl
-14359dc32b7f4e5c08227fb9ac8f9232c1287399463b233fec4a2ab0c19f68d1  crypto/aes/asm/aesni-mb-x86_64.pl
-f525e1bca51d39adcd411cbf8f874fe1441b23a6f614644da78dfd8544d13b23  crypto/aes/asm/aesni-sha1-x86_64.pl
-895f94d7befb90e82f9d300ed8f870e790101f30ba72b249a2c503f07aec7dd2  crypto/aes/asm/aesni-sha256-x86_64.pl
+e220d630965eb2672dca757aefcb9654928288772fd495da3a495b405b5f21ff  crypto/aes/asm/aesni-mb-x86_64.pl
+83a08babb80e15606bb52c6b4fcd1a6416d3b165b9cbfa42678ebe2e27c3b8d4  crypto/aes/asm/aesni-sha1-x86_64.pl
+6808938757a489c3827e6da78f9ce227d88efcc29c3467fa0329b50b761523eb  crypto/aes/asm/aesni-sha256-x86_64.pl
 4ff74d4e629a88ef5a9e3d3f5b340fc0a4793d16d7cc7f1b70da62512a856248  crypto/aes/asm/aesni-x86.pl
 25881237d026cebd96877a2ea2729db1ce512875cb2a10ca0cd1d6ddf4b51a3b  crypto/aes/asm/aesni-x86_64.pl
-6047359ad3967168812fbc8a95cb851b72c09f7846be2f03ec2ab93531a9c2bd  crypto/aes/asm/aesni-xts-avx512.pl
+00dd3a64df71ebd61fd35d2a6179d07cc86fc156cce1541ef176ecafb815f4bb  crypto/aes/asm/aesni-xts-avx512.pl
 0489a10fbb1a8ca3652848d5c1e14e519501e189bad3e5827a573c26df359691  crypto/aes/asm/aesp8-ppc.pl
 e397a5781893e97dd90a5a52049633be12a43f379ec5751bca2a6350c39444c8  crypto/aes/asm/aest4-sparcv9.pl
 578142d03bc47353952fca2027eb63ec97ce9a1379c0f3c7ac0fdf110eb3378b  crypto/aes/asm/aesv8-armx.pl
@@ -39,7 +39,7 @@ c3541865cd02d81101cdbab4877ed82772e6980d2c677b9008b38fa1b26d36d4  crypto/aes/asm
 c6935d2ab7925022cb3d76446536ff01b1a1b8eb7eac619d034a29aad17ed45f  crypto/aes/asm/vpaes-x86_64.pl
 2bc67270155e2d6c7da87d9070e005ee79cea18311004907edfd6a078003532a  crypto/alphacpuid.pl
 269e52f8867c13ca75d2f88ec1f89b692cb8c6c3ee89abe2fd3c1821925191d8  crypto/arm64cpuid.pl
-7a7c1d063be476f35442b0b056cfad0cf62190b603304abd283906ab40590167  crypto/armcap.c
+b0242943b097f7640f1b3c33313934a98caf45d47d4403e9e53d826f6d2dc0c4  crypto/armcap.c
 d9f923daabe7537d1063b182f9f220655abd182ef4c55a0194a7ee8d6030b5bd  crypto/armv4cpuid.pl
 e886d814c34492504cc9a2451c67fd8c0b4e83e8618f931632400cfe522b6e4d  crypto/asn1_dsa.c
 819c9fd2b0cae9aab81c3cbd1815c2e22949d75f132f649b5883812d0bbaa39a  crypto/bn/asm/alpha-mont.pl
@@ -58,14 +58,14 @@ b27ec5181e387e812925bb26823b830f49d7a6e4971b6d11ea583f5632a1504b  crypto/bn/asm/
 59cd27e1e10c4984b7fb684b27f491e7634473b1bcff197a07e0ca653124aa9a  crypto/bn/asm/ppc.pl
 0b3350f56d423a4df918a08e90c7c66227c4449a9f9c44096eacc254ebc65f9f  crypto/bn/asm/ppc64-mont-fixed.pl
 a25be64867ab837d93855af232e2bfa71b85b2c6f00e35e620fdc5618187fb6f  crypto/bn/asm/ppc64-mont.pl
-b3aad31ab658eceaa9c5e734e19f39c33991f4839ab55b0cec8018020b1a305e  crypto/bn/asm/rsaz-2k-avx512.pl
-03f6cc678f377c5cd953e8da135c5d76dc1cd011565118c99e25bff91e7271df  crypto/bn/asm/rsaz-2k-avxifma.pl
-e914311420ae4486ab6000cc6ab424f04d8a042bda40ab8f288348dc9f0eb595  crypto/bn/asm/rsaz-3k-avx512.pl
-95b11e0b04c38bde06d152dfde5ab970dab27cccdfeac998e1bc293e01520474  crypto/bn/asm/rsaz-3k-avxifma.pl
-e13bd2df8c591052ddf16a839072f43353841f9f35e0ac95f836511838dbc771  crypto/bn/asm/rsaz-4k-avx512.pl
-cf92b66c4032703b7ce03ff6aa36887d14e31a8861e7aa21c46a466ea4802851  crypto/bn/asm/rsaz-4k-avxifma.pl
-6e47bf041e51d8086c4933c2a5da3ce6d1b136592984754461d59aa81e4995a6  crypto/bn/asm/rsaz-avx2.pl
-b42f6cf0fbf9eae58343df9629e7a9e5b8814195ea0c9882d7b143a0841cc018  crypto/bn/asm/rsaz-x86_64.pl
+d48aded8547aa44a4af0d76d4675320628c66ba54e6fda865804953eefa8e853  crypto/bn/asm/rsaz-2k-avx512.pl
+ae2e714dc003867c31136f939f8d47eb35eac3de36dbeea8f028a48d03b964ec  crypto/bn/asm/rsaz-2k-avxifma.pl
+6b5f35bf328f19b3add87a9715736ca92a8165920264311e20d3477a41a90a82  crypto/bn/asm/rsaz-3k-avx512.pl
+b0ef4c3bb3a835066e9f7cafab22efc9d668b6debf5b9b9ec312cabae9412631  crypto/bn/asm/rsaz-3k-avxifma.pl
+ca2d4486ee67f2015a8580664f3bbc28c23201205a2422d3a972cdf6ba59147a  crypto/bn/asm/rsaz-4k-avx512.pl
+80b0e7aca0ebee78fb3c651723e7f0eaac43a5b6a2bcf87b98a454a248abb945  crypto/bn/asm/rsaz-4k-avxifma.pl
+7d686b484ea2bb65091c6ed3e74d5f4063ed4a8ecc09b7bef8d3a3aa57c4121e  crypto/bn/asm/rsaz-avx2.pl
+bec7e89c5a33652bbff20c95a6fe82bd96f7f2f61a3544c122f3af6f4f162110  crypto/bn/asm/rsaz-x86_64.pl
 30fedf48dfc5fec1c2044b6c226dd9fc42a92522cc589797a23a79d452bdd2cf  crypto/bn/asm/s390x-gf2m.pl
 590388d69d7ac3a0e9af4014792f4f0fdb9552719e8fb48ebc7e5dfca2a491d4  crypto/bn/asm/s390x-mont.pl
 aa02597f3dc09cfbc190aedb75711859ba0f3efff87067ebfba1ec78ebee40d7  crypto/bn/asm/s390x.S
@@ -81,9 +81,9 @@ d24f3e97239c8eed5efc721521b025b7256c15e67a54ea6b5c4cf8f7cd0f89ea  crypto/bn/asm/
 90d4ae234c08267adce9ed38d56e0edc223f7480cb9605f5d7399d0b3914c6be  crypto/bn/asm/x86-mont.pl
 0e3e572cd864bcb9222cdad7ca4e8dae4250f6f76c2b66e1f0e46df1cc0cf371  crypto/bn/asm/x86_64-gcc.c
 709ddee92e9222ee0ed27bfb90db556e85e2d302e4a9131afa25fdc14c4d858f  crypto/bn/asm/x86_64-gf2m.pl
-da7f7780d27eed164797e5334cd45b35d9c113e86afaca051463aef9a8fd787c  crypto/bn/asm/x86_64-mont.pl
-efe70ef06b5d92539f8a239c98c0261d93a15b3e418ca87d97ec569da9e6e9d3  crypto/bn/asm/x86_64-mont5.pl
-0ea8185a037a2951bb3d1e590bbbdeac305176d5e618f3e43a04c09733a9de34  crypto/bn/bn_add.c
+4ad5e97a7ed376d2cc079a3eabfbdc0cce3fe6e61751324ef18b72d24f7851d6  crypto/bn/asm/x86_64-mont.pl
+11eebbeb8ae59158e780d74300b333de9705aefdde73cff280286c053c8743da  crypto/bn/asm/x86_64-mont5.pl
+7c81cd72fbf6f2dd85cbcbf40027301c98c1701928d3199edb2b8fdf04a5ca5e  crypto/bn/bn_add.c
 529933a6592cf82abde515dae10db17833a16ec29cb89ec577c0a184838fe27b  crypto/bn/bn_asm.c
 feef3a84a40034291286882d483ac23ab55631c3c93f40ba0ea98944916ff3ec  crypto/bn/bn_blind.c
 1b8f89064c287669a834fe032ef823796f7355ed7e6da08d6c56c0a4cd0bba01  crypto/bn/bn_const.c
@@ -91,13 +91,13 @@ eee3d2710144b0e860c57e84f5adc6b2bf64fc27cbd202a8ca2630aefed3b84c  crypto/bn/bn_c
 282f06fbdeb991d90337787c6407020e940b6d5e187a06866f1a7787c10a0c1b  crypto/bn/bn_ctx.c
 b1b1c5fb8a45fde5755dfd5da62b68100b94f8c492c950719c108c384ea7f3c4  crypto/bn/bn_dh.c
 4824f271f0ddc487b5991fbd92f7f7695aeeac234e076078f37da027999cdd88  crypto/bn/bn_div.c
-d36b2be05469f144f52173616e413a7bdd836607fccf94cf543cc7f5a343b962  crypto/bn/bn_exp.c
+f1e98f178356791a3d54f586c19d1639d8e89b2cf6e6a4de783327ceada296a2  crypto/bn/bn_exp.c
 ce5219203bf869561297978d6d416357a441864cd801865503dfd455c481960c  crypto/bn/bn_exp2.c
 18ac3f6fe64225f72243689199839ea2ce2aa61d80b084bc4cd9efe1c7cc9d89  crypto/bn/bn_gcd.c
 b643fdcd91ad7dfcfa97a0bb235221b024b8a77faa7890f0bcb9681ea2c64c49  crypto/bn/bn_gf2m.c
 73ee247467879d4ec984c9900dfe7761233c5b889b8762be37c7e8fdd6d1d210  crypto/bn/bn_intern.c
 ff147e5e032cc7c772b73a91fc6e24d8d9516e642d29354445d1f82d64b1d924  crypto/bn/bn_kron.c
-df9aebbdcca87fc5715dde430687fb516d8de0dac70c8910409fb73d6dd2305b  crypto/bn/bn_lib.c
+c4bae573e4e7132106b1151e8983cb63200dd9e49dc464e805f0fc50d55374d0  crypto/bn/bn_lib.c
 cd7bade0f2e223fe34f6e2f8cc87098ac8f0af96ec62ada5e67f6a2344d48ef0  crypto/bn/bn_local.h
 b494fd85387afa7816422922e52987e0faefc3c890c972e7d4fe04f620dfc59a  crypto/bn/bn_mod.c
 39a8fe0bb625b4c11b74998ce6fd99b7655228aaa7d7ad3076f61741937ae14d  crypto/bn/bn_mont.c
@@ -126,7 +126,7 @@ ab29529cca1308302d852999f2790c404a4dc0ef8cd6653260739f70b2f22758  crypto/core_fe
 0e3519aec0d93b0700d1175616b8bfca9c045989fad515d2202dd7dff9caa5ac  crypto/core_namemap.c
 a62f653b8a6ee765be704980425617e04e1d242f9735efaf35fc6e00815ff2a7  crypto/cpuid.c
 a73118d14eeb232ff250ae908204ddd7cf33deba5f3ca68a2dbb51b020946b0e  crypto/cryptlib.c
-66dbfc58916709d5a6913777346083247942a8d9458ee9b2bf443f0ea4988d64  crypto/ctype.c
+0145299d43dbb60e85ef6b97cf7496dec55cc37b75433e1403c11adfa3e90c5f  crypto/ctype.c
 b9fabcf8480b8c9c7847a0c9af0fcc13b6c4b4a4558d5e445e6409221e6f8113  crypto/der_writer.c
 135ef65f7602432f8c87ad18fdd90b867f1c46b1c631522d56181fbed2106b05  crypto/des/des_enc.c
 7c2cea4c850398158b4aff172b242de0cc436b66f62fc701ccca3fe5489925a5  crypto/des/des_local.h
@@ -136,7 +136,7 @@ c1e015556147b40c854bf0ab275c54235f99001d04c6d49f158fba6865eb5439  crypto/des/fcr
 dc2e7899593032fdf0fcab18f5549c52f12bad2225aac9a08c4622ffee34b193  crypto/des/set_key.c
 41b7fc5e67814311b878684e3f29cff60e228f1516f670d81bf43130f2668ae8  crypto/des/spr.h
 b842e39f34996d74cdc9b9be5fc93c27fc91ef6141fae83163e09f6b0eff1e09  crypto/dh/dh_backend.c
-091ec05b6316cce34305ae8f8014043c7c9b72098aa1abe9c35dcbcdb4b77cd0  crypto/dh/dh_check.c
+380d55ea09a50ba3ece173e64db90782efae08ca56ac51cb4d31b9a303b429ea  crypto/dh/dh_check.c
 c117ac4fd24369c7813ac9dc9685640700a82bb32b0f7e038e85afd6c8db75c7  crypto/dh/dh_gen.c
 1149e214ed664540434912e284730a3c87385172e4c6d1c944ea56659e2dd762  crypto/dh/dh_group_params.c
 a539a8930035fee3b723d74a1d13e931ff69a2b523c83d4a2d0d9db6c78ba902  crypto/dh/dh_kdf.c
@@ -146,7 +146,7 @@ a9166c3cc60f4281e9d471c64145e0a78fc9dc43b8bc9e5de96d91eb7d277da3  crypto/dh/dh_l
 40065939139ac28aa52838aa54d257da82fce73504557f7a9ad34d13824e0cb9  crypto/dsa/dsa_backend.c
 786d6c65ced7ee4e25f5dd7c3150259ec95b6aa321a7590d905757b8139f8230  crypto/dsa/dsa_check.c
 ae727bf6319eb57e682de35d75ea357921987953b3688365c710e7fba51c7c58  crypto/dsa/dsa_gen.c
-dee83cb278b3f712a62bd3477bdecf7b83e6df38ada2f3e1ca043d37327e2da4  crypto/dsa/dsa_key.c
+43f8fba4f50fbc94b1532a7667c9cfdc91b357e8658fd5fe0dcd302ea93ae9a0  crypto/dsa/dsa_key.c
 7d44106570c0ff9a44de874ea2daeaa87ea4c814fef6af0a26f655120a54f529  crypto/dsa/dsa_lib.c
 98ce52d325d2409d7851f1e1226755136f115c884d227d2ae3e4f9b61fc323b8  crypto/dsa/dsa_local.h
 3428bc7602f344f8b8d4a5807b0a7e982cbead1ec28be73ad77b5f849b034993  crypto/dsa/dsa_ossl.c
@@ -159,9 +159,9 @@ d9722ad8c6b6e209865a921f3cda831d09bf54a55cacd1edd9802edb6559190a  crypto/ec/asm/
 3715ddd921425f3018741037f01455ed26a840ace08691a800708170a66cf4d2  crypto/ec/asm/ecp_nistz256-ppc64.pl
 cfe7e75a2fddc87a7251684469a8808b9da82b2f5725eafad5806920f89932bd  crypto/ec/asm/ecp_nistz256-sparcv9.pl
 922725c4761cfa567af6ed9ecab04f2c7729ae2595f2fc0fa46dc67879dc87b0  crypto/ec/asm/ecp_nistz256-x86.pl
-afa4497cfbf9ef7805e42ae6a61c7d983e8a789b270d498a07785570ab85a9fa  crypto/ec/asm/ecp_nistz256-x86_64.pl
+f5c4f8c74a44c8723293e3bb64c0c2cf75dc354466ac9f93ebfdab1df34b64c4  crypto/ec/asm/ecp_nistz256-x86_64.pl
 cc727533130f5f1a29229929b3d4e8454585d647be25d6344f3c6a0240998368  crypto/ec/asm/x25519-ppc64.pl
-ee897e230964511baa0d1bf95fb938312407a40a88ebe01476879c2763e5f732  crypto/ec/asm/x25519-x86_64.pl
+ee576a748991bb2cf0a37437e46a23dd55dfd35d989e087d122c7cf0f332eb2a  crypto/ec/asm/x25519-x86_64.pl
 2e7b5d2a3eff0b8a90c1de3f28a7bf59b1057e7694c0e36909e774343cef609f  crypto/ec/curve25519.c
 784c03c3f81fd0c363cd0500fbd95f3e49c65f47a249f7ba25fad42a41d3eea2  crypto/ec/curve448/arch_32/f_impl32.c
 8e75602d4d492316d318bac147eaa09d87b0eeda0d450e18683d935673ab61b0  crypto/ec/curve448/arch_64/arch_intrinsics.h
@@ -185,7 +185,7 @@ dfbccf591879eecbd9ed75da1fbe6c7b1672d07648fd43b37755dfe248253bb2  crypto/ec/ec_b
 3a3c4f4767513b4fbbabdea2918d7c7d105eb573334a7fd893b866989463c4d2  crypto/ec/ec_check.c
 f3991bfc65a7371b84afd0cc328e3cbd4736edf7267e4b731dd82677bfab047a  crypto/ec/ec_curve.c
 8cfd0dcfb5acbf6105691a2d5e2826dba1ff3906707bc9dd6ff9bffcc306468f  crypto/ec/ec_cvt.c
-add58bcaf43a28e66b3a6ec1f70ed9b0b4a4a0d40230e903a26a1ff1129649e0  crypto/ec/ec_key.c
+b94eb087740dde2bf697cfbc5e8a17efd80e84c5072c9c72f8ed2f9155976d37  crypto/ec/ec_key.c
 35515133fb3c33c5736a9f744e835b9fc0775193357ab2492f11d0f63503c65e  crypto/ec/ec_kmeth.c
 652a1544120bf0fecde46a8e18cc28fffcb7cd864be2e2b84c99d571ba320e64  crypto/ec/ec_lib.c
 0d113ac5dbdb420ba3d1c060f4fa3300fc0a81b571a919c2b176022fdca89878  crypto/ec/ec_local.h
@@ -214,7 +214,7 @@ ed0217e7c2049b44a454b40e7e18385eadb34bce1bcf54337f420cbf988775da  crypto/evp/asy
 e997e921669076c51e230ccb2e36b1c6755fe408c61b1177d2aa67529cab15f3  crypto/evp/evp_local.h
 8963ef06e4d228f7067917434f60f0502dc4bbdf3b271649498b734f4074bfb0  crypto/evp/evp_rand.c
 0bdae4714221662282dccd5b1f2485370d24e463c11bdbb71a310f34616954fe  crypto/evp/evp_utils.c
-8f4194bcc2e0de69236925aa7515bc31f36ed113dcd3cee5d71167ac770cdfdd  crypto/evp/exchange.c
+1d78745866dde8224eec50c8553a15b51aa14bc3313969479806b3c3024c7282  crypto/evp/exchange.c
 294284ad040fe4b74845f91b1903c961c757e1ef3fcc2ffa35f43f37f1655e64  crypto/evp/kdf_lib.c
 532f0ff4ab32068f160016f39cd520fadfbd09b81b3b3b562bf543acafb38889  crypto/evp/kdf_meth.c
 d911878128b90b98f3a4a1fb844ef3a20d35eafda3f80773dac8ce93c55bc352  crypto/evp/kem.c
@@ -239,7 +239,7 @@ bb208ef3a2c7ebdc518bd38f2f07a17cff356040f1c5d68eea13bd9275897a52  crypto/ffc/ffc
 e9a500ddbe96cb5b302fd2db74fac0924a6ac45732df5ee1c09e82b19d06ccfd  crypto/ffc/ffc_params_validate.c
 f172c8c2112ee82716a7bc3a3e05d5cc26188c66b9d768ac1ff906845063d2cc  crypto/hashtable/hashfunc.c
 ed523d9793ff9db947857bca354067d17b8de5a4b28604dbf902320e62d93e33  crypto/hashtable/hashtable.c
-7a9af0b14f1463b36de0689bc434a318adcb7990bb23862bf1d2a0adf510583a  crypto/hmac/hmac.c
+9a63ec43c8b9a55e0b135394a659026c1d1236978ebbb5df0e3c4c5c58b62ef4  crypto/hmac/hmac.c
 907dd44e0bf873eebefcb4d82975b72ecec9e0f3c348c79314450fdaa78d4073  crypto/hmac/hmac_local.h
 0e2d6129504d15ffaf5baa63158ccec0e4b6193a8275333956d8f868ef35127e  crypto/ia64cpuid.S
 29c020cf599c24ef9969a42e00e690a7b463c20dd90356b0a4117ca31b13db6f  crypto/initthread.c
@@ -248,28 +248,28 @@ ed523d9793ff9db947857bca354067d17b8de5a4b28604dbf902320e62d93e33  crypto/hashtab
 899ba6a9049a61d5b175637907f747f58863cd8950409cefac8fbc8f574f970c  crypto/loongarch64cpuid.pl
 460a7af09cde89a820b091522ada1310cfcec99c60aee505f94c48c35e9a29e8  crypto/loongarchcap.c
 f866aafae928db1b439ac950dc90744a2397dfe222672fe68b3798396190c8b0  crypto/mem_clr.c
-23ff635daa1a3149e14de6c2a41b82a7587801581bdf39b8a82e9c624da95471  crypto/ml_dsa/ml_dsa_encoders.c
+1812ee360303b9fdcebe6dd0690944646bd9605ee67e3554c691cf5993293c46  crypto/ml_dsa/ml_dsa_encoders.c
 825105b0a2c4844b2b4229001650ff7e61e1348e52f1072210f70b97cd4adb71  crypto/ml_dsa/ml_dsa_hash.h
-2fbef0188a8606c56f2ffffecfbbbd13ccd454c2af949d6e37fb7c929974f1d4  crypto/ml_dsa/ml_dsa_key.c
+2bebd01093de6f77dabb8b6e5ac3deaad9104904956691e22d80f105a3e526c2  crypto/ml_dsa/ml_dsa_key.c
 579c1a12a5c5f014476a6bf695dc271f63074fb187e23ffc3f9ccb5b7ea044f1  crypto/ml_dsa/ml_dsa_key.h
 3f98eb0467033d0a40867ef1c1036dcfea5d231eeac2321196f7d7c7243edace  crypto/ml_dsa/ml_dsa_key_compress.c
 170292bfc8761e39b688ccfb21b3660af6e1a875aa38ff7448cc22f71f5874c5  crypto/ml_dsa/ml_dsa_local.h
-0490a89372b79d98c2fdc294f836fddd7a54a148202ffbd50c2d4371816a94d8  crypto/ml_dsa/ml_dsa_matrix.c
+6ac18f9ef27efc7fddc38ad5edec94fcf76a972ca9fcb6bdc5472673d885d238  crypto/ml_dsa/ml_dsa_matrix.c
 ff65c82c56e341f47df03d0c74de7fb537de0e68a4fa23fa07a9fdb51c511f1c  crypto/ml_dsa/ml_dsa_matrix.h
 c2652262227348b8bb053a239e8491b26f08d6fadc47ba3471302f5797ae1c62  crypto/ml_dsa/ml_dsa_ntt.c
 3e0980e67842c4d8637fa449ac41e9d650c614c1074c29f1021605d229a4f73d  crypto/ml_dsa/ml_dsa_params.c
 10e37ab3ee09a45d99007665e073efb2b062c819f30af8694c6b0f411eb33822  crypto/ml_dsa/ml_dsa_poly.h
-26be5266a9f1a33999a5a68c96cffc7932ba64521d9554dabe7397591611c852  crypto/ml_dsa/ml_dsa_sample.c
-26ce39dd4cdac0a1c00cee24d53e156c16a1577c71a8a96bce3e2b4130afa6f5  crypto/ml_dsa/ml_dsa_sign.c
+abb4f2263fb9b6d08911e1b8e2df2c2de636d6255f7cf3eee594f50dedcefc0c  crypto/ml_dsa/ml_dsa_sample.c
+f1cbf5ebe46fe456e338a496193bf028d48a28bb3d4804591094babe84d83b25  crypto/ml_dsa/ml_dsa_sign.c
 5217ef237e21872205703b95577290c34898423466a465c7bd609b2eb4627964  crypto/ml_dsa/ml_dsa_sign.h
-8311e08d9d0e2e073092d0cfaf64851fb8d0f0708dfc2707422f525f87f269d0  crypto/ml_dsa/ml_dsa_vector.h
-0fbbb11e30b7e3f4e5366334e273dcc3f6440ed04a0758f0c99279c25b8c0baf  crypto/ml_kem/ml_kem.c
+afc44b2cdf6a03555cebcc0398179b44f5810098d0b17dcb2b0c0c62023d6964  crypto/ml_dsa/ml_dsa_vector.h
+dd95a5261fd1624e1e93270b0dc9404c887506a402d55521a5074975db833fd6  crypto/ml_kem/ml_kem.c
 36e24eae5d38cc9666ae40e4e8a2dc12328e1159fea68447cb19dab174d25adf  crypto/modes/asm/aes-gcm-armv8-unroll8_64.pl
 33357356cd739d4ae89d52f0804b6900e4b94d8829323819c6f64c8908e978df  crypto/modes/asm/aes-gcm-armv8_64.pl
-a91995f81b384b175ecf252690030bb068d6af64bfcdab2fe753484b2d07a184  crypto/modes/asm/aes-gcm-avx512.pl
+573c286991352233cb068d0e218c5cb1e6fe5d07a924496dbccca95fa82e1d4d  crypto/modes/asm/aes-gcm-avx512.pl
 8fab6574aa99ee635d564dbe68b014562b61af37fa4f151210690837cdae6707  crypto/modes/asm/aes-gcm-ppc.pl
 dd0de5ca8913a941cfff781a42fba43227e133976a24d0fddebf63909f7e010a  crypto/modes/asm/aes-gcm-riscv64-zvkb-zvkg-zvkned.pl
-9dcd3be86cda832ebe0394f5a859a761f4b711f2010fb606457f754722c5fb84  crypto/modes/asm/aesni-gcm-x86_64.pl
+a4fad5a5cb112929323632e4f3f5fce7d6f0ceb6ea2e3ed1a4a2165f05fbf0b5  crypto/modes/asm/aesni-gcm-x86_64.pl
 c2e874a8deb418b5d8c935b2e256370566a5150e040c9fa008cdb5b463c26904  crypto/modes/asm/ghash-alpha.pl
 6bc7d63569c73d7020ede481f2de05221ac92403c7cc11e7263ada7644f6aa9b  crypto/modes/asm/ghash-armv4.pl
 097975df63370de7ebea012d17de14fc1f361fb83acf03b432a99ae7d5bceb24  crypto/modes/asm/ghash-c64xplus.pl
@@ -281,7 +281,7 @@ e6d6ce559210aee1e97f098683e290c221cc90f6f4f8047b331e8071a8387559  crypto/modes/a
 92071f9c046f312c4eb7df483f385bc71ade863392e1acf3e821912bcc5cfaa7  crypto/modes/asm/ghash-s390x.pl
 6af1a05981e1d41e4dea51e58938360e3abc4a4f58e179908242466d032b1a8a  crypto/modes/asm/ghash-sparcv9.pl
 26f55a57e77f774d17dfba93d757f78edfa3a03f68a71ffa37ccf3bfc468b1e2  crypto/modes/asm/ghash-x86.pl
-487e23973c9c782d375a956da6231e91f450182d8822d3f86fd4924e143fed70  crypto/modes/asm/ghash-x86_64.pl
+3d746cc0cf6cca866e34cdbbd79f5660244033fa440ed82aaaa9dd16cebf821f  crypto/modes/asm/ghash-x86_64.pl
 a4e9f2e496bd9362b17a1b5989aa4682647cefcff6117f0607122a9e11a9dfd9  crypto/modes/asm/ghashp8-ppc.pl
 92f17ee53bd40123358ce5b37bcd6063bfa7d6860dd734d4ac585249c03a6b32  crypto/modes/asm/ghashv8-armx.pl
 ca4be187fc1805d498f2adb823509f0519e214644029c18d331b5b01a0891a9d  crypto/modes/cbc128.c
@@ -312,7 +312,7 @@ ed6956c34da5127fbf8f1a067654b617c261039743a12fd1d296a1dd01b05c26  crypto/params_
 fcafd9ac56254e921f43dda47aa6d19ff42b3461ff3a72e0bff1840793f96701  crypto/provider_core.c
 aa58d7800d3ccf2989b0de3c2e2710dfac36c88dc51659129897b0dfd2162527  crypto/provider_local.h
 5ba2e1c74ddcd0453d02e32612299d1eef18eff8493a7606c15d0dc3738ad1d9  crypto/provider_predefined.c
-5f077b3d3c0127c9051907f91b7184d18ad045452e0cd891937932c8fb1f129f  crypto/rand/rand_lib.c
+1e919f7f3c860eb21bf2f6f868dae076c64c53f1ad794c6764f69329724c3fc2  crypto/rand/rand_lib.c
 9e162caba63741e3df4d0f1c49a7555263ebc120cfb643546ea7e34d3f5eb862  crypto/rand/rand_local.h
 dce7413b4c4e588c9a099c6fd7c6c9a397e034f259a2027d4ea8bdfe149164fa  crypto/rcu_internal.h
 0c1d3e0e857e9e4f84752a8ef0b619d8af0d81427b52facbd0174e685dac9a47  crypto/riscv32cpuid.pl
@@ -322,7 +322,7 @@ f0c8792a99132e0b9c027cfa7370f45594a115934cdc9e8f23bdd64abecaf7fd  crypto/rsa/rsa
 b1584c4a1a5f83a1fd43d854ce72bb11735aa34945f2b2f983228f36f27fdad2  crypto/rsa/rsa_backend.c
 38a102cd1da1f6ca5a46e6a22f018237964336274385f5c70cbedcaa6997647e  crypto/rsa/rsa_chk.c
 e762c599b17d5c89f4b1c9eb7d0ca1f04a95d815c86a3e72c30b231ce57fb199  crypto/rsa/rsa_crpt.c
-e666568eadfd01ff3e435364dee2575fca7ff3e6855b2c258fa1e4d04239d933  crypto/rsa/rsa_gen.c
+157eec6c45b95ed974324055f594885c50e33616af3af06efb558d651a786c69  crypto/rsa/rsa_gen.c
 f22bc4e2c3acab83e67820c906c1caf048ec1f0d4fcb7472c1bec753c75f8e93  crypto/rsa/rsa_lib.c
 969a13b951b8a77337fef84437b1aeec49ab1c73ecbceeb4b0df2174ae16a9a2  crypto/rsa/rsa_local.h
 cf0b75cd54b61b9b9a290ef18d0ddce9fb26a029a54eb3f720d9b25188440f00  crypto/rsa/rsa_mp_names.c
@@ -350,13 +350,13 @@ be1e7dd9998e3f31cfa6e1b17bc198aeec584a8b76820e38f71d51b05f8a9f2a  crypto/sha/asm
 79dec13ccbee4a6758a22d92bfd5694565416219e48b6894dfb63c6b0029ae28  crypto/sha/asm/keccak1600-s390x.pl
 3fb93b9440f5c3008b5c876a8106acc5f8d38f1afedd79381f0befec7dd7d72b  crypto/sha/asm/keccak1600-x86_64.pl
 831b8b02ab25d78ba6300ce960d96c13439bfba5844e13061e19c4e25cbacc3d  crypto/sha/asm/keccak1600p8-ppc.pl
-75d832db9bf0e98e7a5c522169060a6dd276c5118cfb297fc3f1111f55cd4007  crypto/sha/asm/sha1-586.pl
+131d338bc716d9b5d4c1d3e8de213aa621f7581f91ec0ee7e2e56a9a94f1822b  crypto/sha/asm/sha1-586.pl
 c96e87d4f5311cd73bbdf499acc03418588be12426d878e157dd67e0099e0219  crypto/sha/asm/sha1-alpha.pl
 695ef6f8041f37f4b39cb7099e9c7c3a29d6f823823df7333530d375f5f5e01b  crypto/sha/asm/sha1-armv4-large.pl
 cb32284af92d99d7046b99dd5bbd894d53531f7b99d351235a939c542680193b  crypto/sha/asm/sha1-armv8.pl
 11d332b4e058e9fa418d6633316d2e9f9bf520a08b2d933e877bdf38b2edefcf  crypto/sha/asm/sha1-c64xplus.pl
 32ff0e701a7b8f25bcfe8477b20795de54f536527bd87d3ce694fd9aaae356d4  crypto/sha/asm/sha1-ia64.pl
-de6c7e8c1e27779a8cf1ce2a04f487a3d4dc510d5ba240cd06128ecc8574e424  crypto/sha/asm/sha1-mb-x86_64.pl
+9fdde42e62c5a5c0457316ac35e6f6f940061634ab1e44a1ef5cdbacb656d738  crypto/sha/asm/sha1-mb-x86_64.pl
 0f5c63cf09e950d1b488935ab3b5562e3e9d5cd1a563fb88a41e3dae90a35e6d  crypto/sha/asm/sha1-mips.pl
 b5ffd7b6dbb04c05de7efa2945adb67ea845e7e61a3bf163a532f7b6acdf4267  crypto/sha/asm/sha1-parisc.pl
 482cd23ca6ec38d6f62b90c68f9f20643579c50f2c0fbb0dab1c10a0e35efe77  crypto/sha/asm/sha1-ppc.pl
@@ -364,11 +364,11 @@ b5ffd7b6dbb04c05de7efa2945adb67ea845e7e61a3bf163a532f7b6acdf4267  crypto/sha/asm
 7fd355b412ddfa1c510e0ba3284f75b1c0d621b6db2ecb1d2a935d5cdb706628  crypto/sha/asm/sha1-sparcv9.pl
 24554e68b0e7b7db7b635ff149549015f623ca0bcd9ae90439586a2076f6ae80  crypto/sha/asm/sha1-sparcv9a.pl
 74d197cdd72400cabbff7e173f72c8976723081508b095dc995e8cd1abf3daa6  crypto/sha/asm/sha1-thumb.pl
-dc363497de4fa3bc88b16e834ddf4967aecabdba5ea3ddd6113cf00da7e278bd  crypto/sha/asm/sha1-x86_64.pl
-c099059ef107f548ea2c2bab64a4eb8c277070ce6d74c4d32bb9808dc19c5fa3  crypto/sha/asm/sha256-586.pl
+a579c0ab82151f8879bac23ef1ffb198dfbf9b02d2015c500a232baafc6a3722  crypto/sha/asm/sha1-x86_64.pl
+494390ee974a00a0bfdb0ee46116efa45379b5e63988c0a3be9ff6183be2359d  crypto/sha/asm/sha256-586.pl
 0f01f7b5b0699f1e8ca260439d009febfa5b85b9e7b0933d236467e383aaaa2e  crypto/sha/asm/sha256-armv4.pl
 93ddc97651ee3e779144a3c6b3e46a1bc4aa81e75cd7b9df068a2aef8743d25f  crypto/sha/asm/sha256-c64xplus.pl
-9a68b6642b20e3cdccd636c4a934a6e0114160506784583f684ad65aefac2872  crypto/sha/asm/sha256-mb-x86_64.pl
+478035fb599566f468f68ae9a3c5311b1e9c6257de6c47a7a32082c8aee41c8d  crypto/sha/asm/sha256-mb-x86_64.pl
 b14670492f24cd0d2fedf8780e981b7da123203395c085334d4571b619b0a610  crypto/sha/asm/sha256-riscv64-zvkb-zvknha_or_zvknhb.pl
 dd82e1311703abb019975fc7b61fb87d67e1ed916dddd065aced051e851114b9  crypto/sha/asm/sha512-586.pl
 16e68ac669860c5bf8e4db81cd3d64fc2c22168e129c2597e94b0f56fafcdfa8  crypto/sha/asm/sha512-armv4.pl
@@ -381,7 +381,7 @@ fb06844e7c3b014a58dccc8ec6020c71843cfdc5be08288bc7d204f0a840c474  crypto/sha/asm
 07804b96dda856cffaef291641c4ae7f59288ed1e65e38823cfdcb74f8ac5295  crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl
 38e0455fd6a2b93a7a5385379ca92bc6526585ca1eb4af365fac4c78f7285c72  crypto/sha/asm/sha512-s390x.pl
 0611845c52091b0208dd41f22ddef9dd1e68d3d92fa4c4360738b840a6314de6  crypto/sha/asm/sha512-sparcv9.pl
-473874a27b031e3d6c3dd0388c7231aa299e07c5832fa7499a081488e6f5680a  crypto/sha/asm/sha512-x86_64.pl
+14b563ed790d9bd76b0f45e27b75b5fa46d393d7bea8704d2894004adc3f4ac6  crypto/sha/asm/sha512-x86_64.pl
 8725cabb8d695c576619f19283b034074a3fa0f1c0be952a9dbe9793be15b907  crypto/sha/asm/sha512p8-ppc.pl
 93858e3b530333a129127b8df8cd3326cf55b770238b4fff2474c4e6e3def1dd  crypto/sha/keccak1600.c
 306cacd3f86e5cacaca74c58ef862516515e5c0cafaff48636d537fd84f1c2fb  crypto/sha/sha1dgst.c
@@ -391,19 +391,19 @@ a7e074a2f2cea0c33e7875eacc8adb465b5802e4c1d100cda79ac3dd52cdb453  crypto/sha/sha
 61ab6d7d7da9e65120ec59cfa9f5ede785502ae371696c3e4e04e039743ca111  crypto/sha/sha_local.h
 dfd99e02830973ab349409ac6ba0ee901ba7736216030965bd7e5a54356abd7c  crypto/slh_dsa/slh_adrs.c
 c9b270de1259d9fa71a4d352786357bcf1dd3d22075edab84501e2f8e550b271  crypto/slh_dsa/slh_adrs.h
-95d42ca839ff34a050a7006734a06c157ad259512c1a10b978e9f899efe69f12  crypto/slh_dsa/slh_dsa.c
-ab7b580b1cba302c5675918b457794a3b3d00aac42297312d9447bc6f6a40b09  crypto/slh_dsa/slh_dsa_hash_ctx.c
-892a5ed5213c0898882bfc42f72be2864b363cd62d08a3b337c20b4fa557bef0  crypto/slh_dsa/slh_dsa_key.c
+26566d0e641456101bd17338dbbb16f59dfacd34f76cff5882133a0ab7323130  crypto/slh_dsa/slh_dsa.c
+6b88a8ca514dd2ead7808bf08ea7c7e89125cdcfae8f0db4f3518069382fdfa0  crypto/slh_dsa/slh_dsa_hash_ctx.c
+924e686178fdc5984d1a09b02d91e04d4b9c4eb818ee384107ca64357c237e39  crypto/slh_dsa/slh_dsa_key.c
 4c7981f7db69025f52495c549fb3b3a76be62b9e13072c3f3b7f1dedeaf8cc91  crypto/slh_dsa/slh_dsa_key.h
-5dcb631891eb6afcd27a6b19d2de4d493c71dab159e53620d86d9b96642e97e8  crypto/slh_dsa/slh_dsa_local.h
-adb3f4dea52396935b8442df7b36ed99324d3f3e8ce3fdf714d6dfd683e1f9f0  crypto/slh_dsa/slh_fors.c
-5d3855cb2927efa4b28fec4357694bf863ac8dc6556009bdfa800ba16cb80b4d  crypto/slh_dsa/slh_hash.c
+f8007c0f93908810f138f872809cd49013e22192907f4c38d290b6c4566230f5  crypto/slh_dsa/slh_dsa_local.h
+6d3f3c0be706c1dd871db863f2344f709a2b7fbb60a0d91298aeb2222f767a87  crypto/slh_dsa/slh_fors.c
+f6f5286c6ce9f37cbb527144ec09fd86ae796ac3e71f0bdbb45b5a08a0692122  crypto/slh_dsa/slh_hash.c
 3af167addbfd97f831f2a1981133bf4e2b62b95dc9477767797f7e4a653556db  crypto/slh_dsa/slh_hash.h
-6402664fbb259808a6f7b5a5d6be2b4a3cc8a905399d97b160cdb3e4a97c02c4  crypto/slh_dsa/slh_hypertree.c
+1eebf59ebd0859be5a8deddd2f664f99158060904234532af608a44dd6d92d19  crypto/slh_dsa/slh_hypertree.c
 1ce9b4f4f90a6f82005c9cdc0ea1f6b6876556c76f8bfd95f4c003a1c195a266  crypto/slh_dsa/slh_params.c
 86b16a2c36d708cb880ba49648bb3051c2997188c8ea6aec9292534b97232c7f  crypto/slh_dsa/slh_params.h
-1aa9dc1c6fe59d024485df9a6b782ac4d0656a31b12faee749fe098911799eaf  crypto/slh_dsa/slh_wots.c
-59db81a3342c0c89b030756168b9a7f09c938b2cd3498335108e0a32c041b6e7  crypto/slh_dsa/slh_xmss.c
+668a2431034f8c604970ed531e32b7b20b6b710e258d1db0a8eb06a13d900f0e  crypto/slh_dsa/slh_wots.c
+37fff5f88dd8bcd0ad8cdbab130c5a9a018422fe59b141bdb11bcee8fd1b046f  crypto/slh_dsa/slh_xmss.c
 9ef5a01caccc2eb15f72e367d0424737040ac8018479bbbbce3d216c655765c2  crypto/sparccpuid.S
 b462d1efe0acd798e1ec5f37fd1c824a587e1773e6a6f984d5a332581573ecbc  crypto/sparcv9cap.c
 9e16e8641ac5ec2cb2fcc8e4796af5b698d6fa4ce85e374bd8f5b4edb51e6428  crypto/sparse_array.c
@@ -417,7 +417,7 @@ f06b08138d73b834471abc4a3ba43b2be838f7196c937c3e933694d6cd69f74d  crypto/thread/
 2e5955d706b96c487e4875ffbe208fac15bdca06b33cee916d5343978c14efa1  crypto/threads_lib.c
 b3743dfd1c13fe70dc57a5a0b2ec540ab3afa748699eb6ef36f56f4d36d06ef3  crypto/threads_none.c
 7b97b0f57f6b7cac89c1b8bd03bee34fb39d33cfae1632e75571ba106a5b9442  crypto/threads_pthread.c
-9dac146cda57fb53d9b9eb30ff1fc81090f5e62dbe05d4cd97ed11cf501fc78c  crypto/threads_win.c
+a4692ad34bd148e06344672e08a3ba928719ca5af4d11ba54d97926759dcda0b  crypto/threads_win.c
 93f8fe09f96492a6be6772ddbf0cc37912fc2a90acb7faea378da1735fe20f6f  crypto/time.c
 88c5f9f4d2611223d283ebd2ae10ae5ecbb9972d00f747d93fcb74b62641e3f9  crypto/x86_64cpuid.pl
 085d9fe93adf232f1ff838be9235046c2c2abe2daeb0e6342921d8f2e955dc18  crypto/x86cpuid.pl
@@ -468,7 +468,7 @@ b41a5d9a7bdf60df169e327b41f16489830b82393dd663d1f89f81da4483eaa7  include/intern
 9bafa62442fdeda25b97fdbe8e8bf8ea62a5b5167adb2ac7ebbb13db271673f9  include/internal/ffc.h
 0a82ff0abab6ab815f9cb523b9643854346b47ff276f8868d1cbe48efc1b20ee  include/internal/fips.h
 923d4fb14a08f9b251b9bf9727bc50930d0279e8b63243faf85374bdcbbfc4e0  include/internal/hashfunc.h
-a37a58d887ae4331a19179900b8d077afa1174c5152d53dc1533c37a65f319d6  include/internal/hashtable.h
+d76c942d91e97f8954852ec7ae5a790a591b44762bba31930af585ed5f861fe0  include/internal/hashtable.h
 f6f30785e3eced1ccdd4b149286ff2b8bbb860eb7e070cbe54c997aa022854da  include/internal/namemap.h
 c367e6120d26a2b629f4db7e179973e33fb095e1102d5c7a69c744b88ebe4469  include/internal/nelem.h
 eef3ec603b9877bd24a8fa1dbcd7752618fa74943b045515720bb0ca61394ae5  include/internal/numbers.h
@@ -568,7 +568,7 @@ a481e8762c694b3dac0e74aac8626fe60fa94962a14914f1f6969ea1214c40b1  include/openss
 9e04a3e9ca5352adffbdd75a5ea5237e8ff96a8c0a842368cc3a29de006b2ee7  include/openssl/types.h
 62e0cddeedfc217ac02bf37f3669ccea8d0822a88a74a8ec82b844a85b2700aa  include/openssl/x509.h.in
 869959c3d557d2ace84f38b7a8d0f23b3b0854de7f952f46310e828af04554dd  include/openssl/x509_vfy.h.in
-5dbee881fe4e1f08a773e8bd34eeda7639be7c474a3d4d6e7c8d779e19c7eb2a  include/openssl/x509err.h
+53a45ca5d00026ef0a256f7ff27f5708d5af0a44177a0fc4b209ec054d44e18c  include/openssl/x509err.h
 c0a9551efccf43f3dd748d4fd8ec897ddaabbc629c00ec1ad76ce983e1195a13  providers/common/bio_prov.c
 6d25e1b61731cc558c2f801350d0cd874d3c19a3b0a03f52394c11fcaf2d51a5  providers/common/capabilities.c
 f94b7435d4ec888ec30df1c611afa8b9eedbb59e905a2c7cb17cfc8c4b9b85b8  providers/common/der/der_digests_gen.c.in
@@ -611,7 +611,7 @@ b10730f4d302344579c09f43d5f9c5538bb6b4acd60de7430c24269fc522d5a5  providers/comm
 e2f8f00519d81aa16f1c30e8cbf9a0d8e898a1cb5c8b38bb01dd9ab513e34c9e  providers/common/securitycheck_fips.c
 abd5997bc33b681a4ab275978b92aebca0806a4a3f0c2f41dacf11b3b6f4e101  providers/fips/fips_entry.c
 d8cb05784ae8533a7d9569d4fbaaea4175b63a7c9f4fb0f254215224069dea6b  providers/fips/fipsindicator.c
-0c473190a4b6809caed57997e44ee9ec949bcf01c542633e2881d07c809d3a51  providers/fips/fipsprov.c
+f0f1486219ddb5817b5105c36f384cb9ef095ddceec50966fe178f4b4177028c  providers/fips/fipsprov.c
 8f52eead96febbce9e7f2bf5aaea557efe8f94ce078044959e80e5ae78432539  providers/fips/include/fips/fipsindicator.h
 ef204adc49776214dbb299265bc4f2c40b48848cbea4c25b8029f2b46a5c9797  providers/fips/include/fips_indicator_params.inc
 f2581d7b4e105f2bb6d30908f3c2d9959313be08cec6dbeb49030c125a7676d3  providers/fips/include/fips_selftest_params.inc
@@ -639,7 +639,7 @@ be18c20e0197f25fe7b9e0268657a2271a69d216b89cb100f082fa5fcaad1e07  providers/impl
 60c4f604cf9b5457be48f31cc24ca21729660381081b2dbf99f362a013a09684  providers/implementations/ciphers/cipher_aes_gcm_hw_vaes_avx512.inc
 e2886780637db72b12c9bc488d81647ed55a7f5c850efd4bdbf88ef7127e1913  providers/implementations/ciphers/cipher_aes_hw.c
 89de794c090192459d99d95bc4a422e7782e62192cd0fdb3bdef4128cfedee68  providers/implementations/ciphers/cipher_aes_hw_aesni.inc
-eac58fff6aa9918d657228c2707f1b3f0ef8f1210c97575f3c264db78bfd996f  providers/implementations/ciphers/cipher_aes_ocb.c
+b88e88831695dfc165ce83e64802ffb8240f1f696d9c67f350b9ff1b2e913212  providers/implementations/ciphers/cipher_aes_ocb.c
 88138a1aff9705e608c0557653be92eb4de65b152555a2b79ec8b2a8fae73e8f  providers/implementations/ciphers/cipher_aes_ocb.h
 6c3a89771719b36d6917d23464be5441836378393731af96ba165fd788df1a41  providers/implementations/ciphers/cipher_aes_ocb_hw.c
 c7aac28a9dca1ad46e5bce4de93e07dffec1f89fab82394c3ff7cf1bda8b483f  providers/implementations/ciphers/cipher_aes_wrp.c
@@ -655,7 +655,7 @@ dc4626becaabc3990549483d9ef5f05c7dd9a9c2cf9be96ade3ba6a6e203f7f5  providers/impl
 cca34f1c7baf3a98964f7ce19a59e06d1eaf2ada121a0d4a438f4078a072b325  providers/implementations/ciphers/cipher_tdes_hw.c
 d2f418806c7ed45f118683bc13329573804592684e522efced0fd0921f4548fd  providers/implementations/ciphers/ciphercommon.c
 ab9a2edb23aa61cf31da6addd8674a6028f93399eceeeee35a56ee770338fd6c  providers/implementations/ciphers/ciphercommon_block.c
-6b6090c233ddf29d819f2559361aeeae03505de7626a127628d5f0f6d3bce295  providers/implementations/ciphers/ciphercommon_ccm.c
+fafb07c3fd77a89cff1d2efbb6edc0767132fc30c57f9e282080da04e6762499  providers/implementations/ciphers/ciphercommon_ccm.c
 6632a555d5bcd5af67d0355ce46c2906bb3a0dcdf1651595b29189c40a5ca675  providers/implementations/ciphers/ciphercommon_ccm_hw.c
 ab51261da6aea5a3cca74a7561e4b89e6ce83f2ac497a5c766ecd3c3bff95152  providers/implementations/ciphers/ciphercommon_gcm.c
 bb67eaa7a98494ca938726f9218213870fc97dd87b56bda950626cc794baf20b  providers/implementations/ciphers/ciphercommon_gcm_hw.c
@@ -692,39 +692,39 @@ abe2b0f3711eaa34846e155cffc9242e4051c45de896f747afd5ac9d87f637dc  providers/impl
 a9a5a3ba575b1a372f5a09135667ac1b0e303f8b19b0707804390aba9e266eca  providers/implementations/kdfs/sskdf.c
 f01cbd7c5351d4aa9ae667627503b2cfef6fc0695e7a42296b7bf015c9a418b3  providers/implementations/kdfs/tls1_prf.c
 39207243a84beb670cb0e64b6d0fe7bfc6a3dd84000617b647a3ecf52a1da3c2  providers/implementations/kdfs/x942kdf.c
-748af266d06006da10524f3a621c65b8c3eeddf8b1ccd06ecdc6b689564d220c  providers/implementations/kem/ml_kem_kem.c
-35549cec7031452bb5b46aa8a86028abc7a3a2b39f9f6564fa4bd402451bc647  providers/implementations/kem/mlx_kem.c
-e89b894af920504160abfc11860b89b505d116d978162a02213f72500180903b  providers/implementations/kem/rsa_kem.c
-aa13d72bc69a374db72b6d44e2f2c2ddd5f7bddbe16b950e3c4666d876c63735  providers/implementations/keymgmt/dh_kmgmt.c
+b1431361b8a3448b73f4a46c48b3a4f9fd378c2abba67563f4407b1c7f007fca  providers/implementations/kem/ml_kem_kem.c
+926e08e60171cc867220e0f106533ed155132a034690bddea1e7793a879ebf73  providers/implementations/kem/mlx_kem.c
+ff22e920552b82db3dab51b09f9dd2fd038ef0d57fb76cea5578e703653d28c9  providers/implementations/kem/rsa_kem.c
+6599ad60eef3554741e049c3ff1bd9cc6064d4f3d1835e1ea5dec3a0c14c80bb  providers/implementations/keymgmt/dh_kmgmt.c
 c0446d1b2101ddd977063516b87d23f424cdca33473f293db4c3974b674169b0  providers/implementations/keymgmt/dsa_kmgmt.c
-2b98ba2124a86eae2adc7b88bfa26e47b548e9628b99180cc2cd841eed5ed8da  providers/implementations/keymgmt/ec_kmgmt.c
+45480796e6ea50cbe9529c17f9fa04228a9126dc7e7e32971519eeb6d6ac267c  providers/implementations/keymgmt/ec_kmgmt.c
 258ae17bb2dd87ed1511a8eb3fe99eed9b77f5c2f757215ff6b3d0e8791fc251  providers/implementations/keymgmt/ec_kmgmt_imexport.inc
-167cd7df056bf46f3481cf6101fb6cfca55dea592f896c2b29649df1939885c4  providers/implementations/keymgmt/ecx_kmgmt.c
+c559f1f265388e7b1c8195188fcc71ac8af09b3398530ec8ed7a9afd7b41281e  providers/implementations/keymgmt/ecx_kmgmt.c
 daf35a7ab961ef70aefca981d80407935904c5da39dca6692432d6e6bc98759d  providers/implementations/keymgmt/kdf_legacy_kmgmt.c
 69b509e9c7fe9692622d1059917c3adb991c0047e11bc116f0a393a3a0539445  providers/implementations/keymgmt/mac_legacy_kmgmt.c
-3c63e65bd1a6a2e853828205c015a50c38a82f2fee9bf6787dce6dab7331bb91  providers/implementations/keymgmt/ml_dsa_kmgmt.c
-5c95eb8192483b2d81435e52aef6b2c96180bb22a67f717c29661a13b5861b02  providers/implementations/keymgmt/ml_kem_kmgmt.c
-f37c8b7bb59d4b199889044992cb1b18ad39f2eafc87029f5348c55a95195e8c  providers/implementations/keymgmt/mlx_kmgmt.c
+7d197679dc4ae59f0e697749c56cb76399fc5eed88e94585dfd5ebdb23466e53  providers/implementations/keymgmt/ml_dsa_kmgmt.c
+2df9ca1a68a9b6e1d1b108148b54ccf5454da3afa34e510beb2f4516e473e4c6  providers/implementations/keymgmt/ml_kem_kmgmt.c
+4cec24edda3df01c08bef98a0a177ccdd1f8ba84e37c399dc568e010d7c0b29f  providers/implementations/keymgmt/mlx_kmgmt.c
 cd4b8129eaccbd77f9b6c725d3cb57b71109c4649115ec786b6495100afaddf2  providers/implementations/keymgmt/rsa_kmgmt.c
-d640cff1c46911b69866eb83f48beba42a1741bb1d3f1db6e7201077a57761fc  providers/implementations/keymgmt/slh_dsa_kmgmt.c
-9d02d481b9c7c0c9e0932267d1a3e1fef00830aaa03093f000b88aa042972b9f  providers/implementations/macs/cmac_prov.c
+92621573e975489b821884151d2de751e462fcf91efa83cb3bf8f4fd40cd241b  providers/implementations/keymgmt/slh_dsa_kmgmt.c
+2a66bc54579cb1fcd72674a1e60a7a1f798c13ab964a45e5603bed699268354f  providers/implementations/macs/cmac_prov.c
 a3bb4d7914f45cf82f86cd92135e20a712274ca153d9ed5ad24db7f33710726c  providers/implementations/macs/gmac_prov.c
 2d6b8c42c67e3e43d8d0035463cbff590dabb7da815f9e437a3a72d4b6596319  providers/implementations/macs/hmac_prov.c
 40686337be4261685f176bb10042d903d46ab10c90e10ac42d3842e9b5ddd960  providers/implementations/macs/kmac_prov.c
 0ebc5a48655a697231918644397308e64914c32421e9b8ee7afd7779b6a2fdb8  providers/implementations/rands/drbg.c
-d9e41abc1780bb253bdca6c58cc32af7d0a774e52c91fc5d64577f71defc52c2  providers/implementations/rands/drbg_ctr.c
-cf98646defb0b385d6ce4bedcd51559c9a03424491f4576ea7eb41e3db8a18b3  providers/implementations/rands/drbg_hash.c
-57561d4bd3a79e6a250310a989958409437dfa68b2818d5f0dbb8a5e7ef04bb7  providers/implementations/rands/drbg_hmac.c
+d2805527aa28c27dc0d10f3e35b64e18626691b3c864806dd644b7dd1640ec49  providers/implementations/rands/drbg_ctr.c
+e624059b1c9f878655d6a21a4c295c43d147ea913f638a2d007a1a68379180f8  providers/implementations/rands/drbg_hash.c
+3aa1dd31f0db1ab0a7a5a3037f722e284587c244126810268622fae65bef77d7  providers/implementations/rands/drbg_hmac.c
 841617c81d6d5eae5ea59064e8b45947d436d3e53b49283329d17016866d8f34  providers/implementations/rands/drbg_local.h
 355bd437dde9ecd1da89f42691147f2b5cf9a012ff5f55062bf83b6bead1e181  providers/implementations/rands/fips_crng_test.c
-4913fec58a2648fcec0e5a94dba9decab0505a6d725bed6eb861ce854db81df8  providers/implementations/rands/test_rng.c
+90ea602ec88f7c0a78f3e7c801cdd3574a221f04497121a9ea7dcb05b7ee6765  providers/implementations/rands/test_rng.c
 c6c709dfd8b1be036e2a5232d3b21dc25f0150f2aae24cc7db6b09cd790a04ee  providers/implementations/signature/dsa_sig.c
 d10d611713a6d9aa5cdbe636f1ba90404043431fd1df01fc1a1ce8499bf96ad0  providers/implementations/signature/ecdsa_sig.c
 a837f69cb1aa5d0327372e26a63a8492b6ffb1156325f66e880c202011d07cbe  providers/implementations/signature/eddsa_sig.c
 e0e67e402ff19b0d2eb5228d7ebd70b9477c12595ac34d6f201373d7c8a516f4  providers/implementations/signature/mac_legacy_sig.c
 51251a1ca4c0b6faea059de5d5268167fe47565163317177d09db39978134f78  providers/implementations/signature/ml_dsa_sig.c
-94725f9e466c60c710900ca9878196f359e8421f46d5fb62fda91f5f845caff3  providers/implementations/signature/rsa_sig.c
-539d3f55b8fd28826c786cb4e5c0e735173dc0faf268527ea007052be623cd37  providers/implementations/signature/slh_dsa_sig.c
+6b293ca81102cd2f234d60f52f839e5bd7a746a42df3fe8a4489e6c214108f50  providers/implementations/signature/rsa_sig.c
+ec630d49078bdd901132e7651eaf3478ff3b04e5558c435ffd7c77dcb62e46b3  providers/implementations/signature/slh_dsa_sig.c
 21f537f9083f0341d9d1b0ace090a8d8f0b2b9e9cf76771c359b6ea00667a469  providers/implementations/skeymgmt/aes_skmgmt.c
 2dbf9b8e738fad556c3248fb554ff4cc269ade3c86fa3d2786ba9b6d6016bf22  providers/implementations/skeymgmt/generic.c
 9ba8db9b0e18847ef79ecb77fbc383d8762694be29dfb7d269df6f02dc977222  providers/implementations/skeymgmt/skeymgmt_lcl.h
diff --git a/deps/openssl/openssl/providers/fips.checksum b/deps/openssl/openssl/providers/fips.checksum
index 7d8252550bd4..f236b8ff81a4 100644
--- a/deps/openssl/openssl/providers/fips.checksum
+++ b/deps/openssl/openssl/providers/fips.checksum
@@ -1 +1 @@
-f24213807982cf5d2859d5d1b78caa54c249ec28725645d1af28f092d543962d  providers/fips-sources.checksums
+ee77588030ee4df89ad9ff70a12118a9b89ebc4fde306fd25e9c01ef719d0b26  providers/fips-sources.checksums
diff --git a/deps/openssl/openssl/providers/fips/fipsprov.c b/deps/openssl/openssl/providers/fips/fipsprov.c
index 419878719e98..3c749018bcfc 100644
--- a/deps/openssl/openssl/providers/fips/fipsprov.c
+++ b/deps/openssl/openssl/providers/fips/fipsprov.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -56,7 +56,6 @@ extern OSSL_FUNC_core_thread_start_fn *c_thread_start;
  */
 
 /* Functions provided by the core */
-static OSSL_FUNC_core_gettable_params_fn *c_gettable_params;
 static OSSL_FUNC_core_get_params_fn *c_get_params;
 OSSL_FUNC_core_thread_start_fn *c_thread_start;
 static OSSL_FUNC_core_new_error_fn *c_new_error;
@@ -541,7 +540,7 @@ static const OSSL_ALGORITHM fips_asym_kem[] = {
     { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_asym_kem_functions },
 #if !defined(OPENSSL_NO_ECX)
     { "X25519MLKEM768", FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
-    { "X448MLKEM1024", FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
+    { "X448MLKEM1024", FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
 #endif
 #if !defined(OPENSSL_NO_EC)
     { "SecP256r1MLKEM768", FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
@@ -608,7 +607,7 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
 #if !defined(OPENSSL_NO_ECX)
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions,
         PROV_DESCS_X25519MLKEM768 },
-    { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
+    { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
         PROV_DESCS_X448MLKEM1024 },
 #endif
 #if !defined(OPENSSL_NO_EC)
@@ -771,9 +770,6 @@ int OSSL_provider_init_int(const OSSL_CORE_HANDLE *handle,
         case OSSL_FUNC_CORE_GET_LIBCTX:
             set_func(c_get_libctx, OSSL_FUNC_core_get_libctx(in));
             break;
-        case OSSL_FUNC_CORE_GETTABLE_PARAMS:
-            set_func(c_gettable_params, OSSL_FUNC_core_gettable_params(in));
-            break;
         case OSSL_FUNC_CORE_GET_PARAMS:
             set_func(c_get_params, OSSL_FUNC_core_get_params(in));
             break;
diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
index bf3275f97b38..c1079e0e7874 100644
--- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
+++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
@@ -267,11 +267,17 @@ static int aes_gcm_siv_finish(PROV_AES_GCM_SIV_CTX *ctx)
 {
     int ret = 0;
 
-    if (ctx->enc)
+    if (ctx->enc) {
+        /* Generate the tag when Final is the first empty-message operation. */
+        if (ctx->generated_tag == 0
+            && aes_gcm_siv_encrypt(ctx, NULL, NULL, 0) == 0)
+            return 0;
         return ctx->generated_tag;
-    if (!ctx->generated_tag)
-        aes_gcm_siv_decrypt(ctx, NULL, NULL, 0);
-    ret = !CRYPTO_memcmp(ctx->tag, ctx->user_tag, sizeof(ctx->tag));
+    }
+    if (ctx->generated_tag == 0
+        && aes_gcm_siv_decrypt(ctx, NULL, NULL, 0) == 0)
+        return 0;
+    ret = CRYPTO_memcmp(ctx->tag, ctx->user_tag, sizeof(ctx->tag)) == 0;
     ret &= ctx->have_user_tag;
     return ret;
 }
diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
index 99254cb49a88..62e5a0c1a766 100644
--- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
+++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
@@ -509,6 +509,10 @@ static int aes_ocb_cipher(void *vctx, unsigned char *out, size_t *outl,
     if (!ossl_prov_is_running())
         return 0;
 
+    /* NULL input indicates Final, which must generate or check the tag. */
+    if (in == NULL)
+        return aes_ocb_block_final(vctx, out, outl, outsize);
+
     if (outsize < inl) {
         ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
         return 0;
diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c
index 977f7000c289..673e18702cf7 100644
--- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c
+++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -30,11 +30,11 @@ static OSSL_FUNC_cipher_get_params_fn chacha20_poly1305_get_params;
 static OSSL_FUNC_cipher_get_ctx_params_fn chacha20_poly1305_get_ctx_params;
 static OSSL_FUNC_cipher_set_ctx_params_fn chacha20_poly1305_set_ctx_params;
 static OSSL_FUNC_cipher_cipher_fn chacha20_poly1305_cipher;
+static OSSL_FUNC_cipher_update_fn chacha20_poly1305_update;
 static OSSL_FUNC_cipher_final_fn chacha20_poly1305_final;
 static OSSL_FUNC_cipher_gettable_ctx_params_fn chacha20_poly1305_gettable_ctx_params;
 static OSSL_FUNC_cipher_settable_ctx_params_fn chacha20_poly1305_settable_ctx_params;
 #define chacha20_poly1305_gettable_params ossl_cipher_generic_gettable_params
-#define chacha20_poly1305_update chacha20_poly1305_cipher
 
 static void *chacha20_poly1305_newctx(void *provctx)
 {
@@ -301,11 +301,6 @@ static int chacha20_poly1305_cipher(void *vctx, unsigned char *out,
     if (!ossl_prov_is_running())
         return 0;
 
-    if (inl == 0) {
-        *outl = 0;
-        return 1;
-    }
-
     if (outsize < inl) {
         ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
         return 0;
@@ -317,6 +312,24 @@ static int chacha20_poly1305_cipher(void *vctx, unsigned char *out,
     return 1;
 }
 
+static int chacha20_poly1305_update(void *vctx, unsigned char *out,
+    size_t *outl, size_t outsize,
+    const unsigned char *in, size_t inl)
+{
+    /*
+     * A zero-length update is a no-op. Only EVP_Cipher() and Final produce or
+     * check the authentication tag.
+     */
+    if (inl == 0) {
+        if (!ossl_prov_is_running())
+            return 0;
+        *outl = 0;
+        return 1;
+    }
+
+    return chacha20_poly1305_cipher(vctx, out, outl, outsize, in, inl);
+}
+
 static int chacha20_poly1305_final(void *vctx, unsigned char *out, size_t *outl,
     size_t outsize)
 {
diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c
index 733547a7e732..1bd0d6a5fc81 100644
--- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c
+++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -301,6 +301,8 @@ static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx,
 
     if (in != NULL) { /* aad or text */
         if (out == NULL) { /* aad */
+            if (ctx->len.text != 0)
+                goto err;
             Poly1305_Update(poly, in, inl);
             ctx->len.aad += inl;
             ctx->aad = 1;
diff --git a/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c b/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c
index 2b5bddddeb78..7a70b1b09995 100644
--- a/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c
+++ b/deps/openssl/openssl/providers/implementations/ciphers/ciphercommon_ccm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -288,13 +288,19 @@ int ossl_ccm_stream_final(void *vctx, unsigned char *out, size_t *outl,
     size_t outsize)
 {
     PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
-    int i;
+    unsigned char dummy_in = 0, dummy_out = 0;
 
     if (!ossl_prov_is_running())
         return 0;
 
-    i = ccm_cipher_internal(ctx, out, outl, NULL, 0);
-    if (i <= 0)
+    /*
+     * Encryption sets tag_set after processing the payload, while successful
+     * decryption clears iv_set. Use those transitions to avoid processing an
+     * operation twice.
+     */
+    if (!ctx->key_set
+        || (ctx->iv_set && (!ctx->enc || !ctx->tag_set)
+            && ccm_cipher_internal(ctx, &dummy_out, outl, &dummy_in, 0) <= 0))
         return 0;
 
     *outl = 0;
@@ -309,6 +315,9 @@ int ossl_ccm_cipher(void *vctx, unsigned char *out, size_t *outl, size_t outsize
     if (!ossl_prov_is_running())
         return 0;
 
+    if (in == NULL)
+        return ossl_ccm_stream_final(vctx, out, outl, outsize);
+
     if (outsize < inl) {
         ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
         return 0;
diff --git a/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c b/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c
index 362a806589e6..2c9bff42bbba 100644
--- a/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c
+++ b/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2ms.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -65,10 +65,11 @@ static int write_pvk(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
     return ret;
 }
 
+static OSSL_FUNC_encoder_newctx_fn key2ms_newctx;
 static OSSL_FUNC_encoder_freectx_fn key2ms_freectx;
 static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection;
 
-static struct key2ms_ctx_st *key2ms_newctx(void *provctx)
+static void *key2ms_newctx(void *provctx)
 {
     struct key2ms_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
 
diff --git a/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c b/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c
index 722eadf22897..14c670784c54 100644
--- a/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c
+++ b/deps/openssl/openssl/providers/implementations/kem/ml_kem_kem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -125,6 +125,7 @@ static int ml_kem_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 
         /* Possibly, but much less likely wrong type */
         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH);
+        OPENSSL_cleanse((void *)ctx->entropy_buf, sizeof(ctx->entropy_buf));
         ctx->entropy = NULL;
         return 0;
     }
diff --git a/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c b/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c
index 376b3342ddfa..a917fa93d5ca 100644
--- a/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c
+++ b/deps/openssl/openssl/providers/implementations/kem/mlx_kem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -118,7 +118,7 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen,
 
     if (!mlx_kem_have_pubkey(key)) {
         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
-        goto end;
+        return 0;
     }
     encap_clen = key->minfo->ctext_bytes + key->xinfo->pubkey_bytes;
     encap_slen = ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes;
@@ -236,6 +236,10 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen,
 
     ret = 1;
 end:
+    /* Erase any partial shared secret on failure */
+    if (ret == 0)
+        OPENSSL_cleanse(shsec,
+            ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes);
     EVP_PKEY_free(xkey);
     EVP_PKEY_CTX_free(ctx);
     return ret;
@@ -324,6 +328,10 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
 
     ret = 1;
 end:
+    /* Erase any partial shared secret on failure */
+    if (ret == 0)
+        OPENSSL_cleanse(shsec,
+            ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes);
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(xkey);
     return ret;
diff --git a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c
index 78925809d985..47f0c80c9443 100644
--- a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c
+++ b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c
@@ -131,6 +131,7 @@ static int rsakem_init(void *vprsactx, void *vrsa,
     const char *desc)
 {
     PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
+    const BIGNUM *e = NULL;
     int protect = 0;
 
     if (!ossl_prov_is_running())
@@ -146,6 +147,18 @@ static int rsakem_init(void *vprsactx, void *vrsa,
     RSA_free(prsactx->rsa);
     prsactx->rsa = vrsa;
 
+    /*
+     * Reject the trivial public exponent e <= 1. The FIPS module enforces the
+     * full SP 800-56B §6.4.1.1 constraints via ossl_fips_ind_rsa_key_check()
+     * below; non-FIPS callers wanting the complete §6.4.2 vetting can use
+     * EVP_PKEY_public_check().
+     */
+    RSA_get0_key(prsactx->rsa, NULL, &e, NULL);
+    if (e == NULL || BN_cmp(e, BN_value_one()) <= 0) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
+        return 0;
+    }
+
     OSSL_FIPS_IND_SET_APPROVED(prsactx)
     if (!rsakem_set_ctx_params(prsactx, params))
         return 0;
@@ -389,6 +402,44 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx,
         return 0;
     }
 
+#ifndef FIPS_MODULE
+    /*
+     * Reject clearly degenerate ciphertexts, c in {0, 1, n-1}.
+     *
+     * SP 800-56B Rev 2, 7.1.2.1 requires RSADP to enforce 1 < c < n-1.  In a
+     * FIPS build that bound is applied by the RSADP primitive itself (see
+     * crypto/rsa/rsa_ossl.c, guarded by FIPS_MODULE), where it is also needed
+     * for KTS-OAEP; the primitive does not apply it in a non-FIPS build, so
+     * enforce it here for RSASVE.  Raise the same errors as the primitive so
+     * the behaviour matches in both builds; keep the two sites in step.
+     */
+    {
+        const BIGNUM *n = RSA_get0_n(prsactx->rsa);
+        BIGNUM *c = BN_new();
+        BIGNUM *nminus1 = BN_new();
+        int reason = 0;
+
+        if (n == NULL || c == NULL || nminus1 == NULL
+            || BN_bin2bn(in, (int)inlen, c) == NULL
+            || BN_copy(nminus1, n) == NULL
+            || !BN_sub_word(nminus1, 1)) {
+            BN_free(c);
+            BN_free(nminus1);
+            return 0;
+        }
+        if (BN_ucmp(c, BN_value_one()) <= 0)
+            reason = RSA_R_DATA_TOO_SMALL;
+        else if (BN_ucmp(c, nminus1) >= 0)
+            reason = RSA_R_DATA_TOO_LARGE_FOR_MODULUS;
+        BN_free(c);
+        BN_free(nminus1);
+        if (reason != 0) {
+            ERR_raise(ERR_LIB_RSA, reason);
+            return 0;
+        }
+    }
+#endif
+
     /* Step (3): out = RSADP((n,d), in) */
     ret = RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING);
     if (ret > 0 && outlen != NULL)
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c
index 8a1afe7907b1..eac99a4fed07 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/dh_kmgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -793,10 +793,8 @@ static void *dh_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
 #ifdef FIPS_MODULE
         if (!ossl_fips_self_testing()) {
             ret = ossl_dh_check_pairwise(dh, 0);
-            if (ret <= 0) {
-                ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
+            if (ret <= 0)
                 goto end;
-            }
         }
 #endif /* FIPS_MODULE */
     }
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c
index 305dc3a6b831..1d740307f6a4 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -847,8 +847,8 @@ static const OSSL_PARAM sm2_known_gettable_params[] = {
     OSSL_PARAM_int(OSSL_PKEY_PARAM_EC_DECODED_FROM_EXPLICIT_PARAMS, NULL),
     EC_IMEXPORTABLE_DOM_PARAMETERS,
     EC_IMEXPORTABLE_PUBLIC_KEY,
-    OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_PUB_X, NULL, 0),
-    OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_EC_PUB_Y, NULL, 0),
+    OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_PUB_X, NULL, 0),
+    OSSL_PARAM_BN(OSSL_PKEY_PARAM_EC_PUB_Y, NULL, 0),
     EC_IMEXPORTABLE_PRIVATE_KEY,
     OSSL_PARAM_END
 };
@@ -1298,20 +1298,6 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
 
     if (gctx->group_check != NULL)
         ret = ret && ossl_ec_set_check_group_type_from_name(ec, gctx->group_check);
-#ifdef FIPS_MODULE
-    if (ret > 0
-        && !ossl_fips_self_testing()
-        && EC_KEY_get0_public_key(ec) != NULL
-        && EC_KEY_get0_private_key(ec) != NULL
-        && EC_KEY_get0_group(ec) != NULL) {
-        BN_CTX *bnctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(ec));
-
-        ret = bnctx != NULL && ossl_ec_key_pairwise_check(ec, bnctx);
-        BN_CTX_free(bnctx);
-        if (ret <= 0)
-            ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
-    }
-#endif /* FIPS_MODULE */
 
     if (ret)
         return ec;
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c
index 54af7a6a3956..42a0b9d7aa67 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c
@@ -811,7 +811,6 @@ static void *ed25519_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
     if (!key || ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0))
         return key;
     if (ecd_fips140_pairwise_test(key, ECX_KEY_TYPE_ED25519, 1) != 1) {
-        ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
         ossl_ecx_key_free(key);
         return NULL;
     }
@@ -844,7 +843,6 @@ static void *ed448_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
     if (!key || ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0))
         return key;
     if (ecd_fips140_pairwise_test(key, ECX_KEY_TYPE_ED448, 1) != 1) {
-        ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
         ossl_ecx_key_free(key);
         return NULL;
     }
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c
index 5ebeaae662bf..70e943ff5a03 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -96,6 +96,7 @@ static int ml_dsa_pairwise_test(const ML_DSA_KEY *key)
 err:
     OSSL_SELF_TEST_onend(st, ret);
     OSSL_SELF_TEST_free(st);
+    OPENSSL_cleanse(sig, sizeof(sig));
     return ret;
 }
 #endif
@@ -283,10 +284,8 @@ static int ml_dsa_import(void *keydata, int selection, const OSSL_PARAM params[]
 #ifdef FIPS_MODULE
     if (res > 0) {
         res = ml_dsa_pairwise_test(key);
-        if (!res) {
+        if (!res)
             ossl_ml_dsa_key_reset(key);
-            ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT_IMPORT);
-        }
     }
 #endif /* FIPS_MODULE */
     return res;
@@ -483,10 +482,8 @@ static void *ml_dsa_gen(void *genctx, int evp_type)
         goto err;
     }
 #ifdef FIPS_MODULE
-    if (!ml_dsa_pairwise_test(key)) {
-        ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
+    if (!ml_dsa_pairwise_test(key))
         goto err;
-    }
 #endif
     return key;
 err:
@@ -541,7 +538,7 @@ static void ml_dsa_gen_cleanup(void *genctx)
     if (gctx == NULL)
         return;
 
-    OPENSSL_cleanse(gctx->entropy, gctx->entropy_len);
+    OPENSSL_cleanse(gctx->entropy, sizeof(gctx->entropy));
     OPENSSL_free(gctx->propq);
     OPENSSL_free(gctx);
 }
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c
index d95f021eef70..1422a3775c74 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c
@@ -109,10 +109,6 @@ static int ml_kem_pairwise_test(const ML_KEM_KEY *key, int key_flags)
 
     memset(out, 0, sizeof(out));
 
-    /*
-     * The pairwise test is skipped unless either RANDOM or FIXED entropy PCTs
-     * are enabled.
-     */
     if (key_flags & ML_KEM_KEY_RANDOM_PCT) {
         operation_result = ossl_ml_kem_encap_rand(ctext, v->ctext_bytes,
             secret, sizeof(secret), key);
@@ -147,7 +143,10 @@ static int ml_kem_pairwise_test(const ML_KEM_KEY *key, int key_flags)
             v->algorithm_name);
     }
 #endif
-    OPENSSL_free(ctext);
+    OPENSSL_cleanse((void *)entropy, sizeof(entropy));
+    OPENSSL_cleanse((void *)secret, sizeof(secret));
+    OPENSSL_cleanse((void *)out, sizeof(out));
+    OPENSSL_clear_free(ctext, v->ctext_bytes);
     return ret;
 }
 
@@ -237,7 +236,7 @@ static int ml_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb,
 {
     ML_KEM_KEY *key = vkey;
     OSSL_PARAM_BLD *tmpl = NULL;
-    OSSL_PARAM *params = NULL;
+    OSSL_PARAM *params = NULL, *p;
     const ML_KEM_VINFO *v;
     uint8_t *pubenc = NULL, *prvenc = NULL, *seedenc = NULL;
     size_t prvlen = 0, seedlen = 0;
@@ -316,13 +315,19 @@ static int ml_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb,
         goto err;
 
     ret = param_cb(params, cbarg);
+    /*
+     * OSSL_PARAM_free() only wipes the secure-heap data block,
+     * so wipe the key material copies held in the params first.
+     */
+    for (p = params; p->key != NULL; p++)
+        OPENSSL_cleanse(p->data, p->data_size);
     OSSL_PARAM_free(params);
 
 err:
     OSSL_PARAM_BLD_free(tmpl);
     OPENSSL_secure_clear_free(seedenc, seedlen);
     OPENSSL_secure_clear_free(prvenc, prvlen);
-    OPENSSL_free(pubenc);
+    OPENSSL_clear_free(pubenc, v->pubkey_bytes);
     return ret;
 }
 
@@ -477,9 +482,6 @@ static int ml_kem_import(void *vkey, int selection, const OSSL_PARAM params[])
     res = ml_kem_key_fromdata(key, params, include_private);
     if (res > 0 && include_private
         && !ml_kem_pairwise_test(key, key->prov_flags)) {
-#ifdef FIPS_MODULE
-        ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT_IMPORT);
-#endif
         ossl_ml_kem_key_reset(key);
         res = 0;
     }
@@ -542,12 +544,15 @@ static void *ml_kem_load(const void *reference, size_t reference_sz)
             if (!ml_kem_pairwise_test(key, key->prov_flags))
                 goto err;
         }
-        OPENSSL_free(encoded_dk);
+        OPENSSL_clear_free(encoded_dk, key->vinfo->prvkey_bytes);
+        OPENSSL_cleanse((void *)seed, sizeof(seed));
         return key;
     }
 
 err:
-    OPENSSL_free(encoded_dk);
+    if (key != NULL && key->vinfo != NULL)
+        OPENSSL_clear_free(encoded_dk, key->vinfo->prvkey_bytes);
+    OPENSSL_cleanse((void *)seed, sizeof(seed));
     ossl_ml_kem_key_free(key);
     return NULL;
 }
@@ -708,6 +713,7 @@ static int ml_kem_gen_set_params(void *vgctx, const OSSL_PARAM params[])
 
         /* Possibly, but less likely wrong data type */
         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH);
+        OPENSSL_cleanse((void *)gctx->seedbuf, sizeof(gctx->seedbuf));
         gctx->seed = NULL;
         return 0;
     }
@@ -768,8 +774,10 @@ static void *ml_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
     if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
         return key;
 
-    if (seed != NULL && !ossl_ml_kem_set_seed(seed, ML_KEM_SEED_BYTES, key))
+    if (seed != NULL && !ossl_ml_kem_set_seed(seed, ML_KEM_SEED_BYTES, key)) {
+        ossl_ml_kem_key_free(key);
         return NULL;
+    }
     genok = ossl_ml_kem_genkey(nopub, 0, key);
 
     /* Erase the single-use seed */
@@ -780,7 +788,6 @@ static void *ml_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
     if (genok) {
 #ifdef FIPS_MODULE
         if (!ml_kem_pairwise_test(key, ML_KEM_KEY_FIXED_PCT)) {
-            ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
             ossl_ml_kem_key_free(key);
             return NULL;
         }
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c
index 5d1902ce637c..75267f88e761 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/mlx_kmgmt.c
@@ -245,7 +245,7 @@ static int mlx_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb,
 {
     MLX_KEY *key = vkey;
     OSSL_PARAM_BLD *tmpl = NULL;
-    OSSL_PARAM *params = NULL;
+    OSSL_PARAM *params = NULL, *p;
     size_t publen;
     size_t prvlen;
     int ret = 0;
@@ -307,12 +307,18 @@ static int mlx_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb,
         goto err;
 
     ret = param_cb(params, cbarg);
+    /*
+     * OSSL_PARAM_free() only wipes the secure-heap data block,
+     * so wipe the key material copies held in the params first.
+     */
+    for (p = params; p->key != NULL; p++)
+        OPENSSL_cleanse(p->data, p->data_size);
     OSSL_PARAM_free(params);
 
 err:
     OSSL_PARAM_BLD_free(tmpl);
     OPENSSL_secure_clear_free(sub_arg.prvenc, prvlen);
-    OPENSSL_free(sub_arg.pubenc);
+    OPENSSL_clear_free(sub_arg.pubenc, publen);
     return ret;
 }
 
@@ -562,12 +568,18 @@ static int mlx_kem_get_params(void *vkey, OSSL_PARAM params[])
         selection |= OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS;
 
     /* Extract sub-component key material */
-    if (!export_sub(&sub_arg, selection, key))
-        return 0;
-
-    if ((pub != NULL && sub_arg.pubcount != 2)
-        || (prv != NULL && sub_arg.prvcount != 2))
+    if (!export_sub(&sub_arg, selection, key)
+        || (pub != NULL && sub_arg.pubcount != 2)
+        || (prv != NULL && sub_arg.prvcount != 2)) {
+        /* Erase any partial key material on failure */
+        if (sub_arg.pubenc != NULL)
+            OPENSSL_cleanse(sub_arg.pubenc,
+                key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes);
+        if (sub_arg.prvenc != NULL)
+            OPENSSL_cleanse(sub_arg.prvenc,
+                key->minfo->prvkey_bytes + key->xinfo->prvkey_bytes);
         return 0;
+    }
 
     return 1;
 }
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c
index 8a676213903f..8799df6be6d5 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/slh_dsa_kmgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -223,7 +223,7 @@ static int slh_dsa_export(void *keydata, int selection, OSSL_CALLBACK *param_cb,
 {
     SLH_DSA_KEY *key = keydata;
     OSSL_PARAM_BLD *tmpl;
-    OSSL_PARAM *params = NULL;
+    OSSL_PARAM *params = NULL, *p;
     int ret = 0;
 
     if (!ossl_prov_is_running() || key == NULL)
@@ -244,6 +244,12 @@ static int slh_dsa_export(void *keydata, int selection, OSSL_CALLBACK *param_cb,
         goto err;
 
     ret = param_cb(params, cbarg);
+    /*
+     * OSSL_PARAM_free() only wipes the secure-heap data block,
+     * so wipe the key material copies held in the params first.
+     */
+    for (p = params; p->key != NULL; p++)
+        OPENSSL_cleanse(p->data, p->data_size);
     OSSL_PARAM_free(params);
 err:
     OSSL_PARAM_BLD_free(tmpl);
@@ -298,7 +304,7 @@ static int slh_dsa_fips140_pairwise_test(const SLH_DSA_KEY *key,
     uint8_t msg[16] = { 0 };
     size_t msg_len = sizeof(msg);
     uint8_t *sig = NULL;
-    size_t sig_len;
+    size_t sig_len = 0;
     OSSL_LIB_CTX *lib_ctx;
     int alloc_ctx = 0;
 
@@ -341,7 +347,7 @@ static int slh_dsa_fips140_pairwise_test(const SLH_DSA_KEY *key,
 err:
     if (alloc_ctx)
         ossl_slh_dsa_hash_ctx_free(ctx);
-    OPENSSL_free(sig);
+    OPENSSL_clear_free(sig, sig_len);
     OSSL_SELF_TEST_onend(st, ret);
     OSSL_SELF_TEST_free(st);
     return ret;
@@ -366,10 +372,8 @@ static void *slh_dsa_gen(void *genctx, const char *alg)
             gctx->entropy, gctx->entropy_len))
         goto err;
 #ifdef FIPS_MODULE
-    if (!slh_dsa_fips140_pairwise_test(key, ctx)) {
-        ossl_set_error_state(OSSL_SELF_TEST_TYPE_PCT);
+    if (!slh_dsa_fips140_pairwise_test(key, ctx))
         goto err;
-    }
 #endif /* FIPS_MODULE */
     ossl_slh_dsa_hash_ctx_free(ctx);
     return key;
@@ -428,7 +432,7 @@ static void slh_dsa_gen_cleanup(void *genctx)
     if (gctx == NULL)
         return;
 
-    OPENSSL_cleanse(gctx->entropy, gctx->entropy_len);
+    OPENSSL_cleanse(gctx->entropy, sizeof(gctx->entropy));
     OPENSSL_free(gctx->propq);
     OPENSSL_free(gctx);
 }
diff --git a/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c b/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c
index 58a842776233..14542c6716f2 100644
--- a/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c
+++ b/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -275,7 +275,7 @@ static int cmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[])
                 && !EVP_CIPHER_is_a(cipher, "AES-192-CBC")
                 && !EVP_CIPHER_is_a(cipher, "AES-128-CBC")
                 && !EVP_CIPHER_is_a(cipher, "DES-EDE3-CBC")) {
-                ERR_raise(ERR_LIB_PROV, EVP_R_UNSUPPORTED_CIPHER);
+                ERR_raise(ERR_LIB_PROV, PROV_R_NOT_SUPPORTED);
                 return 0;
             }
         }
diff --git a/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c b/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c
index 22ff0a283739..69d4444a58d7 100644
--- a/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c
+++ b/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c
@@ -82,7 +82,7 @@ static size_t poly1305_size(void)
 static int poly1305_setkey(struct poly1305_data_st *ctx,
     const unsigned char *key, size_t keylen)
 {
-    if (keylen != POLY1305_KEY_SIZE) {
+    if (key == NULL || keylen != POLY1305_KEY_SIZE) {
         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
         return 0;
     }
@@ -111,6 +111,10 @@ static int poly1305_update(void *vmacctx, const unsigned char *data,
 {
     struct poly1305_data_st *ctx = vmacctx;
 
+    if (!ctx->key_set) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET);
+        return 0;
+    }
     ctx->updated = 1;
     if (datalen == 0)
         return 1;
diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c b/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c
index d42f08585713..57da1cfdf33d 100644
--- a/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c
+++ b/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -588,6 +588,18 @@ static int drbg_ctr_init(PROV_DRBG *drbg)
     drbg->strength = keylen * 8;
     drbg->seedlen = keylen + 16;
 
+#ifdef FIPS_MODULE
+    /*
+     * FIPS requires that we use a derivation function since our
+     * entropy source is outside the fips boundary
+     */
+    if (ctr->use_df == 0) {
+        ERR_raise_data(ERR_LIB_PROV, PROV_R_DERIVATION_FUNCTION_INIT_FAILED,
+            "FIPS requires the use of a derivation function");
+        goto err;
+    }
+#endif
+
     if (ctr->use_df) {
         /* df initialisation */
         static const unsigned char df_key[32] = {
@@ -713,7 +725,6 @@ static int drbg_ctr_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[])
     PROV_DRBG *ctx = (PROV_DRBG *)vctx;
     PROV_DRBG_CTR *ctr = (PROV_DRBG_CTR *)ctx->data;
     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
-    OSSL_PROVIDER *prov = NULL;
     const OSSL_PARAM *p;
     char *ecb;
     const char *propquery = NULL;
@@ -731,19 +742,14 @@ static int drbg_ctr_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[])
         != NULL) {
         if (p->data_type != OSSL_PARAM_UTF8_STRING)
             return 0;
-        propquery = (const char *)p->data;
     }
 
-    if ((p = OSSL_PARAM_locate_const(params,
-             OSSL_PROV_PARAM_CORE_PROV_NAME))
-        != NULL) {
-        if (p->data_type != OSSL_PARAM_UTF8_STRING)
-            return 0;
-        if ((prov = ossl_provider_find(libctx,
-                 (const char *)p->data, 1))
-            == NULL)
-            return 0;
-    }
+#ifndef FIPS_MODULE
+    propquery = "provider=default";
+    if (p != NULL
+        && p->data_type == OSSL_PARAM_UTF8_STRING)
+        propquery = (const char *)p->data;
+#endif
 
     if ((p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_CIPHER)) != NULL) {
         const char *base = (const char *)p->data;
@@ -752,50 +758,33 @@ static int drbg_ctr_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[])
 
         if (p->data_type != OSSL_PARAM_UTF8_STRING
             || p->data_size < ctr_str_len) {
-            ossl_provider_free(prov);
             return 0;
         }
         if (OPENSSL_strcasecmp("CTR", base + p->data_size - ctr_str_len) != 0) {
             ERR_raise(ERR_LIB_PROV, PROV_R_REQUIRE_CTR_MODE_CIPHER);
-            ossl_provider_free(prov);
             return 0;
         }
         if ((ecb = OPENSSL_strndup(base, p->data_size)) == NULL) {
-            ossl_provider_free(prov);
             return 0;
         }
         strcpy(ecb + p->data_size - ecb_str_len, "ECB");
         EVP_CIPHER_free(ctr->cipher_ecb);
         EVP_CIPHER_free(ctr->cipher_ctr);
+        ctr->cipher_ctr = NULL;
+        ctr->cipher_ecb = NULL;
         /*
          * Try to fetch algorithms from our own provider code, fallback
          * to generic fetch only if that fails
          */
-        (void)ERR_set_mark();
-        ctr->cipher_ctr = evp_cipher_fetch_from_prov(prov, base, NULL);
-        if (ctr->cipher_ctr == NULL) {
-            (void)ERR_pop_to_mark();
-            ctr->cipher_ctr = EVP_CIPHER_fetch(libctx, base, propquery);
-        } else {
-            (void)ERR_clear_last_mark();
-        }
-        (void)ERR_set_mark();
-        ctr->cipher_ecb = evp_cipher_fetch_from_prov(prov, ecb, NULL);
-        if (ctr->cipher_ecb == NULL) {
-            (void)ERR_pop_to_mark();
-            ctr->cipher_ecb = EVP_CIPHER_fetch(libctx, ecb, propquery);
-        } else {
-            (void)ERR_clear_last_mark();
-        }
+        ctr->cipher_ctr = EVP_CIPHER_fetch(libctx, base, propquery);
+        ctr->cipher_ecb = EVP_CIPHER_fetch(libctx, ecb, propquery);
         OPENSSL_free(ecb);
         if (ctr->cipher_ctr == NULL || ctr->cipher_ecb == NULL) {
             ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_FIND_CIPHERS);
-            ossl_provider_free(prov);
             return 0;
         }
         cipher_init = 1;
     }
-    ossl_provider_free(prov);
 
     if (cipher_init && !drbg_ctr_init(ctx))
         return 0;
diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c b/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c
index 92eb443c6e82..504af87d5e13 100644
--- a/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c
+++ b/deps/openssl/openssl/providers/implementations/rands/drbg_hash.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2011-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -508,23 +508,22 @@ static const OSSL_PARAM *drbg_hash_gettable_ctx_params(ossl_unused void *vctx,
 
 static int drbg_fetch_digest_from_prov(const OSSL_PARAM params[],
     OSSL_LIB_CTX *libctx,
-    EVP_MD **digest)
+    EVP_MD **digest,
+    const char *propq)
 {
-    OSSL_PROVIDER *prov = NULL;
     const OSSL_PARAM *p;
     EVP_MD *md = NULL;
     int ret = 0;
+    const char *propquery = NULL;
 
-    if (digest == NULL)
-        return 0;
+#ifndef FIPS_MODULE
+    if (propq == NULL)
+        propquery = "provider=default";
+    else
+        propquery = propq;
+#endif
 
-    if ((p = OSSL_PARAM_locate_const(params,
-             OSSL_PROV_PARAM_CORE_PROV_NAME))
-        == NULL)
-        return 0;
-    if (p->data_type != OSSL_PARAM_UTF8_STRING)
-        return 0;
-    if ((prov = ossl_provider_find(libctx, (const char *)p->data, 1)) == NULL)
+    if (digest == NULL)
         return 0;
 
     p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST);
@@ -536,15 +535,13 @@ static int drbg_fetch_digest_from_prov(const OSSL_PARAM params[],
     if (p->data_type != OSSL_PARAM_UTF8_STRING)
         goto done;
 
-    md = evp_digest_fetch_from_prov(prov, (const char *)p->data, NULL);
+    md = EVP_MD_fetch(libctx, p->data, propquery);
     if (md) {
         EVP_MD_free(*digest);
         *digest = md;
         ret = 1;
     }
-
 done:
-    ossl_provider_free(prov);
     return ret;
 }
 
@@ -556,15 +553,24 @@ static int drbg_hash_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]
     EVP_MD *prov_md = NULL;
     const EVP_MD *md;
     int md_size;
+    const OSSL_PARAM *p;
 
     if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
             OSSL_DRBG_PARAM_FIPS_DIGEST_CHECK))
         return 0;
 
     /* try to fetch digest from provider */
+    p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_PROPERTIES);
     (void)ERR_set_mark();
-    if (!drbg_fetch_digest_from_prov(params, libctx, &prov_md)) {
+    if (!drbg_fetch_digest_from_prov(params, libctx, &prov_md,
+            (p != NULL && p->data_type == OSSL_PARAM_UTF8_STRING) ? p->data : NULL)) {
         (void)ERR_pop_to_mark();
+        /*
+         * Its possible for drbg_fetch_digest_from_prov to return 0 after having set prov_md
+         * so we need to ensure we free it here
+         */
+        EVP_MD_free(prov_md);
+
         /* fall back to full implementation search */
         if (!ossl_prov_digest_load_from_params(&hash->digest, params, libctx))
             return 0;
diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c b/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c
index d3191e55a929..87050764fe46 100644
--- a/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c
+++ b/deps/openssl/openssl/providers/implementations/rands/drbg_hmac.c
@@ -412,27 +412,25 @@ static const OSSL_PARAM *drbg_hmac_gettable_ctx_params(ossl_unused void *vctx,
 static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[],
     OSSL_LIB_CTX *libctx,
     EVP_MAC_CTX **macctx,
-    EVP_MD **digest)
+    EVP_MD **digest, const char *propq)
 {
-    OSSL_PROVIDER *prov = NULL;
     const OSSL_PARAM *p;
     const char *digest_name = NULL;
     const char *hmac_name = NULL;
     EVP_MD *md = NULL;
     EVP_MAC *mac = NULL;
-    OSSL_PARAM mac_params[2], *mp = mac_params;
+    OSSL_PARAM mac_params[3], *mp = mac_params;
     int ret = 0;
+    const char *propquery = NULL;
 
-    if (macctx == NULL || digest == NULL)
-        return 0;
+#ifndef FIPS_MODULE
+    if (propq == NULL)
+        propquery = "provider=default";
+    else
+        propquery = propq;
+#endif
 
-    if ((p = OSSL_PARAM_locate_const(params,
-             OSSL_PROV_PARAM_CORE_PROV_NAME))
-        == NULL)
-        return 0;
-    if (p->data_type != OSSL_PARAM_UTF8_STRING)
-        return 0;
-    if ((prov = ossl_provider_find(libctx, (const char *)p->data, 1)) == NULL)
+    if (macctx == NULL || digest == NULL)
         return 0;
 
     p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST);
@@ -441,7 +439,7 @@ static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[],
             ERR_raise(ERR_LIB_PROV, PROV_R_VALUE_ERROR);
             goto done;
         }
-        md = evp_digest_fetch_from_prov(prov, digest_name, NULL);
+        md = EVP_MD_fetch(libctx, p->data, propquery);
         if (md) {
             EVP_MD_free(*digest);
             *digest = md;
@@ -467,12 +465,14 @@ static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[],
     EVP_MAC_CTX_free(*macctx);
     *macctx = NULL;
 
-    mac = evp_mac_fetch_from_prov(prov, hmac_name, NULL);
+    mac = EVP_MAC_fetch(libctx, hmac_name, propquery);
     if (mac) {
         *macctx = EVP_MAC_CTX_new(mac);
         /* The context holds on to the MAC */
         EVP_MAC_free(mac);
         *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, (char *)digest_name, 0);
+        if (propquery)
+            *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_PROPERTIES, (char *)propquery, 0);
         *mp = OSSL_PARAM_construct_end();
         if (!EVP_MAC_CTX_set_params(*macctx, mac_params)) {
             ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MAC);
@@ -484,7 +484,6 @@ static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[],
     }
 
 done:
-    ossl_provider_free(prov);
     return ret;
 }
 
@@ -496,15 +495,23 @@ static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]
     EVP_MD *prov_md = NULL;
     const EVP_MD *md;
     int md_size;
+    const OSSL_PARAM *p;
 
     if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
             OSSL_DRBG_PARAM_FIPS_DIGEST_CHECK))
         return 0;
 
     /* try to fetch mac and digest from provider */
+    p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_PROPERTIES);
     (void)ERR_set_mark();
-    if (!drbg_fetch_algs_from_prov(params, libctx, &hmac->ctx, &prov_md)) {
+    if (!drbg_fetch_algs_from_prov(params, libctx, &hmac->ctx, &prov_md,
+            (p != NULL && p->data_type == OSSL_PARAM_UTF8_STRING) ? p->data : NULL)) {
         (void)ERR_pop_to_mark();
+        /*
+         * Its possible for drbg_fetch_algs_from_prov to return 0 and set prov_md here
+         * so we need to free prov_md to be leak free
+         */
+        EVP_MD_free(prov_md);
         /* fall back to full implementation search */
         if (!ossl_prov_digest_load_from_params(&hmac->digest, params, libctx))
             return 0;
diff --git a/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c b/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c
index 80ae8173131d..0b8a9ec341d9 100644
--- a/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c
+++ b/deps/openssl/openssl/providers/implementations/rands/seeding/rand_unix.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -394,7 +394,7 @@ static ssize_t syscall_random(void *buf, size_t buflen)
     return getrandom(buf, buflen, 0);
 #elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND)
     return sysctl_random(buf, buflen);
-#elif defined(__wasi__)
+#elif defined(__wasi__) || defined(__EMSCRIPTEN__)
     if (getentropy(buf, buflen) == 0)
         return (ssize_t)buflen;
     return -1;
diff --git a/deps/openssl/openssl/providers/implementations/rands/test_rng.c b/deps/openssl/openssl/providers/implementations/rands/test_rng.c
index 7942537879f1..88e5fb982aed 100644
--- a/deps/openssl/openssl/providers/implementations/rands/test_rng.c
+++ b/deps/openssl/openssl/providers/implementations/rands/test_rng.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -15,7 +15,7 @@
 #include <openssl/core_names.h>
 #include <openssl/evp.h>
 #include <openssl/err.h>
-#include <openssl/randerr.h>
+#include <openssl/proverr.h>
 #include "prov/securitycheck.h"
 #include "prov/providercommon.h"
 #include "prov/provider_ctx.h"
@@ -305,7 +305,7 @@ static int test_rng_enable_locking(void *vtest)
     if (t != NULL && t->lock == NULL) {
         t->lock = CRYPTO_THREAD_lock_new();
         if (t->lock == NULL) {
-            ERR_raise(ERR_LIB_PROV, RAND_R_FAILED_TO_CREATE_LOCK);
+            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_CREATE_LOCK);
             return 0;
         }
     }
diff --git a/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c b/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c
index 28f3e15b5985..4980474ac03d 100644
--- a/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c
+++ b/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c
@@ -591,7 +591,7 @@ rsa_signverify_init(PROV_RSA_CTX *prsactx, void *vrsa,
 
         break;
     default:
-        ERR_raise(ERR_LIB_RSA, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+        ERR_raise(ERR_LIB_PROV, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
         return 0;
     }
 
@@ -1015,7 +1015,13 @@ static int rsa_verify_recover(void *vprsactx,
         }
         ret = RSA_public_decrypt((int)siglen, sig, rout, prsactx->rsa,
             prsactx->pad_mode);
-        if (ret <= 0) {
+        /*
+         * RSA_public_decrypt() returns -1 on error and otherwise the number
+         * of recovered bytes, which may legitimately be zero for a raw
+         * PKCS#1 v1.5 signature that encodes an empty payload.  Treat only
+         * a negative result as an error.
+         */
+        if (ret < 0) {
             ERR_raise(ERR_LIB_PROV, ERR_R_RSA_LIB);
             return 0;
         }
@@ -1947,7 +1953,7 @@ static int rsa_sigalg_signverify_init(void *vprsactx, void *vrsa,
 
     /* PSS is currently not supported as a sigalg */
     if (prsactx->pad_mode == RSA_PKCS1_PSS_PADDING) {
-        ERR_raise(ERR_LIB_RSA, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+        ERR_raise(ERR_LIB_PROV, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
         return 0;
     }
 
diff --git a/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c b/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c
index c6d4e04c1b84..6d43be32f4d2 100644
--- a/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c
+++ b/deps/openssl/openssl/providers/implementations/signature/slh_dsa_sig.c
@@ -61,7 +61,7 @@ static void slh_dsa_freectx(void *vctx)
 
     ossl_slh_dsa_hash_ctx_free(ctx->hash_ctx);
     OPENSSL_free(ctx->propq);
-    OPENSSL_cleanse(ctx->add_random, ctx->add_random_len);
+    OPENSSL_cleanse(ctx->add_random, sizeof(ctx->add_random));
     OPENSSL_free(ctx);
 }
 
diff --git a/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c b/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c
index f5553b97da37..03560ab4902d 100644
--- a/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c
+++ b/deps/openssl/openssl/providers/implementations/storemgmt/file_store_any2obj.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -191,6 +191,10 @@ static int msblob2obj_decode(void *vctx, OSSL_CORE_BIO *cin, int selection,
 
     ok = 0;
     mem_want = ossl_blob_length(bitlen, isdss, ispub);
+
+    if (mem_want > BLOB_MAX_LENGTH) {
+        goto next;
+    }
     if (!BUF_MEM_grow(mem, mem_len + mem_want)) {
         ERR_raise(ERR_LIB_PEM, ERR_R_BUF_LIB);
         goto err;
diff --git a/deps/openssl/openssl/ssl/quic/quic_ackm.c b/deps/openssl/openssl/ssl/quic/quic_ackm.c
index 58318a123a85..5da8af882ade 100644
--- a/deps/openssl/openssl/ssl/quic/quic_ackm.c
+++ b/deps/openssl/openssl/ssl/quic/quic_ackm.c
@@ -1003,6 +1003,7 @@ static void ackm_on_pkts_acked(OSSL_ACKM *ackm, const OSSL_ACKM_TX_PKT *apkt)
     const OSSL_ACKM_TX_PKT *anext;
     QUIC_PN last_pn_acked = 0;
     OSSL_CC_ACK_INFO ainfo = { 0 };
+    unsigned int is_inflight;
 
     for (; apkt != NULL; apkt = anext) {
         if (apkt->is_inflight) {
@@ -1027,10 +1028,11 @@ static void ackm_on_pkts_acked(OSSL_ACKM *ackm, const OSSL_ACKM_TX_PKT *apkt)
         ainfo.tx_time = apkt->time;
         ainfo.tx_size = apkt->num_bytes;
 
+        is_inflight = apkt->is_inflight;
         anext = apkt->anext;
         apkt->on_acked(apkt->cb_arg); /* may free apkt */
 
-        if (apkt->is_inflight)
+        if (is_inflight)
             ackm->cc_method->on_data_acked(ackm->cc_data, &ainfo);
     }
 }
@@ -1133,6 +1135,38 @@ int ossl_ackm_on_tx_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt)
     return 1;
 }
 
+int ossl_ackm_on_tx_ack_only_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt)
+{
+    struct tx_pkt_history_st *h;
+    unsigned int pkt_space;
+
+    if (pkt == NULL || pkt->pkt_space >= QUIC_PN_SPACE_NUM)
+        return 0;
+
+    /*
+     * A packet containing only an ACK frame must not be treated as
+     * in-flight or ack-eliciting; if it were, ossl_ackm_on_tx_packet()
+     * below would (correctly) perform bytes-in-flight/timer/CC bookkeeping
+     * for a packet we are about to discard from history, which would be
+     * incorrect.
+     */
+    if (pkt->is_inflight || pkt->is_ack_eliciting)
+        return 0;
+
+    pkt_space = pkt->pkt_space;
+
+    /*
+     * No one can expect ACK for packet which carries ACK frames only
+     * (ack_only packet). The ACKM does not need to keep record for ack_only
+     * packet. For ack_only packet the ACKM manager must be updated by the
+     * highest packet number which got sent.
+     */
+    h = get_tx_history(ackm, pkt_space);
+    h->highest_sent = pkt->pkt_num;
+
+    return 1;
+}
+
 int ossl_ackm_on_rx_datagram(OSSL_ACKM *ackm, size_t num_bytes)
 {
     /* No-op on the client. */
@@ -1167,8 +1201,21 @@ int ossl_ackm_on_rx_ack_frame(OSSL_ACKM *ackm, const OSSL_QUIC_FRAME_ACK *ack,
     int pkt_space, OSSL_TIME rx_time)
 {
     OSSL_ACKM_TX_PKT *na_pkts, *lost_pkts;
+    struct tx_pkt_history_st *h = get_tx_history(ackm, pkt_space);
     int must_set_timer = 0;
 
+    /*
+     * RFC 9000 s. 13.1 recommends treating an acknowledgment for a packet we
+     * did not send as a PROTOCOL_VIOLATION, where detectable. The largest
+     * acknowledged PN is ack_ranges[0].end; if it exceeds the highest PN we have
+     * sent in this space, reject the ACK. Otherwise the peer-controlled value is
+     * stored into largest_acked_pkt below, which only ever increases and drives
+     * loss detection, so a single such ACK would permanently force every
+     * in-flight and subsequently-sent packet to be declared lost.
+     */
+    if (ack->ack_ranges[0].end > h->highest_sent)
+        return 0;
+
     if (ackm->largest_acked_pkt[pkt_space] == QUIC_PN_INVALID)
         ackm->largest_acked_pkt[pkt_space] = ack->ack_ranges[0].end;
     else
diff --git a/deps/openssl/openssl/ssl/quic/quic_impl.c b/deps/openssl/openssl/ssl/quic/quic_impl.c
index 97efa4908a49..13bb007fa49b 100644
--- a/deps/openssl/openssl/ssl/quic/quic_impl.c
+++ b/deps/openssl/openssl/ssl/quic/quic_impl.c
@@ -410,6 +410,11 @@ static int expect_quic_cs(const SSL *s, QCTX *ctx)
     return expect_quic_as(s, ctx, QCTX_C | QCTX_S);
 }
 
+static int expect_quic_cl(const SSL *s, QCTX *ctx)
+{
+    return expect_quic_as(s, ctx, QCTX_C | QCTX_L);
+}
+
 static int expect_quic_csl(const SSL *s, QCTX *ctx)
 {
     return expect_quic_as(s, ctx, QCTX_C | QCTX_S | QCTX_L);
@@ -3643,6 +3648,33 @@ static int qc_getset_idle_timeout(QCTX *ctx, uint32_t class_,
     return ret;
 }
 
+QUIC_TAKES_LOCK
+static int qc_getset_max_pending_channels(QCTX *ctx, uint32_t class_,
+    uint64_t *p_value_out, uint64_t *p_value_in)
+{
+    int ret = 0;
+    uint64_t value_out = 0;
+
+    qctx_lock(ctx);
+
+    if (class_ == SSL_VALUE_CLASS_GENERIC && ctx->is_listener) {
+        value_out = ossl_quic_port_get_max_pending_channels(ctx->ql->port);
+        if (p_value_in != NULL)
+            ossl_quic_port_set_max_pending_channels(ctx->ql->port, *p_value_in);
+        ret = 1;
+    } else {
+        QUIC_RAISE_NON_NORMAL_ERROR(ctx, SSL_R_UNSUPPORTED_CONFIG_VALUE_CLASS, NULL);
+        ret = 0;
+    }
+
+    qctx_unlock(ctx);
+
+    if (ret && p_value_out != NULL)
+        *p_value_out = value_out;
+
+    return ret;
+}
+
 QUIC_TAKES_LOCK
 static int qc_get_stream_avail(QCTX *ctx, uint32_t class_,
     int is_uni, int is_remote,
@@ -3778,6 +3810,8 @@ static int expect_quic_for_value(SSL *s, QCTX *ctx, uint32_t id)
     case SSL_VALUE_STREAM_WRITE_BUF_USED:
     case SSL_VALUE_STREAM_WRITE_BUF_AVAIL:
         return expect_quic_cs(s, ctx);
+    case SSL_VALUE_QUIC_MAX_PENDING_CONNS:
+        return expect_quic_cl(s, ctx);
     default:
         return expect_quic_conn_only(s, ctx);
     }
@@ -3799,6 +3833,8 @@ int ossl_quic_get_value_uint(SSL *s, uint32_t class_, uint32_t id,
     switch (id) {
     case SSL_VALUE_QUIC_IDLE_TIMEOUT:
         return qc_getset_idle_timeout(&ctx, class_, value, NULL);
+    case SSL_VALUE_QUIC_MAX_PENDING_CONNS:
+        return qc_getset_max_pending_channels(&ctx, class_, value, NULL);
 
     case SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL:
         return qc_get_stream_avail(&ctx, class_, /*uni=*/0, /*remote=*/0, value);
@@ -3845,6 +3881,8 @@ int ossl_quic_set_value_uint(SSL *s, uint32_t class_, uint32_t id,
 
     case SSL_VALUE_EVENT_HANDLING_MODE:
         return qc_getset_event_handling(&ctx, class_, NULL, &value);
+    case SSL_VALUE_QUIC_MAX_PENDING_CONNS:
+        return qc_getset_max_pending_channels(&ctx, class_, NULL, &value);
 
     default:
         return QUIC_RAISE_NON_NORMAL_ERROR(&ctx,
@@ -4915,6 +4953,11 @@ int ossl_quic_set_peer_token(SSL_CTX *ctx, BIO_ADDR *peer,
         ossl_quic_free_peer_token(old);
     }
     lh_QUIC_TOKEN_insert(c->cache, tok);
+    if (lh_QUIC_TOKEN_error(c->cache)) {
+        ossl_quic_free_peer_token(tok);
+        ossl_crypto_mutex_unlock(c->mutex);
+        return 0;
+    }
 
     ossl_crypto_mutex_unlock(c->mutex);
     return 1;
@@ -5406,6 +5449,19 @@ QUIC_CHANNEL *ossl_quic_conn_get_channel(SSL *s)
     return ctx.qc->ch;
 }
 
+QUIC_PORT *ossl_quic_listener_get_port(SSL *s)
+{
+    QCTX ctx;
+
+    /*
+     * expect listerner only
+     */
+    if (!expect_quic_listener(s, &ctx))
+        return NULL;
+
+    return ctx.ql->port;
+}
+
 int ossl_quic_set_diag_title(SSL_CTX *ctx, const char *title)
 {
 #ifndef OPENSSL_NO_QLOG
diff --git a/deps/openssl/openssl/ssl/quic/quic_port.c b/deps/openssl/openssl/ssl/quic/quic_port.c
index 200022ac2c56..aad9c3a5b3d5 100644
--- a/deps/openssl/openssl/ssl/quic/quic_port.c
+++ b/deps/openssl/openssl/ssl/quic/quic_port.c
@@ -93,6 +93,8 @@ typedef struct validation_token {
  */
 #define ENCRYPTED_TOKEN_MAX_LEN (MARSHALLED_TOKEN_MAX_LEN + 16 + 12)
 
+#define DEFAULT_MAX_PENDING_CONNS 256
+
 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
 DEFINE_LIST_OF_IMPL(incoming_ch, QUIC_CHANNEL);
 DEFINE_LIST_OF_IMPL(port, QUIC_PORT);
@@ -110,6 +112,7 @@ QUIC_PORT *ossl_quic_port_new(const QUIC_PORT_ARGS *args)
     port->validate_addr = args->do_addr_validation;
     port->get_conn_user_ssl = args->get_conn_user_ssl;
     port->user_ssl_arg = args->user_ssl_arg;
+    port->max_pending_channels = DEFAULT_MAX_PENDING_CONNS;
 
     if (!port_init(port)) {
         OPENSSL_free(port);
@@ -531,8 +534,10 @@ static QUIC_CHANNEL *port_make_channel(QUIC_PORT *port, SSL *tls, OSSL_QRX *qrx,
      * start by allocation and provisioning as much of the channel as we can
      */
     ch = ossl_quic_channel_alloc(&args);
-    if (ch == NULL)
+    if (ch == NULL) {
+        ossl_qrx_free(qrx);
         return NULL;
+    }
 
     /*
      * Fixup the channel tls connection here before we init the channel
@@ -1488,7 +1493,7 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg,
     QUIC_CHANNEL *ch = NULL, *new_ch = NULL;
     QUIC_CONN_ID odcid;
     uint8_t gen_new_token = 0;
-    OSSL_QRX *qrx = NULL;
+    OSSL_QRX *qrx = NULL, *qrx_ref;
     OSSL_QRX *qrx_src = NULL;
     OSSL_QRX_ARGS qrx_args = { 0 };
     uint64_t cause_flags = 0;
@@ -1581,6 +1586,9 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg,
     if (hdr.type != QUIC_PKT_TYPE_INITIAL)
         goto undesirable;
 
+    if (port->max_pending_channels > 0 && ossl_list_incoming_ch_num(&port->incoming_channel_list) >= port->max_pending_channels)
+        goto undesirable;
+
     odcid.id_len = 0;
 
     /*
@@ -1678,8 +1686,22 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg,
         }
     }
 
+    qrx_ref = NULL;
+    if (qrx != NULL) {
+        /*
+         * if we are here, then client is validated via retry packet
+         * (client sent a valid token). In this case the qrx has valid
+         * secrets set for QUIC initial level encryption. We can pass
+         * reference to qrx to newly created channel.
+         *
+         * Note: port_bind_channel()/channel becomes owner of qrx_ref.
+         */
+        qrx_ref = ossl_qrx_newref(qrx);
+        if (qrx_ref == NULL)
+            goto undesirable;
+    }
     port_bind_channel(port, &e->peer, &hdr.dst_conn_id,
-        &odcid, qrx, &new_ch);
+        &odcid, qrx_ref, &new_ch);
 
     /*
      * if packet validates it gets moved to channel, we've just bound
@@ -1694,19 +1716,19 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg,
     if (gen_new_token == 1)
         generate_new_token(new_ch, &e->peer);
 
-    if (qrx != NULL) {
+    if (qrx_src != NULL) {
         /*
-         * The qrx belongs to channel now, so don't free it.
-         */
-        qrx = NULL;
-    } else {
-        /*
-         * We still need to salvage packets from almost forgotten qrx
-         * and pass them to channel.
+         * Time to reinject packets from qrx to channel before
+         * qrx will be destroyed here.
          */
         while (ossl_qrx_read_pkt(qrx_src, &qrx_pkt) == 1)
             ossl_quic_channel_inject_pkt(new_ch, qrx_pkt);
         ossl_qrx_update_pn_space(qrx_src, new_ch->qrx);
+        /*
+         * transfer ownership back to qrx;
+         */
+        qrx = qrx_src;
+        qrx_src = NULL;
     }
 
     /*
@@ -1723,7 +1745,7 @@ static void port_default_packet_handler(QUIC_URXE *e, void *arg,
      */
 
 undesirable:
-    ossl_qrx_free(qrx);
+    ossl_qrx_free(qrx); /* releases reference */
     ossl_qrx_free(qrx_src);
     ossl_quic_demux_release_urxe(port->demux, e);
 }
@@ -1760,3 +1782,13 @@ void ossl_quic_port_restore_err_state(const QUIC_PORT *port)
     ERR_clear_error();
     OSSL_ERR_STATE_restore(port->err_state);
 }
+
+uint64_t ossl_quic_port_get_max_pending_channels(const QUIC_PORT *port)
+{
+    return port->max_pending_channels;
+}
+
+void ossl_quic_port_set_max_pending_channels(QUIC_PORT *port, uint64_t max_pending_channels)
+{
+    port->max_pending_channels = max_pending_channels;
+}
diff --git a/deps/openssl/openssl/ssl/quic/quic_port_local.h b/deps/openssl/openssl/ssl/quic/quic_port_local.h
index 3bad3fc3a3aa..0cfc75da0ba1 100644
--- a/deps/openssl/openssl/ssl/quic/quic_port_local.h
+++ b/deps/openssl/openssl/ssl/quic/quic_port_local.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -118,6 +118,7 @@ struct quic_port_st {
 
     /* AES-256 GCM context for token encryption */
     EVP_CIPHER_CTX *token_ctx;
+    uint64_t max_pending_channels;
 };
 
 #endif
diff --git a/deps/openssl/openssl/ssl/quic/quic_record_rx.c b/deps/openssl/openssl/ssl/quic/quic_record_rx.c
index 8897cc6c2df0..0065f1c1e573 100644
--- a/deps/openssl/openssl/ssl/quic/quic_record_rx.c
+++ b/deps/openssl/openssl/ssl/quic/quic_record_rx.c
@@ -171,6 +171,8 @@ struct ossl_qrx_st {
     ossl_msg_cb msg_callback;
     void *msg_callback_arg;
     SSL *msg_callback_ssl;
+
+    uint32_t refcount;
 };
 
 static RXE *qrx_ensure_free_rxe(OSSL_QRX *qrx, size_t alloc_len);
@@ -212,6 +214,7 @@ OSSL_QRX *ossl_qrx_new(const OSSL_QRX_ARGS *args)
     qrx->short_conn_id_len = args->short_conn_id_len;
     qrx->init_key_phase_bit = args->init_key_phase_bit;
     qrx->max_deferred = args->max_deferred;
+    qrx->refcount = 1;
     return qrx;
 }
 
@@ -247,13 +250,10 @@ void ossl_qrx_update_pn_space(OSSL_QRX *src, OSSL_QRX *dst)
     return;
 }
 
-void ossl_qrx_free(OSSL_QRX *qrx)
+static void qrx_destroy(OSSL_QRX *qrx)
 {
     uint32_t i;
 
-    if (qrx == NULL)
-        return;
-
     /* Free RXE queue data. */
     qrx_cleanup_rxl(&qrx->rx_free);
     qrx_cleanup_rxl(&qrx->rx_pending);
@@ -267,6 +267,30 @@ void ossl_qrx_free(OSSL_QRX *qrx)
     OPENSSL_free(qrx);
 }
 
+void ossl_qrx_free(OSSL_QRX *qrx)
+{
+    if (qrx == NULL)
+        return;
+
+    qrx->refcount--;
+    if (qrx->refcount == 0)
+        qrx_destroy(qrx);
+}
+
+OSSL_QRX *ossl_qrx_newref(OSSL_QRX *qrx)
+{
+    OSSL_QRX *rv_qrx;
+
+    if (qrx != NULL && qrx->refcount != (uint32_t)~0) {
+        qrx->refcount++;
+        rv_qrx = qrx;
+    } else {
+        rv_qrx = NULL;
+    }
+
+    return rv_qrx;
+}
+
 void ossl_qrx_inject_urxe(OSSL_QRX *qrx, QUIC_URXE *urxe)
 {
     /* Initialize our own fields inside the URXE and add to the pending list. */
diff --git a/deps/openssl/openssl/ssl/quic/quic_rx_depack.c b/deps/openssl/openssl/ssl/quic/quic_rx_depack.c
index 7ab59f01a1cd..59d16b2f362c 100644
--- a/deps/openssl/openssl/ssl/quic/quic_rx_depack.c
+++ b/deps/openssl/openssl/ssl/quic/quic_rx_depack.c
@@ -125,8 +125,19 @@ static int depack_do_frame_ack(PACKET *pkt, QUIC_CHANNEL *ch,
     }
 
     if (!ossl_ackm_on_rx_ack_frame(ch->ackm, &ack,
-            packet_space, received))
-        goto malformed;
+            packet_space, received)) {
+        /*
+         * The ACK manager rejects the frame if it acknowledges a packet number
+         * we have not sent. RFC 9000 s. 13.1 recommends treating this as a
+         * PROTOCOL_VIOLATION connection error (distinct from a frame decoding
+         * error, which is handled at the malformed label below).
+         */
+        ossl_quic_channel_raise_protocol_error(ch,
+            OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
+            frame_type,
+            "ACK for unsent packet number");
+        return 0;
+    }
 
     ++ch->diag_num_rx_ack;
     return 1;
diff --git a/deps/openssl/openssl/ssl/quic/quic_stream_map.c b/deps/openssl/openssl/ssl/quic/quic_stream_map.c
index 84ac6b714e38..da53d4b8054f 100644
--- a/deps/openssl/openssl/ssl/quic/quic_stream_map.c
+++ b/deps/openssl/openssl/ssl/quic/quic_stream_map.c
@@ -168,6 +168,10 @@ QUIC_STREAM *ossl_quic_stream_map_alloc(QUIC_STREAM_MAP *qsm,
     s->send_final_size = UINT64_MAX;
 
     lh_QUIC_STREAM_insert(qsm->map, s);
+    if (lh_QUIC_STREAM_error(qsm->map)) {
+        OPENSSL_free(s);
+        return NULL;
+    }
     return s;
 }
 
diff --git a/deps/openssl/openssl/ssl/quic/quic_txp.c b/deps/openssl/openssl/ssl/quic/quic_txp.c
index 5ce8e77f61e0..24314f6b34b7 100644
--- a/deps/openssl/openssl/ssl/quic/quic_txp.c
+++ b/deps/openssl/openssl/ssl/quic/quic_txp.c
@@ -2935,6 +2935,20 @@ static int txp_generate_for_el(OSSL_QUIC_TX_PACKETISER *txp,
     return TXP_ERR_INTERNAL;
 }
 
+static int txp_pkt_is_ack_only(const QUIC_TXPIM_PKT *tpkt)
+{
+    return tpkt->had_ack_frame
+        && !tpkt->ackm_pkt.is_inflight
+        && !tpkt->ackm_pkt.is_ack_eliciting
+        && !tpkt->had_handshake_done_frame
+        && !tpkt->had_max_data_frame
+        && !tpkt->had_max_streams_bidi_frame
+        && !tpkt->had_max_streams_uni_frame
+        && !tpkt->had_conn_close
+        && tpkt->retx_head == NULL
+        && ossl_quic_txpim_pkt_get_num_chunks(tpkt) == 0;
+}
+
 /*
  * Commits and queues a packet for transmission. There is no backing out after
  * this.
@@ -2943,8 +2957,9 @@ static int txp_generate_for_el(OSSL_QUIC_TX_PACKETISER *txp,
  *
  *   - Sends the packet to the QTX for encryption and transmission;
  *
- *   - Records the packet as having been transmitted in FIFM. ACKM is informed,
- *     etc. and the TXPIM record is filed.
+ *   - Records non-ACK-only packets as having been transmitted in FIFM. ACKM is
+ *     informed, etc. and the TXPIM record is filed only when later callbacks
+ *     need it.
  *
  *   - Informs various subsystems of frames that were sent and clears frame
  *     wanted flags so that we do not generate the same frames again.
@@ -2971,7 +2986,7 @@ static int txp_pkt_commit(OSSL_QUIC_TX_PACKETISER *txp,
     uint32_t archetype,
     int *txpim_pkt_reffed)
 {
-    int rc = 1;
+    int ack_only, rc = 1;
     uint32_t enc_level = pkt->h.enc_level;
     uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
     QUIC_TXPIM_PKT *tpkt = pkt->tpkt;
@@ -3015,28 +3030,35 @@ static int txp_pkt_commit(OSSL_QUIC_TX_PACKETISER *txp,
                 return 0; /* alloc error */
         }
 
-    /* Dispatch to FIFD. */
-    if (!ossl_quic_fifd_pkt_commit(&txp->fifd, tpkt))
+    ack_only = txp_pkt_is_ack_only(tpkt);
+
+    /* Dispatch packets that need loss/retransmit callbacks to FIFD. */
+    if (!ack_only && !ossl_quic_fifd_pkt_commit(&txp->fifd, tpkt))
         return 0;
 
     /*
      * Transmission and Post-Packet Generation Bookkeeping
      * ===================================================
      *
-     * No backing out anymore - at this point the ACKM has recorded the packet
-     * as having been sent, so we need to increment our next PN counter, or
-     * the ACKM will complain when we try to record a duplicate packet with
-     * the same PN later. At this point actually sending the packet may still
-     * fail. In this unlikely event it will simply be handled as though it
-     * were a lost packet.
+     * No backing out anymore - at this point we need to increment our next PN
+     * counter, or the ACKM will complain when we try to record a duplicate
+     * packet with the same PN later. Non-ACK-only packets have also been
+     * recorded in ACKM, so if QTX write fails they are handled as though they
+     * were lost. ACK-only packets are not recorded and will be cleaned up by
+     * the caller.
      */
     ++txp->next_pn[pn_space];
-    *txpim_pkt_reffed = 1;
+    if (!ack_only)
+        *txpim_pkt_reffed = 1;
 
     /* Send the packet. */
     if (!ossl_qtx_write_pkt(txp->args.qtx, &txpkt))
         return 0;
 
+    if (ack_only
+        && !ossl_ackm_on_tx_ack_only_packet(txp->args.ackm, &tpkt->ackm_pkt))
+        rc = 0;
+
     /*
      * Record FC and stream abort frames as sent; deactivate streams which no
      * longer have anything to do.
diff --git a/deps/openssl/openssl/ssl/record/methods/dtls_meth.c b/deps/openssl/openssl/ssl/record/methods/dtls_meth.c
index 8cbd7678e193..c282efc5ca07 100644
--- a/deps/openssl/openssl/ssl/record/methods/dtls_meth.c
+++ b/deps/openssl/openssl/ssl/record/methods/dtls_meth.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -287,7 +287,7 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu
     pitem *item;
 
     /* Limit the size of the queue to prevent DOS attacks */
-    if (pqueue_size(queue) >= 100)
+    if (pqueue_size(queue) >= 16)
         return 0;
 
     rdata = OPENSSL_malloc(sizeof(*rdata));
@@ -299,29 +299,26 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu
         return -1;
     }
 
-    rdata->packet = rl->packet;
+    /*
+     * Take a copy of just this record's on-wire bytes (header + ciphertext)
+     * rather than the whole (much larger) read buffer. The live rl->rbuf is
+     * left untouched and continues to be used for subsequent reads.
+     */
     rdata->packet_length = rl->packet_length;
-    memcpy(&(rdata->rbuf), &rl->rbuf, sizeof(TLS_BUFFER));
-    memcpy(&(rdata->rrec), &rl->rrec[0], sizeof(TLS_RL_RECORD));
-
-    item->data = rdata;
-
-    rl->packet = NULL;
-    rl->packet_length = 0;
-    memset(&rl->rbuf, 0, sizeof(TLS_BUFFER));
-    memset(&rl->rrec[0], 0, sizeof(rl->rrec[0]));
-
-    if (!tls_setup_read_buffer(rl)) {
-        /* RLAYERfatal() already called */
-        OPENSSL_free(rdata->rbuf.buf);
+    rdata->packet = OPENSSL_memdup(rl->packet, rl->packet_length);
+    if (rdata->packet == NULL) {
         OPENSSL_free(rdata);
         pitem_free(item);
+        RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
         return -1;
     }
+    memcpy(&(rdata->rrec), &rl->rrec[0], sizeof(TLS_RL_RECORD));
+
+    item->data = rdata;
 
     if (pqueue_insert(queue, item) == NULL) {
         /* Must be a duplicate so ignore it */
-        OPENSSL_free(rdata->rbuf.buf);
+        OPENSSL_free(rdata->packet);
         OPENSSL_free(rdata);
         pitem_free(item);
     }
@@ -329,44 +326,6 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu
     return 1;
 }
 
-/* copy buffered record into OSSL_RECORD_LAYER structure */
-static int dtls_copy_rlayer_record(OSSL_RECORD_LAYER *rl, pitem *item)
-{
-    DTLS_RLAYER_RECORD_DATA *rdata;
-
-    rdata = (DTLS_RLAYER_RECORD_DATA *)item->data;
-
-    ossl_tls_buffer_release(&rl->rbuf);
-
-    rl->packet = rdata->packet;
-    rl->packet_length = rdata->packet_length;
-    memcpy(&rl->rbuf, &(rdata->rbuf), sizeof(TLS_BUFFER));
-    memcpy(&rl->rrec[0], &(rdata->rrec), sizeof(TLS_RL_RECORD));
-
-    /* Set proper sequence number for mac calculation */
-    memcpy(&(rl->sequence[2]), &(rdata->packet[5]), 6);
-
-    return 1;
-}
-
-static int dtls_retrieve_rlayer_buffered_record(OSSL_RECORD_LAYER *rl,
-    struct pqueue_st *queue)
-{
-    pitem *item;
-
-    item = pqueue_pop(queue);
-    if (item) {
-        dtls_copy_rlayer_record(rl, item);
-
-        OPENSSL_free(item->data);
-        pitem_free(item);
-
-        return 1;
-    }
-
-    return 0;
-}
-
 /*-
  * Call this to get a new input record.
  * It will return <= 0 if more data is needed, normally due to an error
@@ -400,12 +359,6 @@ int dtls_get_more_records(OSSL_RECORD_LAYER *rl)
     }
 
 again:
-    /* if we're renegotiating, then there may be buffered records */
-    if (dtls_retrieve_rlayer_buffered_record(rl, rl->processed_rcds)) {
-        rl->num_recs = 1;
-        return OSSL_RECORD_RETURN_SUCCESS;
-    }
-
     /* get something from the wire */
 
     /* check if we have the header */
@@ -607,23 +560,13 @@ static int dtls_free(OSSL_RECORD_LAYER *rl)
             /* Push to the next record layer */
             ret &= BIO_write_ex(rl->next, rdata->packet, rdata->packet_length,
                 &written);
-            OPENSSL_free(rdata->rbuf.buf);
+            OPENSSL_free(rdata->packet);
             OPENSSL_free(item->data);
             pitem_free(item);
         }
         pqueue_free(rl->unprocessed_rcds);
     }
 
-    if (rl->processed_rcds != NULL) {
-        while ((item = pqueue_pop(rl->processed_rcds)) != NULL) {
-            rdata = (DTLS_RLAYER_RECORD_DATA *)item->data;
-            OPENSSL_free(rdata->rbuf.buf);
-            OPENSSL_free(item->data);
-            pitem_free(item);
-        }
-        pqueue_free(rl->processed_rcds);
-    }
-
     return tls_free(rl) && ret;
 }
 
@@ -653,10 +596,8 @@ dtls_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers,
         return ret;
 
     (*retrl)->unprocessed_rcds = pqueue_new();
-    (*retrl)->processed_rcds = pqueue_new();
 
-    if ((*retrl)->unprocessed_rcds == NULL
-        || (*retrl)->processed_rcds == NULL) {
+    if ((*retrl)->unprocessed_rcds == NULL) {
         dtls_free(*retrl);
         *retrl = NULL;
         ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
diff --git a/deps/openssl/openssl/ssl/record/methods/recmethod_local.h b/deps/openssl/openssl/ssl/record/methods/recmethod_local.h
index 4ffce8d66385..5e3fdd1d0587 100644
--- a/deps/openssl/openssl/ssl/record/methods/recmethod_local.h
+++ b/deps/openssl/openssl/ssl/record/methods/recmethod_local.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -344,9 +344,8 @@ struct ossl_record_layer_st {
 
     size_t taglen;
 
-    /* DTLS received handshake records (processed and unprocessed) */
+    /* DTLS received handshake records awaiting the next epoch */
     struct pqueue_st *unprocessed_rcds;
-    struct pqueue_st *processed_rcds;
 
     /* records being received in the current epoch */
     DTLS_BITMAP bitmap;
@@ -374,7 +373,6 @@ struct ossl_record_layer_st {
 typedef struct dtls_rlayer_record_data_st {
     unsigned char *packet;
     size_t packet_length;
-    TLS_BUFFER rbuf;
     TLS_RL_RECORD rrec;
 } DTLS_RLAYER_RECORD_DATA;
 
diff --git a/deps/openssl/openssl/ssl/record/methods/tls_common.c b/deps/openssl/openssl/ssl/record/methods/tls_common.c
index 9f957b7cc656..e00ad084cbd9 100644
--- a/deps/openssl/openssl/ssl/record/methods/tls_common.c
+++ b/deps/openssl/openssl/ssl/record/methods/tls_common.c
@@ -497,7 +497,7 @@ static int tls_record_app_data_waiting(OSSL_RECORD_LAYER *rl)
 static int rlayer_early_data_count_ok(OSSL_RECORD_LAYER *rl, size_t length,
     size_t overhead, int send)
 {
-    uint32_t max_early_data = rl->max_early_data;
+    uint64_t max_early_data = rl->max_early_data;
 
     if (max_early_data == 0) {
         RLAYERfatal(rl, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
@@ -1919,13 +1919,14 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl)
 {
     int i, ret;
     TLS_BUFFER *thiswb;
-    size_t tmpwrit = 0;
+    size_t tmpwrit = 0, left;
 
     if (rl->nextwbuf >= rl->numwpipes)
         return OSSL_RECORD_RETURN_SUCCESS;
 
     for (;;) {
         thiswb = &rl->wbuf[rl->nextwbuf];
+        left = TLS_BUFFER_get_left(thiswb);
 
         clear_sys_error();
         if (rl->bio != NULL) {
@@ -1935,13 +1936,24 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl)
                     return ret;
             }
             i = BIO_write(rl->bio, (char *)&(TLS_BUFFER_get_buf(thiswb)[TLS_BUFFER_get_offset(thiswb)]),
-                (unsigned int)TLS_BUFFER_get_left(thiswb));
+                (unsigned int)left);
             if (i >= 0) {
                 tmpwrit = i;
-                if (i == 0 && BIO_should_retry(rl->bio))
-                    ret = OSSL_RECORD_RETURN_RETRY;
-                else
+                if (i == 0 && left != 0) {
+                    if (BIO_should_retry(rl->bio)) {
+                        ret = OSSL_RECORD_RETURN_RETRY;
+                    } else {
+                        /*
+                         * Treat this as a fatal I/O condition. Do not queue an
+                         * SSL reason: a zero return with no retry flag may come
+                         * from a custom BIO and does not imply an SSL library
+                         * or protocol error.
+                         */
+                        ret = OSSL_RECORD_RETURN_FATAL;
+                    }
+                } else {
                     ret = OSSL_RECORD_RETURN_SUCCESS;
+                }
             } else {
                 if (BIO_should_retry(rl->bio)) {
                     ret = OSSL_RECORD_RETURN_RETRY;
@@ -1964,7 +1976,7 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl)
          * Treat i == 0 as success rather than an error for zero byte
          * writes to permit this case.
          */
-        if (i >= 0 && tmpwrit == TLS_BUFFER_get_left(thiswb)) {
+        if (i >= 0 && tmpwrit == left) {
             TLS_BUFFER_set_left(thiswb, 0);
             TLS_BUFFER_add_offset(thiswb, tmpwrit);
             if (++(rl->nextwbuf) < rl->numwpipes)
@@ -1982,9 +1994,9 @@ int tls_retry_write_records(OSSL_RECORD_LAYER *rl)
              */
             if (TLS_BUFFER_is_app_buffer(thiswb)
                 && (rl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) != 0) {
-                size_t left = TLS_BUFFER_get_left(thiswb);
                 unsigned char *buf;
 
+                left = TLS_BUFFER_get_left(thiswb);
                 buf = OPENSSL_malloc(left);
                 if (buf == NULL) {
                     RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
diff --git a/deps/openssl/openssl/ssl/record/rec_layer_s3.c b/deps/openssl/openssl/ssl/record/rec_layer_s3.c
index ba407478b412..3ab50facc93e 100644
--- a/deps/openssl/openssl/ssl/record/rec_layer_s3.c
+++ b/deps/openssl/openssl/ssl/record/rec_layer_s3.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -150,7 +150,7 @@ static uint32_t ossl_get_max_early_data(SSL_CONNECTION *s)
 static int ossl_early_data_count_ok(SSL_CONNECTION *s, size_t length,
     size_t overhead, int send)
 {
-    uint32_t max_early_data;
+    uint64_t max_early_data;
 
     max_early_data = ossl_get_max_early_data(s);
 
diff --git a/deps/openssl/openssl/ssl/rio/poll_builder.c b/deps/openssl/openssl/ssl/rio/poll_builder.c
index 28d93ee1947a..f808e9b01e74 100644
--- a/deps/openssl/openssl/ssl/rio/poll_builder.c
+++ b/deps/openssl/openssl/ssl/rio/poll_builder.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -120,8 +120,10 @@ int ossl_rio_poll_builder_add_fd(RIO_POLL_BUILDER *rpb, int fd,
 
     assert((rpb->pfd_heap != NULL && rpb->pfd_heap == pfds) || (rpb->pfd_heap == NULL && rpb->pfds == pfds));
     assert(i <= rpb->pfd_num && rpb->pfd_num <= rpb->pfd_alloc);
+    /* Check the index first because an appended entry is uninitialised. */
+    if (i == rpb->pfd_num || pfds[i].fd == -1)
+        pfds[i].events = 0;
     pfds[i].fd = fd;
-    pfds[i].events = 0;
 
     if (want_read)
         pfds[i].events |= POLLIN;
diff --git a/deps/openssl/openssl/ssl/rio/poll_builder.h b/deps/openssl/openssl/ssl/rio/poll_builder.h
index 1fe13eacbaba..48605d718223 100644
--- a/deps/openssl/openssl/ssl/rio/poll_builder.h
+++ b/deps/openssl/openssl/ssl/rio/poll_builder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -76,4 +76,17 @@ int ossl_rio_poll_builder_poll(RIO_POLL_BUILDER *rpb, OSSL_TIME deadline);
  * it is currently not needed.
  */
 
+#ifndef OPENSSL_NO_QUIC
+/*
+ * Test instrumentation only. If set, poll_translate() (see poll_immediate.c)
+ * calls this with the index of each item immediately before translating it,
+ * once all earlier items (if any) have finished translation. This lets
+ * tests inject a readiness change into the gap between translation of
+ * consecutive items, in order to deterministically exercise the
+ * abort-blocking path. Always NULL in production use.
+ */
+extern void (*ossl_quic_poll_translate_test_step_cb)(size_t idx, void *arg);
+extern void *ossl_quic_poll_translate_test_step_cb_arg;
+#endif
+
 #endif
diff --git a/deps/openssl/openssl/ssl/rio/poll_immediate.c b/deps/openssl/openssl/ssl/rio/poll_immediate.c
index 24b82f3a6a43..95410df0d8f4 100644
--- a/deps/openssl/openssl/ssl/rio/poll_immediate.c
+++ b/deps/openssl/openssl/ssl/rio/poll_immediate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -49,6 +49,13 @@
     } while (0)
 
 #ifndef OPENSSL_NO_QUIC
+/*
+ * Test instrumentation only; see poll_builder.h. Always NULL in production
+ * use.
+ */
+void (*ossl_quic_poll_translate_test_step_cb)(size_t idx, void *arg) = NULL;
+void *ossl_quic_poll_translate_test_step_cb_arg = NULL;
+
 static int poll_translate_ssl_quic(SSL *ssl,
     QUIC_REACTOR_WAIT_CTX *wctx,
     RIO_POLL_BUILDER *rpb,
@@ -216,6 +223,10 @@ static int poll_translate(SSL_POLL_ITEM *items,
     for (i = 0; i < num_items; ++i) {
         item = &ITEM_N(items, stride, i);
 
+        if (ossl_quic_poll_translate_test_step_cb != NULL)
+            ossl_quic_poll_translate_test_step_cb(i,
+                ossl_quic_poll_translate_test_step_cb_arg);
+
         switch (item->desc.type) {
         case BIO_POLL_DESCRIPTOR_TYPE_SSL:
             ssl = item->desc.value.ssl;
@@ -233,7 +244,7 @@ static int poll_translate(SSL_POLL_ITEM *items,
                     FAIL_ITEM(i);
 
                 if (*abort_blocking)
-                    return 1;
+                    goto out;
 
                 if (!SSL_get_event_timeout(ssl, &timeout, &is_infinite))
                     FAIL_ITEM(i++); /* need to clean up this item too */
@@ -271,7 +282,12 @@ static int poll_translate(SSL_POLL_ITEM *items,
     }
 
 out:
-    if (!ok)
+    /*
+     * On abort_blocking, the item which triggered the abort has already
+     * balanced its own enter/leave of the blocking section (see
+     * poll_translate_ssl_quic()); only items 0..i-1 still need cleanup here.
+     */
+    if (!ok || *abort_blocking)
         postpoll_translation_cleanup(items, i, stride, wctx);
 
     *p_earliest_wakeup_deadline = earliest_wakeup_deadline;
@@ -320,8 +336,15 @@ static int poll_block(SSL_POLL_ITEM *items,
             p_result_count))
         goto out;
 
-    if (abort_blocking)
+    if (abort_blocking) {
+        /*
+         * Nothing actually failed; we just shouldn't block because an item
+         * may have become ready while we were setting up. The caller's
+         * retry loop will call poll_readout() again to pick this up.
+         */
+        ok = 1;
         goto out;
+    }
 
     earliest_wakeup_deadline = ossl_time_min(earliest_wakeup_deadline,
         user_deadline);
diff --git a/deps/openssl/openssl/ssl/rio/rio_notifier.c b/deps/openssl/openssl/ssl/rio/rio_notifier.c
index ea40790d627b..abc1755dae02 100644
--- a/deps/openssl/openssl/ssl/rio/rio_notifier.c
+++ b/deps/openssl/openssl/ssl/rio/rio_notifier.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,7 +10,6 @@
 #include "internal/sockets.h"
 #include <openssl/bio.h>
 #include <openssl/err.h>
-#include "internal/thread_once.h"
 #include "internal/rio_notifier.h"
 
 /*
@@ -28,32 +27,29 @@ static int set_cloexec(int fd)
 
 #if defined(OPENSSL_SYS_WINDOWS)
 
-static CRYPTO_ONCE ensure_wsa_startup_once = CRYPTO_ONCE_STATIC_INIT;
-static int wsa_started;
-
 static void ossl_wsa_cleanup(void)
 {
-    if (wsa_started) {
-        wsa_started = 0;
-        WSACleanup();
-    }
+    WSACleanup();
 }
 
-DEFINE_RUN_ONCE_STATIC(do_wsa_startup)
+static int do_wsa_startup(void)
 {
     WORD versionreq = 0x0202; /* Version 2.2 */
     WSADATA wsadata;
 
     if (WSAStartup(versionreq, &wsadata) != 0)
         return 0;
-    wsa_started = 1;
-    OPENSSL_atexit(ossl_wsa_cleanup);
     return 1;
 }
 
 static ossl_inline int ensure_wsa_startup(void)
 {
-    return RUN_ONCE(&ensure_wsa_startup_once, do_wsa_startup);
+    return do_wsa_startup();
+}
+
+static void wsa_done(void)
+{
+    ossl_wsa_cleanup();
 }
 
 #endif
diff --git a/deps/openssl/openssl/ssl/s3_lib.c b/deps/openssl/openssl/ssl/s3_lib.c
index 213ec84b171d..079a308f6ff1 100644
--- a/deps/openssl/openssl/ssl/s3_lib.c
+++ b/deps/openssl/openssl/ssl/s3_lib.c
@@ -5223,8 +5223,10 @@ int ssl_generate_master_secret(SSL_CONNECTION *s, unsigned char *pms,
 
         pskpmslen = 4 + pmslen + psklen;
         pskpms = OPENSSL_malloc(pskpmslen);
-        if (pskpms == NULL)
+        if (pskpms == NULL) {
+            SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
             goto err;
+        }
         t = pskpms;
         s2n(pmslen, t);
         if (alg_k & SSL_kPSK)
@@ -5248,6 +5250,7 @@ int ssl_generate_master_secret(SSL_CONNECTION *s, unsigned char *pms,
         OPENSSL_clear_free(pskpms, pskpmslen);
 #else
         /* Should never happen */
+        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         goto err;
 #endif
     } else {
diff --git a/deps/openssl/openssl/ssl/ssl_cert.c b/deps/openssl/openssl/ssl/ssl_cert.c
index adc5bb3d35c3..43d1191c6e2e 100644
--- a/deps/openssl/openssl/ssl/ssl_cert.c
+++ b/deps/openssl/openssl/ssl/ssl_cert.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -306,7 +306,7 @@ int ssl_cert_set0_chain(SSL_CONNECTION *s, SSL_CTX *ctx, STACK_OF(X509) *chain)
     for (i = 0; i < sk_X509_num(chain); i++) {
         X509 *x = sk_X509_value(chain, i);
 
-        r = ssl_security_cert(s, ctx, x, 0, 0);
+        r = ssl_security_cert(s, ctx, x, 0);
         if (r != 1) {
             ERR_raise(ERR_LIB_SSL, r);
             return 0;
@@ -340,7 +340,7 @@ int ssl_cert_add0_chain_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x)
 
     if (!cpk)
         return 0;
-    r = ssl_security_cert(s, ctx, x, 0, 0);
+    r = ssl_security_cert(s, ctx, x, 0);
     if (r != 1) {
         ERR_raise(ERR_LIB_SSL, r);
         return 0;
@@ -1149,7 +1149,7 @@ int ssl_build_cert_chain(SSL_CONNECTION *s, SSL_CTX *ctx, int flags)
      */
     for (i = 0; i < sk_X509_num(chain); i++) {
         x = sk_X509_value(chain, i);
-        rv = ssl_security_cert(s, ctx, x, 0, 0);
+        rv = ssl_security_cert(s, ctx, x, 0);
         if (rv != 1) {
             ERR_raise(ERR_LIB_SSL, rv);
             OSSL_STACK_OF_X509_free(chain);
diff --git a/deps/openssl/openssl/ssl/ssl_lib.c b/deps/openssl/openssl/ssl/ssl_lib.c
index 05b0209a76b3..ba494f5fc0d0 100644
--- a/deps/openssl/openssl/ssl/ssl_lib.c
+++ b/deps/openssl/openssl/ssl/ssl_lib.c
@@ -5226,6 +5226,31 @@ SSL *SSL_dup(SSL *s)
         || !dup_ca_names(&retsc->client_ca_names, sc->client_ca_names))
         goto err;
 
+    if (sc->server_cert_type != NULL) {
+        OPENSSL_free(retsc->server_cert_type);
+        retsc->server_cert_type = OPENSSL_memdup(sc->server_cert_type,
+            sc->server_cert_type_len);
+        if (retsc->server_cert_type == NULL)
+            goto err;
+        retsc->server_cert_type_len = sc->server_cert_type_len;
+    }
+
+    if (sc->client_cert_type != NULL) {
+        OPENSSL_free(retsc->client_cert_type);
+        retsc->client_cert_type = OPENSSL_memdup(sc->client_cert_type,
+            sc->client_cert_type_len);
+        if (retsc->client_cert_type == NULL)
+            goto err;
+        retsc->client_cert_type_len = sc->client_cert_type_len;
+    }
+
+#ifndef OPENSSL_NO_CT
+    retsc->ct_validation_callback = sc->ct_validation_callback;
+    retsc->ct_validation_callback_arg = sc->ct_validation_callback_arg;
+#endif
+
+    retsc->ext.status_type = sc->ext.status_type;
+
     return ret;
 
 err:
diff --git a/deps/openssl/openssl/ssl/ssl_local.h b/deps/openssl/openssl/ssl/ssl_local.h
index 8fc8b6440615..d974ac6ecfe0 100644
--- a/deps/openssl/openssl/ssl/ssl_local.h
+++ b/deps/openssl/openssl/ssl/ssl_local.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  * Copyright 2005 Nokia. All rights reserved.
  *
@@ -2901,10 +2901,9 @@ __owur int ssl_validate_ct(SSL_CONNECTION *s);
 
 __owur EVP_PKEY *ssl_get_auto_dh(SSL_CONNECTION *s);
 
-__owur int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy,
-    int is_ee);
+__owur int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int is_ee);
 __owur int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk,
-    X509 *ex, int vfy);
+    X509 *ex);
 
 int tls_choose_sigalg(SSL_CONNECTION *s, int fatalerrs);
 
diff --git a/deps/openssl/openssl/ssl/ssl_rsa.c b/deps/openssl/openssl/ssl/ssl_rsa.c
index 740460f5c2e0..42958d9d0c2d 100644
--- a/deps/openssl/openssl/ssl/ssl_rsa.c
+++ b/deps/openssl/openssl/ssl/ssl_rsa.c
@@ -42,7 +42,7 @@ int SSL_use_certificate(SSL *ssl, X509 *x)
         return 0;
     }
 
-    rv = ssl_security_cert(sc, NULL, x, 0, 1);
+    rv = ssl_security_cert(sc, NULL, x, 1);
     if (rv != 1) {
         ERR_raise(ERR_LIB_SSL, rv);
         return 0;
@@ -247,7 +247,7 @@ int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
         return 0;
     }
 
-    rv = ssl_security_cert(NULL, ctx, x, 0, 1);
+    rv = ssl_security_cert(NULL, ctx, x, 1);
     if (rv != 1) {
         ERR_raise(ERR_LIB_SSL, rv);
         return 0;
@@ -993,13 +993,13 @@ static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *pr
 
     c = sc != NULL ? sc->cert : ctx->cert;
     /* Do all security checks before anything else */
-    rv = ssl_security_cert(sc, ctx, x509, 0, 1);
+    rv = ssl_security_cert(sc, ctx, x509, 1);
     if (rv != 1) {
         ERR_raise(ERR_LIB_SSL, rv);
         goto out;
     }
     for (j = 0; j < sk_X509_num(chain); j++) {
-        rv = ssl_security_cert(sc, ctx, sk_X509_value(chain, j), 0, 0);
+        rv = ssl_security_cert(sc, ctx, sk_X509_value(chain, j), 0);
         if (rv != 1) {
             ERR_raise(ERR_LIB_SSL, rv);
             goto out;
diff --git a/deps/openssl/openssl/ssl/statem/extensions.c b/deps/openssl/openssl/ssl/statem/extensions.c
index 2de540f828f0..13846bc11596 100644
--- a/deps/openssl/openssl/ssl/statem/extensions.c
+++ b/deps/openssl/openssl/ssl/statem/extensions.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -605,6 +605,11 @@ int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet,
             SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
             goto err;
         }
+
+        /* The server must tolerate the unknown extension and complete. */
+        if (thisex == NULL)
+            continue;
+
         idx = thisex - raw_extensions;
         /*-
          * Check that we requested this extension (if appropriate). Requests can
@@ -635,17 +640,15 @@ int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet,
                 SSL_R_UNSOLICITED_EXTENSION);
             goto err;
         }
-        if (thisex != NULL) {
-            thisex->data = extension;
-            thisex->present = 1;
-            thisex->type = type;
-            thisex->received_order = i++;
-            if (s->ext.debug_cb)
-                s->ext.debug_cb(SSL_CONNECTION_GET_USER_SSL(s), !s->server,
-                    thisex->type, PACKET_data(&thisex->data),
-                    PACKET_remaining(&thisex->data),
-                    s->ext.debug_arg);
-        }
+        thisex->data = extension;
+        thisex->present = 1;
+        thisex->type = type;
+        thisex->received_order = i++;
+        if (s->ext.debug_cb)
+            s->ext.debug_cb(SSL_CONNECTION_GET_USER_SSL(s), !s->server,
+                thisex->type, PACKET_data(&thisex->data),
+                (int)PACKET_remaining(&thisex->data),
+                s->ext.debug_arg);
     }
 
     if (init) {
diff --git a/deps/openssl/openssl/ssl/statem/statem_clnt.c b/deps/openssl/openssl/ssl/statem/statem_clnt.c
index b317b9392435..0279a62abd2e 100644
--- a/deps/openssl/openssl/ssl/statem/statem_clnt.c
+++ b/deps/openssl/openssl/ssl/statem/statem_clnt.c
@@ -2814,6 +2814,14 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s,
     if (SSL_CONNECTION_IS_TLS13(s)) {
         PACKET extpkt;
 
+        /*
+         * Fulfilling RFC8446:4.6.1 requirement: Clients MUST NOT cache
+         * tickets for longer than 7 days.
+         */
+        if (ticket_lifetime_hint > 604800) {
+            ticket_lifetime_hint = 604800;
+        }
+
         if (!PACKET_as_length_prefixed_2(pkt, &extpkt)
             || PACKET_remaining(pkt) != 0) {
             SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
diff --git a/deps/openssl/openssl/ssl/statem/statem_lib.c b/deps/openssl/openssl/ssl/statem/statem_lib.c
index 7e3be12f7a71..c69008708147 100644
--- a/deps/openssl/openssl/ssl/statem/statem_lib.c
+++ b/deps/openssl/openssl/ssl/statem/statem_lib.c
@@ -1071,7 +1071,7 @@ static int ssl_add_cert_chain(SSL_CONNECTION *s, WPACKET *pkt, CERT_PKEY *cpk, i
         /* Don't leave errors in the queue */
         ERR_clear_error();
         chain = X509_STORE_CTX_get0_chain(xs_ctx);
-        i = ssl_security_cert_chain(s, chain, NULL, 0);
+        i = ssl_security_cert_chain(s, chain, NULL);
         if (i != 1) {
 #if 0
             /* Dummy error calls so mkerr generates them */
@@ -1096,7 +1096,7 @@ static int ssl_add_cert_chain(SSL_CONNECTION *s, WPACKET *pkt, CERT_PKEY *cpk, i
         }
         X509_STORE_CTX_free(xs_ctx);
     } else {
-        i = ssl_security_cert_chain(s, extra_certs, x, 0);
+        i = ssl_security_cert_chain(s, extra_certs, x);
         if (i != 1) {
             if (!for_comp)
                 SSLfatal(s, SSL_AD_INTERNAL_ERROR, i);
diff --git a/deps/openssl/openssl/ssl/statem/statem_srvr.c b/deps/openssl/openssl/ssl/statem/statem_srvr.c
index b2f8a0ebc43d..03fcc6eeac79 100644
--- a/deps/openssl/openssl/ssl/statem/statem_srvr.c
+++ b/deps/openssl/openssl/ssl/statem/statem_srvr.c
@@ -3921,8 +3921,10 @@ CON_FUNC_RETURN tls_construct_server_compressed_certificate(SSL_CONNECTION *sc,
         || !WPACKET_put_bytes_u24(pkt, cc->orig_len)
         || !WPACKET_start_sub_packet_u24(pkt)
         || !WPACKET_memcpy(pkt, cc->data, cc->len)
-        || !WPACKET_close(pkt))
+        || !WPACKET_close(pkt)) {
+        SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         return 0;
+    }
 
     sc->s3.tmp.cert->cert_comp_used++;
     return 1;
@@ -4251,7 +4253,7 @@ CON_FUNC_RETURN tls_construct_new_session_ticket(SSL_CONNECTION *s, WPACKET *pkt
             SSL_SESSION *new_sess = ssl_session_dup(s->session, 0);
 
             if (new_sess == NULL) {
-                /* SSLfatal already called */
+                SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
                 goto err;
             }
 
diff --git a/deps/openssl/openssl/ssl/t1_lib.c b/deps/openssl/openssl/ssl/t1_lib.c
index e11fa8bc638e..ef1114172a28 100644
--- a/deps/openssl/openssl/ssl/t1_lib.c
+++ b/deps/openssl/openssl/ssl/t1_lib.c
@@ -1817,53 +1817,6 @@ void tls1_get_formatlist(SSL_CONNECTION *s, const unsigned char **pformats,
     }
 }
 
-/* Check a key is compatible with compression extension */
-static int tls1_check_pkey_comp(SSL_CONNECTION *s, EVP_PKEY *pkey)
-{
-    unsigned char comp_id;
-    size_t i;
-    int point_conv;
-
-    /* If not an EC key nothing to check */
-    if (!EVP_PKEY_is_a(pkey, "EC"))
-        return 1;
-
-    /* Get required compression id */
-    point_conv = EVP_PKEY_get_ec_point_conv_form(pkey);
-    if (point_conv == 0)
-        return 0;
-    if (point_conv == POINT_CONVERSION_UNCOMPRESSED) {
-        comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
-    } else if (SSL_CONNECTION_IS_TLS13(s)) {
-        /*
-         * ec_point_formats extension is not used in TLSv1.3 so we ignore
-         * this check.
-         */
-        return 1;
-    } else {
-        int field_type = EVP_PKEY_get_field_type(pkey);
-
-        if (field_type == NID_X9_62_prime_field)
-            comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
-        else if (field_type == NID_X9_62_characteristic_two_field)
-            comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
-        else
-            return 0;
-    }
-    /*
-     * If point formats extension present check it, otherwise everything is
-     * supported (see RFC4492).
-     */
-    if (s->ext.peer_ecpointformats == NULL)
-        return 1;
-
-    for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
-        if (s->ext.peer_ecpointformats[i] == comp_id)
-            return 1;
-    }
-    return 0;
-}
-
 /* Return group id of a key */
 static uint16_t tls1_get_group_id(EVP_PKEY *pkey)
 {
@@ -1888,9 +1841,6 @@ static int tls1_check_cert_param(SSL_CONNECTION *s, X509 *x, int check_ee_md)
     /* If not EC nothing to do */
     if (!EVP_PKEY_is_a(pkey, "EC"))
         return 1;
-    /* Check compression */
-    if (!tls1_check_pkey_comp(s, pkey))
-        return 0;
     group_id = tls1_get_group_id(pkey);
     /*
      * For a server we allow the certificate to not be in our list of supported
@@ -2788,13 +2738,6 @@ int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey)
 
     if (pkeyid == EVP_PKEY_EC) {
 
-        /* Check point compression is permitted */
-        if (!tls1_check_pkey_comp(s, pkey)) {
-            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
-                SSL_R_ILLEGAL_POINT_COMPRESSION);
-            return 0;
-        }
-
         /* For TLS 1.3 or Suite B check curve matches signature algorithm */
         if (SSL_CONNECTION_IS_TLS13(s) || tls1_suiteb(s)) {
             int curve = ssl_get_EC_curve_nid(pkey);
@@ -4057,8 +4000,6 @@ int tls1_check_chain(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pk,
         chain = cpk->chain;
         strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
         if (tls12_rpk_and_privkey(s, idx)) {
-            if (EVP_PKEY_is_a(pk, "EC") && !tls1_check_pkey_comp(s, pk))
-                return 0;
             *pvalid = rv = CERT_PKEY_RPK;
             return rv;
         }
@@ -4401,51 +4342,29 @@ static int ssl_security_cert_key(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
         return ssl_ctx_security(ctx, op, secbits, 0, x);
 }
 
-static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
-    int op)
+int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int is_ee)
 {
-    /* Lookup signature algorithm digest */
-    int secbits, nid, pknid;
-
-    /* Don't check signature if self signed */
-    if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)
-        return 1;
-    if (!X509_get_signature_info(x, &nid, &pknid, &secbits, NULL))
-        secbits = -1;
-    /* If digest NID not defined use signature NID */
-    if (nid == NID_undef)
-        nid = pknid;
-    if (s != NULL)
-        return ssl_security(s, op, secbits, nid, x);
-    else
-        return ssl_ctx_security(ctx, op, secbits, nid, x);
-}
-
-int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy,
-    int is_ee)
-{
-    if (vfy)
-        vfy = SSL_SECOP_PEER;
     if (is_ee) {
-        if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
+        if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY))
             return SSL_R_EE_KEY_TOO_SMALL;
     } else {
-        if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
+        if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY))
             return SSL_R_CA_KEY_TOO_SMALL;
     }
-    if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
-        return SSL_R_CA_MD_TOO_WEAK;
     return 1;
 }
 
 /*
- * Check security of a chain, if |sk| includes the end entity certificate then
- * |x| is NULL. If |vfy| is 1 then we are verifying a peer chain and not sending
- * one to the peer. Return values: 1 if ok otherwise error code to use
+ * Call ssl_security_check() on all certificates in a stack.
+ * If |x| is non NULL it is checked first, before checking the
+ * certificates in the stack.
+ *
+ * Return values: 1 if ok otherwise the error code from the first
+ * failing ssl_security_check().;
  */
 
 int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk,
-    X509 *x, int vfy)
+    X509 *x)
 {
     int rv, start_idx, i;
 
@@ -4457,13 +4376,13 @@ int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk,
     } else
         start_idx = 0;
 
-    rv = ssl_security_cert(s, NULL, x, vfy, 1);
+    rv = ssl_security_cert(s, NULL, x, 1);
     if (rv != 1)
         return rv;
 
     for (i = start_idx; i < sk_X509_num(sk); i++) {
         x = sk_X509_value(sk, i);
-        rv = ssl_security_cert(s, NULL, x, vfy, 0);
+        rv = ssl_security_cert(s, NULL, x, 0);
         if (rv != 1)
             return rv;
     }
@@ -4523,6 +4442,20 @@ static int check_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig,
     if (supported <= 0)
         return 0;
 
+    /*
+     * When RPK is negotiated there are no certificate signatures to
+     * constrain, and there may not even be a certificate configured.
+     */
+    if (TLSEXT_cert_type_rpk == (s->server ? s->ext.server_cert_type : s->ext.client_cert_type))
+        return 1;
+
+    /*
+     * RPK was enabled, adding candidate private-key-only slots, but was not
+     * negotiated, so the key-only slot is not usable.
+     */
+    if (x == NULL)
+        return 0;
+
     /*
      * The TLS 1.3 signature_algorithms_cert extension places restrictions
      * on the sigalg with which the certificate was signed (by its issuer).
diff --git a/deps/openssl/openssl/util/missingcrypto.txt b/deps/openssl/openssl/util/missingcrypto.txt
index 16ca0e49dfa0..ad0f165fa6ba 100644
--- a/deps/openssl/openssl/util/missingcrypto.txt
+++ b/deps/openssl/openssl/util/missingcrypto.txt
@@ -590,8 +590,6 @@ LONG_it(3)
 MD2_options(3)
 MD4_Transform(3)
 MD5_Transform(3)
-NAME_CONSTRAINTS_check(3)
-NAME_CONSTRAINTS_check_CN(3)
 NAME_CONSTRAINTS_it(3)
 NAMING_AUTHORITY_it(3)
 NCONF_WIN32(3)
diff --git a/deps/openssl/openssl/util/other.syms b/deps/openssl/openssl/util/other.syms
index ba188d46c796..0bb7b92bd69b 100644
--- a/deps/openssl/openssl/util/other.syms
+++ b/deps/openssl/openssl/util/other.syms
@@ -2,10 +2,12 @@
 # that don't appear in lib*.num -- because they are define's, in
 # assembly language, etc.
 #
+OPENSSL_armcap                          environment
 OPENSSL_ia32cap                         environment
 OPENSSL_ppccap                          environment
-OPENSSL_s390xcap                        environment
 OPENSSL_riscvcap                        environment
+OPENSSL_s390xcap                        environment
+OPENSSL_sparcv9cap                      environment
 OPENSSL_MALLOC_FD                       environment
 OPENSSL_MALLOC_FAILURES                 environment
 OPENSSL_instrument_bus                  assembler
@@ -783,6 +785,7 @@ SSL_VALUE_CLASS_FEATURE_REQUEST         define
 SSL_VALUE_CLASS_FEATURE_PEER_REQUEST    define
 SSL_VALUE_CLASS_FEATURE_NEGOTIATED      define
 SSL_VALUE_QUIC_IDLE_TIMEOUT             define
+SSL_VALUE_QUIC_MAX_PENDING_CONNS        define
 SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL  define
 SSL_VALUE_QUIC_STREAM_BIDI_REMOTE_AVAIL define
 SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL   define
diff --git a/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm b/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm
index c3db4e28db0f..729b351b3f0a 100644
--- a/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm
+++ b/deps/openssl/openssl/util/perl/TLSProxy/Proxy.pm
@@ -1,4 +1,4 @@
-# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -177,6 +177,7 @@ sub init
         server_port => 0,
         serverpid => 0,
         clientpid => 0,
+        clientexit => 0,
         execute => $execute,
         cert => $cert,
         debug => $debug,
@@ -215,6 +216,7 @@ sub clearClient
     $self->{clientflags} = "";
     $self->{sessionfile} = undef;
     $self->{clientpid} = 0;
+    $self->{clientexit} = 0;
     $is_tls13 = 0;
     $ciphersuite = undef;
 
@@ -585,6 +587,7 @@ sub clientstart
     $pid = $self->{clientpid};
     print "Waiting for s_client process to close: $pid...\n";
     waitpid($pid, 0);
+    $self->{clientexit} = $?;
 
     return $success;
 }
@@ -722,6 +725,11 @@ sub clientpid
     my $self = shift;
     return $self->{clientpid};
 }
+sub clientexit
+{
+    my $self = shift;
+    return $self->{clientexit};
+}
 
 #Read/write accessors
 sub filter
diff --git a/deps/perfetto/VERSION b/deps/perfetto/VERSION
index 06b0aef2d7b5..5132e635a5f8 100644
--- a/deps/perfetto/VERSION
+++ b/deps/perfetto/VERSION
@@ -1 +1 @@
-57.2
+58.2
diff --git a/deps/perfetto/sdk/perfetto.cc b/deps/perfetto/sdk/perfetto.cc
index 4df59d2c46dd..739d48322046 100644
--- a/deps/perfetto/sdk/perfetto.cc
+++ b/deps/perfetto/sdk/perfetto.cc
@@ -94,6 +94,109 @@ void AfterMaybeBlockingSyscall() {}
 }  // namespace platform
 }  // namespace base
 }  // namespace perfetto
+// gen_amalgamated begin source: src/base/check_cpu_optimizations.cc
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Startup check that the CPU supports the extensions (SSE4.2, AVX2, BMI2,
+// LZCNT) the binary is built with when enable_perfetto_x64_cpu_opt is set; if
+// not, it prints an error and exits.
+//
+// Must be built for the baseline x86_64 ISA (its target subtracts
+// config("x64_cpu_opt") in src/base/BUILD.gn), else the check could itself use
+// instructions the CPU lacks. Context:
+// https://github.com/google/perfetto/discussions/5138
+
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/base/export.h"
+
+#if PERFETTO_BUILDFLAG(PERFETTO_X64_CPU_OPT)
+
+#include <stdio.h>
+#include <unistd.h>  // For _exit().
+
+namespace {
+
+// Preserve the %rbx register via %rdi to work around a clang bug
+// https://bugs.llvm.org/show_bug.cgi?id=17907 (%rbx in an output constraint
+// is not considered a clobbered register).
+#define PERFETTO_GETCPUID(a, b, c, d, a_inp, c_inp) \
+  asm("mov %%rbx, %%rdi\n"                          \
+      "cpuid\n"                                     \
+      "xchg %%rdi, %%rbx\n"                         \
+      : "=a"(a), "=D"(b), "=c"(c), "=d"(d)          \
+      : "a"(a_inp), "2"(c_inp))
+
+uint32_t GetXCR0EAX() {
+  uint32_t eax = 0, edx = 0;
+  asm("xgetbv" : "=a"(eax), "=d"(edx) : "c"(0));
+  return eax;
+}
+
+// If we are building with -msse4 check that the CPU actually supports it.
+// This file must be kept in sync with gn/standalone/BUILD.gn.
+void PERFETTO_EXPORT_COMPONENT __attribute__((constructor))
+CheckCpuOptimizations() {
+  uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
+  PERFETTO_GETCPUID(eax, ebx, ecx, edx, 1, 0);
+
+  static constexpr uint64_t xcr0_xmm_mask = 0x2;
+  static constexpr uint64_t xcr0_ymm_mask = 0x4;
+  static constexpr uint64_t xcr0_avx_mask = xcr0_xmm_mask | xcr0_ymm_mask;
+
+  const bool have_popcnt = ecx & (1u << 23);
+  const bool have_sse4_2 = ecx & (1u << 20);
+  const bool have_avx =
+      // Does the OS save/restore XMM and YMM state?
+      (ecx & (1u << 27)) &&  // OS support XGETBV.
+      (ecx & (1u << 28)) &&  // AVX supported in hardware
+      ((GetXCR0EAX() & xcr0_avx_mask) == xcr0_avx_mask);
+
+  // Get level 7 features (eax = 7 and ecx= 0), to check for AVX2 support.
+  // (See Intel 64 and IA-32 Architectures Software Developer's Manual
+  //  Volume 2A: Instruction Set Reference, A-M CPUID).
+  PERFETTO_GETCPUID(eax, ebx, ecx, edx, 7, 0);
+  const bool have_avx2 = have_avx && ((ebx >> 5) & 0x1);
+  const bool have_bmi = (ebx >> 3) & 0x1;
+  const bool have_bmi2 = (ebx >> 8) & 0x1;
+
+  // Get extended features for LZCNT.
+  PERFETTO_GETCPUID(eax, ebx, ecx, edx, 0x80000001, 0);
+  const bool have_lzcnt = ecx & (1u << 5);
+
+  if (!have_sse4_2 || !have_popcnt || !have_avx2 || !have_bmi || !have_bmi2 ||
+      !have_lzcnt) {
+    fprintf(
+        stderr,
+        "This executable requires a x86_64 cpu that supports SSE4.2, BMI2, "
+        "AVX2 and LZCNT.\n"
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
+        "On MacOS, this might be caused by running x86_64 binaries on arm64.\n"
+        "See https://github.com/google/perfetto/issues/294 for more.\n"
+#endif
+        "Rebuild with enable_perfetto_x64_cpu_opt=false.\n");
+    _exit(126);
+  }
+}
+
+}  // namespace
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_X64_CPU_OPT)
 // gen_amalgamated begin source: src/base/android_utils.cc
 // gen_amalgamated begin header: include/perfetto/ext/base/android_utils.h
 /*
@@ -1148,10 +1251,12 @@ constexpr pid_t kInvalidPid = static_cast<pid_t>(-1);
 #include <errno.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <stdio.h>
 #include <stdlib.h>
 
 #include <atomic>
 #include <functional>
+#include <limits>
 #include <memory>
 #include <string>
 
@@ -1199,6 +1304,54 @@ constexpr size_t ArraySize(const T (&)[TSize]) {
   return TSize;
 }
 
+// Adds `a` and `b`, clamping to INT64_MIN / INT64_MAX on overflow instead of
+// wrapping (which is UB and can flip the sign of the result).
+inline int64_t SaturatingAdd(int64_t a, int64_t b) {
+  constexpr int64_t kMax = std::numeric_limits<int64_t>::max();
+  constexpr int64_t kMin = std::numeric_limits<int64_t>::min();
+#if defined(__clang__) || defined(__GNUC__)
+  int64_t result;
+  if (PERFETTO_UNLIKELY(__builtin_add_overflow(a, b, &result)))
+    return a < 0 ? kMin : kMax;
+  return result;
+#else
+  if (b > 0 && a > kMax - b)
+    return kMax;
+  if (b < 0 && a < kMin - b)
+    return kMin;
+  return a + b;
+#endif
+}
+
+// Multiplies `a` by `b`, clamping to INT64_MIN / INT64_MAX on overflow instead
+// of wrapping (which is UB and can flip the sign of the result).
+inline int64_t SaturatingMultiply(int64_t a, int64_t b) {
+  constexpr int64_t kMax = std::numeric_limits<int64_t>::max();
+  constexpr int64_t kMin = std::numeric_limits<int64_t>::min();
+#if defined(__clang__) || defined(__GNUC__)
+  int64_t result;
+  if (PERFETTO_UNLIKELY(__builtin_mul_overflow(a, b, &result))) {
+    // On overflow the true product's sign is the XOR of the operands' signs.
+    // Neither operand can be zero here (0 never overflows).
+    return ((a < 0) == (b < 0)) ? kMax : kMin;
+  }
+  return result;
+#else
+  // Portable fallback (e.g. MSVC cl.exe): detect overflow *before* multiplying
+  // by dividing a limit by one operand, which never itself overflows.
+  if (a == 0 || b == 0)
+    return 0;
+  if ((a < 0) == (b < 0)) {  // Same sign: product is positive.
+    if (a > 0 ? (a > kMax / b) : (a < kMax / b))
+      return kMax;
+  } else {  // Opposite signs: product is negative.
+    if (a > 0 ? (b < kMin / a) : (a < kMin / b))
+      return kMin;
+  }
+  return a * b;
+#endif
+}
+
 // Function object which invokes 'free' on its parameter, which must be
 // a pointer. Can be used to store malloc-allocated pointers in std::unique_ptr:
 //
@@ -1221,11 +1374,39 @@ inline constexpr size_t AlignUp(size_t size, size_t alignment) {
   return (size + alignment - 1) & ~(alignment - 1);
 }
 
+// Round down |size| to a multiple of |alignment| (must be a power of two).
+inline constexpr size_t AlignDown(size_t size, size_t alignment) {
+  return size & ~(alignment - 1);
+}
+
+template <typename T>
+inline constexpr bool IsPowerOfTwo(T x) {
+  static_assert(std::is_unsigned_v<T> && std::is_integral_v<T>,
+                "T must be an unsigned integer");
+  return x != 0 && (x & (x - 1)) == 0;
+}
+
+// Returns the smallest power of two greater than or equal to |x|. Returns zero
+// for zero or when the result is not representable by T.
+template <typename T>
+inline constexpr T RoundUpToPowerOfTwo(T x) {
+  static_assert(std::is_unsigned_v<T> && std::is_integral_v<T>,
+                "T must be an unsigned integer");
+  if (x == 0) {
+    return 0;
+  }
+  --x;
+  for (size_t shift = 1; shift < sizeof(T) * 8; shift *= 2) {
+    x |= x >> shift;
+  }
+  return ++x;
+}
+
 // TODO(primiano): clean this up and move all existing usages to the constexpr
 // version above.
 template <size_t alignment>
 constexpr size_t AlignUp(size_t size) {
-  static_assert((alignment & (alignment - 1)) == 0, "alignment must be a pow2");
+  static_assert(IsPowerOfTwo(alignment), "alignment must be a pow2");
   return AlignUp(size, alignment);
 }
 
@@ -1239,6 +1420,13 @@ void SetEnv(const std::string& key, const std::string& value);
 // unsetenv(2)-equivalent. Deals with Windows vs Posix discrepancies.
 void UnsetEnv(const std::string& key);
 
+// Returns true if |fd| is connected to an interactive terminal (TTY). Deals
+// with Windows vs Posix discrepancies (isatty() vs _isatty()).
+bool IsTty(int fd);
+
+// Convenience overload for C stdio streams (e.g. stdin/stdout/stderr).
+bool IsTty(FILE* stream);
+
 // Calls mallopt(M_PURGE, 0) on Android. Does nothing on other platforms.
 // This forces the allocator to release freed memory. This is used to work
 // around various Scudo inefficiencies. See b/170217718.
@@ -1248,10 +1436,10 @@ void MaybeReleaseAllocatorMemToOS();
 uid_t GetCurrentUserId();
 
 // Forks the process.
-// Parent: prints the PID of the child, calls |parent_cb| and exits from the
-//         process with its return value.
+// Parent: calls |parent_cb| with the child's PID and exits with its return
+//         value. The callback owns any startup output (e.g. printing the PID).
 // Child: redirects stdio onto /dev/null, chdirs into / and returns.
-void Daemonize(std::function<int()> parent_cb);
+void Daemonize(std::function<int(pid_t)> parent_cb);
 
 // Returns the path of the current executable, e.g. /foo/bar/exe.
 std::string GetCurExecutablePath();
@@ -1896,6 +2084,7 @@ using ScopedDir = ScopedResource<DIR*, closedir, nullptr>;
 
 #include <fcntl.h>  // For mode_t & O_RDONLY/RDWR. Exists also on Windows.
 #include <stddef.h>
+#include <stdint.h>
 
 #include <functional>
 #include <memory>
@@ -1977,6 +2166,16 @@ int PERFETTO_EXPORT_COMPONENT CloseFile(int fd);
 
 bool FlushFile(int fd);
 
+// Moves the file offset to |offset| bytes from the beginning of the file.
+// Returns false if |offset| cannot be represented by the platform or the seek
+// fails.
+bool SeekFile(int fd, uint64_t offset);
+
+// Changes the size of an open file to |size| bytes.
+// Returns false if |size| cannot be represented by the platform or truncation
+// fails.
+bool TruncateFile(int fd, uint64_t size);
+
 // Returns true if mkdir succeeds, false if it fails (see errno in that case).
 // `mode` is the permission bits for the new directory; it is ignored on
 // Windows.
@@ -1992,6 +2191,9 @@ bool Unlink(const char* path);
 // Wrapper around access(path, F_OK).
 bool FileExists(const std::string& path);
 
+// Returns true if the path exists and is a directory.
+bool DirectoryExists(const std::string& path);
+
 // Gets the extension for a filename. If the file has two extensions, returns
 // only the last one (foo.pb.gz => .gz). Returns empty string if there is no
 // extension.
@@ -2021,6 +2223,22 @@ std::string Basename(const std::string& path);
 //   Dirname("C:\\Windows\\System32") => "C:\\Windows"
 std::string Dirname(const std::string& path);
 
+// Returns the length of the leading root component of a path: "/" on UNIX,
+// "C:\" or "\\" (UNC) on Windows. Returns 0 if the path is relative. Like
+// Basename() and Dirname(), both '/' and '\' are recognized on all platforms.
+// Stripping the returned prefix turns the path into a relative one.
+// Examples:
+//   PathRootPrefixLength("/usr/bin/ls") => 1
+//   PathRootPrefixLength("//usr/bin") => 2
+//   PathRootPrefixLength("C:\\Windows") => 3
+//   PathRootPrefixLength("C:foo") => 0 (relative to the current dir of drive
+//   C:) PathRootPrefixLength("foo/bar") => 0
+size_t PathRootPrefixLength(const std::string& path);
+
+// Returns true if the path starts with a root component. See
+// PathRootPrefixLength().
+bool IsAbsolutePath(const std::string& path);
+
 // Puts the path to all files under |dir_path| in |output|, recursively walking
 // subdirectories. File paths are relative to |dir_path|. Only files are
 // included, not directories. Path separator is always '/', even on windows (not
@@ -2046,6 +2264,13 @@ std::optional<uint64_t> GetFileSize(const std::string& path);
 // Returns the size of the open file |fd|, or nullopt in case of error.
 std::optional<uint64_t> GetFileSize(PlatformHandle fd);
 
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+// On Windows PlatformHandle is a HANDLE, not a file descriptor. This overload
+// accepts the CRT file descriptors returned by base::OpenFile(). On other
+// platforms PlatformHandle is an int, so the overload above already covers it.
+std::optional<uint64_t> GetFileSize(int fd);
+#endif
+
 // This class uses inotify (on Linux/Android) to watch for the creation of
 // files in the filesystem. When the specified file is created, it triggers a
 // callback function.
@@ -3521,6 +3746,7 @@ class WeakPtrFactory {
 
 #include <algorithm>
 #include <deque>
+#include <limits>
 #include <optional>
 #include <string>
 #include <vector>
@@ -3765,6 +3991,52 @@ bool FlushFile(int fd) {
 #endif
 }
 
+bool SeekFile(int fd, uint64_t offset) {
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  if (fd < 0) {
+    errno = EBADF;
+    return false;
+  }
+  if (offset > static_cast<uint64_t>(std::numeric_limits<int64_t>::max())) {
+    errno = EOVERFLOW;
+    return false;
+  }
+  return _lseeki64(fd, static_cast<int64_t>(offset), SEEK_SET) != -1;
+#else
+  if (offset > static_cast<uint64_t>(std::numeric_limits<off_t>::max())) {
+    errno = EOVERFLOW;
+    return false;
+  }
+  return lseek(fd, static_cast<off_t>(offset), SEEK_SET) !=
+         static_cast<off_t>(-1);
+#endif
+}
+
+bool TruncateFile(int fd, uint64_t size) {
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  if (fd < 0) {
+    errno = EBADF;
+    return false;
+  }
+  if (size > static_cast<uint64_t>(std::numeric_limits<int64_t>::max())) {
+    errno = EOVERFLOW;
+    return false;
+  }
+  int result = _chsize_s(fd, static_cast<int64_t>(size));
+  if (result != 0) {
+    errno = result;
+    return false;
+  }
+  return true;
+#else
+  if (size > static_cast<uint64_t>(std::numeric_limits<off_t>::max())) {
+    errno = EOVERFLOW;
+    return false;
+  }
+  return PERFETTO_EINTR(ftruncate(fd, static_cast<off_t>(size))) == 0;
+#endif
+}
+
 bool Mkdir(const std::string& path, uint32_t mode) {
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
   base::ignore_result(mode);
@@ -3847,6 +4119,22 @@ bool FileExists(const std::string& path) {
 #endif
 }
 
+bool DirectoryExists(const std::string& path) {
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  DWORD attrs = GetFileAttributesA(path.c_str());
+  return attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_DIRECTORY);
+#else
+  struct stat st;
+  if (stat(path.c_str(), &st) != 0) {
+    return false;
+  }
+  // MSan's stat() interceptor on glibc 2.35+ does not mark the output buffer
+  // as initialized (the syscall goes through statx).
+  PERFETTO_MSAN_UNPOISON(&st, sizeof(st));
+  return S_ISDIR(st.st_mode);
+#endif
+}
+
 // Declared in base/platform_handle.h.
 int ClosePlatformHandle(PlatformHandle handle) {
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
@@ -4064,6 +4352,27 @@ std::string Dirname(const std::string& path) {
   return p.substr(0, last_sep);
 }
 
+size_t PathRootPrefixLength(const std::string& path) {
+  size_t pos = 0;
+  // Skip over a leading drive letter, e.g. "C:\foo".
+  bool has_drive_letter = path.size() >= 2 && path[1] == ':' &&
+                          ((path[0] >= 'a' && path[0] <= 'z') ||
+                           (path[0] >= 'A' && path[0] <= 'Z'));
+  if (has_drive_letter)
+    pos = 2;
+
+  size_t end = path.find_first_not_of("/\\", pos);
+  end = end == std::string::npos ? path.size() : end;
+
+  // A drive letter not followed by a separator ("C:foo") is relative to the
+  // current directory of that drive, not absolute.
+  return end > pos ? end : 0;
+}
+
+bool IsAbsolutePath(const std::string& path) {
+  return PathRootPrefixLength(path) != 0;
+}
+
 base::Status SetFilePermissions(const std::string& file_path,
                                 const std::string& group_name_or_id,
                                 const std::string& mode_bits) {
@@ -4147,6 +4456,12 @@ std::optional<uint64_t> GetFileSize(PlatformHandle fd) {
 #endif
 }
 
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+std::optional<uint64_t> GetFileSize(int fd) {
+  return GetFileSize(reinterpret_cast<PlatformHandle>(_get_osfhandle(fd)));
+}
+#endif
+
 // LinuxFileWatch
 
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX_BUT_NOT_QNX) || \
@@ -7564,9 +7879,14 @@ ScopedPlatformHandle OpenFileForMmap(const std::string& file_path) {
   return OpenFile(file_path, O_RDONLY);
 #elif PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
   // This does not use base::OpenFile to avoid getting an exclusive lock.
+  //
+  // The share flags mirror the POSIX open(O_RDONLY) above, which has no notion
+  // of share modes. Same flags as LLVM's openNativeFileInternal():
+  // https://github.com/llvm/llvm-project/blob/main/llvm/lib/Support/Windows/Path.inc
   return ScopedPlatformHandle(
-      CreateFileA(file_path.c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr,
-                  OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr));
+      CreateFileA(file_path.c_str(), GENERIC_READ,
+                  FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                  nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr));
 #else
   // mmap is not supported. Do not even open the file.
   base::ignore_result(file_path);
@@ -9746,7 +10066,11 @@ std::optional<int32_t> GetTimezoneOffsetMins() {
     PERFETTO_BUILDFLAG(PERFETTO_OS_FUCHSIA)
 #include <limits.h>
 #include <stdlib.h>  // For _exit()
-#include <unistd.h>  // For getpagesize() and geteuid() & fork() & sysconf()
+#endif
+
+#if !PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+// For isatty(), getpagesize(), geteuid(), fork() & sysconf().
+#include <unistd.h>
 #endif
 
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
@@ -9808,75 +10132,6 @@ using MalloptType = int (*)(int, int);
 }  // namespace
 #endif  // OS_ANDROID
 
-namespace {
-
-#if PERFETTO_BUILDFLAG(PERFETTO_X64_CPU_OPT)
-
-// Preserve the %rbx register via %rdi to work around a clang bug
-// https://bugs.llvm.org/show_bug.cgi?id=17907 (%rbx in an output constraint
-// is not considered a clobbered register).
-#define PERFETTO_GETCPUID(a, b, c, d, a_inp, c_inp) \
-  asm("mov %%rbx, %%rdi\n"                          \
-      "cpuid\n"                                     \
-      "xchg %%rdi, %%rbx\n"                         \
-      : "=a"(a), "=D"(b), "=c"(c), "=d"(d)          \
-      : "a"(a_inp), "2"(c_inp))
-
-uint32_t GetXCR0EAX() {
-  uint32_t eax = 0, edx = 0;
-  asm("xgetbv" : "=a"(eax), "=d"(edx) : "c"(0));
-  return eax;
-}
-
-// If we are building with -msse4 check that the CPU actually supports it.
-// This file must be kept in sync with gn/standalone/BUILD.gn.
-void PERFETTO_EXPORT_COMPONENT __attribute__((constructor))
-CheckCpuOptimizations() {
-  uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
-  PERFETTO_GETCPUID(eax, ebx, ecx, edx, 1, 0);
-
-  static constexpr uint64_t xcr0_xmm_mask = 0x2;
-  static constexpr uint64_t xcr0_ymm_mask = 0x4;
-  static constexpr uint64_t xcr0_avx_mask = xcr0_xmm_mask | xcr0_ymm_mask;
-
-  const bool have_popcnt = ecx & (1u << 23);
-  const bool have_sse4_2 = ecx & (1u << 20);
-  const bool have_avx =
-      // Does the OS save/restore XMM and YMM state?
-      (ecx & (1u << 27)) &&  // OS support XGETBV.
-      (ecx & (1u << 28)) &&  // AVX supported in hardware
-      ((GetXCR0EAX() & xcr0_avx_mask) == xcr0_avx_mask);
-
-  // Get level 7 features (eax = 7 and ecx= 0), to check for AVX2 support.
-  // (See Intel 64 and IA-32 Architectures Software Developer's Manual
-  //  Volume 2A: Instruction Set Reference, A-M CPUID).
-  PERFETTO_GETCPUID(eax, ebx, ecx, edx, 7, 0);
-  const bool have_avx2 = have_avx && ((ebx >> 5) & 0x1);
-  const bool have_bmi = (ebx >> 3) & 0x1;
-  const bool have_bmi2 = (ebx >> 8) & 0x1;
-
-  // Get extended features for LZCNT.
-  PERFETTO_GETCPUID(eax, ebx, ecx, edx, 0x80000001, 0);
-  const bool have_lzcnt = ecx & (1u << 5);
-
-  if (!have_sse4_2 || !have_popcnt || !have_avx2 || !have_bmi || !have_bmi2 ||
-      !have_lzcnt) {
-    fprintf(
-        stderr,
-        "This executable requires a x86_64 cpu that supports SSE4.2, BMI2, "
-        "AVX2 and LZCNT.\n"
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
-        "On MacOS, this might be caused by running x86_64 binaries on arm64.\n"
-        "See https://github.com/google/perfetto/issues/294 for more.\n"
-#endif
-        "Rebuild with enable_perfetto_x64_cpu_opt=false.\n");
-    _exit(126);
-  }
-}
-#endif
-
-}  // namespace
-
 namespace perfetto {
 namespace base {
 
@@ -9958,7 +10213,23 @@ void UnsetEnv(const std::string& key) {
 #endif
 }
 
-void Daemonize(std::function<int()> parent_cb) {
+bool IsTty(int fd) {
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  return ::_isatty(fd) != 0;
+#else
+  return ::isatty(fd) != 0;
+#endif
+}
+
+bool IsTty(FILE* stream) {
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN)
+  return IsTty(::_fileno(stream));
+#else
+  return IsTty(::fileno(stream));
+#endif
+}
+
+void Daemonize(std::function<int(pid_t)> parent_cb) {
 #if PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) ||   \
     PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) || \
     PERFETTO_BUILDFLAG(PERFETTO_OS_FREEBSD) || \
@@ -9994,8 +10265,7 @@ void Daemonize(std::function<int()> parent_cb) {
       pipe.wr.reset();
       char one = '\0';
       PERFETTO_CHECK(Read(*pipe.rd, &one, sizeof(one)) == 1 && one == '1');
-      printf("%d\n", pid);
-      int err = parent_cb();
+      int err = parent_cb(pid);
       exit(err);
     }
   }
@@ -10572,7 +10842,8 @@ constexpr uint32_t kWatchdogDefaultCpuWindow = 10 * 60 * 1000;  // 10 minutes.
 
 // The default memory margin we give to our processes. This is used as as a
 // constant to put on top of the trace buffers.
-constexpr uint64_t kWatchdogDefaultMemorySlack = 32 * 1024 * 1024;  // 32 MiB.
+// TODO(b/540573436): Retune the value once we have a proper solution.
+constexpr uint64_t kWatchdogDefaultMemorySlack = 64 * 1024 * 1024;  // 64 MiB.
 constexpr uint32_t kWatchdogDefaultMemoryWindow = 30 * 1000;  // 30 seconds.
 
 inline void RunTaskWithWatchdogGuard(const std::function<void()>& task) {
@@ -11258,7 +11529,6 @@ void WeakRunner::PostDelayedTask(std::function<void()> f,
 #define PERFETTO_FLAGS_BUFFER_CLONE_PRESERVE_READ_ITER true
 #define PERFETTO_FLAGS_USE_UNIX_SOCKET_INOTIFY \
   PERFETTO_BUILDFLAG(PERFETTO_ENABLE_SOCK_INOTIFY)
-#define PERFETTO_FLAGS_TRACK_EVENT_INCREMENTAL_STATE_CLEAR_NOT_DESTROY true
 #define PERFETTO_FLAGS_TRIGGER_PERFETTO_ON_TRACED_PROBES_DISCONNECT false
 #define PERFETTO_FLAGS_USE_PCRE2 PERFETTO_BUILDFLAG(PERFETTO_PCRE2)
 #define PERFETTO_FLAGS_SYS_STATS_LARGE_READ true
@@ -13917,7 +14187,7 @@ void Subprocess::StdoutErrThread(MovableState* s) {
     if (!res) {
       auto err = GetLastError();
       if (err != ERROR_BROKEN_PIPE)
-        PERFETTO_PLOG("Subprocess ReadFile(stdouterr) failed %ld", err);
+        PERFETTO_PLOG("Subprocess ReadFile(stdouterr) failed %lx", err);
     }
 
     if (rsize > 0) {
@@ -19970,6 +20240,7 @@ bool TraceStats_BufferStats::operator==(const TraceStats_BufferStats& other) con
    && ::protozero::internal::gen_helpers::EqualsField(padding_bytes_cleared_, other.padding_bytes_cleared_)
    && ::protozero::internal::gen_helpers::EqualsField(chunks_written_, other.chunks_written_)
    && ::protozero::internal::gen_helpers::EqualsField(chunks_rewritten_, other.chunks_rewritten_)
+   && ::protozero::internal::gen_helpers::EqualsField(chunks_relocated_, other.chunks_relocated_)
    && ::protozero::internal::gen_helpers::EqualsField(chunks_overwritten_, other.chunks_overwritten_)
    && ::protozero::internal::gen_helpers::EqualsField(chunks_discarded_, other.chunks_discarded_)
    && ::protozero::internal::gen_helpers::EqualsField(chunks_read_, other.chunks_read_)
@@ -19980,8 +20251,7 @@ bool TraceStats_BufferStats::operator==(const TraceStats_BufferStats& other) con
    && ::protozero::internal::gen_helpers::EqualsField(readaheads_succeeded_, other.readaheads_succeeded_)
    && ::protozero::internal::gen_helpers::EqualsField(readaheads_failed_, other.readaheads_failed_)
    && ::protozero::internal::gen_helpers::EqualsField(abi_violations_, other.abi_violations_)
-   && ::protozero::internal::gen_helpers::EqualsField(trace_writer_packet_loss_, other.trace_writer_packet_loss_)
-   && ::protozero::internal::gen_helpers::EqualsField(shadow_buffer_stats_, other.shadow_buffer_stats_);
+   && ::protozero::internal::gen_helpers::EqualsField(trace_writer_packet_loss_, other.trace_writer_packet_loss_);
 }
 
 bool TraceStats_BufferStats::ParseFromArray(const void* raw, size_t size) {
@@ -20018,6 +20288,9 @@ bool TraceStats_BufferStats::ParseFromArray(const void* raw, size_t size) {
       case 10 /* chunks_rewritten */:
         field.get(&chunks_rewritten_);
         break;
+      case 20 /* chunks_relocated */:
+        field.get(&chunks_relocated_);
+        break;
       case 3 /* chunks_overwritten */:
         field.get(&chunks_overwritten_);
         break;
@@ -20051,9 +20324,6 @@ bool TraceStats_BufferStats::ParseFromArray(const void* raw, size_t size) {
       case 19 /* trace_writer_packet_loss */:
         field.get(&trace_writer_packet_loss_);
         break;
-      case 21 /* shadow_buffer_stats */:
-        (*shadow_buffer_stats_).ParseFromArray(field.data(), field.size());
-        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -20115,6 +20385,11 @@ void TraceStats_BufferStats::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(10, chunks_rewritten_, msg);
   }
 
+  // Field 20: chunks_relocated
+  if (_has_field_[20]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(20, chunks_relocated_, msg);
+  }
+
   // Field 3: chunks_overwritten
   if (_has_field_[3]) {
     ::protozero::internal::gen_helpers::SerializeVarInt(3, chunks_overwritten_, msg);
@@ -20170,129 +20445,6 @@ void TraceStats_BufferStats::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(19, trace_writer_packet_loss_, msg);
   }
 
-  // Field 21: shadow_buffer_stats
-  if (_has_field_[21]) {
-    (*shadow_buffer_stats_).Serialize(msg->BeginNestedMessage<::protozero::Message>(21));
-  }
-
-  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
-}
-
-
-TraceStats_BufferStats_ShadowBufferStats::TraceStats_BufferStats_ShadowBufferStats() = default;
-TraceStats_BufferStats_ShadowBufferStats::~TraceStats_BufferStats_ShadowBufferStats() = default;
-TraceStats_BufferStats_ShadowBufferStats::TraceStats_BufferStats_ShadowBufferStats(const TraceStats_BufferStats_ShadowBufferStats&) = default;
-TraceStats_BufferStats_ShadowBufferStats& TraceStats_BufferStats_ShadowBufferStats::operator=(const TraceStats_BufferStats_ShadowBufferStats&) = default;
-TraceStats_BufferStats_ShadowBufferStats::TraceStats_BufferStats_ShadowBufferStats(TraceStats_BufferStats_ShadowBufferStats&&) noexcept = default;
-TraceStats_BufferStats_ShadowBufferStats& TraceStats_BufferStats_ShadowBufferStats::operator=(TraceStats_BufferStats_ShadowBufferStats&&) = default;
-
-bool TraceStats_BufferStats_ShadowBufferStats::operator==(const TraceStats_BufferStats_ShadowBufferStats& other) const {
-  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
-   && ::protozero::internal::gen_helpers::EqualsField(packets_seen_, other.packets_seen_)
-   && ::protozero::internal::gen_helpers::EqualsField(packets_in_both_, other.packets_in_both_)
-   && ::protozero::internal::gen_helpers::EqualsField(packets_only_v1_, other.packets_only_v1_)
-   && ::protozero::internal::gen_helpers::EqualsField(packets_only_v2_, other.packets_only_v2_)
-   && ::protozero::internal::gen_helpers::EqualsField(patches_attempted_, other.patches_attempted_)
-   && ::protozero::internal::gen_helpers::EqualsField(v1_patches_succeeded_, other.v1_patches_succeeded_)
-   && ::protozero::internal::gen_helpers::EqualsField(v2_patches_succeeded_, other.v2_patches_succeeded_)
-   && ::protozero::internal::gen_helpers::EqualsField(stats_version_, other.stats_version_);
-}
-
-bool TraceStats_BufferStats_ShadowBufferStats::ParseFromArray(const void* raw, size_t size) {
-  unknown_fields_.clear();
-  bool packed_error = false;
-
-  ::protozero::ProtoDecoder dec(raw, size);
-  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
-    if (field.id() < _has_field_.size()) {
-      _has_field_.set(field.id());
-    }
-    switch (field.id()) {
-      case 1 /* packets_seen */:
-        field.get(&packets_seen_);
-        break;
-      case 2 /* packets_in_both */:
-        field.get(&packets_in_both_);
-        break;
-      case 3 /* packets_only_v1 */:
-        field.get(&packets_only_v1_);
-        break;
-      case 4 /* packets_only_v2 */:
-        field.get(&packets_only_v2_);
-        break;
-      case 5 /* patches_attempted */:
-        field.get(&patches_attempted_);
-        break;
-      case 6 /* v1_patches_succeeded */:
-        field.get(&v1_patches_succeeded_);
-        break;
-      case 7 /* v2_patches_succeeded */:
-        field.get(&v2_patches_succeeded_);
-        break;
-      case 8 /* stats_version */:
-        field.get(&stats_version_);
-        break;
-      default:
-        field.SerializeAndAppendTo(&unknown_fields_);
-        break;
-    }
-  }
-  return !packed_error && !dec.bytes_left();
-}
-
-std::string TraceStats_BufferStats_ShadowBufferStats::SerializeAsString() const {
-  ::protozero::internal::gen_helpers::MessageSerializer msg;
-  Serialize(msg.get());
-  return msg.SerializeAsString();
-}
-
-std::vector<uint8_t> TraceStats_BufferStats_ShadowBufferStats::SerializeAsArray() const {
-  ::protozero::internal::gen_helpers::MessageSerializer msg;
-  Serialize(msg.get());
-  return msg.SerializeAsArray();
-}
-
-void TraceStats_BufferStats_ShadowBufferStats::Serialize(::protozero::Message* msg) const {
-  // Field 1: packets_seen
-  if (_has_field_[1]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(1, packets_seen_, msg);
-  }
-
-  // Field 2: packets_in_both
-  if (_has_field_[2]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(2, packets_in_both_, msg);
-  }
-
-  // Field 3: packets_only_v1
-  if (_has_field_[3]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(3, packets_only_v1_, msg);
-  }
-
-  // Field 4: packets_only_v2
-  if (_has_field_[4]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(4, packets_only_v2_, msg);
-  }
-
-  // Field 5: patches_attempted
-  if (_has_field_[5]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(5, patches_attempted_, msg);
-  }
-
-  // Field 6: v1_patches_succeeded
-  if (_has_field_[6]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(6, v1_patches_succeeded_, msg);
-  }
-
-  // Field 7: v2_patches_succeeded
-  if (_has_field_[7]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(7, v2_patches_succeeded_, msg);
-  }
-
-  // Field 8: stats_version
-  if (_has_field_[8]) {
-    ::protozero::internal::gen_helpers::SerializeVarInt(8, stats_version_, msg);
-  }
-
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -22009,7 +22161,8 @@ bool DisplayVideoConfig::operator==(const DisplayVideoConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(scale_, other.scale_)
    && ::protozero::internal::gen_helpers::EqualsField(format_, other.format_)
    && ::protozero::internal::gen_helpers::EqualsField(key_frame_interval_secs_, other.key_frame_interval_secs_)
-   && ::protozero::internal::gen_helpers::EqualsField(max_stream_size_bytes_, other.max_stream_size_bytes_);
+   && ::protozero::internal::gen_helpers::EqualsField(max_stream_size_bytes_, other.max_stream_size_bytes_)
+   && ::protozero::internal::gen_helpers::EqualsField(bitrate_bps_, other.bitrate_bps_);
 }
 
 bool DisplayVideoConfig::ParseFromArray(const void* raw, size_t size) {
@@ -22034,6 +22187,9 @@ bool DisplayVideoConfig::ParseFromArray(const void* raw, size_t size) {
       case 4 /* max_stream_size_bytes */:
         field.get(&max_stream_size_bytes_);
         break;
+      case 5 /* bitrate_bps */:
+        field.get(&bitrate_bps_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -22075,6 +22231,11 @@ void DisplayVideoConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(4, max_stream_size_bytes_, msg);
   }
 
+  // Field 5: bitrate_bps
+  if (_has_field_[5]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(5, bitrate_bps_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -25058,7 +25219,8 @@ bool ProcessStatsConfig::operator==(const ProcessStatsConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(record_process_age_, other.record_process_age_)
    && ::protozero::internal::gen_helpers::EqualsField(record_process_runtime_, other.record_process_runtime_)
    && ::protozero::internal::gen_helpers::EqualsField(record_process_dmabuf_rss_, other.record_process_dmabuf_rss_)
-   && ::protozero::internal::gen_helpers::EqualsField(resolve_process_fds_, other.resolve_process_fds_);
+   && ::protozero::internal::gen_helpers::EqualsField(resolve_process_fds_, other.resolve_process_fds_)
+   && ::protozero::internal::gen_helpers::EqualsField(skip_main_thread_message_, other.skip_main_thread_message_);
 }
 
 bool ProcessStatsConfig::ParseFromArray(const void* raw, size_t size) {
@@ -25103,6 +25265,9 @@ bool ProcessStatsConfig::ParseFromArray(const void* raw, size_t size) {
       case 9 /* resolve_process_fds */:
         field.get(&resolve_process_fds_);
         break;
+      case 14 /* skip_main_thread_message */:
+        field.get(&skip_main_thread_message_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -25174,6 +25339,11 @@ void ProcessStatsConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(9, resolve_process_fds_, msg);
   }
 
+  // Field 14: skip_main_thread_message
+  if (_has_field_[14]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(14, skip_main_thread_message_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -27673,6 +27843,7 @@ void ChromiumHistogramSamplesConfig_HistogramSample::Serialize(::protozero::Mess
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/common/trace_attributes.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 
@@ -29349,6 +29520,7 @@ void InterceptorConfig::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/common/trace_attributes.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 
@@ -29956,6 +30128,7 @@ void TestConfig_DummyFields::Serialize(::protozero::Message* msg) const {
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/common/trace_attributes.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 
@@ -29999,6 +30172,7 @@ bool TraceConfig::operator==(const TraceConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(allow_user_build_tracing_, other.allow_user_build_tracing_)
    && ::protozero::internal::gen_helpers::EqualsField(unique_session_name_, other.unique_session_name_)
    && ::protozero::internal::gen_helpers::EqualsField(compression_type_, other.compression_type_)
+   && ::protozero::internal::gen_helpers::EqualsField(compression_, other.compression_)
    && ::protozero::internal::gen_helpers::EqualsField(incident_report_config_, other.incident_report_config_)
    && ::protozero::internal::gen_helpers::EqualsField(statsd_logging_, other.statsd_logging_)
    && ::protozero::internal::gen_helpers::EqualsField(trace_uuid_msb_, other.trace_uuid_msb_)
@@ -30012,7 +30186,7 @@ bool TraceConfig::operator==(const TraceConfig& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(write_flush_mode_, other.write_flush_mode_)
    && ::protozero::internal::gen_helpers::EqualsField(fflush_post_write_, other.fflush_post_write_)
    && ::protozero::internal::gen_helpers::EqualsField(trace_all_machines_, other.trace_all_machines_)
-   && ::protozero::internal::gen_helpers::EqualsField(notes_, other.notes_);
+   && ::protozero::internal::gen_helpers::EqualsField(trace_attributes_, other.trace_attributes_);
 }
 
 int TraceConfig::buffers_size() const { return static_cast<int>(buffers_.size()); }
@@ -30027,16 +30201,12 @@ TraceConfig_ProducerConfig* TraceConfig::add_producers() { producers_.emplace_ba
 int TraceConfig::session_semaphores_size() const { return static_cast<int>(session_semaphores_.size()); }
 void TraceConfig::clear_session_semaphores() { session_semaphores_.clear(); }
 TraceConfig_SessionSemaphore* TraceConfig::add_session_semaphores() { session_semaphores_.emplace_back(); return &session_semaphores_.back(); }
-int TraceConfig::notes_size() const { return static_cast<int>(notes_.size()); }
-void TraceConfig::clear_notes() { notes_.clear(); }
-TraceConfig_Note* TraceConfig::add_notes() { notes_.emplace_back(); return &notes_.back(); }
 bool TraceConfig::ParseFromArray(const void* raw, size_t size) {
   buffers_.clear();
   data_sources_.clear();
   producers_.clear();
   activate_triggers_.clear();
   session_semaphores_.clear();
-  notes_.clear();
   unknown_fields_.clear();
   bool packed_error = false;
 
@@ -30131,6 +30301,9 @@ bool TraceConfig::ParseFromArray(const void* raw, size_t size) {
       case 24 /* compression_type */:
         field.get(&compression_type_);
         break;
+      case 47 /* compression */:
+        (*compression_).ParseFromArray(field.data(), field.size());
+        break;
       case 25 /* incident_report_config */:
         (*incident_report_config_).ParseFromArray(field.data(), field.size());
         break;
@@ -30171,9 +30344,8 @@ bool TraceConfig::ParseFromArray(const void* raw, size_t size) {
       case 43 /* trace_all_machines */:
         field.get(&trace_all_machines_);
         break;
-      case 46 /* notes */:
-        notes_.emplace_back();
-        notes_.back().ParseFromArray(field.data(), field.size());
+      case 48 /* trace_attributes */:
+        (*trace_attributes_).ParseFromArray(field.data(), field.size());
         break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
@@ -30331,6 +30503,11 @@ void TraceConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(24, compression_type_, msg);
   }
 
+  // Field 47: compression
+  if (_has_field_[47]) {
+    (*compression_).Serialize(msg->BeginNestedMessage<::protozero::Message>(47));
+  }
+
   // Field 25: incident_report_config
   if (_has_field_[25]) {
     (*incident_report_config_).Serialize(msg->BeginNestedMessage<::protozero::Message>(25));
@@ -30396,73 +30573,9 @@ void TraceConfig::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(43, trace_all_machines_, msg);
   }
 
-  // Field 46: notes
-  for (auto& it : notes_) {
-    it.Serialize(msg->BeginNestedMessage<::protozero::Message>(46));
-  }
-
-  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
-}
-
-
-TraceConfig_Note::TraceConfig_Note() = default;
-TraceConfig_Note::~TraceConfig_Note() = default;
-TraceConfig_Note::TraceConfig_Note(const TraceConfig_Note&) = default;
-TraceConfig_Note& TraceConfig_Note::operator=(const TraceConfig_Note&) = default;
-TraceConfig_Note::TraceConfig_Note(TraceConfig_Note&&) noexcept = default;
-TraceConfig_Note& TraceConfig_Note::operator=(TraceConfig_Note&&) = default;
-
-bool TraceConfig_Note::operator==(const TraceConfig_Note& other) const {
-  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
-   && ::protozero::internal::gen_helpers::EqualsField(key_, other.key_)
-   && ::protozero::internal::gen_helpers::EqualsField(value_, other.value_);
-}
-
-bool TraceConfig_Note::ParseFromArray(const void* raw, size_t size) {
-  unknown_fields_.clear();
-  bool packed_error = false;
-
-  ::protozero::ProtoDecoder dec(raw, size);
-  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
-    if (field.id() < _has_field_.size()) {
-      _has_field_.set(field.id());
-    }
-    switch (field.id()) {
-      case 1 /* key */:
-        ::protozero::internal::gen_helpers::DeserializeString(field, &key_);
-        break;
-      case 2 /* value */:
-        ::protozero::internal::gen_helpers::DeserializeString(field, &value_);
-        break;
-      default:
-        field.SerializeAndAppendTo(&unknown_fields_);
-        break;
-    }
-  }
-  return !packed_error && !dec.bytes_left();
-}
-
-std::string TraceConfig_Note::SerializeAsString() const {
-  ::protozero::internal::gen_helpers::MessageSerializer msg;
-  Serialize(msg.get());
-  return msg.SerializeAsString();
-}
-
-std::vector<uint8_t> TraceConfig_Note::SerializeAsArray() const {
-  ::protozero::internal::gen_helpers::MessageSerializer msg;
-  Serialize(msg.get());
-  return msg.SerializeAsArray();
-}
-
-void TraceConfig_Note::Serialize(::protozero::Message* msg) const {
-  // Field 1: key
-  if (_has_field_[1]) {
-    ::protozero::internal::gen_helpers::SerializeString(1, key_, msg);
-  }
-
-  // Field 2: value
-  if (_has_field_[2]) {
-    ::protozero::internal::gen_helpers::SerializeString(2, value_, msg);
+  // Field 48: trace_attributes
+  if (_has_field_[48]) {
+    (*trace_attributes_).Serialize(msg->BeginNestedMessage<::protozero::Message>(48));
   }
 
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
@@ -31014,6 +31127,171 @@ void TraceConfig_IncidentReportConfig::Serialize(::protozero::Message* msg) cons
 }
 
 
+TraceConfig_CompressionConfig::TraceConfig_CompressionConfig() = default;
+TraceConfig_CompressionConfig::~TraceConfig_CompressionConfig() = default;
+TraceConfig_CompressionConfig::TraceConfig_CompressionConfig(const TraceConfig_CompressionConfig&) = default;
+TraceConfig_CompressionConfig& TraceConfig_CompressionConfig::operator=(const TraceConfig_CompressionConfig&) = default;
+TraceConfig_CompressionConfig::TraceConfig_CompressionConfig(TraceConfig_CompressionConfig&&) noexcept = default;
+TraceConfig_CompressionConfig& TraceConfig_CompressionConfig::operator=(TraceConfig_CompressionConfig&&) = default;
+
+bool TraceConfig_CompressionConfig::operator==(const TraceConfig_CompressionConfig& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(deflate_, other.deflate_)
+   && ::protozero::internal::gen_helpers::EqualsField(zstd_, other.zstd_);
+}
+
+bool TraceConfig_CompressionConfig::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* deflate */:
+        (*deflate_).ParseFromArray(field.data(), field.size());
+        break;
+      case 2 /* zstd */:
+        (*zstd_).ParseFromArray(field.data(), field.size());
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string TraceConfig_CompressionConfig::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> TraceConfig_CompressionConfig::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void TraceConfig_CompressionConfig::Serialize(::protozero::Message* msg) const {
+  // Field 1: deflate
+  if (_has_field_[1]) {
+    (*deflate_).Serialize(msg->BeginNestedMessage<::protozero::Message>(1));
+  }
+
+  // Field 2: zstd
+  if (_has_field_[2]) {
+    (*zstd_).Serialize(msg->BeginNestedMessage<::protozero::Message>(2));
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+TraceConfig_CompressionConfig_Zstd::TraceConfig_CompressionConfig_Zstd() = default;
+TraceConfig_CompressionConfig_Zstd::~TraceConfig_CompressionConfig_Zstd() = default;
+TraceConfig_CompressionConfig_Zstd::TraceConfig_CompressionConfig_Zstd(const TraceConfig_CompressionConfig_Zstd&) = default;
+TraceConfig_CompressionConfig_Zstd& TraceConfig_CompressionConfig_Zstd::operator=(const TraceConfig_CompressionConfig_Zstd&) = default;
+TraceConfig_CompressionConfig_Zstd::TraceConfig_CompressionConfig_Zstd(TraceConfig_CompressionConfig_Zstd&&) noexcept = default;
+TraceConfig_CompressionConfig_Zstd& TraceConfig_CompressionConfig_Zstd::operator=(TraceConfig_CompressionConfig_Zstd&&) = default;
+
+bool TraceConfig_CompressionConfig_Zstd::operator==(const TraceConfig_CompressionConfig_Zstd& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
+   && ::protozero::internal::gen_helpers::EqualsField(level_, other.level_);
+}
+
+bool TraceConfig_CompressionConfig_Zstd::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      case 1 /* level */:
+        field.get(&level_);
+        break;
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string TraceConfig_CompressionConfig_Zstd::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> TraceConfig_CompressionConfig_Zstd::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void TraceConfig_CompressionConfig_Zstd::Serialize(::protozero::Message* msg) const {
+  // Field 1: level
+  if (_has_field_[1]) {
+    ::protozero::internal::gen_helpers::SerializeVarInt(1, level_, msg);
+  }
+
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
+TraceConfig_CompressionConfig_Deflate::TraceConfig_CompressionConfig_Deflate() = default;
+TraceConfig_CompressionConfig_Deflate::~TraceConfig_CompressionConfig_Deflate() = default;
+TraceConfig_CompressionConfig_Deflate::TraceConfig_CompressionConfig_Deflate(const TraceConfig_CompressionConfig_Deflate&) = default;
+TraceConfig_CompressionConfig_Deflate& TraceConfig_CompressionConfig_Deflate::operator=(const TraceConfig_CompressionConfig_Deflate&) = default;
+TraceConfig_CompressionConfig_Deflate::TraceConfig_CompressionConfig_Deflate(TraceConfig_CompressionConfig_Deflate&&) noexcept = default;
+TraceConfig_CompressionConfig_Deflate& TraceConfig_CompressionConfig_Deflate::operator=(TraceConfig_CompressionConfig_Deflate&&) = default;
+
+bool TraceConfig_CompressionConfig_Deflate::operator==(const TraceConfig_CompressionConfig_Deflate& other) const {
+  return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_);
+}
+
+bool TraceConfig_CompressionConfig_Deflate::ParseFromArray(const void* raw, size_t size) {
+  unknown_fields_.clear();
+  bool packed_error = false;
+
+  ::protozero::ProtoDecoder dec(raw, size);
+  for (auto field = dec.ReadField(); field.valid(); field = dec.ReadField()) {
+    if (field.id() < _has_field_.size()) {
+      _has_field_.set(field.id());
+    }
+    switch (field.id()) {
+      default:
+        field.SerializeAndAppendTo(&unknown_fields_);
+        break;
+    }
+  }
+  return !packed_error && !dec.bytes_left();
+}
+
+std::string TraceConfig_CompressionConfig_Deflate::SerializeAsString() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsString();
+}
+
+std::vector<uint8_t> TraceConfig_CompressionConfig_Deflate::SerializeAsArray() const {
+  ::protozero::internal::gen_helpers::MessageSerializer msg;
+  Serialize(msg.get());
+  return msg.SerializeAsArray();
+}
+
+void TraceConfig_CompressionConfig_Deflate::Serialize(::protozero::Message* msg) const {
+  protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
+}
+
+
 TraceConfig_IncrementalStateConfig::TraceConfig_IncrementalStateConfig() = default;
 TraceConfig_IncrementalStateConfig::~TraceConfig_IncrementalStateConfig() = default;
 TraceConfig_IncrementalStateConfig::TraceConfig_IncrementalStateConfig(const TraceConfig_IncrementalStateConfig&) = default;
@@ -31483,7 +31761,8 @@ bool TraceConfig_BuiltinDataSource::operator==(const TraceConfig_BuiltinDataSour
    && ::protozero::internal::gen_helpers::EqualsField(snapshot_interval_ms_, other.snapshot_interval_ms_)
    && ::protozero::internal::gen_helpers::EqualsField(prefer_suspend_clock_for_snapshot_, other.prefer_suspend_clock_for_snapshot_)
    && ::protozero::internal::gen_helpers::EqualsField(disable_chunk_usage_histograms_, other.disable_chunk_usage_histograms_)
-   && ::protozero::internal::gen_helpers::EqualsField(disable_extension_descriptors_, other.disable_extension_descriptors_);
+   && ::protozero::internal::gen_helpers::EqualsField(disable_extension_descriptors_, other.disable_extension_descriptors_)
+   && ::protozero::internal::gen_helpers::EqualsField(enable_concurrent_session_events_, other.enable_concurrent_session_events_);
 }
 
 bool TraceConfig_BuiltinDataSource::ParseFromArray(const void* raw, size_t size) {
@@ -31523,6 +31802,9 @@ bool TraceConfig_BuiltinDataSource::ParseFromArray(const void* raw, size_t size)
       case 9 /* disable_extension_descriptors */:
         field.get(&disable_extension_descriptors_);
         break;
+      case 10 /* enable_concurrent_session_events */:
+        field.get(&enable_concurrent_session_events_);
+        break;
       default:
         field.SerializeAndAppendTo(&unknown_fields_);
         break;
@@ -31589,6 +31871,11 @@ void TraceConfig_BuiltinDataSource::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeTinyVarInt(9, disable_extension_descriptors_, msg);
   }
 
+  // Field 10: enable_concurrent_session_events
+  if (_has_field_[10]) {
+    ::protozero::internal::gen_helpers::SerializeTinyVarInt(10, enable_concurrent_session_events_, msg);
+  }
+
   protozero::internal::gen_helpers::SerializeUnknownFields(unknown_fields_, msg);
 }
 
@@ -31832,12 +32119,8 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/android_system_property.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/camera_event.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/cpu_per_uid_data.pbzero.cc
 // Intentionally empty (crbug.com/998165)
-// gen_amalgamated begin source: gen/protos/perfetto/trace/android/frame_timeline_event.pbzero.cc
-// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/graphics_frame_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/android/initial_display_state.pbzero.cc
@@ -31872,6 +32155,8 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/gpu/vulkan_memory_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/inline_callstack.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/art_process_metadata.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/deobfuscation.pbzero.cc
@@ -31882,6 +32167,8 @@ void TraceConfig_BufferConfig::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/smaps.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/profiling/stack_sample.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/chrome_active_processes.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/track_event/chrome_application_state_info.pbzero.cc
@@ -37149,6 +37436,7 @@ bool TrackEvent::operator==(const TrackEvent& other) const {
    && ::protozero::internal::gen_helpers::EqualsField(correlation_id_str_iid_, other.correlation_id_str_iid_)
    && ::protozero::internal::gen_helpers::EqualsField(callstack_, other.callstack_)
    && ::protozero::internal::gen_helpers::EqualsField(callstack_iid_, other.callstack_iid_)
+   && ::protozero::internal::gen_helpers::EqualsField(callstack_weight_, other.callstack_weight_)
    && ::protozero::internal::gen_helpers::EqualsField(debug_annotations_, other.debug_annotations_)
    && ::protozero::internal::gen_helpers::EqualsField(task_execution_, other.task_execution_)
    && ::protozero::internal::gen_helpers::EqualsField(log_message_, other.log_message_)
@@ -37275,6 +37563,9 @@ bool TrackEvent::ParseFromArray(const void* raw, size_t size) {
       case 56 /* callstack_iid */:
         field.get(&callstack_iid_);
         break;
+      case 57 /* callstack_weight */:
+        field.get(&callstack_weight_);
+        break;
       case 4 /* debug_annotations */:
         debug_annotations_.emplace_back();
         debug_annotations_.back().ParseFromArray(field.data(), field.size());
@@ -37483,6 +37774,11 @@ void TrackEvent::Serialize(::protozero::Message* msg) const {
     ::protozero::internal::gen_helpers::SerializeVarInt(56, callstack_iid_, msg);
   }
 
+  // Field 57: callstack_weight
+  if (_has_field_[57]) {
+    ::protozero::internal::gen_helpers::SerializeFixed(57, callstack_weight_, msg);
+  }
+
   // Field 4: debug_annotations
   for (auto& it : debug_annotations_) {
     it.Serialize(msg->BeginNestedMessage<::protozero::Message>(4));
@@ -37812,22 +38108,22 @@ void TrackEvent_LegacyEvent::Serialize(::protozero::Message* msg) const {
 }
 
 
-TrackEvent_Callstack::TrackEvent_Callstack() = default;
-TrackEvent_Callstack::~TrackEvent_Callstack() = default;
-TrackEvent_Callstack::TrackEvent_Callstack(const TrackEvent_Callstack&) = default;
-TrackEvent_Callstack& TrackEvent_Callstack::operator=(const TrackEvent_Callstack&) = default;
-TrackEvent_Callstack::TrackEvent_Callstack(TrackEvent_Callstack&&) noexcept = default;
-TrackEvent_Callstack& TrackEvent_Callstack::operator=(TrackEvent_Callstack&&) = default;
+TrackEvent_InlineCallstack::TrackEvent_InlineCallstack() = default;
+TrackEvent_InlineCallstack::~TrackEvent_InlineCallstack() = default;
+TrackEvent_InlineCallstack::TrackEvent_InlineCallstack(const TrackEvent_InlineCallstack&) = default;
+TrackEvent_InlineCallstack& TrackEvent_InlineCallstack::operator=(const TrackEvent_InlineCallstack&) = default;
+TrackEvent_InlineCallstack::TrackEvent_InlineCallstack(TrackEvent_InlineCallstack&&) noexcept = default;
+TrackEvent_InlineCallstack& TrackEvent_InlineCallstack::operator=(TrackEvent_InlineCallstack&&) = default;
 
-bool TrackEvent_Callstack::operator==(const TrackEvent_Callstack& other) const {
+bool TrackEvent_InlineCallstack::operator==(const TrackEvent_InlineCallstack& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
    && ::protozero::internal::gen_helpers::EqualsField(frames_, other.frames_);
 }
 
-int TrackEvent_Callstack::frames_size() const { return static_cast<int>(frames_.size()); }
-void TrackEvent_Callstack::clear_frames() { frames_.clear(); }
-TrackEvent_Callstack_Frame* TrackEvent_Callstack::add_frames() { frames_.emplace_back(); return &frames_.back(); }
-bool TrackEvent_Callstack::ParseFromArray(const void* raw, size_t size) {
+int TrackEvent_InlineCallstack::frames_size() const { return static_cast<int>(frames_.size()); }
+void TrackEvent_InlineCallstack::clear_frames() { frames_.clear(); }
+TrackEvent_InlineCallstack_Frame* TrackEvent_InlineCallstack::add_frames() { frames_.emplace_back(); return &frames_.back(); }
+bool TrackEvent_InlineCallstack::ParseFromArray(const void* raw, size_t size) {
   frames_.clear();
   unknown_fields_.clear();
   bool packed_error = false;
@@ -37850,19 +38146,19 @@ bool TrackEvent_Callstack::ParseFromArray(const void* raw, size_t size) {
   return !packed_error && !dec.bytes_left();
 }
 
-std::string TrackEvent_Callstack::SerializeAsString() const {
+std::string TrackEvent_InlineCallstack::SerializeAsString() const {
   ::protozero::internal::gen_helpers::MessageSerializer msg;
   Serialize(msg.get());
   return msg.SerializeAsString();
 }
 
-std::vector<uint8_t> TrackEvent_Callstack::SerializeAsArray() const {
+std::vector<uint8_t> TrackEvent_InlineCallstack::SerializeAsArray() const {
   ::protozero::internal::gen_helpers::MessageSerializer msg;
   Serialize(msg.get());
   return msg.SerializeAsArray();
 }
 
-void TrackEvent_Callstack::Serialize(::protozero::Message* msg) const {
+void TrackEvent_InlineCallstack::Serialize(::protozero::Message* msg) const {
   // Field 1: frames
   for (auto& it : frames_) {
     it.Serialize(msg->BeginNestedMessage<::protozero::Message>(1));
@@ -37872,21 +38168,21 @@ void TrackEvent_Callstack::Serialize(::protozero::Message* msg) const {
 }
 
 
-TrackEvent_Callstack_Frame::TrackEvent_Callstack_Frame() = default;
-TrackEvent_Callstack_Frame::~TrackEvent_Callstack_Frame() = default;
-TrackEvent_Callstack_Frame::TrackEvent_Callstack_Frame(const TrackEvent_Callstack_Frame&) = default;
-TrackEvent_Callstack_Frame& TrackEvent_Callstack_Frame::operator=(const TrackEvent_Callstack_Frame&) = default;
-TrackEvent_Callstack_Frame::TrackEvent_Callstack_Frame(TrackEvent_Callstack_Frame&&) noexcept = default;
-TrackEvent_Callstack_Frame& TrackEvent_Callstack_Frame::operator=(TrackEvent_Callstack_Frame&&) = default;
+TrackEvent_InlineCallstack_Frame::TrackEvent_InlineCallstack_Frame() = default;
+TrackEvent_InlineCallstack_Frame::~TrackEvent_InlineCallstack_Frame() = default;
+TrackEvent_InlineCallstack_Frame::TrackEvent_InlineCallstack_Frame(const TrackEvent_InlineCallstack_Frame&) = default;
+TrackEvent_InlineCallstack_Frame& TrackEvent_InlineCallstack_Frame::operator=(const TrackEvent_InlineCallstack_Frame&) = default;
+TrackEvent_InlineCallstack_Frame::TrackEvent_InlineCallstack_Frame(TrackEvent_InlineCallstack_Frame&&) noexcept = default;
+TrackEvent_InlineCallstack_Frame& TrackEvent_InlineCallstack_Frame::operator=(TrackEvent_InlineCallstack_Frame&&) = default;
 
-bool TrackEvent_Callstack_Frame::operator==(const TrackEvent_Callstack_Frame& other) const {
+bool TrackEvent_InlineCallstack_Frame::operator==(const TrackEvent_InlineCallstack_Frame& other) const {
   return ::protozero::internal::gen_helpers::EqualsField(unknown_fields_, other.unknown_fields_)
    && ::protozero::internal::gen_helpers::EqualsField(function_name_, other.function_name_)
    && ::protozero::internal::gen_helpers::EqualsField(source_file_, other.source_file_)
    && ::protozero::internal::gen_helpers::EqualsField(line_number_, other.line_number_);
 }
 
-bool TrackEvent_Callstack_Frame::ParseFromArray(const void* raw, size_t size) {
+bool TrackEvent_InlineCallstack_Frame::ParseFromArray(const void* raw, size_t size) {
   unknown_fields_.clear();
   bool packed_error = false;
 
@@ -37913,19 +38209,19 @@ bool TrackEvent_Callstack_Frame::ParseFromArray(const void* raw, size_t size) {
   return !packed_error && !dec.bytes_left();
 }
 
-std::string TrackEvent_Callstack_Frame::SerializeAsString() const {
+std::string TrackEvent_InlineCallstack_Frame::SerializeAsString() const {
   ::protozero::internal::gen_helpers::MessageSerializer msg;
   Serialize(msg.get());
   return msg.SerializeAsString();
 }
 
-std::vector<uint8_t> TrackEvent_Callstack_Frame::SerializeAsArray() const {
+std::vector<uint8_t> TrackEvent_InlineCallstack_Frame::SerializeAsArray() const {
   ::protozero::internal::gen_helpers::MessageSerializer msg;
   Serialize(msg.get());
   return msg.SerializeAsArray();
 }
 
-void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
+void TrackEvent_InlineCallstack_Frame::Serialize(::protozero::Message* msg) const {
   // Field 1: function_name
   if (_has_field_[1]) {
     ::protozero::internal::gen_helpers::SerializeString(1, function_name_, msg);
@@ -38248,6 +38544,8 @@ void TrackEvent_Callstack_Frame::Serialize(::protozero::Message* msg) const {
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/linux/journald_event.pbzero.cc
 // Intentionally empty (crbug.com/998165)
+// gen_amalgamated begin source: gen/protos/perfetto/trace/perfetto/concurrent_session_event.pbzero.cc
+// Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/perfetto/perfetto_metatrace.pbzero.cc
 // Intentionally empty (crbug.com/998165)
 // gen_amalgamated begin source: gen/protos/perfetto/trace/perfetto/trace_provenance.pbzero.cc
@@ -40472,12 +40770,6 @@ class PERFETTO_EXPORT_COMPONENT ConsumerEndpoint {
 };  // class ConsumerEndpoint.
 
 struct PERFETTO_EXPORT_COMPONENT TracingServiceInitOpts {
-  // Function used by tracing service to compress packets. Takes a pointer to
-  // a vector of TracePackets and replaces the packets in the vector with
-  // compressed ones.
-  using CompressorFn = void (*)(std::vector<TracePacket>*);
-  CompressorFn compressor_fn = nullptr;
-
   // An (optional) list of proto extension descriptors to dump into each trace
   // recorded. This is to support injecting protos that are known by the
   // embedder (e.g. the Android vendor image) but not by the upstream perfetto.
@@ -40550,8 +40842,7 @@ class PERFETTO_EXPORT_COMPONENT TracingService {
     kDisabled
   };
 
-  // Implemented in src/core/tracing_service_impl.cc . CompressorFn can be
-  // nullptr, in which case TracingService will not support compression.
+  // Implemented in src/core/tracing_service_impl.cc .
   static std::unique_ptr<TracingService> CreateInstance(
       std::unique_ptr<SharedMemory::Factory>,
       base::TaskRunner*,
@@ -41681,6 +41972,24 @@ constexpr size_t kMaxCommitDataRequestChunkSize =
     128 * 1024 - 512;  // This is ipc::kIPCBufferSize - 512, see
                        // |kMaxTracePacketSliceSize| in tracing_service_impl.h
 
+// Conservative upper bound of a ChunkToPatch's serialized size, used to bound
+// how many patches are packed into one request. Over-estimating only causes an
+// extra split, never an oversized frame.
+uint32_t EstimateChunkToPatchSize(const CommitDataRequest::ChunkToPatch& ctp) {
+  uint32_t size = 32;  // Fixed fields + repeated-field tag/length.
+  for (const auto& patch : ctp.patches()) {
+    size += static_cast<uint32_t>(patch.data().size()) + 16;  // data + framing.
+  }
+  return size;
+}
+
+// Conservative upper bound of a ChunkToMove's serialized size: the inlined
+// chunk data plus field tags, varints and the submessage length prefix. As
+// above, over-estimating only causes an extra split.
+uint32_t EstimateChunkToMoveSize(const CommitDataRequest::ChunksToMove& ctm) {
+  return static_cast<uint32_t>(ctm.data().size()) + 32;
+}
+
 MaybeUnboundBufferID MakeTargetBufferIdForReservation(uint16_t reservation_id) {
   // Reservation IDs are stored in the upper bits.
   PERFETTO_CHECK(reservation_id > 0);
@@ -42293,13 +42602,17 @@ void SharedMemoryArbiterImpl::CommitDataWithSplitting(
     std::function<void()> callback) {
   PERFETTO_DCHECK(use_shmem_emulation_);
 
-  // If the request is small enough to be sent in a single IPC
-  // avoid the request splitting.
-  uint32_t total_bytes = 0;
+  // If the request is small enough to be sent in a single IPC avoid the request
+  // splitting. |estimated_bytes| includes a conservative bound for the patches,
+  // which are serialized into the request too.
+  uint32_t estimated_bytes = 0;
   for (const auto& ctm : req->chunks_to_move()) {
-    total_bytes += static_cast<uint32_t>(ctm.data().size());
+    estimated_bytes += EstimateChunkToMoveSize(ctm);
   }
-  if (total_bytes < kMaxCommitDataRequestChunkSize) {
+  for (const auto& ctp : req->chunks_to_patch()) {
+    estimated_bytes += EstimateChunkToPatchSize(ctp);
+  }
+  if (estimated_bytes < kMaxCommitDataRequestChunkSize) {
     producer_endpoint_->CommitData(*req, std::move(callback));
     return;
   }
@@ -42314,14 +42627,15 @@ void SharedMemoryArbiterImpl::CommitDataWithSplitting(
     // cannot be greater than |kMaxPageSize| in size, which is less than
     // |kIPCBufferSize|. We provide 512-bytes of headroom for message
     // overhead.
-    if (current_req_bytes + ctm.data().size() >=
-        kMaxCommitDataRequestChunkSize) {
+    uint32_t ctm_bytes = EstimateChunkToMoveSize(ctm);
+    if (current_req_bytes != 0 &&
+        current_req_bytes + ctm_bytes >= kMaxCommitDataRequestChunkSize) {
       producer_endpoint_->CommitData(*split_req);
       split_req.reset(new CommitDataRequest());
       current_req_bytes = 0;
     }
 
-    current_req_bytes += ctm.data().size();
+    current_req_bytes += ctm_bytes;
     auto* new_ctm = split_req->add_chunks_to_move();
     new_ctm->set_page(ctm.page());
     new_ctm->set_chunk(ctm.chunk());
@@ -42330,15 +42644,26 @@ void SharedMemoryArbiterImpl::CommitDataWithSplitting(
     new_ctm->set_data(ctm.data());
   }
 
-  // In shmem emulation mode, the pending commit data requests splitting
-  // is done on a best effort basis, meaning that although rare it is
-  // possible for the last commit data request to exceed the
-  // |kIPCBufferSize| since, we aren't checking the size of the chunk
-  // patches.
-  *split_req->mutable_chunks_to_patch() =
-      std::move(*req->mutable_chunks_to_patch());
-  split_req->set_flush_request_id(req->flush_request_id());
+  // Split the patches too, instead of appending all of them to the last
+  // request: a flush with many patched chunks could otherwise exceed the limit
+  // (see https://github.com/google/perfetto/issues/6426). Patches are applied
+  // after moves and IPC is ordered, so trailing patch requests preserve
+  // ordering.
+  for (auto& ctp : *req->mutable_chunks_to_patch()) {
+    uint32_t ctp_bytes = EstimateChunkToPatchSize(ctp);
+    // A lone ChunkToPatch always fits, so only ever split a non-empty request.
+    if (current_req_bytes != 0 &&
+        current_req_bytes + ctp_bytes >= kMaxCommitDataRequestChunkSize) {
+      producer_endpoint_->CommitData(*split_req);
+      split_req.reset(new CommitDataRequest());
+      current_req_bytes = 0;
+    }
+    current_req_bytes += ctp_bytes;
+    *split_req->add_chunks_to_patch() = std::move(ctp);
+  }
 
+  if (req->has_flush_request_id())
+    split_req->set_flush_request_id(req->flush_request_id());
   producer_endpoint_->CommitData(*split_req, std::move(callback));
 }
 
@@ -42606,14 +42931,14 @@ void SharedMemoryArbiterImpl::ScrapeEmulatedSharedMemoryBuffer(
   // This function must be called on the IPC thread.
   PERFETTO_CHECK(task_runner_->RunsTasksOnCurrentThread());
 
-  CommitDataRequest commit_req;
+  auto commit_req = std::make_unique<CommitDataRequest>();
   ForEachScrapableChunk(&shmem_abi_, [&](SharedMemoryABI::Chunk* chunk,
                                          bool chunk_complete, auto, auto) {
     const auto writer = buffer_for_writers.find(chunk->writer_id());
     if (writer == buffer_for_writers.end())
       return;
     BufferID target_buffer_id = writer->second;
-    auto* ctm = commit_req.add_chunks_to_move();
+    auto* ctm = commit_req->add_chunks_to_move();
     auto page_and_chunk = shmem_abi_.GetPageAndChunkIndex(*chunk);
     ctm->set_page(static_cast<uint32_t>(page_and_chunk.first));
     ctm->set_chunk(static_cast<uint32_t>(page_and_chunk.second));
@@ -42621,9 +42946,12 @@ void SharedMemoryArbiterImpl::ScrapeEmulatedSharedMemoryBuffer(
     ctm->set_data(chunk->begin(), chunk->size());
     ctm->set_chunk_incomplete(!chunk_complete);
   });
-  if (commit_req.chunks_to_move_size() == 0)
+  if (commit_req->chunks_to_move_size() == 0)
     return;
-  producer_endpoint_->CommitData(commit_req);
+  // A scrape can pick up every in-flight chunk in the emulated SMB at once,
+  // which can easily exceed the IPC frame size limit, so it must go through
+  // the same splitting as regular commits.
+  CommitDataWithSplitting(std::move(commit_req), nullptr);
 }
 
 std::unique_ptr<TraceWriter> SharedMemoryArbiterImpl::CreateTraceWriterInternal(
@@ -44248,19 +44576,13 @@ void DataSourceType::ClearIncrementalState(
     internal::DataSourceInstanceThreadLocalState* tls_inst,
     uint32_t instance_index,
     uint32_t actual_generation) {
-  if constexpr (
-      PERFETTO_FLAGS_TRACK_EVENT_INCREMENTAL_STATE_CLEAR_NOT_DESTROY) {
-    // Try to clear the existing state if we have a clear function and the
-    // state exists. This allows reusing allocated memory instead of
-    // destroying and recreating the state object.
-    void* incremental_state = tls_inst->incremental_state.get();
-    if (clear_incremental_state_fn_ && incremental_state &&
-        clear_incremental_state_fn_(incremental_state, user_arg_)) {
-      tls_inst->incremental_state_generation = actual_generation;
-    } else {
-      tls_inst->incremental_state.reset();
-      CreateIncrementalState(tls_inst, instance_index);
-    }
+  // Try to clear the existing state if we have a clear function and the
+  // state exists. This allows reusing allocated memory instead of
+  // destroying and recreating the state object.
+  void* incremental_state = tls_inst->incremental_state.get();
+  if (clear_incremental_state_fn_ && incremental_state &&
+      clear_incremental_state_fn_(incremental_state, user_arg_)) {
+    tls_inst->incremental_state_generation = actual_generation;
   } else {
     tls_inst->incremental_state.reset();
     CreateIncrementalState(tls_inst, instance_index);
@@ -46901,8 +47223,15 @@ bool TracingMuxerImpl::RegisterDataSource(
     bool no_flush,
     DataSourceStaticState* static_state) {
   // Ignore repeated registrations.
-  if (static_state->index != kMaxDataSources)
+  if (static_state->index != kMaxDataSources) {
+    PERFETTO_ELOG(
+        "Data source \"%s\" registration ignored: this data source type is "
+        "already registered. See "
+        "https://perfetto.dev/docs/instrumentation/"
+        "tracing-sdk#reporting-many-similar-things",
+        descriptor.name().c_str());
     return true;
+  }
 
   uint32_t new_index = next_data_source_index_++;
   if (new_index >= kMaxDataSources) {
@@ -48585,6 +48914,7 @@ void TracingMuxerImpl::Shutdown() {
 
   std::unique_ptr<base::TaskRunner> owned_task_runner(
       muxer->task_runner_.get());
+  Platform* platform = muxer->platform_;
   base::WaitableEvent shutdown_done;
   owned_task_runner->PostTask([muxer, &shutdown_done] {
     // Check that no consumer session is currently active on any backend.
@@ -48602,13 +48932,17 @@ void TracingMuxerImpl::Shutdown() {
     // The task runner must be deleted outside the muxer thread. This is done by
     // `owned_task_runner` above.
     muxer->task_runner_.release();
-    auto* platform = muxer->platform_;
     delete muxer;
     instance_ = TracingMuxerFake::Get();
-    platform->Shutdown();
     shutdown_done.Notify();
   });
   shutdown_done.Wait();
+
+  // Join the muxer thread before the platform (and its TLS key) is destroyed.
+  owned_task_runner.reset();
+
+  // On the calling thread, so the platform can free this thread's TLS object.
+  platform->Shutdown();
 }
 
 void TracingMuxerImpl::AppendResetForTestingCallback(std::function<void()> cb) {
@@ -48736,7 +49070,7 @@ class NoDestructor {
 // gen_amalgamated expanded: #include "protos/perfetto/trace/trace_packet_defaults.pbzero.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/debug_annotation.pbzero.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/track_event/track_descriptor.pbzero.h"
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_MAC)
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
 #include <os/signpost.h>
 #endif
 
@@ -49164,7 +49498,7 @@ void TrackEventInternal::ResetIncrementalState(
           thread_time_counter_track.uuid);
     }
 
-#if PERFETTO_BUILDFLAG(PERFETTO_OS_MAC)
+#if PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)
     // Emit a MacOS point-of-interest signpost to synchronize Mac profiler time
     // with boot time.
     // TODO(leszeks): Consider allowing synchronization against other clocks
@@ -49689,6 +50023,9 @@ PlatformWindows::PlatformWindows() {
 }
 
 PlatformWindows::~PlatformWindows() {
+  // TlsFree doesn't call destructors, so do it manually for the calling
+  // thread.
+  OnThreadExit();
   ::TlsFree(tls_key_);
   instance = nullptr;
 }
@@ -52198,8 +52535,8 @@ const char* GetVersionCode();
 #ifndef GEN_PERFETTO_VERSION_GEN_H_
 #define GEN_PERFETTO_VERSION_GEN_H_
 
-#define PERFETTO_VERSION_STRING() "v57.2-da1d152cf"
-#define PERFETTO_VERSION_SCM_REVISION() "da1d152cff27890903d158fe96751de3aab883cc"
+#define PERFETTO_VERSION_STRING() "v58.2-add693d8b"
+#define PERFETTO_VERSION_SCM_REVISION() "add693d8b338ba9599dbcbc3e300b1ab8c000897"
 
 #endif  // GEN_PERFETTO_VERSION_GEN_H_
 /*
@@ -59162,6 +59499,419 @@ perfetto::base::Status LoadMessageFilterConfig(const TraceFilter& filt,
 }
 
 }  // namespace protozero
+// gen_amalgamated begin source: src/tracing/service/zlib_compressor.cc
+// gen_amalgamated begin header: src/tracing/service/zlib_compressor.h
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
+#define SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
+
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/ext/tracing/core/trace_packet.h"
+
+namespace perfetto {
+
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+void ZlibCompressFn(std::vector<TracePacket>*);
+#endif
+
+}  // namespace perfetto
+
+#endif  // SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "src/tracing/service/zlib_compressor.h"
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+
+// File compiles to nothing when the buildflag is off (e.g. SDK opt-out).
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+
+#include <zlib.h>
+
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace.pbzero.h"
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace_packet.pbzero.h"
+// gen_amalgamated expanded: #include "src/tracing/service/packet_compressor_common.h"
+
+namespace perfetto {
+
+namespace {
+
+using packet_compressor::GetPreamble;
+using packet_compressor::kCompressSliceSize;
+using packet_compressor::Preamble;
+using packet_compressor::PreambleToSlice;
+
+// A compressor for `TracePacket`s that uses zlib. The class is exposed for
+// testing.
+class ZlibPacketCompressor {
+ public:
+  ZlibPacketCompressor();
+  ~ZlibPacketCompressor();
+
+  // Can be called multiple times, before Finish() is called.
+  void PushPacket(const TracePacket& packet);
+
+  // Returned the compressed data. Can be called at most once. After this call,
+  // the object is unusable (PushPacket should not be called) and must be
+  // destroyed.
+  TracePacket Finish();
+
+ private:
+  void PushData(const void* data, uint32_t size);
+  void NewOutputSlice();
+  void PushCurSlice();
+
+  z_stream stream_;
+  size_t total_new_slices_size_ = 0;
+  std::vector<Slice> new_slices_;
+  std::unique_ptr<uint8_t[]> cur_slice_;
+};
+
+ZlibPacketCompressor::ZlibPacketCompressor() {
+  memset(&stream_, 0, sizeof(stream_));
+  int status = deflateInit(&stream_, 6);
+  PERFETTO_CHECK(status == Z_OK);
+}
+
+ZlibPacketCompressor::~ZlibPacketCompressor() {
+  int status = deflateEnd(&stream_);
+  PERFETTO_CHECK(status == Z_OK);
+}
+
+void ZlibPacketCompressor::PushPacket(const TracePacket& packet) {
+  // We need to be able to tokenize packets in the compressed stream, so we
+  // prefix a proto preamble to each packet. The compressed stream looks like a
+  // valid Trace proto.
+  Preamble preamble =
+      GetPreamble<protos::pbzero::Trace::kPacketFieldNumber>(packet.size());
+  PushData(preamble.buf.data(), preamble.size);
+  for (const Slice& slice : packet.slices()) {
+    PushData(slice.start, static_cast<uint32_t>(slice.size));
+  }
+}
+
+void ZlibPacketCompressor::PushData(const void* data, uint32_t size) {
+  stream_.next_in = const_cast<Bytef*>(static_cast<const Bytef*>(data));
+  stream_.avail_in = static_cast<uInt>(size);
+  while (stream_.avail_in != 0) {
+    if (stream_.avail_out == 0) {
+      NewOutputSlice();
+    }
+    int status = deflate(&stream_, Z_NO_FLUSH);
+    PERFETTO_CHECK(status == Z_OK);
+  }
+}
+
+TracePacket ZlibPacketCompressor::Finish() {
+  for (;;) {
+    int status = deflate(&stream_, Z_FINISH);
+    if (status == Z_STREAM_END)
+      break;
+    PERFETTO_CHECK(status == Z_OK || status == Z_BUF_ERROR);
+    NewOutputSlice();
+  }
+
+  PushCurSlice();
+
+  TracePacket packet;
+  packet.AddSlice(PreambleToSlice(
+      GetPreamble<protos::pbzero::TracePacket::kCompressedPacketsFieldNumber>(
+          total_new_slices_size_)));
+  for (auto& slice : new_slices_) {
+    packet.AddSlice(std::move(slice));
+  }
+  return packet;
+}
+
+void ZlibPacketCompressor::NewOutputSlice() {
+  PushCurSlice();
+  cur_slice_ = std::make_unique<uint8_t[]>(kCompressSliceSize);
+  stream_.next_out = reinterpret_cast<Bytef*>(cur_slice_.get());
+  stream_.avail_out = kCompressSliceSize;
+}
+
+void ZlibPacketCompressor::PushCurSlice() {
+  if (cur_slice_) {
+    total_new_slices_size_ += kCompressSliceSize - stream_.avail_out;
+    new_slices_.push_back(Slice::TakeOwnership(
+        std::move(cur_slice_), kCompressSliceSize - stream_.avail_out));
+  }
+}
+
+}  // namespace
+
+void ZlibCompressFn(std::vector<TracePacket>* packets) {
+  if (packets->empty()) {
+    return;
+  }
+
+  ZlibPacketCompressor stream;
+
+  for (const TracePacket& packet : *packets) {
+    stream.PushPacket(packet);
+  }
+
+  TracePacket packet = stream.Finish();
+
+  packets->clear();
+  packets->push_back(std::move(packet));
+}
+
+}  // namespace perfetto
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+// gen_amalgamated begin source: src/tracing/service/zstd_compressor.cc
+// gen_amalgamated begin header: src/tracing/service/zstd_compressor.h
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SRC_TRACING_SERVICE_ZSTD_COMPRESSOR_H_
+#define SRC_TRACING_SERVICE_ZSTD_COMPRESSOR_H_
+
+#include <vector>
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+// gen_amalgamated expanded: #include "perfetto/ext/tracing/core/trace_packet.h"
+
+namespace perfetto {
+
+#if PERFETTO_BUILDFLAG(PERFETTO_ZSTD)
+// Compresses `packets` with zstd at the given compression `level`.
+void ZstdCompressFn(std::vector<TracePacket>*, int level);
+#endif
+
+}  // namespace perfetto
+
+#endif  // SRC_TRACING_SERVICE_ZSTD_COMPRESSOR_H_
+/*
+ * Copyright (C) 2026 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// gen_amalgamated expanded: #include "src/tracing/service/zstd_compressor.h"
+
+// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
+
+#if PERFETTO_BUILDFLAG(PERFETTO_ZSTD)
+
+#include <memory>
+
+#include <zstd.h>
+
+// gen_amalgamated expanded: #include "perfetto/base/logging.h"
+// gen_amalgamated expanded: #include "perfetto/ext/base/scoped_file.h"
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace.pbzero.h"
+// gen_amalgamated expanded: #include "protos/perfetto/trace/trace_packet.pbzero.h"
+// gen_amalgamated expanded: #include "src/tracing/service/packet_compressor_common.h"
+
+namespace perfetto {
+
+namespace {
+
+using packet_compressor::GetPreamble;
+using packet_compressor::kCompressSliceSize;
+using packet_compressor::Preamble;
+using packet_compressor::PreambleToSlice;
+
+// ScopedResource's close function must return int; ZSTD_freeCStream returns
+// size_t, so wrap it. It only fails for a static-allocated stream, not the
+// heap one ZSTD_createCStream gives us, so returning 0 is safe.
+inline int ZstdFreeCStream(ZSTD_CStream* cstream) {
+  ZSTD_freeCStream(cstream);
+  return 0;
+}
+using ScopedZstdCStream = base::ScopedResource<ZSTD_CStream*,
+                                               ZstdFreeCStream,
+                                               /*InvalidValue=*/nullptr,
+                                               /*CheckClose=*/false>;
+
+// A compressor for `TracePacket`s that uses zstd's streaming API: data is fed
+// in with ZSTD_compressStream2(ZSTD_e_continue) and the frame is finalized with
+// ZSTD_e_end, emitting output in fixed-size slices (kCompressSliceSize).
+// zstd API reference: https://facebook.github.io/zstd/zstd_manual.html
+class ZstdPacketCompressor {
+ public:
+  explicit ZstdPacketCompressor(int level);
+
+  // Can be called multiple times, before Finish() is called.
+  void PushPacket(const TracePacket& packet);
+
+  // Returns the compressed data. Can be called at most once. After this call,
+  // the object is unusable (PushPacket should not be called) and must be
+  // destroyed.
+  TracePacket Finish();
+
+ private:
+  void PushData(const void* data, uint32_t size);
+  void NewOutputSlice();
+  void PushCurSlice();
+
+  ScopedZstdCStream cstream_;
+  // Points into `cur_slice_`. Zero-initialized so that the first compression
+  // call observes a full output buffer and allocates the initial slice.
+  ZSTD_outBuffer out_{/*dst=*/nullptr, /*size=*/0, /*pos=*/0};
+  size_t total_new_slices_size_ = 0;
+  std::vector<Slice> new_slices_;
+  std::unique_ptr<uint8_t[]> cur_slice_;
+};
+
+ZstdPacketCompressor::ZstdPacketCompressor(int level) {
+  cstream_.reset(ZSTD_createCStream());
+  PERFETTO_CHECK(cstream_);
+  // zstd maps 0 to its default level, clamps levels above its max, and treats
+  // negatives as fast modes, so any int is safe to pass through here.
+  size_t rc =
+      ZSTD_CCtx_setParameter(cstream_.get(), ZSTD_c_compressionLevel, level);
+  PERFETTO_CHECK(!ZSTD_isError(rc));
+}
+
+void ZstdPacketCompressor::PushPacket(const TracePacket& packet) {
+  // Prefix each packet with its proto preamble so the compressed stream itself
+  // parses as a valid Trace proto, and its packets can be tokenized back out.
+  Preamble preamble =
+      GetPreamble<protos::pbzero::Trace::kPacketFieldNumber>(packet.size());
+  PushData(preamble.buf.data(), preamble.size);
+  for (const Slice& slice : packet.slices()) {
+    PushData(slice.start, static_cast<uint32_t>(slice.size));
+  }
+}
+
+void ZstdPacketCompressor::PushData(const void* data, uint32_t size) {
+  // ZSTD_e_continue hands data to the encoder, which buffers and emits at its
+  // own discretion. It may not consume all input in one call (e.g. when the
+  // output slice fills), so loop until `in` is drained, giving it a fresh slice
+  // whenever `out_` is full.
+  ZSTD_inBuffer in = {/*src=*/data, /*size=*/size, /*pos=*/0};
+  while (in.pos < in.size) {
+    if (out_.pos == out_.size) {
+      NewOutputSlice();
+    }
+    size_t rc =
+        ZSTD_compressStream2(cstream_.get(), &out_, &in, ZSTD_e_continue);
+    PERFETTO_CHECK(!ZSTD_isError(rc));
+  }
+}
+
+TracePacket ZstdPacketCompressor::Finish() {
+  // ZSTD_e_end flushes buffered data and writes the frame epilogue. Per the
+  // contract, keep calling (draining `out_` into new slices) until it reports 0
+  // bytes remaining.
+  size_t remaining;
+  do {
+    if (out_.pos == out_.size) {
+      NewOutputSlice();
+    }
+    ZSTD_inBuffer in = {/*src=*/nullptr, /*size=*/0, /*pos=*/0};
+    remaining = ZSTD_compressStream2(cstream_.get(), &out_, &in, ZSTD_e_end);
+    PERFETTO_CHECK(!ZSTD_isError(remaining));
+  } while (remaining != 0);
+
+  PushCurSlice();
+
+  TracePacket packet;
+  packet.AddSlice(PreambleToSlice(
+      GetPreamble<
+          protos::pbzero::TracePacket::kZstdCompressedPacketsFieldNumber>(
+          total_new_slices_size_)));
+  for (auto& slice : new_slices_) {
+    packet.AddSlice(std::move(slice));
+  }
+  return packet;
+}
+
+void ZstdPacketCompressor::NewOutputSlice() {
+  PushCurSlice();
+  cur_slice_ = std::make_unique<uint8_t[]>(kCompressSliceSize);
+  out_.dst = cur_slice_.get();
+  out_.size = kCompressSliceSize;
+  out_.pos = 0;
+}
+
+void ZstdPacketCompressor::PushCurSlice() {
+  if (!cur_slice_) {
+    return;
+  }
+  total_new_slices_size_ += out_.pos;
+  new_slices_.push_back(Slice::TakeOwnership(std::move(cur_slice_), out_.pos));
+}
+
+}  // namespace
+
+void ZstdCompressFn(std::vector<TracePacket>* packets, int level) {
+  if (packets->empty()) {
+    return;
+  }
+
+  ZstdPacketCompressor stream(level);
+
+  for (const TracePacket& packet : *packets) {
+    stream.PushPacket(packet);
+  }
+
+  TracePacket packet = stream.Finish();
+
+  packets->clear();
+  packets->push_back(std::move(packet));
+}
+
+}  // namespace perfetto
+
+#endif  // PERFETTO_BUILDFLAG(PERFETTO_ZSTD)
 // gen_amalgamated begin source: src/tracing/service/clock.cc
 // gen_amalgamated begin header: src/tracing/service/clock.h
 /*
@@ -59514,6 +60264,7 @@ const uint32_t kReservedFieldIds[] = {
     protos::pbzero::TracePacket::kTraceConfigFieldNumber,
     protos::pbzero::TracePacket::kTraceStatsFieldNumber,
     protos::pbzero::TracePacket::kCompressedPacketsFieldNumber,
+    protos::pbzero::TracePacket::kZstdCompressedPacketsFieldNumber,
     protos::pbzero::TracePacket::kSynchronizationMarkerFieldNumber,
     protos::pbzero::TracePacket::kTrustedPidFieldNumber,
     protos::pbzero::TracePacket::kMachineIdFieldNumber,
@@ -59944,12 +60695,10 @@ class TraceBuffer {
 
   // Type of trace buffer implementation.
   // TODO(primiano): remove this once TraceBufferV2 proves itself.
-  // kV2 is experimental and kV1WithV2Shadow is a testing-only class that
-  // is used to gather confidence that the two return the same results.
+  // kV2 is experimental.
   enum BufType {
     kV1,
     kV2,
-    kV1WithV2Shadow,
   };
 
   // Argument for out-of-band patches applied through TryPatchChunkContents().
@@ -61729,139 +62478,7 @@ TraceBufferV1::TraceBufferV1(CloneCtor, const TraceBufferV1& src)
 TraceBuffer::~TraceBuffer() = default;
 
 }  // namespace perfetto
-// gen_amalgamated begin source: src/tracing/service/trace_buffer_v1_with_v2_shadow.cc
-// gen_amalgamated begin header: src/tracing/service/trace_buffer_v1_with_v2_shadow.h
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef SRC_TRACING_SERVICE_TRACE_BUFFER_V1_WITH_V2_SHADOW_H_
-#define SRC_TRACING_SERVICE_TRACE_BUFFER_V1_WITH_V2_SHADOW_H_
-
-#include <memory>
-#include <unordered_set>
-
-// gen_amalgamated expanded: #include "perfetto/ext/base/flat_hash_map.h"
-// gen_amalgamated expanded: #include "src/tracing/service/trace_buffer.h"
-
-namespace perfetto {
-
-class TracePacket;
-
-// ****************************************************************************
-// * THIS IS A TEMPORARY CLASS FOR TESTING PURPOSES ONLY.                     *
-// * It will be removed once TraceBufferV2 is validated and fully rolled out. *
-// ****************************************************************************
-//
-// A wrapper around TraceBufferV1 that also maintains a TraceBufferV2 shadow
-// buffer for comparison purposes. All data is written to both buffers, but
-// only V1 data is returned during readback. Comparison statistics are
-// computed to validate that V2 returns equivalent data.
-//
-// The comparison works as follows:
-// - CopyChunkUntrusted/TryPatchChunkContents: forwarded to both V1 and V2
-// - BeginRead: forwarded to both. V2 is eagerly read to completion and packet
-//   hashes are stored.
-// - ReadNextTracePacket: forwarded to V1 only. Each V1 packet's hash is
-//   compared against V2 hashes.
-// - stats(): returns V1's stats with shadow comparison fields populated.
-class TraceBufferV1WithV2Shadow : public TraceBuffer {
- public:
-  static std::unique_ptr<TraceBufferV1WithV2Shadow> Create(size_t size_in_bytes,
-                                                           OverwritePolicy);
-
-  ~TraceBufferV1WithV2Shadow() override;
-
-  // TraceBuffer implementation - forwards to both V1 and V2.
-  void CopyChunkUntrusted(ProducerID producer_id_trusted,
-                          const ClientIdentity& client_identity_trusted,
-                          WriterID writer_id,
-                          ChunkID chunk_id,
-                          uint16_t num_fragments,
-                          uint8_t chunk_flags,
-                          bool chunk_complete,
-                          const uint8_t* src,
-                          size_t size) override;
-
-  bool TryPatchChunkContents(ProducerID,
-                             WriterID,
-                             ChunkID,
-                             const Patch* patches,
-                             size_t patches_size,
-                             bool other_patches_pending) override;
-
-  // BeginRead forwards to both. V2 is eagerly read and hashes are stored.
-  void BeginRead() override;
-
-  // ReadNextTracePacket forwards to V1 only. Hash comparison is performed.
-  bool ReadNextTracePacket(
-      TracePacket*,
-      PacketSequenceProperties* sequence_properties,
-      uint32_t* previous_packet_on_sequence_dropped) override;
-
-  std::unique_ptr<TraceBuffer> CloneReadOnly() const override;
-
-  // Stats returns V1's stats with shadow comparison fields populated.
-  const TraceStats::BufferStats& stats() const override;
-
-  // These all forward to V1 only.
-  void set_read_only() override;
-  const WriterStats& writer_stats() const override;
-  size_t size() const override;
-  size_t used_size() const override;
-  size_t GetMemoryUsageBytes() const override;
-  OverwritePolicy overwrite_policy() const override;
-  bool has_data() const override;
-  BufType buf_type() const override { return kV1WithV2Shadow; }
-
- private:
-  TraceBufferV1WithV2Shadow();
-
-  // Updates the shadow comparison stats in stats_.
-  void UpdateShadowStats() const;
-
-  static constexpr uint8_t kSeenInV1 = 1 << 0;
-  static constexpr uint8_t kSeenInV2 = 1 << 1;
-
-  std::unique_ptr<TraceBuffer> v1_;
-  std::unique_ptr<TraceBuffer> v2_;
-
-  struct HashPacketCounts {
-    uint16_t seen_in_v1 = 0;
-    uint16_t seen_in_v2 = 0;
-  };
-  base::FlatHashMap<uint64_t,
-                    HashPacketCounts,
-                    base::AlreadyHashed<uint64_t>,
-                    base::QuadraticProbe,
-                    /*AppendOnly=*/true>
-      packet_hashes_;
-  uint64_t packets_seen_ = 0;
-
-  // Patch statistics.
-  uint64_t patches_attempted_ = 0;
-  uint64_t v1_patches_succeeded_ = 0;
-  uint64_t v2_patches_succeeded_ = 0;
-
-  // Cached stats that combines V1 stats with shadow comparison results.
-  mutable TraceStats::BufferStats stats_;
-};
-
-}  // namespace perfetto
-
-#endif  // SRC_TRACING_SERVICE_TRACE_BUFFER_V1_WITH_V2_SHADOW_H_
+// gen_amalgamated begin source: src/tracing/service/trace_buffer_v2.cc
 // gen_amalgamated begin header: src/tracing/service/trace_buffer_v2.h
 // gen_amalgamated begin header: include/perfetto/ext/base/circular_queue.h
 /*
@@ -63139,240 +63756,6 @@ class TraceBufferV2 : public TraceBuffer {
  * limitations under the License.
  */
 
-// gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v1_with_v2_shadow.h"
-
-// gen_amalgamated expanded: #include "perfetto/ext/base/fnv_hash.h"
-// gen_amalgamated expanded: #include "perfetto/ext/tracing/core/trace_packet.h"
-// gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v1.h"
-// gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v2.h"
-
-// ****************************************************************************
-// * THIS IS A TEMPORARY CLASS FOR TESTING PURPOSES ONLY.                     *
-// * It will be removed once TraceBufferV2 is validated and fully rolled out. *
-// * See the header file for detailed documentation.                          *
-// ****************************************************************************
-
-namespace perfetto {
-
-namespace {
-
-// Stop processing hashes after these many packets. After this point we lose
-// stats accuracy for the sake of keeping memory bounded.
-constexpr size_t kMaxPacketHashes = 1000000;
-
-uint64_t ComputePacketHash(
-    const TracePacket& packet,
-    const TraceBuffer::PacketSequenceProperties& seq_props) {
-  base::MurmurHashCombiner hasher;
-  for (const Slice& slice : packet.slices()) {
-    hasher.Combine(std::string_view(reinterpret_cast<const char*>(slice.start),
-                                    slice.size));
-  }
-  hasher.Combine(seq_props.producer_id_trusted);
-  hasher.Combine(seq_props.writer_id);
-  return hasher.digest();
-}
-
-void IncrementWithSaturation(uint16_t* v) {
-  *v += *v < UINT16_MAX ? 1 : 0;
-}
-
-}  // namespace
-
-TraceBufferV1WithV2Shadow::TraceBufferV1WithV2Shadow() = default;
-TraceBufferV1WithV2Shadow::~TraceBufferV1WithV2Shadow() = default;
-
-// static
-std::unique_ptr<TraceBufferV1WithV2Shadow> TraceBufferV1WithV2Shadow::Create(
-    size_t size_in_bytes,
-    OverwritePolicy policy) {
-  auto v1 = TraceBufferV1::Create(size_in_bytes, policy);
-  auto v2 = TraceBufferV2::Create(size_in_bytes, policy);
-  if (!v1 || !v2)
-    return nullptr;
-
-  std::unique_ptr<TraceBufferV1WithV2Shadow> instance(
-      new TraceBufferV1WithV2Shadow());
-  instance->v1_ = std::move(v1);
-  instance->v2_ = std::move(v2);
-  return instance;
-}
-
-void TraceBufferV1WithV2Shadow::CopyChunkUntrusted(
-    ProducerID producer_id_trusted,
-    const ClientIdentity& client_identity_trusted,
-    WriterID writer_id,
-    ChunkID chunk_id,
-    uint16_t num_fragments,
-    uint8_t chunk_flags,
-    bool chunk_complete,
-    const uint8_t* src,
-    size_t size) {
-  v1_->CopyChunkUntrusted(producer_id_trusted, client_identity_trusted,
-                          writer_id, chunk_id, num_fragments, chunk_flags,
-                          chunk_complete, src, size);
-  v2_->CopyChunkUntrusted(producer_id_trusted, client_identity_trusted,
-                          writer_id, chunk_id, num_fragments, chunk_flags,
-                          chunk_complete, src, size);
-}
-
-bool TraceBufferV1WithV2Shadow::TryPatchChunkContents(
-    ProducerID producer_id,
-    WriterID writer_id,
-    ChunkID chunk_id,
-    const Patch* patches,
-    size_t patches_size,
-    bool other_patches_pending) {
-  patches_attempted_++;
-  bool v1_result =
-      v1_->TryPatchChunkContents(producer_id, writer_id, chunk_id, patches,
-                                 patches_size, other_patches_pending);
-  bool v2_result =
-      v2_->TryPatchChunkContents(producer_id, writer_id, chunk_id, patches,
-                                 patches_size, other_patches_pending);
-  if (v1_result)
-    v1_patches_succeeded_++;
-  if (v2_result)
-    v2_patches_succeeded_++;
-  return v1_result;
-}
-
-void TraceBufferV1WithV2Shadow::BeginRead() {
-  v1_->BeginRead();
-
-  if (packets_seen_ > kMaxPacketHashes)
-    return;
-
-  // Read all V2 packets eagerly and store their hashes.
-  v2_->BeginRead();
-
-  for (;;) {
-    TracePacket packet;
-    PacketSequenceProperties seq_props{};
-    uint32_t prev_dropped = 0;
-    if (!v2_->ReadNextTracePacket(&packet, &seq_props, &prev_dropped))
-      break;
-    auto hash = ComputePacketHash(packet, seq_props);
-    IncrementWithSaturation(&packet_hashes_[hash].seen_in_v2);
-  }
-}
-
-bool TraceBufferV1WithV2Shadow::ReadNextTracePacket(
-    TracePacket* packet,
-    PacketSequenceProperties* sequence_properties,
-    uint32_t* previous_packet_on_sequence_dropped) {
-  bool result = v1_->ReadNextTracePacket(packet, sequence_properties,
-                                         previous_packet_on_sequence_dropped);
-  if (result && packets_seen_ < kMaxPacketHashes) {
-    auto hash = ComputePacketHash(*packet, *sequence_properties);
-    IncrementWithSaturation(&packet_hashes_[hash].seen_in_v1);
-    ++packets_seen_;
-  }
-  return result;
-}
-
-std::unique_ptr<TraceBuffer> TraceBufferV1WithV2Shadow::CloneReadOnly() const {
-  auto v1_clone = v1_->CloneReadOnly();
-  auto v2_clone = v2_->CloneReadOnly();
-  if (!v1_clone || !v2_clone)
-    return nullptr;
-
-  std::unique_ptr<TraceBufferV1WithV2Shadow> clone(
-      new TraceBufferV1WithV2Shadow());
-  clone->v1_ = std::move(v1_clone);
-  clone->v2_ = std::move(v2_clone);
-  // Carry over patch stats; clone starts with fresh comparison state.
-  clone->patches_attempted_ = patches_attempted_;
-  clone->v1_patches_succeeded_ = v1_patches_succeeded_;
-  clone->v2_patches_succeeded_ = v2_patches_succeeded_;
-  return clone;
-}
-
-const TraceStats::BufferStats& TraceBufferV1WithV2Shadow::stats() const {
-  UpdateShadowStats();
-  return stats_;
-}
-
-void TraceBufferV1WithV2Shadow::UpdateShadowStats() const {
-  // Copy V1's stats as the base.
-  stats_ = v1_->stats();
-
-  // Count packets.
-  uint64_t packets_in_both = 0;
-  uint64_t packets_only_v1 = 0;
-  uint64_t packets_only_v2 = 0;
-  for (auto it = packet_hashes_.GetIterator(); it; ++it) {
-    HashPacketCounts& counts = it.value();
-    if (counts.seen_in_v1 <= counts.seen_in_v2) {
-      packets_in_both += counts.seen_in_v1;
-      packets_only_v2 += counts.seen_in_v2 - counts.seen_in_v1;
-    } else {
-      packets_in_both += counts.seen_in_v2;
-      packets_only_v1 += counts.seen_in_v1 - counts.seen_in_v2;
-    }
-  }
-
-  // Populate shadow buffer stats.
-  auto* shadow_stats = stats_.mutable_shadow_buffer_stats();
-  shadow_stats->set_stats_version(2);
-  shadow_stats->set_packets_seen(packets_seen_);
-  shadow_stats->set_packets_in_both(packets_in_both);
-  shadow_stats->set_packets_only_v1(packets_only_v1);
-  shadow_stats->set_packets_only_v2(packets_only_v2);
-  shadow_stats->set_patches_attempted(patches_attempted_);
-  shadow_stats->set_v1_patches_succeeded(v1_patches_succeeded_);
-  shadow_stats->set_v2_patches_succeeded(v2_patches_succeeded_);
-}
-
-void TraceBufferV1WithV2Shadow::set_read_only() {
-  v1_->set_read_only();
-  v2_->set_read_only();
-}
-
-const TraceBuffer::WriterStats& TraceBufferV1WithV2Shadow::writer_stats()
-    const {
-  return v1_->writer_stats();
-}
-
-size_t TraceBufferV1WithV2Shadow::size() const {
-  return v1_->size();
-}
-
-size_t TraceBufferV1WithV2Shadow::used_size() const {
-  return v1_->used_size();
-}
-
-size_t TraceBufferV1WithV2Shadow::GetMemoryUsageBytes() const {
-  return v1_->GetMemoryUsageBytes() + v2_->GetMemoryUsageBytes();
-}
-
-TraceBuffer::OverwritePolicy TraceBufferV1WithV2Shadow::overwrite_policy()
-    const {
-  return v1_->overwrite_policy();
-}
-
-bool TraceBufferV1WithV2Shadow::has_data() const {
-  return v1_->has_data();
-}
-
-}  // namespace perfetto
-// gen_amalgamated begin source: src/tracing/service/trace_buffer_v2.cc
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 // gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v2.h"
 
 #include <algorithm>
@@ -64098,9 +64481,13 @@ void TraceBufferV2::CopyChunkUntrusted(
     std::optional<Frag> maybe_frag = frag_iter.NextFragmentInChunk();
     if (!maybe_frag.has_value()) {
       // Either we found less fragments than what the header said, or some
-      // fragment is out of bounds.
-      stats_.set_abi_violations(stats_.abi_violations() + 1);
-      PERFETTO_DCHECK(suppress_client_dchecks_for_testing_);
+      // fragment is out of bounds. The exception is a TraceWriter that
+      // deliberately aborted the packet (kPacketSizeDropPacket), which is not
+      // an ABI violation and is accounted via trace_writer_packet_loss.
+      if (!frag_iter.trace_writer_data_drop()) {
+        stats_.set_abi_violations(stats_.abi_violations() + 1);
+        PERFETTO_DCHECK(suppress_client_dchecks_for_testing_);
+      }
       break;
     }
     Frag& f = *maybe_frag;
@@ -64218,24 +64605,68 @@ void TraceBufferV2::CopyChunkUntrusted(
       PERFETTO_DCHECK(suppress_client_dchecks_for_testing_);
       return;
     }
-    // Only clear kChunkIncomplete on real IPC recommits (chunk_complete=true).
-    // During scraping the producer may still be writing, so the chunk should
-    // remain incomplete until the producer explicitly commits it.
-    if (chunk_complete)
-      recommit_chunk->flags &= ~kChunkIncomplete;
-    if (all_frags_size == recommit_chunk->payload_size) {
-      TRACE_BUFFER_V2_DLOG("  skipping recommit of identical chunk");
+
+    // Decide whether to relocate this re-commit rather than rewrite it in
+    // place. A scraped chunk that has been fully read keeps its copy at the
+    // offset where it was scraped, which can sit arbitrarily close to the
+    // write cursor, so the recovered packets could be overwritten before the
+    // next read. Relocating skips the already-consumed payload as in the
+    // re-admit of evicted chunks above. See b/518755701 for more details.
+
+    // The copy came from a scrape, so more payload may still be coming.
+    const bool copy_is_scraped = recommit_chunk->flags & kChunkIncomplete;
+
+    // Nothing for the erase to lose, nothing for the relocation to duplicate.
+    const bool copy_fully_consumed = recommit_chunk->payload_avail == 0;
+
+    // The producer's final commit (not another scrape), with new fragments.
+    const bool commit_adds_new_data =
+        chunk_complete && all_frags_size > recommit_chunk->payload_size;
+
+    // EraseCurrentChunk() only supports the first chunk of a sequence. Later
+    // chunks may stay physically ahead of the relocated one, which is fine:
+    // reads follow chunk_list, which is ordered by ChunkID and not by offset.
+    const bool copy_is_first_chunk_of_seq =
+        *chunk_list.begin() == OffsetOf(recommit_chunk);
+
+    // Only a ring buffer laps, so only there can the stale copy be overwritten.
+    // On kDiscard, routing the commit through the write path below could also
+    // hit the end-of-buffer DiscardWrite(), dropping the very fragments we are
+    // recovering and sealing the buffer for good.
+    const bool buffer_can_lap = overwrite_policy_ == kOverwrite;
+
+    const bool should_relocate_chunk =
+        copy_is_scraped && copy_fully_consumed && commit_adds_new_data &&
+        copy_is_first_chunk_of_seq && buffer_can_lap;
+
+    if (PERFETTO_LIKELY(!should_relocate_chunk)) {
+      // Only clear kChunkIncomplete on real IPC recommits
+      // (chunk_complete=true). During scraping the producer may still be
+      // writing, so the chunk should remain incomplete until the producer
+      // explicitly commits it.
+      if (chunk_complete)
+        recommit_chunk->flags &= ~kChunkIncomplete;
+      if (all_frags_size == recommit_chunk->payload_size) {
+        TRACE_BUFFER_V2_DLOG("  skipping recommit of identical chunk");
+        return;
+      }
+      uint16_t payload_consumed =
+          recommit_chunk->payload_size - recommit_chunk->payload_avail;
+      recommit_chunk->payload_size = all_frags_size_u16;
+      recommit_chunk->payload_avail = all_frags_size_u16 - payload_consumed;
+      memcpy(recommit_chunk->fragments_begin(), src, all_frags_size);
+      recommit_chunk->flags |= chunk_flags;
+      stats_.set_chunks_rewritten(stats_.chunks_rewritten() + 1);
       return;
     }
-    uint16_t payload_consumed =
-        recommit_chunk->payload_size - recommit_chunk->payload_avail;
-    recommit_chunk->payload_size = all_frags_size_u16;
-    recommit_chunk->payload_avail = all_frags_size_u16 - payload_consumed;
-    memcpy(recommit_chunk->fragments_begin(), src, all_frags_size);
-    recommit_chunk->flags |= chunk_flags;
-    stats_.set_chunks_rewritten(stats_.chunks_rewritten() + 1);
-    return;
-  }
+
+    // Erase the stale copy and fall through to the write path below, which
+    // re-creates the chunk at the write cursor.
+    TRACE_BUFFER_V2_DLOG("  Relocating consumed scraped chunk %u", chunk_id);
+    stats_.set_chunks_relocated(stats_.chunks_relocated() + 1);
+    previously_consumed_payload = recommit_chunk->payload_size;
+    internal::ChunkSeqIterator(this, &seq).EraseCurrentChunk();
+  }  // if (recommit_chunk)
 
   // If there isn't enough room from the given write position: write a padding
   // record to clear the end of the buffer, wrap and start at offset 0.
@@ -64259,8 +64690,9 @@ void TraceBufferV2::CopyChunkUntrusted(
   // Deletes all chunks from |wptr_| to |wptr_| + |record_size|.
   DeleteNextChunksFor(tbchunk_outer_size);
 
-  // If the DeleteNextChunksFor happens to delete a chunk in the same sequence,
-  // the insert_pos becomes invalid and we need to recompute that.
+  // |insert_pos| is invalid if any chunk was removed from this sequence since
+  // it was computed: either by the DeleteNextChunksFor above, or by the
+  // relocation erase.
   // Why don't we compute the insert_pos here? Because we also need to check
   // for re-commits (which are rare, but possible) and don't want to iterate
   // over the chunk list twice in most cases.
@@ -65293,6 +65725,11 @@ struct TracingSession {
   // session.
   bool IsCloneAllowed(uid_t clone_uid) const;
 
+  // Records |src|'s current state into concurrent_session_events, dropping the
+  // event once the buffer hits the limit. The cap bounds memory, as the buffer
+  // is drained only on ReadBuffers().
+  void AddConcurrentSessionEventWithLimit(const TracingSession& src);
+
   const TracingSessionID id;
 
   // The consumer that started the session.
@@ -65355,9 +65792,6 @@ struct TracingSession {
   // Whether we emitted the ProtoVM instances.
   bool did_emit_protovm_instances_ = false;
 
-  // Whether we should compress TracePackets after reading them.
-  bool compress_deflate = false;
-
   // The number of received triggers we've emitted into the trace output.
   size_t num_triggers_emitted_into_trace = 0;
 
@@ -65426,6 +65860,26 @@ struct TracingSession {
 
   State state = DISABLED;
 
+  // BOOTTIME (ns) when this session entered its current state. Maintained
+  // solely by SetSessionState(), which every state transition goes through.
+  // Used as the timestamp when this session is snapshotted into another
+  // session's concurrent_session_events.
+  int64_t current_state_start_ns = 0;
+
+  // State changes of other concurrently active sessions. Emitted as
+  // ConcurrentSessionEvent packets and cleared on ReadBuffers(), like
+  // lifecycle_events.
+  struct ConcurrentSessionEvent {
+    int64_t timestamp = 0;            // BOOTTIME (ns) of the state change.
+    TracingSessionID session_id = 0;  // Id of the session that changed state.
+    State state = DISABLED;           // The state it transitioned to.
+    uid_t consumer_uid = 0;           // Uid of its consumer.
+    uint32_t num_data_sources = 0;    // Its data source count.
+    std::string name;                 // Its unique_session_name (or empty).
+  };
+
+  std::vector<ConcurrentSessionEvent> concurrent_session_events;
+
   // If the consumer detached the session, this variable defines the key used
   // for identifying the session later when reattaching.
   std::string detach_key;
@@ -65544,6 +65998,9 @@ namespace protos {
 namespace gen {
 enum TraceStats_FinalFlushOutcome : int;
 }
+namespace pbzero {
+class TracePacket;
+}
 }  // namespace protos
 
 class Consumer;
@@ -65752,10 +66209,18 @@ class TracingServiceImpl : public TracingService {
   void EmitStats(TracingSession*, std::vector<TracePacket>*);
   TraceStats GetTraceStats(TracingSession*);
   void EmitLifecycleEvents(TracingSession*, std::vector<TracePacket>*);
+  // The only way to change a session's state. Broadcasts the change into the
+  // other opted-in sessions' concurrent_session_events.
+  void SetSessionState(TracingSession*, TracingSession::State);
+  void EmitConcurrentSessionEvents(TracingSession*, std::vector<TracePacket>*);
   void EmitUuid(TracingSession*, std::vector<TracePacket>*);
   void MaybeEmitTraceConfig(TracingSession*, std::vector<TracePacket>*);
   void EmitSystemInfo(std::vector<TracePacket>*);
   void EmitTraceProvenance(TracingSession*, std::vector<TracePacket>*);
+  // Sets the common header fields on a service-emitted packet (trusted uid +
+  // service sequence id), and, for a single-machine in-process session, stamps
+  // the local machine id so the trace has no separate host machine.
+  void SetServiceTracePacketHeader(protos::pbzero::TracePacket*);
   void MaybeEmitRemoteSystemInfo(std::vector<TracePacket>*);
   void MaybeEmitCloneTrigger(TracingSession*, std::vector<TracePacket>*);
   void MaybeEmitReceivedTriggers(TracingSession*, std::vector<TracePacket>*);
@@ -65862,6 +66327,12 @@ class TracingServiceImpl : public TracingService {
   std::multimap<std::string /*name*/, RegisteredDataSource> data_sources_;
   std::map<ProducerID, ProducerEndpointImpl*> producers_;
   std::map<RelayClientID, RelayEndpointImpl*> relay_clients_;
+
+  // Machine to attribute the service's own packets to. Adopted from an
+  // in-process producer (see ConnectProducer) so a single-machine in-process
+  // trace carries no separate host machine. Stays kDefaultMachineID for regular
+  // host/relay sessions, where service packets remain on the host machine.
+  MachineID local_machine_id_ = kDefaultMachineID;
   std::map<TracingSessionID, TracingSession> tracing_sessions_;
   std::map<BufferID, std::unique_ptr<TraceBuffer>> buffers_;
   std::map<std::string, int64_t> session_to_last_trace_s_;
@@ -66838,11 +67309,16 @@ inline base::StatusOr<base::SchedPolicyAndPrio> CreateSchedPolicyFromConfig(
 // gen_amalgamated expanded: #include "src/tracing/service/random.h"
 // gen_amalgamated expanded: #include "src/tracing/service/trace_buffer.h"
 // gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v1.h"
-// gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v1_with_v2_shadow.h"
 // gen_amalgamated expanded: #include "src/tracing/service/trace_buffer_v2.h"
 // gen_amalgamated expanded: #include "src/tracing/service/tracing_service_endpoints_impl.h"
 // gen_amalgamated expanded: #include "src/tracing/service/tracing_service_session.h"
 // gen_amalgamated expanded: #include "src/tracing/service/tracing_service_structs.h"
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+// gen_amalgamated expanded: #include "src/tracing/service/zlib_compressor.h"
+#endif
+#if PERFETTO_BUILDFLAG(PERFETTO_ZSTD)
+// gen_amalgamated expanded: #include "src/tracing/service/zstd_compressor.h"
+#endif
 
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.pbzero.h"
@@ -66853,6 +67329,7 @@ inline base::StatusOr<base::SchedPolicyAndPrio> CreateSchedPolicyFromConfig(
 // gen_amalgamated expanded: #include "protos/perfetto/protovm/vm_program.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/clock_snapshot.pbzero.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/extension_descriptor.pbzero.h"
+// gen_amalgamated expanded: #include "protos/perfetto/trace/perfetto/concurrent_session_event.pbzero.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/perfetto/trace_provenance.pbzero.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/perfetto/tracing_service_event.pbzero.h"
 // gen_amalgamated expanded: #include "protos/perfetto/trace/remote_clock_sync.pbzero.h"
@@ -67144,6 +67621,17 @@ TracingServiceImpl::ConnectProducer(Producer* producer,
       smb_scraping_enabled));
   auto it_and_inserted = producers_.emplace(id, endpoint.get());
   PERFETTO_DCHECK(it_and_inserted.second);
+
+  // Remember an in-process producer's machine so the service can attribute its
+  // own packets to it (see SetServiceTracePacketHeader), leaving a
+  // single-machine in-process trace with no separate host machine. Relayed
+  // producers connect with in_process=false and carry a remote machine id; they
+  // must not redirect the host service's own packets, so only an in-process
+  // producer is adopted here. A default machine id is fine to store; the stamp
+  // decision is made at emit time.
+  if (in_process)
+    local_machine_id_ = client_identity.machine_id();
+
   endpoint->shmem_size_hint_bytes_ = shared_memory_size_hint_bytes;
   endpoint->shmem_page_size_hint_bytes_ = shared_memory_page_size_hint_bytes;
 
@@ -67802,6 +68290,18 @@ base::Status TracingServiceImpl::EnableTracing(ConsumerEndpointImpl* consumer,
                                           weak_runner_.task_runner()))
            .first->second;
 
+  // Snapshot the current state of every other session into the newly created
+  // one, so its trace records which sessions were already active when it
+  // started. Each snapshot is timestamped with when that session entered its
+  // current state.
+  if (cfg.builtin_data_sources().enable_concurrent_session_events()) {
+    for (auto& [src_id, src] : tracing_sessions_) {
+      if (src_id == tsid)
+        continue;
+      tracing_session->AddConcurrentSessionEventWithLimit(src);
+    }
+  }
+
   tracing_session->trace_uuid = uuid;
 
   if (trace_filter)
@@ -67881,15 +68381,14 @@ base::Status TracingServiceImpl::EnableTracing(ConsumerEndpointImpl* consumer,
         cfg.fflush_post_write() == TraceConfig::FFLUSH_ENABLED;
   }
 
-  if (cfg.compression_type() == TraceConfig::COMPRESSION_TYPE_DEFLATE) {
-    if (init_opts_.compressor_fn) {
-      tracing_session->compress_deflate = true;
-    } else {
-      PERFETTO_LOG(
-          "COMPRESSION_TYPE_DEFLATE is not supported in the current build "
-          "configuration. Skipping compression");
-    }
+#if !PERFETTO_BUILDFLAG(PERFETTO_ZLIB) && !PERFETTO_BUILDFLAG(PERFETTO_ZSTD)
+  if (cfg.compression_type() != TraceConfig::COMPRESSION_TYPE_UNSPECIFIED ||
+      cfg.has_compression()) {
+    PERFETTO_LOG(
+        "Compression was requested but this build has no compressor. "
+        "Skipping compression");
   }
+#endif
 
   // Initialize the log buffers.
   bool did_allocate_all_buffers = true;
@@ -67930,9 +68429,6 @@ base::Status TracingServiceImpl::EnableTracing(ConsumerEndpointImpl* consumer,
       case TraceConfig::BufferConfig::TRACE_BUFFER_V2:
         new_buffer = TraceBufferV2::Create(buf_size, policy);
         break;
-      case TraceConfig::BufferConfig::TRACE_BUFFER_V2_SHADOW_MODE:
-        new_buffer = TraceBufferV1WithV2Shadow::Create(buf_size, policy);
-        break;
       case TraceConfig::BufferConfig::MODE_UNSPECIFIED:
         new_buffer = TraceBufferV1::Create(buf_size, policy);
         break;
@@ -68019,7 +68515,7 @@ base::Status TracingServiceImpl::EnableTracing(ConsumerEndpointImpl* consumer,
       // is handled few lines above (search for TriggerMode_MAX).
   }
 
-  tracing_session->state = TracingSession::CONFIGURED;
+  SetSessionState(tracing_session, TracingSession::CONFIGURED);
   PERFETTO_LOG(
       "Configured tracing session %" PRIu64
       ", #sources:%zu, duration:%u ms%s, #buffers:%d, total "
@@ -68189,7 +68685,7 @@ void TracingServiceImpl::StartTracing(TracingSessionID tsid) {
     return;
   }
 
-  tracing_session->state = TracingSession::STARTED;
+  SetSessionState(tracing_session, TracingSession::STARTED);
 
   // We store the start of trace snapshot separately as it's important to make
   // sure we can interpret all the data in the trace and storing it in the ring
@@ -68428,7 +68924,7 @@ void TracingServiceImpl::DisableTracing(TracingSessionID tsid,
   if (tracing_session->AllDataSourceInstancesStopped())
     return DisableTracingNotifyConsumerAndFlushFile(tracing_session, error);
 
-  tracing_session->state = TracingSession::DISABLING_WAITING_STOP_ACKS;
+  SetSessionState(tracing_session, TracingSession::DISABLING_WAITING_STOP_ACKS);
   weak_runner_.PostDelayedTask([this, tsid] { OnDisableTracingTimeout(tsid); },
                                tracing_session->data_source_stop_timeout_ms());
 
@@ -68489,8 +68985,7 @@ void TracingServiceImpl::OnAllDataSourceStartedTimeout(TracingSessionID tsid) {
 
   protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
   packet->set_timestamp(static_cast<uint64_t>(timestamp));
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
 
   size_t i = 0;
   protos::pbzero::TracingServiceEvent::DataSources* slow_data_sources =
@@ -68790,7 +69285,7 @@ void TracingServiceImpl::DisableTracingNotifyConsumerAndFlushFile(
           *producer, inst_kv.second);
     }
   }
-  tracing_session->state = TracingSession::DISABLED;
+  SetSessionState(tracing_session, TracingSession::DISABLED);
 
   // Scrape any remaining chunks that weren't flushed by the producers.
   for (auto& producer_id_and_producer : producers_)
@@ -68803,6 +69298,7 @@ void TracingServiceImpl::DisableTracingNotifyConsumerAndFlushFile(
 
   if (tracing_session->write_into_file) {
     tracing_session->write_period_ms = 0;
+    tracing_session->should_emit_stats = true;
     // Buffers are scraped, no need to flush before reading into file.
     ReadBuffersIntoFile(tracing_session->id,
                         /* async_flush_buffers_before_read = */ false);
@@ -68964,8 +69460,7 @@ void TracingServiceImpl::OnFlushTimeout(TracingSessionID tsid,
 
     protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
     packet->set_timestamp(static_cast<uint64_t>(timestamp));
-    packet->set_trusted_uid(static_cast<int32_t>(uid_));
-    packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+    SetServiceTracePacketHeader(packet.get());
 
     size_t i = 0;
     protos::pbzero::TracingServiceEvent::DataSources* event =
@@ -69432,6 +69927,11 @@ std::vector<TracePacket> TracingServiceImpl::ReadBuffers(
   if (!tracing_session->config.builtin_data_sources().disable_service_events())
     EmitLifecycleEvents(tracing_session, &packets);
 
+  if (tracing_session->config.builtin_data_sources()
+          .enable_concurrent_session_events()) {
+    EmitConcurrentSessionEvents(tracing_session, &packets);
+  }
+
   // In a multi-machine tracing session, emit clock synchronization messages for
   // remote machines.
   if (!tracing_session->config.builtin_data_sources()
@@ -69496,6 +69996,8 @@ std::vector<TracePacket> TracingServiceImpl::ReadBuffers(
           slice.own_data(), slice.size);
       const auto& client_identity_trusted =
           sequence_properties.client_identity_trusted;
+      // Producer data, not a service packet: keeps the producer's own sequence
+      // and machine id, so it can't use SetServiceTracePacketHeader.
       trusted_packet->set_trusted_uid(
           static_cast<int32_t>(client_identity_trusted.uid()));
       trusted_packet->set_trusted_packet_sequence_id(
@@ -69541,6 +70043,8 @@ std::vector<TracePacket> TracingServiceImpl::ReadBuffers(
     EmitLifecycleEvents(tracing_session, &packets);
   }
 
+  MaybeFilterPackets(tracing_session, &packets);
+
   // Only emit the stats when there is no more trace data is available to read.
   // That way, any problems that occur while reading from the buffers are
   // reflected in the emitted stats. This is particularly important for use
@@ -69549,10 +70053,14 @@ std::vector<TracePacket> TracingServiceImpl::ReadBuffers(
   if (!*has_more && tracing_session->should_emit_stats) {
     EmitStats(tracing_session, &packets);
     tracing_session->should_emit_stats = false;
+    if (tracing_session->trace_filter) {
+      size_t stats_packet_size = packets.back().size();
+      tracing_session->filter_input_packets++;
+      tracing_session->filter_input_bytes += stats_packet_size;
+      tracing_session->filter_output_bytes += stats_packet_size;
+    }
   }
 
-  MaybeFilterPackets(tracing_session, &packets);
-
   MaybeCompressPackets(tracing_session, &packets);
 
   if (!*has_more) {
@@ -69628,12 +70136,30 @@ void TracingServiceImpl::MaybeFilterPackets(TracingSession* tracing_session,
 
 void TracingServiceImpl::MaybeCompressPackets(
     TracingSession* tracing_session,
-    std::vector<TracePacket>* packets) {
-  if (!tracing_session->compress_deflate) {
+    [[maybe_unused]] std::vector<TracePacket>* packets) {
+  // Compress with the codec the config selects, preferring the newest (highest
+  // proto field number) this build supports. Leaves the packets uncompressed if
+  // none is available.
+  //
+  // The branches below run highest-field-number-first, so a new codec's branch
+  // goes at the top.
+  [[maybe_unused]] const auto& compression =
+      tracing_session->config.compression();
+#if PERFETTO_BUILDFLAG(PERFETTO_ZSTD)
+  if (compression.has_zstd()) {
+    ZstdCompressFn(packets, compression.zstd().level());
     return;
   }
-
-  init_opts_.compressor_fn(packets);
+#endif
+#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+  // Deflate also serves the legacy compression_type = DEFLATE, so configs
+  // predating `compression` still get compressed.
+  if (compression.has_deflate() || tracing_session->config.compression_type() ==
+                                       TraceConfig::COMPRESSION_TYPE_DEFLATE) {
+    ZlibCompressFn(packets);
+    return;
+  }
+#endif
 }
 
 bool TracingServiceImpl::WriteIntoFile(TracingSession* tracing_session,
@@ -69737,6 +70263,12 @@ void TracingServiceImpl::FreeBuffers(TracingSessionID tsid,
   bool is_long_trace =
       (tracing_session->config.write_into_file() &&
        tracing_session->config.file_write_period_ms() < kMillisPerDay);
+
+  // DisableTracing() above ignores cloned sessions: record their teardown
+  // here so other sessions observing this one see a terminal DISABLED state.
+  if (tracing_session->state == TracingSession::CLONED_READ_ONLY)
+    SetSessionState(tracing_session, TracingSession::DISABLED);
+
   auto pending_clones = std::move(tracing_session->pending_clones);
   tracing_sessions_.erase(tsid);
   tracing_session = nullptr;
@@ -70455,7 +70987,7 @@ void TracingServiceImpl::UpdateMemoryGuardrail() {
     }
   }
 
-  // Set the guard rail to 32MB + the sum of all the buffers over a 30 second
+  // Set the guard rail to 64MB + the sum of all the buffers over a 30 second
   // interval.
   uint64_t guardrail = base::kWatchdogDefaultMemorySlack + total_buffer_bytes;
   base::Watchdog::GetInstance()->SetMemoryLimit(guardrail, 30 * 1000);
@@ -70612,6 +71144,19 @@ bool TracingServiceImpl::SnapshotClocks(
   return true;
 }
 
+void TracingServiceImpl::SetServiceTracePacketHeader(
+    protos::pbzero::TracePacket* tp) {
+  tp->set_trusted_uid(static_cast<int32_t>(uid_));
+  tp->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  // When a local machine was adopted (an in-process producer with a non-default
+  // machine id; see ConnectProducer), attribute the service's own packets to it
+  // so the trace has no separate host machine. Host and relay sessions leave
+  // local_machine_id_ at the default and keep these packets on the host
+  // machine.
+  if (local_machine_id_ != kDefaultMachineID)
+    tp->set_machine_id(local_machine_id_);
+}
+
 void TracingServiceImpl::EmitClockSnapshot(
     TracingSession* tracing_session,
     TracingSession::ClockSnapshotData snapshot_data,
@@ -70635,8 +71180,7 @@ void TracingServiceImpl::EmitClockSnapshot(
     c->set_timestamp(clock_id_and_ts.timestamp);
   }
 
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
   SerializeAndAppendPacket(packets, packet.SerializeAsArray());
 }
 
@@ -70649,6 +71193,9 @@ void TracingServiceImpl::EmitSyncMarker(std::vector<TracePacket>* packets) {
     // calls. The ResynchronizeTraceStreamUsingSyncMarker test verifies the ABI.
     protozero::StaticBuffered<protos::pbzero::TracePacket> packet(
         &sync_marker_packet_[0], sizeof(sync_marker_packet_));
+    // Can't use SetServiceTracePacketHeader: fixed ABI (marker written last,
+    // after uid) and cached/reused across machines, so it must not gain a
+    // machine_id field. It's a stream-resync marker; host is fine.
     packet->set_trusted_uid(static_cast<int32_t>(uid_));
     packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
 
@@ -70663,8 +71210,7 @@ void TracingServiceImpl::EmitSyncMarker(std::vector<TracePacket>* packets) {
 void TracingServiceImpl::EmitStats(TracingSession* tracing_session,
                                    std::vector<TracePacket>* packets) {
   protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
   GetTraceStats(tracing_session).Serialize(packet->set_trace_stats());
   SerializeAndAppendPacket(packets, packet.SerializeAsArray());
 }
@@ -70754,8 +71300,7 @@ TraceStats TracingServiceImpl::GetTraceStats(TracingSession* tracing_session) {
 void TracingServiceImpl::EmitUuid(TracingSession* tracing_session,
                                   std::vector<TracePacket>* packets) {
   protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
   auto* uuid = packet->set_trace_uuid();
   uuid->set_lsb(tracing_session->trace_uuid.lsb());
   uuid->set_msb(tracing_session->trace_uuid.msb());
@@ -70768,8 +71313,7 @@ void TracingServiceImpl::MaybeEmitTraceConfig(
   if (tracing_session->did_emit_initial_packets)
     return;
   protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
   tracing_session->config.Serialize(packet->set_trace_config());
   SerializeAndAppendPacket(packets, packet.SerializeAsArray());
 }
@@ -70818,8 +71362,7 @@ void TracingServiceImpl::EmitSystemInfo(std::vector<TracePacket>* packets) {
   if (!sys_info.android_serial_console.empty())
     info->set_android_serial_console(sys_info.android_serial_console);
 
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
   SerializeAndAppendPacket(packets, packet.SerializeAsArray());
 }
 
@@ -70851,8 +71394,7 @@ void TracingServiceImpl::EmitTraceProvenance(
       sequence_proto->set_producer_id(static_cast<int32_t>(producer_id));
     }
   }
-  packet->set_trusted_uid(static_cast<int32_t>(uid_));
-  packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+  SetServiceTracePacketHeader(packet.get());
   SerializeAndAppendPacket(packets, packet.SerializeAsArray());
 }
 
@@ -70880,6 +71422,8 @@ void TracingServiceImpl::MaybeEmitRemoteSystemInfo(
     packet->AppendBytes(kTracePacketSystemInfoFieldId, system_info.data(),
                         system_info.size());
 
+    // Relay path: stamps each remote machine's own id, not the adopted local
+    // one, so it can't use SetServiceTracePacketHeader.
     packet->set_machine_id(machine_id);
     packet->set_trusted_uid(static_cast<int32_t>(uid_));
     packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
@@ -70898,8 +71442,7 @@ void TracingServiceImpl::EmitLifecycleEvents(
     for (int64_t ts : event.timestamps) {
       protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
       packet->set_timestamp(static_cast<uint64_t>(ts));
-      packet->set_trusted_uid(static_cast<int32_t>(uid_));
-      packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+      SetServiceTracePacketHeader(packet.get());
 
       auto* service_event = packet->set_service_event();
       service_event->AppendVarInt(event.field_id, 1);
@@ -70925,8 +71468,7 @@ void TracingServiceImpl::EmitLifecycleEvents(
     protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
     int64_t ts = tracing_session->buffer_cloned_timestamps[i];
     packet->set_timestamp(static_cast<uint64_t>(ts));
-    packet->set_trusted_uid(static_cast<int32_t>(uid_));
-    packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+    SetServiceTracePacketHeader(packet.get());
 
     auto* service_event = packet->set_service_event();
     service_event->set_buffer_cloned(static_cast<uint32_t>(i));
@@ -70948,6 +71490,88 @@ void TracingServiceImpl::EmitLifecycleEvents(
     SerializeAndAppendPacket(packets, std::move(pair.second));
 }
 
+void TracingServiceImpl::SetSessionState(TracingSession* session,
+                                         TracingSession::State new_state) {
+  PERFETTO_DCHECK_THREAD(thread_checker_);
+
+  if (session->state == new_state)
+    return;
+
+  session->state = new_state;
+  session->current_state_start_ns = clock_->GetBootTimeNs().count();
+
+  // Broadcast this state change into every other session that opted into
+  // concurrent session events, so their trace logs that this session changed
+  // state while they were running.
+  for (auto& [dst_id, dst] : tracing_sessions_) {
+    if (!dst.config.builtin_data_sources().enable_concurrent_session_events())
+      continue;
+    if (dst_id == session->id)
+      continue;
+
+    // Skip CLONED_READ_ONLY sessions, whose buffers are a frozen snapshot and
+    // must never change, and DISABLED ones (terminal, or not yet configured).
+    // Every other state (CONFIGURED, STARTED, DISABLING_WAITING_STOP_ACKS) is a
+    // live trace still being recorded or finalized, and will be read.
+    if (dst.state == TracingSession::CLONED_READ_ONLY ||
+        dst.state == TracingSession::DISABLED) {
+      continue;
+    }
+
+    dst.AddConcurrentSessionEventWithLimit(*session);
+  }
+}
+
+void TracingServiceImpl::EmitConcurrentSessionEvents(
+    TracingSession* tracing_session,
+    std::vector<TracePacket>* packets) {
+  auto& events = tracing_session->concurrent_session_events;
+  if (events.empty())
+    return;
+
+  // Sort by timestamp so this sequence has monotonic timestamps, like the
+  // other service-emitted sequences.
+  std::sort(events.begin(), events.end(),
+            [](const TracingSession::ConcurrentSessionEvent& a,
+               const TracingSession::ConcurrentSessionEvent& b) {
+              return a.timestamp < b.timestamp;
+            });
+
+  auto to_proto_state = [](TracingSession::State state) {
+    using protos::pbzero::ConcurrentSessionEvent;
+    switch (state) {
+      case TracingSession::DISABLED:
+        return ConcurrentSessionEvent::STATE_DISABLED;
+      case TracingSession::CONFIGURED:
+        return ConcurrentSessionEvent::STATE_CONFIGURED;
+      case TracingSession::STARTED:
+        return ConcurrentSessionEvent::STATE_STARTED;
+      case TracingSession::DISABLING_WAITING_STOP_ACKS:
+        return ConcurrentSessionEvent::STATE_DISABLING_WAITING_STOP_ACKS;
+      case TracingSession::CLONED_READ_ONLY:
+        return ConcurrentSessionEvent::STATE_CLONED_READ_ONLY;
+    }
+    PERFETTO_FATAL("For GCC");
+  };
+
+  for (const auto& event : events) {
+    protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
+    packet->set_timestamp(static_cast<uint64_t>(event.timestamp));
+    SetServiceTracePacketHeader(packet.get());
+    auto* session_event = packet->set_concurrent_session_event();
+    session_event->set_state(to_proto_state(event.state));
+    if (!event.name.empty()) {
+      session_event->set_session_name(event.name);
+    }
+    session_event->set_session_id(event.session_id);
+    session_event->set_consumer_uid(static_cast<int32_t>(event.consumer_uid));
+    session_event->set_num_data_sources(event.num_data_sources);
+    SerializeAndAppendPacket(packets, packet.SerializeAsArray());
+  }
+
+  events.clear();
+}
+
 void TracingServiceImpl::MaybeEmitRemoteClockSync(
     TracingSession* tracing_session,
     std::vector<TracePacket>* packets) {
@@ -71041,9 +71665,7 @@ void TracingServiceImpl::MaybeEmitProtoVmInstances(
   }
 
   if (maybe_packet) {
-    maybe_packet.value()->set_trusted_uid(static_cast<int32_t>(uid_));
-    maybe_packet.value()->set_trusted_packet_sequence_id(
-        kServicePacketSequenceID);
+    SetServiceTracePacketHeader(maybe_packet->get());
     SerializeAndAppendPacket(packets, maybe_packet->SerializeAsArray());
   }
 
@@ -71055,8 +71677,7 @@ void TracingServiceImpl::EmitExtensionDescriptors(
     std::vector<TracePacket>* packets) {
   for (const auto& desc : init_opts_.extension_descriptors) {
     protozero::HeapBuffered<protos::pbzero::TracePacket> packet;
-    packet->set_trusted_uid(static_cast<int32_t>(uid_));
-    packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+    SetServiceTracePacketHeader(packet.get());
     auto* ext = packet->set_extension_descriptor();
     if (desc.gzipped) {
       ext->set_extension_set_gzip(desc.start, desc.size);
@@ -71088,8 +71709,7 @@ void TracingServiceImpl::MaybeEmitCloneTrigger(
     trigger->set_stop_delay_ms(info.trigger_delay_ms);
 
     packet->set_timestamp(info.boot_time_ns);
-    packet->set_trusted_uid(static_cast<int32_t>(uid_));
-    packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+    SetServiceTracePacketHeader(packet.get());
     SerializeAndAppendPacket(packets, packet.SerializeAsArray());
   }
 }
@@ -71110,8 +71730,7 @@ void TracingServiceImpl::MaybeEmitReceivedTriggers(
     trigger->set_stop_delay_ms(info.trigger_delay_ms);
 
     packet->set_timestamp(info.boot_time_ns);
-    packet->set_trusted_uid(static_cast<int32_t>(uid_));
-    packet->set_trusted_packet_sequence_id(kServicePacketSequenceID);
+    SetServiceTracePacketHeader(packet.get());
     SerializeAndAppendPacket(packets, packet.SerializeAsArray());
     ++tracing_session->num_triggers_emitted_into_trace;
   }
@@ -71266,9 +71885,6 @@ base::Status TracingServiceImpl::FlushAndCloneSession(
       case TraceBuffer::kV2:
         buf = TraceBufferV2::Create(buf_size, buf_policy);
         break;
-      case TraceBuffer::kV1WithV2Shadow:
-        buf = TraceBufferV1WithV2Shadow::Create(buf_size, buf_policy);
-        break;
     }
     if (!buf) {
       // This is extremely rare but could happen on 32-bit. If the new buffer
@@ -71449,9 +72065,6 @@ bool TracingServiceImpl::DoCloneBuffers(const TracingSession& src,
         case TraceBuffer::kV2:
           src_buf = TraceBufferV2::Create(buf_size, buf_policy);
           break;
-        case TraceBuffer::kV1WithV2Shadow:
-          src_buf = TraceBufferV1WithV2Shadow::Create(buf_size, buf_policy);
-          break;
       }
       if (!src_buf) {
         // If the allocation fails put the buffer back and let the code below
@@ -71519,7 +72132,7 @@ base::Status TracingServiceImpl::FinishCloneSession(
   // that triggered it. See the corresponding code in perfetto_cmd.cc which
   // reads at triggering_subscription_id().
   const int64_t orig_uuid_lsb = src->trace_uuid.lsb();
-  cloned_session->state = TracingSession::CLONED_READ_ONLY;
+  SetSessionState(cloned_session, TracingSession::CLONED_READ_ONLY);
   cloned_session->trace_uuid = base::Uuidv4();
   cloned_session->trace_uuid.set_lsb(orig_uuid_lsb);
   *new_uuid = cloned_session->trace_uuid;
@@ -71554,13 +72167,13 @@ base::Status TracingServiceImpl::FinishCloneSession(
       std::vector<TracingSession::LifecycleEvent>(src->lifecycle_events);
   cloned_session->slow_start_event = src->slow_start_event;
   cloned_session->last_flush_events = src->last_flush_events;
+  cloned_session->concurrent_session_events = src->concurrent_session_events;
   cloned_session->initial_clock_snapshot = src->initial_clock_snapshot;
   cloned_session->clock_snapshot_ring_buffer = src->clock_snapshot_ring_buffer;
   cloned_session->invalid_packets = src->invalid_packets;
   cloned_session->flushes_requested = src->flushes_requested;
   cloned_session->flushes_succeeded = src->flushes_succeeded;
   cloned_session->flushes_failed = src->flushes_failed;
-  cloned_session->compress_deflate = src->compress_deflate;
   if (src->trace_filter && !skip_trace_filter) {
     // Copy the trace filter, unless it's a clone-for-bugreport (b/317065412).
     cloned_session->trace_filter.reset(
@@ -71705,221 +72318,25 @@ bool TracingSession::AllDataSourceInstancesStopped() {
                      });
 }
 
-}  // namespace perfetto::tracing_service
-// gen_amalgamated begin source: src/tracing/service/zlib_compressor.cc
-// gen_amalgamated begin header: src/tracing/service/zlib_compressor.h
-/*
- * Copyright (C) 2023 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
-#define SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
-
-#include <vector>
-
-// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-// gen_amalgamated expanded: #include "perfetto/ext/tracing/core/trace_packet.h"
-
-namespace perfetto {
-
-#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
-// Matches TracingServiceImpl::kMaxTracePacketSliceSize. Exposed for testing.
-static constexpr size_t kZlibCompressSliceSize = 128 * 1024 - 512;
-
-void ZlibCompressFn(std::vector<TracePacket>*);
-#endif
-
-}  // namespace perfetto
-
-#endif  // SRC_TRACING_SERVICE_ZLIB_COMPRESSOR_H_
-/*
- * Copyright (C) 2023 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// gen_amalgamated expanded: #include "src/tracing/service/zlib_compressor.h"
-
-// gen_amalgamated expanded: #include "perfetto/base/build_config.h"
-
-// File compiles to nothing when the buildflag is off (e.g. SDK opt-out).
-#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
-
-#include <zlib.h>
-
-// gen_amalgamated expanded: #include "protos/perfetto/trace/trace.pbzero.h"
-// gen_amalgamated expanded: #include "protos/perfetto/trace/trace_packet.pbzero.h"
+void TracingSession::AddConcurrentSessionEventWithLimit(
+    const TracingSession& src) {
+  static constexpr size_t kMaxConcurrentSessionEvents = 4096;
 
-namespace perfetto {
-
-namespace {
-
-struct Preamble {
-  uint32_t size;
-  std::array<uint8_t, 16> buf;
-};
-
-template <uint32_t id>
-Preamble GetPreamble(size_t sz) {
-  Preamble preamble;
-  uint8_t* ptr = preamble.buf.data();
-  constexpr uint32_t tag = protozero::proto_utils::MakeTagLengthDelimited(id);
-  ptr = protozero::proto_utils::WriteVarInt(tag, ptr);
-  ptr = protozero::proto_utils::WriteVarInt(sz, ptr);
-  preamble.size =
-      static_cast<uint32_t>(reinterpret_cast<uintptr_t>(ptr) -
-                            reinterpret_cast<uintptr_t>(preamble.buf.data()));
-  PERFETTO_DCHECK(preamble.size < preamble.buf.size());
-  return preamble;
-}
-
-Slice PreambleToSlice(const Preamble& preamble) {
-  Slice slice = Slice::Allocate(preamble.size);
-  memcpy(slice.own_data(), preamble.buf.data(), preamble.size);
-  return slice;
-}
-
-// A compressor for `TracePacket`s that uses zlib. The class is exposed for
-// testing.
-class ZlibPacketCompressor {
- public:
-  ZlibPacketCompressor();
-  ~ZlibPacketCompressor();
-
-  // Can be called multiple times, before Finish() is called.
-  void PushPacket(const TracePacket& packet);
-
-  // Returned the compressed data. Can be called at most once. After this call,
-  // the object is unusable (PushPacket should not be called) and must be
-  // destroyed.
-  TracePacket Finish();
-
- private:
-  void PushData(const void* data, uint32_t size);
-  void NewOutputSlice();
-  void PushCurSlice();
-
-  z_stream stream_;
-  size_t total_new_slices_size_ = 0;
-  std::vector<Slice> new_slices_;
-  std::unique_ptr<uint8_t[]> cur_slice_;
-};
-
-ZlibPacketCompressor::ZlibPacketCompressor() {
-  memset(&stream_, 0, sizeof(stream_));
-  int status = deflateInit(&stream_, 6);
-  PERFETTO_CHECK(status == Z_OK);
-}
-
-ZlibPacketCompressor::~ZlibPacketCompressor() {
-  int status = deflateEnd(&stream_);
-  PERFETTO_CHECK(status == Z_OK);
-}
-
-void ZlibPacketCompressor::PushPacket(const TracePacket& packet) {
-  // We need to be able to tokenize packets in the compressed stream, so we
-  // prefix a proto preamble to each packet. The compressed stream looks like a
-  // valid Trace proto.
-  Preamble preamble =
-      GetPreamble<protos::pbzero::Trace::kPacketFieldNumber>(packet.size());
-  PushData(preamble.buf.data(), preamble.size);
-  for (const Slice& slice : packet.slices()) {
-    PushData(slice.start, static_cast<uint32_t>(slice.size));
-  }
-}
-
-void ZlibPacketCompressor::PushData(const void* data, uint32_t size) {
-  stream_.next_in = const_cast<Bytef*>(static_cast<const Bytef*>(data));
-  stream_.avail_in = static_cast<uInt>(size);
-  while (stream_.avail_in != 0) {
-    if (stream_.avail_out == 0) {
-      NewOutputSlice();
-    }
-    int status = deflate(&stream_, Z_NO_FLUSH);
-    PERFETTO_CHECK(status == Z_OK);
-  }
-}
-
-TracePacket ZlibPacketCompressor::Finish() {
-  for (;;) {
-    int status = deflate(&stream_, Z_FINISH);
-    if (status == Z_STREAM_END)
-      break;
-    PERFETTO_CHECK(status == Z_OK || status == Z_BUF_ERROR);
-    NewOutputSlice();
-  }
-
-  PushCurSlice();
-
-  TracePacket packet;
-  packet.AddSlice(PreambleToSlice(
-      GetPreamble<protos::pbzero::TracePacket::kCompressedPacketsFieldNumber>(
-          total_new_slices_size_)));
-  for (auto& slice : new_slices_) {
-    packet.AddSlice(std::move(slice));
-  }
-  return packet;
-}
-
-void ZlibPacketCompressor::NewOutputSlice() {
-  PushCurSlice();
-  cur_slice_ = std::make_unique<uint8_t[]>(kZlibCompressSliceSize);
-  stream_.next_out = reinterpret_cast<Bytef*>(cur_slice_.get());
-  stream_.avail_out = kZlibCompressSliceSize;
-}
-
-void ZlibPacketCompressor::PushCurSlice() {
-  if (cur_slice_) {
-    total_new_slices_size_ += kZlibCompressSliceSize - stream_.avail_out;
-    new_slices_.push_back(Slice::TakeOwnership(
-        std::move(cur_slice_), kZlibCompressSliceSize - stream_.avail_out));
-  }
-}
-
-}  // namespace
-
-void ZlibCompressFn(std::vector<TracePacket>* packets) {
-  if (packets->empty()) {
+  if (concurrent_session_events.size() >= kMaxConcurrentSessionEvents)
     return;
-  }
-
-  ZlibPacketCompressor stream;
-
-  for (const TracePacket& packet : *packets) {
-    stream.PushPacket(packet);
-  }
-
-  TracePacket packet = stream.Finish();
 
-  packets->clear();
-  packets->push_back(std::move(packet));
+  ConcurrentSessionEvent event{};
+  event.timestamp = src.current_state_start_ns;
+  event.session_id = src.id;
+  event.state = src.state;
+  event.consumer_uid = src.consumer_uid;
+  event.num_data_sources =
+      static_cast<uint32_t>(src.data_source_instances.size());
+  event.name = src.config.unique_session_name();
+  concurrent_session_events.emplace_back(std::move(event));
 }
 
-}  // namespace perfetto
-
-#endif  // PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
+}  // namespace perfetto::tracing_service
 // gen_amalgamated begin source: src/tracing/internal/in_process_tracing_backend.cc
 /*
  * Copyright (C) 2019 The Android Open Source Project
@@ -71948,10 +72365,6 @@ void ZlibCompressFn(std::vector<TracePacket>* packets) {
 
 // gen_amalgamated expanded: #include "src/tracing/core/in_process_shared_memory.h"
 
-#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
-// gen_amalgamated expanded: #include "src/tracing/service/zlib_compressor.h"
-#endif
-
 // TODO(primiano): When the in-process backend is used, we should never end up
 // in a situation where the thread where the TracingService and Producer live
 // writes a packet and hence can get into the GetNewChunk() stall.
@@ -71997,13 +72410,6 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
     std::unique_ptr<InProcessSharedMemory::Factory> shm(
         new InProcessSharedMemory::Factory());
     TracingService::InitOpts init_opts = {};
-#if PERFETTO_BUILDFLAG(PERFETTO_ZLIB)
-    // Wire the zlib compressor so TraceConfig.compression_type =
-    // COMPRESSION_TYPE_DEFLATE takes effect on the in-process backend's
-    // service, mirroring what src/traced/service/service.cc does for the
-    // system backend.
-    init_opts.compressor_fn = &ZlibCompressFn;
-#endif
     service_ =
         TracingService::CreateInstance(std::move(shm), task_runner, init_opts);
     service_->SetSMBScrapingEnabled(true);
@@ -72079,6 +72485,7 @@ TracingService* InProcessTracingBackend::GetOrCreateService(
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_input_event_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_game_intervention_list_config.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/config/android/android_aflags_config.gen.h"
+// gen_amalgamated expanded: #include "protos/perfetto/common/trace_attributes.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/semantic_type.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/builtin_clock.gen.h"
 // gen_amalgamated expanded: #include "protos/perfetto/common/trace_stats.gen.h"
diff --git a/deps/perfetto/sdk/perfetto.h b/deps/perfetto/sdk/perfetto.h
index e439c2084e3b..5bf6732f9b76 100644
--- a/deps/perfetto/sdk/perfetto.h
+++ b/deps/perfetto/sdk/perfetto.h
@@ -64,6 +64,7 @@
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TP_INSTRUMENTS() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_LOCAL_SYMBOLIZER() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() (1)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD() (1)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TRACED_PERF() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_HEAPPROFD() (0)
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_STDERR_CRASH_DUMP() (0)
@@ -104,6 +105,7 @@ static const struct PerfettoBuildFlag kPerfettoBuildFlags[] = {
     {"PERFETTO_TP_HTTPD", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TP_HTTPD()},
     {"PERFETTO_TP_INSTRUMENTS", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TP_INSTRUMENTS()},
     {"PERFETTO_ZLIB", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB()},
+    {"PERFETTO_ZSTD", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD()},
     {"PERFETTO_TRACED_PERF", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_TRACED_PERF()},
     {"PERFETTO_HEAPPROFD", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_HEAPPROFD()},
     {"PERFETTO_STDERR_CRASH_DUMP", PERFETTO_BUILDFLAG_DEFINE_PERFETTO_STDERR_CRASH_DUMP()},
@@ -379,18 +381,31 @@ static const int kPerfettoBuildFlagsCount = sizeof(kPerfettoBuildFlags) / sizeof
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() 0
 #endif
 
+#undef PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD
+#if defined(PERFETTO_SDK_ENABLE_ZSTD) && (PERFETTO_SDK_ENABLE_ZSTD == 1)
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD() 1
+#else
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD() 0
+#endif
+
 #endif  // PERFETTO_BUILDFLAG(PERFETTO_AMALGAMATED_SDK)
 
-// Unlike PERFETTO_SDK_ENABLE_ZLIB above (amalgamated SDK opt-in), this is a
-// file-scope opt-out that applies to every build. Define it to compile out the
-// optional zlib compressor. Static libs like libperfetto_client_experimental
-// get linked into many binaries, so keeping the compressor out means those
-// binaries don't have to link libz. See tools/gen_android_bp.
+// Unlike the PERFETTO_SDK_ENABLE_* opt-ins above (amalgamated SDK), these are
+// file-scope opt-outs that apply to every build. Define them to compile out the
+// optional zlib/zstd compressors. Static libs like
+// libperfetto_client_experimental get linked into many binaries, so keeping a
+// compressor out means those binaries don't have to link libz/libzstd. See
+// tools/gen_android_bp.
 #if defined(PERFETTO_FORCE_DISABLE_ZLIB)
 #undef PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB
 #define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZLIB() 0
 #endif
 
+#if defined(PERFETTO_FORCE_DISABLE_ZSTD)
+#undef PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD
+#define PERFETTO_BUILDFLAG_DEFINE_PERFETTO_ZSTD() 0
+#endif
+
 #endif  // INCLUDE_PERFETTO_BASE_BUILD_CONFIG_H_
 // gen_amalgamated begin header: include/perfetto/base/logging.h
 // gen_amalgamated begin header: include/perfetto/base/compiler.h
@@ -670,23 +685,22 @@ inline void ignore_result(const T&...) {}
 
 // PERFETTO_SDK_EXPORT: Exports a symbol from the perfetto SDK shared library.
 //
-// This is controlled by two defines (that likely come from the compiler command
-// line):
-// * PERFETTO_SDK_DISABLE_SHLIB_EXPORT: If this is defined, no export
-//   annotations are added. This might be useful when static linking.
-// * PERFETTO_SDK_SHLIB_IMPLEMENTATION: This must be defined when compiling the
-//   shared library itself (in order to export the symbols), but must be
-//   undefined when compiling objects that use the shared library (in order to
-//   import the symbols).
-#if !defined(PERFETTO_SDK_DISABLE_SHLIB_EXPORT)
-#if defined(PERFETTO_SHLIB_SDK_IMPLEMENTATION)
+// The SDK is linked statically by default and PERFETTO_SDK_EXPORT expands to
+// nothing. This is controlled by two defines (that likely come from the
+// compiler command line):
+// * PERFETTO_SDK_SHLIB_IMPLEMENTATION: This must be defined when compiling
+//   objects that implement the SDK shared library (in order to export the
+//   symbols). This includes the case where those objects are linked into a
+//   larger shared library that re-exports the SDK ABI.
+// * PERFETTO_SDK_SHLIB: This must be defined when compiling objects that use
+//   the SDK as a shared library (in order to import the symbols).
+#if defined(PERFETTO_SDK_SHLIB_IMPLEMENTATION)
 #define PERFETTO_SDK_EXPORT PERFETTO_INTERNAL_DLL_EXPORT
-#else
+#elif defined(PERFETTO_SDK_SHLIB)
 #define PERFETTO_SDK_EXPORT PERFETTO_INTERNAL_DLL_IMPORT
-#endif
-#else  // defined(PERFETTO_SDK_DISABLE_SHLIB_EXPORT)
+#else
 #define PERFETTO_SDK_EXPORT
-#endif  // defined(PERFETTO_SDK_DISABLE_SHLIB_EXPORT)
+#endif
 
 #endif  // INCLUDE_PERFETTO_PUBLIC_ABI_EXPORT_H_
 /*
@@ -5453,8 +5467,8 @@ class LogMessage;
 class Screenshot;
 class SourceLocation;
 class TaskExecution;
-class TrackEvent_Callstack;
-class TrackEvent_Callstack_Frame;
+class TrackEvent_InlineCallstack;
+class TrackEvent_InlineCallstack_Frame;
 class TrackEvent_LegacyEvent;
 namespace perfetto_pbzero_enum_TrackEvent_LegacyEvent {
 enum FlowDirection : int32_t;
@@ -5790,7 +5804,7 @@ class TrackEventDefaults : public ::protozero::Message {
   }
 };
 
-class TrackEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/56> {
+class TrackEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/57> {
  public:
   TrackEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TrackEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -5837,6 +5851,8 @@ class TrackEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=
   ::protozero::ConstBytes callstack() const { return at<55>().as_bytes(); }
   bool has_callstack_iid() const { return at<56>().valid(); }
   uint64_t callstack_iid() const { return at<56>().as_uint64(); }
+  bool has_callstack_weight() const { return at<57>().valid(); }
+  double callstack_weight() const { return at<57>().as_double(); }
   bool has_debug_annotations() const { return at<4>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> debug_annotations() const { return GetRepeated<::protozero::ConstBytes>(4); }
   bool has_task_execution() const { return at<5>().valid(); }
@@ -5918,6 +5934,7 @@ class TrackEvent : public ::protozero::Message {
     kCorrelationIdStrIidFieldNumber = 54,
     kCallstackFieldNumber = 55,
     kCallstackIidFieldNumber = 56,
+    kCallstackWeightFieldNumber = 57,
     kDebugAnnotationsFieldNumber = 4,
     kTaskExecutionFieldNumber = 5,
     kLogMessageFieldNumber = 21,
@@ -5948,7 +5965,7 @@ class TrackEvent : public ::protozero::Message {
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TrackEvent"; }
 
-  using Callstack = ::perfetto::protos::pbzero::TrackEvent_Callstack;
+  using InlineCallstack = ::perfetto::protos::pbzero::TrackEvent_InlineCallstack;
   using LegacyEvent = ::perfetto::protos::pbzero::TrackEvent_LegacyEvent;
 
   using Type = ::perfetto::protos::pbzero::TrackEvent_Type;
@@ -6327,11 +6344,11 @@ class TrackEvent : public ::protozero::Message {
       55,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TrackEvent_Callstack,
+      TrackEvent_InlineCallstack,
       TrackEvent>;
 
   static constexpr FieldMetadata_Callstack kCallstack{};
-  template <typename T = TrackEvent_Callstack> T* set_callstack() {
+  template <typename T = TrackEvent_InlineCallstack> T* set_callstack() {
     return BeginNestedMessage<T>(55);
   }
 
@@ -6354,6 +6371,24 @@ class TrackEvent : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_CallstackWeight =
+    ::protozero::proto_utils::FieldMetadata<
+      57,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kDouble,
+      double,
+      TrackEvent>;
+
+  static constexpr FieldMetadata_CallstackWeight kCallstackWeight{};
+  void set_callstack_weight(double value) {
+    static constexpr uint32_t field_id = FieldMetadata_CallstackWeight::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kDouble>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_DebugAnnotations =
     ::protozero::proto_utils::FieldMetadata<
       4,
@@ -7137,45 +7172,45 @@ class TrackEvent_LegacyEvent : public ::protozero::Message {
   }
 };
 
-class TrackEvent_Callstack_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+class TrackEvent_InlineCallstack_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
  public:
-  TrackEvent_Callstack_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TrackEvent_Callstack_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TrackEvent_Callstack_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  TrackEvent_InlineCallstack_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TrackEvent_InlineCallstack_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TrackEvent_InlineCallstack_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_frames() const { return at<1>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> frames() const { return GetRepeated<::protozero::ConstBytes>(1); }
 };
 
-class TrackEvent_Callstack : public ::protozero::Message {
+class TrackEvent_InlineCallstack : public ::protozero::Message {
  public:
-  using Decoder = TrackEvent_Callstack_Decoder;
+  using Decoder = TrackEvent_InlineCallstack_Decoder;
   enum : int32_t {
     kFramesFieldNumber = 1,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.TrackEvent.Callstack"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TrackEvent.InlineCallstack"; }
 
-  using Frame = ::perfetto::protos::pbzero::TrackEvent_Callstack_Frame;
+  using Frame = ::perfetto::protos::pbzero::TrackEvent_InlineCallstack_Frame;
 
   using FieldMetadata_Frames =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TrackEvent_Callstack_Frame,
-      TrackEvent_Callstack>;
+      TrackEvent_InlineCallstack_Frame,
+      TrackEvent_InlineCallstack>;
 
   static constexpr FieldMetadata_Frames kFrames{};
-  template <typename T = TrackEvent_Callstack_Frame> T* add_frames() {
+  template <typename T = TrackEvent_InlineCallstack_Frame> T* add_frames() {
     return BeginNestedMessage<T>(1);
   }
 
 };
 
-class TrackEvent_Callstack_Frame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class TrackEvent_InlineCallstack_Frame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
-  TrackEvent_Callstack_Frame_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TrackEvent_Callstack_Frame_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TrackEvent_Callstack_Frame_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  TrackEvent_InlineCallstack_Frame_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TrackEvent_InlineCallstack_Frame_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TrackEvent_InlineCallstack_Frame_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_function_name() const { return at<1>().valid(); }
   ::protozero::ConstChars function_name() const { return at<1>().as_string(); }
   bool has_source_file() const { return at<2>().valid(); }
@@ -7184,15 +7219,15 @@ class TrackEvent_Callstack_Frame_Decoder : public ::protozero::TypedProtoDecoder
   uint32_t line_number() const { return at<3>().as_uint32(); }
 };
 
-class TrackEvent_Callstack_Frame : public ::protozero::Message {
+class TrackEvent_InlineCallstack_Frame : public ::protozero::Message {
  public:
-  using Decoder = TrackEvent_Callstack_Frame_Decoder;
+  using Decoder = TrackEvent_InlineCallstack_Frame_Decoder;
   enum : int32_t {
     kFunctionNameFieldNumber = 1,
     kSourceFileFieldNumber = 2,
     kLineNumberFieldNumber = 3,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.TrackEvent.Callstack.Frame"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TrackEvent.InlineCallstack.Frame"; }
 
 
   using FieldMetadata_FunctionName =
@@ -7201,7 +7236,7 @@ class TrackEvent_Callstack_Frame : public ::protozero::Message {
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      TrackEvent_Callstack_Frame>;
+      TrackEvent_InlineCallstack_Frame>;
 
   static constexpr FieldMetadata_FunctionName kFunctionName{};
   void set_function_name(const char* data, size_t size) {
@@ -7225,7 +7260,7 @@ class TrackEvent_Callstack_Frame : public ::protozero::Message {
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      TrackEvent_Callstack_Frame>;
+      TrackEvent_InlineCallstack_Frame>;
 
   static constexpr FieldMetadata_SourceFile kSourceFile{};
   void set_source_file(const char* data, size_t size) {
@@ -7249,7 +7284,7 @@ class TrackEvent_Callstack_Frame : public ::protozero::Message {
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kUint32,
       uint32_t,
-      TrackEvent_Callstack_Frame>;
+      TrackEvent_InlineCallstack_Frame>;
 
   static constexpr FieldMetadata_LineNumber kLineNumber{};
   void set_line_number(uint32_t value) {
@@ -7724,7 +7759,8 @@ namespace perfetto {
 namespace protos {
 namespace gen {
 class TraceConfig;
-class TraceConfig_Note;
+class TraceAttributes;
+class TraceAttributes_Attribute;
 class PriorityBoostConfig;
 class TraceConfig_SessionSemaphore;
 class TraceConfig_CmdTraceStartDelay;
@@ -7733,6 +7769,9 @@ class TraceConfig_TraceFilter;
 class TraceConfig_TraceFilter_StringFilterChain;
 class TraceConfig_TraceFilter_StringFilterRule;
 class TraceConfig_IncidentReportConfig;
+class TraceConfig_CompressionConfig;
+class TraceConfig_CompressionConfig_Zstd;
+class TraceConfig_CompressionConfig_Deflate;
 class TraceConfig_IncrementalStateConfig;
 class TraceConfig_TriggerConfig;
 class TraceConfig_TriggerConfig_Trigger;
@@ -7824,7 +7863,6 @@ enum TraceConfig_BufferConfig_FillPolicy : int {
 enum TraceConfig_BufferConfig_ExperimentalMode : int {
   TraceConfig_BufferConfig_ExperimentalMode_MODE_UNSPECIFIED = 0,
   TraceConfig_BufferConfig_ExperimentalMode_TRACE_BUFFER_V2 = 1,
-  TraceConfig_BufferConfig_ExperimentalMode_TRACE_BUFFER_V2_SHADOW_MODE = 2,
 };
 
 class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj {
@@ -7837,12 +7875,12 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
   using GuardrailOverrides = TraceConfig_GuardrailOverrides;
   using TriggerConfig = TraceConfig_TriggerConfig;
   using IncrementalStateConfig = TraceConfig_IncrementalStateConfig;
+  using CompressionConfig = TraceConfig_CompressionConfig;
   using IncidentReportConfig = TraceConfig_IncidentReportConfig;
   using TraceFilter = TraceConfig_TraceFilter;
   using AndroidReportConfig = TraceConfig_AndroidReportConfig;
   using CmdTraceStartDelay = TraceConfig_CmdTraceStartDelay;
   using SessionSemaphore = TraceConfig_SessionSemaphore;
-  using Note = TraceConfig_Note;
   using LockdownModeOperation = TraceConfig_LockdownModeOperation;
   static constexpr auto LOCKDOWN_UNCHANGED = TraceConfig_LockdownModeOperation_LOCKDOWN_UNCHANGED;
   static constexpr auto LOCKDOWN_CLEAR = TraceConfig_LockdownModeOperation_LOCKDOWN_CLEAR;
@@ -7901,6 +7939,7 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
     kAllowUserBuildTracingFieldNumber = 19,
     kUniqueSessionNameFieldNumber = 22,
     kCompressionTypeFieldNumber = 24,
+    kCompressionFieldNumber = 47,
     kIncidentReportConfigFieldNumber = 25,
     kStatsdLoggingFieldNumber = 31,
     kTraceUuidMsbFieldNumber = 27,
@@ -7914,7 +7953,7 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
     kWriteFlushModeFieldNumber = 44,
     kFflushPostWriteFieldNumber = 45,
     kTraceAllMachinesFieldNumber = 43,
-    kNotesFieldNumber = 46,
+    kTraceAttributesFieldNumber = 48,
   };
 
   TraceConfig();
@@ -8048,6 +8087,10 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
   TraceConfig_CompressionType compression_type() const { return compression_type_; }
   void set_compression_type(TraceConfig_CompressionType value) { compression_type_ = value; _has_field_.set(24); }
 
+  bool has_compression() const { return _has_field_[47]; }
+  const TraceConfig_CompressionConfig& compression() const { return *compression_; }
+  TraceConfig_CompressionConfig* mutable_compression() { _has_field_.set(47); return compression_.get(); }
+
   bool has_incident_report_config() const { return _has_field_[25]; }
   const TraceConfig_IncidentReportConfig& incident_report_config() const { return *incident_report_config_; }
   TraceConfig_IncidentReportConfig* mutable_incident_report_config() { _has_field_.set(25); return incident_report_config_.get(); }
@@ -8102,11 +8145,9 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
   bool trace_all_machines() const { return trace_all_machines_; }
   void set_trace_all_machines(bool value) { trace_all_machines_ = value; _has_field_.set(43); }
 
-  const std::vector<TraceConfig_Note>& notes() const { return notes_; }
-  std::vector<TraceConfig_Note>* mutable_notes() { return &notes_; }
-  int notes_size() const;
-  void clear_notes();
-  TraceConfig_Note* add_notes();
+  bool has_trace_attributes() const { return _has_field_[48]; }
+  const TraceAttributes& trace_attributes() const { return *trace_attributes_; }
+  TraceAttributes* mutable_trace_attributes() { _has_field_.set(48); return trace_attributes_.get(); }
 
  private:
   std::vector<TraceConfig_BufferConfig> buffers_;
@@ -8136,6 +8177,7 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
   bool allow_user_build_tracing_{};
   std::string unique_session_name_{};
   TraceConfig_CompressionType compression_type_{};
+  ::protozero::CopyablePtr<TraceConfig_CompressionConfig> compression_;
   ::protozero::CopyablePtr<TraceConfig_IncidentReportConfig> incident_report_config_;
   TraceConfig_StatsdLogging statsd_logging_{};
   int64_t trace_uuid_msb_{};
@@ -8149,54 +8191,13 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig : public ::protozero::CppMessageObj
   TraceConfig_WriteFlushMode write_flush_mode_{};
   TraceConfig_FFlushMode fflush_post_write_{};
   bool trace_all_machines_{};
-  std::vector<TraceConfig_Note> notes_;
+  ::protozero::CopyablePtr<TraceAttributes> trace_attributes_;
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<47> _has_field_{};
-};
-
-
-class PERFETTO_EXPORT_COMPONENT TraceConfig_Note : public ::protozero::CppMessageObj {
- public:
-  enum FieldNumbers {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-
-  TraceConfig_Note();
-  ~TraceConfig_Note() override;
-  TraceConfig_Note(TraceConfig_Note&&) noexcept;
-  TraceConfig_Note& operator=(TraceConfig_Note&&);
-  TraceConfig_Note(const TraceConfig_Note&);
-  TraceConfig_Note& operator=(const TraceConfig_Note&);
-  bool operator==(const TraceConfig_Note&) const;
-  bool operator!=(const TraceConfig_Note& other) const { return !(*this == other); }
-
-  bool ParseFromArray(const void*, size_t) override;
-  std::string SerializeAsString() const override;
-  std::vector<uint8_t> SerializeAsArray() const override;
-  void Serialize(::protozero::Message*) const;
-
-  bool has_key() const { return _has_field_[1]; }
-  const std::string& key() const { return key_; }
-  void set_key(const std::string& value) { key_ = value; _has_field_.set(1); }
-
-  bool has_value() const { return _has_field_[2]; }
-  const std::string& value() const { return value_; }
-  void set_value(const std::string& value) { value_ = value; _has_field_.set(2); }
-
- private:
-  std::string key_{};
-  std::string value_{};
-
-  // Allows to preserve unknown protobuf fields for compatibility
-  // with future versions of .proto files.
-  std::string unknown_fields_;
-
-  std::bitset<3> _has_field_{};
+  std::bitset<49> _has_field_{};
 };
 
 
@@ -8566,6 +8567,113 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_IncidentReportConfig : public ::prot
 };
 
 
+class PERFETTO_EXPORT_COMPONENT TraceConfig_CompressionConfig : public ::protozero::CppMessageObj {
+ public:
+  using Deflate = TraceConfig_CompressionConfig_Deflate;
+  using Zstd = TraceConfig_CompressionConfig_Zstd;
+  enum FieldNumbers {
+    kDeflateFieldNumber = 1,
+    kZstdFieldNumber = 2,
+  };
+
+  TraceConfig_CompressionConfig();
+  ~TraceConfig_CompressionConfig() override;
+  TraceConfig_CompressionConfig(TraceConfig_CompressionConfig&&) noexcept;
+  TraceConfig_CompressionConfig& operator=(TraceConfig_CompressionConfig&&);
+  TraceConfig_CompressionConfig(const TraceConfig_CompressionConfig&);
+  TraceConfig_CompressionConfig& operator=(const TraceConfig_CompressionConfig&);
+  bool operator==(const TraceConfig_CompressionConfig&) const;
+  bool operator!=(const TraceConfig_CompressionConfig& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_deflate() const { return _has_field_[1]; }
+  const TraceConfig_CompressionConfig_Deflate& deflate() const { return *deflate_; }
+  TraceConfig_CompressionConfig_Deflate* mutable_deflate() { _has_field_.set(1); return deflate_.get(); }
+
+  bool has_zstd() const { return _has_field_[2]; }
+  const TraceConfig_CompressionConfig_Zstd& zstd() const { return *zstd_; }
+  TraceConfig_CompressionConfig_Zstd* mutable_zstd() { _has_field_.set(2); return zstd_.get(); }
+
+ private:
+  ::protozero::CopyablePtr<TraceConfig_CompressionConfig_Deflate> deflate_;
+  ::protozero::CopyablePtr<TraceConfig_CompressionConfig_Zstd> zstd_;
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<3> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT TraceConfig_CompressionConfig_Zstd : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+    kLevelFieldNumber = 1,
+  };
+
+  TraceConfig_CompressionConfig_Zstd();
+  ~TraceConfig_CompressionConfig_Zstd() override;
+  TraceConfig_CompressionConfig_Zstd(TraceConfig_CompressionConfig_Zstd&&) noexcept;
+  TraceConfig_CompressionConfig_Zstd& operator=(TraceConfig_CompressionConfig_Zstd&&);
+  TraceConfig_CompressionConfig_Zstd(const TraceConfig_CompressionConfig_Zstd&);
+  TraceConfig_CompressionConfig_Zstd& operator=(const TraceConfig_CompressionConfig_Zstd&);
+  bool operator==(const TraceConfig_CompressionConfig_Zstd&) const;
+  bool operator!=(const TraceConfig_CompressionConfig_Zstd& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+  bool has_level() const { return _has_field_[1]; }
+  int32_t level() const { return level_; }
+  void set_level(int32_t value) { level_ = value; _has_field_.set(1); }
+
+ private:
+  int32_t level_{};
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<2> _has_field_{};
+};
+
+
+class PERFETTO_EXPORT_COMPONENT TraceConfig_CompressionConfig_Deflate : public ::protozero::CppMessageObj {
+ public:
+  enum FieldNumbers {
+  };
+
+  TraceConfig_CompressionConfig_Deflate();
+  ~TraceConfig_CompressionConfig_Deflate() override;
+  TraceConfig_CompressionConfig_Deflate(TraceConfig_CompressionConfig_Deflate&&) noexcept;
+  TraceConfig_CompressionConfig_Deflate& operator=(TraceConfig_CompressionConfig_Deflate&&);
+  TraceConfig_CompressionConfig_Deflate(const TraceConfig_CompressionConfig_Deflate&);
+  TraceConfig_CompressionConfig_Deflate& operator=(const TraceConfig_CompressionConfig_Deflate&);
+  bool operator==(const TraceConfig_CompressionConfig_Deflate&) const;
+  bool operator!=(const TraceConfig_CompressionConfig_Deflate& other) const { return !(*this == other); }
+
+  bool ParseFromArray(const void*, size_t) override;
+  std::string SerializeAsString() const override;
+  std::vector<uint8_t> SerializeAsArray() const override;
+  void Serialize(::protozero::Message*) const;
+
+ private:
+
+  // Allows to preserve unknown protobuf fields for compatibility
+  // with future versions of .proto files.
+  std::string unknown_fields_;
+
+  std::bitset<2> _has_field_{};
+};
+
+
 class PERFETTO_EXPORT_COMPONENT TraceConfig_IncrementalStateConfig : public ::protozero::CppMessageObj {
  public:
   enum FieldNumbers {
@@ -8876,6 +8984,7 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BuiltinDataSource : public ::protoze
     kPreferSuspendClockForSnapshotFieldNumber = 7,
     kDisableChunkUsageHistogramsFieldNumber = 8,
     kDisableExtensionDescriptorsFieldNumber = 9,
+    kEnableConcurrentSessionEventsFieldNumber = 10,
   };
 
   TraceConfig_BuiltinDataSource();
@@ -8928,6 +9037,10 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BuiltinDataSource : public ::protoze
   bool disable_extension_descriptors() const { return disable_extension_descriptors_; }
   void set_disable_extension_descriptors(bool value) { disable_extension_descriptors_ = value; _has_field_.set(9); }
 
+  bool has_enable_concurrent_session_events() const { return _has_field_[10]; }
+  bool enable_concurrent_session_events() const { return enable_concurrent_session_events_; }
+  void set_enable_concurrent_session_events(bool value) { enable_concurrent_session_events_ = value; _has_field_.set(10); }
+
  private:
   bool disable_clock_snapshotting_{};
   bool disable_trace_config_{};
@@ -8938,12 +9051,13 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BuiltinDataSource : public ::protoze
   bool prefer_suspend_clock_for_snapshot_{};
   bool disable_chunk_usage_histograms_{};
   bool disable_extension_descriptors_{};
+  bool enable_concurrent_session_events_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<10> _has_field_{};
+  std::bitset<11> _has_field_{};
 };
 
 
@@ -9020,9 +9134,8 @@ class PERFETTO_EXPORT_COMPONENT TraceConfig_BufferConfig : public ::protozero::C
   using ExperimentalMode = TraceConfig_BufferConfig_ExperimentalMode;
   static constexpr auto MODE_UNSPECIFIED = TraceConfig_BufferConfig_ExperimentalMode_MODE_UNSPECIFIED;
   static constexpr auto TRACE_BUFFER_V2 = TraceConfig_BufferConfig_ExperimentalMode_TRACE_BUFFER_V2;
-  static constexpr auto TRACE_BUFFER_V2_SHADOW_MODE = TraceConfig_BufferConfig_ExperimentalMode_TRACE_BUFFER_V2_SHADOW_MODE;
   static constexpr auto ExperimentalMode_MIN = TraceConfig_BufferConfig_ExperimentalMode_MODE_UNSPECIFIED;
-  static constexpr auto ExperimentalMode_MAX = TraceConfig_BufferConfig_ExperimentalMode_TRACE_BUFFER_V2_SHADOW_MODE;
+  static constexpr auto ExperimentalMode_MAX = TraceConfig_BufferConfig_ExperimentalMode_TRACE_BUFFER_V2;
   enum FieldNumbers {
     kSizeKbFieldNumber = 1,
     kFillPolicyFieldNumber = 4,
@@ -10642,7 +10755,8 @@ namespace internal {
 // So for each data source, for each instance, for each thread we keep one
 // TraceWriter.
 // The lookup is O(1): Given the TLS object, the TraceWriter is just tls[M][N].
-class TracingTLS : public Platform::ThreadLocalObject {
+class PERFETTO_EXPORT_COMPONENT TracingTLS
+    : public Platform::ThreadLocalObject {
  public:
   ~TracingTLS() override;
 
@@ -11171,8 +11285,6 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 class AndroidAflags;
-class AndroidCameraFrameEvent;
-class AndroidCameraSessionStats;
 class AndroidEnergyEstimationBreakdown;
 class AndroidGameInterventionList;
 class AndroidLogPacket;
@@ -11185,13 +11297,13 @@ class ChromeEventBundle;
 class ChromeMetadataPacket;
 class ChromeTrigger;
 class ClockSnapshot;
+class ConcurrentSessionEvent;
 class CpuInfo;
 class CpuPerUidData;
 class DeobfuscationMapping;
 class EntityStateResidency;
 class EtwTraceEventBundle;
 class ExtensionDescriptor;
-class FrameTimelineEvent;
 class FtraceEventBundle;
 class FtraceStats;
 class GenericGpuFrequencyEvent;
@@ -11224,6 +11336,7 @@ class ProcessTree;
 class ProfilePacket;
 class RemoteClockSync;
 class SmapsPacket;
+class StackSample;
 class StatsdAtom;
 class StreamingAllocation;
 class StreamingFree;
@@ -11446,22 +11559,20 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes smaps_packet() const { return at<68>().as_bytes(); }
   bool has_service_event() const { return at<69>().valid(); }
   ::protozero::ConstBytes service_event() const { return at<69>().as_bytes(); }
+  bool has_concurrent_session_event() const { return at<134>().valid(); }
+  ::protozero::ConstBytes concurrent_session_event() const { return at<134>().as_bytes(); }
+  bool has_stack_sample() const { return at<135>().valid(); }
+  ::protozero::ConstBytes stack_sample() const { return at<135>().as_bytes(); }
   bool has_initial_display_state() const { return at<70>().valid(); }
   ::protozero::ConstBytes initial_display_state() const { return at<70>().as_bytes(); }
   bool has_gpu_mem_total_event() const { return at<71>().valid(); }
   ::protozero::ConstBytes gpu_mem_total_event() const { return at<71>().as_bytes(); }
   bool has_memory_tracker_snapshot() const { return at<73>().valid(); }
   ::protozero::ConstBytes memory_tracker_snapshot() const { return at<73>().as_bytes(); }
-  bool has_frame_timeline_event() const { return at<76>().valid(); }
-  ::protozero::ConstBytes frame_timeline_event() const { return at<76>().as_bytes(); }
   bool has_android_energy_estimation_breakdown() const { return at<77>().valid(); }
   ::protozero::ConstBytes android_energy_estimation_breakdown() const { return at<77>().as_bytes(); }
   bool has_ui_state() const { return at<78>().valid(); }
   ::protozero::ConstBytes ui_state() const { return at<78>().as_bytes(); }
-  bool has_android_camera_frame_event() const { return at<80>().valid(); }
-  ::protozero::ConstBytes android_camera_frame_event() const { return at<80>().as_bytes(); }
-  bool has_android_camera_session_stats() const { return at<81>().valid(); }
-  ::protozero::ConstBytes android_camera_session_stats() const { return at<81>().as_bytes(); }
   bool has_translation_table() const { return at<82>().valid(); }
   ::protozero::ConstBytes translation_table() const { return at<82>().as_bytes(); }
   bool has_android_game_intervention_list() const { return at<83>().valid(); }
@@ -11498,6 +11609,8 @@ class TracePacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstBytes synchronization_marker() const { return at<36>().as_bytes(); }
   bool has_compressed_packets() const { return at<50>().valid(); }
   ::protozero::ConstBytes compressed_packets() const { return at<50>().as_bytes(); }
+  bool has_zstd_compressed_packets() const { return at<133>().valid(); }
+  ::protozero::ConstBytes zstd_compressed_packets() const { return at<133>().as_bytes(); }
   bool has_extension_descriptor() const { return at<72>().valid(); }
   ::protozero::ConstBytes extension_descriptor() const { return at<72>().as_bytes(); }
   bool has_etw_events() const { return at<95>().valid(); }
@@ -11601,14 +11714,13 @@ class TracePacket : public ::protozero::Message {
     kCpuInfoFieldNumber = 67,
     kSmapsPacketFieldNumber = 68,
     kServiceEventFieldNumber = 69,
+    kConcurrentSessionEventFieldNumber = 134,
+    kStackSampleFieldNumber = 135,
     kInitialDisplayStateFieldNumber = 70,
     kGpuMemTotalEventFieldNumber = 71,
     kMemoryTrackerSnapshotFieldNumber = 73,
-    kFrameTimelineEventFieldNumber = 76,
     kAndroidEnergyEstimationBreakdownFieldNumber = 77,
     kUiStateFieldNumber = 78,
-    kAndroidCameraFrameEventFieldNumber = 80,
-    kAndroidCameraSessionStatsFieldNumber = 81,
     kTranslationTableFieldNumber = 82,
     kAndroidGameInterventionListFieldNumber = 83,
     kStatsdAtomFieldNumber = 84,
@@ -11627,6 +11739,7 @@ class TracePacket : public ::protozero::Message {
     kFtraceEventsFieldNumber = 1,
     kSynchronizationMarkerFieldNumber = 36,
     kCompressedPacketsFieldNumber = 50,
+    kZstdCompressedPacketsFieldNumber = 133,
     kExtensionDescriptorFieldNumber = 72,
     kEtwEventsFieldNumber = 95,
     kV8JsCodeFieldNumber = 99,
@@ -12319,6 +12432,34 @@ class TracePacket : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_ConcurrentSessionEvent =
+    ::protozero::proto_utils::FieldMetadata<
+      134,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      ConcurrentSessionEvent,
+      TracePacket>;
+
+  static constexpr FieldMetadata_ConcurrentSessionEvent kConcurrentSessionEvent{};
+  template <typename T = ConcurrentSessionEvent> T* set_concurrent_session_event() {
+    return BeginNestedMessage<T>(134);
+  }
+
+
+  using FieldMetadata_StackSample =
+    ::protozero::proto_utils::FieldMetadata<
+      135,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample,
+      TracePacket>;
+
+  static constexpr FieldMetadata_StackSample kStackSample{};
+  template <typename T = StackSample> T* set_stack_sample() {
+    return BeginNestedMessage<T>(135);
+  }
+
+
   using FieldMetadata_InitialDisplayState =
     ::protozero::proto_utils::FieldMetadata<
       70,
@@ -12361,20 +12502,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_FrameTimelineEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      76,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FrameTimelineEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_FrameTimelineEvent kFrameTimelineEvent{};
-  template <typename T = FrameTimelineEvent> T* set_frame_timeline_event() {
-    return BeginNestedMessage<T>(76);
-  }
-
-
   using FieldMetadata_AndroidEnergyEstimationBreakdown =
     ::protozero::proto_utils::FieldMetadata<
       77,
@@ -12403,34 +12530,6 @@ class TracePacket : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_AndroidCameraFrameEvent =
-    ::protozero::proto_utils::FieldMetadata<
-      80,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidCameraFrameEvent,
-      TracePacket>;
-
-  static constexpr FieldMetadata_AndroidCameraFrameEvent kAndroidCameraFrameEvent{};
-  template <typename T = AndroidCameraFrameEvent> T* set_android_camera_frame_event() {
-    return BeginNestedMessage<T>(80);
-  }
-
-
-  using FieldMetadata_AndroidCameraSessionStats =
-    ::protozero::proto_utils::FieldMetadata<
-      81,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidCameraSessionStats,
-      TracePacket>;
-
-  static constexpr FieldMetadata_AndroidCameraSessionStats kAndroidCameraSessionStats{};
-  template <typename T = AndroidCameraSessionStats> T* set_android_camera_session_stats() {
-    return BeginNestedMessage<T>(81);
-  }
-
-
   using FieldMetadata_TranslationTable =
     ::protozero::proto_utils::FieldMetadata<
       82,
@@ -12703,6 +12802,30 @@ class TracePacket : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_ZstdCompressedPackets =
+    ::protozero::proto_utils::FieldMetadata<
+      133,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBytes,
+      std::string,
+      TracePacket>;
+
+  static constexpr FieldMetadata_ZstdCompressedPackets kZstdCompressedPackets{};
+  void set_zstd_compressed_packets(const uint8_t* data, size_t size) {
+    AppendBytes(FieldMetadata_ZstdCompressedPackets::kFieldId, data, size);
+  }
+  void set_zstd_compressed_packets(::protozero::ConstBytes bytes) {
+    AppendBytes(FieldMetadata_ZstdCompressedPackets::kFieldId, bytes.data, bytes.size);
+  }
+  void set_zstd_compressed_packets(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ZstdCompressedPackets::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_ExtensionDescriptor =
     ::protozero::proto_utils::FieldMetadata<
       72,
@@ -16301,15 +16424,35 @@ class has_traced_value_support {
 
 }  // namespace internal
 
+// A type T is writable into a trace if one of the following is defined:
+// - T::WriteIntoTracedValue(TracedValue) const
+// - T::WriteIntoTrace(TracedValue) const
+// - perfetto::TraceFormatTraits<T>::WriteIntoTracedValue(TracedValue, const T&)
+// - perfetto::TraceFormatTraits<T>::WriteIntoTrace(TracedValue, const T&)
+// The member forms are preferred for code that can depend on perfetto directly;
+// the TraceFormatTraits forms are for types owned by code that cannot. See the
+// examples at the top of this file. Primitives, strings, pointers, STL
+// containers and protozero enums are supported out of the box.
+//
+// If the static_assert below fires, the most common causes are:
+// - No conversion is defined for T.
+// - The conversion method is not const, or does not take TracedValue by value.
+// - The method name is misspelled: only WriteIntoTrace and WriteIntoTracedValue
+//   are recognised.
+// - The TraceFormatTraits<T> specialisation is not in the perfetto namespace.
+// - The header defining the conversion is not included at the TRACE_EVENT call
+//   site.
+// - T is a pointer or smart pointer to a type that is itself not writable.
+// - T is a plain enum with no conversion (only protozero enums are automatic).
 template <typename T>
 void WriteIntoTracedValue(TracedValue context, T&& value) {
-  // TODO(altimin): Add a URL to documentation and a list of common failure
-  // patterns.
   static_assert(
       internal::has_traced_value_support<T>::value,
       "The provided type (passed to TRACE_EVENT argument / TracedArray::Append "
       "/ TracedDictionary::Add) does not support being written in a trace "
-      "format. Please see the comment in traced_value.h for more details.");
+      "format. Please see the comment above WriteIntoTracedValue in "
+      "traced_value.h for the list of supported conversions and common "
+      "failure patterns.");
 
   // Should be kept in sync with check_traced_value_support_t!
   internal::WriteImpl(base::priority_tag<internal::kMaxWriteImplPriority>(),
@@ -19572,6 +19715,10 @@ class InternedV8WasmScript;
 class LogMessageBody;
 class Mapping;
 class SourceLocation;
+class StackSample_AsyncContextDescriptor;
+class StackSample_CounterDescriptor;
+class StackSample_ExecutionContext;
+class StackSample_TaskContext;
 class UnsymbolizedSourceLocation;
 } // Namespace pbzero.
 } // Namespace protos.
@@ -19581,7 +19728,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/47> {
+class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/51> {
  public:
   InternedData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit InternedData_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -19594,14 +19741,10 @@ class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_I
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> debug_annotation_names() const { return GetRepeated<::protozero::ConstBytes>(3); }
   bool has_debug_annotation_value_type_names() const { return at<27>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> debug_annotation_value_type_names() const { return GetRepeated<::protozero::ConstBytes>(27); }
-  bool has_source_locations() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> source_locations() const { return GetRepeated<::protozero::ConstBytes>(4); }
-  bool has_unsymbolized_source_locations() const { return at<28>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> unsymbolized_source_locations() const { return GetRepeated<::protozero::ConstBytes>(28); }
-  bool has_log_message_body() const { return at<20>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> log_message_body() const { return GetRepeated<::protozero::ConstBytes>(20); }
-  bool has_histogram_names() const { return at<25>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> histogram_names() const { return GetRepeated<::protozero::ConstBytes>(25); }
+  bool has_debug_annotation_string_values() const { return at<29>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> debug_annotation_string_values() const { return GetRepeated<::protozero::ConstBytes>(29); }
+  bool has_correlation_id_str() const { return at<43>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> correlation_id_str() const { return GetRepeated<::protozero::ConstBytes>(43); }
   bool has_build_ids() const { return at<16>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> build_ids() const { return GetRepeated<::protozero::ConstBytes>(16); }
   bool has_mapping_paths() const { return at<17>().valid(); }
@@ -19616,16 +19759,32 @@ class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_I
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> frames() const { return GetRepeated<::protozero::ConstBytes>(6); }
   bool has_callstacks() const { return at<7>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> callstacks() const { return GetRepeated<::protozero::ConstBytes>(7); }
+  bool has_stack_sample_task_contexts() const { return at<48>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> stack_sample_task_contexts() const { return GetRepeated<::protozero::ConstBytes>(48); }
+  bool has_stack_sample_execution_contexts() const { return at<49>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> stack_sample_execution_contexts() const { return GetRepeated<::protozero::ConstBytes>(49); }
+  bool has_stack_sample_counter_descriptors() const { return at<50>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> stack_sample_counter_descriptors() const { return GetRepeated<::protozero::ConstBytes>(50); }
+  bool has_stack_sample_async_context_descriptors() const { return at<51>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> stack_sample_async_context_descriptors() const { return GetRepeated<::protozero::ConstBytes>(51); }
+  bool has_source_locations() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> source_locations() const { return GetRepeated<::protozero::ConstBytes>(4); }
+  bool has_unsymbolized_source_locations() const { return at<28>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> unsymbolized_source_locations() const { return GetRepeated<::protozero::ConstBytes>(28); }
+  bool has_log_message_body() const { return at<20>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> log_message_body() const { return GetRepeated<::protozero::ConstBytes>(20); }
+  bool has_histogram_names() const { return at<25>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> histogram_names() const { return GetRepeated<::protozero::ConstBytes>(25); }
   bool has_vulkan_memory_keys() const { return at<22>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> vulkan_memory_keys() const { return GetRepeated<::protozero::ConstBytes>(22); }
   bool has_graphics_contexts() const { return at<23>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> graphics_contexts() const { return GetRepeated<::protozero::ConstBytes>(23); }
   bool has_gpu_specifications() const { return at<24>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> gpu_specifications() const { return GetRepeated<::protozero::ConstBytes>(24); }
+  bool has_gpu_counter_descriptors() const { return at<47>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> gpu_counter_descriptors() const { return GetRepeated<::protozero::ConstBytes>(47); }
   bool has_kernel_symbols() const { return at<26>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> kernel_symbols() const { return GetRepeated<::protozero::ConstBytes>(26); }
-  bool has_debug_annotation_string_values() const { return at<29>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> debug_annotation_string_values() const { return GetRepeated<::protozero::ConstBytes>(29); }
   bool has_v8_js_function_name() const { return at<31>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> v8_js_function_name() const { return GetRepeated<::protozero::ConstBytes>(31); }
   bool has_v8_js_function() const { return at<32>().valid(); }
@@ -19636,26 +19795,6 @@ class InternedData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_I
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> v8_wasm_script() const { return GetRepeated<::protozero::ConstBytes>(34); }
   bool has_v8_isolate() const { return at<35>().valid(); }
   ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> v8_isolate() const { return GetRepeated<::protozero::ConstBytes>(35); }
-  bool has_protolog_string_args() const { return at<36>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> protolog_string_args() const { return GetRepeated<::protozero::ConstBytes>(36); }
-  bool has_protolog_stacktrace() const { return at<37>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> protolog_stacktrace() const { return GetRepeated<::protozero::ConstBytes>(37); }
-  bool has_viewcapture_package_name() const { return at<38>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_package_name() const { return GetRepeated<::protozero::ConstBytes>(38); }
-  bool has_viewcapture_window_name() const { return at<39>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_window_name() const { return GetRepeated<::protozero::ConstBytes>(39); }
-  bool has_viewcapture_view_id() const { return at<40>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_view_id() const { return GetRepeated<::protozero::ConstBytes>(40); }
-  bool has_viewcapture_class_name() const { return at<41>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_class_name() const { return GetRepeated<::protozero::ConstBytes>(41); }
-  bool has_viewcapture_content_description() const { return at<45>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_content_description() const { return GetRepeated<::protozero::ConstBytes>(45); }
-  bool has_viewcapture_text() const { return at<46>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> viewcapture_text() const { return GetRepeated<::protozero::ConstBytes>(46); }
-  bool has_correlation_id_str() const { return at<43>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> correlation_id_str() const { return GetRepeated<::protozero::ConstBytes>(43); }
-  bool has_gpu_counter_descriptors() const { return at<47>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> gpu_counter_descriptors() const { return GetRepeated<::protozero::ConstBytes>(47); }
 };
 
 class InternedData : public ::protozero::Message {
@@ -19666,10 +19805,8 @@ class InternedData : public ::protozero::Message {
     kEventNamesFieldNumber = 2,
     kDebugAnnotationNamesFieldNumber = 3,
     kDebugAnnotationValueTypeNamesFieldNumber = 27,
-    kSourceLocationsFieldNumber = 4,
-    kUnsymbolizedSourceLocationsFieldNumber = 28,
-    kLogMessageBodyFieldNumber = 20,
-    kHistogramNamesFieldNumber = 25,
+    kDebugAnnotationStringValuesFieldNumber = 29,
+    kCorrelationIdStrFieldNumber = 43,
     kBuildIdsFieldNumber = 16,
     kMappingPathsFieldNumber = 17,
     kSourcePathsFieldNumber = 18,
@@ -19677,26 +19814,24 @@ class InternedData : public ::protozero::Message {
     kMappingsFieldNumber = 19,
     kFramesFieldNumber = 6,
     kCallstacksFieldNumber = 7,
+    kStackSampleTaskContextsFieldNumber = 48,
+    kStackSampleExecutionContextsFieldNumber = 49,
+    kStackSampleCounterDescriptorsFieldNumber = 50,
+    kStackSampleAsyncContextDescriptorsFieldNumber = 51,
+    kSourceLocationsFieldNumber = 4,
+    kUnsymbolizedSourceLocationsFieldNumber = 28,
+    kLogMessageBodyFieldNumber = 20,
+    kHistogramNamesFieldNumber = 25,
     kVulkanMemoryKeysFieldNumber = 22,
     kGraphicsContextsFieldNumber = 23,
     kGpuSpecificationsFieldNumber = 24,
+    kGpuCounterDescriptorsFieldNumber = 47,
     kKernelSymbolsFieldNumber = 26,
-    kDebugAnnotationStringValuesFieldNumber = 29,
     kV8JsFunctionNameFieldNumber = 31,
     kV8JsFunctionFieldNumber = 32,
     kV8JsScriptFieldNumber = 33,
     kV8WasmScriptFieldNumber = 34,
     kV8IsolateFieldNumber = 35,
-    kProtologStringArgsFieldNumber = 36,
-    kProtologStacktraceFieldNumber = 37,
-    kViewcapturePackageNameFieldNumber = 38,
-    kViewcaptureWindowNameFieldNumber = 39,
-    kViewcaptureViewIdFieldNumber = 40,
-    kViewcaptureClassNameFieldNumber = 41,
-    kViewcaptureContentDescriptionFieldNumber = 45,
-    kViewcaptureTextFieldNumber = 46,
-    kCorrelationIdStrFieldNumber = 43,
-    kGpuCounterDescriptorsFieldNumber = 47,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.InternedData"; }
 
@@ -19757,59 +19892,31 @@ class InternedData : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_SourceLocations =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      SourceLocation,
-      InternedData>;
-
-  static constexpr FieldMetadata_SourceLocations kSourceLocations{};
-  template <typename T = SourceLocation> T* add_source_locations() {
-    return BeginNestedMessage<T>(4);
-  }
-
-
-  using FieldMetadata_UnsymbolizedSourceLocations =
-    ::protozero::proto_utils::FieldMetadata<
-      28,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      UnsymbolizedSourceLocation,
-      InternedData>;
-
-  static constexpr FieldMetadata_UnsymbolizedSourceLocations kUnsymbolizedSourceLocations{};
-  template <typename T = UnsymbolizedSourceLocation> T* add_unsymbolized_source_locations() {
-    return BeginNestedMessage<T>(28);
-  }
-
-
-  using FieldMetadata_LogMessageBody =
+  using FieldMetadata_DebugAnnotationStringValues =
     ::protozero::proto_utils::FieldMetadata<
-      20,
+      29,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      LogMessageBody,
+      InternedString,
       InternedData>;
 
-  static constexpr FieldMetadata_LogMessageBody kLogMessageBody{};
-  template <typename T = LogMessageBody> T* add_log_message_body() {
-    return BeginNestedMessage<T>(20);
+  static constexpr FieldMetadata_DebugAnnotationStringValues kDebugAnnotationStringValues{};
+  template <typename T = InternedString> T* add_debug_annotation_string_values() {
+    return BeginNestedMessage<T>(29);
   }
 
 
-  using FieldMetadata_HistogramNames =
+  using FieldMetadata_CorrelationIdStr =
     ::protozero::proto_utils::FieldMetadata<
-      25,
+      43,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      HistogramName,
+      InternedString,
       InternedData>;
 
-  static constexpr FieldMetadata_HistogramNames kHistogramNames{};
-  template <typename T = HistogramName> T* add_histogram_names() {
-    return BeginNestedMessage<T>(25);
+  static constexpr FieldMetadata_CorrelationIdStr kCorrelationIdStr{};
+  template <typename T = InternedString> T* add_correlation_id_str() {
+    return BeginNestedMessage<T>(43);
   }
 
 
@@ -19911,283 +20018,255 @@ class InternedData : public ::protozero::Message {
   }
 
 
-  using FieldMetadata_VulkanMemoryKeys =
-    ::protozero::proto_utils::FieldMetadata<
-      22,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
-      InternedData>;
-
-  static constexpr FieldMetadata_VulkanMemoryKeys kVulkanMemoryKeys{};
-  template <typename T = InternedString> T* add_vulkan_memory_keys() {
-    return BeginNestedMessage<T>(22);
-  }
-
-
-  using FieldMetadata_GraphicsContexts =
-    ::protozero::proto_utils::FieldMetadata<
-      23,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedGraphicsContext,
-      InternedData>;
-
-  static constexpr FieldMetadata_GraphicsContexts kGraphicsContexts{};
-  template <typename T = InternedGraphicsContext> T* add_graphics_contexts() {
-    return BeginNestedMessage<T>(23);
-  }
-
-
-  using FieldMetadata_GpuSpecifications =
+  using FieldMetadata_StackSampleTaskContexts =
     ::protozero::proto_utils::FieldMetadata<
-      24,
+      48,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedGpuRenderStageSpecification,
+      StackSample_TaskContext,
       InternedData>;
 
-  static constexpr FieldMetadata_GpuSpecifications kGpuSpecifications{};
-  template <typename T = InternedGpuRenderStageSpecification> T* add_gpu_specifications() {
-    return BeginNestedMessage<T>(24);
+  static constexpr FieldMetadata_StackSampleTaskContexts kStackSampleTaskContexts{};
+  template <typename T = StackSample_TaskContext> T* add_stack_sample_task_contexts() {
+    return BeginNestedMessage<T>(48);
   }
 
 
-  using FieldMetadata_KernelSymbols =
+  using FieldMetadata_StackSampleExecutionContexts =
     ::protozero::proto_utils::FieldMetadata<
-      26,
+      49,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      StackSample_ExecutionContext,
       InternedData>;
 
-  static constexpr FieldMetadata_KernelSymbols kKernelSymbols{};
-  template <typename T = InternedString> T* add_kernel_symbols() {
-    return BeginNestedMessage<T>(26);
+  static constexpr FieldMetadata_StackSampleExecutionContexts kStackSampleExecutionContexts{};
+  template <typename T = StackSample_ExecutionContext> T* add_stack_sample_execution_contexts() {
+    return BeginNestedMessage<T>(49);
   }
 
 
-  using FieldMetadata_DebugAnnotationStringValues =
+  using FieldMetadata_StackSampleCounterDescriptors =
     ::protozero::proto_utils::FieldMetadata<
-      29,
+      50,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      StackSample_CounterDescriptor,
       InternedData>;
 
-  static constexpr FieldMetadata_DebugAnnotationStringValues kDebugAnnotationStringValues{};
-  template <typename T = InternedString> T* add_debug_annotation_string_values() {
-    return BeginNestedMessage<T>(29);
+  static constexpr FieldMetadata_StackSampleCounterDescriptors kStackSampleCounterDescriptors{};
+  template <typename T = StackSample_CounterDescriptor> T* add_stack_sample_counter_descriptors() {
+    return BeginNestedMessage<T>(50);
   }
 
 
-  using FieldMetadata_V8JsFunctionName =
+  using FieldMetadata_StackSampleAsyncContextDescriptors =
     ::protozero::proto_utils::FieldMetadata<
-      31,
+      51,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedV8String,
+      StackSample_AsyncContextDescriptor,
       InternedData>;
 
-  static constexpr FieldMetadata_V8JsFunctionName kV8JsFunctionName{};
-  template <typename T = InternedV8String> T* add_v8_js_function_name() {
-    return BeginNestedMessage<T>(31);
+  static constexpr FieldMetadata_StackSampleAsyncContextDescriptors kStackSampleAsyncContextDescriptors{};
+  template <typename T = StackSample_AsyncContextDescriptor> T* add_stack_sample_async_context_descriptors() {
+    return BeginNestedMessage<T>(51);
   }
 
 
-  using FieldMetadata_V8JsFunction =
+  using FieldMetadata_SourceLocations =
     ::protozero::proto_utils::FieldMetadata<
-      32,
+      4,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedV8JsFunction,
+      SourceLocation,
       InternedData>;
 
-  static constexpr FieldMetadata_V8JsFunction kV8JsFunction{};
-  template <typename T = InternedV8JsFunction> T* add_v8_js_function() {
-    return BeginNestedMessage<T>(32);
+  static constexpr FieldMetadata_SourceLocations kSourceLocations{};
+  template <typename T = SourceLocation> T* add_source_locations() {
+    return BeginNestedMessage<T>(4);
   }
 
 
-  using FieldMetadata_V8JsScript =
+  using FieldMetadata_UnsymbolizedSourceLocations =
     ::protozero::proto_utils::FieldMetadata<
-      33,
+      28,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedV8JsScript,
+      UnsymbolizedSourceLocation,
       InternedData>;
 
-  static constexpr FieldMetadata_V8JsScript kV8JsScript{};
-  template <typename T = InternedV8JsScript> T* add_v8_js_script() {
-    return BeginNestedMessage<T>(33);
+  static constexpr FieldMetadata_UnsymbolizedSourceLocations kUnsymbolizedSourceLocations{};
+  template <typename T = UnsymbolizedSourceLocation> T* add_unsymbolized_source_locations() {
+    return BeginNestedMessage<T>(28);
   }
 
 
-  using FieldMetadata_V8WasmScript =
+  using FieldMetadata_LogMessageBody =
     ::protozero::proto_utils::FieldMetadata<
-      34,
+      20,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedV8WasmScript,
+      LogMessageBody,
       InternedData>;
 
-  static constexpr FieldMetadata_V8WasmScript kV8WasmScript{};
-  template <typename T = InternedV8WasmScript> T* add_v8_wasm_script() {
-    return BeginNestedMessage<T>(34);
+  static constexpr FieldMetadata_LogMessageBody kLogMessageBody{};
+  template <typename T = LogMessageBody> T* add_log_message_body() {
+    return BeginNestedMessage<T>(20);
   }
 
 
-  using FieldMetadata_V8Isolate =
+  using FieldMetadata_HistogramNames =
     ::protozero::proto_utils::FieldMetadata<
-      35,
+      25,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedV8Isolate,
+      HistogramName,
       InternedData>;
 
-  static constexpr FieldMetadata_V8Isolate kV8Isolate{};
-  template <typename T = InternedV8Isolate> T* add_v8_isolate() {
-    return BeginNestedMessage<T>(35);
+  static constexpr FieldMetadata_HistogramNames kHistogramNames{};
+  template <typename T = HistogramName> T* add_histogram_names() {
+    return BeginNestedMessage<T>(25);
   }
 
 
-  using FieldMetadata_ProtologStringArgs =
+  using FieldMetadata_VulkanMemoryKeys =
     ::protozero::proto_utils::FieldMetadata<
-      36,
+      22,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
       InternedString,
       InternedData>;
 
-  static constexpr FieldMetadata_ProtologStringArgs kProtologStringArgs{};
-  template <typename T = InternedString> T* add_protolog_string_args() {
-    return BeginNestedMessage<T>(36);
+  static constexpr FieldMetadata_VulkanMemoryKeys kVulkanMemoryKeys{};
+  template <typename T = InternedString> T* add_vulkan_memory_keys() {
+    return BeginNestedMessage<T>(22);
   }
 
 
-  using FieldMetadata_ProtologStacktrace =
+  using FieldMetadata_GraphicsContexts =
     ::protozero::proto_utils::FieldMetadata<
-      37,
+      23,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedGraphicsContext,
       InternedData>;
 
-  static constexpr FieldMetadata_ProtologStacktrace kProtologStacktrace{};
-  template <typename T = InternedString> T* add_protolog_stacktrace() {
-    return BeginNestedMessage<T>(37);
+  static constexpr FieldMetadata_GraphicsContexts kGraphicsContexts{};
+  template <typename T = InternedGraphicsContext> T* add_graphics_contexts() {
+    return BeginNestedMessage<T>(23);
   }
 
 
-  using FieldMetadata_ViewcapturePackageName =
+  using FieldMetadata_GpuSpecifications =
     ::protozero::proto_utils::FieldMetadata<
-      38,
+      24,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedGpuRenderStageSpecification,
       InternedData>;
 
-  static constexpr FieldMetadata_ViewcapturePackageName kViewcapturePackageName{};
-  template <typename T = InternedString> T* add_viewcapture_package_name() {
-    return BeginNestedMessage<T>(38);
+  static constexpr FieldMetadata_GpuSpecifications kGpuSpecifications{};
+  template <typename T = InternedGpuRenderStageSpecification> T* add_gpu_specifications() {
+    return BeginNestedMessage<T>(24);
   }
 
 
-  using FieldMetadata_ViewcaptureWindowName =
+  using FieldMetadata_GpuCounterDescriptors =
     ::protozero::proto_utils::FieldMetadata<
-      39,
+      47,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedGpuCounterDescriptor,
       InternedData>;
 
-  static constexpr FieldMetadata_ViewcaptureWindowName kViewcaptureWindowName{};
-  template <typename T = InternedString> T* add_viewcapture_window_name() {
-    return BeginNestedMessage<T>(39);
+  static constexpr FieldMetadata_GpuCounterDescriptors kGpuCounterDescriptors{};
+  template <typename T = InternedGpuCounterDescriptor> T* add_gpu_counter_descriptors() {
+    return BeginNestedMessage<T>(47);
   }
 
 
-  using FieldMetadata_ViewcaptureViewId =
+  using FieldMetadata_KernelSymbols =
     ::protozero::proto_utils::FieldMetadata<
-      40,
+      26,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
       InternedString,
       InternedData>;
 
-  static constexpr FieldMetadata_ViewcaptureViewId kViewcaptureViewId{};
-  template <typename T = InternedString> T* add_viewcapture_view_id() {
-    return BeginNestedMessage<T>(40);
+  static constexpr FieldMetadata_KernelSymbols kKernelSymbols{};
+  template <typename T = InternedString> T* add_kernel_symbols() {
+    return BeginNestedMessage<T>(26);
   }
 
 
-  using FieldMetadata_ViewcaptureClassName =
+  using FieldMetadata_V8JsFunctionName =
     ::protozero::proto_utils::FieldMetadata<
-      41,
+      31,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedV8String,
       InternedData>;
 
-  static constexpr FieldMetadata_ViewcaptureClassName kViewcaptureClassName{};
-  template <typename T = InternedString> T* add_viewcapture_class_name() {
-    return BeginNestedMessage<T>(41);
+  static constexpr FieldMetadata_V8JsFunctionName kV8JsFunctionName{};
+  template <typename T = InternedV8String> T* add_v8_js_function_name() {
+    return BeginNestedMessage<T>(31);
   }
 
 
-  using FieldMetadata_ViewcaptureContentDescription =
+  using FieldMetadata_V8JsFunction =
     ::protozero::proto_utils::FieldMetadata<
-      45,
+      32,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedV8JsFunction,
       InternedData>;
 
-  static constexpr FieldMetadata_ViewcaptureContentDescription kViewcaptureContentDescription{};
-  template <typename T = InternedString> T* add_viewcapture_content_description() {
-    return BeginNestedMessage<T>(45);
+  static constexpr FieldMetadata_V8JsFunction kV8JsFunction{};
+  template <typename T = InternedV8JsFunction> T* add_v8_js_function() {
+    return BeginNestedMessage<T>(32);
   }
 
 
-  using FieldMetadata_ViewcaptureText =
+  using FieldMetadata_V8JsScript =
     ::protozero::proto_utils::FieldMetadata<
-      46,
+      33,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedV8JsScript,
       InternedData>;
 
-  static constexpr FieldMetadata_ViewcaptureText kViewcaptureText{};
-  template <typename T = InternedString> T* add_viewcapture_text() {
-    return BeginNestedMessage<T>(46);
+  static constexpr FieldMetadata_V8JsScript kV8JsScript{};
+  template <typename T = InternedV8JsScript> T* add_v8_js_script() {
+    return BeginNestedMessage<T>(33);
   }
 
 
-  using FieldMetadata_CorrelationIdStr =
+  using FieldMetadata_V8WasmScript =
     ::protozero::proto_utils::FieldMetadata<
-      43,
+      34,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedString,
+      InternedV8WasmScript,
       InternedData>;
 
-  static constexpr FieldMetadata_CorrelationIdStr kCorrelationIdStr{};
-  template <typename T = InternedString> T* add_correlation_id_str() {
-    return BeginNestedMessage<T>(43);
+  static constexpr FieldMetadata_V8WasmScript kV8WasmScript{};
+  template <typename T = InternedV8WasmScript> T* add_v8_wasm_script() {
+    return BeginNestedMessage<T>(34);
   }
 
 
-  using FieldMetadata_GpuCounterDescriptors =
+  using FieldMetadata_V8Isolate =
     ::protozero::proto_utils::FieldMetadata<
-      47,
+      35,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      InternedGpuCounterDescriptor,
+      InternedV8Isolate,
       InternedData>;
 
-  static constexpr FieldMetadata_GpuCounterDescriptors kGpuCounterDescriptors{};
-  template <typename T = InternedGpuCounterDescriptor> T* add_gpu_counter_descriptors() {
-    return BeginNestedMessage<T>(47);
+  static constexpr FieldMetadata_V8Isolate kV8Isolate{};
+  template <typename T = InternedV8Isolate> T* add_v8_isolate() {
+    return BeginNestedMessage<T>(35);
   }
 
 };
@@ -22482,6 +22561,9 @@ class StopArgsImpl : public DataSourceBase::StopArgs {
 // perfetto.protos.ClockSnapshot. However, custom clock IDs (>=64) are
 // reserved for internal use by the SDK for the time being.
 // The timestamp value should be in nanoseconds regardless of the clock domain.
+//
+// See the "Custom timestamps and clocks" section in
+// docs/instrumentation/track-events.md for a worked example.
 template <typename T>
 struct TraceTimestampTraits;
 
@@ -24191,10 +24273,11 @@ constexpr bool IsDynamicCategory(const ::perfetto::DynamicCategory&) {
 //     debug_annotation->set_string_value("value");
 //   });
 //
-//   |time_in_nanoseconds| should be an uint64_t by default. To support custom
-//   timestamp types,
-//   |perfetto::TraceTimestampTraits<T>::ConvertTimestampToTraceTimeNs|
-//   should be defined. See |ConvertTimestampToTraceTimeNs| for more details.
+//   |time_in_nanoseconds| is a uint64_t on the trace clock by default. To pass
+//   a custom timestamp type, or a timestamp on a different clock, specialize
+//   |perfetto::TraceTimestampTraits<T>| and define a static
+//   ConvertTimestampToTraceTimeNs in it. See the "Custom timestamps and clocks"
+//   section in docs/instrumentation/track-events.md for a full example.
 //
 // 3. Arbitrary number of debug annotations:
 //
@@ -29335,7 +29418,6 @@ class TraceStats;
 class TraceStats_FilterStats;
 class TraceStats_WriterStats;
 class TraceStats_BufferStats;
-class TraceStats_BufferStats_ShadowBufferStats;
 enum TraceStats_FinalFlushOutcome : int;
 }  // namespace perfetto
 }  // namespace protos
@@ -29630,7 +29712,6 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_WriterStats : public ::protozero::Cpp
 
 class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::CppMessageObj {
  public:
-  using ShadowBufferStats = TraceStats_BufferStats_ShadowBufferStats;
   enum FieldNumbers {
     kBufferSizeFieldNumber = 12,
     kBytesWrittenFieldNumber = 1,
@@ -29640,6 +29721,7 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::Cpp
     kPaddingBytesClearedFieldNumber = 16,
     kChunksWrittenFieldNumber = 2,
     kChunksRewrittenFieldNumber = 10,
+    kChunksRelocatedFieldNumber = 20,
     kChunksOverwrittenFieldNumber = 3,
     kChunksDiscardedFieldNumber = 18,
     kChunksReadFieldNumber = 17,
@@ -29651,7 +29733,6 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::Cpp
     kReadaheadsFailedFieldNumber = 8,
     kAbiViolationsFieldNumber = 9,
     kTraceWriterPacketLossFieldNumber = 19,
-    kShadowBufferStatsFieldNumber = 21,
   };
 
   TraceStats_BufferStats();
@@ -29700,6 +29781,10 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::Cpp
   uint64_t chunks_rewritten() const { return chunks_rewritten_; }
   void set_chunks_rewritten(uint64_t value) { chunks_rewritten_ = value; _has_field_.set(10); }
 
+  bool has_chunks_relocated() const { return _has_field_[20]; }
+  uint64_t chunks_relocated() const { return chunks_relocated_; }
+  void set_chunks_relocated(uint64_t value) { chunks_relocated_ = value; _has_field_.set(20); }
+
   bool has_chunks_overwritten() const { return _has_field_[3]; }
   uint64_t chunks_overwritten() const { return chunks_overwritten_; }
   void set_chunks_overwritten(uint64_t value) { chunks_overwritten_ = value; _has_field_.set(3); }
@@ -29744,10 +29829,6 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::Cpp
   uint64_t trace_writer_packet_loss() const { return trace_writer_packet_loss_; }
   void set_trace_writer_packet_loss(uint64_t value) { trace_writer_packet_loss_ = value; _has_field_.set(19); }
 
-  bool has_shadow_buffer_stats() const { return _has_field_[21]; }
-  const TraceStats_BufferStats_ShadowBufferStats& shadow_buffer_stats() const { return *shadow_buffer_stats_; }
-  TraceStats_BufferStats_ShadowBufferStats* mutable_shadow_buffer_stats() { _has_field_.set(21); return shadow_buffer_stats_.get(); }
-
  private:
   uint64_t buffer_size_{};
   uint64_t bytes_written_{};
@@ -29757,6 +29838,7 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::Cpp
   uint64_t padding_bytes_cleared_{};
   uint64_t chunks_written_{};
   uint64_t chunks_rewritten_{};
+  uint64_t chunks_relocated_{};
   uint64_t chunks_overwritten_{};
   uint64_t chunks_discarded_{};
   uint64_t chunks_read_{};
@@ -29768,90 +29850,12 @@ class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats : public ::protozero::Cpp
   uint64_t readaheads_failed_{};
   uint64_t abi_violations_{};
   uint64_t trace_writer_packet_loss_{};
-  ::protozero::CopyablePtr<TraceStats_BufferStats_ShadowBufferStats> shadow_buffer_stats_;
-
-  // Allows to preserve unknown protobuf fields for compatibility
-  // with future versions of .proto files.
-  std::string unknown_fields_;
-
-  std::bitset<22> _has_field_{};
-};
-
-
-class PERFETTO_EXPORT_COMPONENT TraceStats_BufferStats_ShadowBufferStats : public ::protozero::CppMessageObj {
- public:
-  enum FieldNumbers {
-    kPacketsSeenFieldNumber = 1,
-    kPacketsInBothFieldNumber = 2,
-    kPacketsOnlyV1FieldNumber = 3,
-    kPacketsOnlyV2FieldNumber = 4,
-    kPatchesAttemptedFieldNumber = 5,
-    kV1PatchesSucceededFieldNumber = 6,
-    kV2PatchesSucceededFieldNumber = 7,
-    kStatsVersionFieldNumber = 8,
-  };
-
-  TraceStats_BufferStats_ShadowBufferStats();
-  ~TraceStats_BufferStats_ShadowBufferStats() override;
-  TraceStats_BufferStats_ShadowBufferStats(TraceStats_BufferStats_ShadowBufferStats&&) noexcept;
-  TraceStats_BufferStats_ShadowBufferStats& operator=(TraceStats_BufferStats_ShadowBufferStats&&);
-  TraceStats_BufferStats_ShadowBufferStats(const TraceStats_BufferStats_ShadowBufferStats&);
-  TraceStats_BufferStats_ShadowBufferStats& operator=(const TraceStats_BufferStats_ShadowBufferStats&);
-  bool operator==(const TraceStats_BufferStats_ShadowBufferStats&) const;
-  bool operator!=(const TraceStats_BufferStats_ShadowBufferStats& other) const { return !(*this == other); }
-
-  bool ParseFromArray(const void*, size_t) override;
-  std::string SerializeAsString() const override;
-  std::vector<uint8_t> SerializeAsArray() const override;
-  void Serialize(::protozero::Message*) const;
-
-  bool has_packets_seen() const { return _has_field_[1]; }
-  uint64_t packets_seen() const { return packets_seen_; }
-  void set_packets_seen(uint64_t value) { packets_seen_ = value; _has_field_.set(1); }
-
-  bool has_packets_in_both() const { return _has_field_[2]; }
-  uint64_t packets_in_both() const { return packets_in_both_; }
-  void set_packets_in_both(uint64_t value) { packets_in_both_ = value; _has_field_.set(2); }
-
-  bool has_packets_only_v1() const { return _has_field_[3]; }
-  uint64_t packets_only_v1() const { return packets_only_v1_; }
-  void set_packets_only_v1(uint64_t value) { packets_only_v1_ = value; _has_field_.set(3); }
-
-  bool has_packets_only_v2() const { return _has_field_[4]; }
-  uint64_t packets_only_v2() const { return packets_only_v2_; }
-  void set_packets_only_v2(uint64_t value) { packets_only_v2_ = value; _has_field_.set(4); }
-
-  bool has_patches_attempted() const { return _has_field_[5]; }
-  uint64_t patches_attempted() const { return patches_attempted_; }
-  void set_patches_attempted(uint64_t value) { patches_attempted_ = value; _has_field_.set(5); }
-
-  bool has_v1_patches_succeeded() const { return _has_field_[6]; }
-  uint64_t v1_patches_succeeded() const { return v1_patches_succeeded_; }
-  void set_v1_patches_succeeded(uint64_t value) { v1_patches_succeeded_ = value; _has_field_.set(6); }
-
-  bool has_v2_patches_succeeded() const { return _has_field_[7]; }
-  uint64_t v2_patches_succeeded() const { return v2_patches_succeeded_; }
-  void set_v2_patches_succeeded(uint64_t value) { v2_patches_succeeded_ = value; _has_field_.set(7); }
-
-  bool has_stats_version() const { return _has_field_[8]; }
-  uint32_t stats_version() const { return stats_version_; }
-  void set_stats_version(uint32_t value) { stats_version_ = value; _has_field_.set(8); }
-
- private:
-  uint64_t packets_seen_{};
-  uint64_t packets_in_both_{};
-  uint64_t packets_only_v1_{};
-  uint64_t packets_only_v2_{};
-  uint64_t patches_attempted_{};
-  uint64_t v1_patches_succeeded_{};
-  uint64_t v2_patches_succeeded_{};
-  uint32_t stats_version_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<9> _has_field_{};
+  std::bitset<21> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -37624,7 +37628,6 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 class TraceStats_BufferStats;
-class TraceStats_BufferStats_ShadowBufferStats;
 class TraceStats_FilterStats;
 class TraceStats_WriterStats;
 namespace perfetto_pbzero_enum_TraceStats {
@@ -38274,7 +38277,7 @@ class TraceStats_WriterStats : public ::protozero::Message {
   }
 };
 
-class TraceStats_BufferStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/21> {
+class TraceStats_BufferStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/20> {
  public:
   TraceStats_BufferStats_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TraceStats_BufferStats_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -38295,6 +38298,8 @@ class TraceStats_BufferStats_Decoder : public ::protozero::TypedProtoDecoder</*M
   uint64_t chunks_written() const { return at<2>().as_uint64(); }
   bool has_chunks_rewritten() const { return at<10>().valid(); }
   uint64_t chunks_rewritten() const { return at<10>().as_uint64(); }
+  bool has_chunks_relocated() const { return at<20>().valid(); }
+  uint64_t chunks_relocated() const { return at<20>().as_uint64(); }
   bool has_chunks_overwritten() const { return at<3>().valid(); }
   uint64_t chunks_overwritten() const { return at<3>().as_uint64(); }
   bool has_chunks_discarded() const { return at<18>().valid(); }
@@ -38317,8 +38322,6 @@ class TraceStats_BufferStats_Decoder : public ::protozero::TypedProtoDecoder</*M
   uint64_t abi_violations() const { return at<9>().as_uint64(); }
   bool has_trace_writer_packet_loss() const { return at<19>().valid(); }
   uint64_t trace_writer_packet_loss() const { return at<19>().as_uint64(); }
-  bool has_shadow_buffer_stats() const { return at<21>().valid(); }
-  ::protozero::ConstBytes shadow_buffer_stats() const { return at<21>().as_bytes(); }
 };
 
 class TraceStats_BufferStats : public ::protozero::Message {
@@ -38333,6 +38336,7 @@ class TraceStats_BufferStats : public ::protozero::Message {
     kPaddingBytesClearedFieldNumber = 16,
     kChunksWrittenFieldNumber = 2,
     kChunksRewrittenFieldNumber = 10,
+    kChunksRelocatedFieldNumber = 20,
     kChunksOverwrittenFieldNumber = 3,
     kChunksDiscardedFieldNumber = 18,
     kChunksReadFieldNumber = 17,
@@ -38344,11 +38348,9 @@ class TraceStats_BufferStats : public ::protozero::Message {
     kReadaheadsFailedFieldNumber = 8,
     kAbiViolationsFieldNumber = 9,
     kTraceWriterPacketLossFieldNumber = 19,
-    kShadowBufferStatsFieldNumber = 21,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TraceStats.BufferStats"; }
 
-  using ShadowBufferStats = ::perfetto::protos::pbzero::TraceStats_BufferStats_ShadowBufferStats;
 
   using FieldMetadata_BufferSize =
     ::protozero::proto_utils::FieldMetadata<
@@ -38494,6 +38496,24 @@ class TraceStats_BufferStats : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_ChunksRelocated =
+    ::protozero::proto_utils::FieldMetadata<
+      20,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      TraceStats_BufferStats>;
+
+  static constexpr FieldMetadata_ChunksRelocated kChunksRelocated{};
+  void set_chunks_relocated(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ChunksRelocated::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_ChunksOverwritten =
     ::protozero::proto_utils::FieldMetadata<
       3,
@@ -38691,204 +38711,6 @@ class TraceStats_BufferStats : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
-
-  using FieldMetadata_ShadowBufferStats =
-    ::protozero::proto_utils::FieldMetadata<
-      21,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TraceStats_BufferStats_ShadowBufferStats,
-      TraceStats_BufferStats>;
-
-  static constexpr FieldMetadata_ShadowBufferStats kShadowBufferStats{};
-  template <typename T = TraceStats_BufferStats_ShadowBufferStats> T* set_shadow_buffer_stats() {
-    return BeginNestedMessage<T>(21);
-  }
-
-};
-
-class TraceStats_BufferStats_ShadowBufferStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
- public:
-  TraceStats_BufferStats_ShadowBufferStats_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceStats_BufferStats_ShadowBufferStats_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceStats_BufferStats_ShadowBufferStats_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_packets_seen() const { return at<1>().valid(); }
-  uint64_t packets_seen() const { return at<1>().as_uint64(); }
-  bool has_packets_in_both() const { return at<2>().valid(); }
-  uint64_t packets_in_both() const { return at<2>().as_uint64(); }
-  bool has_packets_only_v1() const { return at<3>().valid(); }
-  uint64_t packets_only_v1() const { return at<3>().as_uint64(); }
-  bool has_packets_only_v2() const { return at<4>().valid(); }
-  uint64_t packets_only_v2() const { return at<4>().as_uint64(); }
-  bool has_patches_attempted() const { return at<5>().valid(); }
-  uint64_t patches_attempted() const { return at<5>().as_uint64(); }
-  bool has_v1_patches_succeeded() const { return at<6>().valid(); }
-  uint64_t v1_patches_succeeded() const { return at<6>().as_uint64(); }
-  bool has_v2_patches_succeeded() const { return at<7>().valid(); }
-  uint64_t v2_patches_succeeded() const { return at<7>().as_uint64(); }
-  bool has_stats_version() const { return at<8>().valid(); }
-  uint32_t stats_version() const { return at<8>().as_uint32(); }
-};
-
-class TraceStats_BufferStats_ShadowBufferStats : public ::protozero::Message {
- public:
-  using Decoder = TraceStats_BufferStats_ShadowBufferStats_Decoder;
-  enum : int32_t {
-    kPacketsSeenFieldNumber = 1,
-    kPacketsInBothFieldNumber = 2,
-    kPacketsOnlyV1FieldNumber = 3,
-    kPacketsOnlyV2FieldNumber = 4,
-    kPatchesAttemptedFieldNumber = 5,
-    kV1PatchesSucceededFieldNumber = 6,
-    kV2PatchesSucceededFieldNumber = 7,
-    kStatsVersionFieldNumber = 8,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceStats.BufferStats.ShadowBufferStats"; }
-
-
-  using FieldMetadata_PacketsSeen =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_PacketsSeen kPacketsSeen{};
-  void set_packets_seen(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PacketsSeen::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PacketsInBoth =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_PacketsInBoth kPacketsInBoth{};
-  void set_packets_in_both(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PacketsInBoth::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PacketsOnlyV1 =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_PacketsOnlyV1 kPacketsOnlyV1{};
-  void set_packets_only_v1(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PacketsOnlyV1::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PacketsOnlyV2 =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_PacketsOnlyV2 kPacketsOnlyV2{};
-  void set_packets_only_v2(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PacketsOnlyV2::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PatchesAttempted =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_PatchesAttempted kPatchesAttempted{};
-  void set_patches_attempted(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PatchesAttempted::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_V1PatchesSucceeded =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_V1PatchesSucceeded kV1PatchesSucceeded{};
-  void set_v1_patches_succeeded(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_V1PatchesSucceeded::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_V2PatchesSucceeded =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_V2PatchesSucceeded kV2PatchesSucceeded{};
-  void set_v2_patches_succeeded(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_V2PatchesSucceeded::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StatsVersion =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceStats_BufferStats_ShadowBufferStats>;
-
-  static constexpr FieldMetadata_StatsVersion kStatsVersion{};
-  void set_stats_version(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StatsVersion::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
 };
 
 } // Namespace.
@@ -40806,6 +40628,7 @@ class PERFETTO_EXPORT_COMPONENT DisplayVideoConfig : public ::protozero::CppMess
     kFormatFieldNumber = 2,
     kKeyFrameIntervalSecsFieldNumber = 3,
     kMaxStreamSizeBytesFieldNumber = 4,
+    kBitrateBpsFieldNumber = 5,
   };
 
   DisplayVideoConfig();
@@ -40838,17 +40661,22 @@ class PERFETTO_EXPORT_COMPONENT DisplayVideoConfig : public ::protozero::CppMess
   uint64_t max_stream_size_bytes() const { return max_stream_size_bytes_; }
   void set_max_stream_size_bytes(uint64_t value) { max_stream_size_bytes_ = value; _has_field_.set(4); }
 
+  bool has_bitrate_bps() const { return _has_field_[5]; }
+  uint32_t bitrate_bps() const { return bitrate_bps_; }
+  void set_bitrate_bps(uint32_t value) { bitrate_bps_ = value; _has_field_.set(5); }
+
  private:
   float scale_{};
   DisplayVideoConfig_Format format_{};
   uint32_t key_frame_interval_secs_{};
   uint64_t max_stream_size_bytes_{};
+  uint32_t bitrate_bps_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<5> _has_field_{};
+  std::bitset<6> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -43494,6 +43322,7 @@ class PERFETTO_EXPORT_COMPONENT ProcessStatsConfig : public ::protozero::CppMess
     kRecordProcessRuntimeFieldNumber = 12,
     kRecordProcessDmabufRssFieldNumber = 13,
     kResolveProcessFdsFieldNumber = 9,
+    kSkipMainThreadMessageFieldNumber = 14,
   };
 
   ProcessStatsConfig();
@@ -43553,6 +43382,10 @@ class PERFETTO_EXPORT_COMPONENT ProcessStatsConfig : public ::protozero::CppMess
   bool resolve_process_fds() const { return resolve_process_fds_; }
   void set_resolve_process_fds(bool value) { resolve_process_fds_ = value; _has_field_.set(9); }
 
+  bool has_skip_main_thread_message() const { return _has_field_[14]; }
+  bool skip_main_thread_message() const { return skip_main_thread_message_; }
+  void set_skip_main_thread_message(bool value) { skip_main_thread_message_ = value; _has_field_.set(14); }
+
  private:
   std::vector<ProcessStatsConfig_Quirks> quirks_;
   bool scan_all_processes_on_start_{};
@@ -43564,12 +43397,13 @@ class PERFETTO_EXPORT_COMPONENT ProcessStatsConfig : public ::protozero::CppMess
   bool record_process_runtime_{};
   bool record_process_dmabuf_rss_{};
   bool resolve_process_fds_{};
+  bool skip_main_thread_message_{};
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<14> _has_field_{};
+  std::bitset<15> _has_field_{};
 };
 
 }  // namespace perfetto
@@ -45537,14 +45371,400 @@ enum AtomId : int {
   ATOM_NOTIFICATION_MEMORY_USE = 10174,
   ATOM_HDR_CAPABILITIES = 10175,
   ATOM_WS_FAVOURITE_WATCH_FACE_LIST_SNAPSHOT = 10176,
-  ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED = 910,
-  ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED = 820,
-  ATOM_THERMAL_STATUS_CALLED = 772,
-  ATOM_THERMAL_HEADROOM_CALLED = 773,
-  ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED = 774,
-  ATOM_ADPF_HINT_SESSION_TID_CLEANUP = 839,
-  ATOM_THERMAL_HEADROOM_THRESHOLDS = 10201,
-  ATOM_ADPF_SESSION_SNAPSHOT = 10218,
+  ATOM_WIFI_AWARE_NDP_REPORTED = 638,
+  ATOM_WIFI_AWARE_ATTACH_REPORTED = 639,
+  ATOM_WIFI_SELF_RECOVERY_TRIGGERED = 661,
+  ATOM_SOFT_AP_STARTED = 680,
+  ATOM_SOFT_AP_STOPPED = 681,
+  ATOM_WIFI_LOCK_RELEASED = 687,
+  ATOM_WIFI_LOCK_DEACTIVATED = 688,
+  ATOM_WIFI_CONFIG_SAVED = 689,
+  ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED = 690,
+  ATOM_WIFI_AWARE_HAL_API_CALLED = 691,
+  ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED = 692,
+  ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED = 693,
+  ATOM_WIFI_THREAD_TASK_EXECUTED = 694,
+  ATOM_WIFI_STATE_CHANGED = 700,
+  ATOM_PNO_SCAN_STARTED = 719,
+  ATOM_PNO_SCAN_STOPPED = 720,
+  ATOM_WIFI_IS_UNUSABLE_REPORTED = 722,
+  ATOM_WIFI_AP_CAPABILITIES_REPORTED = 723,
+  ATOM_SOFT_AP_STATE_CHANGED = 805,
+  ATOM_SCORER_PREDICTION_RESULT_REPORTED = 884,
+  ATOM_WIFI_AWARE_CAPABILITIES = 10190,
+  ATOM_WIFI_MODULE_INFO = 10193,
+  ATOM_WIFI_SETTING_INFO = 10194,
+  ATOM_WIFI_COMPLEX_SETTING_INFO = 10195,
+  ATOM_WIFI_CONFIGURED_NETWORK_INFO = 10198,
+  ATOM_WEAR_POWER_MENU_OPENED = 731,
+  ATOM_WEAR_ASSISTANT_OPENED = 755,
+  ATOM_FIRST_OVERLAY_STATE_CHANGED = 917,
+  ATOM_WS_WEAR_TIME_SESSION = 610,
+  ATOM_WS_INCOMING_CALL_ACTION_REPORTED = 626,
+  ATOM_WS_CALL_DISCONNECTION_REPORTED = 627,
+  ATOM_WS_CALL_DURATION_REPORTED = 628,
+  ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED = 629,
+  ATOM_WS_CALL_INTERACTION_REPORTED = 630,
+  ATOM_WS_ON_BODY_STATE_CHANGED = 787,
+  ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED = 802,
+  ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED = 803,
+  ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED = 804,
+  ATOM_WS_REMOTE_EVENT_USAGE_REPORTED = 920,
+  ATOM_WS_NOTIFICATION_MANAGED_DISMISSAL_SYNC = 941,
+  ATOM_WS_BUGREPORT_EVENT_REPORTED = 964,
+  ATOM_WS_STANDALONE_MODE_SNAPSHOT = 10197,
+  ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT = 10206,
+  ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT = 10225,
+  ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT = 10227,
+  ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED = 619,
+  ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED = 620,
+  ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED = 621,
+  ATOM_WEAR_TIME_SYNC_REQUESTED = 911,
+  ATOM_WEAR_TIME_UPDATE_STARTED = 912,
+  ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED = 913,
+  ATOM_WEAR_TIME_CHANGED = 914,
+  ATOM_WEAR_SETUP_WIZARD_DEVICE_STATUS_REPORTED = 953,
+  ATOM_WEAR_SETUP_WIZARD_PAIRING_COMPLETED = 954,
+  ATOM_WEAR_SETUP_WIZARD_CONNECTION_ESTABLISHED = 955,
+  ATOM_WEAR_SETUP_WIZARD_CHECKIN_COMPLETED = 956,
+  ATOM_WEAR_SETUP_WIZARD_COMPANION_TIME_REPORTED = 957,
+  ATOM_WEAR_SETUP_WIZARD_STATUS_REPORTED = 958,
+  ATOM_WEAR_SETUP_WIZARD_HEARTBEAT_REPORTED = 959,
+  ATOM_WEAR_SETUP_WIZARD_FRP_TRIGGERED = 960,
+  ATOM_WEAR_SETUP_WIZARD_SYSTEM_UPDATE_TRIGGERED = 961,
+  ATOM_WEAR_SETUP_WIZARD_PHONE_SWITCH_TRIGGERED = 962,
+  ATOM_RENDERER_INITIALIZED = 736,
+  ATOM_SCHEMA_VERSION_RECEIVED = 737,
+  ATOM_LAYOUT_INSPECTED = 741,
+  ATOM_LAYOUT_EXPRESSION_INSPECTED = 742,
+  ATOM_LAYOUT_ANIMATIONS_INSPECTED = 743,
+  ATOM_MATERIAL_COMPONENTS_INSPECTED = 744,
+  ATOM_TILE_REQUESTED = 745,
+  ATOM_STATE_RESPONSE_RECEIVED = 746,
+  ATOM_TILE_RESPONSE_RECEIVED = 747,
+  ATOM_INFLATION_FINISHED = 748,
+  ATOM_INFLATION_FAILED = 749,
+  ATOM_IGNORED_INFLATION_FAILURES_REPORTED = 750,
+  ATOM_DRAWABLE_RENDERED = 751,
+  ATOM_WEAR_MODE_STATE_CHANGED = 715,
+  ATOM_MEDIA_ACTION_REPORTED = 608,
+  ATOM_MEDIA_CONTROLS_LAUNCHED = 609,
+  ATOM_MEDIA_SESSION_STATE_CHANGED = 677,
+  ATOM_MEDIA_CONTROL_API_USAGE_REPORTED = 966,
+  ATOM_MEDIA_SUBSCRIPTION_CHANGED = 990,
+  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY = 757,
+  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE = 758,
+  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT = 759,
+  ATOM_MEDIATOR_UPDATED = 721,
+  ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER = 10196,
+  ATOM_SYSPROXY_CONNECTION_UPDATED = 786,
+  ATOM_WEAR_COMPANION_CONNECTION_STATE = 921,
+  ATOM_SYSPROXY_SERVICE_STATE_UPDATED = 949,
+  ATOM_UWB_ACTIVITY_INFO = 10188,
+  ATOM_TEST_UPROBESTATS_ATOM_REPORTED = 915,
+  ATOM_TV_LOW_POWER_STANDBY_POLICY = 679,
+  ATOM_EXTERNAL_TV_INPUT_EVENT = 717,
+  ATOM_BOOT_INTEGRITY_INFO_REPORTED = 775,
+  ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED = 738,
+  ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED = 739,
+  ATOM_THREADNETWORK_DEVICE_INFO_REPORTED = 740,
+  ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED = 713,
+  ATOM_EMERGENCY_NUMBERS_INFO = 10180,
+  ATOM_DATA_NETWORK_VALIDATION = 10207,
+  ATOM_DATA_RAT_STATE_CHANGED = 854,
+  ATOM_CONNECTED_CHANNEL_CHANGED = 882,
+  ATOM_CELLULAR_IDENTIFIER_DISCLOSED = 800,
+  ATOM_SATELLITE_CONTROLLER = 10182,
+  ATOM_SATELLITE_SESSION = 10183,
+  ATOM_SATELLITE_INCOMING_DATAGRAM = 10184,
+  ATOM_SATELLITE_OUTGOING_DATAGRAM = 10185,
+  ATOM_SATELLITE_PROVISION = 10186,
+  ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER = 10187,
+  ATOM_CARRIER_ROAMING_SATELLITE_SESSION = 10211,
+  ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS = 10212,
+  ATOM_CONTROLLER_STATS_PER_PACKAGE = 10213,
+  ATOM_SATELLITE_ENTITLEMENT = 10214,
+  ATOM_SATELLITE_CONFIG_UPDATER = 10215,
+  ATOM_SATELLITE_ACCESS_CONTROLLER = 10219,
+  ATOM_QUALIFIED_RAT_LIST_CHANGED = 634,
+  ATOM_QNS_IMS_CALL_DROP_STATS = 635,
+  ATOM_QNS_FALLBACK_RESTRICTION_CHANGED = 636,
+  ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO = 10177,
+  ATOM_QNS_HANDOVER_TIME_MILLIS = 10178,
+  ATOM_QNS_HANDOVER_PINGPONG = 10179,
+  ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED = 923,
+  ATOM_EMERGENCY_NUMBER_DIALED = 637,
+  ATOM_CALL_STATS = 10221,
+  ATOM_CALL_AUDIO_ROUTE_STATS = 10222,
+  ATOM_TELECOM_API_STATS = 10223,
+  ATOM_TELECOM_ERROR_STATS = 10224,
+  ATOM_LOCKSCREEN_SHORTCUT_SELECTED = 611,
+  ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED = 612,
+  ATOM_LAUNCHER_IMPRESSION_EVENT_V2 = 716,
+  ATOM_DISPLAY_SWITCH_LATENCY_TRACKED = 753,
+  ATOM_NOTIFICATION_LISTENER_SERVICE = 829,
+  ATOM_NAV_HANDLE_TOUCH_POINTS = 869,
+  ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED = 908,
+  ATOM_PERIPHERAL_TUTORIAL_LAUNCHED = 942,
+  ATOM_CONTEXTUAL_EDUCATION_TRIGGERED = 971,
+  ATOM_COMMUNAL_HUB_SNAPSHOT = 10226,
+  ATOM_TEST_EXTENSION_ATOM_REPORTED = 660,
+  ATOM_TEST_RESTRICTED_ATOM_REPORTED = 672,
+  ATOM_STATS_SOCKET_LOSS_REPORTED = 752,
+  ATOM_SETTINGS_SPA_REPORTED = 622,
+  ATOM_SELINUX_AUDIT_LOG = 799,
+  ATOM_SANDBOX_API_CALLED = 488,
+  ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED = 735,
+  ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION = 796,
+  ATOM_SANDBOX_SDK_STORAGE = 10159,
+  ATOM_RKPD_POOL_STATS = 664,
+  ATOM_RKPD_CLIENT_OPERATION = 665,
+  ATOM_RANGING_SESSION_CONFIGURED = 993,
+  ATOM_RANGING_SESSION_STARTED = 994,
+  ATOM_RANGING_SESSION_CLOSED = 995,
+  ATOM_RANGING_TECHNOLOGY_STARTED = 996,
+  ATOM_RANGING_TECHNOLOGY_STOPPED = 997,
+  ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED = 784,
+  ATOM_BACKUP_SETUP_STATUS_REPORTED = 785,
+  ATOM_SCREEN_OFF_REPORTED = 776,
+  ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED = 836,
+  ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED = 837,
+  ATOM_SCREEN_DIM_REPORTED = 867,
+  ATOM_ATOM_9999 = 9999,
+  ATOM_ATOM_99999 = 99999,
+  ATOM_PHOTOPICKER_SESSION_INFO_REPORTED = 886,
+  ATOM_PHOTOPICKER_API_INFO_REPORTED = 887,
+  ATOM_PHOTOPICKER_UI_EVENT_LOGGED = 888,
+  ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED = 889,
+  ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED = 890,
+  ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED = 891,
+  ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED = 892,
+  ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED = 893,
+  ATOM_PHOTOPICKER_PAGE_INFO_LOGGED = 894,
+  ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED = 895,
+  ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED = 896,
+  ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED = 897,
+  ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED = 898,
+  ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED = 899,
+  ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED = 645,
+  ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED = 646,
+  ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION = 647,
+  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED = 648,
+  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED = 649,
+  ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED = 827,
+  ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED = 828,
+  ATOM_PRESSURE_STALL_INFORMATION = 10229,
+  ATOM_PDF_LOAD_REPORTED = 859,
+  ATOM_PDF_API_USAGE_REPORTED = 860,
+  ATOM_PDF_SEARCH_REPORTED = 861,
+  ATOM_COMPONENT_STATE_CHANGED_REPORTED = 863,
+  ATOM_ONDEVICEPERSONALIZATION_API_CALLED = 711,
+  ATOM_ONDEVICEPERSONALIZATION_TRACE_EVENT = 952,
+  ATOM_NFC_OBSERVE_MODE_STATE_CHANGED = 855,
+  ATOM_NFC_FIELD_CHANGED = 856,
+  ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED = 857,
+  ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED = 858,
+  ATOM_NFC_EXIT_FRAME_TABLE_CHANGED = 1036,
+  ATOM_NFC_AUTO_TRANSACT_REPORTED = 1038,
+  ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED = 901,
+  ATOM_MTE_STATE = 10181,
+  ATOM_ZRAM_MAINTENANCE_EXECUTED = 1015,
+  ATOM_ZRAM_SETUP_EXECUTED = 1029,
+  ATOM_ZRAM_MM_STAT_MMD = 10232,
+  ATOM_ZRAM_BD_STAT_MMD = 10233,
+  ATOM_MEDIA_EDITING_ENDED_REPORTED = 798,
+  ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED = 600,
+  ATOM_MEDIA_CODEC_STARTED = 641,
+  ATOM_MEDIA_CODEC_STOPPED = 642,
+  ATOM_MEDIA_CODEC_RENDERED = 684,
+  ATOM_EMERGENCY_STATE_CHANGED = 633,
+  ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED = 868,
+  ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED = 1002,
+  ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED = 1003,
+  ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED = 1004,
+  ATOM_KERNEL_OOM_KILL_OCCURRED = 754,
+  ATOM_KEYBOARD_CONFIGURED = 682,
+  ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED = 683,
+  ATOM_INPUTDEVICE_USAGE_REPORTED = 686,
+  ATOM_INPUT_EVENT_LATENCY_REPORTED = 932,
+  ATOM_TOUCHPAD_USAGE = 10191,
+  ATOM_IKE_SESSION_TERMINATED = 678,
+  ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED = 760,
+  ATOM_NEGOTIATED_SECURITY_ASSOCIATION = 821,
+  ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED = 761,
+  ATOM_HEALTH_CONNECT_UI_IMPRESSION = 623,
+  ATOM_HEALTH_CONNECT_UI_INTERACTION = 624,
+  ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED = 625,
+  ATOM_HEALTH_CONNECT_API_CALLED = 616,
+  ATOM_HEALTH_CONNECT_USAGE_STATS = 617,
+  ATOM_HEALTH_CONNECT_STORAGE_STATS = 618,
+  ATOM_HEALTH_CONNECT_API_INVOKED = 643,
+  ATOM_EXERCISE_ROUTE_API_CALLED = 654,
+  ATOM_HEALTH_CONNECT_EXPORT_INVOKED = 907,
+  ATOM_HEALTH_CONNECT_IMPORT_INVOKED = 918,
+  ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED = 919,
+  ATOM_HEALTH_CONNECT_PERMISSION_STATS = 963,
+  ATOM_HEALTH_CONNECT_PHR_API_INVOKED = 980,
+  ATOM_HEALTH_CONNECT_PHR_USAGE_STATS = 981,
+  ATOM_HEALTH_CONNECT_PHR_STORAGE_STATS = 984,
+  ATOM_HEALTH_CONNECT_RESTRICTED_ECOSYSTEM_STATS = 985,
+  ATOM_HEALTH_CONNECT_ECOSYSTEM_STATS = 986,
+  ATOM_HDMI_EARC_STATUS_REPORTED = 701,
+  ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED = 724,
+  ATOM_HDMI_POWER_STATE_CHANGE_ON_ACTIVE_SOURCE_LOST_TOGGLED = 991,
+  ATOM_BATTERY_HEALTH = 10220,
+  ATOM_BIOMETRIC_UNENROLLED = 944,
+  ATOM_BIOMETRIC_ENUMERATED = 945,
+  ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED = 584,
+  ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED = 816,
+  ATOM_FULL_SCREEN_INTENT_LAUNCHED = 631,
+  ATOM_BAL_ALLOWED = 632,
+  ATOM_IN_TASK_ACTIVITY_STARTED = 685,
+  ATOM_DEVICE_ORIENTATION_CHANGED = 906,
+  ATOM_CACHED_APPS_HIGH_WATERMARK = 10189,
+  ATOM_STYLUS_PREDICTION_METRICS_REPORTED = 718,
+  ATOM_USER_RISK_EVENT_REPORTED = 725,
+  ATOM_MEDIA_PROJECTION_STATE_CHANGED = 729,
+  ATOM_MEDIA_PROJECTION_TARGET_CHANGED = 730,
+  ATOM_EXCESSIVE_BINDER_PROXY_COUNT_REPORTED = 853,
+  ATOM_PROXY_BYTES_TRANSFER_BY_FG_BG = 10200,
+  ATOM_MOBILE_BYTES_TRANSFER_BY_PROC_STATE = 10204,
+  ATOM_BIOMETRIC_FRR_NOTIFICATION = 817,
+  ATOM_SENSITIVE_CONTENT_MEDIA_PROJECTION_SESSION = 830,
+  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_SESSION = 831,
+  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_APPLIED = 832,
+  ATOM_SENSITIVE_NOTIFICATION_REDACTION = 833,
+  ATOM_SENSITIVE_CONTENT_APP_PROTECTION = 835,
+  ATOM_APP_RESTRICTION_STATE_CHANGED = 866,
+  ATOM_BATTERY_USAGE_STATS_PER_UID = 10209,
+  ATOM_POSTGC_MEMORY_SNAPSHOT = 924,
+  ATOM_POWER_SAVE_TEMP_ALLOWLIST_CHANGED = 926,
+  ATOM_APP_OP_ACCESS_TRACKED = 931,
+  ATOM_CONTENT_OR_FILE_URI_EVENT_REPORTED = 933,
+  ATOM_DEVICE_IDLE_TEMP_ALLOWLIST_UPDATED = 940,
+  ATOM_APP_OP_NOTE_OP_OR_CHECK_OP_BINDER_API_CALLED = 943,
+  ATOM_FRAMEWORK_WAKELOCK_INFO = 10230,
+  ATOM_JANK_FRAME_COUNT_BY_WIDGET_REPORTED = 950,
+  ATOM_INTENT_CREATOR_TOKEN_ADDED = 978,
+  ATOM_NOTIFICATION_CHANNEL_CLASSIFICATION = 983,
+  ATOM_CAMERA_STATUS_FOR_COMPATIBILITY_CHANGED = 999,
+  ATOM_FEDERATED_COMPUTE_API_CALLED = 712,
+  ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED = 771,
+  ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED = 838,
+  ATOM_FEDERATED_COMPUTE_TRACE_EVENT_REPORTED = 992,
+  ATOM_EXPRESS_EVENT_REPORTED = 528,
+  ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED = 593,
+  ATOM_EXPRESS_UID_EVENT_REPORTED = 644,
+  ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED = 658,
+  ATOM_DREAM_SETTING_CHANGED = 705,
+  ATOM_DREAM_SETTING_SNAPSHOT = 10192,
+  ATOM_DND_STATE_CHANGED = 657,
+  ATOM_EXTERNAL_DISPLAY_STATE_CHANGED = 806,
+  ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED = 792,
+  ATOM_DEVICE_POLICY_MANAGEMENT_MODE = 10216,
+  ATOM_DEVICE_POLICY_STATE = 10217,
+  ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED = 726,
+  ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED = 727,
+  ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED = 728,
+  ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED = 789,
+  ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED = 790,
+  ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED = 791,
+  ATOM_DESKTOP_MODE_UI_CHANGED = 818,
+  ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE = 819,
+  ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED = 935,
+  ATOM_CRONET_ENGINE_CREATED = 703,
+  ATOM_CRONET_TRAFFIC_REPORTED = 704,
+  ATOM_CRONET_ENGINE_BUILDER_INITIALIZED = 762,
+  ATOM_CRONET_HTTP_FLAGS_INITIALIZED = 763,
+  ATOM_CRONET_INITIALIZED = 764,
+  ATOM_CREDENTIAL_MANAGER_API_CALLED = 585,
+  ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED = 651,
+  ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED = 652,
+  ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED = 653,
+  ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED = 667,
+  ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED = 668,
+  ATOM_CREDENTIAL_MANAGER_GET_REPORTED = 669,
+  ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED = 670,
+  ATOM_CREDENTIAL_MANAGER_APIV2_CALLED = 671,
+  ATOM_CPU_POLICY = 10199,
+  ATOM_VPN_CONNECTION_STATE_CHANGED = 850,
+  ATOM_VPN_CONNECTION_REPORTED = 851,
+  ATOM_IP_CLIENT_RA_INFO_REPORTED = 778,
+  ATOM_APF_SESSION_INFO_REPORTED = 777,
+  ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED = 979,
+  ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED = 783,
+  ATOM_DAILY_KEEPALIVE_INFO_REPORTED = 650,
+  ATOM_NETWORK_REQUEST_STATE_CHANGED = 779,
+  ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED = 925,
+  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED = 972,
+  ATOM_HARDWARE_RENDERER_EVENT = 946,
+  ATOM_TEXTURE_VIEW_EVENT = 947,
+  ATOM_SURFACE_CONTROL_EVENT = 948,
+  ATOM_IMAGE_DECODED = 977,
+  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED = 934,
+  ATOM_CONSCRYPT_SERVICE_USED = 965,
+  ATOM_CERTIFICATE_TRANSPARENCY_VERIFICATION_REPORTED = 989,
+  ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT = 900,
+  ATOM_BROADCAST_SENT = 922,
+  ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED = 613,
+  ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION = 614,
+  ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION = 615,
+  ATOM_BLUETOOTH_LE_SESSION_CONNECTED = 656,
+  ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED = 666,
+  ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED = 696,
+  ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED = 781,
+  ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED = 782,
+  ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID = 862,
+  ATOM_LE_APP_SCAN_STATE_CHANGED = 870,
+  ATOM_LE_RADIO_SCAN_STOPPED = 871,
+  ATOM_LE_SCAN_RESULT_RECEIVED = 872,
+  ATOM_LE_SCAN_ABUSED = 873,
+  ATOM_LE_ADV_STATE_CHANGED = 874,
+  ATOM_LE_ADV_ERROR_REPORTED = 875,
+  ATOM_A2DP_SESSION_REPORTED = 904,
+  ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED = 916,
+  ATOM_BROADCAST_AUDIO_SESSION_REPORTED = 927,
+  ATOM_BROADCAST_AUDIO_SYNC_REPORTED = 928,
+  ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE = 982,
+  ATOM_BLUETOOTH_LE_CONNECTION = 988,
+  ATOM_HEARING_DEVICE_ACTIVE_EVENT_REPORTED = 1021,
+  ATOM_BACKPORTED_FIX_STATUS_REPORTED = 987,
+  ATOM_PLUGIN_INITIALIZED = 655,
+  ATOM_CAR_SYSTEM_UI_DATA_SUBSCRIPTION_EVENT_REPORTED = 974,
+  ATOM_CAR_SETTINGS_DATA_SUBSCRIPTION_EVENT_REPORTED = 975,
+  ATOM_CAR_QC_LIB_EVENT_REPORTED = 976,
+  ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED = 852,
+  ATOM_CAR_RECENTS_EVENT_REPORTED = 770,
+  ATOM_CAR_CALM_MODE_EVENT_REPORTED = 797,
+  ATOM_AUTOFILL_UI_EVENT_REPORTED = 603,
+  ATOM_AUTOFILL_FILL_REQUEST_REPORTED = 604,
+  ATOM_AUTOFILL_FILL_RESPONSE_REPORTED = 605,
+  ATOM_AUTOFILL_SAVE_EVENT_REPORTED = 606,
+  ATOM_AUTOFILL_SESSION_COMMITTED = 607,
+  ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED = 659,
+  ATOM_ODREFRESH_REPORTED = 366,
+  ATOM_ODSIGN_REPORTED = 548,
+  ATOM_BACKGROUND_DEXOPT_JOB_ENDED = 467,
+  ATOM_PREREBOOT_DEXOPT_JOB_ENDED = 883,
+  ATOM_ART_DATUM_REPORTED = 332,
+  ATOM_ART_DEVICE_DATUM_REPORTED = 550,
+  ATOM_ART_DATUM_DELTA_REPORTED = 565,
+  ATOM_ART_DEX2OAT_REPORTED = 929,
+  ATOM_ART_DEVICE_STATUS = 10205,
+  ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED = 385,
+  ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED = 579,
+  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED = 825,
+  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED = 826,
+  ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED = 909,
+  ATOM_APP_FUNCTIONS_REQUEST_REPORTED = 998,
+  ATOM_APEX_INSTALLATION_REQUESTED = 732,
+  ATOM_APEX_INSTALLATION_STAGED = 733,
+  ATOM_APEX_INSTALLATION_ENDED = 734,
+  ATOM_AI_WALLPAPERS_BUTTON_PRESSED = 706,
+  ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED = 707,
+  ATOM_AI_WALLPAPERS_TERM_SELECTED = 708,
+  ATOM_AI_WALLPAPERS_WALLPAPER_SET = 709,
+  ATOM_AI_WALLPAPERS_SESSION_SUMMARY = 710,
   ATOM_JSSCRIPTENGINE_LATENCY_REPORTED = 483,
   ATOM_AD_SERVICES_API_CALLED = 435,
   ATOM_AD_SERVICES_MESUREMENT_REPORTS_UPLOADED = 436,
@@ -45616,351 +45836,19 @@ enum AtomId : int {
   ATOM_AD_SERVICES_COBALT_PERIODIC_JOB_EVENT_REPORTED = 903,
   ATOM_UPDATE_SIGNALS_PROCESS_REPORTED = 905,
   ATOM_TOPICS_SCHEDULE_EPOCH_JOB_SETTING_REPORTED = 930,
-  ATOM_AI_WALLPAPERS_BUTTON_PRESSED = 706,
-  ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED = 707,
-  ATOM_AI_WALLPAPERS_TERM_SELECTED = 708,
-  ATOM_AI_WALLPAPERS_WALLPAPER_SET = 709,
-  ATOM_AI_WALLPAPERS_SESSION_SUMMARY = 710,
-  ATOM_APEX_INSTALLATION_REQUESTED = 732,
-  ATOM_APEX_INSTALLATION_STAGED = 733,
-  ATOM_APEX_INSTALLATION_ENDED = 734,
-  ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED = 385,
-  ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED = 579,
-  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED = 825,
-  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED = 826,
-  ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED = 909,
-  ATOM_ART_DATUM_REPORTED = 332,
-  ATOM_ART_DEVICE_DATUM_REPORTED = 550,
-  ATOM_ART_DATUM_DELTA_REPORTED = 565,
-  ATOM_ART_DEX2OAT_REPORTED = 929,
-  ATOM_ART_DEVICE_STATUS = 10205,
-  ATOM_BACKGROUND_DEXOPT_JOB_ENDED = 467,
-  ATOM_PREREBOOT_DEXOPT_JOB_ENDED = 883,
-  ATOM_ODREFRESH_REPORTED = 366,
-  ATOM_ODSIGN_REPORTED = 548,
-  ATOM_AUTOFILL_UI_EVENT_REPORTED = 603,
-  ATOM_AUTOFILL_FILL_REQUEST_REPORTED = 604,
-  ATOM_AUTOFILL_FILL_RESPONSE_REPORTED = 605,
-  ATOM_AUTOFILL_SAVE_EVENT_REPORTED = 606,
-  ATOM_AUTOFILL_SESSION_COMMITTED = 607,
-  ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED = 659,
-  ATOM_CAR_RECENTS_EVENT_REPORTED = 770,
-  ATOM_CAR_CALM_MODE_EVENT_REPORTED = 797,
-  ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED = 852,
-  ATOM_PLUGIN_INITIALIZED = 655,
-  ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED = 613,
-  ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION = 614,
-  ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION = 615,
-  ATOM_BLUETOOTH_LE_SESSION_CONNECTED = 656,
-  ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED = 666,
-  ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED = 696,
-  ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED = 781,
-  ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED = 782,
-  ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID = 862,
-  ATOM_LE_APP_SCAN_STATE_CHANGED = 870,
-  ATOM_LE_RADIO_SCAN_STOPPED = 871,
-  ATOM_LE_SCAN_RESULT_RECEIVED = 872,
-  ATOM_LE_SCAN_ABUSED = 873,
-  ATOM_LE_ADV_STATE_CHANGED = 874,
-  ATOM_LE_ADV_ERROR_REPORTED = 875,
-  ATOM_A2DP_SESSION_REPORTED = 904,
-  ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED = 916,
-  ATOM_BROADCAST_AUDIO_SESSION_REPORTED = 927,
-  ATOM_BROADCAST_AUDIO_SYNC_REPORTED = 928,
-  ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE = 982,
-  ATOM_BLUETOOTH_LE_CONNECTION = 988,
-  ATOM_BROADCAST_SENT = 922,
-  ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT = 900,
-  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED = 934,
-  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_FAILED = 972,
-  ATOM_DAILY_KEEPALIVE_INFO_REPORTED = 650,
-  ATOM_NETWORK_REQUEST_STATE_CHANGED = 779,
-  ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED = 925,
-  ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED = 783,
-  ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED = 979,
-  ATOM_APF_SESSION_INFO_REPORTED = 777,
-  ATOM_IP_CLIENT_RA_INFO_REPORTED = 778,
-  ATOM_VPN_CONNECTION_STATE_CHANGED = 850,
-  ATOM_VPN_CONNECTION_REPORTED = 851,
-  ATOM_CPU_POLICY = 10199,
-  ATOM_CREDENTIAL_MANAGER_API_CALLED = 585,
-  ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED = 651,
-  ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED = 652,
-  ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED = 653,
-  ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED = 667,
-  ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED = 668,
-  ATOM_CREDENTIAL_MANAGER_GET_REPORTED = 669,
-  ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED = 670,
-  ATOM_CREDENTIAL_MANAGER_APIV2_CALLED = 671,
-  ATOM_CRONET_ENGINE_CREATED = 703,
-  ATOM_CRONET_TRAFFIC_REPORTED = 704,
-  ATOM_CRONET_ENGINE_BUILDER_INITIALIZED = 762,
-  ATOM_CRONET_HTTP_FLAGS_INITIALIZED = 763,
-  ATOM_CRONET_INITIALIZED = 764,
-  ATOM_DESKTOP_MODE_UI_CHANGED = 818,
-  ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE = 819,
-  ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED = 935,
-  ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED = 726,
-  ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED = 727,
-  ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED = 728,
-  ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED = 789,
-  ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED = 790,
-  ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED = 791,
-  ATOM_DEVICE_POLICY_MANAGEMENT_MODE = 10216,
-  ATOM_DEVICE_POLICY_STATE = 10217,
-  ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED = 792,
-  ATOM_EXTERNAL_DISPLAY_STATE_CHANGED = 806,
-  ATOM_DND_STATE_CHANGED = 657,
-  ATOM_DREAM_SETTING_CHANGED = 705,
-  ATOM_DREAM_SETTING_SNAPSHOT = 10192,
-  ATOM_EXPRESS_EVENT_REPORTED = 528,
-  ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED = 593,
-  ATOM_EXPRESS_UID_EVENT_REPORTED = 644,
-  ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED = 658,
-  ATOM_FEDERATED_COMPUTE_API_CALLED = 712,
-  ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED = 771,
-  ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED = 838,
-  ATOM_FULL_SCREEN_INTENT_LAUNCHED = 631,
-  ATOM_BAL_ALLOWED = 632,
-  ATOM_IN_TASK_ACTIVITY_STARTED = 685,
-  ATOM_DEVICE_ORIENTATION_CHANGED = 906,
-  ATOM_CACHED_APPS_HIGH_WATERMARK = 10189,
-  ATOM_STYLUS_PREDICTION_METRICS_REPORTED = 718,
-  ATOM_USER_RISK_EVENT_REPORTED = 725,
-  ATOM_MEDIA_PROJECTION_STATE_CHANGED = 729,
-  ATOM_MEDIA_PROJECTION_TARGET_CHANGED = 730,
-  ATOM_EXCESSIVE_BINDER_PROXY_COUNT_REPORTED = 853,
-  ATOM_PROXY_BYTES_TRANSFER_BY_FG_BG = 10200,
-  ATOM_MOBILE_BYTES_TRANSFER_BY_PROC_STATE = 10204,
-  ATOM_BIOMETRIC_FRR_NOTIFICATION = 817,
-  ATOM_SENSITIVE_CONTENT_MEDIA_PROJECTION_SESSION = 830,
-  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_SESSION = 831,
-  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_APPLIED = 832,
-  ATOM_SENSITIVE_NOTIFICATION_REDACTION = 833,
-  ATOM_SENSITIVE_CONTENT_APP_PROTECTION = 835,
-  ATOM_APP_RESTRICTION_STATE_CHANGED = 866,
-  ATOM_BATTERY_USAGE_STATS_PER_UID = 10209,
-  ATOM_POSTGC_MEMORY_SNAPSHOT = 924,
-  ATOM_POWER_SAVE_TEMP_ALLOWLIST_CHANGED = 926,
-  ATOM_APP_OP_ACCESS_TRACKED = 931,
-  ATOM_CONTENT_OR_FILE_URI_EVENT_REPORTED = 933,
-  ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED = 584,
-  ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED = 816,
-  ATOM_BATTERY_HEALTH = 10220,
-  ATOM_HDMI_EARC_STATUS_REPORTED = 701,
-  ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED = 724,
-  ATOM_HEALTH_CONNECT_API_CALLED = 616,
-  ATOM_HEALTH_CONNECT_USAGE_STATS = 617,
-  ATOM_HEALTH_CONNECT_STORAGE_STATS = 618,
-  ATOM_HEALTH_CONNECT_API_INVOKED = 643,
-  ATOM_EXERCISE_ROUTE_API_CALLED = 654,
-  ATOM_HEALTH_CONNECT_EXPORT_INVOKED = 907,
-  ATOM_HEALTH_CONNECT_IMPORT_INVOKED = 918,
-  ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED = 919,
-  ATOM_HEALTH_CONNECT_UI_IMPRESSION = 623,
-  ATOM_HEALTH_CONNECT_UI_INTERACTION = 624,
-  ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED = 625,
-  ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED = 761,
-  ATOM_IKE_SESSION_TERMINATED = 678,
-  ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED = 760,
-  ATOM_NEGOTIATED_SECURITY_ASSOCIATION = 821,
-  ATOM_KEYBOARD_CONFIGURED = 682,
-  ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED = 683,
-  ATOM_INPUTDEVICE_USAGE_REPORTED = 686,
-  ATOM_INPUT_EVENT_LATENCY_REPORTED = 932,
-  ATOM_TOUCHPAD_USAGE = 10191,
-  ATOM_KERNEL_OOM_KILL_OCCURRED = 754,
-  ATOM_EMERGENCY_STATE_CHANGED = 633,
-  ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED = 868,
-  ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED = 1002,
-  ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED = 1003,
-  ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED = 1004,
-  ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED = 600,
-  ATOM_MEDIA_CODEC_STARTED = 641,
-  ATOM_MEDIA_CODEC_STOPPED = 642,
-  ATOM_MEDIA_CODEC_RENDERED = 684,
-  ATOM_MEDIA_EDITING_ENDED_REPORTED = 798,
-  ATOM_MTE_STATE = 10181,
-  ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED = 901,
-  ATOM_NFC_OBSERVE_MODE_STATE_CHANGED = 855,
-  ATOM_NFC_FIELD_CHANGED = 856,
-  ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED = 857,
-  ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED = 858,
-  ATOM_ONDEVICEPERSONALIZATION_API_CALLED = 711,
-  ATOM_COMPONENT_STATE_CHANGED_REPORTED = 863,
-  ATOM_PDF_LOAD_REPORTED = 859,
-  ATOM_PDF_API_USAGE_REPORTED = 860,
-  ATOM_PDF_SEARCH_REPORTED = 861,
-  ATOM_PRESSURE_STALL_INFORMATION = 10229,
-  ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED = 645,
-  ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED = 646,
-  ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION = 647,
-  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED = 648,
-  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED = 649,
-  ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED = 827,
-  ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED = 828,
-  ATOM_PHOTOPICKER_SESSION_INFO_REPORTED = 886,
-  ATOM_PHOTOPICKER_API_INFO_REPORTED = 887,
-  ATOM_PHOTOPICKER_UI_EVENT_LOGGED = 888,
-  ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED = 889,
-  ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED = 890,
-  ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED = 891,
-  ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED = 892,
-  ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED = 893,
-  ATOM_PHOTOPICKER_PAGE_INFO_LOGGED = 894,
-  ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED = 895,
-  ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED = 896,
-  ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED = 897,
-  ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED = 898,
-  ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED = 899,
-  ATOM_ATOM_9999 = 9999,
-  ATOM_ATOM_99999 = 99999,
-  ATOM_SCREEN_OFF_REPORTED = 776,
-  ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED = 836,
-  ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED = 837,
-  ATOM_SCREEN_DIM_REPORTED = 867,
-  ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED = 784,
-  ATOM_BACKUP_SETUP_STATUS_REPORTED = 785,
-  ATOM_RANGING_SESSION_CONFIGURED = 993,
-  ATOM_RANGING_SESSION_STARTED = 994,
-  ATOM_RANGING_SESSION_CLOSED = 995,
-  ATOM_RANGING_TECHNOLOGY_STARTED = 996,
-  ATOM_RANGING_TECHNOLOGY_STOPPED = 997,
-  ATOM_RKPD_POOL_STATS = 664,
-  ATOM_RKPD_CLIENT_OPERATION = 665,
-  ATOM_SANDBOX_API_CALLED = 488,
-  ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED = 735,
-  ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION = 796,
-  ATOM_SANDBOX_SDK_STORAGE = 10159,
-  ATOM_SELINUX_AUDIT_LOG = 799,
-  ATOM_SETTINGS_SPA_REPORTED = 622,
-  ATOM_TEST_EXTENSION_ATOM_REPORTED = 660,
-  ATOM_TEST_RESTRICTED_ATOM_REPORTED = 672,
-  ATOM_STATS_SOCKET_LOSS_REPORTED = 752,
-  ATOM_LOCKSCREEN_SHORTCUT_SELECTED = 611,
-  ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED = 612,
-  ATOM_LAUNCHER_IMPRESSION_EVENT_V2 = 716,
-  ATOM_DISPLAY_SWITCH_LATENCY_TRACKED = 753,
-  ATOM_NOTIFICATION_LISTENER_SERVICE = 829,
-  ATOM_NAV_HANDLE_TOUCH_POINTS = 869,
-  ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED = 908,
-  ATOM_COMMUNAL_HUB_SNAPSHOT = 10226,
-  ATOM_EMERGENCY_NUMBER_DIALED = 637,
-  ATOM_CALL_STATS = 10221,
-  ATOM_CALL_AUDIO_ROUTE_STATS = 10222,
-  ATOM_TELECOM_API_STATS = 10223,
-  ATOM_TELECOM_ERROR_STATS = 10224,
-  ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED = 713,
-  ATOM_EMERGENCY_NUMBERS_INFO = 10180,
-  ATOM_DATA_NETWORK_VALIDATION = 10207,
-  ATOM_DATA_RAT_STATE_CHANGED = 854,
-  ATOM_CONNECTED_CHANNEL_CHANGED = 882,
-  ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED = 923,
-  ATOM_QUALIFIED_RAT_LIST_CHANGED = 634,
-  ATOM_QNS_IMS_CALL_DROP_STATS = 635,
-  ATOM_QNS_FALLBACK_RESTRICTION_CHANGED = 636,
-  ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO = 10177,
-  ATOM_QNS_HANDOVER_TIME_MILLIS = 10178,
-  ATOM_QNS_HANDOVER_PINGPONG = 10179,
-  ATOM_SATELLITE_CONTROLLER = 10182,
-  ATOM_SATELLITE_SESSION = 10183,
-  ATOM_SATELLITE_INCOMING_DATAGRAM = 10184,
-  ATOM_SATELLITE_OUTGOING_DATAGRAM = 10185,
-  ATOM_SATELLITE_PROVISION = 10186,
-  ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER = 10187,
-  ATOM_CARRIER_ROAMING_SATELLITE_SESSION = 10211,
-  ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS = 10212,
-  ATOM_CONTROLLER_STATS_PER_PACKAGE = 10213,
-  ATOM_SATELLITE_ENTITLEMENT = 10214,
-  ATOM_SATELLITE_CONFIG_UPDATER = 10215,
-  ATOM_SATELLITE_ACCESS_CONTROLLER = 10219,
-  ATOM_CELLULAR_IDENTIFIER_DISCLOSED = 800,
-  ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED = 738,
-  ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED = 739,
-  ATOM_THREADNETWORK_DEVICE_INFO_REPORTED = 740,
-  ATOM_BOOT_INTEGRITY_INFO_REPORTED = 775,
-  ATOM_TV_LOW_POWER_STANDBY_POLICY = 679,
-  ATOM_EXTERNAL_TV_INPUT_EVENT = 717,
-  ATOM_TEST_UPROBESTATS_ATOM_REPORTED = 915,
-  ATOM_UWB_ACTIVITY_INFO = 10188,
-  ATOM_MEDIATOR_UPDATED = 721,
-  ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER = 10196,
-  ATOM_SYSPROXY_CONNECTION_UPDATED = 786,
-  ATOM_WEAR_COMPANION_CONNECTION_STATE = 921,
-  ATOM_MEDIA_ACTION_REPORTED = 608,
-  ATOM_MEDIA_CONTROLS_LAUNCHED = 609,
-  ATOM_MEDIA_SESSION_STATE_CHANGED = 677,
-  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY = 757,
-  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE = 758,
-  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT = 759,
-  ATOM_WEAR_MODE_STATE_CHANGED = 715,
-  ATOM_RENDERER_INITIALIZED = 736,
-  ATOM_SCHEMA_VERSION_RECEIVED = 737,
-  ATOM_LAYOUT_INSPECTED = 741,
-  ATOM_LAYOUT_EXPRESSION_INSPECTED = 742,
-  ATOM_LAYOUT_ANIMATIONS_INSPECTED = 743,
-  ATOM_MATERIAL_COMPONENTS_INSPECTED = 744,
-  ATOM_TILE_REQUESTED = 745,
-  ATOM_STATE_RESPONSE_RECEIVED = 746,
-  ATOM_TILE_RESPONSE_RECEIVED = 747,
-  ATOM_INFLATION_FINISHED = 748,
-  ATOM_INFLATION_FAILED = 749,
-  ATOM_IGNORED_INFLATION_FAILURES_REPORTED = 750,
-  ATOM_DRAWABLE_RENDERED = 751,
-  ATOM_WEAR_TIME_SYNC_REQUESTED = 911,
-  ATOM_WEAR_TIME_UPDATE_STARTED = 912,
-  ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED = 913,
-  ATOM_WEAR_TIME_CHANGED = 914,
-  ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED = 619,
-  ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED = 620,
-  ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED = 621,
-  ATOM_WS_WEAR_TIME_SESSION = 610,
-  ATOM_WS_INCOMING_CALL_ACTION_REPORTED = 626,
-  ATOM_WS_CALL_DISCONNECTION_REPORTED = 627,
-  ATOM_WS_CALL_DURATION_REPORTED = 628,
-  ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED = 629,
-  ATOM_WS_CALL_INTERACTION_REPORTED = 630,
-  ATOM_WS_ON_BODY_STATE_CHANGED = 787,
-  ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED = 802,
-  ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED = 803,
-  ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED = 804,
-  ATOM_WS_REMOTE_EVENT_USAGE_REPORTED = 920,
-  ATOM_WS_BUGREPORT_REQUESTED = 936,
-  ATOM_WS_BUGREPORT_TRIGGERED = 937,
-  ATOM_WS_BUGREPORT_FINISHED = 938,
-  ATOM_WS_BUGREPORT_RESULT_RECEIVED = 939,
-  ATOM_WS_STANDALONE_MODE_SNAPSHOT = 10197,
-  ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT = 10206,
-  ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT = 10225,
-  ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT = 10227,
-  ATOM_WEAR_POWER_MENU_OPENED = 731,
-  ATOM_WEAR_ASSISTANT_OPENED = 755,
-  ATOM_FIRST_OVERLAY_STATE_CHANGED = 917,
-  ATOM_WIFI_AWARE_NDP_REPORTED = 638,
-  ATOM_WIFI_AWARE_ATTACH_REPORTED = 639,
-  ATOM_WIFI_SELF_RECOVERY_TRIGGERED = 661,
-  ATOM_SOFT_AP_STARTED = 680,
-  ATOM_SOFT_AP_STOPPED = 681,
-  ATOM_WIFI_LOCK_RELEASED = 687,
-  ATOM_WIFI_LOCK_DEACTIVATED = 688,
-  ATOM_WIFI_CONFIG_SAVED = 689,
-  ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED = 690,
-  ATOM_WIFI_AWARE_HAL_API_CALLED = 691,
-  ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED = 692,
-  ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED = 693,
-  ATOM_WIFI_THREAD_TASK_EXECUTED = 694,
-  ATOM_WIFI_STATE_CHANGED = 700,
-  ATOM_PNO_SCAN_STARTED = 719,
-  ATOM_PNO_SCAN_STOPPED = 720,
-  ATOM_WIFI_IS_UNUSABLE_REPORTED = 722,
-  ATOM_WIFI_AP_CAPABILITIES_REPORTED = 723,
-  ATOM_SOFT_AP_STATE_CHANGED = 805,
-  ATOM_SCORER_PREDICTION_RESULT_REPORTED = 884,
-  ATOM_WIFI_AWARE_CAPABILITIES = 10190,
-  ATOM_WIFI_MODULE_INFO = 10193,
-  ATOM_WIFI_SETTING_INFO = 10194,
-  ATOM_WIFI_COMPLEX_SETTING_INFO = 10195,
-  ATOM_WIFI_CONFIGURED_NETWORK_INFO = 10198,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_SCHEDULE_ATTEMPTED = 967,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED = 968,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED_ATTEMPTED_FAILURE_REPORTED = 969,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_BACKGROUND_JOB_RAN = 970,
+  ATOM_THERMAL_STATUS_CALLED = 772,
+  ATOM_THERMAL_HEADROOM_CALLED = 773,
+  ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED = 774,
+  ATOM_ADPF_HINT_SESSION_TID_CLEANUP = 839,
+  ATOM_THERMAL_HEADROOM_THRESHOLDS = 10201,
+  ATOM_ADPF_SESSION_SNAPSHOT = 10218,
+  ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED = 820,
+  ATOM_ACCOUNT_MANAGER_EVENT = 951,
+  ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED = 910,
 };
 }  // namespace perfetto
 }  // namespace protos
@@ -46637,7 +46525,8 @@ class ChromeFieldTracingConfig;
 class ScenarioConfig;
 class NestedScenarioConfig;
 class TraceConfig;
-class TraceConfig_Note;
+class TraceAttributes;
+class TraceAttributes_Attribute;
 class PriorityBoostConfig;
 class TraceConfig_SessionSemaphore;
 class TraceConfig_CmdTraceStartDelay;
@@ -46646,6 +46535,9 @@ class TraceConfig_TraceFilter;
 class TraceConfig_TraceFilter_StringFilterChain;
 class TraceConfig_TraceFilter_StringFilterRule;
 class TraceConfig_IncidentReportConfig;
+class TraceConfig_CompressionConfig;
+class TraceConfig_CompressionConfig_Zstd;
+class TraceConfig_CompressionConfig_Deflate;
 class TraceConfig_IncrementalStateConfig;
 class TraceConfig_TriggerConfig;
 class TraceConfig_TriggerConfig_Trigger;
@@ -47464,7 +47356,8 @@ namespace gen {
 class StressTestConfig;
 class StressTestConfig_WriterTiming;
 class TraceConfig;
-class TraceConfig_Note;
+class TraceAttributes;
+class TraceAttributes_Attribute;
 class PriorityBoostConfig;
 class TraceConfig_SessionSemaphore;
 class TraceConfig_CmdTraceStartDelay;
@@ -47473,6 +47366,9 @@ class TraceConfig_TraceFilter;
 class TraceConfig_TraceFilter_StringFilterChain;
 class TraceConfig_TraceFilter_StringFilterRule;
 class TraceConfig_IncidentReportConfig;
+class TraceConfig_CompressionConfig;
+class TraceConfig_CompressionConfig_Zstd;
+class TraceConfig_CompressionConfig_Deflate;
 class TraceConfig_IncrementalStateConfig;
 class TraceConfig_TriggerConfig;
 class TraceConfig_TriggerConfig_Trigger;
@@ -49052,7 +48948,7 @@ const char* DisplayVideoConfig_Format_Name(::perfetto::protos::pbzero::DisplayVi
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class DisplayVideoConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+class DisplayVideoConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
   DisplayVideoConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit DisplayVideoConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -49065,6 +48961,8 @@ class DisplayVideoConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_F
   uint32_t key_frame_interval_secs() const { return at<3>().as_uint32(); }
   bool has_max_stream_size_bytes() const { return at<4>().valid(); }
   uint64_t max_stream_size_bytes() const { return at<4>().as_uint64(); }
+  bool has_bitrate_bps() const { return at<5>().valid(); }
+  uint32_t bitrate_bps() const { return at<5>().as_uint32(); }
 };
 
 class DisplayVideoConfig : public ::protozero::Message {
@@ -49075,6 +48973,7 @@ class DisplayVideoConfig : public ::protozero::Message {
     kFormatFieldNumber = 2,
     kKeyFrameIntervalSecsFieldNumber = 3,
     kMaxStreamSizeBytesFieldNumber = 4,
+    kBitrateBpsFieldNumber = 5,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.DisplayVideoConfig"; }
 
@@ -49158,6 +49057,24 @@ class DisplayVideoConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_BitrateBps =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      DisplayVideoConfig>;
+
+  static constexpr FieldMetadata_BitrateBps kBitrateBps{};
+  void set_bitrate_bps(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_BitrateBps::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -53448,7 +53365,7 @@ const char* ProcessStatsConfig_Quirks_Name(::perfetto::protos::pbzero::ProcessSt
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class ProcessStatsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/13> {
+class ProcessStatsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/14> {
  public:
   ProcessStatsConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit ProcessStatsConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -53473,6 +53390,8 @@ class ProcessStatsConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_F
   bool record_process_dmabuf_rss() const { return at<13>().as_bool(); }
   bool has_resolve_process_fds() const { return at<9>().valid(); }
   bool resolve_process_fds() const { return at<9>().as_bool(); }
+  bool has_skip_main_thread_message() const { return at<14>().valid(); }
+  bool skip_main_thread_message() const { return at<14>().as_bool(); }
 };
 
 class ProcessStatsConfig : public ::protozero::Message {
@@ -53489,6 +53408,7 @@ class ProcessStatsConfig : public ::protozero::Message {
     kRecordProcessRuntimeFieldNumber = 12,
     kRecordProcessDmabufRssFieldNumber = 13,
     kResolveProcessFdsFieldNumber = 9,
+    kSkipMainThreadMessageFieldNumber = 14,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.ProcessStatsConfig"; }
 
@@ -53680,6 +53600,24 @@ class ProcessStatsConfig : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_SkipMainThreadMessage =
+    ::protozero::proto_utils::FieldMetadata<
+      14,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      ProcessStatsConfig>;
+
+  static constexpr FieldMetadata_SkipMainThreadMessage kSkipMainThreadMessage{};
+  void set_skip_main_thread_message(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_SkipMainThreadMessage::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 };
 
 } // Namespace.
@@ -56850,14 +56788,400 @@ enum AtomId : int32_t {
   ATOM_NOTIFICATION_MEMORY_USE = 10174,
   ATOM_HDR_CAPABILITIES = 10175,
   ATOM_WS_FAVOURITE_WATCH_FACE_LIST_SNAPSHOT = 10176,
-  ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED = 910,
-  ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED = 820,
-  ATOM_THERMAL_STATUS_CALLED = 772,
-  ATOM_THERMAL_HEADROOM_CALLED = 773,
-  ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED = 774,
-  ATOM_ADPF_HINT_SESSION_TID_CLEANUP = 839,
-  ATOM_THERMAL_HEADROOM_THRESHOLDS = 10201,
-  ATOM_ADPF_SESSION_SNAPSHOT = 10218,
+  ATOM_WIFI_AWARE_NDP_REPORTED = 638,
+  ATOM_WIFI_AWARE_ATTACH_REPORTED = 639,
+  ATOM_WIFI_SELF_RECOVERY_TRIGGERED = 661,
+  ATOM_SOFT_AP_STARTED = 680,
+  ATOM_SOFT_AP_STOPPED = 681,
+  ATOM_WIFI_LOCK_RELEASED = 687,
+  ATOM_WIFI_LOCK_DEACTIVATED = 688,
+  ATOM_WIFI_CONFIG_SAVED = 689,
+  ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED = 690,
+  ATOM_WIFI_AWARE_HAL_API_CALLED = 691,
+  ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED = 692,
+  ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED = 693,
+  ATOM_WIFI_THREAD_TASK_EXECUTED = 694,
+  ATOM_WIFI_STATE_CHANGED = 700,
+  ATOM_PNO_SCAN_STARTED = 719,
+  ATOM_PNO_SCAN_STOPPED = 720,
+  ATOM_WIFI_IS_UNUSABLE_REPORTED = 722,
+  ATOM_WIFI_AP_CAPABILITIES_REPORTED = 723,
+  ATOM_SOFT_AP_STATE_CHANGED = 805,
+  ATOM_SCORER_PREDICTION_RESULT_REPORTED = 884,
+  ATOM_WIFI_AWARE_CAPABILITIES = 10190,
+  ATOM_WIFI_MODULE_INFO = 10193,
+  ATOM_WIFI_SETTING_INFO = 10194,
+  ATOM_WIFI_COMPLEX_SETTING_INFO = 10195,
+  ATOM_WIFI_CONFIGURED_NETWORK_INFO = 10198,
+  ATOM_WEAR_POWER_MENU_OPENED = 731,
+  ATOM_WEAR_ASSISTANT_OPENED = 755,
+  ATOM_FIRST_OVERLAY_STATE_CHANGED = 917,
+  ATOM_WS_WEAR_TIME_SESSION = 610,
+  ATOM_WS_INCOMING_CALL_ACTION_REPORTED = 626,
+  ATOM_WS_CALL_DISCONNECTION_REPORTED = 627,
+  ATOM_WS_CALL_DURATION_REPORTED = 628,
+  ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED = 629,
+  ATOM_WS_CALL_INTERACTION_REPORTED = 630,
+  ATOM_WS_ON_BODY_STATE_CHANGED = 787,
+  ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED = 802,
+  ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED = 803,
+  ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED = 804,
+  ATOM_WS_REMOTE_EVENT_USAGE_REPORTED = 920,
+  ATOM_WS_NOTIFICATION_MANAGED_DISMISSAL_SYNC = 941,
+  ATOM_WS_BUGREPORT_EVENT_REPORTED = 964,
+  ATOM_WS_STANDALONE_MODE_SNAPSHOT = 10197,
+  ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT = 10206,
+  ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT = 10225,
+  ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT = 10227,
+  ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED = 619,
+  ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED = 620,
+  ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED = 621,
+  ATOM_WEAR_TIME_SYNC_REQUESTED = 911,
+  ATOM_WEAR_TIME_UPDATE_STARTED = 912,
+  ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED = 913,
+  ATOM_WEAR_TIME_CHANGED = 914,
+  ATOM_WEAR_SETUP_WIZARD_DEVICE_STATUS_REPORTED = 953,
+  ATOM_WEAR_SETUP_WIZARD_PAIRING_COMPLETED = 954,
+  ATOM_WEAR_SETUP_WIZARD_CONNECTION_ESTABLISHED = 955,
+  ATOM_WEAR_SETUP_WIZARD_CHECKIN_COMPLETED = 956,
+  ATOM_WEAR_SETUP_WIZARD_COMPANION_TIME_REPORTED = 957,
+  ATOM_WEAR_SETUP_WIZARD_STATUS_REPORTED = 958,
+  ATOM_WEAR_SETUP_WIZARD_HEARTBEAT_REPORTED = 959,
+  ATOM_WEAR_SETUP_WIZARD_FRP_TRIGGERED = 960,
+  ATOM_WEAR_SETUP_WIZARD_SYSTEM_UPDATE_TRIGGERED = 961,
+  ATOM_WEAR_SETUP_WIZARD_PHONE_SWITCH_TRIGGERED = 962,
+  ATOM_RENDERER_INITIALIZED = 736,
+  ATOM_SCHEMA_VERSION_RECEIVED = 737,
+  ATOM_LAYOUT_INSPECTED = 741,
+  ATOM_LAYOUT_EXPRESSION_INSPECTED = 742,
+  ATOM_LAYOUT_ANIMATIONS_INSPECTED = 743,
+  ATOM_MATERIAL_COMPONENTS_INSPECTED = 744,
+  ATOM_TILE_REQUESTED = 745,
+  ATOM_STATE_RESPONSE_RECEIVED = 746,
+  ATOM_TILE_RESPONSE_RECEIVED = 747,
+  ATOM_INFLATION_FINISHED = 748,
+  ATOM_INFLATION_FAILED = 749,
+  ATOM_IGNORED_INFLATION_FAILURES_REPORTED = 750,
+  ATOM_DRAWABLE_RENDERED = 751,
+  ATOM_WEAR_MODE_STATE_CHANGED = 715,
+  ATOM_MEDIA_ACTION_REPORTED = 608,
+  ATOM_MEDIA_CONTROLS_LAUNCHED = 609,
+  ATOM_MEDIA_SESSION_STATE_CHANGED = 677,
+  ATOM_MEDIA_CONTROL_API_USAGE_REPORTED = 966,
+  ATOM_MEDIA_SUBSCRIPTION_CHANGED = 990,
+  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY = 757,
+  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE = 758,
+  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT = 759,
+  ATOM_MEDIATOR_UPDATED = 721,
+  ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER = 10196,
+  ATOM_SYSPROXY_CONNECTION_UPDATED = 786,
+  ATOM_WEAR_COMPANION_CONNECTION_STATE = 921,
+  ATOM_SYSPROXY_SERVICE_STATE_UPDATED = 949,
+  ATOM_UWB_ACTIVITY_INFO = 10188,
+  ATOM_TEST_UPROBESTATS_ATOM_REPORTED = 915,
+  ATOM_TV_LOW_POWER_STANDBY_POLICY = 679,
+  ATOM_EXTERNAL_TV_INPUT_EVENT = 717,
+  ATOM_BOOT_INTEGRITY_INFO_REPORTED = 775,
+  ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED = 738,
+  ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED = 739,
+  ATOM_THREADNETWORK_DEVICE_INFO_REPORTED = 740,
+  ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED = 713,
+  ATOM_EMERGENCY_NUMBERS_INFO = 10180,
+  ATOM_DATA_NETWORK_VALIDATION = 10207,
+  ATOM_DATA_RAT_STATE_CHANGED = 854,
+  ATOM_CONNECTED_CHANNEL_CHANGED = 882,
+  ATOM_CELLULAR_IDENTIFIER_DISCLOSED = 800,
+  ATOM_SATELLITE_CONTROLLER = 10182,
+  ATOM_SATELLITE_SESSION = 10183,
+  ATOM_SATELLITE_INCOMING_DATAGRAM = 10184,
+  ATOM_SATELLITE_OUTGOING_DATAGRAM = 10185,
+  ATOM_SATELLITE_PROVISION = 10186,
+  ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER = 10187,
+  ATOM_CARRIER_ROAMING_SATELLITE_SESSION = 10211,
+  ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS = 10212,
+  ATOM_CONTROLLER_STATS_PER_PACKAGE = 10213,
+  ATOM_SATELLITE_ENTITLEMENT = 10214,
+  ATOM_SATELLITE_CONFIG_UPDATER = 10215,
+  ATOM_SATELLITE_ACCESS_CONTROLLER = 10219,
+  ATOM_QUALIFIED_RAT_LIST_CHANGED = 634,
+  ATOM_QNS_IMS_CALL_DROP_STATS = 635,
+  ATOM_QNS_FALLBACK_RESTRICTION_CHANGED = 636,
+  ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO = 10177,
+  ATOM_QNS_HANDOVER_TIME_MILLIS = 10178,
+  ATOM_QNS_HANDOVER_PINGPONG = 10179,
+  ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED = 923,
+  ATOM_EMERGENCY_NUMBER_DIALED = 637,
+  ATOM_CALL_STATS = 10221,
+  ATOM_CALL_AUDIO_ROUTE_STATS = 10222,
+  ATOM_TELECOM_API_STATS = 10223,
+  ATOM_TELECOM_ERROR_STATS = 10224,
+  ATOM_LOCKSCREEN_SHORTCUT_SELECTED = 611,
+  ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED = 612,
+  ATOM_LAUNCHER_IMPRESSION_EVENT_V2 = 716,
+  ATOM_DISPLAY_SWITCH_LATENCY_TRACKED = 753,
+  ATOM_NOTIFICATION_LISTENER_SERVICE = 829,
+  ATOM_NAV_HANDLE_TOUCH_POINTS = 869,
+  ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED = 908,
+  ATOM_PERIPHERAL_TUTORIAL_LAUNCHED = 942,
+  ATOM_CONTEXTUAL_EDUCATION_TRIGGERED = 971,
+  ATOM_COMMUNAL_HUB_SNAPSHOT = 10226,
+  ATOM_TEST_EXTENSION_ATOM_REPORTED = 660,
+  ATOM_TEST_RESTRICTED_ATOM_REPORTED = 672,
+  ATOM_STATS_SOCKET_LOSS_REPORTED = 752,
+  ATOM_SETTINGS_SPA_REPORTED = 622,
+  ATOM_SELINUX_AUDIT_LOG = 799,
+  ATOM_SANDBOX_API_CALLED = 488,
+  ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED = 735,
+  ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION = 796,
+  ATOM_SANDBOX_SDK_STORAGE = 10159,
+  ATOM_RKPD_POOL_STATS = 664,
+  ATOM_RKPD_CLIENT_OPERATION = 665,
+  ATOM_RANGING_SESSION_CONFIGURED = 993,
+  ATOM_RANGING_SESSION_STARTED = 994,
+  ATOM_RANGING_SESSION_CLOSED = 995,
+  ATOM_RANGING_TECHNOLOGY_STARTED = 996,
+  ATOM_RANGING_TECHNOLOGY_STOPPED = 997,
+  ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED = 784,
+  ATOM_BACKUP_SETUP_STATUS_REPORTED = 785,
+  ATOM_SCREEN_OFF_REPORTED = 776,
+  ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED = 836,
+  ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED = 837,
+  ATOM_SCREEN_DIM_REPORTED = 867,
+  ATOM_ATOM_9999 = 9999,
+  ATOM_ATOM_99999 = 99999,
+  ATOM_PHOTOPICKER_SESSION_INFO_REPORTED = 886,
+  ATOM_PHOTOPICKER_API_INFO_REPORTED = 887,
+  ATOM_PHOTOPICKER_UI_EVENT_LOGGED = 888,
+  ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED = 889,
+  ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED = 890,
+  ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED = 891,
+  ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED = 892,
+  ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED = 893,
+  ATOM_PHOTOPICKER_PAGE_INFO_LOGGED = 894,
+  ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED = 895,
+  ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED = 896,
+  ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED = 897,
+  ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED = 898,
+  ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED = 899,
+  ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED = 645,
+  ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED = 646,
+  ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION = 647,
+  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED = 648,
+  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED = 649,
+  ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED = 827,
+  ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED = 828,
+  ATOM_PRESSURE_STALL_INFORMATION = 10229,
+  ATOM_PDF_LOAD_REPORTED = 859,
+  ATOM_PDF_API_USAGE_REPORTED = 860,
+  ATOM_PDF_SEARCH_REPORTED = 861,
+  ATOM_COMPONENT_STATE_CHANGED_REPORTED = 863,
+  ATOM_ONDEVICEPERSONALIZATION_API_CALLED = 711,
+  ATOM_ONDEVICEPERSONALIZATION_TRACE_EVENT = 952,
+  ATOM_NFC_OBSERVE_MODE_STATE_CHANGED = 855,
+  ATOM_NFC_FIELD_CHANGED = 856,
+  ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED = 857,
+  ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED = 858,
+  ATOM_NFC_EXIT_FRAME_TABLE_CHANGED = 1036,
+  ATOM_NFC_AUTO_TRANSACT_REPORTED = 1038,
+  ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED = 901,
+  ATOM_MTE_STATE = 10181,
+  ATOM_ZRAM_MAINTENANCE_EXECUTED = 1015,
+  ATOM_ZRAM_SETUP_EXECUTED = 1029,
+  ATOM_ZRAM_MM_STAT_MMD = 10232,
+  ATOM_ZRAM_BD_STAT_MMD = 10233,
+  ATOM_MEDIA_EDITING_ENDED_REPORTED = 798,
+  ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED = 600,
+  ATOM_MEDIA_CODEC_STARTED = 641,
+  ATOM_MEDIA_CODEC_STOPPED = 642,
+  ATOM_MEDIA_CODEC_RENDERED = 684,
+  ATOM_EMERGENCY_STATE_CHANGED = 633,
+  ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED = 868,
+  ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED = 1002,
+  ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED = 1003,
+  ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED = 1004,
+  ATOM_KERNEL_OOM_KILL_OCCURRED = 754,
+  ATOM_KEYBOARD_CONFIGURED = 682,
+  ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED = 683,
+  ATOM_INPUTDEVICE_USAGE_REPORTED = 686,
+  ATOM_INPUT_EVENT_LATENCY_REPORTED = 932,
+  ATOM_TOUCHPAD_USAGE = 10191,
+  ATOM_IKE_SESSION_TERMINATED = 678,
+  ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED = 760,
+  ATOM_NEGOTIATED_SECURITY_ASSOCIATION = 821,
+  ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED = 761,
+  ATOM_HEALTH_CONNECT_UI_IMPRESSION = 623,
+  ATOM_HEALTH_CONNECT_UI_INTERACTION = 624,
+  ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED = 625,
+  ATOM_HEALTH_CONNECT_API_CALLED = 616,
+  ATOM_HEALTH_CONNECT_USAGE_STATS = 617,
+  ATOM_HEALTH_CONNECT_STORAGE_STATS = 618,
+  ATOM_HEALTH_CONNECT_API_INVOKED = 643,
+  ATOM_EXERCISE_ROUTE_API_CALLED = 654,
+  ATOM_HEALTH_CONNECT_EXPORT_INVOKED = 907,
+  ATOM_HEALTH_CONNECT_IMPORT_INVOKED = 918,
+  ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED = 919,
+  ATOM_HEALTH_CONNECT_PERMISSION_STATS = 963,
+  ATOM_HEALTH_CONNECT_PHR_API_INVOKED = 980,
+  ATOM_HEALTH_CONNECT_PHR_USAGE_STATS = 981,
+  ATOM_HEALTH_CONNECT_PHR_STORAGE_STATS = 984,
+  ATOM_HEALTH_CONNECT_RESTRICTED_ECOSYSTEM_STATS = 985,
+  ATOM_HEALTH_CONNECT_ECOSYSTEM_STATS = 986,
+  ATOM_HDMI_EARC_STATUS_REPORTED = 701,
+  ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED = 724,
+  ATOM_HDMI_POWER_STATE_CHANGE_ON_ACTIVE_SOURCE_LOST_TOGGLED = 991,
+  ATOM_BATTERY_HEALTH = 10220,
+  ATOM_BIOMETRIC_UNENROLLED = 944,
+  ATOM_BIOMETRIC_ENUMERATED = 945,
+  ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED = 584,
+  ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED = 816,
+  ATOM_FULL_SCREEN_INTENT_LAUNCHED = 631,
+  ATOM_BAL_ALLOWED = 632,
+  ATOM_IN_TASK_ACTIVITY_STARTED = 685,
+  ATOM_DEVICE_ORIENTATION_CHANGED = 906,
+  ATOM_CACHED_APPS_HIGH_WATERMARK = 10189,
+  ATOM_STYLUS_PREDICTION_METRICS_REPORTED = 718,
+  ATOM_USER_RISK_EVENT_REPORTED = 725,
+  ATOM_MEDIA_PROJECTION_STATE_CHANGED = 729,
+  ATOM_MEDIA_PROJECTION_TARGET_CHANGED = 730,
+  ATOM_EXCESSIVE_BINDER_PROXY_COUNT_REPORTED = 853,
+  ATOM_PROXY_BYTES_TRANSFER_BY_FG_BG = 10200,
+  ATOM_MOBILE_BYTES_TRANSFER_BY_PROC_STATE = 10204,
+  ATOM_BIOMETRIC_FRR_NOTIFICATION = 817,
+  ATOM_SENSITIVE_CONTENT_MEDIA_PROJECTION_SESSION = 830,
+  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_SESSION = 831,
+  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_APPLIED = 832,
+  ATOM_SENSITIVE_NOTIFICATION_REDACTION = 833,
+  ATOM_SENSITIVE_CONTENT_APP_PROTECTION = 835,
+  ATOM_APP_RESTRICTION_STATE_CHANGED = 866,
+  ATOM_BATTERY_USAGE_STATS_PER_UID = 10209,
+  ATOM_POSTGC_MEMORY_SNAPSHOT = 924,
+  ATOM_POWER_SAVE_TEMP_ALLOWLIST_CHANGED = 926,
+  ATOM_APP_OP_ACCESS_TRACKED = 931,
+  ATOM_CONTENT_OR_FILE_URI_EVENT_REPORTED = 933,
+  ATOM_DEVICE_IDLE_TEMP_ALLOWLIST_UPDATED = 940,
+  ATOM_APP_OP_NOTE_OP_OR_CHECK_OP_BINDER_API_CALLED = 943,
+  ATOM_FRAMEWORK_WAKELOCK_INFO = 10230,
+  ATOM_JANK_FRAME_COUNT_BY_WIDGET_REPORTED = 950,
+  ATOM_INTENT_CREATOR_TOKEN_ADDED = 978,
+  ATOM_NOTIFICATION_CHANNEL_CLASSIFICATION = 983,
+  ATOM_CAMERA_STATUS_FOR_COMPATIBILITY_CHANGED = 999,
+  ATOM_FEDERATED_COMPUTE_API_CALLED = 712,
+  ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED = 771,
+  ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED = 838,
+  ATOM_FEDERATED_COMPUTE_TRACE_EVENT_REPORTED = 992,
+  ATOM_EXPRESS_EVENT_REPORTED = 528,
+  ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED = 593,
+  ATOM_EXPRESS_UID_EVENT_REPORTED = 644,
+  ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED = 658,
+  ATOM_DREAM_SETTING_CHANGED = 705,
+  ATOM_DREAM_SETTING_SNAPSHOT = 10192,
+  ATOM_DND_STATE_CHANGED = 657,
+  ATOM_EXTERNAL_DISPLAY_STATE_CHANGED = 806,
+  ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED = 792,
+  ATOM_DEVICE_POLICY_MANAGEMENT_MODE = 10216,
+  ATOM_DEVICE_POLICY_STATE = 10217,
+  ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED = 726,
+  ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED = 727,
+  ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED = 728,
+  ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED = 789,
+  ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED = 790,
+  ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED = 791,
+  ATOM_DESKTOP_MODE_UI_CHANGED = 818,
+  ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE = 819,
+  ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED = 935,
+  ATOM_CRONET_ENGINE_CREATED = 703,
+  ATOM_CRONET_TRAFFIC_REPORTED = 704,
+  ATOM_CRONET_ENGINE_BUILDER_INITIALIZED = 762,
+  ATOM_CRONET_HTTP_FLAGS_INITIALIZED = 763,
+  ATOM_CRONET_INITIALIZED = 764,
+  ATOM_CREDENTIAL_MANAGER_API_CALLED = 585,
+  ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED = 651,
+  ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED = 652,
+  ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED = 653,
+  ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED = 667,
+  ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED = 668,
+  ATOM_CREDENTIAL_MANAGER_GET_REPORTED = 669,
+  ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED = 670,
+  ATOM_CREDENTIAL_MANAGER_APIV2_CALLED = 671,
+  ATOM_CPU_POLICY = 10199,
+  ATOM_VPN_CONNECTION_STATE_CHANGED = 850,
+  ATOM_VPN_CONNECTION_REPORTED = 851,
+  ATOM_IP_CLIENT_RA_INFO_REPORTED = 778,
+  ATOM_APF_SESSION_INFO_REPORTED = 777,
+  ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED = 979,
+  ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED = 783,
+  ATOM_DAILY_KEEPALIVE_INFO_REPORTED = 650,
+  ATOM_NETWORK_REQUEST_STATE_CHANGED = 779,
+  ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED = 925,
+  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED = 972,
+  ATOM_HARDWARE_RENDERER_EVENT = 946,
+  ATOM_TEXTURE_VIEW_EVENT = 947,
+  ATOM_SURFACE_CONTROL_EVENT = 948,
+  ATOM_IMAGE_DECODED = 977,
+  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED = 934,
+  ATOM_CONSCRYPT_SERVICE_USED = 965,
+  ATOM_CERTIFICATE_TRANSPARENCY_VERIFICATION_REPORTED = 989,
+  ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT = 900,
+  ATOM_BROADCAST_SENT = 922,
+  ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED = 613,
+  ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION = 614,
+  ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION = 615,
+  ATOM_BLUETOOTH_LE_SESSION_CONNECTED = 656,
+  ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED = 666,
+  ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED = 696,
+  ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED = 781,
+  ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED = 782,
+  ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID = 862,
+  ATOM_LE_APP_SCAN_STATE_CHANGED = 870,
+  ATOM_LE_RADIO_SCAN_STOPPED = 871,
+  ATOM_LE_SCAN_RESULT_RECEIVED = 872,
+  ATOM_LE_SCAN_ABUSED = 873,
+  ATOM_LE_ADV_STATE_CHANGED = 874,
+  ATOM_LE_ADV_ERROR_REPORTED = 875,
+  ATOM_A2DP_SESSION_REPORTED = 904,
+  ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED = 916,
+  ATOM_BROADCAST_AUDIO_SESSION_REPORTED = 927,
+  ATOM_BROADCAST_AUDIO_SYNC_REPORTED = 928,
+  ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE = 982,
+  ATOM_BLUETOOTH_LE_CONNECTION = 988,
+  ATOM_HEARING_DEVICE_ACTIVE_EVENT_REPORTED = 1021,
+  ATOM_BACKPORTED_FIX_STATUS_REPORTED = 987,
+  ATOM_PLUGIN_INITIALIZED = 655,
+  ATOM_CAR_SYSTEM_UI_DATA_SUBSCRIPTION_EVENT_REPORTED = 974,
+  ATOM_CAR_SETTINGS_DATA_SUBSCRIPTION_EVENT_REPORTED = 975,
+  ATOM_CAR_QC_LIB_EVENT_REPORTED = 976,
+  ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED = 852,
+  ATOM_CAR_RECENTS_EVENT_REPORTED = 770,
+  ATOM_CAR_CALM_MODE_EVENT_REPORTED = 797,
+  ATOM_AUTOFILL_UI_EVENT_REPORTED = 603,
+  ATOM_AUTOFILL_FILL_REQUEST_REPORTED = 604,
+  ATOM_AUTOFILL_FILL_RESPONSE_REPORTED = 605,
+  ATOM_AUTOFILL_SAVE_EVENT_REPORTED = 606,
+  ATOM_AUTOFILL_SESSION_COMMITTED = 607,
+  ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED = 659,
+  ATOM_ODREFRESH_REPORTED = 366,
+  ATOM_ODSIGN_REPORTED = 548,
+  ATOM_BACKGROUND_DEXOPT_JOB_ENDED = 467,
+  ATOM_PREREBOOT_DEXOPT_JOB_ENDED = 883,
+  ATOM_ART_DATUM_REPORTED = 332,
+  ATOM_ART_DEVICE_DATUM_REPORTED = 550,
+  ATOM_ART_DATUM_DELTA_REPORTED = 565,
+  ATOM_ART_DEX2OAT_REPORTED = 929,
+  ATOM_ART_DEVICE_STATUS = 10205,
+  ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED = 385,
+  ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED = 579,
+  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED = 825,
+  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED = 826,
+  ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED = 909,
+  ATOM_APP_FUNCTIONS_REQUEST_REPORTED = 998,
+  ATOM_APEX_INSTALLATION_REQUESTED = 732,
+  ATOM_APEX_INSTALLATION_STAGED = 733,
+  ATOM_APEX_INSTALLATION_ENDED = 734,
+  ATOM_AI_WALLPAPERS_BUTTON_PRESSED = 706,
+  ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED = 707,
+  ATOM_AI_WALLPAPERS_TERM_SELECTED = 708,
+  ATOM_AI_WALLPAPERS_WALLPAPER_SET = 709,
+  ATOM_AI_WALLPAPERS_SESSION_SUMMARY = 710,
   ATOM_JSSCRIPTENGINE_LATENCY_REPORTED = 483,
   ATOM_AD_SERVICES_API_CALLED = 435,
   ATOM_AD_SERVICES_MESUREMENT_REPORTS_UPLOADED = 436,
@@ -56929,351 +57253,19 @@ enum AtomId : int32_t {
   ATOM_AD_SERVICES_COBALT_PERIODIC_JOB_EVENT_REPORTED = 903,
   ATOM_UPDATE_SIGNALS_PROCESS_REPORTED = 905,
   ATOM_TOPICS_SCHEDULE_EPOCH_JOB_SETTING_REPORTED = 930,
-  ATOM_AI_WALLPAPERS_BUTTON_PRESSED = 706,
-  ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED = 707,
-  ATOM_AI_WALLPAPERS_TERM_SELECTED = 708,
-  ATOM_AI_WALLPAPERS_WALLPAPER_SET = 709,
-  ATOM_AI_WALLPAPERS_SESSION_SUMMARY = 710,
-  ATOM_APEX_INSTALLATION_REQUESTED = 732,
-  ATOM_APEX_INSTALLATION_STAGED = 733,
-  ATOM_APEX_INSTALLATION_ENDED = 734,
-  ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED = 385,
-  ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED = 579,
-  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED = 825,
-  ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED = 826,
-  ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED = 909,
-  ATOM_ART_DATUM_REPORTED = 332,
-  ATOM_ART_DEVICE_DATUM_REPORTED = 550,
-  ATOM_ART_DATUM_DELTA_REPORTED = 565,
-  ATOM_ART_DEX2OAT_REPORTED = 929,
-  ATOM_ART_DEVICE_STATUS = 10205,
-  ATOM_BACKGROUND_DEXOPT_JOB_ENDED = 467,
-  ATOM_PREREBOOT_DEXOPT_JOB_ENDED = 883,
-  ATOM_ODREFRESH_REPORTED = 366,
-  ATOM_ODSIGN_REPORTED = 548,
-  ATOM_AUTOFILL_UI_EVENT_REPORTED = 603,
-  ATOM_AUTOFILL_FILL_REQUEST_REPORTED = 604,
-  ATOM_AUTOFILL_FILL_RESPONSE_REPORTED = 605,
-  ATOM_AUTOFILL_SAVE_EVENT_REPORTED = 606,
-  ATOM_AUTOFILL_SESSION_COMMITTED = 607,
-  ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED = 659,
-  ATOM_CAR_RECENTS_EVENT_REPORTED = 770,
-  ATOM_CAR_CALM_MODE_EVENT_REPORTED = 797,
-  ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED = 852,
-  ATOM_PLUGIN_INITIALIZED = 655,
-  ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED = 613,
-  ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION = 614,
-  ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION = 615,
-  ATOM_BLUETOOTH_LE_SESSION_CONNECTED = 656,
-  ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED = 666,
-  ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED = 696,
-  ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED = 781,
-  ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED = 782,
-  ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID = 862,
-  ATOM_LE_APP_SCAN_STATE_CHANGED = 870,
-  ATOM_LE_RADIO_SCAN_STOPPED = 871,
-  ATOM_LE_SCAN_RESULT_RECEIVED = 872,
-  ATOM_LE_SCAN_ABUSED = 873,
-  ATOM_LE_ADV_STATE_CHANGED = 874,
-  ATOM_LE_ADV_ERROR_REPORTED = 875,
-  ATOM_A2DP_SESSION_REPORTED = 904,
-  ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED = 916,
-  ATOM_BROADCAST_AUDIO_SESSION_REPORTED = 927,
-  ATOM_BROADCAST_AUDIO_SYNC_REPORTED = 928,
-  ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE = 982,
-  ATOM_BLUETOOTH_LE_CONNECTION = 988,
-  ATOM_BROADCAST_SENT = 922,
-  ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT = 900,
-  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED = 934,
-  ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_FAILED = 972,
-  ATOM_DAILY_KEEPALIVE_INFO_REPORTED = 650,
-  ATOM_NETWORK_REQUEST_STATE_CHANGED = 779,
-  ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED = 925,
-  ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED = 783,
-  ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED = 979,
-  ATOM_APF_SESSION_INFO_REPORTED = 777,
-  ATOM_IP_CLIENT_RA_INFO_REPORTED = 778,
-  ATOM_VPN_CONNECTION_STATE_CHANGED = 850,
-  ATOM_VPN_CONNECTION_REPORTED = 851,
-  ATOM_CPU_POLICY = 10199,
-  ATOM_CREDENTIAL_MANAGER_API_CALLED = 585,
-  ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED = 651,
-  ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED = 652,
-  ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED = 653,
-  ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED = 667,
-  ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED = 668,
-  ATOM_CREDENTIAL_MANAGER_GET_REPORTED = 669,
-  ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED = 670,
-  ATOM_CREDENTIAL_MANAGER_APIV2_CALLED = 671,
-  ATOM_CRONET_ENGINE_CREATED = 703,
-  ATOM_CRONET_TRAFFIC_REPORTED = 704,
-  ATOM_CRONET_ENGINE_BUILDER_INITIALIZED = 762,
-  ATOM_CRONET_HTTP_FLAGS_INITIALIZED = 763,
-  ATOM_CRONET_INITIALIZED = 764,
-  ATOM_DESKTOP_MODE_UI_CHANGED = 818,
-  ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE = 819,
-  ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED = 935,
-  ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED = 726,
-  ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED = 727,
-  ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED = 728,
-  ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED = 789,
-  ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED = 790,
-  ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED = 791,
-  ATOM_DEVICE_POLICY_MANAGEMENT_MODE = 10216,
-  ATOM_DEVICE_POLICY_STATE = 10217,
-  ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED = 792,
-  ATOM_EXTERNAL_DISPLAY_STATE_CHANGED = 806,
-  ATOM_DND_STATE_CHANGED = 657,
-  ATOM_DREAM_SETTING_CHANGED = 705,
-  ATOM_DREAM_SETTING_SNAPSHOT = 10192,
-  ATOM_EXPRESS_EVENT_REPORTED = 528,
-  ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED = 593,
-  ATOM_EXPRESS_UID_EVENT_REPORTED = 644,
-  ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED = 658,
-  ATOM_FEDERATED_COMPUTE_API_CALLED = 712,
-  ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED = 771,
-  ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED = 838,
-  ATOM_FULL_SCREEN_INTENT_LAUNCHED = 631,
-  ATOM_BAL_ALLOWED = 632,
-  ATOM_IN_TASK_ACTIVITY_STARTED = 685,
-  ATOM_DEVICE_ORIENTATION_CHANGED = 906,
-  ATOM_CACHED_APPS_HIGH_WATERMARK = 10189,
-  ATOM_STYLUS_PREDICTION_METRICS_REPORTED = 718,
-  ATOM_USER_RISK_EVENT_REPORTED = 725,
-  ATOM_MEDIA_PROJECTION_STATE_CHANGED = 729,
-  ATOM_MEDIA_PROJECTION_TARGET_CHANGED = 730,
-  ATOM_EXCESSIVE_BINDER_PROXY_COUNT_REPORTED = 853,
-  ATOM_PROXY_BYTES_TRANSFER_BY_FG_BG = 10200,
-  ATOM_MOBILE_BYTES_TRANSFER_BY_PROC_STATE = 10204,
-  ATOM_BIOMETRIC_FRR_NOTIFICATION = 817,
-  ATOM_SENSITIVE_CONTENT_MEDIA_PROJECTION_SESSION = 830,
-  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_SESSION = 831,
-  ATOM_SENSITIVE_NOTIFICATION_APP_PROTECTION_APPLIED = 832,
-  ATOM_SENSITIVE_NOTIFICATION_REDACTION = 833,
-  ATOM_SENSITIVE_CONTENT_APP_PROTECTION = 835,
-  ATOM_APP_RESTRICTION_STATE_CHANGED = 866,
-  ATOM_BATTERY_USAGE_STATS_PER_UID = 10209,
-  ATOM_POSTGC_MEMORY_SNAPSHOT = 924,
-  ATOM_POWER_SAVE_TEMP_ALLOWLIST_CHANGED = 926,
-  ATOM_APP_OP_ACCESS_TRACKED = 931,
-  ATOM_CONTENT_OR_FILE_URI_EVENT_REPORTED = 933,
-  ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED = 584,
-  ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED = 816,
-  ATOM_BATTERY_HEALTH = 10220,
-  ATOM_HDMI_EARC_STATUS_REPORTED = 701,
-  ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED = 724,
-  ATOM_HEALTH_CONNECT_API_CALLED = 616,
-  ATOM_HEALTH_CONNECT_USAGE_STATS = 617,
-  ATOM_HEALTH_CONNECT_STORAGE_STATS = 618,
-  ATOM_HEALTH_CONNECT_API_INVOKED = 643,
-  ATOM_EXERCISE_ROUTE_API_CALLED = 654,
-  ATOM_HEALTH_CONNECT_EXPORT_INVOKED = 907,
-  ATOM_HEALTH_CONNECT_IMPORT_INVOKED = 918,
-  ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED = 919,
-  ATOM_HEALTH_CONNECT_UI_IMPRESSION = 623,
-  ATOM_HEALTH_CONNECT_UI_INTERACTION = 624,
-  ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED = 625,
-  ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED = 761,
-  ATOM_IKE_SESSION_TERMINATED = 678,
-  ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED = 760,
-  ATOM_NEGOTIATED_SECURITY_ASSOCIATION = 821,
-  ATOM_KEYBOARD_CONFIGURED = 682,
-  ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED = 683,
-  ATOM_INPUTDEVICE_USAGE_REPORTED = 686,
-  ATOM_INPUT_EVENT_LATENCY_REPORTED = 932,
-  ATOM_TOUCHPAD_USAGE = 10191,
-  ATOM_KERNEL_OOM_KILL_OCCURRED = 754,
-  ATOM_EMERGENCY_STATE_CHANGED = 633,
-  ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED = 868,
-  ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED = 1002,
-  ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED = 1003,
-  ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED = 1004,
-  ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED = 600,
-  ATOM_MEDIA_CODEC_STARTED = 641,
-  ATOM_MEDIA_CODEC_STOPPED = 642,
-  ATOM_MEDIA_CODEC_RENDERED = 684,
-  ATOM_MEDIA_EDITING_ENDED_REPORTED = 798,
-  ATOM_MTE_STATE = 10181,
-  ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED = 901,
-  ATOM_NFC_OBSERVE_MODE_STATE_CHANGED = 855,
-  ATOM_NFC_FIELD_CHANGED = 856,
-  ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED = 857,
-  ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED = 858,
-  ATOM_ONDEVICEPERSONALIZATION_API_CALLED = 711,
-  ATOM_COMPONENT_STATE_CHANGED_REPORTED = 863,
-  ATOM_PDF_LOAD_REPORTED = 859,
-  ATOM_PDF_API_USAGE_REPORTED = 860,
-  ATOM_PDF_SEARCH_REPORTED = 861,
-  ATOM_PRESSURE_STALL_INFORMATION = 10229,
-  ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED = 645,
-  ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED = 646,
-  ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION = 647,
-  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED = 648,
-  ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED = 649,
-  ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED = 827,
-  ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED = 828,
-  ATOM_PHOTOPICKER_SESSION_INFO_REPORTED = 886,
-  ATOM_PHOTOPICKER_API_INFO_REPORTED = 887,
-  ATOM_PHOTOPICKER_UI_EVENT_LOGGED = 888,
-  ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED = 889,
-  ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED = 890,
-  ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED = 891,
-  ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED = 892,
-  ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED = 893,
-  ATOM_PHOTOPICKER_PAGE_INFO_LOGGED = 894,
-  ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED = 895,
-  ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED = 896,
-  ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED = 897,
-  ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED = 898,
-  ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED = 899,
-  ATOM_ATOM_9999 = 9999,
-  ATOM_ATOM_99999 = 99999,
-  ATOM_SCREEN_OFF_REPORTED = 776,
-  ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED = 836,
-  ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED = 837,
-  ATOM_SCREEN_DIM_REPORTED = 867,
-  ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED = 784,
-  ATOM_BACKUP_SETUP_STATUS_REPORTED = 785,
-  ATOM_RANGING_SESSION_CONFIGURED = 993,
-  ATOM_RANGING_SESSION_STARTED = 994,
-  ATOM_RANGING_SESSION_CLOSED = 995,
-  ATOM_RANGING_TECHNOLOGY_STARTED = 996,
-  ATOM_RANGING_TECHNOLOGY_STOPPED = 997,
-  ATOM_RKPD_POOL_STATS = 664,
-  ATOM_RKPD_CLIENT_OPERATION = 665,
-  ATOM_SANDBOX_API_CALLED = 488,
-  ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED = 735,
-  ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION = 796,
-  ATOM_SANDBOX_SDK_STORAGE = 10159,
-  ATOM_SELINUX_AUDIT_LOG = 799,
-  ATOM_SETTINGS_SPA_REPORTED = 622,
-  ATOM_TEST_EXTENSION_ATOM_REPORTED = 660,
-  ATOM_TEST_RESTRICTED_ATOM_REPORTED = 672,
-  ATOM_STATS_SOCKET_LOSS_REPORTED = 752,
-  ATOM_LOCKSCREEN_SHORTCUT_SELECTED = 611,
-  ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED = 612,
-  ATOM_LAUNCHER_IMPRESSION_EVENT_V2 = 716,
-  ATOM_DISPLAY_SWITCH_LATENCY_TRACKED = 753,
-  ATOM_NOTIFICATION_LISTENER_SERVICE = 829,
-  ATOM_NAV_HANDLE_TOUCH_POINTS = 869,
-  ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED = 908,
-  ATOM_COMMUNAL_HUB_SNAPSHOT = 10226,
-  ATOM_EMERGENCY_NUMBER_DIALED = 637,
-  ATOM_CALL_STATS = 10221,
-  ATOM_CALL_AUDIO_ROUTE_STATS = 10222,
-  ATOM_TELECOM_API_STATS = 10223,
-  ATOM_TELECOM_ERROR_STATS = 10224,
-  ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED = 713,
-  ATOM_EMERGENCY_NUMBERS_INFO = 10180,
-  ATOM_DATA_NETWORK_VALIDATION = 10207,
-  ATOM_DATA_RAT_STATE_CHANGED = 854,
-  ATOM_CONNECTED_CHANNEL_CHANGED = 882,
-  ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED = 923,
-  ATOM_QUALIFIED_RAT_LIST_CHANGED = 634,
-  ATOM_QNS_IMS_CALL_DROP_STATS = 635,
-  ATOM_QNS_FALLBACK_RESTRICTION_CHANGED = 636,
-  ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO = 10177,
-  ATOM_QNS_HANDOVER_TIME_MILLIS = 10178,
-  ATOM_QNS_HANDOVER_PINGPONG = 10179,
-  ATOM_SATELLITE_CONTROLLER = 10182,
-  ATOM_SATELLITE_SESSION = 10183,
-  ATOM_SATELLITE_INCOMING_DATAGRAM = 10184,
-  ATOM_SATELLITE_OUTGOING_DATAGRAM = 10185,
-  ATOM_SATELLITE_PROVISION = 10186,
-  ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER = 10187,
-  ATOM_CARRIER_ROAMING_SATELLITE_SESSION = 10211,
-  ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS = 10212,
-  ATOM_CONTROLLER_STATS_PER_PACKAGE = 10213,
-  ATOM_SATELLITE_ENTITLEMENT = 10214,
-  ATOM_SATELLITE_CONFIG_UPDATER = 10215,
-  ATOM_SATELLITE_ACCESS_CONTROLLER = 10219,
-  ATOM_CELLULAR_IDENTIFIER_DISCLOSED = 800,
-  ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED = 738,
-  ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED = 739,
-  ATOM_THREADNETWORK_DEVICE_INFO_REPORTED = 740,
-  ATOM_BOOT_INTEGRITY_INFO_REPORTED = 775,
-  ATOM_TV_LOW_POWER_STANDBY_POLICY = 679,
-  ATOM_EXTERNAL_TV_INPUT_EVENT = 717,
-  ATOM_TEST_UPROBESTATS_ATOM_REPORTED = 915,
-  ATOM_UWB_ACTIVITY_INFO = 10188,
-  ATOM_MEDIATOR_UPDATED = 721,
-  ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER = 10196,
-  ATOM_SYSPROXY_CONNECTION_UPDATED = 786,
-  ATOM_WEAR_COMPANION_CONNECTION_STATE = 921,
-  ATOM_MEDIA_ACTION_REPORTED = 608,
-  ATOM_MEDIA_CONTROLS_LAUNCHED = 609,
-  ATOM_MEDIA_SESSION_STATE_CHANGED = 677,
-  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY = 757,
-  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE = 758,
-  ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT = 759,
-  ATOM_WEAR_MODE_STATE_CHANGED = 715,
-  ATOM_RENDERER_INITIALIZED = 736,
-  ATOM_SCHEMA_VERSION_RECEIVED = 737,
-  ATOM_LAYOUT_INSPECTED = 741,
-  ATOM_LAYOUT_EXPRESSION_INSPECTED = 742,
-  ATOM_LAYOUT_ANIMATIONS_INSPECTED = 743,
-  ATOM_MATERIAL_COMPONENTS_INSPECTED = 744,
-  ATOM_TILE_REQUESTED = 745,
-  ATOM_STATE_RESPONSE_RECEIVED = 746,
-  ATOM_TILE_RESPONSE_RECEIVED = 747,
-  ATOM_INFLATION_FINISHED = 748,
-  ATOM_INFLATION_FAILED = 749,
-  ATOM_IGNORED_INFLATION_FAILURES_REPORTED = 750,
-  ATOM_DRAWABLE_RENDERED = 751,
-  ATOM_WEAR_TIME_SYNC_REQUESTED = 911,
-  ATOM_WEAR_TIME_UPDATE_STARTED = 912,
-  ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED = 913,
-  ATOM_WEAR_TIME_CHANGED = 914,
-  ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED = 619,
-  ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED = 620,
-  ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED = 621,
-  ATOM_WS_WEAR_TIME_SESSION = 610,
-  ATOM_WS_INCOMING_CALL_ACTION_REPORTED = 626,
-  ATOM_WS_CALL_DISCONNECTION_REPORTED = 627,
-  ATOM_WS_CALL_DURATION_REPORTED = 628,
-  ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED = 629,
-  ATOM_WS_CALL_INTERACTION_REPORTED = 630,
-  ATOM_WS_ON_BODY_STATE_CHANGED = 787,
-  ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED = 802,
-  ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED = 803,
-  ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED = 804,
-  ATOM_WS_REMOTE_EVENT_USAGE_REPORTED = 920,
-  ATOM_WS_BUGREPORT_REQUESTED = 936,
-  ATOM_WS_BUGREPORT_TRIGGERED = 937,
-  ATOM_WS_BUGREPORT_FINISHED = 938,
-  ATOM_WS_BUGREPORT_RESULT_RECEIVED = 939,
-  ATOM_WS_STANDALONE_MODE_SNAPSHOT = 10197,
-  ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT = 10206,
-  ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT = 10225,
-  ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT = 10227,
-  ATOM_WEAR_POWER_MENU_OPENED = 731,
-  ATOM_WEAR_ASSISTANT_OPENED = 755,
-  ATOM_FIRST_OVERLAY_STATE_CHANGED = 917,
-  ATOM_WIFI_AWARE_NDP_REPORTED = 638,
-  ATOM_WIFI_AWARE_ATTACH_REPORTED = 639,
-  ATOM_WIFI_SELF_RECOVERY_TRIGGERED = 661,
-  ATOM_SOFT_AP_STARTED = 680,
-  ATOM_SOFT_AP_STOPPED = 681,
-  ATOM_WIFI_LOCK_RELEASED = 687,
-  ATOM_WIFI_LOCK_DEACTIVATED = 688,
-  ATOM_WIFI_CONFIG_SAVED = 689,
-  ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED = 690,
-  ATOM_WIFI_AWARE_HAL_API_CALLED = 691,
-  ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED = 692,
-  ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED = 693,
-  ATOM_WIFI_THREAD_TASK_EXECUTED = 694,
-  ATOM_WIFI_STATE_CHANGED = 700,
-  ATOM_PNO_SCAN_STARTED = 719,
-  ATOM_PNO_SCAN_STOPPED = 720,
-  ATOM_WIFI_IS_UNUSABLE_REPORTED = 722,
-  ATOM_WIFI_AP_CAPABILITIES_REPORTED = 723,
-  ATOM_SOFT_AP_STATE_CHANGED = 805,
-  ATOM_SCORER_PREDICTION_RESULT_REPORTED = 884,
-  ATOM_WIFI_AWARE_CAPABILITIES = 10190,
-  ATOM_WIFI_MODULE_INFO = 10193,
-  ATOM_WIFI_SETTING_INFO = 10194,
-  ATOM_WIFI_COMPLEX_SETTING_INFO = 10195,
-  ATOM_WIFI_CONFIGURED_NETWORK_INFO = 10198,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_SCHEDULE_ATTEMPTED = 967,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED = 968,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED_ATTEMPTED_FAILURE_REPORTED = 969,
+  ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_BACKGROUND_JOB_RAN = 970,
+  ATOM_THERMAL_STATUS_CALLED = 772,
+  ATOM_THERMAL_HEADROOM_CALLED = 773,
+  ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED = 774,
+  ATOM_ADPF_HINT_SESSION_TID_CLEANUP = 839,
+  ATOM_THERMAL_HEADROOM_THRESHOLDS = 10201,
+  ATOM_ADPF_SESSION_SNAPSHOT = 10218,
+  ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED = 820,
+  ATOM_ACCOUNT_MANAGER_EVENT = 951,
+  ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED = 910,
 };
 
 constexpr AtomId AtomId_MIN = AtomId::ATOM_UNSPECIFIED;
@@ -59470,554 +59462,743 @@ const char* AtomId_Name(::perfetto::protos::pbzero::AtomId value) {
   case ::perfetto::protos::pbzero::AtomId::ATOM_WS_FAVOURITE_WATCH_FACE_LIST_SNAPSHOT:
     return "ATOM_WS_FAVOURITE_WATCH_FACE_LIST_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED:
-    return "ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_NDP_REPORTED:
+    return "ATOM_WIFI_AWARE_NDP_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED:
-    return "ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_ATTACH_REPORTED:
+    return "ATOM_WIFI_AWARE_ATTACH_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_STATUS_CALLED:
-    return "ATOM_THERMAL_STATUS_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_SELF_RECOVERY_TRIGGERED:
+    return "ATOM_WIFI_SELF_RECOVERY_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_HEADROOM_CALLED:
-    return "ATOM_THERMAL_HEADROOM_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SOFT_AP_STARTED:
+    return "ATOM_SOFT_AP_STARTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED:
-    return "ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SOFT_AP_STOPPED:
+    return "ATOM_SOFT_AP_STOPPED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ADPF_HINT_SESSION_TID_CLEANUP:
-    return "ATOM_ADPF_HINT_SESSION_TID_CLEANUP";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCK_RELEASED:
+    return "ATOM_WIFI_LOCK_RELEASED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_HEADROOM_THRESHOLDS:
-    return "ATOM_THERMAL_HEADROOM_THRESHOLDS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCK_DEACTIVATED:
+    return "ATOM_WIFI_LOCK_DEACTIVATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ADPF_SESSION_SNAPSHOT:
-    return "ATOM_ADPF_SESSION_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_CONFIG_SAVED:
+    return "ATOM_WIFI_CONFIG_SAVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_JSSCRIPTENGINE_LATENCY_REPORTED:
-    return "ATOM_JSSCRIPTENGINE_LATENCY_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED:
+    return "ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_API_CALLED:
-    return "ATOM_AD_SERVICES_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_HAL_API_CALLED:
+    return "ATOM_WIFI_AWARE_HAL_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MESUREMENT_REPORTS_UPLOADED:
-    return "ATOM_AD_SERVICES_MESUREMENT_REPORTS_UPLOADED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED:
+    return "ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STATUS_REPORTED:
-    return "ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED:
+    return "ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MOBILE_DATA_DOWNLOAD_DOWNLOAD_RESULT_REPORTED:
-    return "ATOM_MOBILE_DATA_DOWNLOAD_DOWNLOAD_RESULT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_THREAD_TASK_EXECUTED:
+    return "ATOM_WIFI_THREAD_TASK_EXECUTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_SETTINGS_USAGE_REPORTED:
-    return "ATOM_AD_SERVICES_SETTINGS_USAGE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_STATE_CHANGED:
+    return "ATOM_WIFI_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKGROUND_FETCH_PROCESS_REPORTED:
-    return "ATOM_BACKGROUND_FETCH_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PNO_SCAN_STARTED:
+    return "ATOM_PNO_SCAN_STARTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_UPDATE_CUSTOM_AUDIENCE_PROCESS_REPORTED:
-    return "ATOM_UPDATE_CUSTOM_AUDIENCE_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PNO_SCAN_STOPPED:
+    return "ATOM_PNO_SCAN_STOPPED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_BIDDING_PROCESS_REPORTED:
-    return "ATOM_RUN_AD_BIDDING_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_IS_UNUSABLE_REPORTED:
+    return "ATOM_WIFI_IS_UNUSABLE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_SCORING_PROCESS_REPORTED:
-    return "ATOM_RUN_AD_SCORING_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AP_CAPABILITIES_REPORTED:
+    return "ATOM_WIFI_AP_CAPABILITIES_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_SELECTION_PROCESS_REPORTED:
-    return "ATOM_RUN_AD_SELECTION_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SOFT_AP_STATE_CHANGED:
+    return "ATOM_SOFT_AP_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_BIDDING_PER_CA_PROCESS_REPORTED:
-    return "ATOM_RUN_AD_BIDDING_PER_CA_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCORER_PREDICTION_RESULT_REPORTED:
+    return "ATOM_SCORER_PREDICTION_RESULT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STORAGE_STATS_REPORTED:
-    return "ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STORAGE_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_CAPABILITIES:
+    return "ATOM_WIFI_AWARE_CAPABILITIES";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_REGISTRATIONS:
-    return "ATOM_AD_SERVICES_MEASUREMENT_REGISTRATIONS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_MODULE_INFO:
+    return "ATOM_WIFI_MODULE_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_GET_TOPICS_REPORTED:
-    return "ATOM_AD_SERVICES_GET_TOPICS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_SETTING_INFO:
+    return "ATOM_WIFI_SETTING_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_EPOCH_COMPUTATION_GET_TOP_TOPICS_REPORTED:
-    return "ATOM_AD_SERVICES_EPOCH_COMPUTATION_GET_TOP_TOPICS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_COMPLEX_SETTING_INFO:
+    return "ATOM_WIFI_COMPLEX_SETTING_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_EPOCH_COMPUTATION_CLASSIFIER_REPORTED:
-    return "ATOM_AD_SERVICES_EPOCH_COMPUTATION_CLASSIFIER_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_CONFIGURED_NETWORK_INFO:
+    return "ATOM_WIFI_CONFIGURED_NETWORK_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_BACK_COMPAT_GET_TOPICS_REPORTED:
-    return "ATOM_AD_SERVICES_BACK_COMPAT_GET_TOPICS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_POWER_MENU_OPENED:
+    return "ATOM_WEAR_POWER_MENU_OPENED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_BACK_COMPAT_EPOCH_COMPUTATION_CLASSIFIER_REPORTED:
-    return "ATOM_AD_SERVICES_BACK_COMPAT_EPOCH_COMPUTATION_CLASSIFIER_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_ASSISTANT_OPENED:
+    return "ATOM_WEAR_ASSISTANT_OPENED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_DEBUG_KEYS:
-    return "ATOM_AD_SERVICES_MEASUREMENT_DEBUG_KEYS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_FIRST_OVERLAY_STATE_CHANGED:
+    return "ATOM_FIRST_OVERLAY_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ERROR_REPORTED:
-    return "ATOM_AD_SERVICES_ERROR_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WEAR_TIME_SESSION:
+    return "ATOM_WS_WEAR_TIME_SESSION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_BACKGROUND_JOBS_EXECUTION_REPORTED:
-    return "ATOM_AD_SERVICES_BACKGROUND_JOBS_EXECUTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_INCOMING_CALL_ACTION_REPORTED:
+    return "ATOM_WS_INCOMING_CALL_ACTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_DELAYED_SOURCE_REGISTRATION:
-    return "ATOM_AD_SERVICES_MEASUREMENT_DELAYED_SOURCE_REGISTRATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_DISCONNECTION_REPORTED:
+    return "ATOM_WS_CALL_DISCONNECTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_ATTRIBUTION:
-    return "ATOM_AD_SERVICES_MEASUREMENT_ATTRIBUTION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_DURATION_REPORTED:
+    return "ATOM_WS_CALL_DURATION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_JOBS:
-    return "ATOM_AD_SERVICES_MEASUREMENT_JOBS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED:
+    return "ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_WIPEOUT:
-    return "ATOM_AD_SERVICES_MEASUREMENT_WIPEOUT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_INTERACTION_REPORTED:
+    return "ATOM_WS_CALL_INTERACTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_AD_ID_MATCH_FOR_DEBUG_KEYS:
-    return "ATOM_AD_SERVICES_MEASUREMENT_AD_ID_MATCH_FOR_DEBUG_KEYS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_ON_BODY_STATE_CHANGED:
+    return "ATOM_WS_ON_BODY_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_DATA_STORED:
-    return "ATOM_AD_SERVICES_ENROLLMENT_DATA_STORED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED:
+    return "ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_FILE_DOWNLOADED:
-    return "ATOM_AD_SERVICES_ENROLLMENT_FILE_DOWNLOADED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED:
+    return "ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_MATCHED:
-    return "ATOM_AD_SERVICES_ENROLLMENT_MATCHED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED:
+    return "ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_CONSENT_MIGRATED:
-    return "ATOM_AD_SERVICES_CONSENT_MIGRATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_REMOTE_EVENT_USAGE_REPORTED:
+    return "ATOM_WS_REMOTE_EVENT_USAGE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_FAILED:
-    return "ATOM_AD_SERVICES_ENROLLMENT_FAILED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_NOTIFICATION_MANAGED_DISMISSAL_SYNC:
+    return "ATOM_WS_NOTIFICATION_MANAGED_DISMISSAL_SYNC";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_CLICK_VERIFICATION:
-    return "ATOM_AD_SERVICES_MEASUREMENT_CLICK_VERIFICATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_BUGREPORT_EVENT_REPORTED:
+    return "ATOM_WS_BUGREPORT_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENCRYPTION_KEY_FETCHED:
-    return "ATOM_AD_SERVICES_ENCRYPTION_KEY_FETCHED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_STANDALONE_MODE_SNAPSHOT:
+    return "ATOM_WS_STANDALONE_MODE_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENCRYPTION_KEY_DB_TRANSACTION_ENDED:
-    return "ATOM_AD_SERVICES_ENCRYPTION_KEY_DB_TRANSACTION_ENDED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT:
+    return "ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DESTINATION_REGISTERED_BEACONS:
-    return "ATOM_DESTINATION_REGISTERED_BEACONS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT:
+    return "ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_REPORT_INTERACTION_API_CALLED:
-    return "ATOM_REPORT_INTERACTION_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT:
+    return "ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_INTERACTION_REPORTING_TABLE_CLEARED:
-    return "ATOM_INTERACTION_REPORTING_TABLE_CLEARED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED:
+    return "ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_MANIFEST_CONFIG_HELPER_CALLED:
-    return "ATOM_APP_MANIFEST_CONFIG_HELPER_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED:
+    return "ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_FILTERING_PROCESS_JOIN_CA_REPORTED:
-    return "ATOM_AD_FILTERING_PROCESS_JOIN_CA_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED:
+    return "ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_FILTERING_PROCESS_AD_SELECTION_REPORTED:
-    return "ATOM_AD_FILTERING_PROCESS_AD_SELECTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_SYNC_REQUESTED:
+    return "ATOM_WEAR_TIME_SYNC_REQUESTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_COUNTER_HISTOGRAM_UPDATER_REPORTED:
-    return "ATOM_AD_COUNTER_HISTOGRAM_UPDATER_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_UPDATE_STARTED:
+    return "ATOM_WEAR_TIME_UPDATE_STARTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SIGNATURE_VERIFICATION:
-    return "ATOM_SIGNATURE_VERIFICATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED:
+    return "ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_IMMEDIATE_SIGN_JOIN_STATUS_REPORTED:
-    return "ATOM_K_ANON_IMMEDIATE_SIGN_JOIN_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_CHANGED:
+    return "ATOM_WEAR_TIME_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_BACKGROUND_JOB_STATUS_REPORTED:
-    return "ATOM_K_ANON_BACKGROUND_JOB_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_DEVICE_STATUS_REPORTED:
+    return "ATOM_WEAR_SETUP_WIZARD_DEVICE_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_INITIALIZE_STATUS_REPORTED:
-    return "ATOM_K_ANON_INITIALIZE_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_PAIRING_COMPLETED:
+    return "ATOM_WEAR_SETUP_WIZARD_PAIRING_COMPLETED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_SIGN_STATUS_REPORTED:
-    return "ATOM_K_ANON_SIGN_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_CONNECTION_ESTABLISHED:
+    return "ATOM_WEAR_SETUP_WIZARD_CONNECTION_ESTABLISHED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_JOIN_STATUS_REPORTED:
-    return "ATOM_K_ANON_JOIN_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_CHECKIN_COMPLETED:
+    return "ATOM_WEAR_SETUP_WIZARD_CHECKIN_COMPLETED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_KEY_ATTESTATION_STATUS_REPORTED:
-    return "ATOM_K_ANON_KEY_ATTESTATION_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_COMPANION_TIME_REPORTED:
+    return "ATOM_WEAR_SETUP_WIZARD_COMPANION_TIME_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_GET_AD_SELECTION_DATA_API_CALLED:
-    return "ATOM_GET_AD_SELECTION_DATA_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_STATUS_REPORTED:
+    return "ATOM_WEAR_SETUP_WIZARD_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_GET_AD_SELECTION_DATA_BUYER_INPUT_GENERATED:
-    return "ATOM_GET_AD_SELECTION_DATA_BUYER_INPUT_GENERATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_HEARTBEAT_REPORTED:
+    return "ATOM_WEAR_SETUP_WIZARD_HEARTBEAT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKGROUND_JOB_SCHEDULING_REPORTED:
-    return "ATOM_BACKGROUND_JOB_SCHEDULING_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_FRP_TRIGGERED:
+    return "ATOM_WEAR_SETUP_WIZARD_FRP_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TOPICS_ENCRYPTION_EPOCH_COMPUTATION_REPORTED:
-    return "ATOM_TOPICS_ENCRYPTION_EPOCH_COMPUTATION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_SYSTEM_UPDATE_TRIGGERED:
+    return "ATOM_WEAR_SETUP_WIZARD_SYSTEM_UPDATE_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TOPICS_ENCRYPTION_GET_TOPICS_REPORTED:
-    return "ATOM_TOPICS_ENCRYPTION_GET_TOPICS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_SETUP_WIZARD_PHONE_SWITCH_TRIGGERED:
+    return "ATOM_WEAR_SETUP_WIZARD_PHONE_SWITCH_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ADSERVICES_SHELL_COMMAND_CALLED:
-    return "ATOM_ADSERVICES_SHELL_COMMAND_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RENDERER_INITIALIZED:
+    return "ATOM_RENDERER_INITIALIZED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_UPDATE_SIGNALS_API_CALLED:
-    return "ATOM_UPDATE_SIGNALS_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCHEMA_VERSION_RECEIVED:
+    return "ATOM_SCHEMA_VERSION_RECEIVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ENCODING_JOB_RUN:
-    return "ATOM_ENCODING_JOB_RUN";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LAYOUT_INSPECTED:
+    return "ATOM_LAYOUT_INSPECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ENCODING_JS_FETCH:
-    return "ATOM_ENCODING_JS_FETCH";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LAYOUT_EXPRESSION_INSPECTED:
+    return "ATOM_LAYOUT_EXPRESSION_INSPECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ENCODING_JS_EXECUTION:
-    return "ATOM_ENCODING_JS_EXECUTION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LAYOUT_ANIMATIONS_INSPECTED:
+    return "ATOM_LAYOUT_ANIMATIONS_INSPECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PERSIST_AD_SELECTION_RESULT_CALLED:
-    return "ATOM_PERSIST_AD_SELECTION_RESULT_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MATERIAL_COMPONENTS_INSPECTED:
+    return "ATOM_MATERIAL_COMPONENTS_INSPECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SERVER_AUCTION_KEY_FETCH_CALLED:
-    return "ATOM_SERVER_AUCTION_KEY_FETCH_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TILE_REQUESTED:
+    return "ATOM_TILE_REQUESTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SERVER_AUCTION_BACKGROUND_KEY_FETCH_ENABLED:
-    return "ATOM_SERVER_AUCTION_BACKGROUND_KEY_FETCH_ENABLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_STATE_RESPONSE_RECEIVED:
+    return "ATOM_STATE_RESPONSE_RECEIVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_PROCESS_ODP_REGISTRATION:
-    return "ATOM_AD_SERVICES_MEASUREMENT_PROCESS_ODP_REGISTRATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TILE_RESPONSE_RECEIVED:
+    return "ATOM_TILE_RESPONSE_RECEIVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_NOTIFY_REGISTRATION_TO_ODP:
-    return "ATOM_AD_SERVICES_MEASUREMENT_NOTIFY_REGISTRATION_TO_ODP";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_INFLATION_FINISHED:
+    return "ATOM_INFLATION_FINISHED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SELECT_ADS_FROM_OUTCOMES_API_CALLED:
-    return "ATOM_SELECT_ADS_FROM_OUTCOMES_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_INFLATION_FAILED:
+    return "ATOM_INFLATION_FAILED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_REPORT_IMPRESSION_API_CALLED:
-    return "ATOM_REPORT_IMPRESSION_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_IGNORED_INFLATION_FAILURES_REPORTED:
+    return "ATOM_IGNORED_INFLATION_FAILURES_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_TRANSACTION_STATS:
-    return "ATOM_AD_SERVICES_ENROLLMENT_TRANSACTION_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DRAWABLE_RENDERED:
+    return "ATOM_DRAWABLE_RENDERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_COBALT_LOGGER_EVENT_REPORTED:
-    return "ATOM_AD_SERVICES_COBALT_LOGGER_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MODE_STATE_CHANGED:
+    return "ATOM_WEAR_MODE_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_COBALT_PERIODIC_JOB_EVENT_REPORTED:
-    return "ATOM_AD_SERVICES_COBALT_PERIODIC_JOB_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_ACTION_REPORTED:
+    return "ATOM_MEDIA_ACTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_UPDATE_SIGNALS_PROCESS_REPORTED:
-    return "ATOM_UPDATE_SIGNALS_PROCESS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CONTROLS_LAUNCHED:
+    return "ATOM_MEDIA_CONTROLS_LAUNCHED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TOPICS_SCHEDULE_EPOCH_JOB_SETTING_REPORTED:
-    return "ATOM_TOPICS_SCHEDULE_EPOCH_JOB_SETTING_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_SESSION_STATE_CHANGED:
+    return "ATOM_MEDIA_SESSION_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_BUTTON_PRESSED:
-    return "ATOM_AI_WALLPAPERS_BUTTON_PRESSED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CONTROL_API_USAGE_REPORTED:
+    return "ATOM_MEDIA_CONTROL_API_USAGE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED:
-    return "ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_SUBSCRIPTION_CHANGED:
+    return "ATOM_MEDIA_SUBSCRIPTION_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_TERM_SELECTED:
-    return "ATOM_AI_WALLPAPERS_TERM_SELECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY:
+    return "ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_WALLPAPER_SET:
-    return "ATOM_AI_WALLPAPERS_WALLPAPER_SET";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE:
+    return "ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_SESSION_SUMMARY:
-    return "ATOM_AI_WALLPAPERS_SESSION_SUMMARY";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT:
+    return "ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APEX_INSTALLATION_REQUESTED:
-    return "ATOM_APEX_INSTALLATION_REQUESTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIATOR_UPDATED:
+    return "ATOM_MEDIATOR_UPDATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APEX_INSTALLATION_STAGED:
-    return "ATOM_APEX_INSTALLATION_STAGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER:
+    return "ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APEX_INSTALLATION_ENDED:
-    return "ATOM_APEX_INSTALLATION_ENDED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSPROXY_CONNECTION_UPDATED:
+    return "ATOM_SYSPROXY_CONNECTION_UPDATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED:
-    return "ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_COMPANION_CONNECTION_STATE:
+    return "ATOM_WEAR_COMPANION_CONNECTION_STATE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED:
-    return "ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSPROXY_SERVICE_STATE_UPDATED:
+    return "ATOM_SYSPROXY_SERVICE_STATE_UPDATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED:
-    return "ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_UWB_ACTIVITY_INFO:
+    return "ATOM_UWB_ACTIVITY_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED:
-    return "ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TEST_UPROBESTATS_ATOM_REPORTED:
+    return "ATOM_TEST_UPROBESTATS_ATOM_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED:
-    return "ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TV_LOW_POWER_STANDBY_POLICY:
+    return "ATOM_TV_LOW_POWER_STANDBY_POLICY";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DATUM_REPORTED:
-    return "ATOM_ART_DATUM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXTERNAL_TV_INPUT_EVENT:
+    return "ATOM_EXTERNAL_TV_INPUT_EVENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DEVICE_DATUM_REPORTED:
-    return "ATOM_ART_DEVICE_DATUM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BOOT_INTEGRITY_INFO_REPORTED:
+    return "ATOM_BOOT_INTEGRITY_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DATUM_DELTA_REPORTED:
-    return "ATOM_ART_DATUM_DELTA_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED:
+    return "ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DEX2OAT_REPORTED:
-    return "ATOM_ART_DEX2OAT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED:
+    return "ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DEVICE_STATUS:
-    return "ATOM_ART_DEVICE_STATUS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THREADNETWORK_DEVICE_INFO_REPORTED:
+    return "ATOM_THREADNETWORK_DEVICE_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKGROUND_DEXOPT_JOB_ENDED:
-    return "ATOM_BACKGROUND_DEXOPT_JOB_ENDED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED:
+    return "ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PREREBOOT_DEXOPT_JOB_ENDED:
-    return "ATOM_PREREBOOT_DEXOPT_JOB_ENDED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EMERGENCY_NUMBERS_INFO:
+    return "ATOM_EMERGENCY_NUMBERS_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ODREFRESH_REPORTED:
-    return "ATOM_ODREFRESH_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DATA_NETWORK_VALIDATION:
+    return "ATOM_DATA_NETWORK_VALIDATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ODSIGN_REPORTED:
-    return "ATOM_ODSIGN_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DATA_RAT_STATE_CHANGED:
+    return "ATOM_DATA_RAT_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_UI_EVENT_REPORTED:
-    return "ATOM_AUTOFILL_UI_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CONNECTED_CHANNEL_CHANGED:
+    return "ATOM_CONNECTED_CHANNEL_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_FILL_REQUEST_REPORTED:
-    return "ATOM_AUTOFILL_FILL_REQUEST_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CELLULAR_IDENTIFIER_DISCLOSED:
+    return "ATOM_CELLULAR_IDENTIFIER_DISCLOSED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_FILL_RESPONSE_REPORTED:
-    return "ATOM_AUTOFILL_FILL_RESPONSE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_CONTROLLER:
+    return "ATOM_SATELLITE_CONTROLLER";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_SAVE_EVENT_REPORTED:
-    return "ATOM_AUTOFILL_SAVE_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_SESSION:
+    return "ATOM_SATELLITE_SESSION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_SESSION_COMMITTED:
-    return "ATOM_AUTOFILL_SESSION_COMMITTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_INCOMING_DATAGRAM:
+    return "ATOM_SATELLITE_INCOMING_DATAGRAM";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED:
-    return "ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_OUTGOING_DATAGRAM:
+    return "ATOM_SATELLITE_OUTGOING_DATAGRAM";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_RECENTS_EVENT_REPORTED:
-    return "ATOM_CAR_RECENTS_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_PROVISION:
+    return "ATOM_SATELLITE_PROVISION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_CALM_MODE_EVENT_REPORTED:
-    return "ATOM_CAR_CALM_MODE_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER:
+    return "ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED:
-    return "ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CARRIER_ROAMING_SATELLITE_SESSION:
+    return "ATOM_CARRIER_ROAMING_SATELLITE_SESSION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PLUGIN_INITIALIZED:
-    return "ATOM_PLUGIN_INITIALIZED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS:
+    return "ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED:
-    return "ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CONTROLLER_STATS_PER_PACKAGE:
+    return "ATOM_CONTROLLER_STATS_PER_PACKAGE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION:
-    return "ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_ENTITLEMENT:
+    return "ATOM_SATELLITE_ENTITLEMENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION:
-    return "ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_CONFIG_UPDATER:
+    return "ATOM_SATELLITE_CONFIG_UPDATER";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_LE_SESSION_CONNECTED:
-    return "ATOM_BLUETOOTH_LE_SESSION_CONNECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_ACCESS_CONTROLLER:
+    return "ATOM_SATELLITE_ACCESS_CONTROLLER";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED:
-    return "ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_QUALIFIED_RAT_LIST_CHANGED:
+    return "ATOM_QUALIFIED_RAT_LIST_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED:
-    return "ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_IMS_CALL_DROP_STATS:
+    return "ATOM_QNS_IMS_CALL_DROP_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED:
-    return "ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_FALLBACK_RESTRICTION_CHANGED:
+    return "ATOM_QNS_FALLBACK_RESTRICTION_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED:
-    return "ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO:
+    return "ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID:
-    return "ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_HANDOVER_TIME_MILLIS:
+    return "ATOM_QNS_HANDOVER_TIME_MILLIS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_APP_SCAN_STATE_CHANGED:
-    return "ATOM_LE_APP_SCAN_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_HANDOVER_PINGPONG:
+    return "ATOM_QNS_HANDOVER_PINGPONG";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_RADIO_SCAN_STOPPED:
-    return "ATOM_LE_RADIO_SCAN_STOPPED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED:
+    return "ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_SCAN_RESULT_RECEIVED:
-    return "ATOM_LE_SCAN_RESULT_RECEIVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EMERGENCY_NUMBER_DIALED:
+    return "ATOM_EMERGENCY_NUMBER_DIALED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_SCAN_ABUSED:
-    return "ATOM_LE_SCAN_ABUSED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CALL_STATS:
+    return "ATOM_CALL_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_ADV_STATE_CHANGED:
-    return "ATOM_LE_ADV_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CALL_AUDIO_ROUTE_STATS:
+    return "ATOM_CALL_AUDIO_ROUTE_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_ADV_ERROR_REPORTED:
-    return "ATOM_LE_ADV_ERROR_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TELECOM_API_STATS:
+    return "ATOM_TELECOM_API_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_A2DP_SESSION_REPORTED:
-    return "ATOM_A2DP_SESSION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TELECOM_ERROR_STATS:
+    return "ATOM_TELECOM_ERROR_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED:
-    return "ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LOCKSCREEN_SHORTCUT_SELECTED:
+    return "ATOM_LOCKSCREEN_SHORTCUT_SELECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BROADCAST_AUDIO_SESSION_REPORTED:
-    return "ATOM_BROADCAST_AUDIO_SESSION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED:
+    return "ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BROADCAST_AUDIO_SYNC_REPORTED:
-    return "ATOM_BROADCAST_AUDIO_SYNC_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LAUNCHER_IMPRESSION_EVENT_V2:
+    return "ATOM_LAUNCHER_IMPRESSION_EVENT_V2";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE:
-    return "ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DISPLAY_SWITCH_LATENCY_TRACKED:
+    return "ATOM_DISPLAY_SWITCH_LATENCY_TRACKED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_LE_CONNECTION:
-    return "ATOM_BLUETOOTH_LE_CONNECTION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NOTIFICATION_LISTENER_SERVICE:
+    return "ATOM_NOTIFICATION_LISTENER_SERVICE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BROADCAST_SENT:
-    return "ATOM_BROADCAST_SENT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NAV_HANDLE_TOUCH_POINTS:
+    return "ATOM_NAV_HANDLE_TOUCH_POINTS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT:
-    return "ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED:
+    return "ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED:
-    return "ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PERIPHERAL_TUTORIAL_LAUNCHED:
+    return "ATOM_PERIPHERAL_TUTORIAL_LAUNCHED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_FAILED:
-    return "ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_FAILED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CONTEXTUAL_EDUCATION_TRIGGERED:
+    return "ATOM_CONTEXTUAL_EDUCATION_TRIGGERED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DAILY_KEEPALIVE_INFO_REPORTED:
-    return "ATOM_DAILY_KEEPALIVE_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_COMMUNAL_HUB_SNAPSHOT:
+    return "ATOM_COMMUNAL_HUB_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NETWORK_REQUEST_STATE_CHANGED:
-    return "ATOM_NETWORK_REQUEST_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TEST_EXTENSION_ATOM_REPORTED:
+    return "ATOM_TEST_EXTENSION_ATOM_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED:
-    return "ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TEST_RESTRICTED_ATOM_REPORTED:
+    return "ATOM_TEST_RESTRICTED_ATOM_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED:
-    return "ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_STATS_SOCKET_LOSS_REPORTED:
+    return "ATOM_STATS_SOCKET_LOSS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED:
-    return "ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SETTINGS_SPA_REPORTED:
+    return "ATOM_SETTINGS_SPA_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APF_SESSION_INFO_REPORTED:
-    return "ATOM_APF_SESSION_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SELINUX_AUDIT_LOG:
+    return "ATOM_SELINUX_AUDIT_LOG";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_IP_CLIENT_RA_INFO_REPORTED:
-    return "ATOM_IP_CLIENT_RA_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SANDBOX_API_CALLED:
+    return "ATOM_SANDBOX_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_VPN_CONNECTION_STATE_CHANGED:
-    return "ATOM_VPN_CONNECTION_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED:
+    return "ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_VPN_CONNECTION_REPORTED:
-    return "ATOM_VPN_CONNECTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION:
+    return "ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CPU_POLICY:
-    return "ATOM_CPU_POLICY";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SANDBOX_SDK_STORAGE:
+    return "ATOM_SANDBOX_SDK_STORAGE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_API_CALLED:
-    return "ATOM_CREDENTIAL_MANAGER_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RKPD_POOL_STATS:
+    return "ATOM_RKPD_POOL_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RKPD_CLIENT_OPERATION:
+    return "ATOM_RKPD_CLIENT_OPERATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_SESSION_CONFIGURED:
+    return "ATOM_RANGING_SESSION_CONFIGURED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_SESSION_STARTED:
+    return "ATOM_RANGING_SESSION_STARTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_SESSION_CLOSED:
+    return "ATOM_RANGING_SESSION_CLOSED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_TECHNOLOGY_STARTED:
+    return "ATOM_RANGING_TECHNOLOGY_STARTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_GET_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_GET_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_TECHNOLOGY_STOPPED:
+    return "ATOM_RANGING_TECHNOLOGY_STOPPED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED:
-    return "ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED:
+    return "ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_APIV2_CALLED:
-    return "ATOM_CREDENTIAL_MANAGER_APIV2_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKUP_SETUP_STATUS_REPORTED:
+    return "ATOM_BACKUP_SETUP_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_ENGINE_CREATED:
-    return "ATOM_CRONET_ENGINE_CREATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_OFF_REPORTED:
+    return "ATOM_SCREEN_OFF_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_TRAFFIC_REPORTED:
-    return "ATOM_CRONET_TRAFFIC_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED:
+    return "ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_ENGINE_BUILDER_INITIALIZED:
-    return "ATOM_CRONET_ENGINE_BUILDER_INITIALIZED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED:
+    return "ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_HTTP_FLAGS_INITIALIZED:
-    return "ATOM_CRONET_HTTP_FLAGS_INITIALIZED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_DIM_REPORTED:
+    return "ATOM_SCREEN_DIM_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_INITIALIZED:
-    return "ATOM_CRONET_INITIALIZED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ATOM_9999:
+    return "ATOM_ATOM_9999";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DESKTOP_MODE_UI_CHANGED:
-    return "ATOM_DESKTOP_MODE_UI_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ATOM_99999:
+    return "ATOM_ATOM_99999";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE:
-    return "ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_SESSION_INFO_REPORTED:
+    return "ATOM_PHOTOPICKER_SESSION_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED:
-    return "ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_API_INFO_REPORTED:
+    return "ATOM_PHOTOPICKER_API_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED:
-    return "ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_UI_EVENT_LOGGED:
+    return "ATOM_PHOTOPICKER_UI_EVENT_LOGGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED:
-    return "ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED:
+    return "ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED:
-    return "ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED:
+    return "ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED:
-    return "ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED:
+    return "ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED:
-    return "ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED:
+    return "ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED:
-    return "ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED:
+    return "ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_POLICY_MANAGEMENT_MODE:
-    return "ATOM_DEVICE_POLICY_MANAGEMENT_MODE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_PAGE_INFO_LOGGED:
+    return "ATOM_PHOTOPICKER_PAGE_INFO_LOGGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_POLICY_STATE:
-    return "ATOM_DEVICE_POLICY_STATE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED:
+    return "ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED:
-    return "ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED:
+    return "ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXTERNAL_DISPLAY_STATE_CHANGED:
-    return "ATOM_EXTERNAL_DISPLAY_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED:
+    return "ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DND_STATE_CHANGED:
-    return "ATOM_DND_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED:
+    return "ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DREAM_SETTING_CHANGED:
-    return "ATOM_DREAM_SETTING_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED:
+    return "ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DREAM_SETTING_SNAPSHOT:
-    return "ATOM_DREAM_SETTING_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED:
+    return "ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_EVENT_REPORTED:
-    return "ATOM_EXPRESS_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED:
+    return "ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED:
-    return "ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION:
+    return "ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_UID_EVENT_REPORTED:
-    return "ATOM_EXPRESS_UID_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED:
+    return "ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED:
-    return "ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED:
+    return "ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_FEDERATED_COMPUTE_API_CALLED:
-    return "ATOM_FEDERATED_COMPUTE_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED:
+    return "ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED:
-    return "ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED:
+    return "ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED:
-    return "ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PRESSURE_STALL_INFORMATION:
+    return "ATOM_PRESSURE_STALL_INFORMATION";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PDF_LOAD_REPORTED:
+    return "ATOM_PDF_LOAD_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PDF_API_USAGE_REPORTED:
+    return "ATOM_PDF_API_USAGE_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PDF_SEARCH_REPORTED:
+    return "ATOM_PDF_SEARCH_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_COMPONENT_STATE_CHANGED_REPORTED:
+    return "ATOM_COMPONENT_STATE_CHANGED_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ONDEVICEPERSONALIZATION_API_CALLED:
+    return "ATOM_ONDEVICEPERSONALIZATION_API_CALLED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ONDEVICEPERSONALIZATION_TRACE_EVENT:
+    return "ATOM_ONDEVICEPERSONALIZATION_TRACE_EVENT";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_OBSERVE_MODE_STATE_CHANGED:
+    return "ATOM_NFC_OBSERVE_MODE_STATE_CHANGED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_FIELD_CHANGED:
+    return "ATOM_NFC_FIELD_CHANGED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED:
+    return "ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED:
+    return "ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_EXIT_FRAME_TABLE_CHANGED:
+    return "ATOM_NFC_EXIT_FRAME_TABLE_CHANGED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_AUTO_TRANSACT_REPORTED:
+    return "ATOM_NFC_AUTO_TRANSACT_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED:
+    return "ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MTE_STATE:
+    return "ATOM_MTE_STATE";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ZRAM_MAINTENANCE_EXECUTED:
+    return "ATOM_ZRAM_MAINTENANCE_EXECUTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ZRAM_SETUP_EXECUTED:
+    return "ATOM_ZRAM_SETUP_EXECUTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ZRAM_MM_STAT_MMD:
+    return "ATOM_ZRAM_MM_STAT_MMD";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ZRAM_BD_STAT_MMD:
+    return "ATOM_ZRAM_BD_STAT_MMD";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_EDITING_ENDED_REPORTED:
+    return "ATOM_MEDIA_EDITING_ENDED_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED:
+    return "ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_STARTED:
+    return "ATOM_MEDIA_CODEC_STARTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_STOPPED:
+    return "ATOM_MEDIA_CODEC_STOPPED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_RENDERED:
+    return "ATOM_MEDIA_CODEC_RENDERED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EMERGENCY_STATE_CHANGED:
+    return "ATOM_EMERGENCY_STATE_CHANGED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED:
+    return "ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED:
+    return "ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED:
+    return "ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED:
+    return "ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_KERNEL_OOM_KILL_OCCURRED:
+    return "ATOM_KERNEL_OOM_KILL_OCCURRED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_KEYBOARD_CONFIGURED:
+    return "ATOM_KEYBOARD_CONFIGURED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED:
+    return "ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_INPUTDEVICE_USAGE_REPORTED:
+    return "ATOM_INPUTDEVICE_USAGE_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_INPUT_EVENT_LATENCY_REPORTED:
+    return "ATOM_INPUT_EVENT_LATENCY_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TOUCHPAD_USAGE:
+    return "ATOM_TOUCHPAD_USAGE";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_IKE_SESSION_TERMINATED:
+    return "ATOM_IKE_SESSION_TERMINATED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED:
+    return "ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NEGOTIATED_SECURITY_ASSOCIATION:
+    return "ATOM_NEGOTIATED_SECURITY_ASSOCIATION";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED:
+    return "ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_UI_IMPRESSION:
+    return "ATOM_HEALTH_CONNECT_UI_IMPRESSION";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_UI_INTERACTION:
+    return "ATOM_HEALTH_CONNECT_UI_INTERACTION";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED:
+    return "ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_API_CALLED:
+    return "ATOM_HEALTH_CONNECT_API_CALLED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_USAGE_STATS:
+    return "ATOM_HEALTH_CONNECT_USAGE_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_STORAGE_STATS:
+    return "ATOM_HEALTH_CONNECT_STORAGE_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_API_INVOKED:
+    return "ATOM_HEALTH_CONNECT_API_INVOKED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXERCISE_ROUTE_API_CALLED:
+    return "ATOM_EXERCISE_ROUTE_API_CALLED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_EXPORT_INVOKED:
+    return "ATOM_HEALTH_CONNECT_EXPORT_INVOKED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_IMPORT_INVOKED:
+    return "ATOM_HEALTH_CONNECT_IMPORT_INVOKED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED:
+    return "ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_PERMISSION_STATS:
+    return "ATOM_HEALTH_CONNECT_PERMISSION_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_PHR_API_INVOKED:
+    return "ATOM_HEALTH_CONNECT_PHR_API_INVOKED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_PHR_USAGE_STATS:
+    return "ATOM_HEALTH_CONNECT_PHR_USAGE_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_PHR_STORAGE_STATS:
+    return "ATOM_HEALTH_CONNECT_PHR_STORAGE_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_RESTRICTED_ECOSYSTEM_STATS:
+    return "ATOM_HEALTH_CONNECT_RESTRICTED_ECOSYSTEM_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_ECOSYSTEM_STATS:
+    return "ATOM_HEALTH_CONNECT_ECOSYSTEM_STATS";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HDMI_EARC_STATUS_REPORTED:
+    return "ATOM_HDMI_EARC_STATUS_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED:
+    return "ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HDMI_POWER_STATE_CHANGE_ON_ACTIVE_SOURCE_LOST_TOGGLED:
+    return "ATOM_HDMI_POWER_STATE_CHANGE_ON_ACTIVE_SOURCE_LOST_TOGGLED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BATTERY_HEALTH:
+    return "ATOM_BATTERY_HEALTH";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BIOMETRIC_UNENROLLED:
+    return "ATOM_BIOMETRIC_UNENROLLED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BIOMETRIC_ENUMERATED:
+    return "ATOM_BIOMETRIC_ENUMERATED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED:
+    return "ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED";
+
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED:
+    return "ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED";
 
   case ::perfetto::protos::pbzero::AtomId::ATOM_FULL_SCREEN_INTENT_LAUNCHED:
     return "ATOM_FULL_SCREEN_INTENT_LAUNCHED";
@@ -60091,656 +60272,629 @@ const char* AtomId_Name(::perfetto::protos::pbzero::AtomId value) {
   case ::perfetto::protos::pbzero::AtomId::ATOM_CONTENT_OR_FILE_URI_EVENT_REPORTED:
     return "ATOM_CONTENT_OR_FILE_URI_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED:
-    return "ATOM_APPLICATION_GRAMMATICAL_INFLECTION_CHANGED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED:
-    return "ATOM_SYSTEM_GRAMMATICAL_INFLECTION_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_IDLE_TEMP_ALLOWLIST_UPDATED:
+    return "ATOM_DEVICE_IDLE_TEMP_ALLOWLIST_UPDATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BATTERY_HEALTH:
-    return "ATOM_BATTERY_HEALTH";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_OP_NOTE_OP_OR_CHECK_OP_BINDER_API_CALLED:
+    return "ATOM_APP_OP_NOTE_OP_OR_CHECK_OP_BINDER_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HDMI_EARC_STATUS_REPORTED:
-    return "ATOM_HDMI_EARC_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_FRAMEWORK_WAKELOCK_INFO:
+    return "ATOM_FRAMEWORK_WAKELOCK_INFO";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED:
-    return "ATOM_HDMI_SOUNDBAR_MODE_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_JANK_FRAME_COUNT_BY_WIDGET_REPORTED:
+    return "ATOM_JANK_FRAME_COUNT_BY_WIDGET_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_API_CALLED:
-    return "ATOM_HEALTH_CONNECT_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_INTENT_CREATOR_TOKEN_ADDED:
+    return "ATOM_INTENT_CREATOR_TOKEN_ADDED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_USAGE_STATS:
-    return "ATOM_HEALTH_CONNECT_USAGE_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NOTIFICATION_CHANNEL_CLASSIFICATION:
+    return "ATOM_NOTIFICATION_CHANNEL_CLASSIFICATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_STORAGE_STATS:
-    return "ATOM_HEALTH_CONNECT_STORAGE_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAMERA_STATUS_FOR_COMPATIBILITY_CHANGED:
+    return "ATOM_CAMERA_STATUS_FOR_COMPATIBILITY_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_API_INVOKED:
-    return "ATOM_HEALTH_CONNECT_API_INVOKED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_FEDERATED_COMPUTE_API_CALLED:
+    return "ATOM_FEDERATED_COMPUTE_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXERCISE_ROUTE_API_CALLED:
-    return "ATOM_EXERCISE_ROUTE_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED:
+    return "ATOM_FEDERATED_COMPUTE_TRAINING_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_EXPORT_INVOKED:
-    return "ATOM_HEALTH_CONNECT_EXPORT_INVOKED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED:
+    return "ATOM_EXAMPLE_ITERATOR_NEXT_LATENCY_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_IMPORT_INVOKED:
-    return "ATOM_HEALTH_CONNECT_IMPORT_INVOKED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_FEDERATED_COMPUTE_TRACE_EVENT_REPORTED:
+    return "ATOM_FEDERATED_COMPUTE_TRACE_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED:
-    return "ATOM_HEALTH_CONNECT_EXPORT_IMPORT_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_EVENT_REPORTED:
+    return "ATOM_EXPRESS_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_UI_IMPRESSION:
-    return "ATOM_HEALTH_CONNECT_UI_IMPRESSION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED:
+    return "ATOM_EXPRESS_HISTOGRAM_SAMPLE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_UI_INTERACTION:
-    return "ATOM_HEALTH_CONNECT_UI_INTERACTION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_UID_EVENT_REPORTED:
+    return "ATOM_EXPRESS_UID_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED:
-    return "ATOM_HEALTH_CONNECT_APP_OPENED_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED:
+    return "ATOM_EXPRESS_UID_HISTOGRAM_SAMPLE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED:
-    return "ATOM_HOTWORD_EGRESS_SIZE_ATOM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DREAM_SETTING_CHANGED:
+    return "ATOM_DREAM_SETTING_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_IKE_SESSION_TERMINATED:
-    return "ATOM_IKE_SESSION_TERMINATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DREAM_SETTING_SNAPSHOT:
+    return "ATOM_DREAM_SETTING_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED:
-    return "ATOM_IKE_LIVENESS_CHECK_SESSION_VALIDATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DND_STATE_CHANGED:
+    return "ATOM_DND_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NEGOTIATED_SECURITY_ASSOCIATION:
-    return "ATOM_NEGOTIATED_SECURITY_ASSOCIATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_EXTERNAL_DISPLAY_STATE_CHANGED:
+    return "ATOM_EXTERNAL_DISPLAY_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_KEYBOARD_CONFIGURED:
-    return "ATOM_KEYBOARD_CONFIGURED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED:
+    return "ATOM_DISPLAY_MODE_DIRECTOR_VOTE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED:
-    return "ATOM_KEYBOARD_SYSTEMS_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_POLICY_MANAGEMENT_MODE:
+    return "ATOM_DEVICE_POLICY_MANAGEMENT_MODE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_INPUTDEVICE_USAGE_REPORTED:
-    return "ATOM_INPUTDEVICE_USAGE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_POLICY_STATE:
+    return "ATOM_DEVICE_POLICY_STATE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_INPUT_EVENT_LATENCY_REPORTED:
-    return "ATOM_INPUT_EVENT_LATENCY_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED:
+    return "ATOM_DEVICE_LOCK_CHECK_IN_REQUEST_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TOUCHPAD_USAGE:
-    return "ATOM_TOUCHPAD_USAGE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED:
+    return "ATOM_DEVICE_LOCK_PROVISIONING_COMPLETE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_KERNEL_OOM_KILL_OCCURRED:
-    return "ATOM_KERNEL_OOM_KILL_OCCURRED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED:
+    return "ATOM_DEVICE_LOCK_KIOSK_APP_REQUEST_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EMERGENCY_STATE_CHANGED:
-    return "ATOM_EMERGENCY_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED:
+    return "ATOM_DEVICE_LOCK_CHECK_IN_RETRY_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED:
-    return "ATOM_CHRE_SIGNIFICANT_MOTION_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED:
+    return "ATOM_DEVICE_LOCK_PROVISION_FAILURE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED:
-    return "ATOM_POPULATION_DENSITY_PROVIDER_LOADING_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED:
+    return "ATOM_DEVICE_LOCK_LOCK_UNLOCK_DEVICE_FAILURE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED:
-    return "ATOM_DENSITY_BASED_COARSE_LOCATIONS_USAGE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DESKTOP_MODE_UI_CHANGED:
+    return "ATOM_DESKTOP_MODE_UI_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED:
-    return "ATOM_DENSITY_BASED_COARSE_LOCATIONS_PROVIDER_QUERY_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE:
+    return "ATOM_DESKTOP_MODE_SESSION_TASK_UPDATE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED:
-    return "ATOM_MEDIA_CODEC_RECLAIM_REQUEST_COMPLETED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED:
+    return "ATOM_DESKTOP_MODE_TASK_SIZE_UPDATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_STARTED:
-    return "ATOM_MEDIA_CODEC_STARTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_ENGINE_CREATED:
+    return "ATOM_CRONET_ENGINE_CREATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_STOPPED:
-    return "ATOM_MEDIA_CODEC_STOPPED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_TRAFFIC_REPORTED:
+    return "ATOM_CRONET_TRAFFIC_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CODEC_RENDERED:
-    return "ATOM_MEDIA_CODEC_RENDERED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_ENGINE_BUILDER_INITIALIZED:
+    return "ATOM_CRONET_ENGINE_BUILDER_INITIALIZED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_EDITING_ENDED_REPORTED:
-    return "ATOM_MEDIA_EDITING_ENDED_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_HTTP_FLAGS_INITIALIZED:
+    return "ATOM_CRONET_HTTP_FLAGS_INITIALIZED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MTE_STATE:
-    return "ATOM_MTE_STATE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CRONET_INITIALIZED:
+    return "ATOM_CRONET_INITIALIZED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED:
-    return "ATOM_MICROXR_DEVICE_BOOT_COMPLETE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_API_CALLED:
+    return "ATOM_CREDENTIAL_MANAGER_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_OBSERVE_MODE_STATE_CHANGED:
-    return "ATOM_NFC_OBSERVE_MODE_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_INIT_PHASE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_FIELD_CHANGED:
-    return "ATOM_NFC_FIELD_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_CANDIDATE_PHASE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED:
-    return "ATOM_NFC_POLLING_LOOP_NOTIFICATION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_FINAL_PHASE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED:
-    return "ATOM_NFC_PROPRIETARY_CAPABILITIES_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_TOTAL_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ONDEVICEPERSONALIZATION_API_CALLED:
-    return "ATOM_ONDEVICEPERSONALIZATION_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_FINALNOUID_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_COMPONENT_STATE_CHANGED_REPORTED:
-    return "ATOM_COMPONENT_STATE_CHANGED_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_GET_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_GET_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PDF_LOAD_REPORTED:
-    return "ATOM_PDF_LOAD_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED:
+    return "ATOM_CREDENTIAL_MANAGER_AUTH_CLICK_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PDF_API_USAGE_REPORTED:
-    return "ATOM_PDF_API_USAGE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CREDENTIAL_MANAGER_APIV2_CALLED:
+    return "ATOM_CREDENTIAL_MANAGER_APIV2_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PDF_SEARCH_REPORTED:
-    return "ATOM_PDF_SEARCH_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CPU_POLICY:
+    return "ATOM_CPU_POLICY";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PRESSURE_STALL_INFORMATION:
-    return "ATOM_PRESSURE_STALL_INFORMATION";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED:
-    return "ATOM_PERMISSION_RATIONALE_DIALOG_VIEWED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED:
-    return "ATOM_PERMISSION_RATIONALE_DIALOG_ACTION_REPORTED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION:
-    return "ATOM_APP_DATA_SHARING_UPDATES_NOTIFICATION_INTERACTION";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED:
-    return "ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_VIEWED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED:
-    return "ATOM_APP_DATA_SHARING_UPDATES_FRAGMENT_ACTION_REPORTED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED:
-    return "ATOM_ENHANCED_CONFIRMATION_DIALOG_RESULT_REPORTED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED:
-    return "ATOM_ENHANCED_CONFIRMATION_RESTRICTION_CLEARED";
-
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_SESSION_INFO_REPORTED:
-    return "ATOM_PHOTOPICKER_SESSION_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_VPN_CONNECTION_STATE_CHANGED:
+    return "ATOM_VPN_CONNECTION_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_API_INFO_REPORTED:
-    return "ATOM_PHOTOPICKER_API_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_VPN_CONNECTION_REPORTED:
+    return "ATOM_VPN_CONNECTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_UI_EVENT_LOGGED:
-    return "ATOM_PHOTOPICKER_UI_EVENT_LOGGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_IP_CLIENT_RA_INFO_REPORTED:
+    return "ATOM_IP_CLIENT_RA_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED:
-    return "ATOM_PHOTOPICKER_MEDIA_ITEM_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APF_SESSION_INFO_REPORTED:
+    return "ATOM_APF_SESSION_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED:
-    return "ATOM_PHOTOPICKER_PREVIEW_INFO_LOGGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED:
+    return "ATOM_CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED:
-    return "ATOM_PHOTOPICKER_MENU_INTERACTION_LOGGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED:
+    return "ATOM_NETWORK_STATS_RECORDER_FILE_OPERATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED:
-    return "ATOM_PHOTOPICKER_BANNER_INTERACTION_LOGGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DAILY_KEEPALIVE_INFO_REPORTED:
+    return "ATOM_DAILY_KEEPALIVE_INFO_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED:
-    return "ATOM_PHOTOPICKER_MEDIA_LIBRARY_INFO_LOGGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_NETWORK_REQUEST_STATE_CHANGED:
+    return "ATOM_NETWORK_REQUEST_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_PAGE_INFO_LOGGED:
-    return "ATOM_PHOTOPICKER_PAGE_INFO_LOGGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED:
+    return "ATOM_TETHERING_ACTIVE_SESSIONS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED:
-    return "ATOM_PHOTOPICKER_MEDIA_GRID_SYNC_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED:
+    return "ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED:
-    return "ATOM_PHOTOPICKER_ALBUM_SYNC_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HARDWARE_RENDERER_EVENT:
+    return "ATOM_HARDWARE_RENDERER_EVENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED:
-    return "ATOM_PHOTOPICKER_SEARCH_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TEXTURE_VIEW_EVENT:
+    return "ATOM_TEXTURE_VIEW_EVENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED:
-    return "ATOM_SEARCH_DATA_EXTRACTION_DETAILS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SURFACE_CONTROL_EVENT:
+    return "ATOM_SURFACE_CONTROL_EVENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED:
-    return "ATOM_EMBEDDED_PHOTOPICKER_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_IMAGE_DECODED:
+    return "ATOM_IMAGE_DECODED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ATOM_9999:
-    return "ATOM_ATOM_9999";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED:
+    return "ATOM_CERTIFICATE_TRANSPARENCY_LOG_LIST_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_ATOM_99999:
-    return "ATOM_ATOM_99999";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CONSCRYPT_SERVICE_USED:
+    return "ATOM_CONSCRYPT_SERVICE_USED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_OFF_REPORTED:
-    return "ATOM_SCREEN_OFF_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CERTIFICATE_TRANSPARENCY_VERIFICATION_REPORTED:
+    return "ATOM_CERTIFICATE_TRANSPARENCY_VERIFICATION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED:
-    return "ATOM_SCREEN_TIMEOUT_OVERRIDE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT:
+    return "ATOM_CAMERA_FEATURE_COMBINATION_QUERY_EVENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED:
-    return "ATOM_SCREEN_INTERACTIVE_SESSION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BROADCAST_SENT:
+    return "ATOM_BROADCAST_SENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SCREEN_DIM_REPORTED:
-    return "ATOM_SCREEN_DIM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED:
+    return "ATOM_BLUETOOTH_HASHED_DEVICE_NAME_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED:
-    return "ATOM_MEDIA_PROVIDER_DATABASE_ROLLBACK_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION:
+    return "ATOM_BLUETOOTH_L2CAP_COC_CLIENT_CONNECTION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKUP_SETUP_STATUS_REPORTED:
-    return "ATOM_BACKUP_SETUP_STATUS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION:
+    return "ATOM_BLUETOOTH_L2CAP_COC_SERVER_CONNECTION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_SESSION_CONFIGURED:
-    return "ATOM_RANGING_SESSION_CONFIGURED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_LE_SESSION_CONNECTED:
+    return "ATOM_BLUETOOTH_LE_SESSION_CONNECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_SESSION_STARTED:
-    return "ATOM_RANGING_SESSION_STARTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED:
+    return "ATOM_RESTRICTED_BLUETOOTH_DEVICE_NAME_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_SESSION_CLOSED:
-    return "ATOM_RANGING_SESSION_CLOSED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED:
+    return "ATOM_BLUETOOTH_PROFILE_CONNECTION_ATTEMPTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_TECHNOLOGY_STARTED:
-    return "ATOM_RANGING_TECHNOLOGY_STARTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED:
+    return "ATOM_BLUETOOTH_CONTENT_PROFILE_ERROR_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RANGING_TECHNOLOGY_STOPPED:
-    return "ATOM_RANGING_TECHNOLOGY_STOPPED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED:
+    return "ATOM_BLUETOOTH_RFCOMM_CONNECTION_ATTEMPTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RKPD_POOL_STATS:
-    return "ATOM_RKPD_POOL_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID:
+    return "ATOM_REMOTE_DEVICE_INFORMATION_WITH_METRIC_ID";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RKPD_CLIENT_OPERATION:
-    return "ATOM_RKPD_CLIENT_OPERATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_APP_SCAN_STATE_CHANGED:
+    return "ATOM_LE_APP_SCAN_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SANDBOX_API_CALLED:
-    return "ATOM_SANDBOX_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_RADIO_SCAN_STOPPED:
+    return "ATOM_LE_RADIO_SCAN_STOPPED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED:
-    return "ATOM_SANDBOX_ACTIVITY_EVENT_OCCURRED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_SCAN_RESULT_RECEIVED:
+    return "ATOM_LE_SCAN_RESULT_RECEIVED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION:
-    return "ATOM_SDK_SANDBOX_RESTRICTED_ACCESS_IN_SESSION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_SCAN_ABUSED:
+    return "ATOM_LE_SCAN_ABUSED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SANDBOX_SDK_STORAGE:
-    return "ATOM_SANDBOX_SDK_STORAGE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_ADV_STATE_CHANGED:
+    return "ATOM_LE_ADV_STATE_CHANGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SELINUX_AUDIT_LOG:
-    return "ATOM_SELINUX_AUDIT_LOG";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_LE_ADV_ERROR_REPORTED:
+    return "ATOM_LE_ADV_ERROR_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SETTINGS_SPA_REPORTED:
-    return "ATOM_SETTINGS_SPA_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_A2DP_SESSION_REPORTED:
+    return "ATOM_A2DP_SESSION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TEST_EXTENSION_ATOM_REPORTED:
-    return "ATOM_TEST_EXTENSION_ATOM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED:
+    return "ATOM_BLUETOOTH_CROSS_LAYER_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TEST_RESTRICTED_ATOM_REPORTED:
-    return "ATOM_TEST_RESTRICTED_ATOM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BROADCAST_AUDIO_SESSION_REPORTED:
+    return "ATOM_BROADCAST_AUDIO_SESSION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_STATS_SOCKET_LOSS_REPORTED:
-    return "ATOM_STATS_SOCKET_LOSS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BROADCAST_AUDIO_SYNC_REPORTED:
+    return "ATOM_BROADCAST_AUDIO_SYNC_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LOCKSCREEN_SHORTCUT_SELECTED:
-    return "ATOM_LOCKSCREEN_SHORTCUT_SELECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE:
+    return "ATOM_BLUETOOTH_RFCOMM_CONNECTION_REPORTED_AT_CLOSE";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED:
-    return "ATOM_LOCKSCREEN_SHORTCUT_TRIGGERED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BLUETOOTH_LE_CONNECTION:
+    return "ATOM_BLUETOOTH_LE_CONNECTION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LAUNCHER_IMPRESSION_EVENT_V2:
-    return "ATOM_LAUNCHER_IMPRESSION_EVENT_V2";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_HEARING_DEVICE_ACTIVE_EVENT_REPORTED:
+    return "ATOM_HEARING_DEVICE_ACTIVE_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DISPLAY_SWITCH_LATENCY_TRACKED:
-    return "ATOM_DISPLAY_SWITCH_LATENCY_TRACKED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKPORTED_FIX_STATUS_REPORTED:
+    return "ATOM_BACKPORTED_FIX_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NOTIFICATION_LISTENER_SERVICE:
-    return "ATOM_NOTIFICATION_LISTENER_SERVICE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PLUGIN_INITIALIZED:
+    return "ATOM_PLUGIN_INITIALIZED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_NAV_HANDLE_TOUCH_POINTS:
-    return "ATOM_NAV_HANDLE_TOUCH_POINTS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_SYSTEM_UI_DATA_SUBSCRIPTION_EVENT_REPORTED:
+    return "ATOM_CAR_SYSTEM_UI_DATA_SUBSCRIPTION_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED:
-    return "ATOM_COMMUNAL_HUB_WIDGET_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_SETTINGS_DATA_SUBSCRIPTION_EVENT_REPORTED:
+    return "ATOM_CAR_SETTINGS_DATA_SUBSCRIPTION_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_COMMUNAL_HUB_SNAPSHOT:
-    return "ATOM_COMMUNAL_HUB_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_QC_LIB_EVENT_REPORTED:
+    return "ATOM_CAR_QC_LIB_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EMERGENCY_NUMBER_DIALED:
-    return "ATOM_EMERGENCY_NUMBER_DIALED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED:
+    return "ATOM_CAR_WAKEUP_FROM_SUSPEND_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CALL_STATS:
-    return "ATOM_CALL_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_RECENTS_EVENT_REPORTED:
+    return "ATOM_CAR_RECENTS_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CALL_AUDIO_ROUTE_STATS:
-    return "ATOM_CALL_AUDIO_ROUTE_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_CAR_CALM_MODE_EVENT_REPORTED:
+    return "ATOM_CAR_CALM_MODE_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TELECOM_API_STATS:
-    return "ATOM_TELECOM_API_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_UI_EVENT_REPORTED:
+    return "ATOM_AUTOFILL_UI_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TELECOM_ERROR_STATS:
-    return "ATOM_TELECOM_ERROR_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_FILL_REQUEST_REPORTED:
+    return "ATOM_AUTOFILL_FILL_REQUEST_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED:
-    return "ATOM_CELLULAR_RADIO_POWER_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_FILL_RESPONSE_REPORTED:
+    return "ATOM_AUTOFILL_FILL_RESPONSE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EMERGENCY_NUMBERS_INFO:
-    return "ATOM_EMERGENCY_NUMBERS_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_SAVE_EVENT_REPORTED:
+    return "ATOM_AUTOFILL_SAVE_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DATA_NETWORK_VALIDATION:
-    return "ATOM_DATA_NETWORK_VALIDATION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_SESSION_COMMITTED:
+    return "ATOM_AUTOFILL_SESSION_COMMITTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DATA_RAT_STATE_CHANGED:
-    return "ATOM_DATA_RAT_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED:
+    return "ATOM_AUTOFILL_FIELD_CLASSIFICATION_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CONNECTED_CHANNEL_CHANGED:
-    return "ATOM_CONNECTED_CHANNEL_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ODREFRESH_REPORTED:
+    return "ATOM_ODREFRESH_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED:
-    return "ATOM_IWLAN_UNDERLYING_NETWORK_VALIDATION_RESULT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ODSIGN_REPORTED:
+    return "ATOM_ODSIGN_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_QUALIFIED_RAT_LIST_CHANGED:
-    return "ATOM_QUALIFIED_RAT_LIST_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKGROUND_DEXOPT_JOB_ENDED:
+    return "ATOM_BACKGROUND_DEXOPT_JOB_ENDED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_IMS_CALL_DROP_STATS:
-    return "ATOM_QNS_IMS_CALL_DROP_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PREREBOOT_DEXOPT_JOB_ENDED:
+    return "ATOM_PREREBOOT_DEXOPT_JOB_ENDED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_FALLBACK_RESTRICTION_CHANGED:
-    return "ATOM_QNS_FALLBACK_RESTRICTION_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DATUM_REPORTED:
+    return "ATOM_ART_DATUM_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO:
-    return "ATOM_QNS_RAT_PREFERENCE_MISMATCH_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DEVICE_DATUM_REPORTED:
+    return "ATOM_ART_DEVICE_DATUM_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_HANDOVER_TIME_MILLIS:
-    return "ATOM_QNS_HANDOVER_TIME_MILLIS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DATUM_DELTA_REPORTED:
+    return "ATOM_ART_DATUM_DELTA_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_QNS_HANDOVER_PINGPONG:
-    return "ATOM_QNS_HANDOVER_PINGPONG";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DEX2OAT_REPORTED:
+    return "ATOM_ART_DEX2OAT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_CONTROLLER:
-    return "ATOM_SATELLITE_CONTROLLER";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ART_DEVICE_STATUS:
+    return "ATOM_ART_DEVICE_STATUS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_SESSION:
-    return "ATOM_SATELLITE_SESSION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED:
+    return "ATOM_APP_SEARCH_SET_SCHEMA_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_INCOMING_DATAGRAM:
-    return "ATOM_SATELLITE_INCOMING_DATAGRAM";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED:
+    return "ATOM_APP_SEARCH_SCHEMA_MIGRATION_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_OUTGOING_DATAGRAM:
-    return "ATOM_SATELLITE_OUTGOING_DATAGRAM";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED:
+    return "ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_PROVISION:
-    return "ATOM_SATELLITE_PROVISION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED:
+    return "ATOM_APP_SEARCH_USAGE_SEARCH_INTENT_RAW_QUERY_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER:
-    return "ATOM_SATELLITE_SOS_MESSAGE_RECOMMENDER";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED:
+    return "ATOM_APP_SEARCH_APPS_INDEXER_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CARRIER_ROAMING_SATELLITE_SESSION:
-    return "ATOM_CARRIER_ROAMING_SATELLITE_SESSION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_FUNCTIONS_REQUEST_REPORTED:
+    return "ATOM_APP_FUNCTIONS_REQUEST_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS:
-    return "ATOM_CARRIER_ROAMING_SATELLITE_CONTROLLER_STATS";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APEX_INSTALLATION_REQUESTED:
+    return "ATOM_APEX_INSTALLATION_REQUESTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CONTROLLER_STATS_PER_PACKAGE:
-    return "ATOM_CONTROLLER_STATS_PER_PACKAGE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APEX_INSTALLATION_STAGED:
+    return "ATOM_APEX_INSTALLATION_STAGED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_ENTITLEMENT:
-    return "ATOM_SATELLITE_ENTITLEMENT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APEX_INSTALLATION_ENDED:
+    return "ATOM_APEX_INSTALLATION_ENDED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_CONFIG_UPDATER:
-    return "ATOM_SATELLITE_CONFIG_UPDATER";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_BUTTON_PRESSED:
+    return "ATOM_AI_WALLPAPERS_BUTTON_PRESSED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SATELLITE_ACCESS_CONTROLLER:
-    return "ATOM_SATELLITE_ACCESS_CONTROLLER";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED:
+    return "ATOM_AI_WALLPAPERS_TEMPLATE_SELECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_CELLULAR_IDENTIFIER_DISCLOSED:
-    return "ATOM_CELLULAR_IDENTIFIER_DISCLOSED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_TERM_SELECTED:
+    return "ATOM_AI_WALLPAPERS_TERM_SELECTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED:
-    return "ATOM_THREADNETWORK_TELEMETRY_DATA_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_WALLPAPER_SET:
+    return "ATOM_AI_WALLPAPERS_WALLPAPER_SET";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED:
-    return "ATOM_THREADNETWORK_TOPO_ENTRY_REPEATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AI_WALLPAPERS_SESSION_SUMMARY:
+    return "ATOM_AI_WALLPAPERS_SESSION_SUMMARY";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_THREADNETWORK_DEVICE_INFO_REPORTED:
-    return "ATOM_THREADNETWORK_DEVICE_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_JSSCRIPTENGINE_LATENCY_REPORTED:
+    return "ATOM_JSSCRIPTENGINE_LATENCY_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_BOOT_INTEGRITY_INFO_REPORTED:
-    return "ATOM_BOOT_INTEGRITY_INFO_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_API_CALLED:
+    return "ATOM_AD_SERVICES_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TV_LOW_POWER_STANDBY_POLICY:
-    return "ATOM_TV_LOW_POWER_STANDBY_POLICY";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MESUREMENT_REPORTS_UPLOADED:
+    return "ATOM_AD_SERVICES_MESUREMENT_REPORTS_UPLOADED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_EXTERNAL_TV_INPUT_EVENT:
-    return "ATOM_EXTERNAL_TV_INPUT_EVENT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STATUS_REPORTED:
+    return "ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TEST_UPROBESTATS_ATOM_REPORTED:
-    return "ATOM_TEST_UPROBESTATS_ATOM_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MOBILE_DATA_DOWNLOAD_DOWNLOAD_RESULT_REPORTED:
+    return "ATOM_MOBILE_DATA_DOWNLOAD_DOWNLOAD_RESULT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_UWB_ACTIVITY_INFO:
-    return "ATOM_UWB_ACTIVITY_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_SETTINGS_USAGE_REPORTED:
+    return "ATOM_AD_SERVICES_SETTINGS_USAGE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIATOR_UPDATED:
-    return "ATOM_MEDIATOR_UPDATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKGROUND_FETCH_PROCESS_REPORTED:
+    return "ATOM_BACKGROUND_FETCH_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER:
-    return "ATOM_SYSPROXY_BLUETOOTH_BYTES_TRANSFER";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_UPDATE_CUSTOM_AUDIENCE_PROCESS_REPORTED:
+    return "ATOM_UPDATE_CUSTOM_AUDIENCE_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SYSPROXY_CONNECTION_UPDATED:
-    return "ATOM_SYSPROXY_CONNECTION_UPDATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_BIDDING_PROCESS_REPORTED:
+    return "ATOM_RUN_AD_BIDDING_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_COMPANION_CONNECTION_STATE:
-    return "ATOM_WEAR_COMPANION_CONNECTION_STATE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_SCORING_PROCESS_REPORTED:
+    return "ATOM_RUN_AD_SCORING_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_ACTION_REPORTED:
-    return "ATOM_MEDIA_ACTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_SELECTION_PROCESS_REPORTED:
+    return "ATOM_RUN_AD_SELECTION_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_CONTROLS_LAUNCHED:
-    return "ATOM_MEDIA_CONTROLS_LAUNCHED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_RUN_AD_BIDDING_PER_CA_PROCESS_REPORTED:
+    return "ATOM_RUN_AD_BIDDING_PER_CA_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MEDIA_SESSION_STATE_CHANGED:
-    return "ATOM_MEDIA_SESSION_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STORAGE_STATS_REPORTED:
+    return "ATOM_MOBILE_DATA_DOWNLOAD_FILE_GROUP_STORAGE_STATS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY:
-    return "ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_DEVICE_SCAN_API_LATENCY";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_REGISTRATIONS:
+    return "ATOM_AD_SERVICES_MEASUREMENT_REGISTRATIONS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE:
-    return "ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_SASS_DEVICE_UNAVAILABLE";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_GET_TOPICS_REPORTED:
+    return "ATOM_AD_SERVICES_GET_TOPICS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT:
-    return "ATOM_WEAR_MEDIA_OUTPUT_SWITCHER_FASTPAIR_API_TIMEOUT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_EPOCH_COMPUTATION_GET_TOP_TOPICS_REPORTED:
+    return "ATOM_AD_SERVICES_EPOCH_COMPUTATION_GET_TOP_TOPICS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_MODE_STATE_CHANGED:
-    return "ATOM_WEAR_MODE_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_EPOCH_COMPUTATION_CLASSIFIER_REPORTED:
+    return "ATOM_AD_SERVICES_EPOCH_COMPUTATION_CLASSIFIER_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_RENDERER_INITIALIZED:
-    return "ATOM_RENDERER_INITIALIZED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_BACK_COMPAT_GET_TOPICS_REPORTED:
+    return "ATOM_AD_SERVICES_BACK_COMPAT_GET_TOPICS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SCHEMA_VERSION_RECEIVED:
-    return "ATOM_SCHEMA_VERSION_RECEIVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_BACK_COMPAT_EPOCH_COMPUTATION_CLASSIFIER_REPORTED:
+    return "ATOM_AD_SERVICES_BACK_COMPAT_EPOCH_COMPUTATION_CLASSIFIER_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LAYOUT_INSPECTED:
-    return "ATOM_LAYOUT_INSPECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_DEBUG_KEYS:
+    return "ATOM_AD_SERVICES_MEASUREMENT_DEBUG_KEYS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LAYOUT_EXPRESSION_INSPECTED:
-    return "ATOM_LAYOUT_EXPRESSION_INSPECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ERROR_REPORTED:
+    return "ATOM_AD_SERVICES_ERROR_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_LAYOUT_ANIMATIONS_INSPECTED:
-    return "ATOM_LAYOUT_ANIMATIONS_INSPECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_BACKGROUND_JOBS_EXECUTION_REPORTED:
+    return "ATOM_AD_SERVICES_BACKGROUND_JOBS_EXECUTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_MATERIAL_COMPONENTS_INSPECTED:
-    return "ATOM_MATERIAL_COMPONENTS_INSPECTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_DELAYED_SOURCE_REGISTRATION:
+    return "ATOM_AD_SERVICES_MEASUREMENT_DELAYED_SOURCE_REGISTRATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TILE_REQUESTED:
-    return "ATOM_TILE_REQUESTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_ATTRIBUTION:
+    return "ATOM_AD_SERVICES_MEASUREMENT_ATTRIBUTION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_STATE_RESPONSE_RECEIVED:
-    return "ATOM_STATE_RESPONSE_RECEIVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_JOBS:
+    return "ATOM_AD_SERVICES_MEASUREMENT_JOBS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_TILE_RESPONSE_RECEIVED:
-    return "ATOM_TILE_RESPONSE_RECEIVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_WIPEOUT:
+    return "ATOM_AD_SERVICES_MEASUREMENT_WIPEOUT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_INFLATION_FINISHED:
-    return "ATOM_INFLATION_FINISHED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_AD_ID_MATCH_FOR_DEBUG_KEYS:
+    return "ATOM_AD_SERVICES_MEASUREMENT_AD_ID_MATCH_FOR_DEBUG_KEYS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_INFLATION_FAILED:
-    return "ATOM_INFLATION_FAILED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_DATA_STORED:
+    return "ATOM_AD_SERVICES_ENROLLMENT_DATA_STORED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_IGNORED_INFLATION_FAILURES_REPORTED:
-    return "ATOM_IGNORED_INFLATION_FAILURES_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_FILE_DOWNLOADED:
+    return "ATOM_AD_SERVICES_ENROLLMENT_FILE_DOWNLOADED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_DRAWABLE_RENDERED:
-    return "ATOM_DRAWABLE_RENDERED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_MATCHED:
+    return "ATOM_AD_SERVICES_ENROLLMENT_MATCHED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_SYNC_REQUESTED:
-    return "ATOM_WEAR_TIME_SYNC_REQUESTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_CONSENT_MIGRATED:
+    return "ATOM_AD_SERVICES_CONSENT_MIGRATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_UPDATE_STARTED:
-    return "ATOM_WEAR_TIME_UPDATE_STARTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_FAILED:
+    return "ATOM_AD_SERVICES_ENROLLMENT_FAILED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED:
-    return "ATOM_WEAR_TIME_SYNC_ATTEMPT_COMPLETED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_CLICK_VERIFICATION:
+    return "ATOM_AD_SERVICES_MEASUREMENT_CLICK_VERIFICATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_TIME_CHANGED:
-    return "ATOM_WEAR_TIME_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENCRYPTION_KEY_FETCHED:
+    return "ATOM_AD_SERVICES_ENCRYPTION_KEY_FETCHED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED:
-    return "ATOM_WEAR_ADAPTIVE_SUSPEND_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENCRYPTION_KEY_DB_TRANSACTION_ENDED:
+    return "ATOM_AD_SERVICES_ENCRYPTION_KEY_DB_TRANSACTION_ENDED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED:
-    return "ATOM_WEAR_POWER_ANOMALY_SERVICE_OPERATIONAL_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_DESTINATION_REGISTERED_BEACONS:
+    return "ATOM_DESTINATION_REGISTERED_BEACONS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED:
-    return "ATOM_WEAR_POWER_ANOMALY_SERVICE_EVENT_STATS_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_REPORT_INTERACTION_API_CALLED:
+    return "ATOM_REPORT_INTERACTION_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WEAR_TIME_SESSION:
-    return "ATOM_WS_WEAR_TIME_SESSION";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_INTERACTION_REPORTING_TABLE_CLEARED:
+    return "ATOM_INTERACTION_REPORTING_TABLE_CLEARED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_INCOMING_CALL_ACTION_REPORTED:
-    return "ATOM_WS_INCOMING_CALL_ACTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_APP_MANIFEST_CONFIG_HELPER_CALLED:
+    return "ATOM_APP_MANIFEST_CONFIG_HELPER_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_DISCONNECTION_REPORTED:
-    return "ATOM_WS_CALL_DISCONNECTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_FILTERING_PROCESS_JOIN_CA_REPORTED:
+    return "ATOM_AD_FILTERING_PROCESS_JOIN_CA_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_DURATION_REPORTED:
-    return "ATOM_WS_CALL_DURATION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_FILTERING_PROCESS_AD_SELECTION_REPORTED:
+    return "ATOM_AD_FILTERING_PROCESS_AD_SELECTION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED:
-    return "ATOM_WS_CALL_USER_EXPERIENCE_LATENCY_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_COUNTER_HISTOGRAM_UPDATER_REPORTED:
+    return "ATOM_AD_COUNTER_HISTOGRAM_UPDATER_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_CALL_INTERACTION_REPORTED:
-    return "ATOM_WS_CALL_INTERACTION_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SIGNATURE_VERIFICATION:
+    return "ATOM_SIGNATURE_VERIFICATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_ON_BODY_STATE_CHANGED:
-    return "ATOM_WS_ON_BODY_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_IMMEDIATE_SIGN_JOIN_STATUS_REPORTED:
+    return "ATOM_K_ANON_IMMEDIATE_SIGN_JOIN_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED:
-    return "ATOM_WS_WATCH_FACE_RESTRICTED_COMPLICATIONS_IMPACTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_BACKGROUND_JOB_STATUS_REPORTED:
+    return "ATOM_K_ANON_BACKGROUND_JOB_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED:
-    return "ATOM_WS_WATCH_FACE_DEFAULT_RESTRICTED_COMPLICATIONS_REMOVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_INITIALIZE_STATUS_REPORTED:
+    return "ATOM_K_ANON_INITIALIZE_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED:
-    return "ATOM_WS_COMPLICATIONS_IMPACTED_NOTIFICATION_EVENT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_SIGN_STATUS_REPORTED:
+    return "ATOM_K_ANON_SIGN_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_REMOTE_EVENT_USAGE_REPORTED:
-    return "ATOM_WS_REMOTE_EVENT_USAGE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_JOIN_STATUS_REPORTED:
+    return "ATOM_K_ANON_JOIN_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_BUGREPORT_REQUESTED:
-    return "ATOM_WS_BUGREPORT_REQUESTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_K_ANON_KEY_ATTESTATION_STATUS_REPORTED:
+    return "ATOM_K_ANON_KEY_ATTESTATION_STATUS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_BUGREPORT_TRIGGERED:
-    return "ATOM_WS_BUGREPORT_TRIGGERED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_GET_AD_SELECTION_DATA_API_CALLED:
+    return "ATOM_GET_AD_SELECTION_DATA_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_BUGREPORT_FINISHED:
-    return "ATOM_WS_BUGREPORT_FINISHED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_GET_AD_SELECTION_DATA_BUYER_INPUT_GENERATED:
+    return "ATOM_GET_AD_SELECTION_DATA_BUYER_INPUT_GENERATED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_BUGREPORT_RESULT_RECEIVED:
-    return "ATOM_WS_BUGREPORT_RESULT_RECEIVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_BACKGROUND_JOB_SCHEDULING_REPORTED:
+    return "ATOM_BACKGROUND_JOB_SCHEDULING_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_STANDALONE_MODE_SNAPSHOT:
-    return "ATOM_WS_STANDALONE_MODE_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TOPICS_ENCRYPTION_EPOCH_COMPUTATION_REPORTED:
+    return "ATOM_TOPICS_ENCRYPTION_EPOCH_COMPUTATION_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT:
-    return "ATOM_WS_FAVORITE_WATCH_FACE_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TOPICS_ENCRYPTION_GET_TOPICS_REPORTED:
+    return "ATOM_TOPICS_ENCRYPTION_GET_TOPICS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT:
-    return "ATOM_WS_PHOTOS_WATCH_FACE_FEATURE_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ADSERVICES_SHELL_COMMAND_CALLED:
+    return "ATOM_ADSERVICES_SHELL_COMMAND_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT:
-    return "ATOM_WS_WATCH_FACE_CUSTOMIZATION_SNAPSHOT";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_UPDATE_SIGNALS_API_CALLED:
+    return "ATOM_UPDATE_SIGNALS_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_POWER_MENU_OPENED:
-    return "ATOM_WEAR_POWER_MENU_OPENED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ENCODING_JOB_RUN:
+    return "ATOM_ENCODING_JOB_RUN";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WEAR_ASSISTANT_OPENED:
-    return "ATOM_WEAR_ASSISTANT_OPENED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ENCODING_JS_FETCH:
+    return "ATOM_ENCODING_JS_FETCH";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_FIRST_OVERLAY_STATE_CHANGED:
-    return "ATOM_FIRST_OVERLAY_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ENCODING_JS_EXECUTION:
+    return "ATOM_ENCODING_JS_EXECUTION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_NDP_REPORTED:
-    return "ATOM_WIFI_AWARE_NDP_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_PERSIST_AD_SELECTION_RESULT_CALLED:
+    return "ATOM_PERSIST_AD_SELECTION_RESULT_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_ATTACH_REPORTED:
-    return "ATOM_WIFI_AWARE_ATTACH_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SERVER_AUCTION_KEY_FETCH_CALLED:
+    return "ATOM_SERVER_AUCTION_KEY_FETCH_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_SELF_RECOVERY_TRIGGERED:
-    return "ATOM_WIFI_SELF_RECOVERY_TRIGGERED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SERVER_AUCTION_BACKGROUND_KEY_FETCH_ENABLED:
+    return "ATOM_SERVER_AUCTION_BACKGROUND_KEY_FETCH_ENABLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SOFT_AP_STARTED:
-    return "ATOM_SOFT_AP_STARTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_PROCESS_ODP_REGISTRATION:
+    return "ATOM_AD_SERVICES_MEASUREMENT_PROCESS_ODP_REGISTRATION";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SOFT_AP_STOPPED:
-    return "ATOM_SOFT_AP_STOPPED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_MEASUREMENT_NOTIFY_REGISTRATION_TO_ODP:
+    return "ATOM_AD_SERVICES_MEASUREMENT_NOTIFY_REGISTRATION_TO_ODP";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCK_RELEASED:
-    return "ATOM_WIFI_LOCK_RELEASED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SELECT_ADS_FROM_OUTCOMES_API_CALLED:
+    return "ATOM_SELECT_ADS_FROM_OUTCOMES_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCK_DEACTIVATED:
-    return "ATOM_WIFI_LOCK_DEACTIVATED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_REPORT_IMPRESSION_API_CALLED:
+    return "ATOM_REPORT_IMPRESSION_API_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_CONFIG_SAVED:
-    return "ATOM_WIFI_CONFIG_SAVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_ENROLLMENT_TRANSACTION_STATS:
+    return "ATOM_AD_SERVICES_ENROLLMENT_TRANSACTION_STATS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED:
-    return "ATOM_WIFI_AWARE_RESOURCE_USING_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_COBALT_LOGGER_EVENT_REPORTED:
+    return "ATOM_AD_SERVICES_COBALT_LOGGER_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_HAL_API_CALLED:
-    return "ATOM_WIFI_AWARE_HAL_API_CALLED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_AD_SERVICES_COBALT_PERIODIC_JOB_EVENT_REPORTED:
+    return "ATOM_AD_SERVICES_COBALT_PERIODIC_JOB_EVENT_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED:
-    return "ATOM_WIFI_LOCAL_ONLY_REQUEST_RECEIVED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_UPDATE_SIGNALS_PROCESS_REPORTED:
+    return "ATOM_UPDATE_SIGNALS_PROCESS_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED:
-    return "ATOM_WIFI_LOCAL_ONLY_REQUEST_SCAN_TRIGGERED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_TOPICS_SCHEDULE_EPOCH_JOB_SETTING_REPORTED:
+    return "ATOM_TOPICS_SCHEDULE_EPOCH_JOB_SETTING_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_THREAD_TASK_EXECUTED:
-    return "ATOM_WIFI_THREAD_TASK_EXECUTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_SCHEDULE_ATTEMPTED:
+    return "ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_SCHEDULE_ATTEMPTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_STATE_CHANGED:
-    return "ATOM_WIFI_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED:
+    return "ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PNO_SCAN_STARTED:
-    return "ATOM_PNO_SCAN_STARTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED_ATTEMPTED_FAILURE_REPORTED:
+    return "ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_PERFORMED_ATTEMPTED_FAILURE_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_PNO_SCAN_STOPPED:
-    return "ATOM_PNO_SCAN_STOPPED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_BACKGROUND_JOB_RAN:
+    return "ATOM_SCHEDULED_CUSTOM_AUDIENCE_UPDATE_BACKGROUND_JOB_RAN";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_IS_UNUSABLE_REPORTED:
-    return "ATOM_WIFI_IS_UNUSABLE_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_STATUS_CALLED:
+    return "ATOM_THERMAL_STATUS_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AP_CAPABILITIES_REPORTED:
-    return "ATOM_WIFI_AP_CAPABILITIES_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_HEADROOM_CALLED:
+    return "ATOM_THERMAL_HEADROOM_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SOFT_AP_STATE_CHANGED:
-    return "ATOM_SOFT_AP_STATE_CHANGED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED:
+    return "ATOM_THERMAL_HEADROOM_THRESHOLDS_CALLED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_SCORER_PREDICTION_RESULT_REPORTED:
-    return "ATOM_SCORER_PREDICTION_RESULT_REPORTED";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ADPF_HINT_SESSION_TID_CLEANUP:
+    return "ATOM_ADPF_HINT_SESSION_TID_CLEANUP";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_AWARE_CAPABILITIES:
-    return "ATOM_WIFI_AWARE_CAPABILITIES";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_THERMAL_HEADROOM_THRESHOLDS:
+    return "ATOM_THERMAL_HEADROOM_THRESHOLDS";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_MODULE_INFO:
-    return "ATOM_WIFI_MODULE_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ADPF_SESSION_SNAPSHOT:
+    return "ATOM_ADPF_SESSION_SNAPSHOT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_SETTING_INFO:
-    return "ATOM_WIFI_SETTING_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED:
+    return "ATOM_ADAPTIVE_AUTH_UNLOCK_AFTER_LOCK_REPORTED";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_COMPLEX_SETTING_INFO:
-    return "ATOM_WIFI_COMPLEX_SETTING_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ACCOUNT_MANAGER_EVENT:
+    return "ATOM_ACCOUNT_MANAGER_EVENT";
 
-  case ::perfetto::protos::pbzero::AtomId::ATOM_WIFI_CONFIGURED_NETWORK_INFO:
-    return "ATOM_WIFI_CONFIGURED_NETWORK_INFO";
+  case ::perfetto::protos::pbzero::AtomId::ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED:
+    return "ATOM_ACCESSIBILITY_CHECK_RESULT_REPORTED";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
@@ -65571,15 +65725,18 @@ namespace protos {
 namespace pbzero {
 class DataSourceConfig;
 class PriorityBoostConfig;
+class TraceAttributes;
 class TraceConfig_AndroidReportConfig;
 class TraceConfig_BufferConfig;
 class TraceConfig_BuiltinDataSource;
 class TraceConfig_CmdTraceStartDelay;
+class TraceConfig_CompressionConfig;
+class TraceConfig_CompressionConfig_Deflate;
+class TraceConfig_CompressionConfig_Zstd;
 class TraceConfig_DataSource;
 class TraceConfig_GuardrailOverrides;
 class TraceConfig_IncidentReportConfig;
 class TraceConfig_IncrementalStateConfig;
-class TraceConfig_Note;
 class TraceConfig_ProducerConfig;
 class TraceConfig_SessionSemaphore;
 class TraceConfig_StatsdMetadata;
@@ -65886,14 +66043,13 @@ namespace perfetto_pbzero_enum_TraceConfig_BufferConfig {
 enum ExperimentalMode : int32_t {
   MODE_UNSPECIFIED = 0,
   TRACE_BUFFER_V2 = 1,
-  TRACE_BUFFER_V2_SHADOW_MODE = 2,
 };
 } // namespace perfetto_pbzero_enum_TraceConfig_BufferConfig
 using TraceConfig_BufferConfig_ExperimentalMode = perfetto_pbzero_enum_TraceConfig_BufferConfig::ExperimentalMode;
 
 
 constexpr TraceConfig_BufferConfig_ExperimentalMode TraceConfig_BufferConfig_ExperimentalMode_MIN = TraceConfig_BufferConfig_ExperimentalMode::MODE_UNSPECIFIED;
-constexpr TraceConfig_BufferConfig_ExperimentalMode TraceConfig_BufferConfig_ExperimentalMode_MAX = TraceConfig_BufferConfig_ExperimentalMode::TRACE_BUFFER_V2_SHADOW_MODE;
+constexpr TraceConfig_BufferConfig_ExperimentalMode TraceConfig_BufferConfig_ExperimentalMode_MAX = TraceConfig_BufferConfig_ExperimentalMode::TRACE_BUFFER_V2;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
@@ -65904,14 +66060,11 @@ const char* TraceConfig_BufferConfig_ExperimentalMode_Name(::perfetto::protos::p
 
   case ::perfetto::protos::pbzero::TraceConfig_BufferConfig_ExperimentalMode::TRACE_BUFFER_V2:
     return "TRACE_BUFFER_V2";
-
-  case ::perfetto::protos::pbzero::TraceConfig_BufferConfig_ExperimentalMode::TRACE_BUFFER_V2_SHADOW_MODE:
-    return "TRACE_BUFFER_V2_SHADOW_MODE";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class TraceConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/46> {
+class TraceConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/48> {
  public:
   TraceConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TraceConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -65970,6 +66123,8 @@ class TraceConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   ::protozero::ConstChars unique_session_name() const { return at<22>().as_string(); }
   bool has_compression_type() const { return at<24>().valid(); }
   int32_t compression_type() const { return at<24>().as_int32(); }
+  bool has_compression() const { return at<47>().valid(); }
+  ::protozero::ConstBytes compression() const { return at<47>().as_bytes(); }
   bool has_incident_report_config() const { return at<25>().valid(); }
   ::protozero::ConstBytes incident_report_config() const { return at<25>().as_bytes(); }
   bool has_statsd_logging() const { return at<31>().valid(); }
@@ -65996,8 +66151,8 @@ class TraceConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID
   int32_t fflush_post_write() const { return at<45>().as_int32(); }
   bool has_trace_all_machines() const { return at<43>().valid(); }
   bool trace_all_machines() const { return at<43>().as_bool(); }
-  bool has_notes() const { return at<46>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> notes() const { return GetRepeated<::protozero::ConstBytes>(46); }
+  bool has_trace_attributes() const { return at<48>().valid(); }
+  ::protozero::ConstBytes trace_attributes() const { return at<48>().as_bytes(); }
 };
 
 class TraceConfig : public ::protozero::Message {
@@ -66031,6 +66186,7 @@ class TraceConfig : public ::protozero::Message {
     kAllowUserBuildTracingFieldNumber = 19,
     kUniqueSessionNameFieldNumber = 22,
     kCompressionTypeFieldNumber = 24,
+    kCompressionFieldNumber = 47,
     kIncidentReportConfigFieldNumber = 25,
     kStatsdLoggingFieldNumber = 31,
     kTraceUuidMsbFieldNumber = 27,
@@ -66044,7 +66200,7 @@ class TraceConfig : public ::protozero::Message {
     kWriteFlushModeFieldNumber = 44,
     kFflushPostWriteFieldNumber = 45,
     kTraceAllMachinesFieldNumber = 43,
-    kNotesFieldNumber = 46,
+    kTraceAttributesFieldNumber = 48,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig"; }
 
@@ -66056,12 +66212,12 @@ class TraceConfig : public ::protozero::Message {
   using GuardrailOverrides = ::perfetto::protos::pbzero::TraceConfig_GuardrailOverrides;
   using TriggerConfig = ::perfetto::protos::pbzero::TraceConfig_TriggerConfig;
   using IncrementalStateConfig = ::perfetto::protos::pbzero::TraceConfig_IncrementalStateConfig;
+  using CompressionConfig = ::perfetto::protos::pbzero::TraceConfig_CompressionConfig;
   using IncidentReportConfig = ::perfetto::protos::pbzero::TraceConfig_IncidentReportConfig;
   using TraceFilter = ::perfetto::protos::pbzero::TraceConfig_TraceFilter;
   using AndroidReportConfig = ::perfetto::protos::pbzero::TraceConfig_AndroidReportConfig;
   using CmdTraceStartDelay = ::perfetto::protos::pbzero::TraceConfig_CmdTraceStartDelay;
   using SessionSemaphore = ::perfetto::protos::pbzero::TraceConfig_SessionSemaphore;
-  using Note = ::perfetto::protos::pbzero::TraceConfig_Note;
 
   using LockdownModeOperation = ::perfetto::protos::pbzero::TraceConfig_LockdownModeOperation;
   static inline const char* LockdownModeOperation_Name(LockdownModeOperation value) {
@@ -66581,6 +66737,20 @@ class TraceConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_Compression =
+    ::protozero::proto_utils::FieldMetadata<
+      47,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TraceConfig_CompressionConfig,
+      TraceConfig>;
+
+  static constexpr FieldMetadata_Compression kCompression{};
+  template <typename T = TraceConfig_CompressionConfig> T* set_compression() {
+    return BeginNestedMessage<T>(47);
+  }
+
+
   using FieldMetadata_IncidentReportConfig =
     ::protozero::proto_utils::FieldMetadata<
       25,
@@ -66791,89 +66961,19 @@ class TraceConfig : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Notes =
+  using FieldMetadata_TraceAttributes =
     ::protozero::proto_utils::FieldMetadata<
-      46,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      48,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TraceConfig_Note,
+      TraceAttributes,
       TraceConfig>;
 
-  static constexpr FieldMetadata_Notes kNotes{};
-  template <typename T = TraceConfig_Note> T* add_notes() {
-    return BeginNestedMessage<T>(46);
-  }
-
-};
-
-class TraceConfig_Note_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  TraceConfig_Note_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_Note_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_Note_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_key() const { return at<1>().valid(); }
-  ::protozero::ConstChars key() const { return at<1>().as_string(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstChars value() const { return at<2>().as_string(); }
-};
-
-class TraceConfig_Note : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_Note_Decoder;
-  enum : int32_t {
-    kKeyFieldNumber = 1,
-    kValueFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.Note"; }
-
-
-  using FieldMetadata_Key =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_Note>;
-
-  static constexpr FieldMetadata_Key kKey{};
-  void set_key(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Key::kFieldId, data, size);
-  }
-  void set_key(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Key::kFieldId, chars.data, chars.size);
-  }
-  void set_key(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Key::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_TraceAttributes kTraceAttributes{};
+  template <typename T = TraceAttributes> T* set_trace_attributes() {
+    return BeginNestedMessage<T>(48);
   }
 
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_Note>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
-  }
-  void set_value(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
-  }
-  void set_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
 };
 
 class TraceConfig_SessionSemaphore_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
@@ -67475,2803 +67575,364 @@ class TraceConfig_IncidentReportConfig : public ::protozero::Message {
     static constexpr uint32_t field_id = FieldMetadata_DestinationPackage::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DestinationClass =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_IncidentReportConfig>;
-
-  static constexpr FieldMetadata_DestinationClass kDestinationClass{};
-  void set_destination_class(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_DestinationClass::kFieldId, data, size);
-  }
-  void set_destination_class(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_DestinationClass::kFieldId, chars.data, chars.size);
-  }
-  void set_destination_class(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_DestinationClass::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PrivacyLevel =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TraceConfig_IncidentReportConfig>;
-
-  static constexpr FieldMetadata_PrivacyLevel kPrivacyLevel{};
-  void set_privacy_level(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PrivacyLevel::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SkipIncidentd =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_IncidentReportConfig>;
-
-  static constexpr FieldMetadata_SkipIncidentd kSkipIncidentd{};
-  void set_skip_incidentd(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_SkipIncidentd::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SkipDropbox =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_IncidentReportConfig>;
-
-  static constexpr FieldMetadata_SkipDropbox kSkipDropbox{};
-  void set_skip_dropbox(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_SkipDropbox::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_IncrementalStateConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  TraceConfig_IncrementalStateConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_IncrementalStateConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_IncrementalStateConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_clear_period_ms() const { return at<1>().valid(); }
-  uint32_t clear_period_ms() const { return at<1>().as_uint32(); }
-};
-
-class TraceConfig_IncrementalStateConfig : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_IncrementalStateConfig_Decoder;
-  enum : int32_t {
-    kClearPeriodMsFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.IncrementalStateConfig"; }
-
-
-  using FieldMetadata_ClearPeriodMs =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_IncrementalStateConfig>;
-
-  static constexpr FieldMetadata_ClearPeriodMs kClearPeriodMs{};
-  void set_clear_period_ms(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ClearPeriodMs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_TriggerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  TraceConfig_TriggerConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_TriggerConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_TriggerConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_trigger_mode() const { return at<1>().valid(); }
-  int32_t trigger_mode() const { return at<1>().as_int32(); }
-  bool has_use_clone_snapshot_if_available() const { return at<5>().valid(); }
-  bool use_clone_snapshot_if_available() const { return at<5>().as_bool(); }
-  bool has_triggers() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> triggers() const { return GetRepeated<::protozero::ConstBytes>(2); }
-  bool has_trigger_timeout_ms() const { return at<3>().valid(); }
-  uint32_t trigger_timeout_ms() const { return at<3>().as_uint32(); }
-};
-
-class TraceConfig_TriggerConfig : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_TriggerConfig_Decoder;
-  enum : int32_t {
-    kTriggerModeFieldNumber = 1,
-    kUseCloneSnapshotIfAvailableFieldNumber = 5,
-    kTriggersFieldNumber = 2,
-    kTriggerTimeoutMsFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.TriggerConfig"; }
-
-  using Trigger = ::perfetto::protos::pbzero::TraceConfig_TriggerConfig_Trigger;
-
-  using TriggerMode = ::perfetto::protos::pbzero::TraceConfig_TriggerConfig_TriggerMode;
-  static inline const char* TriggerMode_Name(TriggerMode value) {
-    return ::perfetto::protos::pbzero::TraceConfig_TriggerConfig_TriggerMode_Name(value);
-  }
-  static inline const TriggerMode UNSPECIFIED = TriggerMode::UNSPECIFIED;
-  static inline const TriggerMode START_TRACING = TriggerMode::START_TRACING;
-  static inline const TriggerMode STOP_TRACING = TriggerMode::STOP_TRACING;
-  static inline const TriggerMode CLONE_SNAPSHOT = TriggerMode::CLONE_SNAPSHOT;
-
-  using FieldMetadata_TriggerMode =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      TraceConfig_TriggerConfig_TriggerMode,
-      TraceConfig_TriggerConfig>;
-
-  static constexpr FieldMetadata_TriggerMode kTriggerMode{};
-  void set_trigger_mode(TraceConfig_TriggerConfig_TriggerMode value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggerMode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_UseCloneSnapshotIfAvailable =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_TriggerConfig>;
-
-  static constexpr FieldMetadata_UseCloneSnapshotIfAvailable kUseCloneSnapshotIfAvailable{};
-  void set_use_clone_snapshot_if_available(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_UseCloneSnapshotIfAvailable::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Triggers =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      TraceConfig_TriggerConfig_Trigger,
-      TraceConfig_TriggerConfig>;
-
-  static constexpr FieldMetadata_Triggers kTriggers{};
-  template <typename T = TraceConfig_TriggerConfig_Trigger> T* add_triggers() {
-    return BeginNestedMessage<T>(2);
-  }
-
-
-  using FieldMetadata_TriggerTimeoutMs =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_TriggerConfig>;
-
-  static constexpr FieldMetadata_TriggerTimeoutMs kTriggerTimeoutMs{};
-  void set_trigger_timeout_ms(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggerTimeoutMs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_TriggerConfig_Trigger_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  TraceConfig_TriggerConfig_Trigger_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_TriggerConfig_Trigger_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_TriggerConfig_Trigger_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars name() const { return at<1>().as_string(); }
-  bool has_producer_name_regex() const { return at<2>().valid(); }
-  ::protozero::ConstChars producer_name_regex() const { return at<2>().as_string(); }
-  bool has_stop_delay_ms() const { return at<3>().valid(); }
-  uint32_t stop_delay_ms() const { return at<3>().as_uint32(); }
-  bool has_max_per_24_h() const { return at<4>().valid(); }
-  uint32_t max_per_24_h() const { return at<4>().as_uint32(); }
-  bool has_skip_probability() const { return at<5>().valid(); }
-  double skip_probability() const { return at<5>().as_double(); }
-};
-
-class TraceConfig_TriggerConfig_Trigger : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_TriggerConfig_Trigger_Decoder;
-  enum : int32_t {
-    kNameFieldNumber = 1,
-    kProducerNameRegexFieldNumber = 2,
-    kStopDelayMsFieldNumber = 3,
-    kMaxPer24HFieldNumber = 4,
-    kSkipProbabilityFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.TriggerConfig.Trigger"; }
-
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_TriggerConfig_Trigger>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ProducerNameRegex =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_TriggerConfig_Trigger>;
-
-  static constexpr FieldMetadata_ProducerNameRegex kProducerNameRegex{};
-  void set_producer_name_regex(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ProducerNameRegex::kFieldId, data, size);
-  }
-  void set_producer_name_regex(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ProducerNameRegex::kFieldId, chars.data, chars.size);
-  }
-  void set_producer_name_regex(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ProducerNameRegex::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StopDelayMs =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_TriggerConfig_Trigger>;
-
-  static constexpr FieldMetadata_StopDelayMs kStopDelayMs{};
-  void set_stop_delay_ms(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StopDelayMs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MaxPer24H =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_TriggerConfig_Trigger>;
-
-  static constexpr FieldMetadata_MaxPer24H kMaxPer24H{};
-  void set_max_per_24_h(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MaxPer24H::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SkipProbability =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kDouble,
-      double,
-      TraceConfig_TriggerConfig_Trigger>;
-
-  static constexpr FieldMetadata_SkipProbability kSkipProbability{};
-  void set_skip_probability(double value) {
-    static constexpr uint32_t field_id = FieldMetadata_SkipProbability::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kDouble>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_GuardrailOverrides_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  TraceConfig_GuardrailOverrides_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_GuardrailOverrides_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_GuardrailOverrides_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_max_upload_per_day_bytes() const { return at<1>().valid(); }
-  uint64_t max_upload_per_day_bytes() const { return at<1>().as_uint64(); }
-  bool has_max_tracing_buffer_size_kb() const { return at<2>().valid(); }
-  uint32_t max_tracing_buffer_size_kb() const { return at<2>().as_uint32(); }
-};
-
-class TraceConfig_GuardrailOverrides : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_GuardrailOverrides_Decoder;
-  enum : int32_t {
-    kMaxUploadPerDayBytesFieldNumber = 1,
-    kMaxTracingBufferSizeKbFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.GuardrailOverrides"; }
-
-
-  using FieldMetadata_MaxUploadPerDayBytes =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      TraceConfig_GuardrailOverrides>;
-
-  static constexpr FieldMetadata_MaxUploadPerDayBytes kMaxUploadPerDayBytes{};
-  void set_max_upload_per_day_bytes(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MaxUploadPerDayBytes::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MaxTracingBufferSizeKb =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_GuardrailOverrides>;
-
-  static constexpr FieldMetadata_MaxTracingBufferSizeKb kMaxTracingBufferSizeKb{};
-  void set_max_tracing_buffer_size_kb(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_MaxTracingBufferSizeKb::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_StatsdMetadata_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  TraceConfig_StatsdMetadata_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_StatsdMetadata_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_StatsdMetadata_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_triggering_alert_id() const { return at<1>().valid(); }
-  int64_t triggering_alert_id() const { return at<1>().as_int64(); }
-  bool has_triggering_config_uid() const { return at<2>().valid(); }
-  int32_t triggering_config_uid() const { return at<2>().as_int32(); }
-  bool has_triggering_config_id() const { return at<3>().valid(); }
-  int64_t triggering_config_id() const { return at<3>().as_int64(); }
-  bool has_triggering_subscription_id() const { return at<4>().valid(); }
-  int64_t triggering_subscription_id() const { return at<4>().as_int64(); }
-};
-
-class TraceConfig_StatsdMetadata : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_StatsdMetadata_Decoder;
-  enum : int32_t {
-    kTriggeringAlertIdFieldNumber = 1,
-    kTriggeringConfigUidFieldNumber = 2,
-    kTriggeringConfigIdFieldNumber = 3,
-    kTriggeringSubscriptionIdFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.StatsdMetadata"; }
-
-
-  using FieldMetadata_TriggeringAlertId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TraceConfig_StatsdMetadata>;
-
-  static constexpr FieldMetadata_TriggeringAlertId kTriggeringAlertId{};
-  void set_triggering_alert_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggeringAlertId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TriggeringConfigUid =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      TraceConfig_StatsdMetadata>;
-
-  static constexpr FieldMetadata_TriggeringConfigUid kTriggeringConfigUid{};
-  void set_triggering_config_uid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggeringConfigUid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TriggeringConfigId =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TraceConfig_StatsdMetadata>;
-
-  static constexpr FieldMetadata_TriggeringConfigId kTriggeringConfigId{};
-  void set_triggering_config_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggeringConfigId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TriggeringSubscriptionId =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TraceConfig_StatsdMetadata>;
-
-  static constexpr FieldMetadata_TriggeringSubscriptionId kTriggeringSubscriptionId{};
-  void set_triggering_subscription_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggeringSubscriptionId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_ProducerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
- public:
-  TraceConfig_ProducerConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_ProducerConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_ProducerConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_producer_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars producer_name() const { return at<1>().as_string(); }
-  bool has_shm_size_kb() const { return at<2>().valid(); }
-  uint32_t shm_size_kb() const { return at<2>().as_uint32(); }
-  bool has_page_size_kb() const { return at<3>().valid(); }
-  uint32_t page_size_kb() const { return at<3>().as_uint32(); }
-};
-
-class TraceConfig_ProducerConfig : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_ProducerConfig_Decoder;
-  enum : int32_t {
-    kProducerNameFieldNumber = 1,
-    kShmSizeKbFieldNumber = 2,
-    kPageSizeKbFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.ProducerConfig"; }
-
-
-  using FieldMetadata_ProducerName =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_ProducerConfig>;
-
-  static constexpr FieldMetadata_ProducerName kProducerName{};
-  void set_producer_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ProducerName::kFieldId, data, size);
-  }
-  void set_producer_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ProducerName::kFieldId, chars.data, chars.size);
-  }
-  void set_producer_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ProducerName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ShmSizeKb =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_ProducerConfig>;
-
-  static constexpr FieldMetadata_ShmSizeKb kShmSizeKb{};
-  void set_shm_size_kb(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ShmSizeKb::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PageSizeKb =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_ProducerConfig>;
-
-  static constexpr FieldMetadata_PageSizeKb kPageSizeKb{};
-  void set_page_size_kb(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_PageSizeKb::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_BuiltinDataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
- public:
-  TraceConfig_BuiltinDataSource_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_BuiltinDataSource_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_BuiltinDataSource_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_disable_clock_snapshotting() const { return at<1>().valid(); }
-  bool disable_clock_snapshotting() const { return at<1>().as_bool(); }
-  bool has_disable_trace_config() const { return at<2>().valid(); }
-  bool disable_trace_config() const { return at<2>().as_bool(); }
-  bool has_disable_system_info() const { return at<3>().valid(); }
-  bool disable_system_info() const { return at<3>().as_bool(); }
-  bool has_disable_service_events() const { return at<4>().valid(); }
-  bool disable_service_events() const { return at<4>().as_bool(); }
-  bool has_primary_trace_clock() const { return at<5>().valid(); }
-  int32_t primary_trace_clock() const { return at<5>().as_int32(); }
-  bool has_snapshot_interval_ms() const { return at<6>().valid(); }
-  uint32_t snapshot_interval_ms() const { return at<6>().as_uint32(); }
-  bool has_prefer_suspend_clock_for_snapshot() const { return at<7>().valid(); }
-  bool prefer_suspend_clock_for_snapshot() const { return at<7>().as_bool(); }
-  bool has_disable_chunk_usage_histograms() const { return at<8>().valid(); }
-  bool disable_chunk_usage_histograms() const { return at<8>().as_bool(); }
-  bool has_disable_extension_descriptors() const { return at<9>().valid(); }
-  bool disable_extension_descriptors() const { return at<9>().as_bool(); }
-};
-
-class TraceConfig_BuiltinDataSource : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_BuiltinDataSource_Decoder;
-  enum : int32_t {
-    kDisableClockSnapshottingFieldNumber = 1,
-    kDisableTraceConfigFieldNumber = 2,
-    kDisableSystemInfoFieldNumber = 3,
-    kDisableServiceEventsFieldNumber = 4,
-    kPrimaryTraceClockFieldNumber = 5,
-    kSnapshotIntervalMsFieldNumber = 6,
-    kPreferSuspendClockForSnapshotFieldNumber = 7,
-    kDisableChunkUsageHistogramsFieldNumber = 8,
-    kDisableExtensionDescriptorsFieldNumber = 9,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.BuiltinDataSource"; }
-
-
-  using FieldMetadata_DisableClockSnapshotting =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_DisableClockSnapshotting kDisableClockSnapshotting{};
-  void set_disable_clock_snapshotting(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisableClockSnapshotting::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisableTraceConfig =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_DisableTraceConfig kDisableTraceConfig{};
-  void set_disable_trace_config(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisableTraceConfig::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisableSystemInfo =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_DisableSystemInfo kDisableSystemInfo{};
-  void set_disable_system_info(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisableSystemInfo::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisableServiceEvents =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_DisableServiceEvents kDisableServiceEvents{};
-  void set_disable_service_events(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisableServiceEvents::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PrimaryTraceClock =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      BuiltinClock,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_PrimaryTraceClock kPrimaryTraceClock{};
-  void set_primary_trace_clock(BuiltinClock value) {
-    static constexpr uint32_t field_id = FieldMetadata_PrimaryTraceClock::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SnapshotIntervalMs =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_SnapshotIntervalMs kSnapshotIntervalMs{};
-  void set_snapshot_interval_ms(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SnapshotIntervalMs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_PreferSuspendClockForSnapshot =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_PreferSuspendClockForSnapshot kPreferSuspendClockForSnapshot{};
-  void set_prefer_suspend_clock_for_snapshot(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_PreferSuspendClockForSnapshot::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisableChunkUsageHistograms =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_DisableChunkUsageHistograms kDisableChunkUsageHistograms{};
-  void set_disable_chunk_usage_histograms(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisableChunkUsageHistograms::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_DisableExtensionDescriptors =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BuiltinDataSource>;
-
-  static constexpr FieldMetadata_DisableExtensionDescriptors kDisableExtensionDescriptors{};
-  void set_disable_extension_descriptors(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisableExtensionDescriptors::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_DataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  TraceConfig_DataSource_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_DataSource_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_DataSource_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_config() const { return at<1>().valid(); }
-  ::protozero::ConstBytes config() const { return at<1>().as_bytes(); }
-  bool has_producer_name_filter() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> producer_name_filter() const { return GetRepeated<::protozero::ConstChars>(2); }
-  bool has_producer_name_regex_filter() const { return at<3>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> producer_name_regex_filter() const { return GetRepeated<::protozero::ConstChars>(3); }
-  bool has_machine_name_filter() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> machine_name_filter() const { return GetRepeated<::protozero::ConstChars>(4); }
-};
-
-class TraceConfig_DataSource : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_DataSource_Decoder;
-  enum : int32_t {
-    kConfigFieldNumber = 1,
-    kProducerNameFilterFieldNumber = 2,
-    kProducerNameRegexFilterFieldNumber = 3,
-    kMachineNameFilterFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.DataSource"; }
-
-
-  using FieldMetadata_Config =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      DataSourceConfig,
-      TraceConfig_DataSource>;
-
-  static constexpr FieldMetadata_Config kConfig{};
-  template <typename T = DataSourceConfig> T* set_config() {
-    return BeginNestedMessage<T>(1);
-  }
-
-
-  using FieldMetadata_ProducerNameFilter =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_DataSource>;
-
-  static constexpr FieldMetadata_ProducerNameFilter kProducerNameFilter{};
-  void add_producer_name_filter(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ProducerNameFilter::kFieldId, data, size);
-  }
-  void add_producer_name_filter(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ProducerNameFilter::kFieldId, chars.data, chars.size);
-  }
-  void add_producer_name_filter(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ProducerNameFilter::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ProducerNameRegexFilter =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_DataSource>;
-
-  static constexpr FieldMetadata_ProducerNameRegexFilter kProducerNameRegexFilter{};
-  void add_producer_name_regex_filter(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ProducerNameRegexFilter::kFieldId, data, size);
-  }
-  void add_producer_name_regex_filter(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ProducerNameRegexFilter::kFieldId, chars.data, chars.size);
-  }
-  void add_producer_name_regex_filter(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ProducerNameRegexFilter::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_MachineNameFilter =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_DataSource>;
-
-  static constexpr FieldMetadata_MachineNameFilter kMachineNameFilter{};
-  void add_machine_name_filter(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_MachineNameFilter::kFieldId, data, size);
-  }
-  void add_machine_name_filter(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_MachineNameFilter::kFieldId, chars.data, chars.size);
-  }
-  void add_machine_name_filter(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_MachineNameFilter::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class TraceConfig_BufferConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
- public:
-  TraceConfig_BufferConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceConfig_BufferConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceConfig_BufferConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_size_kb() const { return at<1>().valid(); }
-  uint32_t size_kb() const { return at<1>().as_uint32(); }
-  bool has_fill_policy() const { return at<4>().valid(); }
-  int32_t fill_policy() const { return at<4>().as_int32(); }
-  bool has_transfer_on_clone() const { return at<5>().valid(); }
-  bool transfer_on_clone() const { return at<5>().as_bool(); }
-  bool has_clear_before_clone() const { return at<6>().valid(); }
-  bool clear_before_clone() const { return at<6>().as_bool(); }
-  bool has_name() const { return at<7>().valid(); }
-  ::protozero::ConstChars name() const { return at<7>().as_string(); }
-  bool has_experimental_mode() const { return at<8>().valid(); }
-  int32_t experimental_mode() const { return at<8>().as_int32(); }
-};
-
-class TraceConfig_BufferConfig : public ::protozero::Message {
- public:
-  using Decoder = TraceConfig_BufferConfig_Decoder;
-  enum : int32_t {
-    kSizeKbFieldNumber = 1,
-    kFillPolicyFieldNumber = 4,
-    kTransferOnCloneFieldNumber = 5,
-    kClearBeforeCloneFieldNumber = 6,
-    kNameFieldNumber = 7,
-    kExperimentalModeFieldNumber = 8,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.BufferConfig"; }
-
-
-  using FillPolicy = ::perfetto::protos::pbzero::TraceConfig_BufferConfig_FillPolicy;
-  static inline const char* FillPolicy_Name(FillPolicy value) {
-    return ::perfetto::protos::pbzero::TraceConfig_BufferConfig_FillPolicy_Name(value);
-  }
-
-  using ExperimentalMode = ::perfetto::protos::pbzero::TraceConfig_BufferConfig_ExperimentalMode;
-  static inline const char* ExperimentalMode_Name(ExperimentalMode value) {
-    return ::perfetto::protos::pbzero::TraceConfig_BufferConfig_ExperimentalMode_Name(value);
-  }
-  static inline const FillPolicy UNSPECIFIED = FillPolicy::UNSPECIFIED;
-  static inline const FillPolicy RING_BUFFER = FillPolicy::RING_BUFFER;
-  static inline const FillPolicy DISCARD = FillPolicy::DISCARD;
-  static inline const ExperimentalMode MODE_UNSPECIFIED = ExperimentalMode::MODE_UNSPECIFIED;
-  static inline const ExperimentalMode TRACE_BUFFER_V2 = ExperimentalMode::TRACE_BUFFER_V2;
-  static inline const ExperimentalMode TRACE_BUFFER_V2_SHADOW_MODE = ExperimentalMode::TRACE_BUFFER_V2_SHADOW_MODE;
-
-  using FieldMetadata_SizeKb =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      TraceConfig_BufferConfig>;
-
-  static constexpr FieldMetadata_SizeKb kSizeKb{};
-  void set_size_kb(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SizeKb::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_FillPolicy =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      TraceConfig_BufferConfig_FillPolicy,
-      TraceConfig_BufferConfig>;
-
-  static constexpr FieldMetadata_FillPolicy kFillPolicy{};
-  void set_fill_policy(TraceConfig_BufferConfig_FillPolicy value) {
-    static constexpr uint32_t field_id = FieldMetadata_FillPolicy::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TransferOnClone =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BufferConfig>;
-
-  static constexpr FieldMetadata_TransferOnClone kTransferOnClone{};
-  void set_transfer_on_clone(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_TransferOnClone::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ClearBeforeClone =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      TraceConfig_BufferConfig>;
-
-  static constexpr FieldMetadata_ClearBeforeClone kClearBeforeClone{};
-  void set_clear_before_clone(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ClearBeforeClone::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      TraceConfig_BufferConfig>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ExperimentalMode =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      TraceConfig_BufferConfig_ExperimentalMode,
-      TraceConfig_BufferConfig>;
-
-  static constexpr FieldMetadata_ExperimentalMode kExperimentalMode{};
-  void set_experimental_mode(TraceConfig_BufferConfig_ExperimentalMode value) {
-    static constexpr uint32_t field_id = FieldMetadata_ExperimentalMode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/clock_snapshot.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_CLOCK_SNAPSHOT_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_CLOCK_SNAPSHOT_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class ClockSnapshot_Clock;
-enum BuiltinClock : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-namespace perfetto_pbzero_enum_ClockSnapshot_Clock {
-enum BuiltinClocks : int32_t {
-  UNKNOWN = 0,
-  REALTIME = 1,
-  REALTIME_COARSE = 2,
-  MONOTONIC = 3,
-  MONOTONIC_COARSE = 4,
-  MONOTONIC_RAW = 5,
-  BOOTTIME = 6,
-  BUILTIN_CLOCK_MAX_ID = 63,
-};
-} // namespace perfetto_pbzero_enum_ClockSnapshot_Clock
-using ClockSnapshot_Clock_BuiltinClocks = perfetto_pbzero_enum_ClockSnapshot_Clock::BuiltinClocks;
-
-
-constexpr ClockSnapshot_Clock_BuiltinClocks ClockSnapshot_Clock_BuiltinClocks_MIN = ClockSnapshot_Clock_BuiltinClocks::UNKNOWN;
-constexpr ClockSnapshot_Clock_BuiltinClocks ClockSnapshot_Clock_BuiltinClocks_MAX = ClockSnapshot_Clock_BuiltinClocks::BUILTIN_CLOCK_MAX_ID;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* ClockSnapshot_Clock_BuiltinClocks_Name(::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::UNKNOWN:
-    return "UNKNOWN";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::REALTIME:
-    return "REALTIME";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::REALTIME_COARSE:
-    return "REALTIME_COARSE";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::MONOTONIC:
-    return "MONOTONIC";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::MONOTONIC_COARSE:
-    return "MONOTONIC_COARSE";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::MONOTONIC_RAW:
-    return "MONOTONIC_RAW";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::BOOTTIME:
-    return "BOOTTIME";
-
-  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::BUILTIN_CLOCK_MAX_ID:
-    return "BUILTIN_CLOCK_MAX_ID";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class ClockSnapshot_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  ClockSnapshot_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ClockSnapshot_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ClockSnapshot_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_clocks() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> clocks() const { return GetRepeated<::protozero::ConstBytes>(1); }
-  bool has_primary_trace_clock() const { return at<2>().valid(); }
-  int32_t primary_trace_clock() const { return at<2>().as_int32(); }
-};
-
-class ClockSnapshot : public ::protozero::Message {
- public:
-  using Decoder = ClockSnapshot_Decoder;
-  enum : int32_t {
-    kClocksFieldNumber = 1,
-    kPrimaryTraceClockFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ClockSnapshot"; }
-
-  using Clock = ::perfetto::protos::pbzero::ClockSnapshot_Clock;
-
-  using FieldMetadata_Clocks =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      ClockSnapshot_Clock,
-      ClockSnapshot>;
-
-  static constexpr FieldMetadata_Clocks kClocks{};
-  template <typename T = ClockSnapshot_Clock> T* add_clocks() {
-    return BeginNestedMessage<T>(1);
-  }
-
-
-  using FieldMetadata_PrimaryTraceClock =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      BuiltinClock,
-      ClockSnapshot>;
-
-  static constexpr FieldMetadata_PrimaryTraceClock kPrimaryTraceClock{};
-  void set_primary_trace_clock(BuiltinClock value) {
-    static constexpr uint32_t field_id = FieldMetadata_PrimaryTraceClock::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class ClockSnapshot_Clock_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  ClockSnapshot_Clock_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit ClockSnapshot_Clock_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit ClockSnapshot_Clock_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_clock_id() const { return at<1>().valid(); }
-  uint32_t clock_id() const { return at<1>().as_uint32(); }
-  bool has_timestamp() const { return at<2>().valid(); }
-  uint64_t timestamp() const { return at<2>().as_uint64(); }
-  bool has_is_incremental() const { return at<3>().valid(); }
-  bool is_incremental() const { return at<3>().as_bool(); }
-  bool has_unit_multiplier_ns() const { return at<4>().valid(); }
-  uint64_t unit_multiplier_ns() const { return at<4>().as_uint64(); }
-};
-
-class ClockSnapshot_Clock : public ::protozero::Message {
- public:
-  using Decoder = ClockSnapshot_Clock_Decoder;
-  enum : int32_t {
-    kClockIdFieldNumber = 1,
-    kTimestampFieldNumber = 2,
-    kIsIncrementalFieldNumber = 3,
-    kUnitMultiplierNsFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.ClockSnapshot.Clock"; }
-
-
-  using BuiltinClocks = ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks;
-  static inline const char* BuiltinClocks_Name(BuiltinClocks value) {
-    return ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks_Name(value);
-  }
-  static inline const BuiltinClocks UNKNOWN = BuiltinClocks::UNKNOWN;
-  static inline const BuiltinClocks REALTIME = BuiltinClocks::REALTIME;
-  static inline const BuiltinClocks REALTIME_COARSE = BuiltinClocks::REALTIME_COARSE;
-  static inline const BuiltinClocks MONOTONIC = BuiltinClocks::MONOTONIC;
-  static inline const BuiltinClocks MONOTONIC_COARSE = BuiltinClocks::MONOTONIC_COARSE;
-  static inline const BuiltinClocks MONOTONIC_RAW = BuiltinClocks::MONOTONIC_RAW;
-  static inline const BuiltinClocks BOOTTIME = BuiltinClocks::BOOTTIME;
-  static inline const BuiltinClocks BUILTIN_CLOCK_MAX_ID = BuiltinClocks::BUILTIN_CLOCK_MAX_ID;
-
-  using FieldMetadata_ClockId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      ClockSnapshot_Clock>;
-
-  static constexpr FieldMetadata_ClockId kClockId{};
-  void set_clock_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ClockId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Timestamp =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      ClockSnapshot_Clock>;
-
-  static constexpr FieldMetadata_Timestamp kTimestamp{};
-  void set_timestamp(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Timestamp::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_IsIncremental =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      ClockSnapshot_Clock>;
-
-  static constexpr FieldMetadata_IsIncremental kIsIncremental{};
-  void set_is_incremental(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsIncremental::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_UnitMultiplierNs =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      ClockSnapshot_Clock>;
-
-  static constexpr FieldMetadata_UnitMultiplierNs kUnitMultiplierNs{};
-  void set_unit_multiplier_ns(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_UnitMultiplierNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/trace_uuid.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACE_UUID_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACE_UUID_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class TraceUuid_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  TraceUuid_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit TraceUuid_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit TraceUuid_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_msb() const { return at<1>().valid(); }
-  int64_t msb() const { return at<1>().as_int64(); }
-  bool has_lsb() const { return at<2>().valid(); }
-  int64_t lsb() const { return at<2>().as_int64(); }
-};
-
-class TraceUuid : public ::protozero::Message {
- public:
-  using Decoder = TraceUuid_Decoder;
-  enum : int32_t {
-    kMsbFieldNumber = 1,
-    kLsbFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.TraceUuid"; }
-
-
-  using FieldMetadata_Msb =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TraceUuid>;
-
-  static constexpr FieldMetadata_Msb kMsb{};
-  void set_msb(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Msb::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Lsb =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      TraceUuid>;
-
-  static constexpr FieldMetadata_Lsb kLsb{};
-  void set_lsb(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Lsb::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/trigger.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRIGGER_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRIGGER_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class Trigger_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  Trigger_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit Trigger_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit Trigger_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_trigger_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars trigger_name() const { return at<1>().as_string(); }
-  bool has_producer_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars producer_name() const { return at<2>().as_string(); }
-  bool has_trusted_producer_uid() const { return at<3>().valid(); }
-  int32_t trusted_producer_uid() const { return at<3>().as_int32(); }
-  bool has_stop_delay_ms() const { return at<4>().valid(); }
-  uint64_t stop_delay_ms() const { return at<4>().as_uint64(); }
-};
-
-class Trigger : public ::protozero::Message {
- public:
-  using Decoder = Trigger_Decoder;
-  enum : int32_t {
-    kTriggerNameFieldNumber = 1,
-    kProducerNameFieldNumber = 2,
-    kTrustedProducerUidFieldNumber = 3,
-    kStopDelayMsFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.Trigger"; }
-
-
-  using FieldMetadata_TriggerName =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      Trigger>;
-
-  static constexpr FieldMetadata_TriggerName kTriggerName{};
-  void set_trigger_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_TriggerName::kFieldId, data, size);
-  }
-  void set_trigger_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_TriggerName::kFieldId, chars.data, chars.size);
-  }
-  void set_trigger_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_TriggerName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ProducerName =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      Trigger>;
-
-  static constexpr FieldMetadata_ProducerName kProducerName{};
-  void set_producer_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_ProducerName::kFieldId, data, size);
-  }
-  void set_producer_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_ProducerName::kFieldId, chars.data, chars.size);
-  }
-  void set_producer_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_ProducerName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_TrustedProducerUid =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      Trigger>;
-
-  static constexpr FieldMetadata_TrustedProducerUid kTrustedProducerUid{};
-  void set_trusted_producer_uid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_TrustedProducerUid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StopDelayMs =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      Trigger>;
-
-  static constexpr FieldMetadata_StopDelayMs kStopDelayMs{};
-  void set_stop_delay_ms(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StopDelayMs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_aflags.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_AFLAGS_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_AFLAGS_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class AndroidAflags_Flag;
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum FlagPermission : int32_t;
-}  // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_FlagPermission = perfetto_pbzero_enum_AndroidAflags::FlagPermission;
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum FlagStorageBackend : int32_t;
-}  // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_FlagStorageBackend = perfetto_pbzero_enum_AndroidAflags::FlagStorageBackend;
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum FlagType : int32_t;
-}  // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_FlagType = perfetto_pbzero_enum_AndroidAflags::FlagType;
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum ValuePickedFrom : int32_t;
-}  // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_ValuePickedFrom = perfetto_pbzero_enum_AndroidAflags::ValuePickedFrom;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum FlagPermission : int32_t {
-  FLAG_PERMISSION_UNSPECIFIED = 0,
-  FLAG_PERMISSION_READ_ONLY = 1,
-  FLAG_PERMISSION_READ_WRITE = 2,
-};
-} // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_FlagPermission = perfetto_pbzero_enum_AndroidAflags::FlagPermission;
-
-
-constexpr AndroidAflags_FlagPermission AndroidAflags_FlagPermission_MIN = AndroidAflags_FlagPermission::FLAG_PERMISSION_UNSPECIFIED;
-constexpr AndroidAflags_FlagPermission AndroidAflags_FlagPermission_MAX = AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_WRITE;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* AndroidAflags_FlagPermission_Name(::perfetto::protos::pbzero::AndroidAflags_FlagPermission value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_UNSPECIFIED:
-    return "FLAG_PERMISSION_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_ONLY:
-    return "FLAG_PERMISSION_READ_ONLY";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_WRITE:
-    return "FLAG_PERMISSION_READ_WRITE";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum ValuePickedFrom : int32_t {
-  VALUE_PICKED_FROM_UNSPECIFIED = 0,
-  VALUE_PICKED_FROM_DEFAULT = 1,
-  VALUE_PICKED_FROM_SERVER = 2,
-  VALUE_PICKED_FROM_LOCAL = 3,
-};
-} // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_ValuePickedFrom = perfetto_pbzero_enum_AndroidAflags::ValuePickedFrom;
-
-
-constexpr AndroidAflags_ValuePickedFrom AndroidAflags_ValuePickedFrom_MIN = AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED;
-constexpr AndroidAflags_ValuePickedFrom AndroidAflags_ValuePickedFrom_MAX = AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_LOCAL;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* AndroidAflags_ValuePickedFrom_Name(::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED:
-    return "VALUE_PICKED_FROM_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_DEFAULT:
-    return "VALUE_PICKED_FROM_DEFAULT";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_SERVER:
-    return "VALUE_PICKED_FROM_SERVER";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_LOCAL:
-    return "VALUE_PICKED_FROM_LOCAL";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum FlagStorageBackend : int32_t {
-  FLAG_STORAGE_BACKEND_UNSPECIFIED = 0,
-  FLAG_STORAGE_BACKEND_NONE = 1,
-  FLAG_STORAGE_BACKEND_ACONFIGD = 2,
-  FLAG_STORAGE_BACKEND_DEVICE_CONFIG = 3,
-};
-} // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_FlagStorageBackend = perfetto_pbzero_enum_AndroidAflags::FlagStorageBackend;
-
-
-constexpr AndroidAflags_FlagStorageBackend AndroidAflags_FlagStorageBackend_MIN = AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED;
-constexpr AndroidAflags_FlagStorageBackend AndroidAflags_FlagStorageBackend_MAX = AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* AndroidAflags_FlagStorageBackend_Name(::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED:
-    return "FLAG_STORAGE_BACKEND_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_NONE:
-    return "FLAG_STORAGE_BACKEND_NONE";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_ACONFIGD:
-    return "FLAG_STORAGE_BACKEND_ACONFIGD";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG:
-    return "FLAG_STORAGE_BACKEND_DEVICE_CONFIG";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_AndroidAflags {
-enum FlagType : int32_t {
-  FLAG_TYPE_UNSPECIFIED = 0,
-  FLAG_TYPE_BOOLEAN = 1,
-  FLAG_TYPE_INTEGER = 2,
-};
-} // namespace perfetto_pbzero_enum_AndroidAflags
-using AndroidAflags_FlagType = perfetto_pbzero_enum_AndroidAflags::FlagType;
-
-
-constexpr AndroidAflags_FlagType AndroidAflags_FlagType_MIN = AndroidAflags_FlagType::FLAG_TYPE_UNSPECIFIED;
-constexpr AndroidAflags_FlagType AndroidAflags_FlagType_MAX = AndroidAflags_FlagType::FLAG_TYPE_INTEGER;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* AndroidAflags_FlagType_Name(::perfetto::protos::pbzero::AndroidAflags_FlagType value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_UNSPECIFIED:
-    return "FLAG_TYPE_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_BOOLEAN:
-    return "FLAG_TYPE_BOOLEAN";
-
-  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_INTEGER:
-    return "FLAG_TYPE_INTEGER";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-class AndroidAflags_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
- public:
-  AndroidAflags_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidAflags_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidAflags_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_flags() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> flags() const { return GetRepeated<::protozero::ConstBytes>(1); }
-  bool has_error() const { return at<2>().valid(); }
-  ::protozero::ConstChars error() const { return at<2>().as_string(); }
-};
-
-class AndroidAflags : public ::protozero::Message {
- public:
-  using Decoder = AndroidAflags_Decoder;
-  enum : int32_t {
-    kFlagsFieldNumber = 1,
-    kErrorFieldNumber = 2,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflags"; }
-
-  using Flag = ::perfetto::protos::pbzero::AndroidAflags_Flag;
-
-  using FlagPermission = ::perfetto::protos::pbzero::AndroidAflags_FlagPermission;
-  static inline const char* FlagPermission_Name(FlagPermission value) {
-    return ::perfetto::protos::pbzero::AndroidAflags_FlagPermission_Name(value);
-  }
-
-  using ValuePickedFrom = ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom;
-  static inline const char* ValuePickedFrom_Name(ValuePickedFrom value) {
-    return ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom_Name(value);
-  }
-
-  using FlagStorageBackend = ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend;
-  static inline const char* FlagStorageBackend_Name(FlagStorageBackend value) {
-    return ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend_Name(value);
-  }
-
-  using FlagType = ::perfetto::protos::pbzero::AndroidAflags_FlagType;
-  static inline const char* FlagType_Name(FlagType value) {
-    return ::perfetto::protos::pbzero::AndroidAflags_FlagType_Name(value);
-  }
-  static inline const FlagPermission FLAG_PERMISSION_UNSPECIFIED = FlagPermission::FLAG_PERMISSION_UNSPECIFIED;
-  static inline const FlagPermission FLAG_PERMISSION_READ_ONLY = FlagPermission::FLAG_PERMISSION_READ_ONLY;
-  static inline const FlagPermission FLAG_PERMISSION_READ_WRITE = FlagPermission::FLAG_PERMISSION_READ_WRITE;
-  static inline const ValuePickedFrom VALUE_PICKED_FROM_UNSPECIFIED = ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED;
-  static inline const ValuePickedFrom VALUE_PICKED_FROM_DEFAULT = ValuePickedFrom::VALUE_PICKED_FROM_DEFAULT;
-  static inline const ValuePickedFrom VALUE_PICKED_FROM_SERVER = ValuePickedFrom::VALUE_PICKED_FROM_SERVER;
-  static inline const ValuePickedFrom VALUE_PICKED_FROM_LOCAL = ValuePickedFrom::VALUE_PICKED_FROM_LOCAL;
-  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_UNSPECIFIED = FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED;
-  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_NONE = FlagStorageBackend::FLAG_STORAGE_BACKEND_NONE;
-  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_ACONFIGD = FlagStorageBackend::FLAG_STORAGE_BACKEND_ACONFIGD;
-  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_DEVICE_CONFIG = FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG;
-  static inline const FlagType FLAG_TYPE_UNSPECIFIED = FlagType::FLAG_TYPE_UNSPECIFIED;
-  static inline const FlagType FLAG_TYPE_BOOLEAN = FlagType::FLAG_TYPE_BOOLEAN;
-  static inline const FlagType FLAG_TYPE_INTEGER = FlagType::FLAG_TYPE_INTEGER;
-
-  using FieldMetadata_Flags =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidAflags_Flag,
-      AndroidAflags>;
-
-  static constexpr FieldMetadata_Flags kFlags{};
-  template <typename T = AndroidAflags_Flag> T* add_flags() {
-    return BeginNestedMessage<T>(1);
-  }
-
-
-  using FieldMetadata_Error =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags>;
-
-  static constexpr FieldMetadata_Error kError{};
-  void set_error(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Error::kFieldId, data, size);
-  }
-  void set_error(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Error::kFieldId, chars.data, chars.size);
-  }
-  void set_error(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Error::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class AndroidAflags_Flag_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
- public:
-  AndroidAflags_Flag_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidAflags_Flag_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidAflags_Flag_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_flag_namespace() const { return at<1>().valid(); }
-  ::protozero::ConstChars flag_namespace() const { return at<1>().as_string(); }
-  bool has_name() const { return at<2>().valid(); }
-  ::protozero::ConstChars name() const { return at<2>().as_string(); }
-  bool has_pkg() const { return at<3>().valid(); }
-  ::protozero::ConstChars pkg() const { return at<3>().as_string(); }
-  bool has_container() const { return at<4>().valid(); }
-  ::protozero::ConstChars container() const { return at<4>().as_string(); }
-  bool has_value() const { return at<5>().valid(); }
-  ::protozero::ConstChars value() const { return at<5>().as_string(); }
-  bool has_staged_value() const { return at<6>().valid(); }
-  ::protozero::ConstChars staged_value() const { return at<6>().as_string(); }
-  bool has_permission() const { return at<7>().valid(); }
-  int32_t permission() const { return at<7>().as_int32(); }
-  bool has_value_picked_from() const { return at<8>().valid(); }
-  int32_t value_picked_from() const { return at<8>().as_int32(); }
-  bool has_storage_backend() const { return at<9>().valid(); }
-  int32_t storage_backend() const { return at<9>().as_int32(); }
-  bool has_type() const { return at<10>().valid(); }
-  int32_t type() const { return at<10>().as_int32(); }
-};
-
-class AndroidAflags_Flag : public ::protozero::Message {
- public:
-  using Decoder = AndroidAflags_Flag_Decoder;
-  enum : int32_t {
-    kFlagNamespaceFieldNumber = 1,
-    kNameFieldNumber = 2,
-    kPkgFieldNumber = 3,
-    kContainerFieldNumber = 4,
-    kValueFieldNumber = 5,
-    kStagedValueFieldNumber = 6,
-    kPermissionFieldNumber = 7,
-    kValuePickedFromFieldNumber = 8,
-    kStorageBackendFieldNumber = 9,
-    kTypeFieldNumber = 10,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflags.Flag"; }
-
-
-  using FieldMetadata_FlagNamespace =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_FlagNamespace kFlagNamespace{};
-  void set_flag_namespace(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_FlagNamespace::kFieldId, data, size);
-  }
-  void set_flag_namespace(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_FlagNamespace::kFieldId, chars.data, chars.size);
-  }
-  void set_flag_namespace(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_FlagNamespace::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Pkg =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_Pkg kPkg{};
-  void set_pkg(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Pkg::kFieldId, data, size);
-  }
-  void set_pkg(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Pkg::kFieldId, chars.data, chars.size);
-  }
-  void set_pkg(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pkg::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Container =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_Container kContainer{};
-  void set_container(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Container::kFieldId, data, size);
-  }
-  void set_container(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Container::kFieldId, chars.data, chars.size);
-  }
-  void set_container(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Container::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Value =
-    ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
-  }
-  void set_value(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
-  }
-  void set_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StagedValue =
-    ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_StagedValue kStagedValue{};
-  void set_staged_value(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_StagedValue::kFieldId, data, size);
-  }
-  void set_staged_value(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_StagedValue::kFieldId, chars.data, chars.size);
-  }
-  void set_staged_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_StagedValue::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Permission =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidAflags_FlagPermission,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_Permission kPermission{};
-  void set_permission(AndroidAflags_FlagPermission value) {
-    static constexpr uint32_t field_id = FieldMetadata_Permission::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ValuePickedFrom =
-    ::protozero::proto_utils::FieldMetadata<
-      8,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidAflags_ValuePickedFrom,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_ValuePickedFrom kValuePickedFrom{};
-  void set_value_picked_from(AndroidAflags_ValuePickedFrom value) {
-    static constexpr uint32_t field_id = FieldMetadata_ValuePickedFrom::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_StorageBackend =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidAflags_FlagStorageBackend,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_StorageBackend kStorageBackend{};
-  void set_storage_backend(AndroidAflags_FlagStorageBackend value) {
-    static constexpr uint32_t field_id = FieldMetadata_StorageBackend::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Type =
-    ::protozero::proto_utils::FieldMetadata<
-      10,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidAflags_FlagType,
-      AndroidAflags_Flag>;
-
-  static constexpr FieldMetadata_Type kType{};
-  void set_type(AndroidAflags_FlagType value) {
-    static constexpr uint32_t field_id = FieldMetadata_Type::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_game_intervention_list.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_GAME_INTERVENTION_LIST_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_GAME_INTERVENTION_LIST_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class AndroidGameInterventionList_GameModeInfo;
-class AndroidGameInterventionList_GamePackageInfo;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class AndroidGameInterventionList_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
- public:
-  AndroidGameInterventionList_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidGameInterventionList_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidGameInterventionList_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_game_packages() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> game_packages() const { return GetRepeated<::protozero::ConstBytes>(1); }
-  bool has_parse_error() const { return at<2>().valid(); }
-  bool parse_error() const { return at<2>().as_bool(); }
-  bool has_read_error() const { return at<3>().valid(); }
-  bool read_error() const { return at<3>().as_bool(); }
-};
-
-class AndroidGameInterventionList : public ::protozero::Message {
- public:
-  using Decoder = AndroidGameInterventionList_Decoder;
-  enum : int32_t {
-    kGamePackagesFieldNumber = 1,
-    kParseErrorFieldNumber = 2,
-    kReadErrorFieldNumber = 3,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidGameInterventionList"; }
-
-  using GameModeInfo = ::perfetto::protos::pbzero::AndroidGameInterventionList_GameModeInfo;
-  using GamePackageInfo = ::perfetto::protos::pbzero::AndroidGameInterventionList_GamePackageInfo;
-
-  using FieldMetadata_GamePackages =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidGameInterventionList_GamePackageInfo,
-      AndroidGameInterventionList>;
-
-  static constexpr FieldMetadata_GamePackages kGamePackages{};
-  template <typename T = AndroidGameInterventionList_GamePackageInfo> T* add_game_packages() {
-    return BeginNestedMessage<T>(1);
-  }
-
-
-  using FieldMetadata_ParseError =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      AndroidGameInterventionList>;
-
-  static constexpr FieldMetadata_ParseError kParseError{};
-  void set_parse_error(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ParseError::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_ReadError =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      AndroidGameInterventionList>;
-
-  static constexpr FieldMetadata_ReadError kReadError{};
-  void set_read_error(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_ReadError::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
-        ::Append(*this, field_id, value);
-  }
-};
-
-class AndroidGameInterventionList_GamePackageInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  AndroidGameInterventionList_GamePackageInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidGameInterventionList_GamePackageInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidGameInterventionList_GamePackageInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars name() const { return at<1>().as_string(); }
-  bool has_uid() const { return at<2>().valid(); }
-  uint64_t uid() const { return at<2>().as_uint64(); }
-  bool has_current_mode() const { return at<3>().valid(); }
-  uint32_t current_mode() const { return at<3>().as_uint32(); }
-  bool has_game_mode_info() const { return at<4>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> game_mode_info() const { return GetRepeated<::protozero::ConstBytes>(4); }
-};
-
-class AndroidGameInterventionList_GamePackageInfo : public ::protozero::Message {
- public:
-  using Decoder = AndroidGameInterventionList_GamePackageInfo_Decoder;
-  enum : int32_t {
-    kNameFieldNumber = 1,
-    kUidFieldNumber = 2,
-    kCurrentModeFieldNumber = 3,
-    kGameModeInfoFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidGameInterventionList.GamePackageInfo"; }
-
-
-  using FieldMetadata_Name =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidGameInterventionList_GamePackageInfo>;
-
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_Uid =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidGameInterventionList_GamePackageInfo>;
-
-  static constexpr FieldMetadata_Uid kUid{};
-  void set_uid(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_CurrentMode =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      AndroidGameInterventionList_GamePackageInfo>;
-
-  static constexpr FieldMetadata_CurrentMode kCurrentMode{};
-  void set_current_mode(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CurrentMode::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_GameModeInfo =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidGameInterventionList_GameModeInfo,
-      AndroidGameInterventionList_GamePackageInfo>;
-
-  static constexpr FieldMetadata_GameModeInfo kGameModeInfo{};
-  template <typename T = AndroidGameInterventionList_GameModeInfo> T* add_game_mode_info() {
-    return BeginNestedMessage<T>(4);
-  }
-
-};
-
-class AndroidGameInterventionList_GameModeInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
- public:
-  AndroidGameInterventionList_GameModeInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidGameInterventionList_GameModeInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidGameInterventionList_GameModeInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_mode() const { return at<1>().valid(); }
-  uint32_t mode() const { return at<1>().as_uint32(); }
-  bool has_use_angle() const { return at<2>().valid(); }
-  bool use_angle() const { return at<2>().as_bool(); }
-  bool has_resolution_downscale() const { return at<3>().valid(); }
-  float resolution_downscale() const { return at<3>().as_float(); }
-  bool has_fps() const { return at<4>().valid(); }
-  float fps() const { return at<4>().as_float(); }
-};
-
-class AndroidGameInterventionList_GameModeInfo : public ::protozero::Message {
- public:
-  using Decoder = AndroidGameInterventionList_GameModeInfo_Decoder;
-  enum : int32_t {
-    kModeFieldNumber = 1,
-    kUseAngleFieldNumber = 2,
-    kResolutionDownscaleFieldNumber = 3,
-    kFpsFieldNumber = 4,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidGameInterventionList.GameModeInfo"; }
-
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 
-  using FieldMetadata_Mode =
+  using FieldMetadata_DestinationClass =
     ::protozero::proto_utils::FieldMetadata<
-      1,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      AndroidGameInterventionList_GameModeInfo>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceConfig_IncidentReportConfig>;
 
-  static constexpr FieldMetadata_Mode kMode{};
-  void set_mode(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Mode::kFieldId;
+  static constexpr FieldMetadata_DestinationClass kDestinationClass{};
+  void set_destination_class(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_DestinationClass::kFieldId, data, size);
+  }
+  void set_destination_class(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_DestinationClass::kFieldId, chars.data, chars.size);
+  }
+  void set_destination_class(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_DestinationClass::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_UseAngle =
+  using FieldMetadata_PrivacyLevel =
     ::protozero::proto_utils::FieldMetadata<
-      2,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      AndroidGameInterventionList_GameModeInfo>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      TraceConfig_IncidentReportConfig>;
 
-  static constexpr FieldMetadata_UseAngle kUseAngle{};
-  void set_use_angle(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_UseAngle::kFieldId;
+  static constexpr FieldMetadata_PrivacyLevel kPrivacyLevel{};
+  void set_privacy_level(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PrivacyLevel::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_ResolutionDownscale =
+  using FieldMetadata_SkipIncidentd =
     ::protozero::proto_utils::FieldMetadata<
-      3,
+      5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      AndroidGameInterventionList_GameModeInfo>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_IncidentReportConfig>;
 
-  static constexpr FieldMetadata_ResolutionDownscale kResolutionDownscale{};
-  void set_resolution_downscale(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_ResolutionDownscale::kFieldId;
+  static constexpr FieldMetadata_SkipIncidentd kSkipIncidentd{};
+  void set_skip_incidentd(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_SkipIncidentd::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Fps =
+  using FieldMetadata_SkipDropbox =
     ::protozero::proto_utils::FieldMetadata<
       4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      AndroidGameInterventionList_GameModeInfo>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_IncidentReportConfig>;
 
-  static constexpr FieldMetadata_Fps kFps{};
-  void set_fps(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_Fps::kFieldId;
+  static constexpr FieldMetadata_SkipDropbox kSkipDropbox{};
+  void set_skip_dropbox(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_SkipDropbox::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 };
 
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_log.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_LOG_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_LOG_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class AndroidLogPacket_LogEvent;
-class AndroidLogPacket_LogEvent_Arg;
-class AndroidLogPacket_Stats;
-enum AndroidLogId : int32_t;
-enum AndroidLogPriority : int32_t;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-class AndroidLogPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class TraceConfig_CompressionConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
-  AndroidLogPacket_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidLogPacket_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidLogPacket_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_events() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> events() const { return GetRepeated<::protozero::ConstBytes>(1); }
-  bool has_stats() const { return at<2>().valid(); }
-  ::protozero::ConstBytes stats() const { return at<2>().as_bytes(); }
+  TraceConfig_CompressionConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_CompressionConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_CompressionConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_deflate() const { return at<1>().valid(); }
+  ::protozero::ConstBytes deflate() const { return at<1>().as_bytes(); }
+  bool has_zstd() const { return at<2>().valid(); }
+  ::protozero::ConstBytes zstd() const { return at<2>().as_bytes(); }
 };
 
-class AndroidLogPacket : public ::protozero::Message {
+class TraceConfig_CompressionConfig : public ::protozero::Message {
  public:
-  using Decoder = AndroidLogPacket_Decoder;
+  using Decoder = TraceConfig_CompressionConfig_Decoder;
   enum : int32_t {
-    kEventsFieldNumber = 1,
-    kStatsFieldNumber = 2,
+    kDeflateFieldNumber = 1,
+    kZstdFieldNumber = 2,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.CompressionConfig"; }
 
-  using LogEvent = ::perfetto::protos::pbzero::AndroidLogPacket_LogEvent;
-  using Stats = ::perfetto::protos::pbzero::AndroidLogPacket_Stats;
+  using Deflate = ::perfetto::protos::pbzero::TraceConfig_CompressionConfig_Deflate;
+  using Zstd = ::perfetto::protos::pbzero::TraceConfig_CompressionConfig_Zstd;
 
-  using FieldMetadata_Events =
+  using FieldMetadata_Deflate =
     ::protozero::proto_utils::FieldMetadata<
       1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidLogPacket_LogEvent,
-      AndroidLogPacket>;
+      TraceConfig_CompressionConfig_Deflate,
+      TraceConfig_CompressionConfig>;
 
-  static constexpr FieldMetadata_Events kEvents{};
-  template <typename T = AndroidLogPacket_LogEvent> T* add_events() {
+  static constexpr FieldMetadata_Deflate kDeflate{};
+  template <typename T = TraceConfig_CompressionConfig_Deflate> T* set_deflate() {
     return BeginNestedMessage<T>(1);
   }
 
 
-  using FieldMetadata_Stats =
+  using FieldMetadata_Zstd =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidLogPacket_Stats,
-      AndroidLogPacket>;
+      TraceConfig_CompressionConfig_Zstd,
+      TraceConfig_CompressionConfig>;
 
-  static constexpr FieldMetadata_Stats kStats{};
-  template <typename T = AndroidLogPacket_Stats> T* set_stats() {
+  static constexpr FieldMetadata_Zstd kZstd{};
+  template <typename T = TraceConfig_CompressionConfig_Zstd> T* set_zstd() {
     return BeginNestedMessage<T>(2);
   }
 
 };
 
-class AndroidLogPacket_Stats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class TraceConfig_CompressionConfig_Zstd_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
  public:
-  AndroidLogPacket_Stats_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidLogPacket_Stats_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidLogPacket_Stats_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_num_total() const { return at<1>().valid(); }
-  uint64_t num_total() const { return at<1>().as_uint64(); }
-  bool has_num_failed() const { return at<2>().valid(); }
-  uint64_t num_failed() const { return at<2>().as_uint64(); }
-  bool has_num_skipped() const { return at<3>().valid(); }
-  uint64_t num_skipped() const { return at<3>().as_uint64(); }
+  TraceConfig_CompressionConfig_Zstd_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_CompressionConfig_Zstd_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_CompressionConfig_Zstd_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_level() const { return at<1>().valid(); }
+  int32_t level() const { return at<1>().as_int32(); }
 };
 
-class AndroidLogPacket_Stats : public ::protozero::Message {
+class TraceConfig_CompressionConfig_Zstd : public ::protozero::Message {
  public:
-  using Decoder = AndroidLogPacket_Stats_Decoder;
+  using Decoder = TraceConfig_CompressionConfig_Zstd_Decoder;
   enum : int32_t {
-    kNumTotalFieldNumber = 1,
-    kNumFailedFieldNumber = 2,
-    kNumSkippedFieldNumber = 3,
+    kLevelFieldNumber = 1,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket.Stats"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.CompressionConfig.Zstd"; }
 
 
-  using FieldMetadata_NumTotal =
+  using FieldMetadata_Level =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidLogPacket_Stats>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      TraceConfig_CompressionConfig_Zstd>;
 
-  static constexpr FieldMetadata_NumTotal kNumTotal{};
-  void set_num_total(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NumTotal::kFieldId;
+  static constexpr FieldMetadata_Level kLevel{};
+  void set_level(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Level::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
+};
 
-  using FieldMetadata_NumFailed =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidLogPacket_Stats>;
-
-  static constexpr FieldMetadata_NumFailed kNumFailed{};
-  void set_num_failed(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NumFailed::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
+class TraceConfig_CompressionConfig_Deflate_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/0> {
+ public:
+  TraceConfig_CompressionConfig_Deflate_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_CompressionConfig_Deflate_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_CompressionConfig_Deflate_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+};
 
-  using FieldMetadata_NumSkipped =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidLogPacket_Stats>;
+class TraceConfig_CompressionConfig_Deflate : public ::protozero::Message {
+ public:
+  using Decoder = TraceConfig_CompressionConfig_Deflate_Decoder;
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.CompressionConfig.Deflate"; }
 
-  static constexpr FieldMetadata_NumSkipped kNumSkipped{};
-  void set_num_skipped(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NumSkipped::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
-  }
 };
 
-class AndroidLogPacket_LogEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
+class TraceConfig_IncrementalStateConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
  public:
-  AndroidLogPacket_LogEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidLogPacket_LogEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidLogPacket_LogEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_log_id() const { return at<1>().valid(); }
-  int32_t log_id() const { return at<1>().as_int32(); }
-  bool has_pid() const { return at<2>().valid(); }
-  int32_t pid() const { return at<2>().as_int32(); }
-  bool has_tid() const { return at<3>().valid(); }
-  int32_t tid() const { return at<3>().as_int32(); }
-  bool has_uid() const { return at<4>().valid(); }
-  int32_t uid() const { return at<4>().as_int32(); }
-  bool has_timestamp() const { return at<5>().valid(); }
-  uint64_t timestamp() const { return at<5>().as_uint64(); }
-  bool has_tag() const { return at<6>().valid(); }
-  ::protozero::ConstChars tag() const { return at<6>().as_string(); }
-  bool has_prio() const { return at<7>().valid(); }
-  int32_t prio() const { return at<7>().as_int32(); }
-  bool has_message() const { return at<8>().valid(); }
-  ::protozero::ConstChars message() const { return at<8>().as_string(); }
-  bool has_args() const { return at<9>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> args() const { return GetRepeated<::protozero::ConstBytes>(9); }
+  TraceConfig_IncrementalStateConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_IncrementalStateConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_IncrementalStateConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_clear_period_ms() const { return at<1>().valid(); }
+  uint32_t clear_period_ms() const { return at<1>().as_uint32(); }
 };
 
-class AndroidLogPacket_LogEvent : public ::protozero::Message {
+class TraceConfig_IncrementalStateConfig : public ::protozero::Message {
  public:
-  using Decoder = AndroidLogPacket_LogEvent_Decoder;
+  using Decoder = TraceConfig_IncrementalStateConfig_Decoder;
   enum : int32_t {
-    kLogIdFieldNumber = 1,
-    kPidFieldNumber = 2,
-    kTidFieldNumber = 3,
-    kUidFieldNumber = 4,
-    kTimestampFieldNumber = 5,
-    kTagFieldNumber = 6,
-    kPrioFieldNumber = 7,
-    kMessageFieldNumber = 8,
-    kArgsFieldNumber = 9,
+    kClearPeriodMsFieldNumber = 1,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket.LogEvent"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.IncrementalStateConfig"; }
 
-  using Arg = ::perfetto::protos::pbzero::AndroidLogPacket_LogEvent_Arg;
 
-  using FieldMetadata_LogId =
+  using FieldMetadata_ClearPeriodMs =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidLogId,
-      AndroidLogPacket_LogEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_IncrementalStateConfig>;
 
-  static constexpr FieldMetadata_LogId kLogId{};
-  void set_log_id(AndroidLogId value) {
-    static constexpr uint32_t field_id = FieldMetadata_LogId::kFieldId;
+  static constexpr FieldMetadata_ClearPeriodMs kClearPeriodMs{};
+  void set_clear_period_ms(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ClearPeriodMs::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
+};
 
-  using FieldMetadata_Pid =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidLogPacket_LogEvent>;
+class TraceConfig_TriggerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+ public:
+  TraceConfig_TriggerConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_TriggerConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_TriggerConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_trigger_mode() const { return at<1>().valid(); }
+  int32_t trigger_mode() const { return at<1>().as_int32(); }
+  bool has_use_clone_snapshot_if_available() const { return at<5>().valid(); }
+  bool use_clone_snapshot_if_available() const { return at<5>().as_bool(); }
+  bool has_triggers() const { return at<2>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> triggers() const { return GetRepeated<::protozero::ConstBytes>(2); }
+  bool has_trigger_timeout_ms() const { return at<3>().valid(); }
+  uint32_t trigger_timeout_ms() const { return at<3>().as_uint32(); }
+};
 
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
-  }
+class TraceConfig_TriggerConfig : public ::protozero::Message {
+ public:
+  using Decoder = TraceConfig_TriggerConfig_Decoder;
+  enum : int32_t {
+    kTriggerModeFieldNumber = 1,
+    kUseCloneSnapshotIfAvailableFieldNumber = 5,
+    kTriggersFieldNumber = 2,
+    kTriggerTimeoutMsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.TriggerConfig"; }
 
-  using FieldMetadata_Tid =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidLogPacket_LogEvent>;
+  using Trigger = ::perfetto::protos::pbzero::TraceConfig_TriggerConfig_Trigger;
 
-  static constexpr FieldMetadata_Tid kTid{};
-  void set_tid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  using TriggerMode = ::perfetto::protos::pbzero::TraceConfig_TriggerConfig_TriggerMode;
+  static inline const char* TriggerMode_Name(TriggerMode value) {
+    return ::perfetto::protos::pbzero::TraceConfig_TriggerConfig_TriggerMode_Name(value);
   }
+  static inline const TriggerMode UNSPECIFIED = TriggerMode::UNSPECIFIED;
+  static inline const TriggerMode START_TRACING = TriggerMode::START_TRACING;
+  static inline const TriggerMode STOP_TRACING = TriggerMode::STOP_TRACING;
+  static inline const TriggerMode CLONE_SNAPSHOT = TriggerMode::CLONE_SNAPSHOT;
 
-  using FieldMetadata_Uid =
+  using FieldMetadata_TriggerMode =
     ::protozero::proto_utils::FieldMetadata<
-      4,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidLogPacket_LogEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      TraceConfig_TriggerConfig_TriggerMode,
+      TraceConfig_TriggerConfig>;
 
-  static constexpr FieldMetadata_Uid kUid{};
-  void set_uid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
+  static constexpr FieldMetadata_TriggerMode kTriggerMode{};
+  void set_trigger_mode(TraceConfig_TriggerConfig_TriggerMode value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggerMode::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Timestamp =
+  using FieldMetadata_UseCloneSnapshotIfAvailable =
     ::protozero::proto_utils::FieldMetadata<
       5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidLogPacket_LogEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_TriggerConfig>;
 
-  static constexpr FieldMetadata_Timestamp kTimestamp{};
-  void set_timestamp(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Timestamp::kFieldId;
+  static constexpr FieldMetadata_UseCloneSnapshotIfAvailable kUseCloneSnapshotIfAvailable{};
+  void set_use_clone_snapshot_if_available(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_UseCloneSnapshotIfAvailable::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Tag =
+  using FieldMetadata_Triggers =
     ::protozero::proto_utils::FieldMetadata<
-      6,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidLogPacket_LogEvent>;
+      2,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      TraceConfig_TriggerConfig_Trigger,
+      TraceConfig_TriggerConfig>;
 
-  static constexpr FieldMetadata_Tag kTag{};
-  void set_tag(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Tag::kFieldId, data, size);
-  }
-  void set_tag(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Tag::kFieldId, chars.data, chars.size);
-  }
-  void set_tag(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Tag::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Triggers kTriggers{};
+  template <typename T = TraceConfig_TriggerConfig_Trigger> T* add_triggers() {
+    return BeginNestedMessage<T>(2);
   }
 
-  using FieldMetadata_Prio =
-    ::protozero::proto_utils::FieldMetadata<
-      7,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidLogPriority,
-      AndroidLogPacket_LogEvent>;
-
-  static constexpr FieldMetadata_Prio kPrio{};
-  void set_prio(AndroidLogPriority value) {
-    static constexpr uint32_t field_id = FieldMetadata_Prio::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
-        ::Append(*this, field_id, value);
-  }
 
-  using FieldMetadata_Message =
+  using FieldMetadata_TriggerTimeoutMs =
     ::protozero::proto_utils::FieldMetadata<
-      8,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidLogPacket_LogEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_TriggerConfig>;
 
-  static constexpr FieldMetadata_Message kMessage{};
-  void set_message(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Message::kFieldId, data, size);
-  }
-  void set_message(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Message::kFieldId, chars.data, chars.size);
-  }
-  void set_message(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Message::kFieldId;
+  static constexpr FieldMetadata_TriggerTimeoutMs kTriggerTimeoutMs{};
+  void set_trigger_timeout_ms(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggerTimeoutMs::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
-
-  using FieldMetadata_Args =
-    ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidLogPacket_LogEvent_Arg,
-      AndroidLogPacket_LogEvent>;
-
-  static constexpr FieldMetadata_Args kArgs{};
-  template <typename T = AndroidLogPacket_LogEvent_Arg> T* add_args() {
-    return BeginNestedMessage<T>(9);
-  }
-
 };
 
-class AndroidLogPacket_LogEvent_Arg_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+class TraceConfig_TriggerConfig_Trigger_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
  public:
-  AndroidLogPacket_LogEvent_Arg_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidLogPacket_LogEvent_Arg_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidLogPacket_LogEvent_Arg_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  TraceConfig_TriggerConfig_Trigger_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_TriggerConfig_Trigger_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_TriggerConfig_Trigger_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
   bool has_name() const { return at<1>().valid(); }
   ::protozero::ConstChars name() const { return at<1>().as_string(); }
-  bool has_int_value() const { return at<2>().valid(); }
-  int64_t int_value() const { return at<2>().as_int64(); }
-  bool has_float_value() const { return at<3>().valid(); }
-  float float_value() const { return at<3>().as_float(); }
-  bool has_string_value() const { return at<4>().valid(); }
-  ::protozero::ConstChars string_value() const { return at<4>().as_string(); }
+  bool has_producer_name_regex() const { return at<2>().valid(); }
+  ::protozero::ConstChars producer_name_regex() const { return at<2>().as_string(); }
+  bool has_stop_delay_ms() const { return at<3>().valid(); }
+  uint32_t stop_delay_ms() const { return at<3>().as_uint32(); }
+  bool has_max_per_24_h() const { return at<4>().valid(); }
+  uint32_t max_per_24_h() const { return at<4>().as_uint32(); }
+  bool has_skip_probability() const { return at<5>().valid(); }
+  double skip_probability() const { return at<5>().as_double(); }
 };
 
-class AndroidLogPacket_LogEvent_Arg : public ::protozero::Message {
+class TraceConfig_TriggerConfig_Trigger : public ::protozero::Message {
  public:
-  using Decoder = AndroidLogPacket_LogEvent_Arg_Decoder;
+  using Decoder = TraceConfig_TriggerConfig_Trigger_Decoder;
   enum : int32_t {
     kNameFieldNumber = 1,
-    kIntValueFieldNumber = 2,
-    kFloatValueFieldNumber = 3,
-    kStringValueFieldNumber = 4,
+    kProducerNameRegexFieldNumber = 2,
+    kStopDelayMsFieldNumber = 3,
+    kMaxPer24HFieldNumber = 4,
+    kSkipProbabilityFieldNumber = 5,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket.LogEvent.Arg"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.TriggerConfig.Trigger"; }
 
 
   using FieldMetadata_Name =
@@ -70280,7 +67941,7 @@ class AndroidLogPacket_LogEvent_Arg : public ::protozero::Message {
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      AndroidLogPacket_LogEvent_Arg>;
+      TraceConfig_TriggerConfig_Trigger>;
 
   static constexpr FieldMetadata_Name kName{};
   void set_name(const char* data, size_t size) {
@@ -70298,767 +67959,727 @@ class AndroidLogPacket_LogEvent_Arg : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_IntValue =
+  using FieldMetadata_ProducerNameRegex =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidLogPacket_LogEvent_Arg>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceConfig_TriggerConfig_Trigger>;
 
-  static constexpr FieldMetadata_IntValue kIntValue{};
-  void set_int_value(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_IntValue::kFieldId;
+  static constexpr FieldMetadata_ProducerNameRegex kProducerNameRegex{};
+  void set_producer_name_regex(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ProducerNameRegex::kFieldId, data, size);
+  }
+  void set_producer_name_regex(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ProducerNameRegex::kFieldId, chars.data, chars.size);
+  }
+  void set_producer_name_regex(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProducerNameRegex::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_FloatValue =
+  using FieldMetadata_StopDelayMs =
     ::protozero::proto_utils::FieldMetadata<
       3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      AndroidLogPacket_LogEvent_Arg>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_TriggerConfig_Trigger>;
 
-  static constexpr FieldMetadata_FloatValue kFloatValue{};
-  void set_float_value(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_FloatValue::kFieldId;
+  static constexpr FieldMetadata_StopDelayMs kStopDelayMs{};
+  void set_stop_delay_ms(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_StopDelayMs::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_StringValue =
+  using FieldMetadata_MaxPer24H =
     ::protozero::proto_utils::FieldMetadata<
       4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidLogPacket_LogEvent_Arg>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_TriggerConfig_Trigger>;
 
-  static constexpr FieldMetadata_StringValue kStringValue{};
-  void set_string_value(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_StringValue::kFieldId, data, size);
-  }
-  void set_string_value(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_StringValue::kFieldId, chars.data, chars.size);
-  }
-  void set_string_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_StringValue::kFieldId;
+  static constexpr FieldMetadata_MaxPer24H kMaxPer24H{};
+  void set_max_per_24_h(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MaxPer24H::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_system_property.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_SYSTEM_PROPERTY_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_SYSTEM_PROPERTY_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
 
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class AndroidSystemProperty_PropertyValue;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
+  using FieldMetadata_SkipProbability =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kDouble,
+      double,
+      TraceConfig_TriggerConfig_Trigger>;
 
-namespace perfetto {
-namespace protos {
-namespace pbzero {
+  static constexpr FieldMetadata_SkipProbability kSkipProbability{};
+  void set_skip_probability(double value) {
+    static constexpr uint32_t field_id = FieldMetadata_SkipProbability::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kDouble>
+        ::Append(*this, field_id, value);
+  }
+};
 
-class AndroidSystemProperty_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+class TraceConfig_GuardrailOverrides_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
-  AndroidSystemProperty_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidSystemProperty_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidSystemProperty_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_values() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> values() const { return GetRepeated<::protozero::ConstBytes>(1); }
+  TraceConfig_GuardrailOverrides_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_GuardrailOverrides_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_GuardrailOverrides_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_max_upload_per_day_bytes() const { return at<1>().valid(); }
+  uint64_t max_upload_per_day_bytes() const { return at<1>().as_uint64(); }
+  bool has_max_tracing_buffer_size_kb() const { return at<2>().valid(); }
+  uint32_t max_tracing_buffer_size_kb() const { return at<2>().as_uint32(); }
 };
 
-class AndroidSystemProperty : public ::protozero::Message {
+class TraceConfig_GuardrailOverrides : public ::protozero::Message {
  public:
-  using Decoder = AndroidSystemProperty_Decoder;
+  using Decoder = TraceConfig_GuardrailOverrides_Decoder;
   enum : int32_t {
-    kValuesFieldNumber = 1,
+    kMaxUploadPerDayBytesFieldNumber = 1,
+    kMaxTracingBufferSizeKbFieldNumber = 2,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidSystemProperty"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.GuardrailOverrides"; }
 
-  using PropertyValue = ::perfetto::protos::pbzero::AndroidSystemProperty_PropertyValue;
 
-  using FieldMetadata_Values =
+  using FieldMetadata_MaxUploadPerDayBytes =
     ::protozero::proto_utils::FieldMetadata<
       1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidSystemProperty_PropertyValue,
-      AndroidSystemProperty>;
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      TraceConfig_GuardrailOverrides>;
 
-  static constexpr FieldMetadata_Values kValues{};
-  template <typename T = AndroidSystemProperty_PropertyValue> T* add_values() {
-    return BeginNestedMessage<T>(1);
+  static constexpr FieldMetadata_MaxUploadPerDayBytes kMaxUploadPerDayBytes{};
+  void set_max_upload_per_day_bytes(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MaxUploadPerDayBytes::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_MaxTracingBufferSizeKb =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_GuardrailOverrides>;
+
+  static constexpr FieldMetadata_MaxTracingBufferSizeKb kMaxTracingBufferSizeKb{};
+  void set_max_tracing_buffer_size_kb(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_MaxTracingBufferSizeKb::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
-class AndroidSystemProperty_PropertyValue_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class TraceConfig_StatsdMetadata_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
-  AndroidSystemProperty_PropertyValue_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidSystemProperty_PropertyValue_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidSystemProperty_PropertyValue_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_name() const { return at<1>().valid(); }
-  ::protozero::ConstChars name() const { return at<1>().as_string(); }
-  bool has_value() const { return at<2>().valid(); }
-  ::protozero::ConstChars value() const { return at<2>().as_string(); }
+  TraceConfig_StatsdMetadata_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_StatsdMetadata_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_StatsdMetadata_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_triggering_alert_id() const { return at<1>().valid(); }
+  int64_t triggering_alert_id() const { return at<1>().as_int64(); }
+  bool has_triggering_config_uid() const { return at<2>().valid(); }
+  int32_t triggering_config_uid() const { return at<2>().as_int32(); }
+  bool has_triggering_config_id() const { return at<3>().valid(); }
+  int64_t triggering_config_id() const { return at<3>().as_int64(); }
+  bool has_triggering_subscription_id() const { return at<4>().valid(); }
+  int64_t triggering_subscription_id() const { return at<4>().as_int64(); }
 };
 
-class AndroidSystemProperty_PropertyValue : public ::protozero::Message {
+class TraceConfig_StatsdMetadata : public ::protozero::Message {
  public:
-  using Decoder = AndroidSystemProperty_PropertyValue_Decoder;
+  using Decoder = TraceConfig_StatsdMetadata_Decoder;
   enum : int32_t {
-    kNameFieldNumber = 1,
-    kValueFieldNumber = 2,
+    kTriggeringAlertIdFieldNumber = 1,
+    kTriggeringConfigUidFieldNumber = 2,
+    kTriggeringConfigIdFieldNumber = 3,
+    kTriggeringSubscriptionIdFieldNumber = 4,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidSystemProperty.PropertyValue"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.StatsdMetadata"; }
 
 
-  using FieldMetadata_Name =
+  using FieldMetadata_TriggeringAlertId =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidSystemProperty_PropertyValue>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      TraceConfig_StatsdMetadata>;
 
-  static constexpr FieldMetadata_Name kName{};
-  void set_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
-  }
-  void set_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
-  }
-  void set_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+  static constexpr FieldMetadata_TriggeringAlertId kTriggeringAlertId{};
+  void set_triggering_alert_id(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggeringAlertId::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Value =
+  using FieldMetadata_TriggeringConfigUid =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      AndroidSystemProperty_PropertyValue>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      TraceConfig_StatsdMetadata>;
 
-  static constexpr FieldMetadata_Value kValue{};
-  void set_value(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
-  }
-  void set_value(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
-  }
-  void set_value(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
+  static constexpr FieldMetadata_TriggeringConfigUid kTriggeringConfigUid{};
+  void set_triggering_config_uid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggeringConfigUid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
-};
-
-} // Namespace.
-} // Namespace.
-} // Namespace.
-#endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/camera_event.pbzero.h
-// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
-
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_CAMERA_EVENT_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_CAMERA_EVENT_PROTO_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
-// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-class AndroidCameraFrameEvent_CameraNodeProcessingDetails;
-class AndroidCameraSessionStats_CameraGraph;
-class AndroidCameraSessionStats_CameraGraph_CameraEdge;
-class AndroidCameraSessionStats_CameraGraph_CameraNode;
-namespace perfetto_pbzero_enum_AndroidCameraFrameEvent {
-enum CaptureResultStatus : int32_t;
-}  // namespace perfetto_pbzero_enum_AndroidCameraFrameEvent
-using AndroidCameraFrameEvent_CaptureResultStatus = perfetto_pbzero_enum_AndroidCameraFrameEvent::CaptureResultStatus;
-} // Namespace pbzero.
-} // Namespace protos.
-} // Namespace perfetto.
-
-namespace perfetto {
-namespace protos {
-namespace pbzero {
-
-namespace perfetto_pbzero_enum_AndroidCameraFrameEvent {
-enum CaptureResultStatus : int32_t {
-  STATUS_UNSPECIFIED = 0,
-  STATUS_OK = 1,
-  STATUS_EARLY_METADATA_ERROR = 2,
-  STATUS_FINAL_METADATA_ERROR = 3,
-  STATUS_BUFFER_ERROR = 4,
-  STATUS_FLUSH_ERROR = 5,
-};
-} // namespace perfetto_pbzero_enum_AndroidCameraFrameEvent
-using AndroidCameraFrameEvent_CaptureResultStatus = perfetto_pbzero_enum_AndroidCameraFrameEvent::CaptureResultStatus;
-
-
-constexpr AndroidCameraFrameEvent_CaptureResultStatus AndroidCameraFrameEvent_CaptureResultStatus_MIN = AndroidCameraFrameEvent_CaptureResultStatus::STATUS_UNSPECIFIED;
-constexpr AndroidCameraFrameEvent_CaptureResultStatus AndroidCameraFrameEvent_CaptureResultStatus_MAX = AndroidCameraFrameEvent_CaptureResultStatus::STATUS_FLUSH_ERROR;
-
 
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* AndroidCameraFrameEvent_CaptureResultStatus_Name(::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus::STATUS_UNSPECIFIED:
-    return "STATUS_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus::STATUS_OK:
-    return "STATUS_OK";
-
-  case ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus::STATUS_EARLY_METADATA_ERROR:
-    return "STATUS_EARLY_METADATA_ERROR";
+  using FieldMetadata_TriggeringConfigId =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      TraceConfig_StatsdMetadata>;
 
-  case ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus::STATUS_FINAL_METADATA_ERROR:
-    return "STATUS_FINAL_METADATA_ERROR";
+  static constexpr FieldMetadata_TriggeringConfigId kTriggeringConfigId{};
+  void set_triggering_config_id(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggeringConfigId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
+  }
 
-  case ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus::STATUS_BUFFER_ERROR:
-    return "STATUS_BUFFER_ERROR";
+  using FieldMetadata_TriggeringSubscriptionId =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      TraceConfig_StatsdMetadata>;
 
-  case ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus::STATUS_FLUSH_ERROR:
-    return "STATUS_FLUSH_ERROR";
+  static constexpr FieldMetadata_TriggeringSubscriptionId kTriggeringSubscriptionId{};
+  void set_triggering_subscription_id(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggeringSubscriptionId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+        ::Append(*this, field_id, value);
   }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
+};
 
-class AndroidCameraSessionStats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class TraceConfig_ProducerConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
  public:
-  AndroidCameraSessionStats_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidCameraSessionStats_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidCameraSessionStats_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_session_id() const { return at<1>().valid(); }
-  uint64_t session_id() const { return at<1>().as_uint64(); }
-  bool has_graph() const { return at<2>().valid(); }
-  ::protozero::ConstBytes graph() const { return at<2>().as_bytes(); }
+  TraceConfig_ProducerConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_ProducerConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_ProducerConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_producer_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars producer_name() const { return at<1>().as_string(); }
+  bool has_shm_size_kb() const { return at<2>().valid(); }
+  uint32_t shm_size_kb() const { return at<2>().as_uint32(); }
+  bool has_page_size_kb() const { return at<3>().valid(); }
+  uint32_t page_size_kb() const { return at<3>().as_uint32(); }
 };
 
-class AndroidCameraSessionStats : public ::protozero::Message {
+class TraceConfig_ProducerConfig : public ::protozero::Message {
  public:
-  using Decoder = AndroidCameraSessionStats_Decoder;
+  using Decoder = TraceConfig_ProducerConfig_Decoder;
   enum : int32_t {
-    kSessionIdFieldNumber = 1,
-    kGraphFieldNumber = 2,
+    kProducerNameFieldNumber = 1,
+    kShmSizeKbFieldNumber = 2,
+    kPageSizeKbFieldNumber = 3,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidCameraSessionStats"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.ProducerConfig"; }
 
-  using CameraGraph = ::perfetto::protos::pbzero::AndroidCameraSessionStats_CameraGraph;
 
-  using FieldMetadata_SessionId =
+  using FieldMetadata_ProducerName =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidCameraSessionStats>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceConfig_ProducerConfig>;
 
-  static constexpr FieldMetadata_SessionId kSessionId{};
-  void set_session_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SessionId::kFieldId;
+  static constexpr FieldMetadata_ProducerName kProducerName{};
+  void set_producer_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ProducerName::kFieldId, data, size);
+  }
+  void set_producer_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ProducerName::kFieldId, chars.data, chars.size);
+  }
+  void set_producer_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProducerName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Graph =
+  using FieldMetadata_ShmSizeKb =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidCameraSessionStats_CameraGraph,
-      AndroidCameraSessionStats>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_ProducerConfig>;
 
-  static constexpr FieldMetadata_Graph kGraph{};
-  template <typename T = AndroidCameraSessionStats_CameraGraph> T* set_graph() {
-    return BeginNestedMessage<T>(2);
+  static constexpr FieldMetadata_ShmSizeKb kShmSizeKb{};
+  void set_shm_size_kb(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ShmSizeKb::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_PageSizeKb =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_ProducerConfig>;
+
+  static constexpr FieldMetadata_PageSizeKb kPageSizeKb{};
+  void set_page_size_kb(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PageSizeKb::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
-class AndroidCameraSessionStats_CameraGraph_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+class TraceConfig_BuiltinDataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
  public:
-  AndroidCameraSessionStats_CameraGraph_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidCameraSessionStats_CameraGraph_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidCameraSessionStats_CameraGraph_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_nodes() const { return at<1>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> nodes() const { return GetRepeated<::protozero::ConstBytes>(1); }
-  bool has_edges() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> edges() const { return GetRepeated<::protozero::ConstBytes>(2); }
+  TraceConfig_BuiltinDataSource_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_BuiltinDataSource_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_BuiltinDataSource_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_disable_clock_snapshotting() const { return at<1>().valid(); }
+  bool disable_clock_snapshotting() const { return at<1>().as_bool(); }
+  bool has_disable_trace_config() const { return at<2>().valid(); }
+  bool disable_trace_config() const { return at<2>().as_bool(); }
+  bool has_disable_system_info() const { return at<3>().valid(); }
+  bool disable_system_info() const { return at<3>().as_bool(); }
+  bool has_disable_service_events() const { return at<4>().valid(); }
+  bool disable_service_events() const { return at<4>().as_bool(); }
+  bool has_primary_trace_clock() const { return at<5>().valid(); }
+  int32_t primary_trace_clock() const { return at<5>().as_int32(); }
+  bool has_snapshot_interval_ms() const { return at<6>().valid(); }
+  uint32_t snapshot_interval_ms() const { return at<6>().as_uint32(); }
+  bool has_prefer_suspend_clock_for_snapshot() const { return at<7>().valid(); }
+  bool prefer_suspend_clock_for_snapshot() const { return at<7>().as_bool(); }
+  bool has_disable_chunk_usage_histograms() const { return at<8>().valid(); }
+  bool disable_chunk_usage_histograms() const { return at<8>().as_bool(); }
+  bool has_disable_extension_descriptors() const { return at<9>().valid(); }
+  bool disable_extension_descriptors() const { return at<9>().as_bool(); }
+  bool has_enable_concurrent_session_events() const { return at<10>().valid(); }
+  bool enable_concurrent_session_events() const { return at<10>().as_bool(); }
 };
 
-class AndroidCameraSessionStats_CameraGraph : public ::protozero::Message {
+class TraceConfig_BuiltinDataSource : public ::protozero::Message {
  public:
-  using Decoder = AndroidCameraSessionStats_CameraGraph_Decoder;
+  using Decoder = TraceConfig_BuiltinDataSource_Decoder;
   enum : int32_t {
-    kNodesFieldNumber = 1,
-    kEdgesFieldNumber = 2,
+    kDisableClockSnapshottingFieldNumber = 1,
+    kDisableTraceConfigFieldNumber = 2,
+    kDisableSystemInfoFieldNumber = 3,
+    kDisableServiceEventsFieldNumber = 4,
+    kPrimaryTraceClockFieldNumber = 5,
+    kSnapshotIntervalMsFieldNumber = 6,
+    kPreferSuspendClockForSnapshotFieldNumber = 7,
+    kDisableChunkUsageHistogramsFieldNumber = 8,
+    kDisableExtensionDescriptorsFieldNumber = 9,
+    kEnableConcurrentSessionEventsFieldNumber = 10,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidCameraSessionStats.CameraGraph"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.BuiltinDataSource"; }
 
-  using CameraNode = ::perfetto::protos::pbzero::AndroidCameraSessionStats_CameraGraph_CameraNode;
-  using CameraEdge = ::perfetto::protos::pbzero::AndroidCameraSessionStats_CameraGraph_CameraEdge;
 
-  using FieldMetadata_Nodes =
+  using FieldMetadata_DisableClockSnapshotting =
     ::protozero::proto_utils::FieldMetadata<
       1,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidCameraSessionStats_CameraGraph_CameraNode,
-      AndroidCameraSessionStats_CameraGraph>;
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_Nodes kNodes{};
-  template <typename T = AndroidCameraSessionStats_CameraGraph_CameraNode> T* add_nodes() {
-    return BeginNestedMessage<T>(1);
+  static constexpr FieldMetadata_DisableClockSnapshotting kDisableClockSnapshotting{};
+  void set_disable_clock_snapshotting(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableClockSnapshotting::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
   }
 
-
-  using FieldMetadata_Edges =
+  using FieldMetadata_DisableTraceConfig =
     ::protozero::proto_utils::FieldMetadata<
       2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge,
-      AndroidCameraSessionStats_CameraGraph>;
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_Edges kEdges{};
-  template <typename T = AndroidCameraSessionStats_CameraGraph_CameraEdge> T* add_edges() {
-    return BeginNestedMessage<T>(2);
+  static constexpr FieldMetadata_DisableTraceConfig kDisableTraceConfig{};
+  void set_disable_trace_config(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableTraceConfig::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
   }
 
-};
+  using FieldMetadata_DisableSystemInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-class AndroidCameraSessionStats_CameraGraph_CameraEdge_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
- public:
-  AndroidCameraSessionStats_CameraGraph_CameraEdge_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidCameraSessionStats_CameraGraph_CameraEdge_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidCameraSessionStats_CameraGraph_CameraEdge_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_output_node_id() const { return at<1>().valid(); }
-  int64_t output_node_id() const { return at<1>().as_int64(); }
-  bool has_output_id() const { return at<2>().valid(); }
-  int64_t output_id() const { return at<2>().as_int64(); }
-  bool has_input_node_id() const { return at<3>().valid(); }
-  int64_t input_node_id() const { return at<3>().as_int64(); }
-  bool has_input_id() const { return at<4>().valid(); }
-  int64_t input_id() const { return at<4>().as_int64(); }
-  bool has_vendor_data_version() const { return at<5>().valid(); }
-  int32_t vendor_data_version() const { return at<5>().as_int32(); }
-  bool has_vendor_data() const { return at<6>().valid(); }
-  ::protozero::ConstBytes vendor_data() const { return at<6>().as_bytes(); }
-};
+  static constexpr FieldMetadata_DisableSystemInfo kDisableSystemInfo{};
+  void set_disable_system_info(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableSystemInfo::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 
-class AndroidCameraSessionStats_CameraGraph_CameraEdge : public ::protozero::Message {
- public:
-  using Decoder = AndroidCameraSessionStats_CameraGraph_CameraEdge_Decoder;
-  enum : int32_t {
-    kOutputNodeIdFieldNumber = 1,
-    kOutputIdFieldNumber = 2,
-    kInputNodeIdFieldNumber = 3,
-    kInputIdFieldNumber = 4,
-    kVendorDataVersionFieldNumber = 5,
-    kVendorDataFieldNumber = 6,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidCameraSessionStats.CameraGraph.CameraEdge"; }
+  using FieldMetadata_DisableServiceEvents =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
+  static constexpr FieldMetadata_DisableServiceEvents kDisableServiceEvents{};
+  void set_disable_service_events(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableServiceEvents::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
+        ::Append(*this, field_id, value);
+  }
 
-  using FieldMetadata_OutputNodeId =
+  using FieldMetadata_PrimaryTraceClock =
     ::protozero::proto_utils::FieldMetadata<
-      1,
+      5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      BuiltinClock,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_OutputNodeId kOutputNodeId{};
-  void set_output_node_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OutputNodeId::kFieldId;
+  static constexpr FieldMetadata_PrimaryTraceClock kPrimaryTraceClock{};
+  void set_primary_trace_clock(BuiltinClock value) {
+    static constexpr uint32_t field_id = FieldMetadata_PrimaryTraceClock::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_OutputId =
+  using FieldMetadata_SnapshotIntervalMs =
     ::protozero::proto_utils::FieldMetadata<
-      2,
+      6,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_OutputId kOutputId{};
-  void set_output_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OutputId::kFieldId;
+  static constexpr FieldMetadata_SnapshotIntervalMs kSnapshotIntervalMs{};
+  void set_snapshot_interval_ms(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SnapshotIntervalMs::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_InputNodeId =
+  using FieldMetadata_PreferSuspendClockForSnapshot =
     ::protozero::proto_utils::FieldMetadata<
-      3,
+      7,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_InputNodeId kInputNodeId{};
-  void set_input_node_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_InputNodeId::kFieldId;
+  static constexpr FieldMetadata_PreferSuspendClockForSnapshot kPreferSuspendClockForSnapshot{};
+  void set_prefer_suspend_clock_for_snapshot(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_PreferSuspendClockForSnapshot::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_InputId =
+  using FieldMetadata_DisableChunkUsageHistograms =
     ::protozero::proto_utils::FieldMetadata<
-      4,
+      8,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_InputId kInputId{};
-  void set_input_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_InputId::kFieldId;
+  static constexpr FieldMetadata_DisableChunkUsageHistograms kDisableChunkUsageHistograms{};
+  void set_disable_chunk_usage_histograms(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableChunkUsageHistograms::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_VendorDataVersion =
+  using FieldMetadata_DisableExtensionDescriptors =
     ::protozero::proto_utils::FieldMetadata<
-      5,
+      9,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_VendorDataVersion kVendorDataVersion{};
-  void set_vendor_data_version(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VendorDataVersion::kFieldId;
+  static constexpr FieldMetadata_DisableExtensionDescriptors kDisableExtensionDescriptors{};
+  void set_disable_extension_descriptors(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_DisableExtensionDescriptors::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_VendorData =
+  using FieldMetadata_EnableConcurrentSessionEvents =
     ::protozero::proto_utils::FieldMetadata<
-      6,
+      10,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
-      std::string,
-      AndroidCameraSessionStats_CameraGraph_CameraEdge>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BuiltinDataSource>;
 
-  static constexpr FieldMetadata_VendorData kVendorData{};
-  void set_vendor_data(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_VendorData::kFieldId, data, size);
-  }
-  void set_vendor_data(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_VendorData::kFieldId, bytes.data, bytes.size);
-  }
-  void set_vendor_data(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_VendorData::kFieldId;
+  static constexpr FieldMetadata_EnableConcurrentSessionEvents kEnableConcurrentSessionEvents{};
+  void set_enable_concurrent_session_events(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_EnableConcurrentSessionEvents::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 };
 
-class AndroidCameraSessionStats_CameraGraph_CameraNode_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+class TraceConfig_DataSource_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
-  AndroidCameraSessionStats_CameraGraph_CameraNode_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidCameraSessionStats_CameraGraph_CameraNode_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidCameraSessionStats_CameraGraph_CameraNode_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_node_id() const { return at<1>().valid(); }
-  int64_t node_id() const { return at<1>().as_int64(); }
-  bool has_input_ids() const { return at<2>().valid(); }
-  ::protozero::RepeatedFieldIterator<int64_t> input_ids() const { return GetRepeated<int64_t>(2); }
-  bool has_output_ids() const { return at<3>().valid(); }
-  ::protozero::RepeatedFieldIterator<int64_t> output_ids() const { return GetRepeated<int64_t>(3); }
-  bool has_vendor_data_version() const { return at<4>().valid(); }
-  int32_t vendor_data_version() const { return at<4>().as_int32(); }
-  bool has_vendor_data() const { return at<5>().valid(); }
-  ::protozero::ConstBytes vendor_data() const { return at<5>().as_bytes(); }
+  TraceConfig_DataSource_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_DataSource_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_DataSource_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_config() const { return at<1>().valid(); }
+  ::protozero::ConstBytes config() const { return at<1>().as_bytes(); }
+  bool has_producer_name_filter() const { return at<2>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> producer_name_filter() const { return GetRepeated<::protozero::ConstChars>(2); }
+  bool has_producer_name_regex_filter() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> producer_name_regex_filter() const { return GetRepeated<::protozero::ConstChars>(3); }
+  bool has_machine_name_filter() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstChars> machine_name_filter() const { return GetRepeated<::protozero::ConstChars>(4); }
 };
 
-class AndroidCameraSessionStats_CameraGraph_CameraNode : public ::protozero::Message {
+class TraceConfig_DataSource : public ::protozero::Message {
  public:
-  using Decoder = AndroidCameraSessionStats_CameraGraph_CameraNode_Decoder;
+  using Decoder = TraceConfig_DataSource_Decoder;
   enum : int32_t {
-    kNodeIdFieldNumber = 1,
-    kInputIdsFieldNumber = 2,
-    kOutputIdsFieldNumber = 3,
-    kVendorDataVersionFieldNumber = 4,
-    kVendorDataFieldNumber = 5,
+    kConfigFieldNumber = 1,
+    kProducerNameFilterFieldNumber = 2,
+    kProducerNameRegexFilterFieldNumber = 3,
+    kMachineNameFilterFieldNumber = 4,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidCameraSessionStats.CameraGraph.CameraNode"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.DataSource"; }
 
 
-  using FieldMetadata_NodeId =
+  using FieldMetadata_Config =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraNode>;
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      DataSourceConfig,
+      TraceConfig_DataSource>;
 
-  static constexpr FieldMetadata_NodeId kNodeId{};
-  void set_node_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NodeId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Config kConfig{};
+  template <typename T = DataSourceConfig> T* set_config() {
+    return BeginNestedMessage<T>(1);
   }
 
-  using FieldMetadata_InputIds =
+
+  using FieldMetadata_ProducerNameFilter =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraNode>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceConfig_DataSource>;
 
-  static constexpr FieldMetadata_InputIds kInputIds{};
-  void add_input_ids(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_InputIds::kFieldId;
+  static constexpr FieldMetadata_ProducerNameFilter kProducerNameFilter{};
+  void add_producer_name_filter(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ProducerNameFilter::kFieldId, data, size);
+  }
+  void add_producer_name_filter(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ProducerNameFilter::kFieldId, chars.data, chars.size);
+  }
+  void add_producer_name_filter(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProducerNameFilter::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_OutputIds =
+  using FieldMetadata_ProducerNameRegexFilter =
     ::protozero::proto_utils::FieldMetadata<
       3,
       ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraSessionStats_CameraGraph_CameraNode>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceConfig_DataSource>;
 
-  static constexpr FieldMetadata_OutputIds kOutputIds{};
-  void add_output_ids(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_OutputIds::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_ProducerNameRegexFilter kProducerNameRegexFilter{};
+  void add_producer_name_regex_filter(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ProducerNameRegexFilter::kFieldId, data, size);
   }
-
-  using FieldMetadata_VendorDataVersion =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidCameraSessionStats_CameraGraph_CameraNode>;
-
-  static constexpr FieldMetadata_VendorDataVersion kVendorDataVersion{};
-  void set_vendor_data_version(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VendorDataVersion::kFieldId;
+  void add_producer_name_regex_filter(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ProducerNameRegexFilter::kFieldId, chars.data, chars.size);
+  }
+  void add_producer_name_regex_filter(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProducerNameRegexFilter::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_VendorData =
+  using FieldMetadata_MachineNameFilter =
     ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
       std::string,
-      AndroidCameraSessionStats_CameraGraph_CameraNode>;
+      TraceConfig_DataSource>;
 
-  static constexpr FieldMetadata_VendorData kVendorData{};
-  void set_vendor_data(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_VendorData::kFieldId, data, size);
+  static constexpr FieldMetadata_MachineNameFilter kMachineNameFilter{};
+  void add_machine_name_filter(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_MachineNameFilter::kFieldId, data, size);
   }
-  void set_vendor_data(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_VendorData::kFieldId, bytes.data, bytes.size);
+  void add_machine_name_filter(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_MachineNameFilter::kFieldId, chars.data, chars.size);
   }
-  void set_vendor_data(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_VendorData::kFieldId;
+  void add_machine_name_filter(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_MachineNameFilter::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 };
 
-class AndroidCameraFrameEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/16> {
- public:
-  AndroidCameraFrameEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidCameraFrameEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidCameraFrameEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_session_id() const { return at<1>().valid(); }
-  uint64_t session_id() const { return at<1>().as_uint64(); }
-  bool has_camera_id() const { return at<2>().valid(); }
-  uint32_t camera_id() const { return at<2>().as_uint32(); }
-  bool has_frame_number() const { return at<3>().valid(); }
-  int64_t frame_number() const { return at<3>().as_int64(); }
-  bool has_request_id() const { return at<4>().valid(); }
-  int64_t request_id() const { return at<4>().as_int64(); }
-  bool has_request_received_ns() const { return at<5>().valid(); }
-  int64_t request_received_ns() const { return at<5>().as_int64(); }
-  bool has_request_processing_started_ns() const { return at<6>().valid(); }
-  int64_t request_processing_started_ns() const { return at<6>().as_int64(); }
-  bool has_start_of_exposure_ns() const { return at<7>().valid(); }
-  int64_t start_of_exposure_ns() const { return at<7>().as_int64(); }
-  bool has_start_of_frame_ns() const { return at<8>().valid(); }
-  int64_t start_of_frame_ns() const { return at<8>().as_int64(); }
-  bool has_responses_all_sent_ns() const { return at<9>().valid(); }
-  int64_t responses_all_sent_ns() const { return at<9>().as_int64(); }
-  bool has_capture_result_status() const { return at<10>().valid(); }
-  int32_t capture_result_status() const { return at<10>().as_int32(); }
-  bool has_skipped_sensor_frames() const { return at<11>().valid(); }
-  int32_t skipped_sensor_frames() const { return at<11>().as_int32(); }
-  bool has_capture_intent() const { return at<12>().valid(); }
-  int32_t capture_intent() const { return at<12>().as_int32(); }
-  bool has_num_streams() const { return at<13>().valid(); }
-  int32_t num_streams() const { return at<13>().as_int32(); }
-  bool has_node_processing_details() const { return at<14>().valid(); }
-  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> node_processing_details() const { return GetRepeated<::protozero::ConstBytes>(14); }
-  bool has_vendor_data_version() const { return at<15>().valid(); }
-  int32_t vendor_data_version() const { return at<15>().as_int32(); }
-  bool has_vendor_data() const { return at<16>().valid(); }
-  ::protozero::ConstBytes vendor_data() const { return at<16>().as_bytes(); }
-};
-
-class AndroidCameraFrameEvent : public ::protozero::Message {
- public:
-  using Decoder = AndroidCameraFrameEvent_Decoder;
+class TraceConfig_BufferConfig_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
+ public:
+  TraceConfig_BufferConfig_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceConfig_BufferConfig_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceConfig_BufferConfig_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_size_kb() const { return at<1>().valid(); }
+  uint32_t size_kb() const { return at<1>().as_uint32(); }
+  bool has_fill_policy() const { return at<4>().valid(); }
+  int32_t fill_policy() const { return at<4>().as_int32(); }
+  bool has_transfer_on_clone() const { return at<5>().valid(); }
+  bool transfer_on_clone() const { return at<5>().as_bool(); }
+  bool has_clear_before_clone() const { return at<6>().valid(); }
+  bool clear_before_clone() const { return at<6>().as_bool(); }
+  bool has_name() const { return at<7>().valid(); }
+  ::protozero::ConstChars name() const { return at<7>().as_string(); }
+  bool has_experimental_mode() const { return at<8>().valid(); }
+  int32_t experimental_mode() const { return at<8>().as_int32(); }
+};
+
+class TraceConfig_BufferConfig : public ::protozero::Message {
+ public:
+  using Decoder = TraceConfig_BufferConfig_Decoder;
   enum : int32_t {
-    kSessionIdFieldNumber = 1,
-    kCameraIdFieldNumber = 2,
-    kFrameNumberFieldNumber = 3,
-    kRequestIdFieldNumber = 4,
-    kRequestReceivedNsFieldNumber = 5,
-    kRequestProcessingStartedNsFieldNumber = 6,
-    kStartOfExposureNsFieldNumber = 7,
-    kStartOfFrameNsFieldNumber = 8,
-    kResponsesAllSentNsFieldNumber = 9,
-    kCaptureResultStatusFieldNumber = 10,
-    kSkippedSensorFramesFieldNumber = 11,
-    kCaptureIntentFieldNumber = 12,
-    kNumStreamsFieldNumber = 13,
-    kNodeProcessingDetailsFieldNumber = 14,
-    kVendorDataVersionFieldNumber = 15,
-    kVendorDataFieldNumber = 16,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidCameraFrameEvent"; }
-
-  using CameraNodeProcessingDetails = ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CameraNodeProcessingDetails;
-
-  using CaptureResultStatus = ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus;
-  static inline const char* CaptureResultStatus_Name(CaptureResultStatus value) {
-    return ::perfetto::protos::pbzero::AndroidCameraFrameEvent_CaptureResultStatus_Name(value);
-  }
-  static inline const CaptureResultStatus STATUS_UNSPECIFIED = CaptureResultStatus::STATUS_UNSPECIFIED;
-  static inline const CaptureResultStatus STATUS_OK = CaptureResultStatus::STATUS_OK;
-  static inline const CaptureResultStatus STATUS_EARLY_METADATA_ERROR = CaptureResultStatus::STATUS_EARLY_METADATA_ERROR;
-  static inline const CaptureResultStatus STATUS_FINAL_METADATA_ERROR = CaptureResultStatus::STATUS_FINAL_METADATA_ERROR;
-  static inline const CaptureResultStatus STATUS_BUFFER_ERROR = CaptureResultStatus::STATUS_BUFFER_ERROR;
-  static inline const CaptureResultStatus STATUS_FLUSH_ERROR = CaptureResultStatus::STATUS_FLUSH_ERROR;
+    kSizeKbFieldNumber = 1,
+    kFillPolicyFieldNumber = 4,
+    kTransferOnCloneFieldNumber = 5,
+    kClearBeforeCloneFieldNumber = 6,
+    kNameFieldNumber = 7,
+    kExperimentalModeFieldNumber = 8,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceConfig.BufferConfig"; }
 
-  using FieldMetadata_SessionId =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint64,
-      uint64_t,
-      AndroidCameraFrameEvent>;
 
-  static constexpr FieldMetadata_SessionId kSessionId{};
-  void set_session_id(uint64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SessionId::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint64>
-        ::Append(*this, field_id, value);
+  using FillPolicy = ::perfetto::protos::pbzero::TraceConfig_BufferConfig_FillPolicy;
+  static inline const char* FillPolicy_Name(FillPolicy value) {
+    return ::perfetto::protos::pbzero::TraceConfig_BufferConfig_FillPolicy_Name(value);
+  }
+
+  using ExperimentalMode = ::perfetto::protos::pbzero::TraceConfig_BufferConfig_ExperimentalMode;
+  static inline const char* ExperimentalMode_Name(ExperimentalMode value) {
+    return ::perfetto::protos::pbzero::TraceConfig_BufferConfig_ExperimentalMode_Name(value);
   }
+  static inline const FillPolicy UNSPECIFIED = FillPolicy::UNSPECIFIED;
+  static inline const FillPolicy RING_BUFFER = FillPolicy::RING_BUFFER;
+  static inline const FillPolicy DISCARD = FillPolicy::DISCARD;
+  static inline const ExperimentalMode MODE_UNSPECIFIED = ExperimentalMode::MODE_UNSPECIFIED;
+  static inline const ExperimentalMode TRACE_BUFFER_V2 = ExperimentalMode::TRACE_BUFFER_V2;
 
-  using FieldMetadata_CameraId =
+  using FieldMetadata_SizeKb =
     ::protozero::proto_utils::FieldMetadata<
-      2,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kUint32,
       uint32_t,
-      AndroidCameraFrameEvent>;
+      TraceConfig_BufferConfig>;
 
-  static constexpr FieldMetadata_CameraId kCameraId{};
-  void set_camera_id(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CameraId::kFieldId;
+  static constexpr FieldMetadata_SizeKb kSizeKb{};
+  void set_size_kb(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SizeKb::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -71066,299 +68687,408 @@ class AndroidCameraFrameEvent : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_FrameNumber =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
-
-  static constexpr FieldMetadata_FrameNumber kFrameNumber{};
-  void set_frame_number(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_FrameNumber::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_RequestId =
+  using FieldMetadata_FillPolicy =
     ::protozero::proto_utils::FieldMetadata<
       4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      TraceConfig_BufferConfig_FillPolicy,
+      TraceConfig_BufferConfig>;
 
-  static constexpr FieldMetadata_RequestId kRequestId{};
-  void set_request_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RequestId::kFieldId;
+  static constexpr FieldMetadata_FillPolicy kFillPolicy{};
+  void set_fill_policy(TraceConfig_BufferConfig_FillPolicy value) {
+    static constexpr uint32_t field_id = FieldMetadata_FillPolicy::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_RequestReceivedNs =
+  using FieldMetadata_TransferOnClone =
     ::protozero::proto_utils::FieldMetadata<
       5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BufferConfig>;
 
-  static constexpr FieldMetadata_RequestReceivedNs kRequestReceivedNs{};
-  void set_request_received_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RequestReceivedNs::kFieldId;
+  static constexpr FieldMetadata_TransferOnClone kTransferOnClone{};
+  void set_transfer_on_clone(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_TransferOnClone::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_RequestProcessingStartedNs =
+  using FieldMetadata_ClearBeforeClone =
     ::protozero::proto_utils::FieldMetadata<
       6,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      TraceConfig_BufferConfig>;
 
-  static constexpr FieldMetadata_RequestProcessingStartedNs kRequestProcessingStartedNs{};
-  void set_request_processing_started_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_RequestProcessingStartedNs::kFieldId;
+  static constexpr FieldMetadata_ClearBeforeClone kClearBeforeClone{};
+  void set_clear_before_clone(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_ClearBeforeClone::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_StartOfExposureNs =
+  using FieldMetadata_Name =
     ::protozero::proto_utils::FieldMetadata<
       7,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      TraceConfig_BufferConfig>;
 
-  static constexpr FieldMetadata_StartOfExposureNs kStartOfExposureNs{};
-  void set_start_of_exposure_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StartOfExposureNs::kFieldId;
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_StartOfFrameNs =
+  using FieldMetadata_ExperimentalMode =
     ::protozero::proto_utils::FieldMetadata<
       8,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      TraceConfig_BufferConfig_ExperimentalMode,
+      TraceConfig_BufferConfig>;
 
-  static constexpr FieldMetadata_StartOfFrameNs kStartOfFrameNs{};
-  void set_start_of_frame_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StartOfFrameNs::kFieldId;
+  static constexpr FieldMetadata_ExperimentalMode kExperimentalMode{};
+  void set_experimental_mode(TraceConfig_BufferConfig_ExperimentalMode value) {
+    static constexpr uint32_t field_id = FieldMetadata_ExperimentalMode::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
+};
+
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/clock_snapshot.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_CLOCK_SNAPSHOT_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_CLOCK_SNAPSHOT_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class ClockSnapshot_Clock;
+enum BuiltinClock : int32_t;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+namespace perfetto_pbzero_enum_ClockSnapshot_Clock {
+enum BuiltinClocks : int32_t {
+  UNKNOWN = 0,
+  REALTIME = 1,
+  REALTIME_COARSE = 2,
+  MONOTONIC = 3,
+  MONOTONIC_COARSE = 4,
+  MONOTONIC_RAW = 5,
+  BOOTTIME = 6,
+  BUILTIN_CLOCK_MAX_ID = 63,
+};
+} // namespace perfetto_pbzero_enum_ClockSnapshot_Clock
+using ClockSnapshot_Clock_BuiltinClocks = perfetto_pbzero_enum_ClockSnapshot_Clock::BuiltinClocks;
+
+
+constexpr ClockSnapshot_Clock_BuiltinClocks ClockSnapshot_Clock_BuiltinClocks_MIN = ClockSnapshot_Clock_BuiltinClocks::UNKNOWN;
+constexpr ClockSnapshot_Clock_BuiltinClocks ClockSnapshot_Clock_BuiltinClocks_MAX = ClockSnapshot_Clock_BuiltinClocks::BUILTIN_CLOCK_MAX_ID;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* ClockSnapshot_Clock_BuiltinClocks_Name(::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::UNKNOWN:
+    return "UNKNOWN";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::REALTIME:
+    return "REALTIME";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::REALTIME_COARSE:
+    return "REALTIME_COARSE";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::MONOTONIC:
+    return "MONOTONIC";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::MONOTONIC_COARSE:
+    return "MONOTONIC_COARSE";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::MONOTONIC_RAW:
+    return "MONOTONIC_RAW";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::BOOTTIME:
+    return "BOOTTIME";
+
+  case ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks::BUILTIN_CLOCK_MAX_ID:
+    return "BUILTIN_CLOCK_MAX_ID";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class ClockSnapshot_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  ClockSnapshot_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit ClockSnapshot_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit ClockSnapshot_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_clocks() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> clocks() const { return GetRepeated<::protozero::ConstBytes>(1); }
+  bool has_primary_trace_clock() const { return at<2>().valid(); }
+  int32_t primary_trace_clock() const { return at<2>().as_int32(); }
+};
+
+class ClockSnapshot : public ::protozero::Message {
+ public:
+  using Decoder = ClockSnapshot_Decoder;
+  enum : int32_t {
+    kClocksFieldNumber = 1,
+    kPrimaryTraceClockFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.ClockSnapshot"; }
 
-  using FieldMetadata_ResponsesAllSentNs =
+  using Clock = ::perfetto::protos::pbzero::ClockSnapshot_Clock;
+
+  using FieldMetadata_Clocks =
     ::protozero::proto_utils::FieldMetadata<
-      9,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent>;
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      ClockSnapshot_Clock,
+      ClockSnapshot>;
 
-  static constexpr FieldMetadata_ResponsesAllSentNs kResponsesAllSentNs{};
-  void set_responses_all_sent_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ResponsesAllSentNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Clocks kClocks{};
+  template <typename T = ClockSnapshot_Clock> T* add_clocks() {
+    return BeginNestedMessage<T>(1);
   }
 
-  using FieldMetadata_CaptureResultStatus =
+
+  using FieldMetadata_PrimaryTraceClock =
     ::protozero::proto_utils::FieldMetadata<
-      10,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      AndroidCameraFrameEvent_CaptureResultStatus,
-      AndroidCameraFrameEvent>;
+      BuiltinClock,
+      ClockSnapshot>;
 
-  static constexpr FieldMetadata_CaptureResultStatus kCaptureResultStatus{};
-  void set_capture_result_status(AndroidCameraFrameEvent_CaptureResultStatus value) {
-    static constexpr uint32_t field_id = FieldMetadata_CaptureResultStatus::kFieldId;
+  static constexpr FieldMetadata_PrimaryTraceClock kPrimaryTraceClock{};
+  void set_primary_trace_clock(BuiltinClock value) {
+    static constexpr uint32_t field_id = FieldMetadata_PrimaryTraceClock::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
       ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
+};
 
-  using FieldMetadata_SkippedSensorFrames =
-    ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidCameraFrameEvent>;
+class ClockSnapshot_Clock_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  ClockSnapshot_Clock_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit ClockSnapshot_Clock_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit ClockSnapshot_Clock_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_clock_id() const { return at<1>().valid(); }
+  uint32_t clock_id() const { return at<1>().as_uint32(); }
+  bool has_timestamp() const { return at<2>().valid(); }
+  uint64_t timestamp() const { return at<2>().as_uint64(); }
+  bool has_is_incremental() const { return at<3>().valid(); }
+  bool is_incremental() const { return at<3>().as_bool(); }
+  bool has_unit_multiplier_ns() const { return at<4>().valid(); }
+  uint64_t unit_multiplier_ns() const { return at<4>().as_uint64(); }
+};
 
-  static constexpr FieldMetadata_SkippedSensorFrames kSkippedSensorFrames{};
-  void set_skipped_sensor_frames(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SkippedSensorFrames::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+class ClockSnapshot_Clock : public ::protozero::Message {
+ public:
+  using Decoder = ClockSnapshot_Clock_Decoder;
+  enum : int32_t {
+    kClockIdFieldNumber = 1,
+    kTimestampFieldNumber = 2,
+    kIsIncrementalFieldNumber = 3,
+    kUnitMultiplierNsFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.ClockSnapshot.Clock"; }
+
+
+  using BuiltinClocks = ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks;
+  static inline const char* BuiltinClocks_Name(BuiltinClocks value) {
+    return ::perfetto::protos::pbzero::ClockSnapshot_Clock_BuiltinClocks_Name(value);
   }
+  static inline const BuiltinClocks UNKNOWN = BuiltinClocks::UNKNOWN;
+  static inline const BuiltinClocks REALTIME = BuiltinClocks::REALTIME;
+  static inline const BuiltinClocks REALTIME_COARSE = BuiltinClocks::REALTIME_COARSE;
+  static inline const BuiltinClocks MONOTONIC = BuiltinClocks::MONOTONIC;
+  static inline const BuiltinClocks MONOTONIC_COARSE = BuiltinClocks::MONOTONIC_COARSE;
+  static inline const BuiltinClocks MONOTONIC_RAW = BuiltinClocks::MONOTONIC_RAW;
+  static inline const BuiltinClocks BOOTTIME = BuiltinClocks::BOOTTIME;
+  static inline const BuiltinClocks BUILTIN_CLOCK_MAX_ID = BuiltinClocks::BUILTIN_CLOCK_MAX_ID;
 
-  using FieldMetadata_CaptureIntent =
+  using FieldMetadata_ClockId =
     ::protozero::proto_utils::FieldMetadata<
-      12,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ClockSnapshot_Clock>;
 
-  static constexpr FieldMetadata_CaptureIntent kCaptureIntent{};
-  void set_capture_intent(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_CaptureIntent::kFieldId;
+  static constexpr FieldMetadata_ClockId kClockId{};
+  void set_clock_id(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ClockId::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_NumStreams =
+  using FieldMetadata_Timestamp =
     ::protozero::proto_utils::FieldMetadata<
-      13,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      ClockSnapshot_Clock>;
 
-  static constexpr FieldMetadata_NumStreams kNumStreams{};
-  void set_num_streams(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NumStreams::kFieldId;
+  static constexpr FieldMetadata_Timestamp kTimestamp{};
+  void set_timestamp(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Timestamp::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_NodeProcessingDetails =
-    ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      AndroidCameraFrameEvent_CameraNodeProcessingDetails,
-      AndroidCameraFrameEvent>;
-
-  static constexpr FieldMetadata_NodeProcessingDetails kNodeProcessingDetails{};
-  template <typename T = AndroidCameraFrameEvent_CameraNodeProcessingDetails> T* add_node_processing_details() {
-    return BeginNestedMessage<T>(14);
-  }
-
-
-  using FieldMetadata_VendorDataVersion =
+  using FieldMetadata_IsIncremental =
     ::protozero::proto_utils::FieldMetadata<
-      15,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      ClockSnapshot_Clock>;
 
-  static constexpr FieldMetadata_VendorDataVersion kVendorDataVersion{};
-  void set_vendor_data_version(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_VendorDataVersion::kFieldId;
+  static constexpr FieldMetadata_IsIncremental kIsIncremental{};
+  void set_is_incremental(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_IsIncremental::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_VendorData =
+  using FieldMetadata_UnitMultiplierNs =
     ::protozero::proto_utils::FieldMetadata<
-      16,
+      4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBytes,
-      std::string,
-      AndroidCameraFrameEvent>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      ClockSnapshot_Clock>;
 
-  static constexpr FieldMetadata_VendorData kVendorData{};
-  void set_vendor_data(const uint8_t* data, size_t size) {
-    AppendBytes(FieldMetadata_VendorData::kFieldId, data, size);
-  }
-  void set_vendor_data(::protozero::ConstBytes bytes) {
-    AppendBytes(FieldMetadata_VendorData::kFieldId, bytes.data, bytes.size);
-  }
-  void set_vendor_data(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_VendorData::kFieldId;
+  static constexpr FieldMetadata_UnitMultiplierNs kUnitMultiplierNs{};
+  void set_unit_multiplier_ns(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_UnitMultiplierNs::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBytes>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
 };
 
-class AndroidCameraFrameEvent_CameraNodeProcessingDetails_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/trace_uuid.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACE_UUID_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRACE_UUID_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class TraceUuid_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
-  AndroidCameraFrameEvent_CameraNodeProcessingDetails_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit AndroidCameraFrameEvent_CameraNodeProcessingDetails_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit AndroidCameraFrameEvent_CameraNodeProcessingDetails_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_node_id() const { return at<1>().valid(); }
-  int64_t node_id() const { return at<1>().as_int64(); }
-  bool has_start_processing_ns() const { return at<2>().valid(); }
-  int64_t start_processing_ns() const { return at<2>().as_int64(); }
-  bool has_end_processing_ns() const { return at<3>().valid(); }
-  int64_t end_processing_ns() const { return at<3>().as_int64(); }
-  bool has_scheduling_latency_ns() const { return at<4>().valid(); }
-  int64_t scheduling_latency_ns() const { return at<4>().as_int64(); }
+  TraceUuid_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit TraceUuid_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit TraceUuid_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_msb() const { return at<1>().valid(); }
+  int64_t msb() const { return at<1>().as_int64(); }
+  bool has_lsb() const { return at<2>().valid(); }
+  int64_t lsb() const { return at<2>().as_int64(); }
 };
 
-class AndroidCameraFrameEvent_CameraNodeProcessingDetails : public ::protozero::Message {
+class TraceUuid : public ::protozero::Message {
  public:
-  using Decoder = AndroidCameraFrameEvent_CameraNodeProcessingDetails_Decoder;
+  using Decoder = TraceUuid_Decoder;
   enum : int32_t {
-    kNodeIdFieldNumber = 1,
-    kStartProcessingNsFieldNumber = 2,
-    kEndProcessingNsFieldNumber = 3,
-    kSchedulingLatencyNsFieldNumber = 4,
+    kMsbFieldNumber = 1,
+    kLsbFieldNumber = 2,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.AndroidCameraFrameEvent.CameraNodeProcessingDetails"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.TraceUuid"; }
 
 
-  using FieldMetadata_NodeId =
+  using FieldMetadata_Msb =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kInt64,
       int64_t,
-      AndroidCameraFrameEvent_CameraNodeProcessingDetails>;
+      TraceUuid>;
 
-  static constexpr FieldMetadata_NodeId kNodeId{};
-  void set_node_id(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_NodeId::kFieldId;
+  static constexpr FieldMetadata_Msb kMsb{};
+  void set_msb(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Msb::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -71366,53 +69096,17 @@ class AndroidCameraFrameEvent_CameraNodeProcessingDetails : public ::protozero::
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_StartProcessingNs =
+  using FieldMetadata_Lsb =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kInt64,
       int64_t,
-      AndroidCameraFrameEvent_CameraNodeProcessingDetails>;
-
-  static constexpr FieldMetadata_StartProcessingNs kStartProcessingNs{};
-  void set_start_processing_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_StartProcessingNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_EndProcessingNs =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent_CameraNodeProcessingDetails>;
-
-  static constexpr FieldMetadata_EndProcessingNs kEndProcessingNs{};
-  void set_end_processing_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_EndProcessingNs::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
-  }
-
-  using FieldMetadata_SchedulingLatencyNs =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      AndroidCameraFrameEvent_CameraNodeProcessingDetails>;
+      TraceUuid>;
 
-  static constexpr FieldMetadata_SchedulingLatencyNs kSchedulingLatencyNs{};
-  void set_scheduling_latency_ns(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_SchedulingLatencyNs::kFieldId;
+  static constexpr FieldMetadata_Lsb kLsb{};
+  void set_lsb(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Lsb::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -71425,11 +69119,11 @@ class AndroidCameraFrameEvent_CameraNodeProcessingDetails : public ::protozero::
 } // Namespace.
 } // Namespace.
 #endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/cpu_per_uid_data.pbzero.h
+// gen_amalgamated begin header: gen/protos/perfetto/trace/trigger.pbzero.h
 // Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
 
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_CPU_PER_UID_DATA_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_CPU_PER_UID_DATA_PROTO_H_
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRIGGER_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_TRIGGER_PROTO_H_
 
 #include <stddef.h>
 #include <stdint.h>
@@ -71445,74 +69139,115 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class CpuPerUidData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class Trigger_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
-  CpuPerUidData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit CpuPerUidData_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit CpuPerUidData_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_cluster_count() const { return at<1>().valid(); }
-  uint32_t cluster_count() const { return at<1>().as_uint32(); }
-  bool has_uid() const { return at<2>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t> uid(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t>(2, parse_error_ptr); }
-  bool has_total_time_ms() const { return at<3>().valid(); }
-  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> total_time_ms(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(3, parse_error_ptr); }
+  Trigger_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit Trigger_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit Trigger_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_trigger_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars trigger_name() const { return at<1>().as_string(); }
+  bool has_producer_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars producer_name() const { return at<2>().as_string(); }
+  bool has_trusted_producer_uid() const { return at<3>().valid(); }
+  int32_t trusted_producer_uid() const { return at<3>().as_int32(); }
+  bool has_stop_delay_ms() const { return at<4>().valid(); }
+  uint64_t stop_delay_ms() const { return at<4>().as_uint64(); }
 };
 
-class CpuPerUidData : public ::protozero::Message {
+class Trigger : public ::protozero::Message {
  public:
-  using Decoder = CpuPerUidData_Decoder;
+  using Decoder = Trigger_Decoder;
   enum : int32_t {
-    kClusterCountFieldNumber = 1,
-    kUidFieldNumber = 2,
-    kTotalTimeMsFieldNumber = 3,
+    kTriggerNameFieldNumber = 1,
+    kProducerNameFieldNumber = 2,
+    kTrustedProducerUidFieldNumber = 3,
+    kStopDelayMsFieldNumber = 4,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.CpuPerUidData"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.Trigger"; }
 
 
-  using FieldMetadata_ClusterCount =
+  using FieldMetadata_TriggerName =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      CpuPerUidData>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      Trigger>;
 
-  static constexpr FieldMetadata_ClusterCount kClusterCount{};
-  void set_cluster_count(uint32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_ClusterCount::kFieldId;
+  static constexpr FieldMetadata_TriggerName kTriggerName{};
+  void set_trigger_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_TriggerName::kFieldId, data, size);
+  }
+  void set_trigger_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_TriggerName::kFieldId, chars.data, chars.size);
+  }
+  void set_trigger_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_TriggerName::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Uid =
+  using FieldMetadata_ProducerName =
     ::protozero::proto_utils::FieldMetadata<
       2,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
-      ::protozero::proto_utils::ProtoSchemaType::kUint32,
-      uint32_t,
-      CpuPerUidData>;
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      Trigger>;
 
-  static constexpr FieldMetadata_Uid kUid{};
-  void set_uid(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_Uid::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
+  static constexpr FieldMetadata_ProducerName kProducerName{};
+  void set_producer_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_ProducerName::kFieldId, data, size);
+  }
+  void set_producer_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_ProducerName::kFieldId, chars.data, chars.size);
+  }
+  void set_producer_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_ProducerName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_TotalTimeMs =
+  using FieldMetadata_TrustedProducerUid =
     ::protozero::proto_utils::FieldMetadata<
       3,
-      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      Trigger>;
+
+  static constexpr FieldMetadata_TrustedProducerUid kTrustedProducerUid{};
+  void set_trusted_producer_uid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TrustedProducerUid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_StopDelayMs =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kUint64,
       uint64_t,
-      CpuPerUidData>;
+      Trigger>;
 
-  static constexpr FieldMetadata_TotalTimeMs kTotalTimeMs{};
-  void set_total_time_ms(const ::protozero::PackedVarInt& packed_buffer) {
-    AppendBytes(FieldMetadata_TotalTimeMs::kFieldId, packed_buffer.data(),
-                packed_buffer.size());
+  static constexpr FieldMetadata_StopDelayMs kStopDelayMs{};
+  void set_stop_delay_ms(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_StopDelayMs::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
   }
 };
 
@@ -71520,11 +69255,11 @@ class CpuPerUidData : public ::protozero::Message {
 } // Namespace.
 } // Namespace.
 #endif  // Include guard.
-// gen_amalgamated begin header: gen/protos/perfetto/trace/android/frame_timeline_event.pbzero.h
+// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_aflags.pbzero.h
 // Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
 
-#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_FRAME_TIMELINE_EVENT_PROTO_H_
-#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_FRAME_TIMELINE_EVENT_PROTO_H_
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_AFLAGS_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_AFLAGS_PROTO_H_
 
 #include <stddef.h>
 #include <stdint.h>
@@ -71538,27 +69273,23 @@ class CpuPerUidData : public ::protozero::Message {
 namespace perfetto {
 namespace protos {
 namespace pbzero {
-class FrameTimelineEvent_ActualDisplayFrameStart;
-class FrameTimelineEvent_ActualSurfaceFrameStart;
-class FrameTimelineEvent_ExpectedDisplayFrameStart;
-class FrameTimelineEvent_ExpectedSurfaceFrameStart;
-class FrameTimelineEvent_FrameEnd;
-namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart {
-enum LatchedFenceState : int32_t;
-}  // namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart
-using FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState = perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart::LatchedFenceState;
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum JankSeverityType : int32_t;
-}  // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_JankSeverityType = perfetto_pbzero_enum_FrameTimelineEvent::JankSeverityType;
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum PredictionType : int32_t;
-}  // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_PredictionType = perfetto_pbzero_enum_FrameTimelineEvent::PredictionType;
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum PresentType : int32_t;
-}  // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_PresentType = perfetto_pbzero_enum_FrameTimelineEvent::PresentType;
+class AndroidAflags_Flag;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagPermission : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagPermission = perfetto_pbzero_enum_AndroidAflags::FlagPermission;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagStorageBackend : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagStorageBackend = perfetto_pbzero_enum_AndroidAflags::FlagStorageBackend;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagType : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagType = perfetto_pbzero_enum_AndroidAflags::FlagType;
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum ValuePickedFrom : int32_t;
+}  // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_ValuePickedFrom = perfetto_pbzero_enum_AndroidAflags::ValuePickedFrom;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -71567,625 +69298,443 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum JankType : int32_t {
-  JANK_UNSPECIFIED = 0,
-  JANK_NONE = 1,
-  JANK_SF_SCHEDULING = 2,
-  JANK_PREDICTION_ERROR = 4,
-  JANK_DISPLAY_HAL = 8,
-  JANK_SF_CPU_DEADLINE_MISSED = 16,
-  JANK_SF_GPU_DEADLINE_MISSED = 32,
-  JANK_APP_DEADLINE_MISSED = 64,
-  JANK_BUFFER_STUFFING = 128,
-  JANK_UNKNOWN = 256,
-  JANK_SF_STUFFING = 512,
-  JANK_DROPPED = 1024,
-  JANK_NON_ANIMATING = 2048,
-  JANK_APP_RESYNCED_JITTER = 4096,
-  JANK_DISPLAY_NOT_ON = 8192,
-  JANK_DISPLAY_MODE_CHANGE_IN_PROGRESS = 16384,
-  JANK_DISPLAY_POWER_MODE_CHANGE_IN_PROGRESS = 32768,
-};
-} // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_JankType = perfetto_pbzero_enum_FrameTimelineEvent::JankType;
-
-
-constexpr FrameTimelineEvent_JankType FrameTimelineEvent_JankType_MIN = FrameTimelineEvent_JankType::JANK_UNSPECIFIED;
-constexpr FrameTimelineEvent_JankType FrameTimelineEvent_JankType_MAX = FrameTimelineEvent_JankType::JANK_DISPLAY_POWER_MODE_CHANGE_IN_PROGRESS;
-
-
-PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* FrameTimelineEvent_JankType_Name(::perfetto::protos::pbzero::FrameTimelineEvent_JankType value) {
-  switch (value) {
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_UNSPECIFIED:
-    return "JANK_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_NONE:
-    return "JANK_NONE";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_SF_SCHEDULING:
-    return "JANK_SF_SCHEDULING";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_PREDICTION_ERROR:
-    return "JANK_PREDICTION_ERROR";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_DISPLAY_HAL:
-    return "JANK_DISPLAY_HAL";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_SF_CPU_DEADLINE_MISSED:
-    return "JANK_SF_CPU_DEADLINE_MISSED";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_SF_GPU_DEADLINE_MISSED:
-    return "JANK_SF_GPU_DEADLINE_MISSED";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_APP_DEADLINE_MISSED:
-    return "JANK_APP_DEADLINE_MISSED";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_BUFFER_STUFFING:
-    return "JANK_BUFFER_STUFFING";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_UNKNOWN:
-    return "JANK_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_SF_STUFFING:
-    return "JANK_SF_STUFFING";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_DROPPED:
-    return "JANK_DROPPED";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_NON_ANIMATING:
-    return "JANK_NON_ANIMATING";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_APP_RESYNCED_JITTER:
-    return "JANK_APP_RESYNCED_JITTER";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_DISPLAY_NOT_ON:
-    return "JANK_DISPLAY_NOT_ON";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_DISPLAY_MODE_CHANGE_IN_PROGRESS:
-    return "JANK_DISPLAY_MODE_CHANGE_IN_PROGRESS";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankType::JANK_DISPLAY_POWER_MODE_CHANGE_IN_PROGRESS:
-    return "JANK_DISPLAY_POWER_MODE_CHANGE_IN_PROGRESS";
-  }
-  return "PBZERO_UNKNOWN_ENUM_VALUE";
-}
-
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum JankSeverityType : int32_t {
-  SEVERITY_UNKNOWN = 0,
-  SEVERITY_NONE = 1,
-  SEVERITY_PARTIAL = 2,
-  SEVERITY_FULL = 3,
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagPermission : int32_t {
+  FLAG_PERMISSION_UNSPECIFIED = 0,
+  FLAG_PERMISSION_READ_ONLY = 1,
+  FLAG_PERMISSION_READ_WRITE = 2,
 };
-} // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_JankSeverityType = perfetto_pbzero_enum_FrameTimelineEvent::JankSeverityType;
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagPermission = perfetto_pbzero_enum_AndroidAflags::FlagPermission;
 
 
-constexpr FrameTimelineEvent_JankSeverityType FrameTimelineEvent_JankSeverityType_MIN = FrameTimelineEvent_JankSeverityType::SEVERITY_UNKNOWN;
-constexpr FrameTimelineEvent_JankSeverityType FrameTimelineEvent_JankSeverityType_MAX = FrameTimelineEvent_JankSeverityType::SEVERITY_FULL;
+constexpr AndroidAflags_FlagPermission AndroidAflags_FlagPermission_MIN = AndroidAflags_FlagPermission::FLAG_PERMISSION_UNSPECIFIED;
+constexpr AndroidAflags_FlagPermission AndroidAflags_FlagPermission_MAX = AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_WRITE;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* FrameTimelineEvent_JankSeverityType_Name(::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType value) {
+const char* AndroidAflags_FlagPermission_Name(::perfetto::protos::pbzero::AndroidAflags_FlagPermission value) {
   switch (value) {
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType::SEVERITY_UNKNOWN:
-    return "SEVERITY_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType::SEVERITY_NONE:
-    return "SEVERITY_NONE";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_UNSPECIFIED:
+    return "FLAG_PERMISSION_UNSPECIFIED";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType::SEVERITY_PARTIAL:
-    return "SEVERITY_PARTIAL";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_ONLY:
+    return "FLAG_PERMISSION_READ_ONLY";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType::SEVERITY_FULL:
-    return "SEVERITY_FULL";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagPermission::FLAG_PERMISSION_READ_WRITE:
+    return "FLAG_PERMISSION_READ_WRITE";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum PresentType : int32_t {
-  PRESENT_UNSPECIFIED = 0,
-  PRESENT_ON_TIME = 1,
-  PRESENT_LATE = 2,
-  PRESENT_EARLY = 3,
-  PRESENT_DROPPED = 4,
-  PRESENT_UNKNOWN = 5,
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum ValuePickedFrom : int32_t {
+  VALUE_PICKED_FROM_UNSPECIFIED = 0,
+  VALUE_PICKED_FROM_DEFAULT = 1,
+  VALUE_PICKED_FROM_SERVER = 2,
+  VALUE_PICKED_FROM_LOCAL = 3,
 };
-} // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_PresentType = perfetto_pbzero_enum_FrameTimelineEvent::PresentType;
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_ValuePickedFrom = perfetto_pbzero_enum_AndroidAflags::ValuePickedFrom;
 
 
-constexpr FrameTimelineEvent_PresentType FrameTimelineEvent_PresentType_MIN = FrameTimelineEvent_PresentType::PRESENT_UNSPECIFIED;
-constexpr FrameTimelineEvent_PresentType FrameTimelineEvent_PresentType_MAX = FrameTimelineEvent_PresentType::PRESENT_UNKNOWN;
+constexpr AndroidAflags_ValuePickedFrom AndroidAflags_ValuePickedFrom_MIN = AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED;
+constexpr AndroidAflags_ValuePickedFrom AndroidAflags_ValuePickedFrom_MAX = AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_LOCAL;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* FrameTimelineEvent_PresentType_Name(::perfetto::protos::pbzero::FrameTimelineEvent_PresentType value) {
+const char* AndroidAflags_ValuePickedFrom_Name(::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom value) {
   switch (value) {
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType::PRESENT_UNSPECIFIED:
-    return "PRESENT_UNSPECIFIED";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType::PRESENT_ON_TIME:
-    return "PRESENT_ON_TIME";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType::PRESENT_LATE:
-    return "PRESENT_LATE";
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED:
+    return "VALUE_PICKED_FROM_UNSPECIFIED";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType::PRESENT_EARLY:
-    return "PRESENT_EARLY";
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_DEFAULT:
+    return "VALUE_PICKED_FROM_DEFAULT";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType::PRESENT_DROPPED:
-    return "PRESENT_DROPPED";
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_SERVER:
+    return "VALUE_PICKED_FROM_SERVER";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType::PRESENT_UNKNOWN:
-    return "PRESENT_UNKNOWN";
+  case ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom::VALUE_PICKED_FROM_LOCAL:
+    return "VALUE_PICKED_FROM_LOCAL";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-namespace perfetto_pbzero_enum_FrameTimelineEvent {
-enum PredictionType : int32_t {
-  PREDICTION_UNSPECIFIED = 0,
-  PREDICTION_VALID = 1,
-  PREDICTION_EXPIRED = 2,
-  PREDICTION_UNKNOWN = 3,
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagStorageBackend : int32_t {
+  FLAG_STORAGE_BACKEND_UNSPECIFIED = 0,
+  FLAG_STORAGE_BACKEND_NONE = 1,
+  FLAG_STORAGE_BACKEND_ACONFIGD = 2,
+  FLAG_STORAGE_BACKEND_DEVICE_CONFIG = 3,
 };
-} // namespace perfetto_pbzero_enum_FrameTimelineEvent
-using FrameTimelineEvent_PredictionType = perfetto_pbzero_enum_FrameTimelineEvent::PredictionType;
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagStorageBackend = perfetto_pbzero_enum_AndroidAflags::FlagStorageBackend;
 
 
-constexpr FrameTimelineEvent_PredictionType FrameTimelineEvent_PredictionType_MIN = FrameTimelineEvent_PredictionType::PREDICTION_UNSPECIFIED;
-constexpr FrameTimelineEvent_PredictionType FrameTimelineEvent_PredictionType_MAX = FrameTimelineEvent_PredictionType::PREDICTION_UNKNOWN;
+constexpr AndroidAflags_FlagStorageBackend AndroidAflags_FlagStorageBackend_MIN = AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED;
+constexpr AndroidAflags_FlagStorageBackend AndroidAflags_FlagStorageBackend_MAX = AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* FrameTimelineEvent_PredictionType_Name(::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType value) {
+const char* AndroidAflags_FlagStorageBackend_Name(::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend value) {
   switch (value) {
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType::PREDICTION_UNSPECIFIED:
-    return "PREDICTION_UNSPECIFIED";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED:
+    return "FLAG_STORAGE_BACKEND_UNSPECIFIED";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType::PREDICTION_VALID:
-    return "PREDICTION_VALID";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_NONE:
+    return "FLAG_STORAGE_BACKEND_NONE";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType::PREDICTION_EXPIRED:
-    return "PREDICTION_EXPIRED";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_ACONFIGD:
+    return "FLAG_STORAGE_BACKEND_ACONFIGD";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType::PREDICTION_UNKNOWN:
-    return "PREDICTION_UNKNOWN";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG:
+    return "FLAG_STORAGE_BACKEND_DEVICE_CONFIG";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart {
-enum LatchedFenceState : int32_t {
-  LATCHED_UNKNOWN = 0,
-  LATCHED_SIGNALED = 1,
-  LATCHED_UNSIGNALED = 2,
-  LATCHED_DELAYED_LATCH_UNSIGNALED = 3,
+namespace perfetto_pbzero_enum_AndroidAflags {
+enum FlagType : int32_t {
+  FLAG_TYPE_UNSPECIFIED = 0,
+  FLAG_TYPE_BOOLEAN = 1,
+  FLAG_TYPE_INTEGER = 2,
 };
-} // namespace perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart
-using FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState = perfetto_pbzero_enum_FrameTimelineEvent_ActualSurfaceFrameStart::LatchedFenceState;
+} // namespace perfetto_pbzero_enum_AndroidAflags
+using AndroidAflags_FlagType = perfetto_pbzero_enum_AndroidAflags::FlagType;
 
 
-constexpr FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_MIN = FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_UNKNOWN;
-constexpr FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_MAX = FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_DELAYED_LATCH_UNSIGNALED;
+constexpr AndroidAflags_FlagType AndroidAflags_FlagType_MIN = AndroidAflags_FlagType::FLAG_TYPE_UNSPECIFIED;
+constexpr AndroidAflags_FlagType AndroidAflags_FlagType_MAX = AndroidAflags_FlagType::FLAG_TYPE_INTEGER;
 
 
 PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
-const char* FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_Name(::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState value) {
+const char* AndroidAflags_FlagType_Name(::perfetto::protos::pbzero::AndroidAflags_FlagType value) {
   switch (value) {
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_UNKNOWN:
-    return "LATCHED_UNKNOWN";
-
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_SIGNALED:
-    return "LATCHED_SIGNALED";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_UNSPECIFIED:
+    return "FLAG_TYPE_UNSPECIFIED";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_UNSIGNALED:
-    return "LATCHED_UNSIGNALED";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_BOOLEAN:
+    return "FLAG_TYPE_BOOLEAN";
 
-  case ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState::LATCHED_DELAYED_LATCH_UNSIGNALED:
-    return "LATCHED_DELAYED_LATCH_UNSIGNALED";
+  case ::perfetto::protos::pbzero::AndroidAflags_FlagType::FLAG_TYPE_INTEGER:
+    return "FLAG_TYPE_INTEGER";
   }
   return "PBZERO_UNKNOWN_ENUM_VALUE";
 }
 
-class FrameTimelineEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
- public:
-  FrameTimelineEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FrameTimelineEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FrameTimelineEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_expected_display_frame_start() const { return at<1>().valid(); }
-  ::protozero::ConstBytes expected_display_frame_start() const { return at<1>().as_bytes(); }
-  bool has_actual_display_frame_start() const { return at<2>().valid(); }
-  ::protozero::ConstBytes actual_display_frame_start() const { return at<2>().as_bytes(); }
-  bool has_expected_surface_frame_start() const { return at<3>().valid(); }
-  ::protozero::ConstBytes expected_surface_frame_start() const { return at<3>().as_bytes(); }
-  bool has_actual_surface_frame_start() const { return at<4>().valid(); }
-  ::protozero::ConstBytes actual_surface_frame_start() const { return at<4>().as_bytes(); }
-  bool has_frame_end() const { return at<5>().valid(); }
-  ::protozero::ConstBytes frame_end() const { return at<5>().as_bytes(); }
-};
-
-class FrameTimelineEvent : public ::protozero::Message {
- public:
-  using Decoder = FrameTimelineEvent_Decoder;
-  enum : int32_t {
-    kExpectedDisplayFrameStartFieldNumber = 1,
-    kActualDisplayFrameStartFieldNumber = 2,
-    kExpectedSurfaceFrameStartFieldNumber = 3,
-    kActualSurfaceFrameStartFieldNumber = 4,
-    kFrameEndFieldNumber = 5,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent"; }
-
-  using ExpectedSurfaceFrameStart = ::perfetto::protos::pbzero::FrameTimelineEvent_ExpectedSurfaceFrameStart;
-  using ActualSurfaceFrameStart = ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart;
-  using ExpectedDisplayFrameStart = ::perfetto::protos::pbzero::FrameTimelineEvent_ExpectedDisplayFrameStart;
-  using ActualDisplayFrameStart = ::perfetto::protos::pbzero::FrameTimelineEvent_ActualDisplayFrameStart;
-  using FrameEnd = ::perfetto::protos::pbzero::FrameTimelineEvent_FrameEnd;
-
-  using JankType = ::perfetto::protos::pbzero::FrameTimelineEvent_JankType;
-  static inline const char* JankType_Name(JankType value) {
-    return ::perfetto::protos::pbzero::FrameTimelineEvent_JankType_Name(value);
-  }
-
-  using JankSeverityType = ::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType;
-  static inline const char* JankSeverityType_Name(JankSeverityType value) {
-    return ::perfetto::protos::pbzero::FrameTimelineEvent_JankSeverityType_Name(value);
-  }
-
-  using PresentType = ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType;
-  static inline const char* PresentType_Name(PresentType value) {
-    return ::perfetto::protos::pbzero::FrameTimelineEvent_PresentType_Name(value);
-  }
-
-  using PredictionType = ::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType;
-  static inline const char* PredictionType_Name(PredictionType value) {
-    return ::perfetto::protos::pbzero::FrameTimelineEvent_PredictionType_Name(value);
-  }
-  static inline const JankType JANK_UNSPECIFIED = JankType::JANK_UNSPECIFIED;
-  static inline const JankType JANK_NONE = JankType::JANK_NONE;
-  static inline const JankType JANK_SF_SCHEDULING = JankType::JANK_SF_SCHEDULING;
-  static inline const JankType JANK_PREDICTION_ERROR = JankType::JANK_PREDICTION_ERROR;
-  static inline const JankType JANK_DISPLAY_HAL = JankType::JANK_DISPLAY_HAL;
-  static inline const JankType JANK_SF_CPU_DEADLINE_MISSED = JankType::JANK_SF_CPU_DEADLINE_MISSED;
-  static inline const JankType JANK_SF_GPU_DEADLINE_MISSED = JankType::JANK_SF_GPU_DEADLINE_MISSED;
-  static inline const JankType JANK_APP_DEADLINE_MISSED = JankType::JANK_APP_DEADLINE_MISSED;
-  static inline const JankType JANK_BUFFER_STUFFING = JankType::JANK_BUFFER_STUFFING;
-  static inline const JankType JANK_UNKNOWN = JankType::JANK_UNKNOWN;
-  static inline const JankType JANK_SF_STUFFING = JankType::JANK_SF_STUFFING;
-  static inline const JankType JANK_DROPPED = JankType::JANK_DROPPED;
-  static inline const JankType JANK_NON_ANIMATING = JankType::JANK_NON_ANIMATING;
-  static inline const JankType JANK_APP_RESYNCED_JITTER = JankType::JANK_APP_RESYNCED_JITTER;
-  static inline const JankType JANK_DISPLAY_NOT_ON = JankType::JANK_DISPLAY_NOT_ON;
-  static inline const JankType JANK_DISPLAY_MODE_CHANGE_IN_PROGRESS = JankType::JANK_DISPLAY_MODE_CHANGE_IN_PROGRESS;
-  static inline const JankType JANK_DISPLAY_POWER_MODE_CHANGE_IN_PROGRESS = JankType::JANK_DISPLAY_POWER_MODE_CHANGE_IN_PROGRESS;
-  static inline const JankSeverityType SEVERITY_UNKNOWN = JankSeverityType::SEVERITY_UNKNOWN;
-  static inline const JankSeverityType SEVERITY_NONE = JankSeverityType::SEVERITY_NONE;
-  static inline const JankSeverityType SEVERITY_PARTIAL = JankSeverityType::SEVERITY_PARTIAL;
-  static inline const JankSeverityType SEVERITY_FULL = JankSeverityType::SEVERITY_FULL;
-  static inline const PresentType PRESENT_UNSPECIFIED = PresentType::PRESENT_UNSPECIFIED;
-  static inline const PresentType PRESENT_ON_TIME = PresentType::PRESENT_ON_TIME;
-  static inline const PresentType PRESENT_LATE = PresentType::PRESENT_LATE;
-  static inline const PresentType PRESENT_EARLY = PresentType::PRESENT_EARLY;
-  static inline const PresentType PRESENT_DROPPED = PresentType::PRESENT_DROPPED;
-  static inline const PresentType PRESENT_UNKNOWN = PresentType::PRESENT_UNKNOWN;
-  static inline const PredictionType PREDICTION_UNSPECIFIED = PredictionType::PREDICTION_UNSPECIFIED;
-  static inline const PredictionType PREDICTION_VALID = PredictionType::PREDICTION_VALID;
-  static inline const PredictionType PREDICTION_EXPIRED = PredictionType::PREDICTION_EXPIRED;
-  static inline const PredictionType PREDICTION_UNKNOWN = PredictionType::PREDICTION_UNKNOWN;
-
-  using FieldMetadata_ExpectedDisplayFrameStart =
-    ::protozero::proto_utils::FieldMetadata<
-      1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FrameTimelineEvent_ExpectedDisplayFrameStart,
-      FrameTimelineEvent>;
-
-  static constexpr FieldMetadata_ExpectedDisplayFrameStart kExpectedDisplayFrameStart{};
-  template <typename T = FrameTimelineEvent_ExpectedDisplayFrameStart> T* set_expected_display_frame_start() {
-    return BeginNestedMessage<T>(1);
-  }
+class AndroidAflags_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  AndroidAflags_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidAflags_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidAflags_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_flags() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> flags() const { return GetRepeated<::protozero::ConstBytes>(1); }
+  bool has_error() const { return at<2>().valid(); }
+  ::protozero::ConstChars error() const { return at<2>().as_string(); }
+};
 
+class AndroidAflags : public ::protozero::Message {
+ public:
+  using Decoder = AndroidAflags_Decoder;
+  enum : int32_t {
+    kFlagsFieldNumber = 1,
+    kErrorFieldNumber = 2,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflags"; }
 
-  using FieldMetadata_ActualDisplayFrameStart =
-    ::protozero::proto_utils::FieldMetadata<
-      2,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FrameTimelineEvent_ActualDisplayFrameStart,
-      FrameTimelineEvent>;
+  using Flag = ::perfetto::protos::pbzero::AndroidAflags_Flag;
 
-  static constexpr FieldMetadata_ActualDisplayFrameStart kActualDisplayFrameStart{};
-  template <typename T = FrameTimelineEvent_ActualDisplayFrameStart> T* set_actual_display_frame_start() {
-    return BeginNestedMessage<T>(2);
+  using FlagPermission = ::perfetto::protos::pbzero::AndroidAflags_FlagPermission;
+  static inline const char* FlagPermission_Name(FlagPermission value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_FlagPermission_Name(value);
   }
 
-
-  using FieldMetadata_ExpectedSurfaceFrameStart =
-    ::protozero::proto_utils::FieldMetadata<
-      3,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FrameTimelineEvent_ExpectedSurfaceFrameStart,
-      FrameTimelineEvent>;
-
-  static constexpr FieldMetadata_ExpectedSurfaceFrameStart kExpectedSurfaceFrameStart{};
-  template <typename T = FrameTimelineEvent_ExpectedSurfaceFrameStart> T* set_expected_surface_frame_start() {
-    return BeginNestedMessage<T>(3);
+  using ValuePickedFrom = ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom;
+  static inline const char* ValuePickedFrom_Name(ValuePickedFrom value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_ValuePickedFrom_Name(value);
   }
 
-
-  using FieldMetadata_ActualSurfaceFrameStart =
-    ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FrameTimelineEvent_ActualSurfaceFrameStart,
-      FrameTimelineEvent>;
-
-  static constexpr FieldMetadata_ActualSurfaceFrameStart kActualSurfaceFrameStart{};
-  template <typename T = FrameTimelineEvent_ActualSurfaceFrameStart> T* set_actual_surface_frame_start() {
-    return BeginNestedMessage<T>(4);
+  using FlagStorageBackend = ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend;
+  static inline const char* FlagStorageBackend_Name(FlagStorageBackend value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_FlagStorageBackend_Name(value);
   }
 
+  using FlagType = ::perfetto::protos::pbzero::AndroidAflags_FlagType;
+  static inline const char* FlagType_Name(FlagType value) {
+    return ::perfetto::protos::pbzero::AndroidAflags_FlagType_Name(value);
+  }
+  static inline const FlagPermission FLAG_PERMISSION_UNSPECIFIED = FlagPermission::FLAG_PERMISSION_UNSPECIFIED;
+  static inline const FlagPermission FLAG_PERMISSION_READ_ONLY = FlagPermission::FLAG_PERMISSION_READ_ONLY;
+  static inline const FlagPermission FLAG_PERMISSION_READ_WRITE = FlagPermission::FLAG_PERMISSION_READ_WRITE;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_UNSPECIFIED = ValuePickedFrom::VALUE_PICKED_FROM_UNSPECIFIED;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_DEFAULT = ValuePickedFrom::VALUE_PICKED_FROM_DEFAULT;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_SERVER = ValuePickedFrom::VALUE_PICKED_FROM_SERVER;
+  static inline const ValuePickedFrom VALUE_PICKED_FROM_LOCAL = ValuePickedFrom::VALUE_PICKED_FROM_LOCAL;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_UNSPECIFIED = FlagStorageBackend::FLAG_STORAGE_BACKEND_UNSPECIFIED;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_NONE = FlagStorageBackend::FLAG_STORAGE_BACKEND_NONE;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_ACONFIGD = FlagStorageBackend::FLAG_STORAGE_BACKEND_ACONFIGD;
+  static inline const FlagStorageBackend FLAG_STORAGE_BACKEND_DEVICE_CONFIG = FlagStorageBackend::FLAG_STORAGE_BACKEND_DEVICE_CONFIG;
+  static inline const FlagType FLAG_TYPE_UNSPECIFIED = FlagType::FLAG_TYPE_UNSPECIFIED;
+  static inline const FlagType FLAG_TYPE_BOOLEAN = FlagType::FLAG_TYPE_BOOLEAN;
+  static inline const FlagType FLAG_TYPE_INTEGER = FlagType::FLAG_TYPE_INTEGER;
 
-  using FieldMetadata_FrameEnd =
+  using FieldMetadata_Flags =
     ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
       ::protozero::proto_utils::ProtoSchemaType::kMessage,
-      FrameTimelineEvent_FrameEnd,
-      FrameTimelineEvent>;
+      AndroidAflags_Flag,
+      AndroidAflags>;
 
-  static constexpr FieldMetadata_FrameEnd kFrameEnd{};
-  template <typename T = FrameTimelineEvent_FrameEnd> T* set_frame_end() {
-    return BeginNestedMessage<T>(5);
+  static constexpr FieldMetadata_Flags kFlags{};
+  template <typename T = AndroidAflags_Flag> T* add_flags() {
+    return BeginNestedMessage<T>(1);
   }
 
-};
-
-class FrameTimelineEvent_FrameEnd_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
- public:
-  FrameTimelineEvent_FrameEnd_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FrameTimelineEvent_FrameEnd_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FrameTimelineEvent_FrameEnd_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_cookie() const { return at<1>().valid(); }
-  int64_t cookie() const { return at<1>().as_int64(); }
-};
-
-class FrameTimelineEvent_FrameEnd : public ::protozero::Message {
- public:
-  using Decoder = FrameTimelineEvent_FrameEnd_Decoder;
-  enum : int32_t {
-    kCookieFieldNumber = 1,
-  };
-  static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.FrameEnd"; }
 
-
-  using FieldMetadata_Cookie =
+  using FieldMetadata_Error =
     ::protozero::proto_utils::FieldMetadata<
-      1,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_FrameEnd>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags>;
 
-  static constexpr FieldMetadata_Cookie kCookie{};
-  void set_cookie(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Cookie::kFieldId;
+  static constexpr FieldMetadata_Error kError{};
+  void set_error(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Error::kFieldId, data, size);
+  }
+  void set_error(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Error::kFieldId, chars.data, chars.size);
+  }
+  void set_error(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Error::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 };
 
-class FrameTimelineEvent_ActualDisplayFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/16> {
+class AndroidAflags_Flag_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/10> {
  public:
-  FrameTimelineEvent_ActualDisplayFrameStart_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FrameTimelineEvent_ActualDisplayFrameStart_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FrameTimelineEvent_ActualDisplayFrameStart_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_cookie() const { return at<1>().valid(); }
-  int64_t cookie() const { return at<1>().as_int64(); }
-  bool has_token() const { return at<2>().valid(); }
-  int64_t token() const { return at<2>().as_int64(); }
-  bool has_pid() const { return at<3>().valid(); }
-  int32_t pid() const { return at<3>().as_int32(); }
-  bool has_present_type() const { return at<4>().valid(); }
-  int32_t present_type() const { return at<4>().as_int32(); }
-  bool has_on_time_finish() const { return at<5>().valid(); }
-  bool on_time_finish() const { return at<5>().as_bool(); }
-  bool has_gpu_composition() const { return at<6>().valid(); }
-  bool gpu_composition() const { return at<6>().as_bool(); }
-  bool has_jank_type() const { return at<7>().valid(); }
-  int32_t jank_type() const { return at<7>().as_int32(); }
-  bool has_prediction_type() const { return at<8>().valid(); }
-  int32_t prediction_type() const { return at<8>().as_int32(); }
-  bool has_jank_severity_type() const { return at<9>().valid(); }
-  int32_t jank_severity_type() const { return at<9>().as_int32(); }
-  bool has_present_delay_millis() const { return at<10>().valid(); }
-  float present_delay_millis() const { return at<10>().as_float(); }
-  bool has_jank_severity_score() const { return at<11>().valid(); }
-  float jank_severity_score() const { return at<11>().as_float(); }
-  bool has_jank_type_experimental() const { return at<12>().valid(); }
-  int32_t jank_type_experimental() const { return at<12>().as_int32(); }
-  bool has_present_type_experimental() const { return at<13>().valid(); }
-  int32_t present_type_experimental() const { return at<13>().as_int32(); }
-  bool has_jank_debug_metadata() const { return at<14>().valid(); }
-  float jank_debug_metadata() const { return at<14>().as_float(); }
-  bool has_latched_unsignaled_count() const { return at<15>().valid(); }
-  int64_t latched_unsignaled_count() const { return at<15>().as_int64(); }
-  bool has_addressable_unsignaled_latch_count() const { return at<16>().valid(); }
-  int64_t addressable_unsignaled_latch_count() const { return at<16>().as_int64(); }
-};
-
-class FrameTimelineEvent_ActualDisplayFrameStart : public ::protozero::Message {
- public:
-  using Decoder = FrameTimelineEvent_ActualDisplayFrameStart_Decoder;
-  enum : int32_t {
-    kCookieFieldNumber = 1,
-    kTokenFieldNumber = 2,
-    kPidFieldNumber = 3,
-    kPresentTypeFieldNumber = 4,
-    kOnTimeFinishFieldNumber = 5,
-    kGpuCompositionFieldNumber = 6,
-    kJankTypeFieldNumber = 7,
-    kPredictionTypeFieldNumber = 8,
-    kJankSeverityTypeFieldNumber = 9,
-    kPresentDelayMillisFieldNumber = 10,
-    kJankSeverityScoreFieldNumber = 11,
-    kJankTypeExperimentalFieldNumber = 12,
-    kPresentTypeExperimentalFieldNumber = 13,
-    kJankDebugMetadataFieldNumber = 14,
-    kLatchedUnsignaledCountFieldNumber = 15,
-    kAddressableUnsignaledLatchCountFieldNumber = 16,
+  AndroidAflags_Flag_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidAflags_Flag_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidAflags_Flag_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_flag_namespace() const { return at<1>().valid(); }
+  ::protozero::ConstChars flag_namespace() const { return at<1>().as_string(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+  bool has_pkg() const { return at<3>().valid(); }
+  ::protozero::ConstChars pkg() const { return at<3>().as_string(); }
+  bool has_container() const { return at<4>().valid(); }
+  ::protozero::ConstChars container() const { return at<4>().as_string(); }
+  bool has_value() const { return at<5>().valid(); }
+  ::protozero::ConstChars value() const { return at<5>().as_string(); }
+  bool has_staged_value() const { return at<6>().valid(); }
+  ::protozero::ConstChars staged_value() const { return at<6>().as_string(); }
+  bool has_permission() const { return at<7>().valid(); }
+  int32_t permission() const { return at<7>().as_int32(); }
+  bool has_value_picked_from() const { return at<8>().valid(); }
+  int32_t value_picked_from() const { return at<8>().as_int32(); }
+  bool has_storage_backend() const { return at<9>().valid(); }
+  int32_t storage_backend() const { return at<9>().as_int32(); }
+  bool has_type() const { return at<10>().valid(); }
+  int32_t type() const { return at<10>().as_int32(); }
+};
+
+class AndroidAflags_Flag : public ::protozero::Message {
+ public:
+  using Decoder = AndroidAflags_Flag_Decoder;
+  enum : int32_t {
+    kFlagNamespaceFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kPkgFieldNumber = 3,
+    kContainerFieldNumber = 4,
+    kValueFieldNumber = 5,
+    kStagedValueFieldNumber = 6,
+    kPermissionFieldNumber = 7,
+    kValuePickedFromFieldNumber = 8,
+    kStorageBackendFieldNumber = 9,
+    kTypeFieldNumber = 10,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.ActualDisplayFrameStart"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidAflags.Flag"; }
 
 
-  using FieldMetadata_Cookie =
+  using FieldMetadata_FlagNamespace =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Cookie kCookie{};
-  void set_cookie(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Cookie::kFieldId;
+  static constexpr FieldMetadata_FlagNamespace kFlagNamespace{};
+  void set_flag_namespace(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_FlagNamespace::kFieldId, data, size);
+  }
+  void set_flag_namespace(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_FlagNamespace::kFieldId, chars.data, chars.size);
+  }
+  void set_flag_namespace(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_FlagNamespace::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Token =
+  using FieldMetadata_Name =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Token kToken{};
-  void set_token(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Token::kFieldId;
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Pid =
+  using FieldMetadata_Pkg =
     ::protozero::proto_utils::FieldMetadata<
       3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+  static constexpr FieldMetadata_Pkg kPkg{};
+  void set_pkg(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Pkg::kFieldId, data, size);
+  }
+  void set_pkg(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Pkg::kFieldId, chars.data, chars.size);
+  }
+  void set_pkg(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pkg::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PresentType =
+  using FieldMetadata_Container =
     ::protozero::proto_utils::FieldMetadata<
       4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_PresentType,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_PresentType kPresentType{};
-  void set_present_type(FrameTimelineEvent_PresentType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PresentType::kFieldId;
+  static constexpr FieldMetadata_Container kContainer{};
+  void set_container(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Container::kFieldId, data, size);
+  }
+  void set_container(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Container::kFieldId, chars.data, chars.size);
+  }
+  void set_container(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Container::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_OnTimeFinish =
+  using FieldMetadata_Value =
     ::protozero::proto_utils::FieldMetadata<
       5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_OnTimeFinish kOnTimeFinish{};
-  void set_on_time_finish(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_OnTimeFinish::kFieldId;
+  static constexpr FieldMetadata_Value kValue{};
+  void set_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
+  }
+  void set_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
+  }
+  void set_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_GpuComposition =
+  using FieldMetadata_StagedValue =
     ::protozero::proto_utils::FieldMetadata<
       6,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_GpuComposition kGpuComposition{};
-  void set_gpu_composition(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_GpuComposition::kFieldId;
+  static constexpr FieldMetadata_StagedValue kStagedValue{};
+  void set_staged_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StagedValue::kFieldId, data, size);
+  }
+  void set_staged_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StagedValue::kFieldId, chars.data, chars.size);
+  }
+  void set_staged_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StagedValue::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_JankType =
+  using FieldMetadata_Permission =
     ::protozero::proto_utils::FieldMetadata<
       7,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      AndroidAflags_FlagPermission,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_JankType kJankType{};
-  void set_jank_type(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankType::kFieldId;
+  static constexpr FieldMetadata_Permission kPermission{};
+  void set_permission(AndroidAflags_FlagPermission value) {
+    static constexpr uint32_t field_id = FieldMetadata_Permission::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PredictionType =
+  using FieldMetadata_ValuePickedFrom =
     ::protozero::proto_utils::FieldMetadata<
       8,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_PredictionType,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      AndroidAflags_ValuePickedFrom,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_PredictionType kPredictionType{};
-  void set_prediction_type(FrameTimelineEvent_PredictionType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PredictionType::kFieldId;
+  static constexpr FieldMetadata_ValuePickedFrom kValuePickedFrom{};
+  void set_value_picked_from(AndroidAflags_ValuePickedFrom value) {
+    static constexpr uint32_t field_id = FieldMetadata_ValuePickedFrom::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -72193,17 +69742,17 @@ class FrameTimelineEvent_ActualDisplayFrameStart : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_JankSeverityType =
+  using FieldMetadata_StorageBackend =
     ::protozero::proto_utils::FieldMetadata<
       9,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_JankSeverityType,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      AndroidAflags_FlagStorageBackend,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_JankSeverityType kJankSeverityType{};
-  void set_jank_severity_type(FrameTimelineEvent_JankSeverityType value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankSeverityType::kFieldId;
+  static constexpr FieldMetadata_StorageBackend kStorageBackend{};
+  void set_storage_backend(AndroidAflags_FlagStorageBackend value) {
+    static constexpr uint32_t field_id = FieldMetadata_StorageBackend::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -72211,403 +69760,556 @@ class FrameTimelineEvent_ActualDisplayFrameStart : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PresentDelayMillis =
+  using FieldMetadata_Type =
     ::protozero::proto_utils::FieldMetadata<
       10,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      AndroidAflags_FlagType,
+      AndroidAflags_Flag>;
 
-  static constexpr FieldMetadata_PresentDelayMillis kPresentDelayMillis{};
-  void set_present_delay_millis(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_PresentDelayMillis::kFieldId;
+  static constexpr FieldMetadata_Type kType{};
+  void set_type(AndroidAflags_FlagType value) {
+    static constexpr uint32_t field_id = FieldMetadata_Type::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
         ::Append(*this, field_id, value);
   }
+};
+
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_game_intervention_list.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_GAME_INTERVENTION_LIST_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_GAME_INTERVENTION_LIST_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class AndroidGameInterventionList_GameModeInfo;
+class AndroidGameInterventionList_GamePackageInfo;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
 
-  using FieldMetadata_JankSeverityScore =
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class AndroidGameInterventionList_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  AndroidGameInterventionList_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidGameInterventionList_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidGameInterventionList_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_game_packages() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> game_packages() const { return GetRepeated<::protozero::ConstBytes>(1); }
+  bool has_parse_error() const { return at<2>().valid(); }
+  bool parse_error() const { return at<2>().as_bool(); }
+  bool has_read_error() const { return at<3>().valid(); }
+  bool read_error() const { return at<3>().as_bool(); }
+};
+
+class AndroidGameInterventionList : public ::protozero::Message {
+ public:
+  using Decoder = AndroidGameInterventionList_Decoder;
+  enum : int32_t {
+    kGamePackagesFieldNumber = 1,
+    kParseErrorFieldNumber = 2,
+    kReadErrorFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidGameInterventionList"; }
+
+  using GameModeInfo = ::perfetto::protos::pbzero::AndroidGameInterventionList_GameModeInfo;
+  using GamePackageInfo = ::perfetto::protos::pbzero::AndroidGameInterventionList_GamePackageInfo;
+
+  using FieldMetadata_GamePackages =
     ::protozero::proto_utils::FieldMetadata<
-      11,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidGameInterventionList_GamePackageInfo,
+      AndroidGameInterventionList>;
 
-  static constexpr FieldMetadata_JankSeverityScore kJankSeverityScore{};
-  void set_jank_severity_score(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankSeverityScore::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_GamePackages kGamePackages{};
+  template <typename T = AndroidGameInterventionList_GamePackageInfo> T* add_game_packages() {
+    return BeginNestedMessage<T>(1);
   }
 
-  using FieldMetadata_JankTypeExperimental =
+
+  using FieldMetadata_ParseError =
     ::protozero::proto_utils::FieldMetadata<
-      12,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      AndroidGameInterventionList>;
 
-  static constexpr FieldMetadata_JankTypeExperimental kJankTypeExperimental{};
-  void set_jank_type_experimental(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankTypeExperimental::kFieldId;
+  static constexpr FieldMetadata_ParseError kParseError{};
+  void set_parse_error(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_ParseError::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PresentTypeExperimental =
+  using FieldMetadata_ReadError =
     ::protozero::proto_utils::FieldMetadata<
-      13,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_PresentType,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      AndroidGameInterventionList>;
 
-  static constexpr FieldMetadata_PresentTypeExperimental kPresentTypeExperimental{};
-  void set_present_type_experimental(FrameTimelineEvent_PresentType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PresentTypeExperimental::kFieldId;
+  static constexpr FieldMetadata_ReadError kReadError{};
+  void set_read_error(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_ReadError::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
+};
+
+class AndroidGameInterventionList_GamePackageInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  AndroidGameInterventionList_GamePackageInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidGameInterventionList_GamePackageInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidGameInterventionList_GamePackageInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars name() const { return at<1>().as_string(); }
+  bool has_uid() const { return at<2>().valid(); }
+  uint64_t uid() const { return at<2>().as_uint64(); }
+  bool has_current_mode() const { return at<3>().valid(); }
+  uint32_t current_mode() const { return at<3>().as_uint32(); }
+  bool has_game_mode_info() const { return at<4>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> game_mode_info() const { return GetRepeated<::protozero::ConstBytes>(4); }
+};
+
+class AndroidGameInterventionList_GamePackageInfo : public ::protozero::Message {
+ public:
+  using Decoder = AndroidGameInterventionList_GamePackageInfo_Decoder;
+  enum : int32_t {
+    kNameFieldNumber = 1,
+    kUidFieldNumber = 2,
+    kCurrentModeFieldNumber = 3,
+    kGameModeInfoFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidGameInterventionList.GamePackageInfo"; }
+
 
-  using FieldMetadata_JankDebugMetadata =
+  using FieldMetadata_Name =
     ::protozero::proto_utils::FieldMetadata<
-      14,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidGameInterventionList_GamePackageInfo>;
 
-  static constexpr FieldMetadata_JankDebugMetadata kJankDebugMetadata{};
-  void set_jank_debug_metadata(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankDebugMetadata::kFieldId;
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_LatchedUnsignaledCount =
+  using FieldMetadata_Uid =
     ::protozero::proto_utils::FieldMetadata<
-      15,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      AndroidGameInterventionList_GamePackageInfo>;
 
-  static constexpr FieldMetadata_LatchedUnsignaledCount kLatchedUnsignaledCount{};
-  void set_latched_unsignaled_count(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_LatchedUnsignaledCount::kFieldId;
+  static constexpr FieldMetadata_Uid kUid{};
+  void set_uid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_AddressableUnsignaledLatchCount =
+  using FieldMetadata_CurrentMode =
     ::protozero::proto_utils::FieldMetadata<
-      16,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      AndroidGameInterventionList_GamePackageInfo>;
 
-  static constexpr FieldMetadata_AddressableUnsignaledLatchCount kAddressableUnsignaledLatchCount{};
-  void set_addressable_unsignaled_latch_count(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_AddressableUnsignaledLatchCount::kFieldId;
+  static constexpr FieldMetadata_CurrentMode kCurrentMode{};
+  void set_current_mode(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CurrentMode::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_GameModeInfo =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidGameInterventionList_GameModeInfo,
+      AndroidGameInterventionList_GamePackageInfo>;
+
+  static constexpr FieldMetadata_GameModeInfo kGameModeInfo{};
+  template <typename T = AndroidGameInterventionList_GameModeInfo> T* add_game_mode_info() {
+    return BeginNestedMessage<T>(4);
+  }
+
 };
 
-class FrameTimelineEvent_ExpectedDisplayFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class AndroidGameInterventionList_GameModeInfo_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
  public:
-  FrameTimelineEvent_ExpectedDisplayFrameStart_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FrameTimelineEvent_ExpectedDisplayFrameStart_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FrameTimelineEvent_ExpectedDisplayFrameStart_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_cookie() const { return at<1>().valid(); }
-  int64_t cookie() const { return at<1>().as_int64(); }
-  bool has_token() const { return at<2>().valid(); }
-  int64_t token() const { return at<2>().as_int64(); }
-  bool has_pid() const { return at<3>().valid(); }
-  int32_t pid() const { return at<3>().as_int32(); }
+  AndroidGameInterventionList_GameModeInfo_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidGameInterventionList_GameModeInfo_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidGameInterventionList_GameModeInfo_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_mode() const { return at<1>().valid(); }
+  uint32_t mode() const { return at<1>().as_uint32(); }
+  bool has_use_angle() const { return at<2>().valid(); }
+  bool use_angle() const { return at<2>().as_bool(); }
+  bool has_resolution_downscale() const { return at<3>().valid(); }
+  float resolution_downscale() const { return at<3>().as_float(); }
+  bool has_fps() const { return at<4>().valid(); }
+  float fps() const { return at<4>().as_float(); }
 };
 
-class FrameTimelineEvent_ExpectedDisplayFrameStart : public ::protozero::Message {
+class AndroidGameInterventionList_GameModeInfo : public ::protozero::Message {
  public:
-  using Decoder = FrameTimelineEvent_ExpectedDisplayFrameStart_Decoder;
+  using Decoder = AndroidGameInterventionList_GameModeInfo_Decoder;
   enum : int32_t {
-    kCookieFieldNumber = 1,
-    kTokenFieldNumber = 2,
-    kPidFieldNumber = 3,
+    kModeFieldNumber = 1,
+    kUseAngleFieldNumber = 2,
+    kResolutionDownscaleFieldNumber = 3,
+    kFpsFieldNumber = 4,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.ExpectedDisplayFrameStart"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidGameInterventionList.GameModeInfo"; }
 
 
-  using FieldMetadata_Cookie =
+  using FieldMetadata_Mode =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ExpectedDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      AndroidGameInterventionList_GameModeInfo>;
 
-  static constexpr FieldMetadata_Cookie kCookie{};
-  void set_cookie(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Cookie::kFieldId;
+  static constexpr FieldMetadata_Mode kMode{};
+  void set_mode(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Mode::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Token =
+  using FieldMetadata_UseAngle =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ExpectedDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kBool,
+      bool,
+      AndroidGameInterventionList_GameModeInfo>;
 
-  static constexpr FieldMetadata_Token kToken{};
-  void set_token(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Token::kFieldId;
+  static constexpr FieldMetadata_UseAngle kUseAngle{};
+  void set_use_angle(bool value) {
+    static constexpr uint32_t field_id = FieldMetadata_UseAngle::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kBool>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Pid =
+  using FieldMetadata_ResolutionDownscale =
     ::protozero::proto_utils::FieldMetadata<
       3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ExpectedDisplayFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kFloat,
+      float,
+      AndroidGameInterventionList_GameModeInfo>;
 
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+  static constexpr FieldMetadata_ResolutionDownscale kResolutionDownscale{};
+  void set_resolution_downscale(float value) {
+    static constexpr uint32_t field_id = FieldMetadata_ResolutionDownscale::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Fps =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kFloat,
+      float,
+      AndroidGameInterventionList_GameModeInfo>;
+
+  static constexpr FieldMetadata_Fps kFps{};
+  void set_fps(float value) {
+    static constexpr uint32_t field_id = FieldMetadata_Fps::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kFloat>
         ::Append(*this, field_id, value);
   }
 };
 
-class FrameTimelineEvent_ActualSurfaceFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/20> {
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_log.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_LOG_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_LOG_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class AndroidLogPacket_LogEvent;
+class AndroidLogPacket_LogEvent_Arg;
+class AndroidLogPacket_Stats;
+enum AndroidLogId : int32_t;
+enum AndroidLogPriority : int32_t;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class AndroidLogPacket_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
+ public:
+  AndroidLogPacket_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidLogPacket_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidLogPacket_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_events() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> events() const { return GetRepeated<::protozero::ConstBytes>(1); }
+  bool has_stats() const { return at<2>().valid(); }
+  ::protozero::ConstBytes stats() const { return at<2>().as_bytes(); }
+};
+
+class AndroidLogPacket : public ::protozero::Message {
  public:
-  FrameTimelineEvent_ActualSurfaceFrameStart_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FrameTimelineEvent_ActualSurfaceFrameStart_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FrameTimelineEvent_ActualSurfaceFrameStart_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_cookie() const { return at<1>().valid(); }
-  int64_t cookie() const { return at<1>().as_int64(); }
-  bool has_token() const { return at<2>().valid(); }
-  int64_t token() const { return at<2>().as_int64(); }
-  bool has_display_frame_token() const { return at<3>().valid(); }
-  int64_t display_frame_token() const { return at<3>().as_int64(); }
-  bool has_pid() const { return at<4>().valid(); }
-  int32_t pid() const { return at<4>().as_int32(); }
-  bool has_layer_name() const { return at<5>().valid(); }
-  ::protozero::ConstChars layer_name() const { return at<5>().as_string(); }
-  bool has_present_type() const { return at<6>().valid(); }
-  int32_t present_type() const { return at<6>().as_int32(); }
-  bool has_on_time_finish() const { return at<7>().valid(); }
-  bool on_time_finish() const { return at<7>().as_bool(); }
-  bool has_gpu_composition() const { return at<8>().valid(); }
-  bool gpu_composition() const { return at<8>().as_bool(); }
-  bool has_jank_type() const { return at<9>().valid(); }
-  int32_t jank_type() const { return at<9>().as_int32(); }
-  bool has_prediction_type() const { return at<10>().valid(); }
-  int32_t prediction_type() const { return at<10>().as_int32(); }
-  bool has_is_buffer() const { return at<11>().valid(); }
-  bool is_buffer() const { return at<11>().as_bool(); }
-  bool has_jank_severity_type() const { return at<12>().valid(); }
-  int32_t jank_severity_type() const { return at<12>().as_int32(); }
-  bool has_present_delay_millis() const { return at<13>().valid(); }
-  float present_delay_millis() const { return at<13>().as_float(); }
-  bool has_vsync_resynced_jitter_millis() const { return at<14>().valid(); }
-  float vsync_resynced_jitter_millis() const { return at<14>().as_float(); }
-  bool has_jank_severity_score() const { return at<15>().valid(); }
-  float jank_severity_score() const { return at<15>().as_float(); }
-  bool has_jank_type_experimental() const { return at<16>().valid(); }
-  int32_t jank_type_experimental() const { return at<16>().as_int32(); }
-  bool has_present_type_experimental() const { return at<17>().valid(); }
-  int32_t present_type_experimental() const { return at<17>().as_int32(); }
-  bool has_jank_debug_metadata() const { return at<18>().valid(); }
-  float jank_debug_metadata() const { return at<18>().as_float(); }
-  bool has_latched_fence_state() const { return at<19>().valid(); }
-  int32_t latched_fence_state() const { return at<19>().as_int32(); }
-  bool has_animation_time_millis() const { return at<20>().valid(); }
-  float animation_time_millis() const { return at<20>().as_float(); }
-};
-
-class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
- public:
-  using Decoder = FrameTimelineEvent_ActualSurfaceFrameStart_Decoder;
-  enum : int32_t {
-    kCookieFieldNumber = 1,
-    kTokenFieldNumber = 2,
-    kDisplayFrameTokenFieldNumber = 3,
-    kPidFieldNumber = 4,
-    kLayerNameFieldNumber = 5,
-    kPresentTypeFieldNumber = 6,
-    kOnTimeFinishFieldNumber = 7,
-    kGpuCompositionFieldNumber = 8,
-    kJankTypeFieldNumber = 9,
-    kPredictionTypeFieldNumber = 10,
-    kIsBufferFieldNumber = 11,
-    kJankSeverityTypeFieldNumber = 12,
-    kPresentDelayMillisFieldNumber = 13,
-    kVsyncResyncedJitterMillisFieldNumber = 14,
-    kJankSeverityScoreFieldNumber = 15,
-    kJankTypeExperimentalFieldNumber = 16,
-    kPresentTypeExperimentalFieldNumber = 17,
-    kJankDebugMetadataFieldNumber = 18,
-    kLatchedFenceStateFieldNumber = 19,
-    kAnimationTimeMillisFieldNumber = 20,
+  using Decoder = AndroidLogPacket_Decoder;
+  enum : int32_t {
+    kEventsFieldNumber = 1,
+    kStatsFieldNumber = 2,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.ActualSurfaceFrameStart"; }
-
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket"; }
 
-  using LatchedFenceState = ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState;
-  static inline const char* LatchedFenceState_Name(LatchedFenceState value) {
-    return ::perfetto::protos::pbzero::FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState_Name(value);
-  }
-  static inline const LatchedFenceState LATCHED_UNKNOWN = LatchedFenceState::LATCHED_UNKNOWN;
-  static inline const LatchedFenceState LATCHED_SIGNALED = LatchedFenceState::LATCHED_SIGNALED;
-  static inline const LatchedFenceState LATCHED_UNSIGNALED = LatchedFenceState::LATCHED_UNSIGNALED;
-  static inline const LatchedFenceState LATCHED_DELAYED_LATCH_UNSIGNALED = LatchedFenceState::LATCHED_DELAYED_LATCH_UNSIGNALED;
+  using LogEvent = ::perfetto::protos::pbzero::AndroidLogPacket_LogEvent;
+  using Stats = ::perfetto::protos::pbzero::AndroidLogPacket_Stats;
 
-  using FieldMetadata_Cookie =
+  using FieldMetadata_Events =
     ::protozero::proto_utils::FieldMetadata<
       1,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidLogPacket_LogEvent,
+      AndroidLogPacket>;
 
-  static constexpr FieldMetadata_Cookie kCookie{};
-  void set_cookie(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Cookie::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Events kEvents{};
+  template <typename T = AndroidLogPacket_LogEvent> T* add_events() {
+    return BeginNestedMessage<T>(1);
   }
 
-  using FieldMetadata_Token =
+
+  using FieldMetadata_Stats =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidLogPacket_Stats,
+      AndroidLogPacket>;
 
-  static constexpr FieldMetadata_Token kToken{};
-  void set_token(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Token::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Stats kStats{};
+  template <typename T = AndroidLogPacket_Stats> T* set_stats() {
+    return BeginNestedMessage<T>(2);
   }
 
-  using FieldMetadata_DisplayFrameToken =
+};
+
+class AndroidLogPacket_Stats_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  AndroidLogPacket_Stats_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidLogPacket_Stats_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidLogPacket_Stats_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_num_total() const { return at<1>().valid(); }
+  uint64_t num_total() const { return at<1>().as_uint64(); }
+  bool has_num_failed() const { return at<2>().valid(); }
+  uint64_t num_failed() const { return at<2>().as_uint64(); }
+  bool has_num_skipped() const { return at<3>().valid(); }
+  uint64_t num_skipped() const { return at<3>().as_uint64(); }
+};
+
+class AndroidLogPacket_Stats : public ::protozero::Message {
+ public:
+  using Decoder = AndroidLogPacket_Stats_Decoder;
+  enum : int32_t {
+    kNumTotalFieldNumber = 1,
+    kNumFailedFieldNumber = 2,
+    kNumSkippedFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket.Stats"; }
+
+
+  using FieldMetadata_NumTotal =
     ::protozero::proto_utils::FieldMetadata<
-      3,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      AndroidLogPacket_Stats>;
 
-  static constexpr FieldMetadata_DisplayFrameToken kDisplayFrameToken{};
-  void set_display_frame_token(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisplayFrameToken::kFieldId;
+  static constexpr FieldMetadata_NumTotal kNumTotal{};
+  void set_num_total(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumTotal::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Pid =
+  using FieldMetadata_NumFailed =
     ::protozero::proto_utils::FieldMetadata<
-      4,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      AndroidLogPacket_Stats>;
 
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+  static constexpr FieldMetadata_NumFailed kNumFailed{};
+  void set_num_failed(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumFailed::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_LayerName =
+  using FieldMetadata_NumSkipped =
     ::protozero::proto_utils::FieldMetadata<
-      5,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      AndroidLogPacket_Stats>;
 
-  static constexpr FieldMetadata_LayerName kLayerName{};
-  void set_layer_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_LayerName::kFieldId, data, size);
-  }
-  void set_layer_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_LayerName::kFieldId, chars.data, chars.size);
-  }
-  void set_layer_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerName::kFieldId;
+  static constexpr FieldMetadata_NumSkipped kNumSkipped{};
+  void set_num_skipped(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumSkipped::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
+};
+
+class AndroidLogPacket_LogEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/9> {
+ public:
+  AndroidLogPacket_LogEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidLogPacket_LogEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidLogPacket_LogEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_log_id() const { return at<1>().valid(); }
+  int32_t log_id() const { return at<1>().as_int32(); }
+  bool has_pid() const { return at<2>().valid(); }
+  int32_t pid() const { return at<2>().as_int32(); }
+  bool has_tid() const { return at<3>().valid(); }
+  int32_t tid() const { return at<3>().as_int32(); }
+  bool has_uid() const { return at<4>().valid(); }
+  int32_t uid() const { return at<4>().as_int32(); }
+  bool has_timestamp() const { return at<5>().valid(); }
+  uint64_t timestamp() const { return at<5>().as_uint64(); }
+  bool has_tag() const { return at<6>().valid(); }
+  ::protozero::ConstChars tag() const { return at<6>().as_string(); }
+  bool has_prio() const { return at<7>().valid(); }
+  int32_t prio() const { return at<7>().as_int32(); }
+  bool has_message() const { return at<8>().valid(); }
+  ::protozero::ConstChars message() const { return at<8>().as_string(); }
+  bool has_args() const { return at<9>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> args() const { return GetRepeated<::protozero::ConstBytes>(9); }
+};
+
+class AndroidLogPacket_LogEvent : public ::protozero::Message {
+ public:
+  using Decoder = AndroidLogPacket_LogEvent_Decoder;
+  enum : int32_t {
+    kLogIdFieldNumber = 1,
+    kPidFieldNumber = 2,
+    kTidFieldNumber = 3,
+    kUidFieldNumber = 4,
+    kTimestampFieldNumber = 5,
+    kTagFieldNumber = 6,
+    kPrioFieldNumber = 7,
+    kMessageFieldNumber = 8,
+    kArgsFieldNumber = 9,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket.LogEvent"; }
+
+  using Arg = ::perfetto::protos::pbzero::AndroidLogPacket_LogEvent_Arg;
 
-  using FieldMetadata_PresentType =
+  using FieldMetadata_LogId =
     ::protozero::proto_utils::FieldMetadata<
-      6,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_PresentType,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      AndroidLogId,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_PresentType kPresentType{};
-  void set_present_type(FrameTimelineEvent_PresentType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PresentType::kFieldId;
+  static constexpr FieldMetadata_LogId kLogId{};
+  void set_log_id(AndroidLogId value) {
+    static constexpr uint32_t field_id = FieldMetadata_LogId::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -72615,53 +70317,53 @@ class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_OnTimeFinish =
+  using FieldMetadata_Pid =
     ::protozero::proto_utils::FieldMetadata<
-      7,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_OnTimeFinish kOnTimeFinish{};
-  void set_on_time_finish(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_OnTimeFinish::kFieldId;
+  static constexpr FieldMetadata_Pid kPid{};
+  void set_pid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_GpuComposition =
+  using FieldMetadata_Tid =
     ::protozero::proto_utils::FieldMetadata<
-      8,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_GpuComposition kGpuComposition{};
-  void set_gpu_composition(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_GpuComposition::kFieldId;
+  static constexpr FieldMetadata_Tid kTid{};
+  void set_tid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Tid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_JankType =
+  using FieldMetadata_Uid =
     ::protozero::proto_utils::FieldMetadata<
-      9,
+      4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kInt32,
       int32_t,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_JankType kJankType{};
-  void set_jank_type(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankType::kFieldId;
+  static constexpr FieldMetadata_Uid kUid{};
+  void set_uid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Uid::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -72669,53 +70371,59 @@ class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PredictionType =
+  using FieldMetadata_Timestamp =
     ::protozero::proto_utils::FieldMetadata<
-      10,
+      5,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_PredictionType,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_PredictionType kPredictionType{};
-  void set_prediction_type(FrameTimelineEvent_PredictionType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PredictionType::kFieldId;
+  static constexpr FieldMetadata_Timestamp kTimestamp{};
+  void set_timestamp(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Timestamp::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_IsBuffer =
+  using FieldMetadata_Tag =
     ::protozero::proto_utils::FieldMetadata<
-      11,
+      6,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kBool,
-      bool,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_IsBuffer kIsBuffer{};
-  void set_is_buffer(bool value) {
-    static constexpr uint32_t field_id = FieldMetadata_IsBuffer::kFieldId;
+  static constexpr FieldMetadata_Tag kTag{};
+  void set_tag(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Tag::kFieldId, data, size);
+  }
+  void set_tag(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Tag::kFieldId, chars.data, chars.size);
+  }
+  void set_tag(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Tag::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kBool>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_JankSeverityType =
+  using FieldMetadata_Prio =
     ::protozero::proto_utils::FieldMetadata<
-      12,
+      7,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_JankSeverityType,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      AndroidLogPriority,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_JankSeverityType kJankSeverityType{};
-  void set_jank_severity_type(FrameTimelineEvent_JankSeverityType value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankSeverityType::kFieldId;
+  static constexpr FieldMetadata_Prio kPrio{};
+  void set_prio(AndroidLogPriority value) {
+    static constexpr uint32_t field_id = FieldMetadata_Prio::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -72723,107 +70431,125 @@ class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PresentDelayMillis =
+  using FieldMetadata_Message =
     ::protozero::proto_utils::FieldMetadata<
-      13,
+      8,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_PresentDelayMillis kPresentDelayMillis{};
-  void set_present_delay_millis(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_PresentDelayMillis::kFieldId;
+  static constexpr FieldMetadata_Message kMessage{};
+  void set_message(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Message::kFieldId, data, size);
+  }
+  void set_message(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Message::kFieldId, chars.data, chars.size);
+  }
+  void set_message(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Message::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_VsyncResyncedJitterMillis =
+  using FieldMetadata_Args =
     ::protozero::proto_utils::FieldMetadata<
-      14,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      9,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidLogPacket_LogEvent_Arg,
+      AndroidLogPacket_LogEvent>;
 
-  static constexpr FieldMetadata_VsyncResyncedJitterMillis kVsyncResyncedJitterMillis{};
-  void set_vsync_resynced_jitter_millis(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_VsyncResyncedJitterMillis::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Args kArgs{};
+  template <typename T = AndroidLogPacket_LogEvent_Arg> T* add_args() {
+    return BeginNestedMessage<T>(9);
   }
 
-  using FieldMetadata_JankSeverityScore =
-    ::protozero::proto_utils::FieldMetadata<
-      15,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+};
+
+class AndroidLogPacket_LogEvent_Arg_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  AndroidLogPacket_LogEvent_Arg_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidLogPacket_LogEvent_Arg_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidLogPacket_LogEvent_Arg_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars name() const { return at<1>().as_string(); }
+  bool has_int_value() const { return at<2>().valid(); }
+  int64_t int_value() const { return at<2>().as_int64(); }
+  bool has_float_value() const { return at<3>().valid(); }
+  float float_value() const { return at<3>().as_float(); }
+  bool has_string_value() const { return at<4>().valid(); }
+  ::protozero::ConstChars string_value() const { return at<4>().as_string(); }
+};
+
+class AndroidLogPacket_LogEvent_Arg : public ::protozero::Message {
+ public:
+  using Decoder = AndroidLogPacket_LogEvent_Arg_Decoder;
+  enum : int32_t {
+    kNameFieldNumber = 1,
+    kIntValueFieldNumber = 2,
+    kFloatValueFieldNumber = 3,
+    kStringValueFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidLogPacket.LogEvent.Arg"; }
 
-  static constexpr FieldMetadata_JankSeverityScore kJankSeverityScore{};
-  void set_jank_severity_score(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankSeverityScore::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
-  }
 
-  using FieldMetadata_JankTypeExperimental =
+  using FieldMetadata_Name =
     ::protozero::proto_utils::FieldMetadata<
-      16,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidLogPacket_LogEvent_Arg>;
 
-  static constexpr FieldMetadata_JankTypeExperimental kJankTypeExperimental{};
-  void set_jank_type_experimental(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankTypeExperimental::kFieldId;
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_PresentTypeExperimental =
+  using FieldMetadata_IntValue =
     ::protozero::proto_utils::FieldMetadata<
-      17,
+      2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_PresentType,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kInt64,
+      int64_t,
+      AndroidLogPacket_LogEvent_Arg>;
 
-  static constexpr FieldMetadata_PresentTypeExperimental kPresentTypeExperimental{};
-  void set_present_type_experimental(FrameTimelineEvent_PresentType value) {
-    static constexpr uint32_t field_id = FieldMetadata_PresentTypeExperimental::kFieldId;
+  static constexpr FieldMetadata_IntValue kIntValue{};
+  void set_int_value(int64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_IntValue::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kInt64>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_JankDebugMetadata =
+  using FieldMetadata_FloatValue =
     ::protozero::proto_utils::FieldMetadata<
-      18,
+      3,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
       ::protozero::proto_utils::ProtoSchemaType::kFloat,
       float,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      AndroidLogPacket_LogEvent_Arg>;
 
-  static constexpr FieldMetadata_JankDebugMetadata kJankDebugMetadata{};
-  void set_jank_debug_metadata(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_JankDebugMetadata::kFieldId;
+  static constexpr FieldMetadata_FloatValue kFloatValue{};
+  void set_float_value(float value) {
+    static constexpr uint32_t field_id = FieldMetadata_FloatValue::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
@@ -72831,167 +70557,258 @@ class FrameTimelineEvent_ActualSurfaceFrameStart : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_LatchedFenceState =
+  using FieldMetadata_StringValue =
     ::protozero::proto_utils::FieldMetadata<
-      19,
+      4,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kEnum,
-      FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidLogPacket_LogEvent_Arg>;
 
-  static constexpr FieldMetadata_LatchedFenceState kLatchedFenceState{};
-  void set_latched_fence_state(FrameTimelineEvent_ActualSurfaceFrameStart_LatchedFenceState value) {
-    static constexpr uint32_t field_id = FieldMetadata_LatchedFenceState::kFieldId;
+  static constexpr FieldMetadata_StringValue kStringValue{};
+  void set_string_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_StringValue::kFieldId, data, size);
+  }
+  void set_string_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_StringValue::kFieldId, chars.data, chars.size);
+  }
+  void set_string_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_StringValue::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+};
+
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/android/android_system_property.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_SYSTEM_PROPERTY_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_ANDROID_SYSTEM_PROPERTY_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class AndroidSystemProperty_PropertyValue;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class AndroidSystemProperty_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  AndroidSystemProperty_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidSystemProperty_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidSystemProperty_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_values() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> values() const { return GetRepeated<::protozero::ConstBytes>(1); }
+};
+
+class AndroidSystemProperty : public ::protozero::Message {
+ public:
+  using Decoder = AndroidSystemProperty_Decoder;
+  enum : int32_t {
+    kValuesFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidSystemProperty"; }
+
+  using PropertyValue = ::perfetto::protos::pbzero::AndroidSystemProperty_PropertyValue;
 
-  using FieldMetadata_AnimationTimeMillis =
+  using FieldMetadata_Values =
     ::protozero::proto_utils::FieldMetadata<
-      20,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kFloat,
-      float,
-      FrameTimelineEvent_ActualSurfaceFrameStart>;
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      AndroidSystemProperty_PropertyValue,
+      AndroidSystemProperty>;
 
-  static constexpr FieldMetadata_AnimationTimeMillis kAnimationTimeMillis{};
-  void set_animation_time_millis(float value) {
-    static constexpr uint32_t field_id = FieldMetadata_AnimationTimeMillis::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kFloat>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Values kValues{};
+  template <typename T = AndroidSystemProperty_PropertyValue> T* add_values() {
+    return BeginNestedMessage<T>(1);
   }
+
 };
 
-class FrameTimelineEvent_ExpectedSurfaceFrameStart_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+class AndroidSystemProperty_PropertyValue_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
-  FrameTimelineEvent_ExpectedSurfaceFrameStart_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
-  explicit FrameTimelineEvent_ExpectedSurfaceFrameStart_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
-  explicit FrameTimelineEvent_ExpectedSurfaceFrameStart_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
-  bool has_cookie() const { return at<1>().valid(); }
-  int64_t cookie() const { return at<1>().as_int64(); }
-  bool has_token() const { return at<2>().valid(); }
-  int64_t token() const { return at<2>().as_int64(); }
-  bool has_display_frame_token() const { return at<3>().valid(); }
-  int64_t display_frame_token() const { return at<3>().as_int64(); }
-  bool has_pid() const { return at<4>().valid(); }
-  int32_t pid() const { return at<4>().as_int32(); }
-  bool has_layer_name() const { return at<5>().valid(); }
-  ::protozero::ConstChars layer_name() const { return at<5>().as_string(); }
+  AndroidSystemProperty_PropertyValue_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit AndroidSystemProperty_PropertyValue_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit AndroidSystemProperty_PropertyValue_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars name() const { return at<1>().as_string(); }
+  bool has_value() const { return at<2>().valid(); }
+  ::protozero::ConstChars value() const { return at<2>().as_string(); }
 };
 
-class FrameTimelineEvent_ExpectedSurfaceFrameStart : public ::protozero::Message {
+class AndroidSystemProperty_PropertyValue : public ::protozero::Message {
  public:
-  using Decoder = FrameTimelineEvent_ExpectedSurfaceFrameStart_Decoder;
+  using Decoder = AndroidSystemProperty_PropertyValue_Decoder;
   enum : int32_t {
-    kCookieFieldNumber = 1,
-    kTokenFieldNumber = 2,
-    kDisplayFrameTokenFieldNumber = 3,
-    kPidFieldNumber = 4,
-    kLayerNameFieldNumber = 5,
+    kNameFieldNumber = 1,
+    kValueFieldNumber = 2,
   };
-  static constexpr const char* GetName() { return ".perfetto.protos.FrameTimelineEvent.ExpectedSurfaceFrameStart"; }
+  static constexpr const char* GetName() { return ".perfetto.protos.AndroidSystemProperty.PropertyValue"; }
 
 
-  using FieldMetadata_Cookie =
+  using FieldMetadata_Name =
     ::protozero::proto_utils::FieldMetadata<
       1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ExpectedSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidSystemProperty_PropertyValue>;
 
-  static constexpr FieldMetadata_Cookie kCookie{};
-  void set_cookie(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Cookie::kFieldId;
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Token =
+  using FieldMetadata_Value =
     ::protozero::proto_utils::FieldMetadata<
       2,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ExpectedSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      AndroidSystemProperty_PropertyValue>;
 
-  static constexpr FieldMetadata_Token kToken{};
-  void set_token(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Token::kFieldId;
+  static constexpr FieldMetadata_Value kValue{};
+  void set_value(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Value::kFieldId, data, size);
+  }
+  void set_value(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Value::kFieldId, chars.data, chars.size);
+  }
+  void set_value(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Value::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kString>
         ::Append(*this, field_id, value);
   }
+};
+
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/android/cpu_per_uid_data.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_CPU_PER_UID_DATA_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_ANDROID_CPU_PER_UID_DATA_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class CpuPerUidData_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  CpuPerUidData_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit CpuPerUidData_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit CpuPerUidData_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_cluster_count() const { return at<1>().valid(); }
+  uint32_t cluster_count() const { return at<1>().as_uint32(); }
+  bool has_uid() const { return at<2>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t> uid(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint32_t>(2, parse_error_ptr); }
+  bool has_total_time_ms() const { return at<3>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> total_time_ms(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(3, parse_error_ptr); }
+};
+
+class CpuPerUidData : public ::protozero::Message {
+ public:
+  using Decoder = CpuPerUidData_Decoder;
+  enum : int32_t {
+    kClusterCountFieldNumber = 1,
+    kUidFieldNumber = 2,
+    kTotalTimeMsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.CpuPerUidData"; }
 
-  using FieldMetadata_DisplayFrameToken =
+
+  using FieldMetadata_ClusterCount =
     ::protozero::proto_utils::FieldMetadata<
-      3,
+      1,
       ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt64,
-      int64_t,
-      FrameTimelineEvent_ExpectedSurfaceFrameStart>;
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      CpuPerUidData>;
 
-  static constexpr FieldMetadata_DisplayFrameToken kDisplayFrameToken{};
-  void set_display_frame_token(int64_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_DisplayFrameToken::kFieldId;
+  static constexpr FieldMetadata_ClusterCount kClusterCount{};
+  void set_cluster_count(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ClusterCount::kFieldId;
     // Call the appropriate protozero::Message::Append(field_id, ...)
     // method based on the type of the field.
     ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt64>
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
 
-  using FieldMetadata_Pid =
+  using FieldMetadata_Uid =
     ::protozero::proto_utils::FieldMetadata<
-      4,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kInt32,
-      int32_t,
-      FrameTimelineEvent_ExpectedSurfaceFrameStart>;
+      2,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      CpuPerUidData>;
 
-  static constexpr FieldMetadata_Pid kPid{};
-  void set_pid(int32_t value) {
-    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kInt32>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_Uid kUid{};
+  void set_uid(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_Uid::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
   }
 
-  using FieldMetadata_LayerName =
+  using FieldMetadata_TotalTimeMs =
     ::protozero::proto_utils::FieldMetadata<
-      5,
-      ::protozero::proto_utils::RepetitionType::kNotRepeated,
-      ::protozero::proto_utils::ProtoSchemaType::kString,
-      std::string,
-      FrameTimelineEvent_ExpectedSurfaceFrameStart>;
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      CpuPerUidData>;
 
-  static constexpr FieldMetadata_LayerName kLayerName{};
-  void set_layer_name(const char* data, size_t size) {
-    AppendBytes(FieldMetadata_LayerName::kFieldId, data, size);
-  }
-  void set_layer_name(::protozero::ConstChars chars) {
-    AppendBytes(FieldMetadata_LayerName::kFieldId, chars.data, chars.size);
-  }
-  void set_layer_name(std::string value) {
-    static constexpr uint32_t field_id = FieldMetadata_LayerName::kFieldId;
-    // Call the appropriate protozero::Message::Append(field_id, ...)
-    // method based on the type of the field.
-    ::protozero::internal::FieldWriter<
-      ::protozero::proto_utils::ProtoSchemaType::kString>
-        ::Append(*this, field_id, value);
+  static constexpr FieldMetadata_TotalTimeMs kTotalTimeMs{};
+  void set_total_time_ms(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_TotalTimeMs::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
   }
 };
 
@@ -153916,7 +151733,7 @@ class SdeSdePerfCalcCrtcFtraceEvent : public ::protozero::Message {
   }
 };
 
-class SdeSdeEvtlogFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+class SdeSdeEvtlogFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/18> {
  public:
   SdeSdeEvtlogFtraceEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit SdeSdeEvtlogFtraceEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -153927,6 +151744,36 @@ class SdeSdeEvtlogFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*
   int32_t pid() const { return at<2>().as_int32(); }
   bool has_tag_id() const { return at<3>().valid(); }
   uint32_t tag_id() const { return at<3>().as_uint32(); }
+  bool has_d00() const { return at<4>().valid(); }
+  uint32_t d00() const { return at<4>().as_uint32(); }
+  bool has_d01() const { return at<5>().valid(); }
+  uint32_t d01() const { return at<5>().as_uint32(); }
+  bool has_d02() const { return at<6>().valid(); }
+  uint32_t d02() const { return at<6>().as_uint32(); }
+  bool has_d03() const { return at<7>().valid(); }
+  uint32_t d03() const { return at<7>().as_uint32(); }
+  bool has_d04() const { return at<8>().valid(); }
+  uint32_t d04() const { return at<8>().as_uint32(); }
+  bool has_d05() const { return at<9>().valid(); }
+  uint32_t d05() const { return at<9>().as_uint32(); }
+  bool has_d06() const { return at<10>().valid(); }
+  uint32_t d06() const { return at<10>().as_uint32(); }
+  bool has_d07() const { return at<11>().valid(); }
+  uint32_t d07() const { return at<11>().as_uint32(); }
+  bool has_d08() const { return at<12>().valid(); }
+  uint32_t d08() const { return at<12>().as_uint32(); }
+  bool has_d09() const { return at<13>().valid(); }
+  uint32_t d09() const { return at<13>().as_uint32(); }
+  bool has_d10() const { return at<14>().valid(); }
+  uint32_t d10() const { return at<14>().as_uint32(); }
+  bool has_d11() const { return at<15>().valid(); }
+  uint32_t d11() const { return at<15>().as_uint32(); }
+  bool has_d12() const { return at<16>().valid(); }
+  uint32_t d12() const { return at<16>().as_uint32(); }
+  bool has_d13() const { return at<17>().valid(); }
+  uint32_t d13() const { return at<17>().as_uint32(); }
+  bool has_d14() const { return at<18>().valid(); }
+  uint32_t d14() const { return at<18>().as_uint32(); }
 };
 
 class SdeSdeEvtlogFtraceEvent : public ::protozero::Message {
@@ -153936,6 +151783,21 @@ class SdeSdeEvtlogFtraceEvent : public ::protozero::Message {
     kEvtlogTagFieldNumber = 1,
     kPidFieldNumber = 2,
     kTagIdFieldNumber = 3,
+    kD00FieldNumber = 4,
+    kD01FieldNumber = 5,
+    kD02FieldNumber = 6,
+    kD03FieldNumber = 7,
+    kD04FieldNumber = 8,
+    kD05FieldNumber = 9,
+    kD06FieldNumber = 10,
+    kD07FieldNumber = 11,
+    kD08FieldNumber = 12,
+    kD09FieldNumber = 13,
+    kD10FieldNumber = 14,
+    kD11FieldNumber = 15,
+    kD12FieldNumber = 16,
+    kD13FieldNumber = 17,
+    kD14FieldNumber = 18,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.SdeSdeEvtlogFtraceEvent"; }
 
@@ -153999,6 +151861,276 @@ class SdeSdeEvtlogFtraceEvent : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_D00 =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D00 kD00{};
+  void set_d00(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D00::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D01 =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D01 kD01{};
+  void set_d01(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D01::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D02 =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D02 kD02{};
+  void set_d02(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D02::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D03 =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D03 kD03{};
+  void set_d03(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D03::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D04 =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D04 kD04{};
+  void set_d04(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D04::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D05 =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D05 kD05{};
+  void set_d05(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D05::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D06 =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D06 kD06{};
+  void set_d06(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D06::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D07 =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D07 kD07{};
+  void set_d07(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D07::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D08 =
+    ::protozero::proto_utils::FieldMetadata<
+      12,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D08 kD08{};
+  void set_d08(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D08::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D09 =
+    ::protozero::proto_utils::FieldMetadata<
+      13,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D09 kD09{};
+  void set_d09(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D09::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D10 =
+    ::protozero::proto_utils::FieldMetadata<
+      14,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D10 kD10{};
+  void set_d10(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D10::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D11 =
+    ::protozero::proto_utils::FieldMetadata<
+      15,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D11 kD11{};
+  void set_d11(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D11::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D12 =
+    ::protozero::proto_utils::FieldMetadata<
+      16,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D12 kD12{};
+  void set_d12(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D12::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D13 =
+    ::protozero::proto_utils::FieldMetadata<
+      17,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D13 kD13{};
+  void set_d13(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D13::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_D14 =
+    ::protozero::proto_utils::FieldMetadata<
+      18,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      SdeSdeEvtlogFtraceEvent>;
+
+  static constexpr FieldMetadata_D14 kD14{};
+  void set_d14(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_D14::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class SdeTracingMarkWriteFtraceEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
@@ -166740,6 +164872,162 @@ class VulkanMemoryEventAnnotation : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/profiling/inline_callstack.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_INLINE_CALLSTACK_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_INLINE_CALLSTACK_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class InlineCallstack_Frame;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+class InlineCallstack_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/1> {
+ public:
+  InlineCallstack_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InlineCallstack_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InlineCallstack_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_frames() const { return at<1>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> frames() const { return GetRepeated<::protozero::ConstBytes>(1); }
+};
+
+class InlineCallstack : public ::protozero::Message {
+ public:
+  using Decoder = InlineCallstack_Decoder;
+  enum : int32_t {
+    kFramesFieldNumber = 1,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InlineCallstack"; }
+
+  using Frame = ::perfetto::protos::pbzero::InlineCallstack_Frame;
+
+  using FieldMetadata_Frames =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      InlineCallstack_Frame,
+      InlineCallstack>;
+
+  static constexpr FieldMetadata_Frames kFrames{};
+  template <typename T = InlineCallstack_Frame> T* add_frames() {
+    return BeginNestedMessage<T>(1);
+  }
+
+};
+
+class InlineCallstack_Frame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  InlineCallstack_Frame_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit InlineCallstack_Frame_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit InlineCallstack_Frame_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_function_name() const { return at<1>().valid(); }
+  ::protozero::ConstChars function_name() const { return at<1>().as_string(); }
+  bool has_source_file() const { return at<2>().valid(); }
+  ::protozero::ConstChars source_file() const { return at<2>().as_string(); }
+  bool has_line_number() const { return at<3>().valid(); }
+  uint32_t line_number() const { return at<3>().as_uint32(); }
+};
+
+class InlineCallstack_Frame : public ::protozero::Message {
+ public:
+  using Decoder = InlineCallstack_Frame_Decoder;
+  enum : int32_t {
+    kFunctionNameFieldNumber = 1,
+    kSourceFileFieldNumber = 2,
+    kLineNumberFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.InlineCallstack.Frame"; }
+
+
+  using FieldMetadata_FunctionName =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InlineCallstack_Frame>;
+
+  static constexpr FieldMetadata_FunctionName kFunctionName{};
+  void set_function_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_FunctionName::kFieldId, data, size);
+  }
+  void set_function_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_FunctionName::kFieldId, chars.data, chars.size);
+  }
+  void set_function_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_FunctionName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SourceFile =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      InlineCallstack_Frame>;
+
+  static constexpr FieldMetadata_SourceFile kSourceFile{};
+  void set_source_file(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_SourceFile::kFieldId, data, size);
+  }
+  void set_source_file(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_SourceFile::kFieldId, chars.data, chars.size);
+  }
+  void set_source_file(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_SourceFile::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_LineNumber =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      InlineCallstack_Frame>;
+
+  static constexpr FieldMetadata_LineNumber kLineNumber{};
+  void set_line_number(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_LineNumber::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -167510,6 +165798,10 @@ namespace protos {
 namespace pbzero {
 class AddressSymbols;
 class Line;
+namespace perfetto_pbzero_enum_Frame {
+enum Kind : int32_t;
+}  // namespace perfetto_pbzero_enum_Frame
+using Frame_Kind = perfetto_pbzero_enum_Frame::Kind;
 } // Namespace pbzero.
 } // Namespace protos.
 } // Namespace perfetto.
@@ -167518,6 +165810,51 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
+namespace perfetto_pbzero_enum_Frame {
+enum Kind : int32_t {
+  KIND_UNKNOWN = 0,
+  KIND_NATIVE = 1,
+  KIND_KERNEL = 2,
+  KIND_INTERPRETED = 3,
+  KIND_JIT = 4,
+  KIND_GC = 5,
+  KIND_RUNTIME = 6,
+};
+} // namespace perfetto_pbzero_enum_Frame
+using Frame_Kind = perfetto_pbzero_enum_Frame::Kind;
+
+
+constexpr Frame_Kind Frame_Kind_MIN = Frame_Kind::KIND_UNKNOWN;
+constexpr Frame_Kind Frame_Kind_MAX = Frame_Kind::KIND_RUNTIME;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* Frame_Kind_Name(::perfetto::protos::pbzero::Frame_Kind value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_UNKNOWN:
+    return "KIND_UNKNOWN";
+
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_NATIVE:
+    return "KIND_NATIVE";
+
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_KERNEL:
+    return "KIND_KERNEL";
+
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_INTERPRETED:
+    return "KIND_INTERPRETED";
+
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_JIT:
+    return "KIND_JIT";
+
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_GC:
+    return "KIND_GC";
+
+  case ::perfetto::protos::pbzero::Frame_Kind::KIND_RUNTIME:
+    return "KIND_RUNTIME";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
 class Callstack_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/2> {
  public:
   Callstack_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
@@ -167576,7 +165913,7 @@ class Callstack : public ::protozero::Message {
   }
 };
 
-class Frame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6> {
+class Frame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
  public:
   Frame_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit Frame_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -167593,6 +165930,10 @@ class Frame_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/6>
   uint64_t source_path_iid() const { return at<5>().as_uint64(); }
   bool has_line_number() const { return at<6>().valid(); }
   uint32_t line_number() const { return at<6>().as_uint32(); }
+  bool has_kind() const { return at<7>().valid(); }
+  int32_t kind() const { return at<7>().as_int32(); }
+  bool has_kind_str() const { return at<8>().valid(); }
+  ::protozero::ConstChars kind_str() const { return at<8>().as_string(); }
 };
 
 class Frame : public ::protozero::Message {
@@ -167605,10 +165946,24 @@ class Frame : public ::protozero::Message {
     kRelPcFieldNumber = 4,
     kSourcePathIidFieldNumber = 5,
     kLineNumberFieldNumber = 6,
+    kKindFieldNumber = 7,
+    kKindStrFieldNumber = 8,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.Frame"; }
 
 
+  using Kind = ::perfetto::protos::pbzero::Frame_Kind;
+  static inline const char* Kind_Name(Kind value) {
+    return ::perfetto::protos::pbzero::Frame_Kind_Name(value);
+  }
+  static inline const Kind KIND_UNKNOWN = Kind::KIND_UNKNOWN;
+  static inline const Kind KIND_NATIVE = Kind::KIND_NATIVE;
+  static inline const Kind KIND_KERNEL = Kind::KIND_KERNEL;
+  static inline const Kind KIND_INTERPRETED = Kind::KIND_INTERPRETED;
+  static inline const Kind KIND_JIT = Kind::KIND_JIT;
+  static inline const Kind KIND_GC = Kind::KIND_GC;
+  static inline const Kind KIND_RUNTIME = Kind::KIND_RUNTIME;
+
   using FieldMetadata_Iid =
     ::protozero::proto_utils::FieldMetadata<
       1,
@@ -167716,6 +166071,48 @@ class Frame : public ::protozero::Message {
       ::protozero::proto_utils::ProtoSchemaType::kUint32>
         ::Append(*this, field_id, value);
   }
+
+  using FieldMetadata_Kind =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      Frame_Kind,
+      Frame>;
+
+  static constexpr FieldMetadata_Kind kKind{};
+  void set_kind(Frame_Kind value) {
+    static constexpr uint32_t field_id = FieldMetadata_Kind::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_KindStr =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      Frame>;
+
+  static constexpr FieldMetadata_KindStr kKindStr{};
+  void set_kind_str(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_KindStr::kFieldId, data, size);
+  }
+  void set_kind_str(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_KindStr::kFieldId, chars.data, chars.size);
+  }
+  void set_kind_str(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_KindStr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
 };
 
 class Mapping_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/8> {
@@ -169356,7 +167753,7 @@ class ProfilePacket : public ::protozero::Message {
   }
 };
 
-class ProfilePacket_ProcessHeapSamples_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/14> {
+class ProfilePacket_ProcessHeapSamples_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/15> {
  public:
   ProfilePacket_ProcessHeapSamples_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit ProfilePacket_ProcessHeapSamples_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -169385,6 +167782,8 @@ class ProfilePacket_ProcessHeapSamples_Decoder : public ::protozero::TypedProtoD
   uint64_t orig_sampling_interval_bytes() const { return at<13>().as_uint64(); }
   bool has_timestamp() const { return at<9>().valid(); }
   uint64_t timestamp() const { return at<9>().as_uint64(); }
+  bool has_start_timestamp() const { return at<15>().valid(); }
+  uint64_t start_timestamp() const { return at<15>().as_uint64(); }
   bool has_stats() const { return at<5>().valid(); }
   ::protozero::ConstBytes stats() const { return at<5>().as_bytes(); }
   bool has_samples() const { return at<2>().valid(); }
@@ -169407,6 +167806,7 @@ class ProfilePacket_ProcessHeapSamples : public ::protozero::Message {
     kSamplingIntervalBytesFieldNumber = 12,
     kOrigSamplingIntervalBytesFieldNumber = 13,
     kTimestampFieldNumber = 9,
+    kStartTimestampFieldNumber = 15,
     kStatsFieldNumber = 5,
     kSamplesFieldNumber = 2,
   };
@@ -169643,6 +168043,24 @@ class ProfilePacket_ProcessHeapSamples : public ::protozero::Message {
         ::Append(*this, field_id, value);
   }
 
+  using FieldMetadata_StartTimestamp =
+    ::protozero::proto_utils::FieldMetadata<
+      15,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      ProfilePacket_ProcessHeapSamples>;
+
+  static constexpr FieldMetadata_StartTimestamp kStartTimestamp{};
+  void set_start_timestamp(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_StartTimestamp::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
   using FieldMetadata_Stats =
     ::protozero::proto_utils::FieldMetadata<
       5,
@@ -170913,6 +169331,1055 @@ class SmapsEntry : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/profiling/stack_sample.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_STACK_SAMPLE_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PROFILING_STACK_SAMPLE_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+class InlineCallstack;
+class StackSample_AsyncContextDescriptor;
+class StackSample_CounterDescriptor;
+class StackSample_ExecutionContext;
+class StackSample_TaskContext;
+namespace perfetto_pbzero_enum_StackSample_CounterDescriptor {
+enum Scope : int32_t;
+}  // namespace perfetto_pbzero_enum_StackSample_CounterDescriptor
+using StackSample_CounterDescriptor_Scope = perfetto_pbzero_enum_StackSample_CounterDescriptor::Scope;
+namespace perfetto_pbzero_enum_StackSample {
+enum Mode : int32_t;
+}  // namespace perfetto_pbzero_enum_StackSample
+using StackSample_Mode = perfetto_pbzero_enum_StackSample::Mode;
+namespace perfetto_pbzero_enum_StackSample {
+enum Unit : int32_t;
+}  // namespace perfetto_pbzero_enum_StackSample
+using StackSample_Unit = perfetto_pbzero_enum_StackSample::Unit;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+namespace perfetto_pbzero_enum_StackSample {
+enum Mode : int32_t {
+  MODE_UNKNOWN = 0,
+  MODE_USER = 1,
+  MODE_KERNEL = 2,
+  MODE_HYPERVISOR = 3,
+  MODE_GUEST_USER = 4,
+  MODE_GUEST_KERNEL = 5,
+};
+} // namespace perfetto_pbzero_enum_StackSample
+using StackSample_Mode = perfetto_pbzero_enum_StackSample::Mode;
+
+
+constexpr StackSample_Mode StackSample_Mode_MIN = StackSample_Mode::MODE_UNKNOWN;
+constexpr StackSample_Mode StackSample_Mode_MAX = StackSample_Mode::MODE_GUEST_KERNEL;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* StackSample_Mode_Name(::perfetto::protos::pbzero::StackSample_Mode value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::StackSample_Mode::MODE_UNKNOWN:
+    return "MODE_UNKNOWN";
+
+  case ::perfetto::protos::pbzero::StackSample_Mode::MODE_USER:
+    return "MODE_USER";
+
+  case ::perfetto::protos::pbzero::StackSample_Mode::MODE_KERNEL:
+    return "MODE_KERNEL";
+
+  case ::perfetto::protos::pbzero::StackSample_Mode::MODE_HYPERVISOR:
+    return "MODE_HYPERVISOR";
+
+  case ::perfetto::protos::pbzero::StackSample_Mode::MODE_GUEST_USER:
+    return "MODE_GUEST_USER";
+
+  case ::perfetto::protos::pbzero::StackSample_Mode::MODE_GUEST_KERNEL:
+    return "MODE_GUEST_KERNEL";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+namespace perfetto_pbzero_enum_StackSample {
+enum Unit : int32_t {
+  UNIT_UNSPECIFIED = 0,
+  UNIT_NANOSECONDS = 1,
+  UNIT_CPU_CYCLES = 2,
+  UNIT_INSTRUCTIONS = 3,
+  UNIT_BYTES = 4,
+  UNIT_PAGE_FAULTS = 5,
+  UNIT_CACHE_MISSES = 6,
+  UNIT_CACHE_REFERENCES = 7,
+  UNIT_BRANCH_MISSES = 8,
+  UNIT_COUNT = 9,
+};
+} // namespace perfetto_pbzero_enum_StackSample
+using StackSample_Unit = perfetto_pbzero_enum_StackSample::Unit;
+
+
+constexpr StackSample_Unit StackSample_Unit_MIN = StackSample_Unit::UNIT_UNSPECIFIED;
+constexpr StackSample_Unit StackSample_Unit_MAX = StackSample_Unit::UNIT_COUNT;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* StackSample_Unit_Name(::perfetto::protos::pbzero::StackSample_Unit value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_UNSPECIFIED:
+    return "UNIT_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_NANOSECONDS:
+    return "UNIT_NANOSECONDS";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_CPU_CYCLES:
+    return "UNIT_CPU_CYCLES";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_INSTRUCTIONS:
+    return "UNIT_INSTRUCTIONS";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_BYTES:
+    return "UNIT_BYTES";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_PAGE_FAULTS:
+    return "UNIT_PAGE_FAULTS";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_CACHE_MISSES:
+    return "UNIT_CACHE_MISSES";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_CACHE_REFERENCES:
+    return "UNIT_CACHE_REFERENCES";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_BRANCH_MISSES:
+    return "UNIT_BRANCH_MISSES";
+
+  case ::perfetto::protos::pbzero::StackSample_Unit::UNIT_COUNT:
+    return "UNIT_COUNT";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+namespace perfetto_pbzero_enum_StackSample_CounterDescriptor {
+enum Scope : int32_t {
+  SCOPE_UNSPECIFIED = 0,
+  SCOPE_GLOBAL = 1,
+  SCOPE_CPU = 2,
+};
+} // namespace perfetto_pbzero_enum_StackSample_CounterDescriptor
+using StackSample_CounterDescriptor_Scope = perfetto_pbzero_enum_StackSample_CounterDescriptor::Scope;
+
+
+constexpr StackSample_CounterDescriptor_Scope StackSample_CounterDescriptor_Scope_MIN = StackSample_CounterDescriptor_Scope::SCOPE_UNSPECIFIED;
+constexpr StackSample_CounterDescriptor_Scope StackSample_CounterDescriptor_Scope_MAX = StackSample_CounterDescriptor_Scope::SCOPE_CPU;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* StackSample_CounterDescriptor_Scope_Name(::perfetto::protos::pbzero::StackSample_CounterDescriptor_Scope value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::StackSample_CounterDescriptor_Scope::SCOPE_UNSPECIFIED:
+    return "SCOPE_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::StackSample_CounterDescriptor_Scope::SCOPE_GLOBAL:
+    return "SCOPE_GLOBAL";
+
+  case ::perfetto::protos::pbzero::StackSample_CounterDescriptor_Scope::SCOPE_CPU:
+    return "SCOPE_CPU";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class StackSampleDefaults_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  StackSampleDefaults_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackSampleDefaults_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackSampleDefaults_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_source() const { return at<1>().valid(); }
+  ::protozero::ConstChars source() const { return at<1>().as_string(); }
+  bool has_primary_descriptor() const { return at<2>().valid(); }
+  ::protozero::ConstBytes primary_descriptor() const { return at<2>().as_bytes(); }
+  bool has_follower_descriptors() const { return at<3>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> follower_descriptors() const { return GetRepeated<::protozero::ConstBytes>(3); }
+};
+
+class StackSampleDefaults : public ::protozero::Message {
+ public:
+  using Decoder = StackSampleDefaults_Decoder;
+  enum : int32_t {
+    kSourceFieldNumber = 1,
+    kPrimaryDescriptorFieldNumber = 2,
+    kFollowerDescriptorsFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackSampleDefaults"; }
+
+
+  using FieldMetadata_Source =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSampleDefaults>;
+
+  static constexpr FieldMetadata_Source kSource{};
+  void set_source(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Source::kFieldId, data, size);
+  }
+  void set_source(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Source::kFieldId, chars.data, chars.size);
+  }
+  void set_source(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Source::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_PrimaryDescriptor =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample_CounterDescriptor,
+      StackSampleDefaults>;
+
+  static constexpr FieldMetadata_PrimaryDescriptor kPrimaryDescriptor{};
+  template <typename T = StackSample_CounterDescriptor> T* set_primary_descriptor() {
+    return BeginNestedMessage<T>(2);
+  }
+
+
+  using FieldMetadata_FollowerDescriptors =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample_CounterDescriptor,
+      StackSampleDefaults>;
+
+  static constexpr FieldMetadata_FollowerDescriptors kFollowerDescriptors{};
+  template <typename T = StackSample_CounterDescriptor> T* add_follower_descriptors() {
+    return BeginNestedMessage<T>(3);
+  }
+
+};
+
+class StackSample_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/14> {
+ public:
+  StackSample_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackSample_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackSample_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_task_context() const { return at<1>().valid(); }
+  ::protozero::ConstBytes task_context() const { return at<1>().as_bytes(); }
+  bool has_task_context_iid() const { return at<2>().valid(); }
+  uint64_t task_context_iid() const { return at<2>().as_uint64(); }
+  bool has_execution_context() const { return at<3>().valid(); }
+  ::protozero::ConstBytes execution_context() const { return at<3>().as_bytes(); }
+  bool has_execution_context_iid() const { return at<4>().valid(); }
+  uint64_t execution_context_iid() const { return at<4>().as_uint64(); }
+  bool has_callstack() const { return at<5>().valid(); }
+  ::protozero::ConstBytes callstack() const { return at<5>().as_bytes(); }
+  bool has_callstack_iid() const { return at<6>().valid(); }
+  uint64_t callstack_iid() const { return at<6>().as_uint64(); }
+  bool has_unwind_error() const { return at<7>().valid(); }
+  ::protozero::ConstChars unwind_error() const { return at<7>().as_string(); }
+  bool has_unwind_error_iid() const { return at<8>().valid(); }
+  uint64_t unwind_error_iid() const { return at<8>().as_uint64(); }
+  bool has_primary_descriptor() const { return at<9>().valid(); }
+  ::protozero::ConstBytes primary_descriptor() const { return at<9>().as_bytes(); }
+  bool has_primary_descriptor_iid() const { return at<10>().valid(); }
+  uint64_t primary_descriptor_iid() const { return at<10>().as_uint64(); }
+  bool has_primary_weight() const { return at<11>().valid(); }
+  uint64_t primary_weight() const { return at<11>().as_uint64(); }
+  bool has_follower_descriptors() const { return at<12>().valid(); }
+  ::protozero::RepeatedFieldIterator<::protozero::ConstBytes> follower_descriptors() const { return GetRepeated<::protozero::ConstBytes>(12); }
+  bool has_follower_descriptor_iids() const { return at<13>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> follower_descriptor_iids(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(13, parse_error_ptr); }
+  bool has_follower_weights() const { return at<14>().valid(); }
+  ::protozero::PackedRepeatedFieldIterator<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t> follower_weights(bool* parse_error_ptr) const { return GetPackedRepeated<::protozero::proto_utils::ProtoWireType::kVarInt, uint64_t>(14, parse_error_ptr); }
+};
+
+class StackSample : public ::protozero::Message {
+ public:
+  using Decoder = StackSample_Decoder;
+  enum : int32_t {
+    kTaskContextFieldNumber = 1,
+    kTaskContextIidFieldNumber = 2,
+    kExecutionContextFieldNumber = 3,
+    kExecutionContextIidFieldNumber = 4,
+    kCallstackFieldNumber = 5,
+    kCallstackIidFieldNumber = 6,
+    kUnwindErrorFieldNumber = 7,
+    kUnwindErrorIidFieldNumber = 8,
+    kPrimaryDescriptorFieldNumber = 9,
+    kPrimaryDescriptorIidFieldNumber = 10,
+    kPrimaryWeightFieldNumber = 11,
+    kFollowerDescriptorsFieldNumber = 12,
+    kFollowerDescriptorIidsFieldNumber = 13,
+    kFollowerWeightsFieldNumber = 14,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackSample"; }
+
+  using TaskContext = ::perfetto::protos::pbzero::StackSample_TaskContext;
+  using AsyncContextDescriptor = ::perfetto::protos::pbzero::StackSample_AsyncContextDescriptor;
+  using ExecutionContext = ::perfetto::protos::pbzero::StackSample_ExecutionContext;
+  using CounterDescriptor = ::perfetto::protos::pbzero::StackSample_CounterDescriptor;
+
+  using Mode = ::perfetto::protos::pbzero::StackSample_Mode;
+  static inline const char* Mode_Name(Mode value) {
+    return ::perfetto::protos::pbzero::StackSample_Mode_Name(value);
+  }
+
+  using Unit = ::perfetto::protos::pbzero::StackSample_Unit;
+  static inline const char* Unit_Name(Unit value) {
+    return ::perfetto::protos::pbzero::StackSample_Unit_Name(value);
+  }
+  static inline const Mode MODE_UNKNOWN = Mode::MODE_UNKNOWN;
+  static inline const Mode MODE_USER = Mode::MODE_USER;
+  static inline const Mode MODE_KERNEL = Mode::MODE_KERNEL;
+  static inline const Mode MODE_HYPERVISOR = Mode::MODE_HYPERVISOR;
+  static inline const Mode MODE_GUEST_USER = Mode::MODE_GUEST_USER;
+  static inline const Mode MODE_GUEST_KERNEL = Mode::MODE_GUEST_KERNEL;
+  static inline const Unit UNIT_UNSPECIFIED = Unit::UNIT_UNSPECIFIED;
+  static inline const Unit UNIT_NANOSECONDS = Unit::UNIT_NANOSECONDS;
+  static inline const Unit UNIT_CPU_CYCLES = Unit::UNIT_CPU_CYCLES;
+  static inline const Unit UNIT_INSTRUCTIONS = Unit::UNIT_INSTRUCTIONS;
+  static inline const Unit UNIT_BYTES = Unit::UNIT_BYTES;
+  static inline const Unit UNIT_PAGE_FAULTS = Unit::UNIT_PAGE_FAULTS;
+  static inline const Unit UNIT_CACHE_MISSES = Unit::UNIT_CACHE_MISSES;
+  static inline const Unit UNIT_CACHE_REFERENCES = Unit::UNIT_CACHE_REFERENCES;
+  static inline const Unit UNIT_BRANCH_MISSES = Unit::UNIT_BRANCH_MISSES;
+  static inline const Unit UNIT_COUNT = Unit::UNIT_COUNT;
+
+  using FieldMetadata_TaskContext =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample_TaskContext,
+      StackSample>;
+
+  static constexpr FieldMetadata_TaskContext kTaskContext{};
+  template <typename T = StackSample_TaskContext> T* set_task_context() {
+    return BeginNestedMessage<T>(1);
+  }
+
+
+  using FieldMetadata_TaskContextIid =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_TaskContextIid kTaskContextIid{};
+  void set_task_context_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_TaskContextIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ExecutionContext =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample_ExecutionContext,
+      StackSample>;
+
+  static constexpr FieldMetadata_ExecutionContext kExecutionContext{};
+  template <typename T = StackSample_ExecutionContext> T* set_execution_context() {
+    return BeginNestedMessage<T>(3);
+  }
+
+
+  using FieldMetadata_ExecutionContextIid =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_ExecutionContextIid kExecutionContextIid{};
+  void set_execution_context_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ExecutionContextIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Callstack =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      InlineCallstack,
+      StackSample>;
+
+  static constexpr FieldMetadata_Callstack kCallstack{};
+  template <typename T = InlineCallstack> T* set_callstack() {
+    return BeginNestedMessage<T>(5);
+  }
+
+
+  using FieldMetadata_CallstackIid =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_CallstackIid kCallstackIid{};
+  void set_callstack_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_CallstackIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_UnwindError =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSample>;
+
+  static constexpr FieldMetadata_UnwindError kUnwindError{};
+  void set_unwind_error(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_UnwindError::kFieldId, data, size);
+  }
+  void set_unwind_error(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_UnwindError::kFieldId, chars.data, chars.size);
+  }
+  void set_unwind_error(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_UnwindError::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_UnwindErrorIid =
+    ::protozero::proto_utils::FieldMetadata<
+      8,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_UnwindErrorIid kUnwindErrorIid{};
+  void set_unwind_error_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_UnwindErrorIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_PrimaryDescriptor =
+    ::protozero::proto_utils::FieldMetadata<
+      9,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample_CounterDescriptor,
+      StackSample>;
+
+  static constexpr FieldMetadata_PrimaryDescriptor kPrimaryDescriptor{};
+  template <typename T = StackSample_CounterDescriptor> T* set_primary_descriptor() {
+    return BeginNestedMessage<T>(9);
+  }
+
+
+  using FieldMetadata_PrimaryDescriptorIid =
+    ::protozero::proto_utils::FieldMetadata<
+      10,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_PrimaryDescriptorIid kPrimaryDescriptorIid{};
+  void set_primary_descriptor_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PrimaryDescriptorIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_PrimaryWeight =
+    ::protozero::proto_utils::FieldMetadata<
+      11,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_PrimaryWeight kPrimaryWeight{};
+  void set_primary_weight(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_PrimaryWeight::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_FollowerDescriptors =
+    ::protozero::proto_utils::FieldMetadata<
+      12,
+      ::protozero::proto_utils::RepetitionType::kRepeatedNotPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSample_CounterDescriptor,
+      StackSample>;
+
+  static constexpr FieldMetadata_FollowerDescriptors kFollowerDescriptors{};
+  template <typename T = StackSample_CounterDescriptor> T* add_follower_descriptors() {
+    return BeginNestedMessage<T>(12);
+  }
+
+
+  using FieldMetadata_FollowerDescriptorIids =
+    ::protozero::proto_utils::FieldMetadata<
+      13,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_FollowerDescriptorIids kFollowerDescriptorIids{};
+  void set_follower_descriptor_iids(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_FollowerDescriptorIids::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+
+  using FieldMetadata_FollowerWeights =
+    ::protozero::proto_utils::FieldMetadata<
+      14,
+      ::protozero::proto_utils::RepetitionType::kRepeatedPacked,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample>;
+
+  static constexpr FieldMetadata_FollowerWeights kFollowerWeights{};
+  void set_follower_weights(const ::protozero::PackedVarInt& packed_buffer) {
+    AppendBytes(FieldMetadata_FollowerWeights::kFieldId, packed_buffer.data(),
+                packed_buffer.size());
+  }
+};
+
+class StackSample_CounterDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/7> {
+ public:
+  StackSample_CounterDescriptor_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackSample_CounterDescriptor_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackSample_CounterDescriptor_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+  bool has_unit() const { return at<3>().valid(); }
+  int32_t unit() const { return at<3>().as_int32(); }
+  bool has_unit_str() const { return at<4>().valid(); }
+  ::protozero::ConstChars unit_str() const { return at<4>().as_string(); }
+  bool has_unit_multiplier() const { return at<5>().valid(); }
+  uint64_t unit_multiplier() const { return at<5>().as_uint64(); }
+  bool has_description() const { return at<6>().valid(); }
+  ::protozero::ConstChars description() const { return at<6>().as_string(); }
+  bool has_scope() const { return at<7>().valid(); }
+  int32_t scope() const { return at<7>().as_int32(); }
+};
+
+class StackSample_CounterDescriptor : public ::protozero::Message {
+ public:
+  using Decoder = StackSample_CounterDescriptor_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kUnitFieldNumber = 3,
+    kUnitStrFieldNumber = 4,
+    kUnitMultiplierFieldNumber = 5,
+    kDescriptionFieldNumber = 6,
+    kScopeFieldNumber = 7,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackSample.CounterDescriptor"; }
+
+
+  using Scope = ::perfetto::protos::pbzero::StackSample_CounterDescriptor_Scope;
+  static inline const char* Scope_Name(Scope value) {
+    return ::perfetto::protos::pbzero::StackSample_CounterDescriptor_Scope_Name(value);
+  }
+  static inline const Scope SCOPE_UNSPECIFIED = Scope::SCOPE_UNSPECIFIED;
+  static inline const Scope SCOPE_GLOBAL = Scope::SCOPE_GLOBAL;
+  static inline const Scope SCOPE_CPU = Scope::SCOPE_CPU;
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Unit =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      StackSample_Unit,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_Unit kUnit{};
+  void set_unit(StackSample_Unit value) {
+    static constexpr uint32_t field_id = FieldMetadata_Unit::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_UnitStr =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_UnitStr kUnitStr{};
+  void set_unit_str(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_UnitStr::kFieldId, data, size);
+  }
+  void set_unit_str(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_UnitStr::kFieldId, chars.data, chars.size);
+  }
+  void set_unit_str(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_UnitStr::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_UnitMultiplier =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_UnitMultiplier kUnitMultiplier{};
+  void set_unit_multiplier(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_UnitMultiplier::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Description =
+    ::protozero::proto_utils::FieldMetadata<
+      6,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_Description kDescription{};
+  void set_description(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Description::kFieldId, data, size);
+  }
+  void set_description(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Description::kFieldId, chars.data, chars.size);
+  }
+  void set_description(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Description::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Scope =
+    ::protozero::proto_utils::FieldMetadata<
+      7,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      StackSample_CounterDescriptor_Scope,
+      StackSample_CounterDescriptor>;
+
+  static constexpr FieldMetadata_Scope kScope{};
+  void set_scope(StackSample_CounterDescriptor_Scope value) {
+    static constexpr uint32_t field_id = FieldMetadata_Scope::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class StackSample_ExecutionContext_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/3> {
+ public:
+  StackSample_ExecutionContext_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackSample_ExecutionContext_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackSample_ExecutionContext_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_cpu() const { return at<2>().valid(); }
+  uint32_t cpu() const { return at<2>().as_uint32(); }
+  bool has_mode() const { return at<3>().valid(); }
+  int32_t mode() const { return at<3>().as_int32(); }
+};
+
+class StackSample_ExecutionContext : public ::protozero::Message {
+ public:
+  using Decoder = StackSample_ExecutionContext_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kCpuFieldNumber = 2,
+    kModeFieldNumber = 3,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackSample.ExecutionContext"; }
+
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_ExecutionContext>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Cpu =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      StackSample_ExecutionContext>;
+
+  static constexpr FieldMetadata_Cpu kCpu{};
+  void set_cpu(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Cpu::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Mode =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      StackSample_Mode,
+      StackSample_ExecutionContext>;
+
+  static constexpr FieldMetadata_Mode kMode{};
+  void set_mode(StackSample_Mode value) {
+    static constexpr uint32_t field_id = FieldMetadata_Mode::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class StackSample_AsyncContextDescriptor_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  StackSample_AsyncContextDescriptor_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackSample_AsyncContextDescriptor_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackSample_AsyncContextDescriptor_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars name() const { return at<2>().as_string(); }
+  bool has_kind() const { return at<3>().valid(); }
+  ::protozero::ConstChars kind() const { return at<3>().as_string(); }
+  bool has_parent_iid() const { return at<4>().valid(); }
+  uint64_t parent_iid() const { return at<4>().as_uint64(); }
+};
+
+class StackSample_AsyncContextDescriptor : public ::protozero::Message {
+ public:
+  using Decoder = StackSample_AsyncContextDescriptor_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kNameFieldNumber = 2,
+    kKindFieldNumber = 3,
+    kParentIidFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackSample.AsyncContextDescriptor"; }
+
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_AsyncContextDescriptor>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Name =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSample_AsyncContextDescriptor>;
+
+  static constexpr FieldMetadata_Name kName{};
+  void set_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Name::kFieldId, data, size);
+  }
+  void set_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Name::kFieldId, chars.data, chars.size);
+  }
+  void set_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Name::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Kind =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      StackSample_AsyncContextDescriptor>;
+
+  static constexpr FieldMetadata_Kind kKind{};
+  void set_kind(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_Kind::kFieldId, data, size);
+  }
+  void set_kind(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_Kind::kFieldId, chars.data, chars.size);
+  }
+  void set_kind(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_Kind::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ParentIid =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_AsyncContextDescriptor>;
+
+  static constexpr FieldMetadata_ParentIid kParentIid{};
+  void set_parent_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ParentIid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
+class StackSample_TaskContext_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/4> {
+ public:
+  StackSample_TaskContext_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit StackSample_TaskContext_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit StackSample_TaskContext_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_iid() const { return at<1>().valid(); }
+  uint64_t iid() const { return at<1>().as_uint64(); }
+  bool has_pid() const { return at<2>().valid(); }
+  uint32_t pid() const { return at<2>().as_uint32(); }
+  bool has_tid() const { return at<3>().valid(); }
+  uint32_t tid() const { return at<3>().as_uint32(); }
+  bool has_async_id() const { return at<4>().valid(); }
+  uint64_t async_id() const { return at<4>().as_uint64(); }
+};
+
+class StackSample_TaskContext : public ::protozero::Message {
+ public:
+  using Decoder = StackSample_TaskContext_Decoder;
+  enum : int32_t {
+    kIidFieldNumber = 1,
+    kPidFieldNumber = 2,
+    kTidFieldNumber = 3,
+    kAsyncIdFieldNumber = 4,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.StackSample.TaskContext"; }
+
+
+  using FieldMetadata_Iid =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_TaskContext>;
+
+  static constexpr FieldMetadata_Iid kIid{};
+  void set_iid(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Iid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Pid =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      StackSample_TaskContext>;
+
+  static constexpr FieldMetadata_Pid kPid{};
+  void set_pid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Pid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_Tid =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      StackSample_TaskContext>;
+
+  static constexpr FieldMetadata_Tid kTid{};
+  void set_tid(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_Tid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_AsyncId =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      StackSample_TaskContext>;
+
+  static constexpr FieldMetadata_AsyncId kAsyncId{};
+  void set_async_id(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_AsyncId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -177675,6 +177142,219 @@ class SystemdJournaldEvent : public ::protozero::Message {
   }
 };
 
+} // Namespace.
+} // Namespace.
+} // Namespace.
+#endif  // Include guard.
+// gen_amalgamated begin header: gen/protos/perfetto/trace/perfetto/concurrent_session_event.pbzero.h
+// Autogenerated by the ProtoZero compiler plugin. DO NOT EDIT.
+
+#ifndef PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PERFETTO_CONCURRENT_SESSION_EVENT_PROTO_H_
+#define PERFETTO_PROTOS_PROTOS_PERFETTO_TRACE_PERFETTO_CONCURRENT_SESSION_EVENT_PROTO_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+// gen_amalgamated expanded: #include "perfetto/protozero/field_writer.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/message.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/packed_repeated_fields.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_decoder.h"
+// gen_amalgamated expanded: #include "perfetto/protozero/proto_utils.h"
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+namespace perfetto_pbzero_enum_ConcurrentSessionEvent {
+enum State : int32_t;
+}  // namespace perfetto_pbzero_enum_ConcurrentSessionEvent
+using ConcurrentSessionEvent_State = perfetto_pbzero_enum_ConcurrentSessionEvent::State;
+} // Namespace pbzero.
+} // Namespace protos.
+} // Namespace perfetto.
+
+namespace perfetto {
+namespace protos {
+namespace pbzero {
+
+namespace perfetto_pbzero_enum_ConcurrentSessionEvent {
+enum State : int32_t {
+  STATE_UNSPECIFIED = 0,
+  STATE_DISABLED = 1,
+  STATE_CONFIGURED = 2,
+  STATE_STARTED = 3,
+  STATE_DISABLING_WAITING_STOP_ACKS = 4,
+  STATE_CLONED_READ_ONLY = 5,
+};
+} // namespace perfetto_pbzero_enum_ConcurrentSessionEvent
+using ConcurrentSessionEvent_State = perfetto_pbzero_enum_ConcurrentSessionEvent::State;
+
+
+constexpr ConcurrentSessionEvent_State ConcurrentSessionEvent_State_MIN = ConcurrentSessionEvent_State::STATE_UNSPECIFIED;
+constexpr ConcurrentSessionEvent_State ConcurrentSessionEvent_State_MAX = ConcurrentSessionEvent_State::STATE_CLONED_READ_ONLY;
+
+
+PERFETTO_PROTOZERO_CONSTEXPR14_OR_INLINE
+const char* ConcurrentSessionEvent_State_Name(::perfetto::protos::pbzero::ConcurrentSessionEvent_State value) {
+  switch (value) {
+  case ::perfetto::protos::pbzero::ConcurrentSessionEvent_State::STATE_UNSPECIFIED:
+    return "STATE_UNSPECIFIED";
+
+  case ::perfetto::protos::pbzero::ConcurrentSessionEvent_State::STATE_DISABLED:
+    return "STATE_DISABLED";
+
+  case ::perfetto::protos::pbzero::ConcurrentSessionEvent_State::STATE_CONFIGURED:
+    return "STATE_CONFIGURED";
+
+  case ::perfetto::protos::pbzero::ConcurrentSessionEvent_State::STATE_STARTED:
+    return "STATE_STARTED";
+
+  case ::perfetto::protos::pbzero::ConcurrentSessionEvent_State::STATE_DISABLING_WAITING_STOP_ACKS:
+    return "STATE_DISABLING_WAITING_STOP_ACKS";
+
+  case ::perfetto::protos::pbzero::ConcurrentSessionEvent_State::STATE_CLONED_READ_ONLY:
+    return "STATE_CLONED_READ_ONLY";
+  }
+  return "PBZERO_UNKNOWN_ENUM_VALUE";
+}
+
+class ConcurrentSessionEvent_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/5> {
+ public:
+  ConcurrentSessionEvent_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
+  explicit ConcurrentSessionEvent_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
+  explicit ConcurrentSessionEvent_Decoder(const ::protozero::ConstBytes& raw) : TypedProtoDecoder(raw.data, raw.size) {}
+  bool has_state() const { return at<1>().valid(); }
+  int32_t state() const { return at<1>().as_int32(); }
+  bool has_session_name() const { return at<2>().valid(); }
+  ::protozero::ConstChars session_name() const { return at<2>().as_string(); }
+  bool has_session_id() const { return at<3>().valid(); }
+  uint64_t session_id() const { return at<3>().as_uint64(); }
+  bool has_consumer_uid() const { return at<4>().valid(); }
+  int32_t consumer_uid() const { return at<4>().as_int32(); }
+  bool has_num_data_sources() const { return at<5>().valid(); }
+  uint32_t num_data_sources() const { return at<5>().as_uint32(); }
+};
+
+class ConcurrentSessionEvent : public ::protozero::Message {
+ public:
+  using Decoder = ConcurrentSessionEvent_Decoder;
+  enum : int32_t {
+    kStateFieldNumber = 1,
+    kSessionNameFieldNumber = 2,
+    kSessionIdFieldNumber = 3,
+    kConsumerUidFieldNumber = 4,
+    kNumDataSourcesFieldNumber = 5,
+  };
+  static constexpr const char* GetName() { return ".perfetto.protos.ConcurrentSessionEvent"; }
+
+
+  using State = ::perfetto::protos::pbzero::ConcurrentSessionEvent_State;
+  static inline const char* State_Name(State value) {
+    return ::perfetto::protos::pbzero::ConcurrentSessionEvent_State_Name(value);
+  }
+  static inline const State STATE_UNSPECIFIED = State::STATE_UNSPECIFIED;
+  static inline const State STATE_DISABLED = State::STATE_DISABLED;
+  static inline const State STATE_CONFIGURED = State::STATE_CONFIGURED;
+  static inline const State STATE_STARTED = State::STATE_STARTED;
+  static inline const State STATE_DISABLING_WAITING_STOP_ACKS = State::STATE_DISABLING_WAITING_STOP_ACKS;
+  static inline const State STATE_CLONED_READ_ONLY = State::STATE_CLONED_READ_ONLY;
+
+  using FieldMetadata_State =
+    ::protozero::proto_utils::FieldMetadata<
+      1,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kEnum,
+      ConcurrentSessionEvent_State,
+      ConcurrentSessionEvent>;
+
+  static constexpr FieldMetadata_State kState{};
+  void set_state(ConcurrentSessionEvent_State value) {
+    static constexpr uint32_t field_id = FieldMetadata_State::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kEnum>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SessionName =
+    ::protozero::proto_utils::FieldMetadata<
+      2,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kString,
+      std::string,
+      ConcurrentSessionEvent>;
+
+  static constexpr FieldMetadata_SessionName kSessionName{};
+  void set_session_name(const char* data, size_t size) {
+    AppendBytes(FieldMetadata_SessionName::kFieldId, data, size);
+  }
+  void set_session_name(::protozero::ConstChars chars) {
+    AppendBytes(FieldMetadata_SessionName::kFieldId, chars.data, chars.size);
+  }
+  void set_session_name(std::string value) {
+    static constexpr uint32_t field_id = FieldMetadata_SessionName::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kString>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_SessionId =
+    ::protozero::proto_utils::FieldMetadata<
+      3,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint64,
+      uint64_t,
+      ConcurrentSessionEvent>;
+
+  static constexpr FieldMetadata_SessionId kSessionId{};
+  void set_session_id(uint64_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_SessionId::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint64>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_ConsumerUid =
+    ::protozero::proto_utils::FieldMetadata<
+      4,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kInt32,
+      int32_t,
+      ConcurrentSessionEvent>;
+
+  static constexpr FieldMetadata_ConsumerUid kConsumerUid{};
+  void set_consumer_uid(int32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_ConsumerUid::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kInt32>
+        ::Append(*this, field_id, value);
+  }
+
+  using FieldMetadata_NumDataSources =
+    ::protozero::proto_utils::FieldMetadata<
+      5,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kUint32,
+      uint32_t,
+      ConcurrentSessionEvent>;
+
+  static constexpr FieldMetadata_NumDataSources kNumDataSources{};
+  void set_num_data_sources(uint32_t value) {
+    static constexpr uint32_t field_id = FieldMetadata_NumDataSources::kFieldId;
+    // Call the appropriate protozero::Message::Append(field_id, ...)
+    // method based on the type of the field.
+    ::protozero::internal::FieldWriter<
+      ::protozero::proto_utils::ProtoSchemaType::kUint32>
+        ::Append(*this, field_id, value);
+  }
+};
+
 } // Namespace.
 } // Namespace.
 } // Namespace.
@@ -184176,6 +183856,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 class PerfSampleDefaults;
+class StackSampleDefaults;
 class TrackEventDefaults;
 class V8CodeDefaults;
 } // Namespace pbzero.
@@ -184186,7 +183867,7 @@ namespace perfetto {
 namespace protos {
 namespace pbzero {
 
-class TracePacketDefaults_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/99> {
+class TracePacketDefaults_Decoder : public ::protozero::TypedProtoDecoder</*MAX_FIELD_ID=*/100> {
  public:
   TracePacketDefaults_Decoder(const uint8_t* data, size_t len) : TypedProtoDecoder(data, len) {}
   explicit TracePacketDefaults_Decoder(const std::string& raw) : TypedProtoDecoder(reinterpret_cast<const uint8_t*>(raw.data()), raw.size()) {}
@@ -184197,6 +183878,8 @@ class TracePacketDefaults_Decoder : public ::protozero::TypedProtoDecoder</*MAX_
   ::protozero::ConstBytes track_event_defaults() const { return at<11>().as_bytes(); }
   bool has_perf_sample_defaults() const { return at<12>().valid(); }
   ::protozero::ConstBytes perf_sample_defaults() const { return at<12>().as_bytes(); }
+  bool has_stack_sample_defaults() const { return at<100>().valid(); }
+  ::protozero::ConstBytes stack_sample_defaults() const { return at<100>().as_bytes(); }
   bool has_v8_code_defaults() const { return at<99>().valid(); }
   ::protozero::ConstBytes v8_code_defaults() const { return at<99>().as_bytes(); }
 };
@@ -184208,6 +183891,7 @@ class TracePacketDefaults : public ::protozero::Message {
     kTimestampClockIdFieldNumber = 58,
     kTrackEventDefaultsFieldNumber = 11,
     kPerfSampleDefaultsFieldNumber = 12,
+    kStackSampleDefaultsFieldNumber = 100,
     kV8CodeDefaultsFieldNumber = 99,
   };
   static constexpr const char* GetName() { return ".perfetto.protos.TracePacketDefaults"; }
@@ -184259,6 +183943,20 @@ class TracePacketDefaults : public ::protozero::Message {
   }
 
 
+  using FieldMetadata_StackSampleDefaults =
+    ::protozero::proto_utils::FieldMetadata<
+      100,
+      ::protozero::proto_utils::RepetitionType::kNotRepeated,
+      ::protozero::proto_utils::ProtoSchemaType::kMessage,
+      StackSampleDefaults,
+      TracePacketDefaults>;
+
+  static constexpr FieldMetadata_StackSampleDefaults kStackSampleDefaults{};
+  template <typename T = StackSampleDefaults> T* set_stack_sample_defaults() {
+    return BeginNestedMessage<T>(100);
+  }
+
+
   using FieldMetadata_V8CodeDefaults =
     ::protozero::proto_utils::FieldMetadata<
       99,
@@ -189882,8 +189580,8 @@ class LogMessage;
 class TaskExecution;
 class DebugAnnotation;
 class DebugAnnotation_NestedValue;
-class TrackEvent_Callstack;
-class TrackEvent_Callstack_Frame;
+class TrackEvent_InlineCallstack;
+class TrackEvent_InlineCallstack_Frame;
 enum TrackEvent_Type : int;
 enum TrackEvent_LegacyEvent_FlowDirection : int;
 enum TrackEvent_LegacyEvent_InstantEventScope : int;
@@ -190078,7 +189776,7 @@ class PERFETTO_EXPORT_COMPONENT TrackEventDefaults : public ::protozero::CppMess
 
 class PERFETTO_EXPORT_COMPONENT TrackEvent : public ::protozero::CppMessageObj {
  public:
-  using Callstack = TrackEvent_Callstack;
+  using InlineCallstack = TrackEvent_InlineCallstack;
   using LegacyEvent = TrackEvent_LegacyEvent;
   using Type = TrackEvent_Type;
   static constexpr auto TYPE_UNSPECIFIED = TrackEvent_Type_TYPE_UNSPECIFIED;
@@ -190111,6 +189809,7 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent : public ::protozero::CppMessageObj {
     kCorrelationIdStrIidFieldNumber = 54,
     kCallstackFieldNumber = 55,
     kCallstackIidFieldNumber = 56,
+    kCallstackWeightFieldNumber = 57,
     kDebugAnnotationsFieldNumber = 4,
     kTaskExecutionFieldNumber = 5,
     kLogMessageFieldNumber = 21,
@@ -190261,13 +189960,17 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent : public ::protozero::CppMessageObj {
   void set_correlation_id_str_iid(uint64_t value) { correlation_id_str_iid_ = value; _has_field_.set(54); }
 
   bool has_callstack() const { return _has_field_[55]; }
-  const TrackEvent_Callstack& callstack() const { return *callstack_; }
-  TrackEvent_Callstack* mutable_callstack() { _has_field_.set(55); return callstack_.get(); }
+  const TrackEvent_InlineCallstack& callstack() const { return *callstack_; }
+  TrackEvent_InlineCallstack* mutable_callstack() { _has_field_.set(55); return callstack_.get(); }
 
   bool has_callstack_iid() const { return _has_field_[56]; }
   uint64_t callstack_iid() const { return callstack_iid_; }
   void set_callstack_iid(uint64_t value) { callstack_iid_ = value; _has_field_.set(56); }
 
+  bool has_callstack_weight() const { return _has_field_[57]; }
+  double callstack_weight() const { return callstack_weight_; }
+  void set_callstack_weight(double value) { callstack_weight_ = value; _has_field_.set(57); }
+
   const std::vector<DebugAnnotation>& debug_annotations() const { return debug_annotations_; }
   std::vector<DebugAnnotation>* mutable_debug_annotations() { return &debug_annotations_; }
   int debug_annotations_size() const;
@@ -190398,8 +190101,9 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent : public ::protozero::CppMessageObj {
   uint64_t correlation_id_{};
   std::string correlation_id_str_{};
   uint64_t correlation_id_str_iid_{};
-  ::protozero::CopyablePtr<TrackEvent_Callstack> callstack_;
+  ::protozero::CopyablePtr<TrackEvent_InlineCallstack> callstack_;
   uint64_t callstack_iid_{};
+  double callstack_weight_{};
   std::vector<DebugAnnotation> debug_annotations_;
   ::protozero::CopyablePtr<TaskExecution> task_execution_;
   ::protozero::CopyablePtr<LogMessage> log_message_;
@@ -190432,7 +190136,7 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent : public ::protozero::CppMessageObj {
   // with future versions of .proto files.
   std::string unknown_fields_;
 
-  std::bitset<57> _has_field_{};
+  std::bitset<58> _has_field_{};
 };
 
 
@@ -190575,35 +190279,35 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent_LegacyEvent : public ::protozero::Cpp
 };
 
 
-class PERFETTO_EXPORT_COMPONENT TrackEvent_Callstack : public ::protozero::CppMessageObj {
+class PERFETTO_EXPORT_COMPONENT TrackEvent_InlineCallstack : public ::protozero::CppMessageObj {
  public:
-  using Frame = TrackEvent_Callstack_Frame;
+  using Frame = TrackEvent_InlineCallstack_Frame;
   enum FieldNumbers {
     kFramesFieldNumber = 1,
   };
 
-  TrackEvent_Callstack();
-  ~TrackEvent_Callstack() override;
-  TrackEvent_Callstack(TrackEvent_Callstack&&) noexcept;
-  TrackEvent_Callstack& operator=(TrackEvent_Callstack&&);
-  TrackEvent_Callstack(const TrackEvent_Callstack&);
-  TrackEvent_Callstack& operator=(const TrackEvent_Callstack&);
-  bool operator==(const TrackEvent_Callstack&) const;
-  bool operator!=(const TrackEvent_Callstack& other) const { return !(*this == other); }
+  TrackEvent_InlineCallstack();
+  ~TrackEvent_InlineCallstack() override;
+  TrackEvent_InlineCallstack(TrackEvent_InlineCallstack&&) noexcept;
+  TrackEvent_InlineCallstack& operator=(TrackEvent_InlineCallstack&&);
+  TrackEvent_InlineCallstack(const TrackEvent_InlineCallstack&);
+  TrackEvent_InlineCallstack& operator=(const TrackEvent_InlineCallstack&);
+  bool operator==(const TrackEvent_InlineCallstack&) const;
+  bool operator!=(const TrackEvent_InlineCallstack& other) const { return !(*this == other); }
 
   bool ParseFromArray(const void*, size_t) override;
   std::string SerializeAsString() const override;
   std::vector<uint8_t> SerializeAsArray() const override;
   void Serialize(::protozero::Message*) const;
 
-  const std::vector<TrackEvent_Callstack_Frame>& frames() const { return frames_; }
-  std::vector<TrackEvent_Callstack_Frame>* mutable_frames() { return &frames_; }
+  const std::vector<TrackEvent_InlineCallstack_Frame>& frames() const { return frames_; }
+  std::vector<TrackEvent_InlineCallstack_Frame>* mutable_frames() { return &frames_; }
   int frames_size() const;
   void clear_frames();
-  TrackEvent_Callstack_Frame* add_frames();
+  TrackEvent_InlineCallstack_Frame* add_frames();
 
  private:
-  std::vector<TrackEvent_Callstack_Frame> frames_;
+  std::vector<TrackEvent_InlineCallstack_Frame> frames_;
 
   // Allows to preserve unknown protobuf fields for compatibility
   // with future versions of .proto files.
@@ -190613,7 +190317,7 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent_Callstack : public ::protozero::CppMe
 };
 
 
-class PERFETTO_EXPORT_COMPONENT TrackEvent_Callstack_Frame : public ::protozero::CppMessageObj {
+class PERFETTO_EXPORT_COMPONENT TrackEvent_InlineCallstack_Frame : public ::protozero::CppMessageObj {
  public:
   enum FieldNumbers {
     kFunctionNameFieldNumber = 1,
@@ -190621,14 +190325,14 @@ class PERFETTO_EXPORT_COMPONENT TrackEvent_Callstack_Frame : public ::protozero:
     kLineNumberFieldNumber = 3,
   };
 
-  TrackEvent_Callstack_Frame();
-  ~TrackEvent_Callstack_Frame() override;
-  TrackEvent_Callstack_Frame(TrackEvent_Callstack_Frame&&) noexcept;
-  TrackEvent_Callstack_Frame& operator=(TrackEvent_Callstack_Frame&&);
-  TrackEvent_Callstack_Frame(const TrackEvent_Callstack_Frame&);
-  TrackEvent_Callstack_Frame& operator=(const TrackEvent_Callstack_Frame&);
-  bool operator==(const TrackEvent_Callstack_Frame&) const;
-  bool operator!=(const TrackEvent_Callstack_Frame& other) const { return !(*this == other); }
+  TrackEvent_InlineCallstack_Frame();
+  ~TrackEvent_InlineCallstack_Frame() override;
+  TrackEvent_InlineCallstack_Frame(TrackEvent_InlineCallstack_Frame&&) noexcept;
+  TrackEvent_InlineCallstack_Frame& operator=(TrackEvent_InlineCallstack_Frame&&);
+  TrackEvent_InlineCallstack_Frame(const TrackEvent_InlineCallstack_Frame&);
+  TrackEvent_InlineCallstack_Frame& operator=(const TrackEvent_InlineCallstack_Frame&);
+  bool operator==(const TrackEvent_InlineCallstack_Frame&) const;
+  bool operator!=(const TrackEvent_InlineCallstack_Frame& other) const { return !(*this == other); }
 
   bool ParseFromArray(const void*, size_t) override;
   std::string SerializeAsString() const override;
@@ -190714,11 +190418,11 @@ class TraceStats;
 class TraceStats_FilterStats;
 class TraceStats_WriterStats;
 class TraceStats_BufferStats;
-class TraceStats_BufferStats_ShadowBufferStats;
 class GetTraceStatsRequest;
 class AttachResponse;
 class TraceConfig;
-class TraceConfig_Note;
+class TraceAttributes;
+class TraceAttributes_Attribute;
 class PriorityBoostConfig;
 class TraceConfig_SessionSemaphore;
 class TraceConfig_CmdTraceStartDelay;
@@ -190727,6 +190431,9 @@ class TraceConfig_TraceFilter;
 class TraceConfig_TraceFilter_StringFilterChain;
 class TraceConfig_TraceFilter_StringFilterRule;
 class TraceConfig_IncidentReportConfig;
+class TraceConfig_CompressionConfig;
+class TraceConfig_CompressionConfig_Zstd;
+class TraceConfig_CompressionConfig_Deflate;
 class TraceConfig_IncrementalStateConfig;
 class TraceConfig_TriggerConfig;
 class TraceConfig_TriggerConfig_Trigger;
diff --git a/deps/simdjson/simdjson.cpp b/deps/simdjson/simdjson.cpp
index 7b8b0c44f057..92d971fd448b 100644
--- a/deps/simdjson/simdjson.cpp
+++ b/deps/simdjson/simdjson.cpp
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-14 12:14:27 -0400. version 4.6.7 Do not edit! */
+/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
 /* including simdjson.cpp:  */
 /* begin file simdjson.cpp */
 #define SIMDJSON_SRC_SIMDJSON_CPP
diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
index afcca85ad6bf..55346b59ef59 100644
--- a/deps/simdjson/simdjson.h
+++ b/deps/simdjson/simdjson.h
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-14 12:14:27 -0400. version 4.6.7 Do not edit! */
+/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
 /* including simdjson.h:  */
 /* begin file simdjson.h */
 #ifndef SIMDJSON_H
@@ -2538,7 +2538,7 @@ namespace std {
 #define SIMDJSON_SIMDJSON_VERSION_H
 
 /** The version of simdjson being used (major.minor.revision) */
-#define SIMDJSON_VERSION "4.6.7"
+#define SIMDJSON_VERSION "4.6.9"
 
 namespace simdjson {
 enum {
@@ -2553,7 +2553,7 @@ enum {
   /**
    * The revision (major.minor.REVISION) of simdjson being used.
    */
-  SIMDJSON_VERSION_REVISION = 7
+  SIMDJSON_VERSION_REVISION = 9
 };
 } // namespace simdjson
 
@@ -69201,6 +69201,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -72864,13 +72865,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -82583,6 +82580,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -86246,13 +86244,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -96452,6 +96446,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -100115,13 +100110,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -110321,6 +110312,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -113984,13 +113976,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -124305,6 +124293,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -127968,13 +127957,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -138606,6 +138591,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -142269,13 +142255,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -152381,6 +152363,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -156044,13 +156027,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -166179,6 +166158,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -169842,13 +169822,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -179981,6 +179957,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -183644,13 +183621,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
diff --git a/deps/sqlite/unofficial.gni b/deps/sqlite/unofficial.gni
index 0e62accfb699..a0957c5769d6 100644
--- a/deps/sqlite/unofficial.gni
+++ b/deps/sqlite/unofficial.gni
@@ -4,47 +4,67 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("sqlite_gn_build") {
-  config("sqlite_config") {
-    include_dirs = [ "." ]
-    defines = [
-      "SQLITE_ENABLE_COLUMN_METADATA",
-      "SQLITE_ENABLE_DBSTAT_VTAB",
-      "SQLITE_ENABLE_FTS3",
-      "SQLITE_ENABLE_FTS3_PARENTHESIS",
-      "SQLITE_ENABLE_FTS5",
-      "SQLITE_ENABLE_GEOPOLY",
-      "SQLITE_ENABLE_MATH_FUNCTIONS",
-      "SQLITE_ENABLE_PERCENTILE",
-      "SQLITE_ENABLE_PREUPDATE_HOOK",
-      "SQLITE_ENABLE_RBU",
-      "SQLITE_ENABLE_RTREE",
-      "SQLITE_ENABLE_SESSION",
-    ]
-  }
+  if (node_shared_sqlite) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("sqlite_config") {
+      packages = [ "sqlite3" ]
+    }
+    # sqlite3.h only declares the session extension when this is defined.
+    config("sqlite_defines") {
+      defines = [ "SQLITE_ENABLE_SESSION" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [
+        ":sqlite_config",
+        ":sqlite_defines",
+      ]
+    }
+  } else {
+    config("sqlite_config") {
+      include_dirs = [ "." ]
+      defines = [
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_DBSTAT_VTAB",
+        "SQLITE_ENABLE_FTS3",
+        "SQLITE_ENABLE_FTS3_PARENTHESIS",
+        "SQLITE_ENABLE_FTS5",
+        "SQLITE_ENABLE_GEOPOLY",
+        "SQLITE_ENABLE_MATH_FUNCTIONS",
+        "SQLITE_ENABLE_PERCENTILE",
+        "SQLITE_ENABLE_PREUPDATE_HOOK",
+        "SQLITE_ENABLE_RBU",
+        "SQLITE_ENABLE_RTREE",
+        "SQLITE_ENABLE_SESSION",
+      ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("sqlite.gyp") ],
-                            "scope",
-                            [ "sqlite.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("sqlite.gyp") ],
+                              "scope",
+                              [ "sqlite.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":sqlite_config" ]
-    sources = gypi_values.sqlite_sources
-    cflags_c = [
-      "-Wno-implicit-fallthrough",
-      "-Wno-unreachable-code-return",
-      "-Wno-unreachable-code-break",
-      "-Wno-unreachable-code",
-    ]
-    if (is_win) {
-      cflags_c += [
-        "-Wno-sign-compare",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-variable",
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":sqlite_config" ]
+      sources = gypi_values.sqlite_sources
+      cflags_c = [
+        "-Wno-implicit-fallthrough",
+        "-Wno-unreachable-code-return",
+        "-Wno-unreachable-code-break",
+        "-Wno-unreachable-code",
       ]
+      if (is_win) {
+        cflags_c += [
+          "-Wno-sign-compare",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-variable",
+        ]
+      }
     }
   }
 }
diff --git a/deps/undici/src/docs/docs/api/Client.md b/deps/undici/src/docs/docs/api/Client.md
index d48b2303f287..5f44ae42db86 100644
--- a/deps/undici/src/docs/docs/api/Client.md
+++ b/deps/undici/src/docs/docs/api/Client.md
@@ -147,6 +147,10 @@ added: v1.0.0
       WebSocket messages. Applied to uncompressed messages, compressed frame
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
+  * `eventSource` {Object} (optional) EventSource-specific configuration.
+    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
+      EventSource messages. Set to `0` to disable the limit.
+      **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 
 Instantiating a `Client` does not open a connection; the connection is
diff --git a/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md b/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
index 8a6b75a3d67b..f14b8760964e 100644
--- a/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
+++ b/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
@@ -25,8 +25,9 @@ it is used only for HTTPS requests.
 proxied. Each entry may include a leading dot or `*.` wildcard (for example
 `.example.com`) to match subdomains, and an optional `:port` suffix to restrict
 the match to a specific port. A request bypasses the proxy when its host equals
-an entry or is a subdomain of one. Setting `no_proxy` to `*` bypasses the proxy
-for every request.
+an entry or is a subdomain of one. A trailing dot is ignored on both sides, so
+`example.com.` and `example.com` match each other. Setting `no_proxy` to `*`
+bypasses the proxy for every request.
 
 The uppercase variants `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are also
 honored. When both the lowercase and uppercase forms of a variable are set, the
diff --git a/deps/undici/src/docs/docs/api/EventSource.md b/deps/undici/src/docs/docs/api/EventSource.md
index 938a7a8c6f2b..285a983379f7 100644
--- a/deps/undici/src/docs/docs/api/EventSource.md
+++ b/deps/undici/src/docs/docs/api/EventSource.md
@@ -66,6 +66,9 @@ added: v6.5.0
       wait before re-establishing a dropped connection. The server may override
       this value with a `retry` field. **Default:** `3000`.
 
+EventSource-specific limits can be configured on the dispatcher using the
+`eventSource` option. See [`Client`][] for details.
+
 Creates a new `EventSource` and immediately begins connecting to `url`. The
 request is sent with the `Accept: text/event-stream` header, a cache mode of
 `no-store`, and an initiator type of `other`.
@@ -349,6 +352,7 @@ eventSource.onerror = () => {
 ```
 
 [WHATWG-conformant]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
+[`Client`]: Client.md#new-clienturl-options
 [`Dispatcher`]: Dispatcher.md#class-dispatcher
 [`addEventListener()`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener
 [server-sent events]: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events
diff --git a/deps/undici/src/docs/docs/api/Interceptors.md b/deps/undici/src/docs/docs/api/Interceptors.md
index c692442d7f04..856877c3e4ae 100644
--- a/deps/undici/src/docs/docs/api/Interceptors.md
+++ b/deps/undici/src/docs/docs/api/Interceptors.md
@@ -101,8 +101,8 @@ body yourself.
 
 * `opts` {Object} (optional)
   * `maxSize` {number} Maximum number of bytes to read and discard. Responses
-    whose `Content-Length` exceeds this value are aborted. **Default:**
-    `1_048_576` (1 MiB).
+    whose declared or received body size exceeds this value are aborted.
+    **Default:** `1_048_576` (1 MiB).
 
 Per-request override: set `dumpMaxSize` on the dispatch options to override
 the global `maxSize` for a specific request.
@@ -210,6 +210,9 @@ Automatically decompresses response bodies encoded with `gzip`, `x-gzip`,
     skipped. **Default:** `[204, 304]`.
   * `skipErrorResponses` {boolean} When `true`, responses with a status code
     >= 400 are not decompressed. **Default:** `true`.
+  * `maxSize` {number} Maximum decompressed response size in bytes. The request
+    fails with a `ResponseExceededMaxSizeError` if the decoded body exceeds
+    this limit. **Default:** `67108864` (64 MiB).
 
 **Returns:** {Dispatcher.DispatcherComposeInterceptor}
 
@@ -221,7 +224,8 @@ import { Agent, interceptors } from 'undici'
 const agent = new Agent().compose(
   interceptors.decompress({
     skipStatusCodes: [204, 304],
-    skipErrorResponses: false // decompress error bodies too
+    skipErrorResponses: false, // decompress error bodies too
+    maxSize: 16 * 1024 * 1024 // limit decoded bodies to 16 MiB
   })
 )
 ```
diff --git a/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md b/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
index 21fec19b141e..783424da5114 100644
--- a/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
+++ b/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
@@ -60,6 +60,11 @@ added: v7.23.0
     a password embedded in `proxyUrl`. **Default:** the URL password, if any.
   * `connect` {Function} Custom connector used to open the socket to the proxy.
     **Default:** a connector built from `proxyTls`.
+  * `connectTimeout` {number} Maximum time in milliseconds for each proxy
+    connection, SOCKS5 negotiation, and target TLS negotiation stage. A value of
+    `0` disables these stage timeouts. `proxyTls.timeout` and
+    `requestTls.timeout` override it for their respective TLS stages.
+    **Default:** `5000`.
   * `proxyTls` {BuildOptions} TLS options for the connection to the proxy itself
     (SOCKS5 over TLS). When set, the proxy connection is established over TLS and
     `servername` defaults to the proxy host name.
@@ -69,7 +74,8 @@ added: v7.23.0
     host name.
 
 Throws an `InvalidArgumentError` if `proxyUrl` is missing or does not use the
-`socks5:` or `socks:` protocol.
+`socks5:` or `socks:` protocol, or if `connectTimeout`, `proxyTls.timeout`, or
+`requestTls.timeout` is not a finite, non-negative number.
 
 ```mjs
 import { Socks5ProxyAgent } from 'undici'
diff --git a/deps/undici/src/lib/cache/memory-cache-store.js b/deps/undici/src/lib/cache/memory-cache-store.js
index 5ea0f7247dd7..07dba9c3988e 100644
--- a/deps/undici/src/lib/cache/memory-cache-store.js
+++ b/deps/undici/src/lib/cache/memory-cache-store.js
@@ -87,7 +87,7 @@ class MemoryCacheStore extends EventEmitter {
   }
 
   /**
-   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} req
+   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} key
    * @returns {import('../../types/cache-interceptor.d.ts').default.GetResult | undefined}
    */
   get (key) {
@@ -179,7 +179,7 @@ class MemoryCacheStore extends EventEmitter {
 
           // Perform eviction
           for (const [key, entries] of store.#entries) {
-            for (const entry of entries.splice(0, entries.length / 2)) {
+            for (const entry of entries.splice(0, Math.ceil(entries.length / 2))) {
               store.#size -= entry.size
               store.#count -= 1
             }
diff --git a/deps/undici/src/lib/core/symbols.js b/deps/undici/src/lib/core/symbols.js
index badecb709086..5186052881bf 100644
--- a/deps/undici/src/lib/core/symbols.js
+++ b/deps/undici/src/lib/core/symbols.js
@@ -5,6 +5,8 @@ module.exports = {
   kDestroy: Symbol('destroy'),
   kDispatch: Symbol('dispatch'),
   kUrl: Symbol('url'),
+  kRequestOrigin: Symbol('request origin'),
+  kOriginless: Symbol('originless'),
   kWriting: Symbol('writing'),
   kResuming: Symbol('resuming'),
   kQueue: Symbol('queue'),
diff --git a/deps/undici/src/lib/dispatcher/agent.js b/deps/undici/src/lib/dispatcher/agent.js
index 1e670746e8e9..95c1b0923f08 100644
--- a/deps/undici/src/lib/dispatcher/agent.js
+++ b/deps/undici/src/lib/dispatcher/agent.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const { InvalidArgumentError, MaxOriginsReachedError } = require('../core/errors')
-const { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
+const { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
 const DispatcherBase = require('./dispatcher-base')
 const Pool = require('./pool')
 const Client = require('./client')
@@ -97,7 +97,12 @@ class Agent extends DispatcherBase {
           return
         }
 
-        if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+        // A GOAWAY detaches the HTTP/2 session before requeued requests are
+        // dispatched on a replacement connection. At that point the pool has
+        // no connected clients and is not busy, but it still has pending work.
+        // Closing it here lets the replacement Client finish those requests
+        // and then destroys that new connection with ClientDestroyedError.
+        if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
           return
         }
 
diff --git a/deps/undici/src/lib/dispatcher/balanced-pool.js b/deps/undici/src/lib/dispatcher/balanced-pool.js
index ca14bf6ed1d5..dbd9ebc8a552 100644
--- a/deps/undici/src/lib/dispatcher/balanced-pool.js
+++ b/deps/undici/src/lib/dispatcher/balanced-pool.js
@@ -13,7 +13,7 @@ const {
   kGetDispatcher
 } = require('./pool-base')
 const Pool = require('./pool')
-const { kUrl } = require('../core/symbols')
+const { kOriginless, kUrl } = require('../core/symbols')
 const util = require('../core/util')
 const kFactory = Symbol('factory')
 
@@ -49,14 +49,17 @@ function defaultFactory (origin, opts) {
 }
 
 class BalancedPool extends PoolBase {
-  constructor (upstreams = [], { factory = defaultFactory, ...opts } = {}) {
+  constructor (upstreams = [], { factory = defaultFactory, connect, tls, ...opts } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
 
-    super()
+    super(opts)
 
-    this[kOptions] = { ...util.deepClone(opts) }
+    this[kOriginless] = true
+    if (connect && typeof connect !== 'function') connect = { ...connect }
+    if (tls && typeof tls !== 'function') tls = { ...tls }
+    this[kOptions] = { ...util.deepClone(opts), connect, tls }
     this[kIndex] = -1
     this[kCurrentWeight] = 0
 
diff --git a/deps/undici/src/lib/dispatcher/client-h1.js b/deps/undici/src/lib/dispatcher/client-h1.js
index 9f6f17c1579b..f06ca74bfe53 100644
--- a/deps/undici/src/lib/dispatcher/client-h1.js
+++ b/deps/undici/src/lib/dispatcher/client-h1.js
@@ -1052,7 +1052,7 @@ function onSocketClose () {
 
 function clearIdleSocketValidation (socket) {
   if (socket[kIdleSocketValidationTimeout]) {
-    clearTimeout(socket[kIdleSocketValidationTimeout])
+    clearImmediate(socket[kIdleSocketValidationTimeout])
     socket[kIdleSocketValidationTimeout] = null
   }
 
@@ -1061,15 +1061,23 @@ function clearIdleSocketValidation (socket) {
 
 function scheduleIdleSocketValidation (client, socket) {
   socket[kIdleSocketValidation] = 1
-  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+  // Yield to the check phase (after poll) so unsolicited bytes / FIN / RST
+  // already pending on this idle keep-alive socket are processed before the
+  // next request is written (GHSA-35p6-xmwp-9g52).
+  //
+  // setTimeout(0) pays Node's ~1ms timer floor on every sequential reuse
+  // (#5493). setImmediate avoids that, but an *unref'd* Immediate lets poll
+  // block for ~500ms when the event loop is otherwise idle (#5600 / #5606).
+  // A ref'd Immediate both keeps the pending request alive and makes poll
+  // return immediately — the hybrid those issues asked for.
+  socket[kIdleSocketValidationTimeout] = setImmediate(() => {
     socket[kIdleSocketValidationTimeout] = null
     socket[kIdleSocketValidation] = 2
 
     if (client[kSocket] === socket && !socket.destroyed) {
       client[kResume]()
     }
-  }, 0)
-  socket[kIdleSocketValidationTimeout].unref?.()
+  })
 }
 
 /**
diff --git a/deps/undici/src/lib/dispatcher/client-h2.js b/deps/undici/src/lib/dispatcher/client-h2.js
index bc401008f004..55179000ebaf 100644
--- a/deps/undici/src/lib/dispatcher/client-h2.js
+++ b/deps/undici/src/lib/dispatcher/client-h2.js
@@ -10,7 +10,8 @@ const {
   InformationalError,
   InvalidArgumentError,
   HeadersTimeoutError,
-  BodyTimeoutError
+  BodyTimeoutError,
+  ResponseExceededMaxSizeError
 } = require('../core/errors.js')
 const {
   kUrl,
@@ -39,7 +40,8 @@ const {
   kRemoteSettings,
   kHTTP2Stream,
   kHTTP2SessionState,
-  kHTTP2Options
+  kHTTP2Options,
+  kMaxResponseSize
 } = require('../core/symbols.js')
 const { channels } = require('../core/diagnostics.js')
 
@@ -1022,9 +1024,11 @@ function writeH2 (client, request) {
   const state = {
     abort: null,
     body: request.body,
+    bytesRead: 0,
     client,
     contentLength: null,
     expectsPayload: false,
+    maxResponseSize: client[kMaxResponseSize],
     request,
     headersTimeout,
     bodyTimeout,
@@ -1260,6 +1264,7 @@ function writeH2 (client, request) {
   // become unreachable once the stream closes, so plain `on` avoids the
   // per-listener `once` wrapper allocation.
   stream.on('response', onResponse)
+  stream.on('headers', onInterimResponse)
   stream.on('end', onEnd)
   stream.on('error', onError)
   stream.on('frameError', onFrameError)
@@ -1280,6 +1285,7 @@ function removeRequestStreamListeners (stream) {
   stream.off('error', noop)
   stream.off('continue', writeBodyH2)
   stream.off('response', onResponse)
+  stream.off('headers', onInterimResponse)
   stream.off('end', onEnd)
   stream.off('error', onError)
   stream.off('frameError', onFrameError)
@@ -1322,17 +1328,51 @@ function onData (chunk) {
     return
   }
 
-  const { request } = state
+  const { request, maxResponseSize } = state
 
   if (request.aborted || request.completed) {
     return
   }
 
+  if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+    // Unlike HTTP/1.1, which destroys the socket because it cannot abandon one
+    // response without losing framing, resetting the offending stream leaves
+    // the session usable for its siblings.
+    state.abort(new ResponseExceededMaxSizeError())
+    return
+  }
+
+  state.bytesRead += chunk.length
+
   if (request.onResponseData(chunk) === false) {
     stream.pause()
   }
 }
 
+function onInterimResponse (headers) {
+  const stream = this
+  const state = stream[kRequestStreamState]
+
+  if (state == null) {
+    return
+  }
+
+  const { request } = state
+
+  if (request.aborted || request.completed) {
+    return
+  }
+
+  // node http2 emits 'headers' for interim (1xx) informational responses,
+  // while the final response arrives via 'response'. Forward these to the
+  // handler so that onInfo is invoked, matching the HTTP/1 behaviour and the
+  // documented onInfo contract.
+  const statusCode = headers[HTTP2_HEADER_STATUS]
+  delete headers[HTTP2_HEADER_STATUS]
+
+  request.onResponseStart(Number(statusCode), headers, noop, '')
+}
+
 function onResponse (headers) {
   const stream = this
   const state = stream[kRequestStreamState]
diff --git a/deps/undici/src/lib/dispatcher/client.js b/deps/undici/src/lib/dispatcher/client.js
index d620e8310cfb..ec81541f9a59 100644
--- a/deps/undici/src/lib/dispatcher/client.js
+++ b/deps/undici/src/lib/dispatcher/client.js
@@ -137,7 +137,8 @@ class Client extends DispatcherBase {
     connectionWindowSize,
     pingInterval,
     webSocket,
-    h2Options
+    h2Options,
+    eventSource
   } = {}) {
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -276,7 +277,7 @@ class Client extends DispatcherBase {
       }
     }
 
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (typeof connect !== 'function') {
       connect = buildConnector({
diff --git a/deps/undici/src/lib/dispatcher/dispatcher-base.js b/deps/undici/src/lib/dispatcher/dispatcher-base.js
index 21b5e346acad..d9d15d6441a9 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher-base.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher-base.js
@@ -1,5 +1,6 @@
 'use strict'
 
+const buffer = require('node:buffer')
 const Dispatcher = require('./dispatcher')
 const {
   ClientDestroyedError,
@@ -11,6 +12,7 @@ const { kDestroy, kClose, kClosed, kDestroyed, kDispatch } = require('../core/sy
 const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   /** @type {boolean} */
@@ -31,10 +33,11 @@ class DispatcherBase extends Dispatcher {
   constructor (opts) {
     super()
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   /**
-   * @returns {import('../../types/dispatcher').WebSocketOptions}
+   * @returns {import('../../types/client').Client.WebSocketOptions}
    */
   get webSocketOptions () {
     return {
@@ -43,6 +46,15 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  /**
+   * @returns {import('../../types/client').Client.EventSourceOptions}
+   */
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   /** @returns {boolean} */
   get destroyed () {
     return this[kDestroyed]
diff --git a/deps/undici/src/lib/dispatcher/dispatcher.js b/deps/undici/src/lib/dispatcher/dispatcher.js
index ecff2a9b1685..11a7ab2b4476 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher.js
@@ -1,5 +1,6 @@
 'use strict'
 const EventEmitter = require('node:events')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class Dispatcher extends EventEmitter {
   dispatch () {
@@ -17,6 +18,10 @@ class Dispatcher extends EventEmitter {
   compose (...args) {
     // So we handle [interceptor1, interceptor2] or interceptor1, interceptor2, ...
     const interceptors = Array.isArray(args[0]) ? args[0] : args
+    // null disables origin-dependent interceptors; undefined uses opts.origin.
+    const interceptorOrigin = this[kOriginless] === true
+      ? null
+      : this[kUrl]?.origin
     let dispatch = this.dispatch.bind(this)
 
     for (const interceptor of interceptors) {
@@ -28,13 +33,22 @@ class Dispatcher extends EventEmitter {
         throw new TypeError(`invalid interceptor, expected function received ${typeof interceptor}`)
       }
 
-      dispatch = interceptor(dispatch)
+      dispatch = interceptor(dispatch, interceptorOrigin)
 
       if (dispatch == null || typeof dispatch !== 'function' || dispatch.length !== 2) {
         throw new TypeError('invalid interceptor')
       }
     }
 
+    const originalDispatch = dispatch
+    const self = this
+    dispatch = function (opts, handler) {
+      if (opts && typeof opts === 'object' && !opts.origin && self[kUrl]) {
+        opts = Object.assign({}, opts, { origin: self[kUrl].origin })
+      }
+      return originalDispatch(opts, handler)
+    }
+
     return new Proxy(this, {
       get: (target, key) => key === 'dispatch' ? dispatch : target[key]
     })
diff --git a/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js b/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
index f5813288cb33..e206984d5a47 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
@@ -3,6 +3,7 @@
 const Dispatcher = require('./dispatcher')
 const { InvalidArgumentError } = require('../core/errors')
 const { toRawHeaders } = require('../core/util')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class LegacyHandlerWrapper {
   #handler
@@ -71,6 +72,8 @@ class Dispatcher1Wrapper extends Dispatcher {
     }
 
     this.#dispatcher = dispatcher
+    this[kUrl] = dispatcher[kUrl]
+    this[kOriginless] = dispatcher[kOriginless]
   }
 
   static wrapHandler (handler) {
diff --git a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
index 51c50601714b..5d943dbd250e 100644
--- a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
@@ -16,7 +16,7 @@ class EnvHttpProxyAgent extends DispatcherBase {
   #opts = null
 
   constructor (opts = {}) {
-    super()
+    super(opts)
     this.#opts = opts
 
     const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts
@@ -69,6 +69,13 @@ class EnvHttpProxyAgent extends DispatcherBase {
     // brackets from IPv6 literals (e.g. "[::1]" -> "::1") so that the
     // result matches the unbracketed form stored by #parseNoProxy.
     hostname = hostname.replace(/:\d*$/, '').replace(/^\[(.+)\]$/, '$1').toLowerCase()
+    // Drop a trailing dot: it only marks the fully qualified form of a domain
+    // name ("example.com." and "example.com" are the same name, RFC 1034 root
+    // label). This runs on every dispatch, so it is a charCode check rather
+    // than a third regex. `length > 1` leaves the degenerate host "." alone.
+    if (hostname.length > 1 && hostname.charCodeAt(hostname.length - 1) === 46) {
+      hostname = hostname.slice(0, -1)
+    }
     port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0
     if (!this.#shouldProxy(hostname, port)) {
       return this[kNoProxyAgent]
@@ -143,8 +150,8 @@ class EnvHttpProxyAgent extends DispatcherBase {
       }
 
       noProxyEntries.push({
-        // strip leading dot or asterisk with dot
-        hostname: hostname.replace(/^\*?\./, '').toLowerCase(),
+        // strip leading dot or asterisk with dot, and any trailing dot
+        hostname: hostname.replace(/^\*?\./, '').replace(/^(.+)\.$/, '$1').toLowerCase(),
         port
       })
     }
diff --git a/deps/undici/src/lib/dispatcher/proxy-agent.js b/deps/undici/src/lib/dispatcher/proxy-agent.js
index 0b07b2fe8fe0..2b118581eec8 100644
--- a/deps/undici/src/lib/dispatcher/proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/proxy-agent.js
@@ -9,6 +9,7 @@ const buildConnector = require('../core/connect')
 const Client = require('./client')
 const { channels } = require('../core/diagnostics')
 const Socks5ProxyAgent = require('./socks5-proxy-agent')
+const { hasSafeIterator } = require('../core/util')
 
 const kAgent = Symbol('proxy agent')
 const kClient = Symbol('proxy client')
@@ -120,7 +121,7 @@ class ProxyAgent extends DispatcherBase {
 
     const { proxyTunnel, connectTimeout } = opts
 
-    super()
+    super(opts)
 
     const url = this.#getUrl(opts)
     const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url
@@ -161,6 +162,7 @@ class ProxyAgent extends DispatcherBase {
           factory: agentFactory,
           username: opts.username || username,
           password: opts.password || password,
+          connectTimeout,
           proxyTls: opts.proxyTls,
           requestTls: opts.requestTls
         })
@@ -344,6 +346,21 @@ function buildHeaders (headers) {
     return headersPair
   }
 
+  // Materialize iterable header containers (e.g. Map, Headers) into a record so
+  // that throwIfProxyAuthIsSent() can inspect their entries. Object.keys and
+  // for...in see nothing on a Map/Headers instance, so without this the
+  // Proxy-Authorization guard is bypassed and proxy credentials can reach the
+  // origin server (GHSA-6cv7-626c-qhqw).
+  if (headers && typeof headers === 'object' && hasSafeIterator(headers)) {
+    const headersPair = {}
+
+    for (const [key, value] of headers) {
+      headersPair[key] = value
+    }
+
+    return headersPair
+  }
+
   return headers
 }
 
diff --git a/deps/undici/src/lib/dispatcher/retry-agent.js b/deps/undici/src/lib/dispatcher/retry-agent.js
index 0c2120d6f26a..0b50f22a3181 100644
--- a/deps/undici/src/lib/dispatcher/retry-agent.js
+++ b/deps/undici/src/lib/dispatcher/retry-agent.js
@@ -2,6 +2,7 @@
 
 const Dispatcher = require('./dispatcher')
 const RetryHandler = require('../handler/retry-handler')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class RetryAgent extends Dispatcher {
   #agent = null
@@ -10,6 +11,8 @@ class RetryAgent extends Dispatcher {
     super(options)
     this.#agent = agent
     this.#options = options
+    this[kUrl] = agent[kUrl]
+    this[kOriginless] = agent[kOriginless]
   }
 
   dispatch (opts, handler) {
diff --git a/deps/undici/src/lib/dispatcher/round-robin-pool.js b/deps/undici/src/lib/dispatcher/round-robin-pool.js
index b1f4763530f5..1db82a9ccb3b 100644
--- a/deps/undici/src/lib/dispatcher/round-robin-pool.js
+++ b/deps/undici/src/lib/dispatcher/round-robin-pool.js
@@ -65,7 +65,7 @@ class RoundRobinPool extends PoolBase {
       })
     }
 
-    super()
+    super(options)
 
     this[kConnections] = connections || null
     this[kUrl] = util.parseOrigin(origin)
diff --git a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
index 909c7f502478..e380005ffb61 100644
--- a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
@@ -4,22 +4,33 @@ const { URL } = require('node:url')
 
 let tls // include tls conditionally since it is not always available
 const DispatcherBase = require('./dispatcher-base')
-const { InvalidArgumentError } = require('../core/errors')
+const { ConnectTimeoutError, InvalidArgumentError } = require('../core/errors')
 const { Socks5Client, STATES } = require('../core/socks5-client')
 const { kBusy, kConnected, kDispatch, kClose, kDestroy } = require('../core/symbols')
 const Pool = require('./pool')
 const buildConnector = require('../core/connect')
+const { setupConnectTimeout } = require('../core/util')
 const { debuglog } = require('node:util')
 
 const debug = debuglog('undici:socks5-proxy')
 
+const DEFAULT_SOCKS5_CONNECT_TIMEOUT = 5000
+
 const kProxyUrl = Symbol('proxy url')
 const kProxyHeaders = Symbol('proxy headers')
 const kProxyAuth = Symbol('proxy auth')
 const kProxyProtocol = Symbol('proxy protocol')
 const kPools = Symbol('pools')
 const kConnector = Symbol('connector')
+const kConnectTimeout = Symbol('connect timeout')
 const kRequestTls = Symbol('request tls settings')
+const kRequestTlsTimeout = Symbol('request tls timeout')
+
+function createConnectTimeoutError (hostname, port, timeout) {
+  return new ConnectTimeoutError(
+    `Connect Timeout Error (attempted address: ${hostname}:${port}, timeout: ${timeout}ms)`
+  )
+}
 
 // Static flag to ensure warning is only emitted once per process
 let experimentalWarningEmitted = false
@@ -29,7 +40,7 @@ let experimentalWarningEmitted = false
  */
 class Socks5ProxyAgent extends DispatcherBase {
   constructor (proxyUrl, options = {}) {
-    super()
+    super(options)
 
     // Emit experimental warning only once
     if (!experimentalWarningEmitted) {
@@ -54,7 +65,20 @@ class Socks5ProxyAgent extends DispatcherBase {
     this[kProxyUrl] = url
     this[kProxyHeaders] = options.headers || {}
     this[kProxyProtocol] = options.proxyTls ? 'https:' : 'http:'
-    this[kRequestTls] = options.requestTls
+
+    const connectTimeout = options.connectTimeout ?? DEFAULT_SOCKS5_CONNECT_TIMEOUT
+    if (!Number.isFinite(connectTimeout) || connectTimeout < 0) {
+      throw new InvalidArgumentError('invalid connectTimeout')
+    }
+    this[kConnectTimeout] = connectTimeout
+
+    const { timeout, ...requestTls } = options.requestTls || {}
+    const requestTlsTimeout = timeout ?? connectTimeout
+    if (!Number.isFinite(requestTlsTimeout) || requestTlsTimeout < 0) {
+      throw new InvalidArgumentError('invalid requestTls.timeout')
+    }
+    this[kRequestTls] = requestTls
+    this[kRequestTlsTimeout] = requestTlsTimeout
 
     // Extract auth from URL or options
     this[kProxyAuth] = {
@@ -63,8 +87,13 @@ class Socks5ProxyAgent extends DispatcherBase {
     }
 
     // Create connector for proxy connection
+    const proxyTlsTimeout = options.proxyTls?.timeout ?? connectTimeout
+    if (!Number.isFinite(proxyTlsTimeout) || proxyTlsTimeout < 0) {
+      throw new InvalidArgumentError('invalid proxyTls.timeout')
+    }
     this[kConnector] = options.connect || buildConnector({
       ...options.proxyTls,
+      timeout: proxyTlsTimeout,
       servername: options.proxyTls?.servername || url.hostname
     })
 
@@ -113,20 +142,29 @@ class Socks5ProxyAgent extends DispatcherBase {
 
     // Wait for authentication (if required)
     const authenticationReady = Promise.withResolvers()
-
-    const authenticationTimeout = setTimeout(() => {
-      authenticationReady.reject(new Error('SOCKS5 authentication timeout'))
-    }, 5000)
-
-    const onAuthenticated = () => {
+    const authenticationTimeout = this[kConnectTimeout] === 0
+      ? null
+      : setTimeout(() => {
+        cleanupAuthenticationListeners()
+        socks5Client.destroy()
+        authenticationReady.reject(
+          createConnectTimeoutError(proxyHost, proxyPort, this[kConnectTimeout])
+        )
+      }, this[kConnectTimeout])
+
+    const cleanupAuthenticationListeners = () => {
       clearTimeout(authenticationTimeout)
+      socks5Client.removeListener('authenticated', onAuthenticated)
       socks5Client.removeListener('error', onAuthenticationError)
+    }
+
+    const onAuthenticated = () => {
+      cleanupAuthenticationListeners()
       authenticationReady.resolve()
     }
 
     const onAuthenticationError = (err) => {
-      clearTimeout(authenticationTimeout)
-      socks5Client.removeListener('authenticated', onAuthenticated)
+      cleanupAuthenticationListeners()
       authenticationReady.reject(err)
     }
 
@@ -146,21 +184,30 @@ class Socks5ProxyAgent extends DispatcherBase {
 
     // Wait for connection
     const connectionReady = Promise.withResolvers()
-
-    const connectionTimeout = setTimeout(() => {
-      connectionReady.reject(new Error('SOCKS5 connection timeout'))
-    }, 5000)
+    const connectionTimeout = this[kConnectTimeout] === 0
+      ? null
+      : setTimeout(() => {
+        cleanupConnectionListeners()
+        socks5Client.destroy()
+        connectionReady.reject(
+          createConnectTimeoutError(targetHost, targetPort, this[kConnectTimeout])
+        )
+      }, this[kConnectTimeout])
+
+    const cleanupConnectionListeners = () => {
+      clearTimeout(connectionTimeout)
+      socks5Client.removeListener('connected', onConnected)
+      socks5Client.removeListener('error', onConnectionError)
+    }
 
     const onConnected = (info) => {
       debug('SOCKS5 tunnel established to', targetHost, targetPort, 'via', info)
-      clearTimeout(connectionTimeout)
-      socks5Client.removeListener('error', onConnectionError)
+      cleanupConnectionListeners()
       connectionReady.resolve()
     }
 
     const onConnectionError = (err) => {
-      clearTimeout(connectionTimeout)
-      socks5Client.removeListener('connected', onConnected)
+      cleanupConnectionListeners()
       connectionReady.reject(err)
     }
 
@@ -213,8 +260,31 @@ class Socks5ProxyAgent extends DispatcherBase {
                 })
 
                 const tlsReady = Promise.withResolvers()
-                finalSocket.once('secureConnect', tlsReady.resolve)
-                finalSocket.once('error', tlsReady.reject)
+
+                const cleanupTlsListeners = () => {
+                  queueMicrotask(clearTlsTimeout)
+                  finalSocket.removeListener('secureConnect', onSecureConnect)
+                  finalSocket.removeListener('error', onTlsError)
+                }
+
+                const onSecureConnect = () => {
+                  cleanupTlsListeners()
+                  tlsReady.resolve()
+                }
+
+                const onTlsError = (err) => {
+                  cleanupTlsListeners()
+                  tlsReady.reject(err)
+                }
+
+                const clearTlsTimeout = setupConnectTimeout(new WeakRef(finalSocket), {
+                  timeout: this[kRequestTlsTimeout],
+                  hostname: targetHost,
+                  port: targetPort
+                })
+
+                finalSocket.once('secureConnect', onSecureConnect)
+                finalSocket.once('error', onTlsError)
                 await tlsReady.promise
               }
 
diff --git a/deps/undici/src/lib/handler/cache-handler.js b/deps/undici/src/lib/handler/cache-handler.js
index bdfc0d94a433..2ec550b431ad 100644
--- a/deps/undici/src/lib/handler/cache-handler.js
+++ b/deps/undici/src/lib/handler/cache-handler.js
@@ -173,6 +173,14 @@ class CacheHandler {
     this.#handler.onRequestStart?.(controller, context)
   }
 
+  onBodySent (chunk) {
+    this.#handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.#handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (controller, statusCode, headers, socket) {
     this.#handler.onRequestUpgrade?.(controller, statusCode, headers, socket)
   }
@@ -210,6 +218,13 @@ class CacheHandler {
     }
 
     const cacheControlHeader = resHeaders['cache-control']
+    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
+
+    if (revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives)) {
+      deleteCachedValue(this.#store, this.#cacheKey)
+      return downstreamOnHeaders()
+    }
+
     const heuristicallyCacheable = resHeaders['last-modified'] && arrayIncludes(HEURISTICALLY_CACHEABLE_STATUS_CODES, statusCode)
     if (
       !cacheControlHeader &&
@@ -226,8 +241,7 @@ class CacheHandler {
       return downstreamOnHeaders()
     }
 
-    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
-    if (!canCacheResponse(this.#cacheType, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
+    if (!canCacheResponse(this.#cacheType, this.#cacheKey.method, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
       if (statusCode === 304 && (cacheControlHeader || revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives))) {
         deleteCachedValue(this.#store, this.#cacheKey)
       }
@@ -476,7 +490,10 @@ function deleteCachedValueIfNotModified (statusCode, store, cacheKey) {
  */
 function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheControlDirectives) {
   return cacheControlDirectives['no-store'] === true ||
-    (cacheType === 'shared' && cacheControlDirectives.private === true) ||
+    (cacheType === 'shared' && (
+      cacheControlDirectives.private === true ||
+      Object.hasOwn(resHeaders, 'set-cookie')
+    )) ||
     (resHeaders.vary ? isInvalidOrWildcardVaryHeader(resHeaders.vary) : false)
 }
 
@@ -484,12 +501,16 @@ function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheC
  * @see https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-to-authen
  *
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+ * @param {string} method
  * @param {number} statusCode
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} resHeaders
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives} cacheControlDirectives
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} [reqHeaders]
  */
-function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+function canCacheResponse (cacheType, method, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+  if (!arrayIncludes(util.safeHTTPMethods, method)) {
+    return false
+  }
   // Status code must be final and understood.
   if (statusCode < 200 || arrayIncludes(NOT_UNDERSTOOD_STATUS_CODES, statusCode)) {
     return false
@@ -510,7 +531,10 @@ function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirect
     return false
   }
 
-  if (cacheType === 'shared' && cacheControlDirectives.private === true) {
+  if (cacheType === 'shared' && (
+    cacheControlDirectives.private === true ||
+    Object.hasOwn(resHeaders, 'set-cookie')
+  )) {
     return false
   }
 
diff --git a/deps/undici/src/lib/handler/decorator-handler.js b/deps/undici/src/lib/handler/decorator-handler.js
index 1b53c711324a..bc99893cda0b 100644
--- a/deps/undici/src/lib/handler/decorator-handler.js
+++ b/deps/undici/src/lib/handler/decorator-handler.js
@@ -62,5 +62,11 @@ module.exports = class DecoratorHandler {
   /**
    * @deprecated
    */
-  onBodySent () {}
+  onBodySent (...args) {
+    return this.#handler.onBodySent?.(...args)
+  }
+
+  onRequestSent (...args) {
+    return this.#handler.onRequestSent?.(...args)
+  }
 }
diff --git a/deps/undici/src/lib/handler/deduplication-handler.js b/deps/undici/src/lib/handler/deduplication-handler.js
index 537c4f70e974..4d85e9cde3bf 100644
--- a/deps/undici/src/lib/handler/deduplication-handler.js
+++ b/deps/undici/src/lib/handler/deduplication-handler.js
@@ -365,12 +365,22 @@ class DeduplicationHandler {
       get aborted () { return state.aborted },
       get reason () { return state.reason },
       abort: (reason) => {
+        if (state.aborted) {
+          return
+        }
+
         state.aborted = true
         state.reason = reason ?? null
         waitingHandler.done = true
         waitingHandler.pendingTrailers = null
         waitingHandler.bufferedChunks = []
         waitingHandler.bufferedBytes = 0
+
+        try {
+          handler.onResponseError?.(waitingHandler.controller, state.reason ?? new RequestAbortedError())
+        } catch {
+          // Ignore errors from waiting handlers
+        }
       }
     }
 
@@ -444,12 +454,8 @@ class DeduplicationHandler {
     waitingHandler.bufferedChunks = []
     waitingHandler.bufferedBytes = 0
 
-    try {
-      waitingHandler.controller.abort(err)
-      waitingHandler.handler.onResponseError?.(waitingHandler.controller, err)
-    } catch {
-      // Ignore errors from waiting handlers
-    }
+    // controller.abort(err) notifies the handler via onResponseError
+    waitingHandler.controller.abort(err)
   }
 
   #pruneDoneWaitingHandlers () {
diff --git a/deps/undici/src/lib/handler/redirect-handler.js b/deps/undici/src/lib/handler/redirect-handler.js
index 1b813dac98b9..a5d925086319 100644
--- a/deps/undici/src/lib/handler/redirect-handler.js
+++ b/deps/undici/src/lib/handler/redirect-handler.js
@@ -3,6 +3,7 @@
 const util = require('../core/util')
 const assert = require('node:assert')
 const { InvalidArgumentError } = require('../core/errors')
+const { kRequestOrigin } = require('../core/symbols')
 
 const redirectableStatusCodes = [300, 301, 302, 303, 307, 308]
 
@@ -43,6 +44,14 @@ class RedirectHandler {
     this.handler.onRequestStart?.(controller, { ...context, history: this.history })
   }
 
+  onBodySent (chunk) {
+    this.handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (controller, statusCode, headers, socket) {
     this.handler.onRequestUpgrade?.(controller, statusCode, headers, socket)
   }
@@ -81,8 +90,12 @@ class RedirectHandler {
       ? null
       : headers.location
 
-    if (this.opts.origin) {
-      this.history.push(new URL(this.opts.path, this.opts.origin))
+    const requestOrigin = this.opts[kRequestOrigin] === undefined
+      ? this.opts.origin
+      : this.opts[kRequestOrigin]
+
+    if (requestOrigin) {
+      this.history.push(new URL(this.opts.path, requestOrigin))
     }
 
     if (!this.location) {
@@ -90,7 +103,10 @@ class RedirectHandler {
       return
     }
 
-    const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)))
+    const baseUrl = requestOrigin
+      ? new URL(this.opts.path, requestOrigin)
+      : undefined
+    const { origin, pathname, search } = util.parseURL(new URL(this.location, baseUrl))
     const path = search ? `${pathname}${search}` : pathname
 
     // Check for redirect loops by seeing if we've already visited this URL in our history
@@ -106,9 +122,10 @@ class RedirectHandler {
     // Remove headers referring to the original URL.
     // By default it is Host only. A 303 or a 301/302 POST-to-GET redirect also removes all Content-* headers.
     // https://tools.ietf.org/html/rfc7231#section-6.4
-    this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, this.opts.origin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect)
+    this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, requestOrigin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect)
     this.opts.path = path
     this.opts.origin = origin
+    this.opts[kRequestOrigin] = origin
     this.opts.query = null
   }
 
diff --git a/deps/undici/src/lib/handler/retry-handler.js b/deps/undici/src/lib/handler/retry-handler.js
index c098b510c26c..5703f145d74c 100644
--- a/deps/undici/src/lib/handler/retry-handler.js
+++ b/deps/undici/src/lib/handler/retry-handler.js
@@ -2,7 +2,7 @@
 const assert = require('node:assert')
 
 const { kRetryHandlerDefaultRetry } = require('../core/symbols')
-const { RequestRetryError } = require('../core/errors')
+const { RequestRetryError, RequestAbortedError } = require('../core/errors')
 const {
   isDisturbed,
   parseRangeHeader,
@@ -41,19 +41,42 @@ function validatePartialResponseContentLength (headers, range, statusCode, retry
 // new one: backpressure pauses the new connection's controller, but the
 // consumer's resume() targets the old one, so the resumed body stalls forever.
 // The proxy always forwards to the controller of the currently active connection.
+// An abort is additionally reported to the handler so it can cancel a pending
+// retry backoff instead of letting the request hang until the backoff elapses.
+// The notification is a private callback the handler hands over on construction,
+// so nothing outside the handler can trigger it.
 class RetryController {
-  constructor () {
+  #onAbort
+
+  constructor (onAbort) {
+    this.#onAbort = onAbort
     this.target = null
   }
 
   pause () { this.target?.pause() }
   resume () { this.target?.resume() }
-  abort (reason) { this.target?.abort(reason) }
+
+  abort (reason) {
+    this.target?.abort(reason)
+    this.#onAbort(reason)
+  }
+
   get paused () { return this.target?.paused ?? false }
   get aborted () { return this.target?.aborted ?? false }
   get reason () { return this.target?.reason ?? null }
   get rawHeaders () { return this.target?.rawHeaders ?? null }
+  set rawHeaders (value) {
+    if (this.target) {
+      this.target.rawHeaders = value
+    }
+  }
+
   get rawTrailers () { return this.target?.rawTrailers ?? null }
+  set rawTrailers (value) {
+    if (this.target) {
+      this.target.rawTrailers = value
+    }
+  }
 }
 
 class RetryHandler {
@@ -112,15 +135,32 @@ class RetryHandler {
     this.etag = null
     this.statusCode = null
     this.headers = null
-    this.controllerProxy = new RetryController()
+    this.controllerProxy = new RetryController(reason => this.#onAbort(reason))
+    // A retry decision is in flight (the policy may be holding a backoff
+    // timer). While pending, a consumer abort cancels the wait.
+    this.retryPending = false
+    // Backoff timer returned by the retry policy, so #onAbort can cancel it.
+    // Null for custom policies that do not return their timer.
+    this.retryTimer = null
+    // Set once an abort during the backoff delivered the terminal error
+    // downstream; late policy callbacks and connection errors are then moot.
+    this.aborted = false
   }
 
   onResponseStartWithRetry (controller, statusCode, headers, statusMessage, err) {
     if (this.retryOpts.throwOnError) {
       // Preserve old behavior for status codes that are not eligible for retry
       if (this.retryOpts.statusCodes.includes(statusCode) === false) {
-        this.headersSent = true
-        this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        if (this.headersSent) {
+          // The downstream handler already received the response from an
+          // earlier attempt. Forwarding this response would replace the
+          // downstream body and leave the original body pending forever.
+          this.handler.onResponseError?.(this.controllerProxy, err)
+        } else {
+          this.headersSent = true
+          this.checkpointResponseEnd(headers)
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        }
       } else {
         this.error = err
       }
@@ -130,14 +170,30 @@ class RetryHandler {
 
     if (isDisturbed(this.opts.body)) {
       this.headersSent = true
+      this.checkpointResponseEnd(headers)
       this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
       return
     }
 
     function shouldRetry (passedErr) {
+      if (this.aborted) {
+        // Aborted while the policy was deciding; the decision is moot.
+        return
+      }
+      this.retryPending = false
+      this.retryTimer = null
+
       if (passedErr) {
-        this.headersSent = true
-        this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        if (this.headersSent) {
+          // The downstream handler already received the response from an
+          // earlier attempt. Forwarding this response would replace the
+          // downstream body and leave the original body pending forever.
+          this.handler.onResponseError?.(this.controllerProxy, passedErr)
+        } else {
+          this.headersSent = true
+          this.checkpointResponseEnd(headers)
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        }
         controller.resume()
         return
       }
@@ -154,14 +210,31 @@ class RetryHandler {
     // between, leaving this one paused forever -- the very stall the proxy exists
     // to prevent.
     controller.pause()
-    this.retryOpts.retry(
+    // The default policy returns its backoff timer so an abort can cancel it;
+    // a custom policy may return anything (or nothing), which is ignored.
+    this.retryPending = true
+    this.retryTimer = this.retryOpts.retry(
       err,
       {
         state: { counter: this.retryCount },
         opts: { retryOptions: this.retryOpts, ...this.opts }
       },
       shouldRetry.bind(this)
-    )
+    ) ?? null
+  }
+
+  checkpointResponseEnd (headers) {
+    if (this.end == null && this.opts.method !== 'HEAD') {
+      const contentLength = headers['content-length']
+      this.end = contentLength != null ? Number(contentLength) - 1 : null
+
+      assert(
+        this.end == null || Number.isFinite(this.end),
+        'invalid content-length'
+      )
+
+      this.resume = this.end != null
+    }
   }
 
   onRequestStart (controller, context) {
@@ -176,6 +249,14 @@ class RetryHandler {
     }
   }
 
+  onBodySent (chunk) {
+    this.handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (_controller, statusCode, headers, socket) {
     this.handler.onRequestUpgrade?.(this.controllerProxy, statusCode, headers, socket)
   }
@@ -190,7 +271,8 @@ class RetryHandler {
       timeoutFactor,
       statusCodes,
       errorCodes,
-      methods
+      methods,
+      retryAfter
     } = retryOptions
     const { counter } = state
 
@@ -222,7 +304,7 @@ class RetryHandler {
       return
     }
 
-    let retryAfterHeader = headers?.['retry-after']
+    let retryAfterHeader = retryAfter === false ? undefined : headers?.['retry-after']
     if (retryAfterHeader) {
       retryAfterHeader = Number(retryAfterHeader)
       retryAfterHeader = Number.isNaN(retryAfterHeader)
@@ -237,7 +319,9 @@ class RetryHandler {
           ? Math.min(retryAfterHeader, maxTimeout)
           : Math.min(minTimeout * timeoutFactor ** (counter - 1), maxTimeout)
 
-    setTimeout(() => cb(null), retryTimeout)
+    // Return the backoff timer so the handler can cancel it when the
+    // consumer aborts while the retry decision is pending.
+    return setTimeout(() => cb(null), retryTimeout)
   }
 
   onResponseStart (controller, statusCode, headers, statusMessage) {
@@ -251,18 +335,6 @@ class RetryHandler {
     this.statusCode = statusCode
     this.headers = headers
 
-    if (statusCode >= 300) {
-      const err = new RequestRetryError('Request failed', statusCode, {
-        headers,
-        data: {
-          count: this.retryCount
-        }
-      })
-
-      this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err)
-      return
-    }
-
     // Checkpoint for resume from where we left it
     if (this.headersSent) {
       // Only Partial Content 206 supposed to provide Content-Range,
@@ -299,12 +371,28 @@ class RetryHandler {
 
       const { start, size, end = size ? size - 1 : null } = contentRange
 
-      assert(this.start === start, 'content-range mismatch')
-      assert(this.end == null || this.end === end, 'content-range mismatch')
+      if (this.start !== start || (this.end != null && this.end !== end)) {
+        throw new RequestRetryError('Content-Range mismatch', statusCode, {
+          headers,
+          data: { count: this.retryCount }
+        })
+      }
 
       return
     }
 
+    if (statusCode >= 300) {
+      const err = new RequestRetryError('Request failed', statusCode, {
+        headers,
+        data: {
+          count: this.retryCount
+        }
+      })
+
+      this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err)
+      return
+    }
+
     if (this.end == null) {
       if (statusCode === 206) {
         // First time we receive 206
@@ -435,14 +523,27 @@ class RetryHandler {
   }
 
   onResponseError (controller, err) {
+    if (this.aborted) {
+      // #onAbort already delivered the terminal error downstream; the late
+      // error of the torn-down connection must not be forwarded twice.
+      return
+    }
+
     // controller is THIS failed connection (not the proxy): we inspect whether
     // the consumer aborted it to decide retry-vs-propagate.
-    if (controller?.aborted || isDisturbed(this.opts.body)) {
+    if (controller?.aborted || isDisturbed(this.opts.body) || (this.headersSent && !this.resume)) {
       this.handler.onResponseError?.(this.controllerProxy, err)
       return
     }
 
     function shouldRetry (returnedErr) {
+      if (this.aborted) {
+        // Aborted while the policy was deciding; the decision is moot.
+        return
+      }
+      this.retryPending = false
+      this.retryTimer = null
+
       if (!returnedErr) {
         this.retry()
         return
@@ -462,14 +563,31 @@ class RetryHandler {
       this.retryCount += 1
     }
 
-    this.retryOpts.retry(
+    this.retryPending = true
+    this.retryTimer = this.retryOpts.retry(
       err,
       {
         state: { counter: this.retryCount },
         opts: { retryOptions: this.retryOpts, ...this.opts }
       },
       shouldRetry.bind(this)
-    )
+    ) ?? null
+  }
+
+  #onAbort (reason) {
+    // A consumer abort lands on the controller proxy. If the retry policy is
+    // still deciding (typically holding a backoff timer), cancel the wait and
+    // surface the abort immediately instead of letting the request hang until
+    // the backoff elapses.
+    if (!this.retryPending) {
+      return
+    }
+
+    this.aborted = true
+    this.retryPending = false
+    clearTimeout(this.retryTimer)
+    this.retryTimer = null
+    this.handler.onResponseError?.(this.controllerProxy, reason ?? new RequestAbortedError())
   }
 }
 
diff --git a/deps/undici/src/lib/interceptor/cache.js b/deps/undici/src/lib/interceptor/cache.js
index 2d7d01f130aa..0b8593f7ee6d 100644
--- a/deps/undici/src/lib/interceptor/cache.js
+++ b/deps/undici/src/lib/interceptor/cache.js
@@ -6,7 +6,16 @@ const util = require('../core/util')
 const CacheHandler = require('../handler/cache-handler')
 const MemoryCacheStore = require('../cache/memory-cache-store')
 const CacheRevalidationHandler = require('../handler/cache-revalidation-handler')
-const { assertCacheStore, assertCacheMethods, makeCacheKey, normalizeHeaders, parseCacheControlHeader, isInvalidOrWildcardVaryHeader } = require('../util/cache.js')
+const {
+  assertCacheStore,
+  assertCacheMethods,
+  getInterceptorOrigin,
+  makeCacheKey,
+  normalizeHeaders,
+  parseCacheControlHeader,
+  isInvalidOrWildcardVaryHeader,
+  parseVaryHeader
+} = require('../util/cache.js')
 const { AbortError } = require('../core/errors.js')
 const { parseHttpDate } = require('../util/date.js')
 
@@ -117,7 +126,10 @@ function staleResponseRequiresRevalidation (result, cacheType) {
  * @returns {boolean}
  */
 function revalidationResponseDisallowsCachedReuse (cacheType, headers) {
-  if (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) {
+  if (
+    (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) ||
+    (cacheType === 'shared' && Object.hasOwn(headers, 'set-cookie'))
+  ) {
     return true
   }
 
@@ -135,6 +147,25 @@ function revalidationResponseUpdatesCacheControl (headers) {
   return headers['cache-control'] !== undefined
 }
 
+/**
+ * @param {import('../../types/cache-interceptor.d.ts').default.GetResult} result
+ * @param {Record<string, string | string[] | null> | undefined} varyDirectives
+ * @returns {boolean}
+ */
+function revalidationResponseAddsVary (result, varyDirectives) {
+  if (!varyDirectives) {
+    return false
+  }
+
+  for (const key in varyDirectives) {
+    if (result.vary == null || !Object.hasOwn(result.vary, key)) {
+      return true
+    }
+  }
+
+  return false
+}
+
 function deleteCachedValue (store, cacheKey) {
   try {
     store.delete(cacheKey)?.catch?.(nop)
@@ -389,6 +420,17 @@ function handleResult (
     return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl)
   }
 
+  // Shared stores may outlive the Undici version that wrote them. Do not
+  // re-serve a Set-Cookie header from an existing shared-cache entry.
+  if (globalOpts.type === 'shared' && Object.hasOwn(result.headers, 'set-cookie')) {
+    if (util.isStream(result.body)) {
+      result.body.on('error', nop).destroy()
+    }
+
+    deleteCachedValue(globalOpts.store, cacheKey)
+    return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl)
+  }
+
   const now = Date.now()
   if (now > result.deleteAt) {
     // Response is expired, cache store shouldn't have given this to us
@@ -471,6 +513,13 @@ function handleResult (
 
               if (revalidationResponseUpdatesCacheControl(headers)) {
                 deleteCachedValue(globalOpts.store, cacheKey)
+              } else if (revalidationResponseAddsVary(result, headers.vary ? parseVaryHeader(headers.vary, opts.headers) : undefined)) {
+                if (util.isStream(result.body)) {
+                  result.body.on('error', nop).destroy()
+                }
+
+                deleteCachedValue(globalOpts.store, cacheKey)
+                return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
               }
             }
 
@@ -538,29 +587,28 @@ module.exports = (opts = {}) => {
     }
   }
 
-  return dispatch => {
+  return (dispatch, interceptorOrigin) => {
     return (opts, handler) => {
-      if (arrayIncludes(safeMethodsToNotCache, opts.method)) {
-        // Not a method we want to cache, skip
+      const requestOrigin = getInterceptorOrigin(opts, interceptorOrigin)
+      if (!requestOrigin || arrayIncludes(safeMethodsToNotCache, opts.method)) {
+        // We cannot safely cache without an authoritative origin, or this is
+        // not a method we want to cache.
         return dispatch(opts, handler)
       }
 
       // Check if origin is in whitelist
       if (origins !== undefined) {
-        if (!opts.origin) {
-          return dispatch(opts, handler)
-        }
-        const requestOrigin = opts.origin.toString().toLowerCase()
+        const normalizedRequestOrigin = requestOrigin.toString().toLowerCase()
         let isAllowed = false
 
         for (let i = 0; i < origins.length; i++) {
           const allowed = origins[i]
           if (typeof allowed === 'string') {
-            if (allowed.toLowerCase() === requestOrigin) {
+            if (allowed.toLowerCase() === normalizedRequestOrigin) {
               isAllowed = true
               break
             }
-          } else if (allowed.test(requestOrigin)) {
+          } else if (allowed.test(normalizedRequestOrigin)) {
             isAllowed = true
             break
           }
@@ -589,7 +637,12 @@ module.exports = (opts = {}) => {
       /**
        * @type {import('../../types/cache-interceptor.d.ts').default.CacheKey}
        */
-      const cacheKey = makeCacheKey(opts)
+      const cacheKey = makeCacheKey(opts, requestOrigin)
+
+      if (!arrayIncludes(util.safeHTTPMethods, opts.method)) {
+        return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
+      }
+
       const result = store.get(cacheKey)
 
       if (result && typeof result.then === 'function') {
diff --git a/deps/undici/src/lib/interceptor/decompress.js b/deps/undici/src/lib/interceptor/decompress.js
index c675de4197c3..a0e77a37c8c4 100644
--- a/deps/undici/src/lib/interceptor/decompress.js
+++ b/deps/undici/src/lib/interceptor/decompress.js
@@ -1,7 +1,8 @@
 'use strict'
 
 const { createInflate, createGunzip, createBrotliDecompress, createZstdDecompress } = require('node:zlib')
-const { pipeline } = require('node:stream')
+const { pipeline, Transform: TransformStream } = require('node:stream')
+const { InvalidArgumentError, ResponseExceededMaxSizeError } = require('../core/errors')
 const DecoratorHandler = require('../handler/decorator-handler')
 
 /** @typedef {import('node:stream').Transform} Transform */
@@ -20,6 +21,31 @@ const supportedEncodings = {
 }
 
 const defaultSkipStatusCodes = /** @type {const} */ ([204, 304])
+const defaultMaxSize = 64 * 1024 * 1024
+
+/**
+ * Limits the output of one stage in a decompression chain.
+ * @param {number} maxSize - Maximum output size in bytes
+ * @returns {Transform}
+ */
+function createMaxSizeLimiter (maxSize) {
+  let size = 0
+
+  return new TransformStream({
+    transform (chunk, _encoding, callback) {
+      const decompressedSize = size + chunk.length
+      if (decompressedSize > maxSize) {
+        callback(new ResponseExceededMaxSizeError(
+          `Decompressed response size (${decompressedSize}) exceeded maxSize (${maxSize})`
+        ))
+        return
+      }
+
+      size = decompressedSize
+      callback(null, chunk)
+    }
+  })
+}
 
 let warningEmitted = /** @type {boolean} */ (false)
 
@@ -27,6 +53,7 @@ let warningEmitted = /** @type {boolean} */ (false)
  * @typedef {Object} DecompressHandlerOptions
  * @property {number[]|Readonly<number[]>} [skipStatusCodes=[204, 304]] - List of status codes to skip decompression for
  * @property {boolean} [skipErrorResponses] - Whether to skip decompression for error responses (status codes >= 400)
+ * @property {number} [maxSize=67108864] - Maximum decompressed response size in bytes
  */
 
 class DecompressHandler extends DecoratorHandler {
@@ -38,11 +65,24 @@ class DecompressHandler extends DecoratorHandler {
   #skipStatusCodes
   /** @type {boolean} */
   #skipErrorResponses
+  /** @type {number} */
+  #maxSize
+  /** @type {number} */
+  #decompressedSize = 0
+  /** @type {boolean} */
+  #terminated = false
+  /** @type {boolean} */
+  #inputEnded = false
+
+  constructor (handler, { skipStatusCodes = defaultSkipStatusCodes, skipErrorResponses = true, maxSize = defaultMaxSize } = {}) {
+    if (!Number.isSafeInteger(maxSize) || maxSize < 1) {
+      throw new InvalidArgumentError('maxSize must be a positive integer')
+    }
 
-  constructor (handler, { skipStatusCodes = defaultSkipStatusCodes, skipErrorResponses = true } = {}) {
     super(handler)
     this.#skipStatusCodes = skipStatusCodes
     this.#skipErrorResponses = skipErrorResponses
+    this.#maxSize = maxSize
   }
 
   /**
@@ -62,7 +102,7 @@ class DecompressHandler extends DecoratorHandler {
    * Creates a chain of decompressors for multiple content encodings
    *
    * @param {string} encodings - Comma-separated list of content encodings
-   * @returns {Array<DecompressorStream>} - Array of decompressor streams
+   * @returns {Array<Transform>} - Array of decompressor and limiting streams
    * @throws {Error} - If the number of content-encodings exceeds the maximum allowed
    */
   #createDecompressionChain (encodings) {
@@ -90,7 +130,40 @@ class DecompressHandler extends DecoratorHandler {
       decompressors.push(supportedEncodings[encoding]())
     }
 
-    return decompressors
+    if (decompressors.length < 2) {
+      return decompressors
+    }
+
+    /** @type {Transform[]} */
+    const streams = []
+    for (let i = 0; i < decompressors.length; i++) {
+      streams.push(decompressors[i])
+      if (i < decompressors.length - 1) {
+        streams.push(createMaxSizeLimiter(this.#maxSize))
+      }
+    }
+
+    return streams
+  }
+
+  /**
+   * Stops decompression and reports an error.
+   * @param {Controller} controller - The controller to coordinate with
+   * @param {Error} error - The decompression error
+   * @returns {void}
+   */
+  #fail (controller, error) {
+    if (this.#terminated) {
+      return
+    }
+
+    if (this.#inputEnded) {
+      // The request is already marked complete once the compressed input ends,
+      // so controller.abort() can no longer propagate decoder flush errors.
+      this.onResponseError(controller, error)
+    } else {
+      controller.abort(error)
+    }
   }
 
   /**
@@ -101,8 +174,21 @@ class DecompressHandler extends DecoratorHandler {
    */
   #setupDecompressorEvents (decompressor, controller) {
     decompressor.on('readable', () => {
+      if (this.#terminated) {
+        return
+      }
+
       let chunk
       while ((chunk = decompressor.read()) !== null) {
+        const decompressedSize = this.#decompressedSize + chunk.length
+        if (decompressedSize > this.#maxSize) {
+          this.#fail(controller, new ResponseExceededMaxSizeError(
+            `Decompressed response size (${decompressedSize}) exceeded maxSize (${this.#maxSize})`
+          ))
+          return
+        }
+
+        this.#decompressedSize = decompressedSize
         const result = super.onResponseData(controller, chunk)
         if (result === false) {
           break
@@ -111,7 +197,7 @@ class DecompressHandler extends DecoratorHandler {
     })
 
     decompressor.on('error', (error) => {
-      super.onResponseError(controller, error)
+      this.#fail(controller, error)
     })
   }
 
@@ -125,6 +211,12 @@ class DecompressHandler extends DecoratorHandler {
     this.#setupDecompressorEvents(decompressor, controller)
 
     decompressor.on('end', () => {
+      if (this.#terminated) {
+        return
+      }
+
+      this.#terminated = true
+      this.#cleanupDecompressors()
       super.onResponseEnd(controller, this.#trailers)
     })
   }
@@ -139,10 +231,17 @@ class DecompressHandler extends DecoratorHandler {
     this.#setupDecompressorEvents(lastDecompressor, controller)
 
     pipeline(this.#decompressors, (err) => {
+      if (this.#terminated) {
+        return
+      }
+
       if (err) {
-        super.onResponseError(controller, err)
+        this.#fail(controller, err)
         return
       }
+
+      this.#terminated = true
+      this.#cleanupDecompressors()
       super.onResponseEnd(controller, this.#trailers)
     })
   }
@@ -198,7 +297,7 @@ class DecompressHandler extends DecoratorHandler {
 
           filteredHeaders.push(rawHeaders[i], rawHeaders[i + 1])
         }
-        controller.rawHeaders = filteredHeaders
+        rawHeaders.splice(0, rawHeaders.length, ...filteredHeaders)
       } else if (typeof rawHeaders === 'object') {
         for (const name of Object.keys(rawHeaders)) {
           const lowerName = name.toLowerCase()
@@ -238,9 +337,9 @@ class DecompressHandler extends DecoratorHandler {
    */
   onResponseEnd (controller, trailers) {
     if (this.#decompressors.length > 0) {
+      this.#inputEnded = true
       this.#trailers = trailers
       this.#decompressors[0].end()
-      this.#cleanupDecompressors()
       return
     }
     super.onResponseEnd(controller, trailers)
@@ -252,12 +351,15 @@ class DecompressHandler extends DecoratorHandler {
    * @returns {void}
    */
   onResponseError (controller, err) {
-    if (this.#decompressors.length > 0) {
-      for (const decompressor of this.#decompressors) {
-        decompressor.destroy(err)
-      }
-      this.#cleanupDecompressors()
+    if (this.#terminated) {
+      return
+    }
+
+    this.#terminated = true
+    for (const decompressor of this.#decompressors) {
+      decompressor.destroy()
     }
+    this.#cleanupDecompressors()
     super.onResponseError(controller, err)
   }
 }
diff --git a/deps/undici/src/lib/interceptor/deduplicate.js b/deps/undici/src/lib/interceptor/deduplicate.js
index bacfeb3fb37e..12598130e8f9 100644
--- a/deps/undici/src/lib/interceptor/deduplicate.js
+++ b/deps/undici/src/lib/interceptor/deduplicate.js
@@ -3,7 +3,7 @@
 const diagnosticsChannel = require('node:diagnostics_channel')
 const util = require('../core/util')
 const DeduplicationHandler = require('../handler/deduplication-handler')
-const { normalizeHeaders, makeCacheKey, makeDeduplicationKey } = require('../util/cache.js')
+const { getInterceptorOrigin, normalizeHeaders, makeCacheKey, makeDeduplicationKey } = require('../util/cache.js')
 
 const pendingRequestsChannel = diagnosticsChannel.channel('undici:request:pending-requests')
 
@@ -57,9 +57,10 @@ module.exports = (opts = {}) => {
    */
   const pendingRequests = new Map()
 
-  return dispatch => {
+  return (dispatch, interceptorOrigin) => {
     return (opts, handler) => {
-      if (opts.upgrade || methods.includes(opts.method) === false) {
+      const requestOrigin = getInterceptorOrigin(opts, interceptorOrigin)
+      if (!requestOrigin || opts.upgrade || methods.includes(opts.method) === false) {
         return dispatch(opts, handler)
       }
 
@@ -77,7 +78,7 @@ module.exports = (opts = {}) => {
         }
       }
 
-      const cacheKey = makeCacheKey(opts)
+      const cacheKey = makeCacheKey(opts, requestOrigin)
       const dedupeKey = makeDeduplicationKey(cacheKey, excludeHeaderNamesSet)
 
       // Check if there's already a pending request for this key
diff --git a/deps/undici/src/lib/interceptor/dns.js b/deps/undici/src/lib/interceptor/dns.js
index ebc9a5383036..ecca6efeb660 100644
--- a/deps/undici/src/lib/interceptor/dns.js
+++ b/deps/undici/src/lib/interceptor/dns.js
@@ -3,6 +3,7 @@ const { isIP } = require('node:net')
 const { lookup } = require('node:dns')
 const DecoratorHandler = require('../handler/decorator-handler')
 const { InvalidArgumentError, InformationalError } = require('../core/errors')
+const { kRequestOrigin } = require('../core/symbols')
 const maxInt = Math.pow(2, 31) - 1
 
 function hasSafeIterator (headers) {
@@ -434,6 +435,9 @@ class DNSDispatchHandler extends DecoratorHandler {
             origin: `${this.#origin.protocol}//${
               ip.family === 6 ? `[${ip.address}]` : ip.address
             }${port}`,
+            [kRequestOrigin]: this.#opts[kRequestOrigin] === undefined
+              ? this.#origin
+              : this.#opts[kRequestOrigin],
             headers: withHostHeader(this.#origin.host, this.#opts.headers)
           }
           this.#dispatch(dispatchOpts, this)
@@ -557,6 +561,9 @@ module.exports = interceptorOpts => {
           ...origDispatchOpts,
           servername: origin.hostname, // For SNI on TLS
           origin: newOrigin.origin,
+          [kRequestOrigin]: origDispatchOpts[kRequestOrigin] === undefined
+            ? origin
+            : origDispatchOpts[kRequestOrigin],
           headers: withHostHeader(origin.host, origDispatchOpts.headers)
         }
 
diff --git a/deps/undici/src/lib/interceptor/dump.js b/deps/undici/src/lib/interceptor/dump.js
index 4810a09f3824..09b57f2163fb 100644
--- a/deps/undici/src/lib/interceptor/dump.js
+++ b/deps/undici/src/lib/interceptor/dump.js
@@ -7,7 +7,6 @@ class DumpHandler extends DecoratorHandler {
   #maxSize = 1024 * 1024
   #dumped = false
   #size = 0
-  #controller = null
   aborted = false
   reason = false
 
@@ -29,7 +28,6 @@ class DumpHandler extends DecoratorHandler {
 
   onRequestStart (controller, context) {
     controller.abort = this.#abort.bind(this)
-    this.#controller = controller
 
     return super.onRequestStart(controller, context)
   }
@@ -53,43 +51,32 @@ class DumpHandler extends DecoratorHandler {
   }
 
   onResponseError (controller, err) {
-    if (this.#dumped) {
-      return
-    }
-
-    // On network errors before connect, controller will be null
-    err = this.#controller?.reason ?? err
-
-    super.onResponseError(controller, err)
+    super.onResponseError(controller, this.aborted === true ? this.reason : err)
   }
 
   onResponseData (controller, chunk) {
     this.#size = this.#size + chunk.length
 
-    if (this.#size >= this.#maxSize) {
-      this.#dumped = true
+    if (this.#size > this.#maxSize) {
+      throw new RequestAbortedError(
+        `Response size (${this.#size}) larger than maxSize (${this.#maxSize})`
+      )
+    }
 
-      if (this.aborted === true) {
-        super.onResponseError(controller, this.reason)
-      } else {
-        super.onResponseEnd(controller, {})
-      }
+    if (this.#size === this.#maxSize) {
+      this.#dumped = true
     }
 
     return true
   }
 
   onResponseEnd (controller, trailers) {
-    if (this.#dumped) {
-      return
-    }
-
-    if (this.#controller.aborted === true) {
+    if (this.aborted === true) {
       super.onResponseError(controller, this.reason)
       return
     }
 
-    super.onResponseEnd(controller, trailers)
+    super.onResponseEnd(controller, this.#dumped ? {} : trailers)
   }
 }
 
diff --git a/deps/undici/src/lib/llhttp/wasm_build_env.txt b/deps/undici/src/lib/llhttp/wasm_build_env.txt
index 82569ca62dd1..9085bb4e260d 100644
--- a/deps/undici/src/lib/llhttp/wasm_build_env.txt
+++ b/deps/undici/src/lib/llhttp/wasm_build_env.txt
@@ -1,5 +1,5 @@
 
-> undici@8.10.0 build:wasm
+> undici@8.10.2 build:wasm
 > node build/wasm.js --docker
 
 > docker run --rm --platform=linux/x86_64  --user 1001:1001 --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/lib/llhttp,target=/home/node/build/lib/llhttp            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/build,target=/home/node/build/build            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/deps,target=/home/node/build/deps            -t ghcr.io/nodejs/wasm-builder@sha256:975f391d907e42a75b8c72eb77c782181e941608687d4d8694c3e9df415a0970 node build/wasm.js
diff --git a/deps/undici/src/lib/mock/mock-agent.js b/deps/undici/src/lib/mock/mock-agent.js
index 17a7b717c213..6051d5aab7c0 100644
--- a/deps/undici/src/lib/mock/mock-agent.js
+++ b/deps/undici/src/lib/mock/mock-agent.js
@@ -73,7 +73,7 @@ class MockAgent extends Dispatcher {
     opts.origin = normalizeOrigin(opts.origin)
 
     // Call MockAgent.get to perform additional setup before dispatching as normal
-    this.get(opts.origin)
+    const mockDispatcher = this.get(opts.origin)
 
     this[kMockAgentAddCallHistoryLog](opts)
 
@@ -81,6 +81,18 @@ class MockAgent extends Dispatcher {
 
     const dispatchOpts = { ...opts }
 
+    // Agent keeps HTTP/1.1-only dispatchers under a separate key. Legacy
+    // global dispatcher consumers use that path, so mirror the mock dispatches
+    // before delegating to the internal Agent.
+    if (dispatchOpts.allowH2 === false) {
+      const http1OnlyKey = `${dispatchOpts.origin}#http1-only`
+      if (!this[kClients].has(http1OnlyKey)) {
+        const http1OnlyDispatcher = this[kFactory](dispatchOpts.origin)
+        http1OnlyDispatcher[kDispatches] = mockDispatcher[kDispatches]
+        this[kMockAgentSet](http1OnlyKey, http1OnlyDispatcher)
+      }
+    }
+
     if (acceptNonStandardSearchParameters && dispatchOpts.path) {
       const [path, searchParams] = dispatchOpts.path.split('?')
       const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters)
diff --git a/deps/undici/src/lib/mock/mock-utils.js b/deps/undici/src/lib/mock/mock-utils.js
index e43f7218d0b4..00c1a0bbe13c 100644
--- a/deps/undici/src/lib/mock/mock-utils.js
+++ b/deps/undici/src/lib/mock/mock-utils.js
@@ -333,8 +333,7 @@ function mockDispatch (opts, handler) {
             handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
             return
           }
-          mockDispatch.data = { ...responseDefaults, ...resolvedData }
-          dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
+          dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler, { ...responseDefaults, ...resolvedData })
         },
         (error) => {
           handler.onResponseError(null, error)
@@ -347,7 +346,7 @@ function mockDispatch (opts, handler) {
       throw new InvalidArgumentError('reply options callback must return an object')
     }
 
-    mockDispatch.data = { ...responseDefaults, ...callbackResult }
+    return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler, { ...responseDefaults, ...callbackResult })
   }
 
   return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
@@ -356,9 +355,13 @@ function mockDispatch (opts, handler) {
 /**
  * Replies to a request once the mock dispatch data is fully resolved
  */
-function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
-  // Parse mockDispatch data
-  const { data: response, delay } = mockDispatch
+function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler, resolvedResponse) {
+  // Parse mockDispatch data. When a reply callback has already been resolved
+  // in mockDispatch() (i.e. no body lifecycle hooks are involved), the resolved
+  // response is passed in here, leaving mockDispatch.data untouched so the
+  // callback can be re-invoked for persistent / times() replies.
+  const { data: responseData, delay } = mockDispatch
+  const response = resolvedResponse ?? responseData
 
   // If specified, trigger dispatch error
   if (response.error !== null) {
@@ -454,8 +457,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
               handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
               return
             }
-            mockDispatch.data = { ...responseDefaults, ...resolvedData }
-            handleReply(dispatches, mockDispatch.data)
+            handleReply(dispatches, { ...responseDefaults, ...resolvedData })
           },
           (err) => {
             handler.onResponseError(null, err)
@@ -468,8 +470,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
         throw new InvalidArgumentError('reply options callback must return an object')
       }
 
-      mockDispatch.data = { ...responseDefaults, ...callbackResult }
-      handleReply(dispatches, mockDispatch.data)
+      handleReply(dispatches, { ...responseDefaults, ...callbackResult })
       return
     }
 
diff --git a/deps/undici/src/lib/util/cache.js b/deps/undici/src/lib/util/cache.js
index 1fac28af5d97..ad2524fad3a4 100644
--- a/deps/undici/src/lib/util/cache.js
+++ b/deps/undici/src/lib/util/cache.js
@@ -8,6 +8,7 @@ const {
 } = require('../core/util')
 
 const { serializePathWithQuery } = require('../core/util')
+const { kRequestOrigin } = require('../core/symbols')
 
 const MAX_DELTA_SECONDS = 2147483647
 const RESTRICTIVE_DIRECTIVE_NAMES = ['no-store', 'private', 'no-cache']
@@ -147,8 +148,47 @@ function getMalformedRestrictiveDirectiveName (key) {
 /**
  * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
  */
-function makeCacheKey (opts) {
-  const origin = opts.origin ? opts.origin.toString() : ''
+function getRequestOrigin (opts) {
+  const origin = opts[kRequestOrigin] === undefined
+    ? opts.origin
+    : opts[kRequestOrigin]
+  return typeof origin === 'string' || origin instanceof URL
+    ? origin
+    : null
+}
+
+/**
+ * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
+ * @param {string|null|undefined} interceptorOrigin
+ */
+function getInterceptorOrigin (opts, interceptorOrigin) {
+  const requestOrigin = getRequestOrigin(opts)
+  if (interceptorOrigin === undefined) {
+    return requestOrigin
+  }
+  if (interceptorOrigin === null) {
+    return null
+  }
+  if (requestOrigin) {
+    try {
+      if (new URL(requestOrigin).origin !== interceptorOrigin) {
+        return null
+      }
+    } catch {
+      return interceptorOrigin
+    }
+  }
+  return interceptorOrigin
+}
+
+/**
+ * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
+ * @param {string|URL|null} [origin]
+ */
+function makeCacheKey (opts, origin = getRequestOrigin(opts)) {
+  if (!origin) {
+    throw new Error('opts.origin is undefined')
+  }
 
   let fullPath = opts.path || '/'
 
@@ -157,7 +197,7 @@ function makeCacheKey (opts) {
   }
 
   return {
-    origin,
+    origin: origin.toString(),
     method: opts.method,
     path: fullPath,
     headers: opts.headers
@@ -700,6 +740,8 @@ function makeDeduplicationKey (cacheKey, excludeHeaders) {
 }
 
 module.exports = {
+  getInterceptorOrigin,
+  getRequestOrigin,
   makeCacheKey,
   normalizeHeaders,
   assertCacheKey,
diff --git a/deps/undici/src/lib/web/cookies/parse.js b/deps/undici/src/lib/web/cookies/parse.js
index 51854822a8b6..27606b230d1c 100644
--- a/deps/undici/src/lib/web/cookies/parse.js
+++ b/deps/undici/src/lib/web/cookies/parse.js
@@ -92,221 +92,224 @@ function parseSetCookie (header) {
  * @param {Object.<string, unknown>} [cookieAttributeList={}]
  */
 function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {}) {
-  // 1. If the unparsed-attributes string is empty, skip the rest of
-  //    these steps.
-  if (unparsedAttributes.length === 0) {
-    return cookieAttributeList
-  }
+  while (true) {
+    // 1. If the unparsed-attributes string is empty, skip the rest of
+    //    these steps.
+    if (unparsedAttributes.length === 0) {
+      return cookieAttributeList
+    }
 
-  // 2. Discard the first character of the unparsed-attributes (which
-  //    will be a %x3B (";") character).
-  assert(unparsedAttributes[0] === ';')
-  unparsedAttributes = unparsedAttributes.slice(1)
+    // 2. Discard the first character of the unparsed-attributes (which
+    //    will be a %x3B (";") character).
+    assert(unparsedAttributes[0] === ';')
+    unparsedAttributes = unparsedAttributes.slice(1)
 
-  let cookieAv = ''
+    let cookieAv = ''
 
-  // 3. If the remaining unparsed-attributes contains a %x3B (";")
-  //    character:
-  if (unparsedAttributes.includes(';')) {
+    // 3. If the remaining unparsed-attributes contains a %x3B (";")
+    //    character:
+    if (unparsedAttributes.includes(';')) {
     // 1. Consume the characters of the unparsed-attributes up to, but
     //    not including, the first %x3B (";") character.
-    cookieAv = collectASequenceOfCodePointsFast(
-      ';',
-      unparsedAttributes,
-      { position: 0 }
-    )
-    unparsedAttributes = unparsedAttributes.slice(cookieAv.length)
-  } else {
+      cookieAv = collectASequenceOfCodePointsFast(
+        ';',
+        unparsedAttributes,
+        { position: 0 }
+      )
+      unparsedAttributes = unparsedAttributes.slice(cookieAv.length)
+    } else {
     // Otherwise:
 
-    // 1. Consume the remainder of the unparsed-attributes.
-    cookieAv = unparsedAttributes
-    unparsedAttributes = ''
-  }
+      // 1. Consume the remainder of the unparsed-attributes.
+      cookieAv = unparsedAttributes
+      unparsedAttributes = ''
+    }
 
-  // Let the cookie-av string be the characters consumed in this step.
+    // Let the cookie-av string be the characters consumed in this step.
 
-  let attributeName = ''
-  let attributeValue = ''
+    let attributeName = ''
+    let attributeValue = ''
 
-  // 4. If the cookie-av string contains a %x3D ("=") character:
-  if (cookieAv.includes('=')) {
+    // 4. If the cookie-av string contains a %x3D ("=") character:
+    if (cookieAv.includes('=')) {
     // 1. The (possibly empty) attribute-name string consists of the
     //    characters up to, but not including, the first %x3D ("=")
     //    character, and the (possibly empty) attribute-value string
     //    consists of the characters after the first %x3D ("=")
     //    character.
-    const position = { position: 0 }
-
-    attributeName = collectASequenceOfCodePointsFast(
-      '=',
-      cookieAv,
-      position
-    )
-    attributeValue = cookieAv.slice(position.position + 1)
-  } else {
+      const position = { position: 0 }
+
+      attributeName = collectASequenceOfCodePointsFast(
+        '=',
+        cookieAv,
+        position
+      )
+      attributeValue = cookieAv.slice(position.position + 1)
+    } else {
     // Otherwise:
 
-    // 1. The attribute-name string consists of the entire cookie-av
-    //    string, and the attribute-value string is empty.
-    attributeName = cookieAv
-  }
+      // 1. The attribute-name string consists of the entire cookie-av
+      //    string, and the attribute-value string is empty.
+      attributeName = cookieAv
+    }
 
-  // 5. Remove any leading or trailing WSP characters from the attribute-
-  //    name string and the attribute-value string.
-  attributeName = attributeName.trim()
-  attributeValue = attributeValue.trim()
+    // 5. Remove any leading or trailing WSP characters from the attribute-
+    //    name string and the attribute-value string.
+    attributeName = attributeName.trim()
+    attributeValue = attributeValue.trim()
 
-  // 6. If the attribute-value is longer than 1024 octets, ignore the
-  //    cookie-av string and return to Step 1 of this algorithm.
-  if (attributeValue.length > maxAttributeValueSize) {
-    return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-  }
+    // 6. If the attribute-value is longer than 1024 octets, ignore the
+    //    cookie-av string and return to Step 1 of this algorithm.
+    if (attributeValue.length > maxAttributeValueSize) {
+      continue
+    }
 
-  // 7. Process the attribute-name and attribute-value according to the
-  //    requirements in the following subsections.  (Notice that
-  //    attributes with unrecognized attribute-names are ignored.)
-  const attributeNameLowercase = attributeName.toLowerCase()
+    // 7. Process the attribute-name and attribute-value according to the
+    //    requirements in the following subsections.  (Notice that
+    //    attributes with unrecognized attribute-names are ignored.)
+    const attributeNameLowercase = attributeName.toLowerCase()
 
-  // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.1
-  // If the attribute-name case-insensitively matches the string
-  // "Expires", the user agent MUST process the cookie-av as follows.
-  if (attributeNameLowercase === 'expires') {
+    // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.1
+    // If the attribute-name case-insensitively matches the string
+    // "Expires", the user agent MUST process the cookie-av as follows.
+    if (attributeNameLowercase === 'expires') {
     // 1. Let the expiry-time be the result of parsing the attribute-value
     //    as cookie-date (see Section 5.1.1).
-    const expiryTime = new Date(attributeValue)
-
-    // 2. If the attribute-value failed to parse as a cookie date, ignore
-    //    the cookie-av.
-    if (!Number.isNaN(expiryTime.getTime())) {
-      cookieAttributeList.expires = expiryTime
-    }
-  } else if (attributeNameLowercase === 'max-age') {
+      const expiryTime = new Date(attributeValue)
+
+      // 2. If the attribute-value failed to parse as a cookie date, ignore
+      //    the cookie-av.
+      if (!Number.isNaN(expiryTime.getTime())) {
+        cookieAttributeList.expires = expiryTime
+      }
+    } else if (attributeNameLowercase === 'max-age') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.2
     // If the attribute-name case-insensitively matches the string "Max-
     // Age", the user agent MUST process the cookie-av as follows.
 
-    // 1. If the first character of the attribute-value is not a DIGIT or a
-    //    "-" character, ignore the cookie-av.
-    const charCode = attributeValue.charCodeAt(0)
-
-    if ((charCode < 48 || charCode > 57) && attributeValue[0] !== '-') {
-      return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-    }
-
-    // 2. If the remainder of attribute-value contains a non-DIGIT
-    //    character, ignore the cookie-av.
-    if (!/^\d+$/.test(attributeValue)) {
-      return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-    }
-
-    // 3. Let delta-seconds be the attribute-value converted to an integer.
-    const deltaSeconds = Number(attributeValue)
-
-    // 4. Let cookie-age-limit be the maximum age of the cookie (which
-    //    SHOULD be 400 days or less, see Section 4.1.2.2).
-
-    // 5. Set delta-seconds to the smaller of its present value and cookie-
-    //    age-limit.
-    // deltaSeconds = Math.min(deltaSeconds * 1000, maxExpiresMs)
-
-    // 6. If delta-seconds is less than or equal to zero (0), let expiry-
-    //    time be the earliest representable date and time.  Otherwise, let
-    //    the expiry-time be the current date and time plus delta-seconds
-    //    seconds.
-    // const expiryTime = deltaSeconds <= 0 ? Date.now() : Date.now() + deltaSeconds
-
-    // 7. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Max-Age and an attribute-value of expiry-time.
-    cookieAttributeList.maxAge = deltaSeconds
-  } else if (attributeNameLowercase === 'domain') {
+      // 1. If the first character of the attribute-value is not a DIGIT or a
+      //    "-" character, ignore the cookie-av.
+      const charCode = attributeValue.charCodeAt(0)
+      const startsWithDigit = charCode >= 48 && charCode <= 57
+      const startsWithSignedDigit = attributeValue[0] === '-' && attributeValue.length > 1
+
+      if (!startsWithDigit && !startsWithSignedDigit) {
+        continue
+      }
+
+      // 2. If the remainder of attribute-value contains a non-DIGIT
+      //    character, ignore the cookie-av.
+      if (/[^\d]/.test(attributeValue.slice(1))) {
+        continue
+      }
+
+      // 3. Let delta-seconds be the attribute-value converted to an integer.
+      const deltaSeconds = Number(attributeValue)
+
+      // 4. Let cookie-age-limit be the maximum age of the cookie (which
+      //    SHOULD be 400 days or less, see Section 4.1.2.2).
+
+      // 5. Set delta-seconds to the smaller of its present value and cookie-
+      //    age-limit.
+      // deltaSeconds = Math.min(deltaSeconds * 1000, maxExpiresMs)
+
+      // 6. If delta-seconds is less than or equal to zero (0), let expiry-
+      //    time be the earliest representable date and time.  Otherwise, let
+      //    the expiry-time be the current date and time plus delta-seconds
+      //    seconds.
+      // const expiryTime = deltaSeconds <= 0 ? Date.now() : Date.now() + deltaSeconds
+
+      // 7. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Max-Age and an attribute-value of expiry-time.
+      cookieAttributeList.maxAge = deltaSeconds
+    } else if (attributeNameLowercase === 'domain') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.3
     // If the attribute-name case-insensitively matches the string "Domain",
     // the user agent MUST process the cookie-av as follows.
 
-    // 1. Let cookie-domain be the attribute-value.
-    let cookieDomain = attributeValue
+      // 1. Let cookie-domain be the attribute-value.
+      let cookieDomain = attributeValue
 
-    // 2. If cookie-domain starts with %x2E ("."), let cookie-domain be
-    //    cookie-domain without its leading %x2E (".").
-    if (cookieDomain[0] === '.') {
-      cookieDomain = cookieDomain.slice(1)
-    }
+      // 2. If cookie-domain starts with %x2E ("."), let cookie-domain be
+      //    cookie-domain without its leading %x2E (".").
+      if (cookieDomain[0] === '.') {
+        cookieDomain = cookieDomain.slice(1)
+      }
 
-    // 3. Convert the cookie-domain to lower case.
-    cookieDomain = cookieDomain.toLowerCase()
+      // 3. Convert the cookie-domain to lower case.
+      cookieDomain = cookieDomain.toLowerCase()
 
-    // 4. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Domain and an attribute-value of cookie-domain.
-    cookieAttributeList.domain = cookieDomain
-  } else if (attributeNameLowercase === 'path') {
+      // 4. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Domain and an attribute-value of cookie-domain.
+      cookieAttributeList.domain = cookieDomain
+    } else if (attributeNameLowercase === 'path') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.4
     // If the attribute-name case-insensitively matches the string "Path",
     // the user agent MUST process the cookie-av as follows.
 
-    // 1. If the attribute-value is empty or if the first character of the
-    //    attribute-value is not %x2F ("/"):
-    let cookiePath = ''
-    if (attributeValue.length === 0 || attributeValue[0] !== '/') {
+      // 1. If the attribute-value is empty or if the first character of the
+      //    attribute-value is not %x2F ("/"):
+      let cookiePath = ''
+      if (attributeValue.length === 0 || attributeValue[0] !== '/') {
       // 1. Let cookie-path be the default-path.
-      cookiePath = '/'
-    } else {
+        cookiePath = '/'
+      } else {
       // Otherwise:
 
-      // 1. Let cookie-path be the attribute-value.
-      cookiePath = attributeValue
-    }
+        // 1. Let cookie-path be the attribute-value.
+        cookiePath = attributeValue
+      }
 
-    // 2. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Path and an attribute-value of cookie-path.
-    cookieAttributeList.path = cookiePath
-  } else if (attributeNameLowercase === 'secure') {
+      // 2. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Path and an attribute-value of cookie-path.
+      cookieAttributeList.path = cookiePath
+    } else if (attributeNameLowercase === 'secure') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.5
     // If the attribute-name case-insensitively matches the string "Secure",
     // the user agent MUST append an attribute to the cookie-attribute-list
     // with an attribute-name of Secure and an empty attribute-value.
 
-    cookieAttributeList.secure = true
-  } else if (attributeNameLowercase === 'httponly') {
+      cookieAttributeList.secure = true
+    } else if (attributeNameLowercase === 'httponly') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.6
     // If the attribute-name case-insensitively matches the string
     // "HttpOnly", the user agent MUST append an attribute to the cookie-
     // attribute-list with an attribute-name of HttpOnly and an empty
     // attribute-value.
 
-    cookieAttributeList.httpOnly = true
-  } else if (attributeNameLowercase === 'samesite') {
+      cookieAttributeList.httpOnly = true
+    } else if (attributeNameLowercase === 'samesite') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.7
     // If the attribute-name case-insensitively matches the string
     // "SameSite", the user agent MUST process the cookie-av as follows:
 
-    const attributeValueLowercase = attributeValue.toLowerCase()
+      const attributeValueLowercase = attributeValue.toLowerCase()
 
-    // 1. If cookie-av's attribute-value is a case-insensitive match for
-    //    "None", append an attribute to the cookie-attribute-list with an
-    //    attribute-name of "SameSite" and an attribute-value of "None".
-    if (attributeValueLowercase === 'none') {
-      cookieAttributeList.sameSite = 'None'
-    } else if (attributeValueLowercase === 'strict') {
+      // 1. If cookie-av's attribute-value is a case-insensitive match for
+      //    "None", append an attribute to the cookie-attribute-list with an
+      //    attribute-name of "SameSite" and an attribute-value of "None".
+      if (attributeValueLowercase === 'none') {
+        cookieAttributeList.sameSite = 'None'
+      } else if (attributeValueLowercase === 'strict') {
       // 2. If cookie-av's attribute-value is a case-insensitive match for
       //    "Strict", append an attribute to the cookie-attribute-list with
       //    an attribute-name of "SameSite" and an attribute-value of
       //    "Strict".
-      cookieAttributeList.sameSite = 'Strict'
-    } else if (attributeValueLowercase === 'lax') {
+        cookieAttributeList.sameSite = 'Strict'
+      } else if (attributeValueLowercase === 'lax') {
       // 3. If cookie-av's attribute-value is a case-insensitive match for
       //    "Lax", append an attribute to the cookie-attribute-list with an
       //    attribute-name of "SameSite" and an attribute-value of "Lax".
-      cookieAttributeList.sameSite = 'Lax'
-    }
-  } else {
-    cookieAttributeList.unparsed ??= []
+        cookieAttributeList.sameSite = 'Lax'
+      }
+    } else {
+      cookieAttributeList.unparsed ??= []
 
-    cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`)
-  }
+      cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`)
+    }
 
   // 8. Return to Step 1 of this algorithm.
-  return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
+  }
 }
 
 module.exports = {
diff --git a/deps/undici/src/lib/web/eventsource/eventsource-stream.js b/deps/undici/src/lib/web/eventsource/eventsource-stream.js
index 7b9e2f8cbba8..03000e67dd0f 100644
--- a/deps/undici/src/lib/web/eventsource/eventsource-stream.js
+++ b/deps/undici/src/lib/web/eventsource/eventsource-stream.js
@@ -1,4 +1,5 @@
 'use strict'
+const buffer = require('node:buffer')
 const { Transform } = require('node:stream')
 const { isASCIINumber, isValidLastEventId } = require('./util')
 
@@ -23,6 +24,8 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
@@ -66,6 +69,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -114,6 +123,8 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  eventDataSize = 0
+  maxEventSize
 
   event = {
     data: undefined,
@@ -125,6 +136,7 @@ class EventSourceStream extends Transform {
   /**
    * @param {object} options
    * @param {boolean} [options.readableObjectMode]
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} [options.eventSourceSettings]
    * @param {(chunk: any, encoding?: BufferEncoding | undefined) => boolean} [options.push]
    */
@@ -136,6 +148,7 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
     if (options.push) {
       this.push = options.push
     }
@@ -231,7 +244,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
-        this.parseLine(this.readLine(), this.event)
+        try {
+          this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -282,6 +300,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      const valueBytes = line.length - valueStart
+      const eventDataSize = this.eventDataSize + (event.data === undefined ? 0 : 1) + valueBytes
+
+      if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+        throw createMaxEventSizeExceededError()
+      }
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -289,6 +314,7 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.eventDataSize = eventDataSize
       return
     }
 
@@ -345,6 +371,7 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventDataSize = 0
   }
 
   hasPendingEvent () {
diff --git a/deps/undici/src/lib/web/eventsource/eventsource.js b/deps/undici/src/lib/web/eventsource/eventsource.js
index 17a1de7b7ba6..657c0643ca88 100644
--- a/deps/undici/src/lib/web/eventsource/eventsource.js
+++ b/deps/undici/src/lib/web/eventsource/eventsource.js
@@ -7,9 +7,13 @@ const { EventSourceStream } = require('./eventsource-stream')
 const { parseMIMEType } = require('../fetch/data-url')
 const { createFastMessageEvent } = require('../websocket/events')
 const { isNetworkError } = require('../fetch/response')
-const { kEnumerableProperty } = require('../../core/util')
+const { isValidHeaderValue, kEnumerableProperty } = require('../../core/util')
 const { environmentSettingsObject } = require('../fetch/util')
 const { createPotentialCORSRequest } = require('./util')
+const { getGlobalDispatcher } = require('../../global')
+const { isomorphicDecode } = require('../infra')
+
+const textEncoder = new TextEncoder()
 
 let experimentalWarned = false
 
@@ -281,6 +285,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -340,8 +345,12 @@ class EventSource extends EventTarget {
       //         string, encoded as UTF-8.
       //      2. Set (`Last-Event-ID`, lastEventIDValue) in request's header
       //         list.
+      this.#request.headersList.delete('last-event-id', true)
       if (this.#state.lastEventId.length) {
-        this.#request.headersList.set('last-event-id', this.#state.lastEventId, true)
+        const lastEventId = isomorphicDecode(textEncoder.encode(this.#state.lastEventId))
+        if (isValidHeaderValue(lastEventId)) {
+          this.#request.headersList.set('last-event-id', lastEventId, true)
+        }
       }
 
       //   4. Fetch request and process the response obtained in this fashion, if any, as described earlier in this section.
@@ -465,7 +474,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   },
   {
     key: 'node', // undici only
diff --git a/deps/undici/src/lib/web/fetch/index.js b/deps/undici/src/lib/web/fetch/index.js
index 935bc9d4c90e..4ac812ad6220 100644
--- a/deps/undici/src/lib/web/fetch/index.js
+++ b/deps/undici/src/lib/web/fetch/index.js
@@ -59,6 +59,7 @@ const {
 const EE = require('node:events')
 const { Readable, pipeline, finished, isErrored, isReadable } = require('node:stream')
 const { addAbortListener, bufferToLowerCasedHeaderName } = require('../../core/util')
+const { SocketError } = require('../../core/errors')
 const { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require('./data-url')
 const { getGlobalDispatcher } = require('../../global')
 const { webidl } = require('../webidl')
@@ -2396,6 +2397,11 @@ async function httpNetworkFetch (
             // We need to support 200 for websocket over h2 as per RFC-8441
             // Absence of session means H1
             if ((socket.session != null && status !== 200) || (socket.session == null && status !== 101)) {
+              if (socket.session != null) {
+                // The server refused the extended CONNECT, and nothing further
+                // will settle this request. Fail the opening handshake here.
+                controller.abort(new SocketError('bad upgrade', null))
+              }
               return false
             }
 
diff --git a/deps/undici/src/lib/web/fetch/request.js b/deps/undici/src/lib/web/fetch/request.js
index dbe809c289c7..56945ec02ee5 100644
--- a/deps/undici/src/lib/web/fetch/request.js
+++ b/deps/undici/src/lib/web/fetch/request.js
@@ -923,7 +923,7 @@ function makeRequest (init) {
     serviceWorkers: init.serviceWorkers ?? 'all',
     initiator: init.initiator ?? '',
     destination: init.destination ?? '',
-    priority: init.priority ?? null,
+    priority: init.priority ?? 'auto',
     origin: init.origin ?? 'client',
     policyContainer: init.policyContainer ?? 'client',
     referrer: init.referrer ?? 'client',
@@ -1129,8 +1129,7 @@ webidl.converters.RequestInit = webidl.dictionaryConverter([
   {
     key: 'priority',
     converter: webidl.converters.DOMString,
-    allowedValues: ['high', 'low', 'auto'],
-    defaultValue: () => 'auto'
+    allowedValues: ['high', 'low', 'auto']
   }
 ])
 
diff --git a/deps/undici/src/lib/web/fetch/util.js b/deps/undici/src/lib/web/fetch/util.js
index eb0ece355b7e..20cbb5c58f6c 100644
--- a/deps/undici/src/lib/web/fetch/util.js
+++ b/deps/undici/src/lib/web/fetch/util.js
@@ -227,14 +227,19 @@ function TAOCheck () {
   return 'success'
 }
 
+// https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-append-the-fetch-metadata-headers-for-a-request
 function appendFetchMetadata (httpRequest) {
+  //  1. If r’s url is not a potentially trustworthy URL, return.
+  if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+    return
+  }
+
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-dest-header
   //  TODO
 
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header
 
   //  1. Assert: r’s url is a potentially trustworthy URL.
-  //  TODO
 
   //  2. Let header be a Structured Header whose value is a token.
   let header = null
diff --git a/deps/undici/src/lib/web/webidl/index.js b/deps/undici/src/lib/web/webidl/index.js
index 05a6a4bce580..ce81c1e323af 100644
--- a/deps/undici/src/lib/web/webidl/index.js
+++ b/deps/undici/src/lib/web/webidl/index.js
@@ -26,9 +26,9 @@ const webidl = {
 /**
  * @description Instantiate an error.
  *
- * @param {Object} opts
- * @param {string} opts.header
- * @param {string} opts.message
+ * @param {Object} message
+ * @param {string} message.header
+ * @param {string} message.message
  * @returns {TypeError}
  */
 webidl.errors.exception = function (message) {
diff --git a/deps/undici/src/lib/web/websocket/connection.js b/deps/undici/src/lib/web/websocket/connection.js
index 4ecc8a195fcd..cd95d2ca76ec 100644
--- a/deps/undici/src/lib/web/websocket/connection.js
+++ b/deps/undici/src/lib/web/websocket/connection.js
@@ -200,7 +200,7 @@ function establishWebSocketConnection (url, protocols, client, handler, options)
         // is specified, the server needs to include the same field and one of
         // the selected subprotocol values in its response for the connection to
         // be established.
-        if (!requestProtocols.includes(secProtocol)) {
+        if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
           failWebsocketConnection(handler, 1002, 'Protocol was not set in the opening handshake.')
           return
         }
diff --git a/deps/undici/src/lib/web/websocket/permessage-deflate.js b/deps/undici/src/lib/web/websocket/permessage-deflate.js
index 6a6e43899c5a..0b3d493db820 100644
--- a/deps/undici/src/lib/web/websocket/permessage-deflate.js
+++ b/deps/undici/src/lib/web/websocket/permessage-deflate.js
@@ -63,7 +63,12 @@ class PerMessageDeflate {
 
         if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
           callback(new MessageSizeExceededError())
+          // The inflater may still hold buffered input that can emit a late
+          // zlib error. Remove the data listener, then deterministically stop
+          // the stream so a subsequent 'error' cannot fire without a listener
+          // (which would terminate the process as an unhandled error event).
           this.#inflate.removeAllListeners()
+          this.#inflate.destroy()
           this.#inflate = null
           return
         }
diff --git a/deps/undici/src/lib/web/websocket/stream/websocketstream.js b/deps/undici/src/lib/web/websocket/stream/websocketstream.js
index 383fd0bf7aab..1c13a30677dc 100644
--- a/deps/undici/src/lib/web/websocket/stream/websocketstream.js
+++ b/deps/undici/src/lib/web/websocket/stream/websocketstream.js
@@ -34,9 +34,9 @@ class WebSocketStream {
   /** @type {ReadableStreamDefaultController} */
   #readableStreamController
 
-  // Each WebSocketStream object has an associated writable stream , which is a WritableStream .
-  /** @type {WritableStream} */
-  #writableStream
+  // Retain the controller so the writable stream can be errored while locked.
+  /** @type {WritableStreamDefaultController} */
+  #writableStreamController
 
   // Each WebSocketStream object has an associated boolean handshake aborted , which is initially false.
   #handshakeAborted = false
@@ -300,6 +300,9 @@ class WebSocketStream {
     // 12. Let writable be a new WritableStream .
     // 13. Set up writable with writeAlgorithm , closeAlgorithm , and abortAlgorithm .
     const writable = new WritableStream({
+      start: (controller) => {
+        this.#writableStreamController = controller
+      },
       write: (chunk) => this.#write(chunk),
       close: () => closeWebSocketConnection(this.#handler, null, null),
       abort: (reason) => this.#closeUsingReason(reason)
@@ -308,9 +311,6 @@ class WebSocketStream {
     // Set stream ’s readable stream to readable .
     this.#readableStream = readable
 
-    // Set stream ’s writable stream to writable .
-    this.#writableStream = writable
-
     // Resolve stream ’s opened promise with WebSocketOpenInfo «[ " extensions " → extensions , " protocol " → protocol , " readable " → readable , " writable " → writable ]».
     this.#openedPromise.resolve({
       extensions,
@@ -396,9 +396,7 @@ class WebSocketStream {
       readableStreamClose(this.#readableStreamController)
 
       // 6.2. Error stream ’s writable stream with an " InvalidStateError " DOMException indicating that a closed WebSocketStream cannot be written to.
-      if (!this.#writableStream.locked) {
-        this.#writableStream.abort(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
-      }
+      this.#writableStreamController.error(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
 
       // 6.3. Resolve stream ’s closed promise with WebSocketCloseInfo «[ " closeCode " → code , " reason " → reason ]».
       this.#closedPromise.resolve({
@@ -415,7 +413,7 @@ class WebSocketStream {
       this.#readableStreamController?.error(error)
 
       // 7.3. Error stream ’s writable stream with error .
-      this.#writableStream?.abort(error)
+      this.#writableStreamController?.error(error)
 
       // 7.4. Reject stream ’s closed promise with error .
       this.#closedPromise.reject(error)
diff --git a/deps/undici/src/package-lock.json b/deps/undici/src/package-lock.json
index 28d9db8de52e..c0f6d19a83a8 100644
--- a/deps/undici/src/package-lock.json
+++ b/deps/undici/src/package-lock.json
@@ -1,15 +1,15 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "undici",
-      "version": "8.10.0",
+      "version": "8.10.2",
       "license": "MIT",
       "devDependencies": {
-        "@fastify/busboy": "3.2.0",
+        "@fastify/busboy": "3.2.2",
         "@matteo.collina/tspl": "^0.2.0",
         "@metcoder95/https-pem": "^1.0.0",
         "@sinonjs/fake-timers": "^12.0.0",
@@ -76,13 +76,13 @@
       "license": "MIT"
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -91,9 +91,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -101,21 +101,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -132,14 +132,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -149,14 +149,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -166,9 +166,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -176,29 +176,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -208,9 +208,9 @@
       }
     },
     "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -218,9 +218,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -238,9 +238,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -248,27 +248,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -333,13 +333,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-import-attributes": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.28.6.tgz",
-      "integrity": "sha512-jiLC0ma9XkQT3TKJ9uYvlakm66Pamywo+qwL+oL8HJOvc6TWdZXVfhqJr8CCzbSGUAbDOzlGHJC1U+vRfLQDvw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz",
+      "integrity": "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -375,13 +375,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-jsx": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.28.6.tgz",
-      "integrity": "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz",
+      "integrity": "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -501,13 +501,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-typescript": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.28.6.tgz",
-      "integrity": "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz",
+      "integrity": "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -517,33 +517,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -551,14 +551,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -623,9 +623,9 @@
       "license": "MIT"
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
       "cpu": [
         "ppc64"
       ],
@@ -640,9 +640,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
       "cpu": [
         "arm"
       ],
@@ -657,9 +657,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
       "cpu": [
         "arm64"
       ],
@@ -674,9 +674,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
       "cpu": [
         "x64"
       ],
@@ -691,9 +691,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
       "cpu": [
         "arm64"
       ],
@@ -708,9 +708,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
       "cpu": [
         "x64"
       ],
@@ -725,9 +725,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
       "cpu": [
         "arm64"
       ],
@@ -742,9 +742,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
       "cpu": [
         "x64"
       ],
@@ -759,9 +759,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
       "cpu": [
         "arm"
       ],
@@ -776,9 +776,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
       "cpu": [
         "arm64"
       ],
@@ -793,9 +793,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
       "cpu": [
         "ia32"
       ],
@@ -810,9 +810,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
       "cpu": [
         "loong64"
       ],
@@ -827,9 +827,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
       "cpu": [
         "mips64el"
       ],
@@ -844,9 +844,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
       "cpu": [
         "ppc64"
       ],
@@ -861,9 +861,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
       "cpu": [
         "riscv64"
       ],
@@ -878,9 +878,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
       "cpu": [
         "s390x"
       ],
@@ -895,9 +895,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
       "cpu": [
         "x64"
       ],
@@ -912,9 +912,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
       "cpu": [
         "arm64"
       ],
@@ -929,9 +929,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
       "cpu": [
         "x64"
       ],
@@ -946,9 +946,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
       "cpu": [
         "arm64"
       ],
@@ -963,9 +963,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
       "cpu": [
         "x64"
       ],
@@ -980,9 +980,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
       "cpu": [
         "arm64"
       ],
@@ -997,9 +997,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
       "cpu": [
         "x64"
       ],
@@ -1014,9 +1014,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
       "cpu": [
         "arm64"
       ],
@@ -1031,9 +1031,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
       "cpu": [
         "ia32"
       ],
@@ -1048,9 +1048,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
       "cpu": [
         "x64"
       ],
@@ -1209,36 +1209,50 @@
       }
     },
     "node_modules/@fastify/busboy": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.0.tgz",
-      "integrity": "sha512-m9FVDXU3GT2ITSe0UaMA5rU3QkfC/UXtCU8y0gSN/GugTqtVldOBWIB5V6V3sbmenVZUIpU6f+mPEO2+m5iTaA==",
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.2.tgz",
+      "integrity": "sha512-yXSS27qPExaXeuLvMRMXOLtpipzfQYNjG3FkunDWKGfMYjKuhFXko9CVzqxm8jcF+lmtS9Fd89QNdh9XDjnbNg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/gitignore-to-minimatch": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/gitignore-to-minimatch/-/gitignore-to-minimatch-1.0.2.tgz",
@@ -1338,9 +1352,9 @@
       }
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1424,17 +1438,17 @@
       }
     },
     "node_modules/@jest/console": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.4.1.tgz",
-      "integrity": "sha512-v3bhyxUh9Hgmo5p6hAOXe14/R3ZxZDOsvHleh4B07z3m/x4/ngPUXEm9XwK4sF4u+f+P2ORb0Ge+MgpaqRMVDA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.5.0.tgz",
+      "integrity": "sha512-BI1DpOedrJqbrYVi9yNhDWGjqphR/+gsM4STmg2+VaeXm7851hvpBDyKOZGMXATTrGEnFuEseQvLCtrrRmG0GQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1442,18 +1456,18 @@
       }
     },
     "node_modules/@jest/core": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.4.2.tgz",
-      "integrity": "sha512-TZJA6cPJUFxoWhxaLo8t0VX/MZX2wPWr0uIDvLSHIvN4gu9h02vSzqI2kBADG1ExqQlC+cY09xKMSreivvrChQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.5.0.tgz",
+      "integrity": "sha512-DLjRME+NY//j+UDTSfWnjoP0srrdR3DrJRy7yFZktGIwzpN2iVy2vMo0jziZ5c2Ij7bOwlJRXKVWtxZusazOJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/pattern": "30.4.0",
-        "@jest/reporters": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/pattern": "30.5.0",
+        "@jest/reporters": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "ansi-escapes": "^4.3.2",
         "chalk": "^4.1.2",
@@ -1461,20 +1475,20 @@
         "exit-x": "^0.2.2",
         "fast-json-stable-stringify": "^2.1.0",
         "graceful-fs": "^4.2.11",
-        "jest-changed-files": "30.4.1",
-        "jest-config": "30.4.2",
-        "jest-haste-map": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-resolve-dependencies": "30.4.2",
-        "jest-runner": "30.4.2",
-        "jest-runtime": "30.4.2",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
-        "jest-watcher": "30.4.1",
-        "pretty-format": "30.4.1",
+        "jest-changed-files": "30.5.0",
+        "jest-config": "30.5.0",
+        "jest-haste-map": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-resolve-dependencies": "30.5.0",
+        "jest-runner": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
+        "jest-watcher": "30.5.0",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1490,9 +1504,9 @@
       }
     },
     "node_modules/@jest/diff-sequences": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.4.0.tgz",
-      "integrity": "sha512-zOpzlfUs45l6u7jm39qr87JCHUDsaeCtvL+kQe/Vn9jSnRB4/5IPXISm0h9I1vZW/o00Kn4UTJ2MOlhnUGwv3g==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.5.0.tgz",
+      "integrity": "sha512-OsqBjHXCn8cadasoAZBP6nWYvMsRhpMzGXTpxJ5aO04NlbdhIz+FVe3q49l0AwVhsz/cEmIpBes6gAFl1/dWQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1500,61 +1514,61 @@
       }
     },
     "node_modules/@jest/environment": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.4.1.tgz",
-      "integrity": "sha512-AK9yNRqgKxiabqMoe4oW+3/TSSeV8vkdC7BGaxZdU0AFXfOpofTLqdru2GXKZghP3sdgwE9XXpnVwfZ8JnFV4w==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.5.0.tgz",
+      "integrity": "sha512-HUaqexIauIh69IQ4NTuPDEUCB8g8T4TOPSIzQOS18mwI/KEHKQk1j013K2o6ra031szZE2t5jGmVx3xbzdjgKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/fake-timers": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-mock": "30.4.1"
+        "jest-mock": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.4.1.tgz",
-      "integrity": "sha512-ginrj6TMgh2GshLUGCjO94Ptx9HhdZA/I6A9iUfyeLKFtdAjnKzHDgzgP9HYQgbxM1lbXScQ2eUBz2lGeVDPWA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.5.0.tgz",
+      "integrity": "sha512-jEmgmgJEobJ3zEhDOGp1VAJ6JkoVelpS8uZ1ae1Ul/5lP78UKJKmmU0lciJwd6JdnqOXHaaS/QCKwbf1dHI9MA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "expect": "30.4.1",
-        "jest-snapshot": "30.4.1"
+        "expect": "30.5.0",
+        "jest-snapshot": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.4.1.tgz",
-      "integrity": "sha512-ZBn5CglH8fBsQsvs4VWNzD4aWfUYks+IdOOQU3MEK71ol/BcVm+P+rtb1KpiFBpSWSCE27uOahyyf1vfqOVbcQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.5.0.tgz",
+      "integrity": "sha512-5j0ztPxSy3McUJihjkDdCyCfjvT2hxykFTWsgEBZKB8qsw9ALdCiGTpTRH5gnf/d+qI4SflYUJ0dWNbzjQCWbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0"
+        "@jest/get-type": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/fake-timers": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.4.1.tgz",
-      "integrity": "sha512-iW5umdmfPeWzehrVhugFQZqCchSCud5S1l2YT0O9ZhjRR0ExclANDZkiSBwzqtnlOn0J1JXvO+HZ6rkuyOVOgQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.5.0.tgz",
+      "integrity": "sha512-sg8xIbYwe5GdB/vT3/0qrDIpO7Ov9mazHi++M95uynmDKEZ70G1r169AWct73H07VrTZhrz1SJEfLtjYv8tE3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@sinonjs/fake-timers": "^15.4.0",
         "@types/node": "*",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1"
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -1571,9 +1585,9 @@
       }
     },
     "node_modules/@jest/get-type": {
-      "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
-      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.5.0.tgz",
+      "integrity": "sha512-9/2VUPitAjmBzbvDvqrxmvB7BzWsBW0WmkkojX1ODuxX1NLGxx9gfaZpHB0z8DtJ9uhGNmZG/VXBhf8uO0OV8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1581,62 +1595,78 @@
       }
     },
     "node_modules/@jest/globals": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.4.1.tgz",
-      "integrity": "sha512-ZbuY4cmXC8DkxYjfvT2DbcHWL2T6vmsMhXCDcmTB2T0y0gaezBI77ufq5ZAIdcRkYZ7NEQEDg1xFeKbxUJ5v5Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.5.0.tgz",
+      "integrity": "sha512-h7eJx534czwL8lQMYB0hwLT4/HquO8EX/RtYL7RNUHyUyWWVciYjoudN4Ns5JmNvn2/jh0Vm9UstZjEzJJ5EsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/expect": "30.4.1",
-        "@jest/types": "30.4.1",
-        "jest-mock": "30.4.1"
+        "@jest/environment": "30.5.0",
+        "@jest/expect": "30.5.0",
+        "@jest/types": "30.5.0",
+        "jest-mock": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/pattern": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.4.0.tgz",
-      "integrity": "sha512-RAWn3+f9u8BsHijKJ71uHcFp6vmyEt6VvoWXkl6hKF3qVIuWNmudVjg12DlBPGup/frIl5UcUlH5HfEuvHpEXg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.5.0.tgz",
+      "integrity": "sha512-HdNQYSdRTEBNrginaqzQtTjG0HRMfrra/z6Ok7uL3S87vSlarIVohEsJsSj5edu3MiHoHjAkvPROz5ZjoKai+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
-        "jest-regex-util": "30.4.0"
+        "jest-regex-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/@jest/react-is-18": {
+      "name": "react-is",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jest/react-is-19": {
+      "name": "react-is",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.8.tgz",
+      "integrity": "sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@jest/reporters": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.4.1.tgz",
-      "integrity": "sha512-/SnkPCzEQpUaBH81kjdEdDdo2WZl5hxw+BmLDGWjRkm8o7XlhjwsU36cqwe5PGBE5WYpBvDzRSdXx9rbGuJtNA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.5.0.tgz",
+      "integrity": "sha512-FEAuusWm+PUOn9ydjaHhpOpyPmS6IbGE04HaKTuUI4zd8eqYZiXiNLoCsdCog/l2XnNj53E9pFy64UltcvfJKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^0.2.3",
-        "@jest/console": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@jest/console": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "collect-v8-coverage": "^1.0.2",
         "exit-x": "^0.2.2",
-        "glob": "^10.5.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
         "istanbul-lib-coverage": "^3.0.0",
         "istanbul-lib-instrument": "^6.0.0",
         "istanbul-lib-report": "^3.0.0",
         "istanbul-lib-source-maps": "^5.0.0",
         "istanbul-reports": "^3.1.3",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-worker": "30.4.1",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-worker": "30.5.0",
         "slash": "^3.0.0",
         "string-length": "^4.0.2",
         "v8-to-istanbul": "^9.0.1"
@@ -1660,10 +1690,94 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@jest/reporters/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@jest/schemas": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.4.1.tgz",
-      "integrity": "sha512-i6b4qw5qnP8c5FEeBJg/uZQ4ddrkN6Ca8qISJh0pr7a5hfn3h3v5x60BEbOC7OYAGZNMs1LfFLwnW2CuK8F57Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.5.0.tgz",
+      "integrity": "sha512-/hunigyNpc4RCjC0VaW3f5RCUZVM2+WQ65qP7z083Gmvac7or2LI50XVNOtE4YPgBpV0yxYiAgorAPGniCoJmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1674,13 +1788,13 @@
       }
     },
     "node_modules/@jest/snapshot-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.4.1.tgz",
-      "integrity": "sha512-ObY4ljvQ95mt6iwKtVLetR/4yXiAgl3H4nJxhztr0MTjrN97TwDYrnCp/kF60Ec9HdhkWTHSu+Hg05aXfngpOA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.5.0.tgz",
+      "integrity": "sha512-iWQtIsi2dRsO2oWzVceOeynuRJiYTW8gsDVp5wFQ02ipHluQsNgBpasWSHiawVxukIlsGLdCtCSbIEK7fPtpvQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
         "natural-compare": "^1.4.0"
@@ -1690,14 +1804,15 @@
       }
     },
     "node_modules/@jest/source-map": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.0.1.tgz",
-      "integrity": "sha512-MIRWMUUR3sdbP36oyNyhbThLHyJ2eEDClPCiHVbrYAe5g3CHRArIVpBw7cdSB5fr+ofSfIb2Tnsw8iEHL0PYQg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.5.0.tgz",
+      "integrity": "sha512-xWpTJP9D0bDFGbPGT8XuWSwwha/iHADyyKzUnMx4UbdgnHugxrDaQFO4RZ8x4ZsFzRP6pNii8uvlgKCDxCIuDg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "callsites": "^3.1.0",
+        "convert-source-map": "^2.0.0",
         "graceful-fs": "^4.2.11"
       },
       "engines": {
@@ -1705,14 +1820,14 @@
       }
     },
     "node_modules/@jest/test-result": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.4.1.tgz",
-      "integrity": "sha512-/ZG7pgEiOmmWkN9TplKbOu4id2N5lh7FHwRwlkgBVAzGdRH+OkkQ8wX/kIxg4zmd3ZQvAL1RwL2yWsvNYYECTw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.5.0.tgz",
+      "integrity": "sha512-9IlPqUzUMkVDmoDqSSrVVLroVotgN3hTUPWPwq24XWXhh1Zpg915RXZ5pgRJ/7j4YE/kng5nqjSn4p3S68SZJA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "collect-v8-coverage": "^1.0.2"
       },
@@ -1721,15 +1836,15 @@
       }
     },
     "node_modules/@jest/test-sequencer": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.4.1.tgz",
-      "integrity": "sha512-PeYE+4td5rKjoRPxztObrXU+H8hsjZfxKMXOcmrr34JerSyB/ROOxbbicz8B7A5j9R9VayDnVPvBmedqCsFCdw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.5.0.tgz",
+      "integrity": "sha512-TXlvSDIVv482b83hD8A8WtxDJEmGF47f60W6jRXOQL0Isfs3hKtk4rZIm9R/jLzAibg8+c56y+Q00BQs8R7Xcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/test-result": "30.4.1",
+        "@jest/test-result": "30.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
+        "jest-haste-map": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1737,23 +1852,23 @@
       }
     },
     "node_modules/@jest/transform": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.4.1.tgz",
-      "integrity": "sha512-Wz0LyktlTvRefoymh+n64hQ84KNXsRGcwdoZ8CSa0Ea+fgYcHZlnk+hDP7v2MS7il2bQ5uTEIxf4/NNfhMN4KQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.5.0.tgz",
+      "integrity": "sha512-n1cYhoByyULEIXi64wbT4Lq91qeT1E6bwpM//sprFXhw955qaiHTdAmy1c1rNFGB6fCf1J+nxDUSf3RGwgZP5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.27.4",
-        "@jest/types": "30.4.1",
-        "@jridgewell/trace-mapping": "^0.3.25",
-        "babel-plugin-istanbul": "^7.0.1",
+        "@jest/types": "30.5.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "babel-plugin-istanbul": "^8.0.0",
         "chalk": "^4.1.2",
         "convert-source-map": "^2.0.0",
         "fast-json-stable-stringify": "^2.1.0",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-util": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-util": "30.5.0",
         "pirates": "^4.0.7",
         "slash": "^3.0.0",
         "write-file-atomic": "^5.0.1"
@@ -1763,14 +1878,14 @@
       }
     },
     "node_modules/@jest/types": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
-      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.5.0.tgz",
+      "integrity": "sha512-s1N+79S4Yp9ZgklCauZXi+YPJdCdtStNYQT32stuD6EeQaIBGHoUfyj2P0YWy8RmuQfaJboO+ulxEvEheR/POQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/pattern": "30.4.0",
-        "@jest/schemas": "30.4.1",
+        "@jest/pattern": "30.5.0",
+        "@jest/schemas": "30.5.0",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "@types/istanbul-reports": "^3.0.4",
         "@types/node": "*",
@@ -1860,16 +1975,25 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
-      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.3.tgz",
+      "integrity": "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.4.3",
-        "@emnapi/runtime": "^1.4.3",
-        "@tybys/wasm-util": "^0.10.0"
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4"
       }
     },
     "node_modules/@nodelib/fs.scandir": {
@@ -1910,6 +2034,311 @@
         "node": ">= 8"
       }
     },
+    "node_modules/@parcel/watcher": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.6.0.tgz",
+      "integrity": "sha512-7FNeNl8NCE7aINx7WXiKQrPYZWC/hvrTsmk6zmxbI7LTXE7hVek/n8AfVgpe2y82zl3w0HvCHN0bVKMBoJcC0w==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.3",
+        "is-glob": "^4.0.3",
+        "node-addon-api": "^7.0.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher-android-arm64": "2.6.0",
+        "@parcel/watcher-darwin-arm64": "2.6.0",
+        "@parcel/watcher-darwin-x64": "2.6.0",
+        "@parcel/watcher-freebsd-x64": "2.6.0",
+        "@parcel/watcher-linux-arm-glibc": "2.6.0",
+        "@parcel/watcher-linux-arm-musl": "2.6.0",
+        "@parcel/watcher-linux-arm64-glibc": "2.6.0",
+        "@parcel/watcher-linux-arm64-musl": "2.6.0",
+        "@parcel/watcher-linux-x64-glibc": "2.6.0",
+        "@parcel/watcher-linux-x64-musl": "2.6.0",
+        "@parcel/watcher-win32-arm64": "2.6.0",
+        "@parcel/watcher-win32-x64": "2.6.0"
+      }
+    },
+    "node_modules/@parcel/watcher-android-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.6.0.tgz",
+      "integrity": "sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.6.0.tgz",
+      "integrity": "sha512-Y3QV0gl7Q1zbfueunkWIERICbEojQFCgpyG7YqOGNFLsckXyI1xu9mAIUpKY9QBYzBtSkN8dBPwd3yiAO9ovMw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.6.0.tgz",
+      "integrity": "sha512-Ohv6OpzhUfKYD7Beb8kDvG0jbIxORCYY1JRdZnaBtnjjkJxgD7ZVL0nw2sCYd0yTMKTvz3nnTnOF3cDifK+kvw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-freebsd-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.6.0.tgz",
+      "integrity": "sha512-5HmXvDgs8VK+74jF9y9/2FE3/OnlcKmc56tjmSrEuZjpSZOGL+fvAu+HKJBdPs9uwoP2hE6TlSUpXZ/C5jUFmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.6.0.tgz",
+      "integrity": "sha512-Ps/hui3A+vMbjdqlqAowK2ZL8+BO8dBjxeWXj6npTBs3jx4wWmbPpaLuqwrQrSqIVMCnpWo238bJ1U37GhQOYg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.6.0.tgz",
+      "integrity": "sha512-9c6AUHgHoG+IY88MRIHupztQiQnrbqHYQjkM2btA+Bf/wQnQMuiD0Wfk1EVv3TlNT3x41uU71rn6E4xh/+zvkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.6.0.tgz",
+      "integrity": "sha512-yHRqS2owEXe6Hic9z6Mh1ECsCd+ODVOGvZDyciqRd21+v+o+DnXMOrw50DSpIG2sb8GPEaPPmfeCAWKPJdq46g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.6.0.tgz",
+      "integrity": "sha512-WhB2e/V7rqdHHWZusBSPuy5Ei8S6lSz6FE5TKKQz5h3a0O+C+mhY7vxU9b/stqvMb8beLnPY82ZrFTLKs+SrKA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.6.0.tgz",
+      "integrity": "sha512-ulGE6x6Oz6iAwg75T8YQSoguBWasniIbX+QWpaYPcCnDOpdWX3k+4xbEYPZVLxOuoJI+svJJPD3sEj8G7lrQ3A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.6.0.tgz",
+      "integrity": "sha512-tkBYKt7YQrjIJWYDnto2YgO8MRkjlMTSNoRHzsXinBqbLdeOM3L32wPZJvIZxqaLMfSlS/4sUjH/6STVP/XDLw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.6.0.tgz",
+      "integrity": "sha512-gIZAP23jaHjGWasY/TY6yL7NHFClf0Ga7FN+iINvk+KN94rhm94lYZhFsbYFNcA04/onvGD9kKmiJLJB2HbNwQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.6.0.tgz",
+      "integrity": "sha512-cA+/pXV2YkfxlIcXOQ5fSWqAzzPyD78/x5qbK/I0vUkrlYHA8TIz+MXjAbGouguKVSI4bOmkTSJ1/poVSsgt+A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -1922,13 +2351,13 @@
       }
     },
     "node_modules/@pkgr/core": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
+      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+        "node": "^14.18.0 || >=16.0.0"
       },
       "funding": {
         "url": "https://opencollective.com/pkgr"
@@ -1953,9 +2382,9 @@
       "license": "MIT"
     },
     "node_modules/@sinclair/typebox": {
-      "version": "0.34.49",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
-      "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==",
+      "version": "0.34.52",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
+      "integrity": "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==",
       "dev": true,
       "license": "MIT"
     },
@@ -2023,9 +2452,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2377,16 +2806,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
@@ -2474,16 +2903,16 @@
       }
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/@unrs/resolver-binding-android-arm-eabi": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.11.1.tgz",
-      "integrity": "sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.12.2.tgz",
+      "integrity": "sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==",
       "cpu": [
         "arm"
       ],
@@ -2495,9 +2924,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-android-arm64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.11.1.tgz",
-      "integrity": "sha512-lCxkVtb4wp1v+EoN+HjIG9cIIzPkX5OtM03pQYkG+U5O/wL53LC4QbIeazgiKqluGeVEeBlZahHalCaBvU1a2g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.12.2.tgz",
+      "integrity": "sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==",
       "cpu": [
         "arm64"
       ],
@@ -2509,9 +2938,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-darwin-arm64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.11.1.tgz",
-      "integrity": "sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.12.2.tgz",
+      "integrity": "sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==",
       "cpu": [
         "arm64"
       ],
@@ -2523,9 +2952,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-darwin-x64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.11.1.tgz",
-      "integrity": "sha512-cFzP7rWKd3lZaCsDze07QX1SC24lO8mPty9vdP+YVa3MGdVgPmFc59317b2ioXtgCMKGiCLxJ4HQs62oz6GfRQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.12.2.tgz",
+      "integrity": "sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==",
       "cpu": [
         "x64"
       ],
@@ -2537,9 +2966,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-freebsd-x64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.11.1.tgz",
-      "integrity": "sha512-fqtGgak3zX4DCB6PFpsH5+Kmt/8CIi4Bry4rb1ho6Av2QHTREM+47y282Uqiu3ZRF5IQioJQ5qWRV6jduA+iGw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.12.2.tgz",
+      "integrity": "sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==",
       "cpu": [
         "x64"
       ],
@@ -2551,9 +2980,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm-gnueabihf": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.11.1.tgz",
-      "integrity": "sha512-u92mvlcYtp9MRKmP+ZvMmtPN34+/3lMHlyMj7wXJDeXxuM0Vgzz0+PPJNsro1m3IZPYChIkn944wW8TYgGKFHw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.12.2.tgz",
+      "integrity": "sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==",
       "cpu": [
         "arm"
       ],
@@ -2565,9 +2994,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm-musleabihf": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.11.1.tgz",
-      "integrity": "sha512-cINaoY2z7LVCrfHkIcmvj7osTOtm6VVT16b5oQdS4beibX2SYBwgYLmqhBjA1t51CarSaBuX5YNsWLjsqfW5Cw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.12.2.tgz",
+      "integrity": "sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==",
       "cpu": [
         "arm"
       ],
@@ -2579,13 +3008,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.11.1.tgz",
-      "integrity": "sha512-34gw7PjDGB9JgePJEmhEqBhWvCiiWCuXsL9hYphDF7crW7UgI05gyBAi6MF58uGcMOiOqSJ2ybEeCvHcq0BCmQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.12.2.tgz",
+      "integrity": "sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2593,13 +3025,50 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.11.1.tgz",
-      "integrity": "sha512-RyMIx6Uf53hhOtJDIamSbTskA99sPHS96wxVE/bJtePJJtpdKGXO1wY90oRdXuYOGOTuqjT8ACccMc4K6QmT3w==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.12.2.tgz",
+      "integrity": "sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-gnu/-/resolver-binding-linux-loong64-gnu-1.12.2.tgz",
+      "integrity": "sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-musl/-/resolver-binding-linux-loong64-musl-1.12.2.tgz",
+      "integrity": "sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2607,13 +3076,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-ppc64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.11.1.tgz",
-      "integrity": "sha512-D8Vae74A4/a+mZH0FbOkFJL9DSK2R6TFPC9M+jCWYia/q2einCubX10pecpDiTmkJVUH+y8K3BZClycD8nCShA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.12.2.tgz",
+      "integrity": "sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2621,13 +3093,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-riscv64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.11.1.tgz",
-      "integrity": "sha512-frxL4OrzOWVVsOc96+V3aqTIQl1O2TjgExV4EKgRY09AJ9leZpEg8Ak9phadbuX0BA4k8U5qtvMSQQGGmaJqcQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.12.2.tgz",
+      "integrity": "sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2635,13 +3110,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-riscv64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.11.1.tgz",
-      "integrity": "sha512-mJ5vuDaIZ+l/acv01sHoXfpnyrNKOk/3aDoEdLO/Xtn9HuZlDD6jKxHlkN8ZhWyLJsRBxfv9GYM2utQ1SChKew==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.12.2.tgz",
+      "integrity": "sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2649,13 +3127,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-s390x-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.11.1.tgz",
-      "integrity": "sha512-kELo8ebBVtb9sA7rMe1Cph4QHreByhaZ2QEADd9NzIQsYNQpt9UkM9iqr2lhGr5afh885d/cB5QeTXSbZHTYPg==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.12.2.tgz",
+      "integrity": "sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==",
       "cpu": [
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2663,13 +3144,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-x64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.11.1.tgz",
-      "integrity": "sha512-C3ZAHugKgovV5YvAMsxhq0gtXuwESUKc5MhEtjBpLoHPLYM+iuwSj3lflFwK3DPm68660rZ7G8BMcwSro7hD5w==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.12.2.tgz",
+      "integrity": "sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2677,23 +3161,40 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-x64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.11.1.tgz",
-      "integrity": "sha512-rV0YSoyhK2nZ4vEswT/QwqzqQXw5I6CjoaYMOX0TqBlWhojUf8P94mvI7nuJTeaCkkds3QE4+zS8Ko+GdXuZtA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.12.2.tgz",
+      "integrity": "sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ]
     },
+    "node_modules/@unrs/resolver-binding-openharmony-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-openharmony-arm64/-/resolver-binding-openharmony-arm64-1.12.2.tgz",
+      "integrity": "sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
     "node_modules/@unrs/resolver-binding-wasm32-wasi": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.11.1.tgz",
-      "integrity": "sha512-5u4RkfxJm+Ng7IWgkzi3qrFOvLvQYnPBmjmZQ8+szTK/b31fQCnleNl1GgEt7nIsZRIf5PLhPwT0WM+q45x/UQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.12.2.tgz",
+      "integrity": "sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==",
       "cpu": [
         "wasm32"
       ],
@@ -2701,16 +3202,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@napi-rs/wasm-runtime": "^0.2.11"
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.11.1.tgz",
-      "integrity": "sha512-nRcz5Il4ln0kMhfL8S3hLkxI85BXs3o8EYoattsJNdsX4YUU89iOkVn7g0VHSRxFuVMdM4Q1jEpIId1Ihim/Uw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
+      "integrity": "sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==",
       "cpu": [
         "arm64"
       ],
@@ -2722,9 +3225,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-win32-ia32-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.11.1.tgz",
-      "integrity": "sha512-DCEI6t5i1NmAZp6pFonpD5m7i6aFrpofcp4LA2i8IIq60Jyo28hamKBxNrZcyOwVOZkgsRp9O2sXWBWP8MnvIQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.12.2.tgz",
+      "integrity": "sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==",
       "cpu": [
         "ia32"
       ],
@@ -2736,9 +3239,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.11.1.tgz",
-      "integrity": "sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
+      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
       "cpu": [
         "x64"
       ],
@@ -3180,16 +3683,16 @@
       }
     },
     "node_modules/babel-jest": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.4.1.tgz",
-      "integrity": "sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.5.0.tgz",
+      "integrity": "sha512-PrhPHlKC+MsLnuNzgIH/y1dkz1f6cSfKWaQeaG8WxLMuG44dYWQ8E9uRrsBbAGCU/3+BEFYPN4d6G3Zc5Y+waA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/transform": "30.4.1",
+        "@jest/transform": "30.5.0",
         "@types/babel__core": "^7.20.5",
-        "babel-plugin-istanbul": "^7.0.1",
-        "babel-preset-jest": "30.4.0",
+        "babel-plugin-istanbul": "^8.0.0",
+        "babel-preset-jest": "30.5.0",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
         "slash": "^3.0.0"
@@ -3202,9 +3705,9 @@
       }
     },
     "node_modules/babel-plugin-istanbul": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-7.0.1.tgz",
-      "integrity": "sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-8.0.0.tgz",
+      "integrity": "sha512-18wCskrN3DgbuBmp1gr7LBGT8xdz5xhQQqFvFhVxbkl8VBCrMKQ2YtqBWtUal1Zrc1HTuX0011+Brjw78TCFkg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "workspaces": [
@@ -3215,53 +3718,70 @@
         "@istanbuljs/load-nyc-config": "^1.0.0",
         "@istanbuljs/schema": "^0.1.3",
         "istanbul-lib-instrument": "^6.0.2",
-        "test-exclude": "^6.0.0"
+        "test-exclude": "^7.0.1"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
-    "node_modules/babel-plugin-istanbul/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+    "node_modules/babel-plugin-istanbul/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/babel-plugin-istanbul/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "*"
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/babel-plugin-istanbul/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/babel-plugin-istanbul/node_modules/test-exclude": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.2.tgz",
+      "integrity": "sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
+        "glob": "^10.4.1",
+        "minimatch": "^10.2.2"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
     "node_modules/babel-plugin-jest-hoist": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz",
-      "integrity": "sha512-9EdtWM/sSfXLOGLwSn+GS6pIXyBnL07/8gyJlwFXjWy4DxMOyItqyUT29d4lQiS380EZwYlX7/At4PgBS+m2aA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.5.0.tgz",
+      "integrity": "sha512-gtGo1B+u14jrZQv6TdSWIWkTqclboo7Qn+dFAGUOIuXLFuJKAdg3U5MIWzZnW4vfUb4dX9skmAMiby86e/SF4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3299,20 +3819,20 @@
       }
     },
     "node_modules/babel-preset-jest": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.4.0.tgz",
-      "integrity": "sha512-lBY4jxsNmCnSiu7kquw8ZC9F4+XLMOKypT3RnNHPvU2Kpd4W0xaPuLr5ZkRyOsvLYAY4yaW1ZwTW4xB7NIiZzg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.5.0.tgz",
+      "integrity": "sha512-ZGPn5ClP4lBDpuOK8W1yQIOy359HmbnZv3suucAlIe+SEE9yDsxV4S2PjSbH2Vc97U+WmzYD7vw3kr8NsQ/i6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "babel-plugin-jest-hoist": "30.4.0",
+        "babel-plugin-jest-hoist": "30.5.0",
         "babel-preset-current-node-syntax": "^1.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       },
       "peerDependencies": {
-        "@babel/core": "^7.11.0 || ^8.0.0-beta.1"
+        "@babel/core": "^7.11.0 || ^8.0.0-beta.1 || ^8.0.0"
       }
     },
     "node_modules/balanced-match": {
@@ -3323,9 +3843,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.29",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.29.tgz",
-      "integrity": "sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3367,16 +3887,16 @@
       }
     },
     "node_modules/borp/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/borp/node_modules/c8": {
@@ -3504,9 +4024,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3528,9 +4048,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "dev": true,
       "funding": [
         {
@@ -3548,11 +4068,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -3571,13 +4091,6 @@
         "node-int64": "^0.4.0"
       }
     },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/c8": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/c8/-/c8-12.0.0.tgz",
@@ -3859,9 +4372,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001792",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001792.tgz",
-      "integrity": "sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -3923,9 +4436,9 @@
       }
     },
     "node_modules/cjs-module-lexer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
-      "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.1.tgz",
+      "integrity": "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -4269,6 +4782,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/detect-newline": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -4351,9 +4874,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.354",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.354.tgz",
-      "integrity": "sha512-JaBHwWcfIdmSAfWM5l3uwjGd431j8YEMikZ+K/2nXVuBqJKyZ0f+2h4n4JY5AyNiZmnY9qQr2RU3v9DxDmHMNg==",
+      "version": "1.5.416",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.416.tgz",
+      "integrity": "sha512-K6bvB2BjnNrugtIih6ewlbBI9DXa976jIdiIlRLHhBoEI9a4JaQjjHyF+A1IQI543aQYR4LnmOrT/K5fZj0aPA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4518,6 +5041,13 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
@@ -4579,9 +5109,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -4592,32 +5122,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.1",
-        "@esbuild/android-arm": "0.28.1",
-        "@esbuild/android-arm64": "0.28.1",
-        "@esbuild/android-x64": "0.28.1",
-        "@esbuild/darwin-arm64": "0.28.1",
-        "@esbuild/darwin-x64": "0.28.1",
-        "@esbuild/freebsd-arm64": "0.28.1",
-        "@esbuild/freebsd-x64": "0.28.1",
-        "@esbuild/linux-arm": "0.28.1",
-        "@esbuild/linux-arm64": "0.28.1",
-        "@esbuild/linux-ia32": "0.28.1",
-        "@esbuild/linux-loong64": "0.28.1",
-        "@esbuild/linux-mips64el": "0.28.1",
-        "@esbuild/linux-ppc64": "0.28.1",
-        "@esbuild/linux-riscv64": "0.28.1",
-        "@esbuild/linux-s390x": "0.28.1",
-        "@esbuild/linux-x64": "0.28.1",
-        "@esbuild/netbsd-arm64": "0.28.1",
-        "@esbuild/netbsd-x64": "0.28.1",
-        "@esbuild/openbsd-arm64": "0.28.1",
-        "@esbuild/openbsd-x64": "0.28.1",
-        "@esbuild/openharmony-arm64": "0.28.1",
-        "@esbuild/sunos-x64": "0.28.1",
-        "@esbuild/win32-arm64": "0.28.1",
-        "@esbuild/win32-ia32": "0.28.1",
-        "@esbuild/win32-x64": "0.28.1"
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
       }
     },
     "node_modules/escalade": {
@@ -5149,18 +5679,18 @@
       }
     },
     "node_modules/expect": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-30.4.1.tgz",
-      "integrity": "sha512-PMARsyh/JtqC20HoGqlFcIlQAyqUtW4PlI1rup1uhYJtKuwAjbvWi3GQMAn+STdHum/dk8xrKfUM1+5SAwpolA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-30.5.0.tgz",
+      "integrity": "sha512-8fiMWcEjPU7B9nErC4FtFcCzf2tC6I75Qf7m8wzBAWC2taZmcno3yAFEjIQL34SwoGZNgPf63UDiJLyh4SMPaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/expect-utils": "30.4.1",
-        "@jest/get-type": "30.1.0",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1"
+        "@jest/expect-utils": "30.5.0",
+        "@jest/get-type": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -5392,28 +5922,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@ -5631,9 +6139,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5971,25 +6479,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/internal-slot": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -6515,9 +7004,9 @@
       }
     },
     "node_modules/istanbul-lib-instrument/node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -6606,16 +7095,16 @@
       }
     },
     "node_modules/jest": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-30.4.2.tgz",
-      "integrity": "sha512-Yi1jqNC/Oq0N4hBgNH/YvBpP1P57QqundgytzYqy3yqAa7NZPNjSoi4SGbRAXDMdBzNE6xBCi5U7RgfrvMEUVQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest/-/jest-30.5.0.tgz",
+      "integrity": "sha512-HeFeOUEKh5gjnp1rjuSCse8Dhj0Y3KA8lsZ3azr4Wnq1nCxwMBu35MDc9mp8iblZxmeAz6wV4P241tyUB7J2Ew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/core": "30.4.2",
-        "@jest/types": "30.4.1",
+        "@jest/core": "30.5.0",
+        "@jest/types": "30.5.0",
         "import-local": "^3.2.0",
-        "jest-cli": "30.4.2"
+        "jest-cli": "30.5.0"
       },
       "bin": {
         "jest": "bin/jest.js"
@@ -6633,14 +7122,14 @@
       }
     },
     "node_modules/jest-changed-files": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.4.1.tgz",
-      "integrity": "sha512-IuctmYrxi21iOSOaIXpJWalHyPAsVv0GeBHKDn8C1CA4W5htHn7INL+wdnL4Bo0+olEndvAFkmb++tIQJG+vvg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.5.0.tgz",
+      "integrity": "sha512-dq1x8JiEnHkJDxxOrF6UJDivBRAQMwAa5tzr+VX3um0SfyMFseUPQUbe51wLwggfoa5h/EmOtSpdJxxkzSlNRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "execa": "^5.1.1",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "p-limit": "^3.1.0"
       },
       "engines": {
@@ -6738,29 +7227,29 @@
       }
     },
     "node_modules/jest-circus": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.4.2.tgz",
-      "integrity": "sha512-rvHH7VlY6LgbJXJTQ87GW62g1FntOtbhh0zT+v04kC+pgL6aBKyYINXxWukCpj3dcIBMw5/XUbtDS9dU9JTXeQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.5.0.tgz",
+      "integrity": "sha512-T3v7uM4wwCu+RQicjsAWCgoL3CiyuX3THSKwv2uMb9N2bMUgb+HfwDWEUma85vOGbvQNQ/YfoCXF1OCZot0ZEw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/expect": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/expect": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "co": "^4.6.0",
         "dedent": "^1.6.0",
         "is-generator-fn": "^2.1.0",
-        "jest-each": "30.4.1",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-runtime": "30.4.2",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-each": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
         "p-limit": "^3.1.0",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "pure-rand": "^7.0.0",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
@@ -6787,21 +7276,21 @@
       "license": "MIT"
     },
     "node_modules/jest-cli": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.4.2.tgz",
-      "integrity": "sha512-jfA2ocvVHMXS2QijrJ0d31ektP+d/W0T5RpcTX2Pq+3sVqHlsXVCM2+FmwpL+bdY8OfHpIg9xMxLF17Zg0U49Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.5.0.tgz",
+      "integrity": "sha512-QHZMiy32x2K+NzJ1AuuoCAVc1Y5co0VXib3R7kD9MWcWFflzsD1eJN0wR+mkNlM+ts7C+Bjz0oOoFE5IiHylCg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/core": "30.4.2",
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/core": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
         "exit-x": "^0.2.2",
         "import-local": "^3.2.0",
-        "jest-config": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-config": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "yargs": "^17.7.2"
       },
       "bin": {
@@ -6820,33 +7309,33 @@
       }
     },
     "node_modules/jest-config": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.4.2.tgz",
-      "integrity": "sha512-rNHAShJQqQwFNoL0hbf3BphSBOWnpOUAKvidLS/AjNVLPfoj5mSf4jQMfW3cYOs6hXeZC7nF7mDHaBnbxELOzg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.5.0.tgz",
+      "integrity": "sha512-gYQl2FqYgiVpyuB7DutBIbJRWaq5VcHdzOXJJ51HNa8J5JrsZehIlzNFW0/9s5uvvcbzM5/LTUizYSbsFErv+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.27.4",
-        "@jest/get-type": "30.1.0",
-        "@jest/pattern": "30.4.0",
-        "@jest/test-sequencer": "30.4.1",
-        "@jest/types": "30.4.1",
-        "babel-jest": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/pattern": "30.5.0",
+        "@jest/test-sequencer": "30.5.0",
+        "@jest/types": "30.5.0",
+        "babel-jest": "30.5.0",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
         "deepmerge": "^4.3.1",
-        "glob": "^10.5.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "jest-circus": "30.4.2",
-        "jest-docblock": "30.4.0",
-        "jest-environment-node": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-runner": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-circus": "30.5.0",
+        "jest-docblock": "30.5.0",
+        "jest-environment-node": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-runner": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "parse-json": "^5.2.0",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0",
         "strip-json-comments": "^3.1.1"
       },
@@ -6870,26 +7359,110 @@
         }
       }
     },
+    "node_modules/jest-config/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-config/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-config/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jest-diff": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz",
-      "integrity": "sha512-CRpFK0RtLriVDGcPPAnR6HMVI8bSR2jnUIgralhauzYQZIb4RH9AtEInTuQr65LmmGggGcRT6HIASxwqsVsmlA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.5.0.tgz",
+      "integrity": "sha512-QjCfDMwdPFvLxTQmS4/Dswx3PUCiqmSXVLGljMC3SU7YG1qHVoR6b86IH/O2G9k9OMyKXz2vS2Q60VnAozNDwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/diff-sequences": "30.4.0",
-        "@jest/get-type": "30.1.0",
+        "@jest/diff-sequences": "30.5.0",
+        "@jest/get-type": "30.5.0",
         "chalk": "^4.1.2",
-        "pretty-format": "30.4.1"
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-docblock": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.4.0.tgz",
-      "integrity": "sha512-ZPMabUZCx5MpbZ2eBYSvZ0J8fvo3dR9oM+eeUpb3aKNQFuS2tu3Duw1TNlMoP8k3WQgKGJuhcMFvwcVuq6T7oA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.5.0.tgz",
+      "integrity": "sha512-NwDqcxtoZi33RhuW+zJS/RVA3rmheQ8BnwpYZuc/Eruaz6seQb7+aoCeDZu/3X7W2XmD8DbSo9Pn72DbKsBFYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6900,36 +7473,36 @@
       }
     },
     "node_modules/jest-each": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.4.1.tgz",
-      "integrity": "sha512-/8MJbH6fuj48TstjrMf+u/pd06Qezz5xOXvZA6442heNOWr8bdeoGZX2d9fCn028CoMgYmroH9//zky5GfyYmA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.5.0.tgz",
+      "integrity": "sha512-NiMFNhRygJEFqYNt8pnkxppUF6CR486GEpt9rSU6lPBf7KeccaOL0zbjxG8fgJgD//6e7zYdssnlt6j+1kI31A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "@jest/types": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
-        "jest-util": "30.4.1",
-        "pretty-format": "30.4.1"
+        "jest-util": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-environment-node": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.4.1.tgz",
-      "integrity": "sha512-4FZYVOk85hz2AyT6BbarKy9u37g6DbrDyCdFhsnDdXqyrueYQvB+0zO4f/kqLCRD0BsPRXPMNJeQwihKZV8naw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.5.0.tgz",
+      "integrity": "sha512-bTc79ywKLz0ogbT3JIYuEhgWV4Ffd/cJe06co4v8CyRtlmju8x5gokMlGFR8ARWhmk5SnbDRxmf50XWnlZVhDg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/fake-timers": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1"
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -6946,75 +7519,73 @@
       }
     },
     "node_modules/jest-haste-map": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.4.1.tgz",
-      "integrity": "sha512-rFrcONd8jeFsyw+Z9CrScJgglRf2+NFmNam8dKu7n+SoHqNYT47mn0DdEcVUZJpvh7Iz6/si7f7yUH7GJHVgnw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.5.0.tgz",
+      "integrity": "sha512-0FStogBslBVOEqTOJr4oXMtFitmrWp9WscG6Gbns88i0YAuMXijCT2G5VMfg/HCR4QAnL+OF2C2ednag+HlDuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
+        "@parcel/watcher": "^2.6.0",
         "@types/node": "*",
         "anymatch": "^3.1.3",
         "fb-watchman": "^2.0.2",
+        "fdir": "^6.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-regex-util": "30.4.0",
-        "jest-util": "30.4.1",
-        "jest-worker": "30.4.1",
-        "picomatch": "^4.0.3",
-        "walker": "^1.0.8"
+        "jest-regex-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-worker": "30.5.0",
+        "picomatch": "^4.0.3"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "^2.3.3"
       }
     },
     "node_modules/jest-leak-detector": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.4.1.tgz",
-      "integrity": "sha512-IpmyiioeHxiWDhesHnUFmOxcTzwCwKpgACgWajtAP+nYQXiY7DakTxB6Bx9JFiRMljr0AX1PvnQdaU1KFoz6NQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.5.0.tgz",
+      "integrity": "sha512-Mq11ceAkNR250Iv45RoOwuG9fb4kYbJ02qoyL7A0nCI8FV5+aG/THmcEUx5uR2dNSa4KOtz+xBKrJ8cZPhPpuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "pretty-format": "30.4.1"
+        "@jest/get-type": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-matcher-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.4.1.tgz",
-      "integrity": "sha512-zvYfX5CaeEkFrrLS9suWe9rvJrm9J1Iv3ua8kIBv9GEPzcnsfBf0bob37la7s67fs0nlBC3EuvkOLnXQKxtx4A==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.5.0.tgz",
+      "integrity": "sha512-EfaYMC9f9ds7fahB/LYFTgd1Z2RS9Vpm2e46gazij0onkpoQG7Daq+MLm8/gQVqWwRVjL/RNDggbFx9MsrJEmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
+        "@jest/get-type": "30.5.0",
         "chalk": "^4.1.2",
-        "jest-diff": "30.4.1",
-        "pretty-format": "30.4.1"
+        "jest-diff": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-message-util": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.4.1.tgz",
-      "integrity": "sha512-kwCKIvq0MCW1HzLoGola9Te6JUdzgV0loyKJ3Qghrkz9i5/RRIHsL95BMQc2HBBhlBKC4j22K9p11TGHH8RBpQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.5.0.tgz",
+      "integrity": "sha512-dBYMhplGfspKaCnVk9TUy1cZnknWubpuPNEputjz0YJk1G/92R45rn45BvbPMPMtC5LVcIdxJGPOaOSQTiuzJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/stack-utils": "^2.0.3",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "picomatch": "^4.0.3",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
       },
@@ -7023,42 +7594,25 @@
       }
     },
     "node_modules/jest-mock": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.4.1.tgz",
-      "integrity": "sha512-/i8SVb8/NSB7RfNi8gfqu8gxLV23KaL5EpAttyb9iz8qWRIqXRLflycz/32wXsYkOnaUlx8NAKnJYtpsmXUmfw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.5.0.tgz",
+      "integrity": "sha512-bP5MHZpkYrV7xpV+yvhl36DPcXoEmTR57Un5EACcdVpMY7mpkDefCBq+V4mhcjE/3rwUajT6OTrcJTN7EwN1BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/expect-utils": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-util": "30.4.1"
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/jest-pnp-resolver": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
-      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "peerDependencies": {
-        "jest-resolve": "*"
-      },
-      "peerDependenciesMeta": {
-        "jest-resolve": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/jest-regex-util": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.4.0.tgz",
-      "integrity": "sha512-mWlvLviKIgIQ8VCuM1xRdD0TWp3zlzionlmDBjuXVBs+VkmXq6FgW9T4Emr7oGz/Rk6feDCGyiugolcQEyp3mg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.5.0.tgz",
+      "integrity": "sha512-Mg0WK7A6xRHLSA1udJ8y9f3lM0uUhFTBnLKzwPmqB9AylvpleJ6BLemR8K9dK27DY+cesDryoA7yLZCAHsPG1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7066,100 +7620,100 @@
       }
     },
     "node_modules/jest-resolve": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.4.1.tgz",
-      "integrity": "sha512-Zry8Yq/yJcNAZ7dJ5F2heic8AheXvbFZ7XI5V+h28nrYZ7Qoyy4dItq8OodjnYD270mvX+ZudmrNV9cysqhW5Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.5.0.tgz",
+      "integrity": "sha512-NFvQWJ4G7e2kN5712iG+12Xr325NRFGAIhovrwLfgq5Oqd4bFHITw4CzcFkZGp1GTCqemC4v1l8/yZzedKZkjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-pnp-resolver": "^1.2.3",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "slash": "^3.0.0",
-        "unrs-resolver": "^1.7.11"
+        "unrs-resolver": "^1.12.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-resolve-dependencies": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.4.2.tgz",
-      "integrity": "sha512-gDiVh1I+GxYzz9oXlyw+1wv6VOYX1WYxMOfjsA3iGKePV2oxmbHhwxfkALxNxYy1ciw6APWwkW2zZONwP97aEQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.5.0.tgz",
+      "integrity": "sha512-TnSBAp3wGOnqXBmLT3OXtJkugw6Vj2KU0IPde2EJmbGns/QMoNlkauJ7jZ8KYaxONSpx0o4pUvi+u1Q/LSk3Pg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "jest-regex-util": "30.4.0",
-        "jest-snapshot": "30.4.1"
+        "jest-regex-util": "30.5.0",
+        "jest-snapshot": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-runner": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.4.2.tgz",
-      "integrity": "sha512-2dw0PslVYXxffXGpLo+Ejad+KcI1Qkjn7f4X4619gf21oCUmL+SPfjqIa/losUem3yEOvfNZe/F1HWUcNpODcg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.5.0.tgz",
+      "integrity": "sha512-Q6Yt+1LvXvEstvru6sQLT7OQYC77VNl6dK0KEvBkeOHgThmXDqNp3Ox9TglDWFHU85pemqTNdKwxfnmO3vgrdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/environment": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/environment": "30.5.0",
+        "@jest/source-map": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "emittery": "^0.13.1",
         "exit-x": "^0.2.2",
         "graceful-fs": "^4.2.11",
-        "jest-docblock": "30.4.0",
-        "jest-environment-node": "30.4.1",
-        "jest-haste-map": "30.4.1",
-        "jest-leak-detector": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-resolve": "30.4.1",
-        "jest-runtime": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-watcher": "30.4.1",
-        "jest-worker": "30.4.1",
-        "p-limit": "^3.1.0",
-        "source-map-support": "0.5.13"
+        "jest-docblock": "30.5.0",
+        "jest-environment-node": "30.5.0",
+        "jest-haste-map": "30.5.0",
+        "jest-leak-detector": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-watcher": "30.5.0",
+        "jest-worker": "30.5.0",
+        "p-limit": "^3.1.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-runtime": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.4.2.tgz",
-      "integrity": "sha512-3/5e8iPz2k/VLqlr8DgTftYyLUv8Su3FkCAO2/Od81UsUTpSxOrS6O5x5KkoQwyUjmpYyDJKeyAvg2T2nvpNkQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.5.0.tgz",
+      "integrity": "sha512-VTRz0sRIw2EISeHigx1O+CMuwoG4+RKJjF8dp8okzFaDNQEcv5Mw0h5QW8VJXgb2CRF4gZIjSEBb2jdzXPagFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/fake-timers": "30.4.1",
-        "@jest/globals": "30.4.1",
-        "@jest/source-map": "30.0.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/globals": "30.5.0",
+        "@jest/source-map": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
-        "cjs-module-lexer": "^2.1.0",
+        "cjs-module-lexer": "^2.2.0",
         "collect-v8-coverage": "^1.0.2",
-        "glob": "^10.5.0",
+        "es-module-lexer": "^2.1.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
         "slash": "^3.0.0",
         "strip-bom": "^4.0.0"
       },
@@ -7167,10 +7721,94 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/jest-runtime/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jest-snapshot": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.4.1.tgz",
-      "integrity": "sha512-tEOkkfOMppUyeiHwjZswOQ3lcnoTnws/q5FnGIaeIh/jmoU0ZlgMYRR8sTlTj+nNGCoJ0RDq6SfxGxCsyMTPmw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.5.0.tgz",
+      "integrity": "sha512-pZWETdcqmKve9MDTE/AX6RaeAbRhzKhhAXGozAW8Pg2FfOSdUrQ/7D+VdwE3fLQsqjpITXJVQvYVZoMEzrUl0Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7179,20 +7817,20 @@
         "@babel/plugin-syntax-jsx": "^7.27.1",
         "@babel/plugin-syntax-typescript": "^7.27.1",
         "@babel/types": "^7.27.3",
-        "@jest/expect-utils": "30.4.1",
-        "@jest/get-type": "30.1.0",
-        "@jest/snapshot-utils": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/expect-utils": "30.5.0",
+        "@jest/get-type": "30.5.0",
+        "@jest/snapshot-utils": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "babel-preset-current-node-syntax": "^1.2.0",
         "chalk": "^4.1.2",
-        "expect": "30.4.1",
+        "expect": "30.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-diff": "30.4.1",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
-        "pretty-format": "30.4.1",
+        "jest-diff": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "pretty-format": "30.5.0",
         "semver": "^7.7.2",
         "synckit": "^0.11.8"
       },
@@ -7201,9 +7839,9 @@
       }
     },
     "node_modules/jest-snapshot/node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -7214,13 +7852,13 @@
       }
     },
     "node_modules/jest-util": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.4.1.tgz",
-      "integrity": "sha512-vjQb1sACEiv13DKJMDToJpzVW0joCsIQrmbg0fi7CyOOt+g9jTuQl2A216pWRBYhOVt53XbL/2LbMKg1BECWOw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.5.0.tgz",
+      "integrity": "sha512-lzU4aGUWaS+2X/B0CmgheDasfnsVlRfZh/rNQxB9b9s8cSYUq5BcqdQA95ld+KqJXBUVVt1sqnMQ2T3OxIalmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
@@ -7232,18 +7870,18 @@
       }
     },
     "node_modules/jest-validate": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.4.1.tgz",
-      "integrity": "sha512-PDWi4SOwLnwqNDfHZjOcsEFyZ4fc/2W2gVL3DEoyqnB6jCQMLRtfBong8s6omIw3lI0HWOus12xfnFmQtjW3fw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.5.0.tgz",
+      "integrity": "sha512-N/hsPYKgBSzBeVZ2RHCs3yvBbTZNPX7Be8q33zhyo/yeFneBL1swzly31LYU4LJ3zJM9e8TxSM8IYLo2SDJZYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "@jest/types": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/types": "30.5.0",
         "camelcase": "^6.3.0",
         "chalk": "^4.1.2",
         "leven": "^3.1.0",
-        "pretty-format": "30.4.1"
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -7263,19 +7901,19 @@
       }
     },
     "node_modules/jest-watcher": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.4.1.tgz",
-      "integrity": "sha512-/l9UonmvCwjHH7d2h3iAwIloLc1H0S8mJZ/LNK3i86hqwPAz8otUJjP9MfYtz9Tt77Su5FD2xGjZn8d31IZHlw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.5.0.tgz",
+      "integrity": "sha512-ujjnEoL4Uu+Swu3WRwYenWMB9JMEiD2T3OypnveMJ64S/1r/5G8eC4OQ1wEOgYWQqMi+mT+buzccflCHr/XJ9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "ansi-escapes": "^4.3.2",
         "chalk": "^4.1.2",
         "emittery": "^0.13.1",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "string-length": "^4.0.2"
       },
       "engines": {
@@ -7283,15 +7921,15 @@
       }
     },
     "node_modules/jest-worker": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.4.1.tgz",
-      "integrity": "sha512-SHynN/q/QD++iNyvMdy+WMmbCGk8jIsNcRxycXbWubSOhvo6T+j2afcfUSl+3hYsiBebOTo0cT7c2H7CXugu1g==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.5.0.tgz",
+      "integrity": "sha512-7kFk/607EoynNHLJa20daivkElM+c9PrCLduYy6AlMkYrXbh5TmVtW1BLXE05Y8baAFsJHMoC3xs2QRRTotwLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
         "@ungap/structured-clone": "^1.3.0",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "merge-stream": "^2.0.0",
         "supports-color": "^8.1.1"
       },
@@ -7577,16 +8215,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/makeerror": {
-      "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "tmpl": "1.0.5"
-      }
-    },
     "node_modules/map-obj": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-4.3.0.tgz",
@@ -7898,6 +8526,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/node-addon-api": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/node-exports-info": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/node-exports-info/-/node-exports-info-1.6.0.tgz",
@@ -7935,11 +8570,14 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.44",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
-      "integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-package-data": {
       "version": "3.0.3",
@@ -8131,16 +8769,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
     "node_modules/onetime": {
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
@@ -8326,16 +8954,6 @@
         "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       }
     },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -8544,16 +9162,16 @@
       }
     },
     "node_modules/pretty-format": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
-      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.5.0.tgz",
+      "integrity": "sha512-mzNzBErpHwM0zpmWS7ExOv62yhQhvd546nUuFqVR0dmnJB59tfrw9sjDF0DJknwsr59OXP0buwJ7PaKguczHSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/schemas": "30.4.1",
-        "ansi-styles": "^5.2.0",
-        "react-is-18": "npm:react-is@^18.3.1",
-        "react-is-19": "npm:react-is@^19.2.5"
+        "@jest/react-is-18": "npm:react-is@^18.3.1",
+        "@jest/react-is-19": "npm:react-is@^19.2.5",
+        "@jest/schemas": "30.5.0",
+        "ansi-styles": "^5.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -8689,22 +9307,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/react-is-18": {
-      "name": "react-is",
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/react-is-19": {
-      "name": "react-is",
-      "version": "19.2.6",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.6.tgz",
-      "integrity": "sha512-XjBR15BhXuylgWGuslhDKqlSayuqvqBX91BP8pauG8kd1zY8kotkNWbXksTCNRarse4kuGbe2kIY05ARtwNIvw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/read-pkg": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz",
@@ -9296,27 +9898,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-support": {
-      "version": "0.5.13",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
-      "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -9726,13 +10307,13 @@
       }
     },
     "node_modules/synckit": {
-      "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
+      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.2.9"
+        "@pkgr/core": "^0.3.6"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -9781,16 +10362,16 @@
       }
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/test-exclude/node_modules/glob": {
@@ -9871,13 +10452,6 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tmpl": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -10223,9 +10797,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10253,44 +10827,47 @@
       }
     },
     "node_modules/unrs-resolver": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.11.1.tgz",
-      "integrity": "sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.12.2.tgz",
+      "integrity": "sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "napi-postinstall": "^0.3.0"
+        "napi-postinstall": "^0.3.4"
       },
       "funding": {
         "url": "https://opencollective.com/unrs-resolver"
       },
       "optionalDependencies": {
-        "@unrs/resolver-binding-android-arm-eabi": "1.11.1",
-        "@unrs/resolver-binding-android-arm64": "1.11.1",
-        "@unrs/resolver-binding-darwin-arm64": "1.11.1",
-        "@unrs/resolver-binding-darwin-x64": "1.11.1",
-        "@unrs/resolver-binding-freebsd-x64": "1.11.1",
-        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.11.1",
-        "@unrs/resolver-binding-linux-arm-musleabihf": "1.11.1",
-        "@unrs/resolver-binding-linux-arm64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-arm64-musl": "1.11.1",
-        "@unrs/resolver-binding-linux-ppc64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-riscv64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-riscv64-musl": "1.11.1",
-        "@unrs/resolver-binding-linux-s390x-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-x64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-x64-musl": "1.11.1",
-        "@unrs/resolver-binding-wasm32-wasi": "1.11.1",
-        "@unrs/resolver-binding-win32-arm64-msvc": "1.11.1",
-        "@unrs/resolver-binding-win32-ia32-msvc": "1.11.1",
-        "@unrs/resolver-binding-win32-x64-msvc": "1.11.1"
+        "@unrs/resolver-binding-android-arm-eabi": "1.12.2",
+        "@unrs/resolver-binding-android-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-x64": "1.12.2",
+        "@unrs/resolver-binding-freebsd-x64": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-musleabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-ppc64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-s390x-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-musl": "1.12.2",
+        "@unrs/resolver-binding-openharmony-arm64": "1.12.2",
+        "@unrs/resolver-binding-wasm32-wasi": "1.12.2",
+        "@unrs/resolver-binding-win32-arm64-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-ia32-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-x64-msvc": "1.12.2"
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "dev": true,
       "funding": [
         {
@@ -10354,16 +10931,6 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
-    "node_modules/walker": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "makeerror": "1.0.12"
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -10574,13 +11141,6 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/write-file-atomic": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-5.0.1.tgz",
@@ -10596,9 +11156,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/deps/undici/src/package.json b/deps/undici/src/package.json
index 270b572dfc89..bc78602fe5b9 100644
--- a/deps/undici/src/package.json
+++ b/deps/undici/src/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
@@ -97,7 +97,7 @@
     "test:websocket:autobahn": "node test/autobahn/client.js",
     "test:websocket:autobahn:report": "node test/autobahn/report.js",
     "test:wpt:setup": "node test/web-platform-tests/wpt-runner.mjs setup",
-    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /websockets /serviceWorkers /eventsource",
+    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /xhr /websockets /eventsource",
     "test:cache-tests": "node test/cache-interceptor/cache-tests.mjs --ci",
     "coverage": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report",
     "coverage:ci": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report:ci",
@@ -109,7 +109,7 @@
     "prepare": "husky && node ./scripts/platform-shell.js"
   },
   "devDependencies": {
-    "@fastify/busboy": "3.2.0",
+    "@fastify/busboy": "3.2.2",
     "@matteo.collina/tspl": "^0.2.0",
     "@metcoder95/https-pem": "^1.0.0",
     "@sinonjs/fake-timers": "^12.0.0",
diff --git a/deps/undici/src/types/client.d.ts b/deps/undici/src/types/client.d.ts
index 064d3d69f2c1..1edaeb05f1e0 100644
--- a/deps/undici/src/types/client.d.ts
+++ b/deps/undici/src/types/client.d.ts
@@ -80,6 +80,8 @@ export declare namespace Client {
     maxResponseSize?: number;
     /** WebSocket-specific options */
     webSocket?: Client.WebSocketOptions;
+    /** EventSource-specific options */
+    eventSource?: Client.EventSourceOptions;
     /** Enables a family autodetection algorithm that loosely implements section 5 of RFC 8305. */
     autoSelectFamily?: boolean;
     /** The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. */
@@ -169,6 +171,14 @@ export declare namespace Client {
      */
     settings?: Omit<SessionOptions['settings'], 'enablePush' | 'maxConcurrentStreams' | 'enableConnectProtocol'>
   }
+  export interface EventSourceOptions {
+    /**
+     * Maximum allowed event size in bytes for EventSource messages.
+     * Set to 0 to disable the limit.
+     * @default buffer.kStringMaxLength
+     */
+    maxEventSize?: number;
+  }
 }
 
 export default Client
diff --git a/deps/undici/src/types/interceptors.d.ts b/deps/undici/src/types/interceptors.d.ts
index d21d717cec51..c11d4017b11e 100644
--- a/deps/undici/src/types/interceptors.d.ts
+++ b/deps/undici/src/types/interceptors.d.ts
@@ -12,6 +12,8 @@ declare namespace Interceptors {
   export type DecompressInterceptorOpts = {
     skipErrorResponses?: boolean
     skipStatusCodes?: number[]
+    /** Maximum decompressed response size in bytes. @default 67108864 */
+    maxSize?: number
   }
 
   export type ResponseErrorInterceptorOpts = { throwOnError: boolean }
diff --git a/deps/undici/src/types/mock-agent.d.ts b/deps/undici/src/types/mock-agent.d.ts
index 330926be1919..c718df1a4334 100644
--- a/deps/undici/src/types/mock-agent.d.ts
+++ b/deps/undici/src/types/mock-agent.d.ts
@@ -6,10 +6,6 @@ import { MockCallHistory } from './mock-call-history'
 
 export default MockAgent
 
-interface PendingInterceptor extends MockDispatch {
-  origin: string;
-}
-
 /** A mocked Agent class that implements the Agent API. It allows one to intercept HTTP requests made through undici and return mocked responses instead. */
 declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.Options> extends Dispatcher {
   constructor (options?: TMockAgentOptions)
@@ -40,17 +36,22 @@ declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.
   enableCallHistory (): this
   /** Disable call history. Any subsequence calls will then not be registered. */
   disableCallHistory (): this
-  pendingInterceptors (): PendingInterceptor[]
+  pendingInterceptors (): MockAgent.PendingInterceptor[]
   assertNoPendingInterceptors (options?: {
-    pendingInterceptorsFormatter?: PendingInterceptorsFormatter;
+    pendingInterceptorsFormatter?: MockAgent.PendingInterceptorsFormatter;
   }): void
 }
 
-interface PendingInterceptorsFormatter {
-  format(pendingInterceptors: readonly PendingInterceptor[]): string;
-}
-
 declare namespace MockAgent {
+  /** An interceptor that was registered on a mock dispatcher and has not been consumed yet. */
+  export interface PendingInterceptor extends MockDispatch {
+    origin: string;
+  }
+
+  export interface PendingInterceptorsFormatter {
+    format(pendingInterceptors: readonly PendingInterceptor[]): string;
+  }
+
   /** MockAgent options. */
   export interface Options extends Agent.Options {
     /** A custom agent to be encapsulated by the MockAgent. */
diff --git a/deps/undici/src/types/socks5-proxy-agent.d.ts b/deps/undici/src/types/socks5-proxy-agent.d.ts
index 05e4331670e9..4eaeb11048f3 100644
--- a/deps/undici/src/types/socks5-proxy-agent.d.ts
+++ b/deps/undici/src/types/socks5-proxy-agent.d.ts
@@ -21,5 +21,7 @@ declare namespace Socks5ProxyAgent {
     connect?: buildConnector.connector;
     /** TLS options for the proxy connection (for SOCKS5 over TLS) */
     proxyTls?: buildConnector.BuildOptions;
+    /** TLS options for the end-to-end connection to the target */
+    requestTls?: buildConnector.BuildOptions;
   }
 }
diff --git a/deps/undici/undici.js b/deps/undici/undici.js
index bb398a0686ce..b67af93f3659 100644
--- a/deps/undici/undici.js
+++ b/deps/undici/undici.js
@@ -523,6 +523,8 @@ var require_symbols = __commonJS({
       kDestroy: /* @__PURE__ */ Symbol("destroy"),
       kDispatch: /* @__PURE__ */ Symbol("dispatch"),
       kUrl: /* @__PURE__ */ Symbol("url"),
+      kRequestOrigin: /* @__PURE__ */ Symbol("request origin"),
+      kOriginless: /* @__PURE__ */ Symbol("originless"),
       kWriting: /* @__PURE__ */ Symbol("writing"),
       kResuming: /* @__PURE__ */ Symbol("resuming"),
       kQueue: /* @__PURE__ */ Symbol("queue"),
@@ -601,6 +603,7 @@ var require_dispatcher = __commonJS({
   "lib/dispatcher/dispatcher.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("node:events");
+    var { kOriginless, kUrl } = require_symbols();
     var Dispatcher2 = class extends EventEmitter {
       static {
         __name(this, "Dispatcher");
@@ -616,6 +619,7 @@ var require_dispatcher = __commonJS({
       }
       compose(...args) {
         const interceptors = Array.isArray(args[0]) ? args[0] : args;
+        const interceptorOrigin = this[kOriginless] === true ? null : this[kUrl]?.origin;
         let dispatch = this.dispatch.bind(this);
         for (const interceptor of interceptors) {
           if (interceptor == null) {
@@ -624,11 +628,19 @@ var require_dispatcher = __commonJS({
           if (typeof interceptor !== "function") {
             throw new TypeError(`invalid interceptor, expected function received ${typeof interceptor}`);
           }
-          dispatch = interceptor(dispatch);
+          dispatch = interceptor(dispatch, interceptorOrigin);
           if (dispatch == null || typeof dispatch !== "function" || dispatch.length !== 2) {
             throw new TypeError("invalid interceptor");
           }
         }
+        const originalDispatch = dispatch;
+        const self = this;
+        dispatch = /* @__PURE__ */ __name(function(opts, handler) {
+          if (opts && typeof opts === "object" && !opts.origin && self[kUrl]) {
+            opts = Object.assign({}, opts, { origin: self[kUrl].origin });
+          }
+          return originalDispatch(opts, handler);
+        }, "dispatch");
         return new Proxy(this, {
           get: /* @__PURE__ */ __name((target, key) => key === "dispatch" ? dispatch : target[key], "get")
         });
@@ -642,6 +654,7 @@ var require_dispatcher = __commonJS({
 var require_dispatcher_base = __commonJS({
   "lib/dispatcher/dispatcher-base.js"(exports2, module2) {
     "use strict";
+    var buffer = require("node:buffer");
     var Dispatcher2 = require_dispatcher();
     var {
       ClientDestroyedError,
@@ -652,6 +665,7 @@ var require_dispatcher_base = __commonJS({
     var kOnDestroyed = /* @__PURE__ */ Symbol("onDestroyed");
     var kOnClosed = /* @__PURE__ */ Symbol("onClosed");
     var kWebSocketOptions = /* @__PURE__ */ Symbol("webSocketOptions");
+    var kEventSourceOptions = /* @__PURE__ */ Symbol("eventSourceOptions");
     var DispatcherBase = class extends Dispatcher2 {
       static {
         __name(this, "DispatcherBase");
@@ -670,9 +684,10 @@ var require_dispatcher_base = __commonJS({
       constructor(opts) {
         super();
         this[kWebSocketOptions] = opts?.webSocket ?? {};
+        this[kEventSourceOptions] = opts?.eventSource ?? {};
       }
       /**
-       * @returns {import('../../types/dispatcher').WebSocketOptions}
+       * @returns {import('../../types/client').Client.WebSocketOptions}
        */
       get webSocketOptions() {
         return {
@@ -681,6 +696,14 @@ var require_dispatcher_base = __commonJS({
           // 128 MB default
         };
       }
+      /**
+       * @returns {import('../../types/client').Client.EventSourceOptions}
+       */
+      get eventSourceOptions() {
+        return {
+          maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+        };
+      }
       /** @returns {boolean} */
       get destroyed() {
         return this[kDestroyed];
@@ -5425,6 +5448,9 @@ var require_util2 = __commonJS({
     }
     __name(TAOCheck, "TAOCheck");
     function appendFetchMetadata(httpRequest) {
+      if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+        return;
+      }
       let header = null;
       header = httpRequest.mode;
       httpRequest.headersList.set("sec-fetch-mode", header, true);
@@ -7856,7 +7882,7 @@ var require_client_h1 = __commonJS({
     __name(onSocketClose, "onSocketClose");
     function clearIdleSocketValidation(socket) {
       if (socket[kIdleSocketValidationTimeout]) {
-        clearTimeout(socket[kIdleSocketValidationTimeout]);
+        clearImmediate(socket[kIdleSocketValidationTimeout]);
         socket[kIdleSocketValidationTimeout] = null;
       }
       socket[kIdleSocketValidation] = 0;
@@ -7864,14 +7890,13 @@ var require_client_h1 = __commonJS({
     __name(clearIdleSocketValidation, "clearIdleSocketValidation");
     function scheduleIdleSocketValidation(client, socket) {
       socket[kIdleSocketValidation] = 1;
-      socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+      socket[kIdleSocketValidationTimeout] = setImmediate(() => {
         socket[kIdleSocketValidationTimeout] = null;
         socket[kIdleSocketValidation] = 2;
         if (client[kSocket] === socket && !socket.destroyed) {
           client[kResume]();
         }
-      }, 0);
-      socket[kIdleSocketValidationTimeout].unref?.();
+      });
     }
     __name(scheduleIdleSocketValidation, "scheduleIdleSocketValidation");
     function resumeH1(client) {
@@ -8391,7 +8416,8 @@ var require_client_h2 = __commonJS({
       InformationalError,
       InvalidArgumentError,
       HeadersTimeoutError,
-      BodyTimeoutError
+      BodyTimeoutError,
+      ResponseExceededMaxSizeError
     } = require_errors();
     var {
       kUrl,
@@ -8420,7 +8446,8 @@ var require_client_h2 = __commonJS({
       kRemoteSettings,
       kHTTP2Stream,
       kHTTP2SessionState,
-      kHTTP2Options
+      kHTTP2Options,
+      kMaxResponseSize
     } = require_symbols();
     var { channels } = require_diagnostics();
     var kOpenStreams = /* @__PURE__ */ Symbol("open streams");
@@ -9175,9 +9202,11 @@ var require_client_h2 = __commonJS({
       const state = {
         abort: null,
         body: request.body,
+        bytesRead: 0,
         client,
         contentLength: null,
         expectsPayload: false,
+        maxResponseSize: client[kMaxResponseSize],
         request,
         headersTimeout,
         bodyTimeout,
@@ -9316,6 +9345,7 @@ var require_client_h2 = __commonJS({
         stream.once("continue", writeBodyH2);
       }
       stream.on("response", onResponse);
+      stream.on("headers", onInterimResponse);
       stream.on("end", onEnd);
       stream.on("error", onError);
       stream.on("frameError", onFrameError);
@@ -9334,6 +9364,7 @@ var require_client_h2 = __commonJS({
       stream.off("error", noop);
       stream.off("continue", writeBodyH2);
       stream.off("response", onResponse);
+      stream.off("headers", onInterimResponse);
       stream.off("end", onEnd);
       stream.off("error", onError);
       stream.off("frameError", onFrameError);
@@ -9367,15 +9398,35 @@ var require_client_h2 = __commonJS({
       if (state == null) {
         return;
       }
-      const { request } = state;
+      const { request, maxResponseSize } = state;
       if (request.aborted || request.completed) {
         return;
       }
+      if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+        state.abort(new ResponseExceededMaxSizeError());
+        return;
+      }
+      state.bytesRead += chunk.length;
       if (request.onResponseData(chunk) === false) {
         stream.pause();
       }
     }
     __name(onData, "onData");
+    function onInterimResponse(headers) {
+      const stream = this;
+      const state = stream[kRequestStreamState];
+      if (state == null) {
+        return;
+      }
+      const { request } = state;
+      if (request.aborted || request.completed) {
+        return;
+      }
+      const statusCode = headers[HTTP2_HEADER_STATUS];
+      delete headers[HTTP2_HEADER_STATUS];
+      request.onResponseStart(Number(statusCode), headers, noop, "");
+    }
+    __name(onInterimResponse, "onInterimResponse");
     function onResponse(headers) {
       const stream = this;
       const state = stream[kRequestStreamState];
@@ -9816,7 +9867,8 @@ var require_client = __commonJS({
         connectionWindowSize,
         pingInterval,
         webSocket,
-        h2Options
+        h2Options,
+        eventSource
       } = {}) {
         if (keepAlive !== void 0) {
           throw new InvalidArgumentError("unsupported keepAlive, use pipelining=0 instead");
@@ -9919,7 +9971,7 @@ var require_client = __commonJS({
             }
           }
         }
-        super({ webSocket });
+        super({ webSocket, eventSource });
         if (typeof connect2 !== "function") {
           connect2 = buildConnector({
             ...tls,
@@ -10420,7 +10472,7 @@ var require_agent = __commonJS({
   "lib/dispatcher/agent.js"(exports2, module2) {
     "use strict";
     var { InvalidArgumentError, MaxOriginsReachedError } = require_errors();
-    var { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require_symbols();
+    var { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require_symbols();
     var DispatcherBase = require_dispatcher_base();
     var Pool = require_pool();
     var Client = require_client();
@@ -10497,7 +10549,7 @@ var require_agent = __commonJS({
             if (this[kClients].get(key) !== dispatcher) {
               return;
             }
-            if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+            if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
               return;
             }
             this[kClients].delete(key);
@@ -10564,6 +10616,7 @@ var require_dispatcher1_wrapper = __commonJS({
     var Dispatcher2 = require_dispatcher();
     var { InvalidArgumentError } = require_errors();
     var { toRawHeaders } = require_util();
+    var { kOriginless, kUrl } = require_symbols();
     var LegacyHandlerWrapper = class {
       static {
         __name(this, "LegacyHandlerWrapper");
@@ -10621,6 +10674,8 @@ var require_dispatcher1_wrapper = __commonJS({
           throw new InvalidArgumentError("Argument dispatcher must implement dispatch");
         }
         this.#dispatcher = dispatcher;
+        this[kUrl] = dispatcher[kUrl];
+        this[kOriginless] = dispatcher[kOriginless];
       }
       static wrapHandler(handler) {
         if (!handler || typeof handler !== "object") {
@@ -11230,27 +11285,37 @@ var require_socks5_proxy_agent = __commonJS({
     var { URL: URL2 } = require("node:url");
     var tls;
     var DispatcherBase = require_dispatcher_base();
-    var { InvalidArgumentError } = require_errors();
+    var { ConnectTimeoutError, InvalidArgumentError } = require_errors();
     var { Socks5Client, STATES } = require_socks5_client();
     var { kBusy, kConnected, kDispatch, kClose, kDestroy } = require_symbols();
     var Pool = require_pool();
     var buildConnector = require_connect();
+    var { setupConnectTimeout } = require_util();
     var { debuglog } = require("node:util");
     var debug = debuglog("undici:socks5-proxy");
+    var DEFAULT_SOCKS5_CONNECT_TIMEOUT = 5e3;
     var kProxyUrl = /* @__PURE__ */ Symbol("proxy url");
     var kProxyHeaders = /* @__PURE__ */ Symbol("proxy headers");
     var kProxyAuth = /* @__PURE__ */ Symbol("proxy auth");
     var kProxyProtocol = /* @__PURE__ */ Symbol("proxy protocol");
     var kPools = /* @__PURE__ */ Symbol("pools");
     var kConnector = /* @__PURE__ */ Symbol("connector");
+    var kConnectTimeout = /* @__PURE__ */ Symbol("connect timeout");
     var kRequestTls = /* @__PURE__ */ Symbol("request tls settings");
+    var kRequestTlsTimeout = /* @__PURE__ */ Symbol("request tls timeout");
+    function createConnectTimeoutError(hostname, port, timeout) {
+      return new ConnectTimeoutError(
+        `Connect Timeout Error (attempted address: ${hostname}:${port}, timeout: ${timeout}ms)`
+      );
+    }
+    __name(createConnectTimeoutError, "createConnectTimeoutError");
     var experimentalWarningEmitted = false;
     var Socks5ProxyAgent = class extends DispatcherBase {
       static {
         __name(this, "Socks5ProxyAgent");
       }
       constructor(proxyUrl, options = {}) {
-        super();
+        super(options);
         if (!experimentalWarningEmitted) {
           process.emitWarning(
             "SOCKS5 proxy support is experimental and subject to change",
@@ -11268,13 +11333,29 @@ var require_socks5_proxy_agent = __commonJS({
         this[kProxyUrl] = url;
         this[kProxyHeaders] = options.headers || {};
         this[kProxyProtocol] = options.proxyTls ? "https:" : "http:";
-        this[kRequestTls] = options.requestTls;
+        const connectTimeout = options.connectTimeout ?? DEFAULT_SOCKS5_CONNECT_TIMEOUT;
+        if (!Number.isFinite(connectTimeout) || connectTimeout < 0) {
+          throw new InvalidArgumentError("invalid connectTimeout");
+        }
+        this[kConnectTimeout] = connectTimeout;
+        const { timeout, ...requestTls } = options.requestTls || {};
+        const requestTlsTimeout = timeout ?? connectTimeout;
+        if (!Number.isFinite(requestTlsTimeout) || requestTlsTimeout < 0) {
+          throw new InvalidArgumentError("invalid requestTls.timeout");
+        }
+        this[kRequestTls] = requestTls;
+        this[kRequestTlsTimeout] = requestTlsTimeout;
         this[kProxyAuth] = {
           username: options.username || (url.username ? decodeURIComponent(url.username) : null),
           password: options.password || (url.password ? decodeURIComponent(url.password) : null)
         };
+        const proxyTlsTimeout = options.proxyTls?.timeout ?? connectTimeout;
+        if (!Number.isFinite(proxyTlsTimeout) || proxyTlsTimeout < 0) {
+          throw new InvalidArgumentError("invalid proxyTls.timeout");
+        }
         this[kConnector] = options.connect || buildConnector({
           ...options.proxyTls,
+          timeout: proxyTlsTimeout,
           servername: options.proxyTls?.servername || url.hostname
         });
         this[kPools] = /* @__PURE__ */ new Map();
@@ -11307,17 +11388,24 @@ var require_socks5_proxy_agent = __commonJS({
         });
         await socks5Client.handshake();
         const authenticationReady = Promise.withResolvers();
-        const authenticationTimeout = setTimeout(() => {
-          authenticationReady.reject(new Error("SOCKS5 authentication timeout"));
-        }, 5e3);
-        const onAuthenticated = /* @__PURE__ */ __name(() => {
+        const authenticationTimeout = this[kConnectTimeout] === 0 ? null : setTimeout(() => {
+          cleanupAuthenticationListeners();
+          socks5Client.destroy();
+          authenticationReady.reject(
+            createConnectTimeoutError(proxyHost, proxyPort, this[kConnectTimeout])
+          );
+        }, this[kConnectTimeout]);
+        const cleanupAuthenticationListeners = /* @__PURE__ */ __name(() => {
           clearTimeout(authenticationTimeout);
+          socks5Client.removeListener("authenticated", onAuthenticated);
           socks5Client.removeListener("error", onAuthenticationError);
+        }, "cleanupAuthenticationListeners");
+        const onAuthenticated = /* @__PURE__ */ __name(() => {
+          cleanupAuthenticationListeners();
           authenticationReady.resolve();
         }, "onAuthenticated");
         const onAuthenticationError = /* @__PURE__ */ __name((err) => {
-          clearTimeout(authenticationTimeout);
-          socks5Client.removeListener("authenticated", onAuthenticated);
+          cleanupAuthenticationListeners();
           authenticationReady.reject(err);
         }, "onAuthenticationError");
         if (socks5Client.state === STATES.AUTHENTICATED) {
@@ -11330,18 +11418,25 @@ var require_socks5_proxy_agent = __commonJS({
         await authenticationReady.promise;
         await socks5Client.connect(targetHost, targetPort);
         const connectionReady = Promise.withResolvers();
-        const connectionTimeout = setTimeout(() => {
-          connectionReady.reject(new Error("SOCKS5 connection timeout"));
-        }, 5e3);
-        const onConnected = /* @__PURE__ */ __name((info) => {
-          debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
+        const connectionTimeout = this[kConnectTimeout] === 0 ? null : setTimeout(() => {
+          cleanupConnectionListeners();
+          socks5Client.destroy();
+          connectionReady.reject(
+            createConnectTimeoutError(targetHost, targetPort, this[kConnectTimeout])
+          );
+        }, this[kConnectTimeout]);
+        const cleanupConnectionListeners = /* @__PURE__ */ __name(() => {
           clearTimeout(connectionTimeout);
+          socks5Client.removeListener("connected", onConnected);
           socks5Client.removeListener("error", onConnectionError);
+        }, "cleanupConnectionListeners");
+        const onConnected = /* @__PURE__ */ __name((info) => {
+          debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
+          cleanupConnectionListeners();
           connectionReady.resolve();
         }, "onConnected");
         const onConnectionError = /* @__PURE__ */ __name((err) => {
-          clearTimeout(connectionTimeout);
-          socks5Client.removeListener("connected", onConnected);
+          cleanupConnectionListeners();
           connectionReady.reject(err);
         }, "onConnectionError");
         socks5Client.once("connected", onConnected);
@@ -11381,8 +11476,26 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: this[kRequestTls]?.servername || targetHost
                     });
                     const tlsReady = Promise.withResolvers();
-                    finalSocket.once("secureConnect", tlsReady.resolve);
-                    finalSocket.once("error", tlsReady.reject);
+                    const cleanupTlsListeners = /* @__PURE__ */ __name(() => {
+                      queueMicrotask(clearTlsTimeout);
+                      finalSocket.removeListener("secureConnect", onSecureConnect);
+                      finalSocket.removeListener("error", onTlsError);
+                    }, "cleanupTlsListeners");
+                    const onSecureConnect = /* @__PURE__ */ __name(() => {
+                      cleanupTlsListeners();
+                      tlsReady.resolve();
+                    }, "onSecureConnect");
+                    const onTlsError = /* @__PURE__ */ __name((err) => {
+                      cleanupTlsListeners();
+                      tlsReady.reject(err);
+                    }, "onTlsError");
+                    const clearTlsTimeout = setupConnectTimeout(new WeakRef(finalSocket), {
+                      timeout: this[kRequestTlsTimeout],
+                      hostname: targetHost,
+                      port: targetPort
+                    });
+                    finalSocket.once("secureConnect", onSecureConnect);
+                    finalSocket.once("error", onTlsError);
                     await tlsReady.promise;
                   }
                   callback(null, finalSocket);
@@ -11453,6 +11566,7 @@ var require_proxy_agent = __commonJS({
     var Client = require_client();
     var { channels } = require_diagnostics();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
+    var { hasSafeIterator } = require_util();
     var kAgent = /* @__PURE__ */ Symbol("proxy agent");
     var kClient = /* @__PURE__ */ Symbol("proxy client");
     var kProxyHeaders = /* @__PURE__ */ Symbol("proxy headers");
@@ -11549,7 +11663,7 @@ var require_proxy_agent = __commonJS({
           throw new InvalidArgumentError("Proxy opts.clientFactory must be a function.");
         }
         const { proxyTunnel, connectTimeout } = opts;
-        super();
+        super(opts);
         const url = this.#getUrl(opts);
         const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url;
         this[kProxy] = { uri: href, protocol };
@@ -11582,6 +11696,7 @@ var require_proxy_agent = __commonJS({
               factory: agentFactory,
               username: opts.username || username,
               password: opts.password || password,
+              connectTimeout,
               proxyTls: opts.proxyTls,
               requestTls: opts.requestTls
             });
@@ -11723,6 +11838,13 @@ var require_proxy_agent = __commonJS({
         }
         return headersPair;
       }
+      if (headers && typeof headers === "object" && hasSafeIterator(headers)) {
+        const headersPair = {};
+        for (const [key, value] of headers) {
+          headersPair[key] = value;
+        }
+        return headersPair;
+      }
       return headers;
     }
     __name(buildHeaders, "buildHeaders");
@@ -11766,7 +11888,7 @@ var require_env_http_proxy_agent = __commonJS({
       #noProxyEntries = null;
       #opts = null;
       constructor(opts = {}) {
-        super();
+        super(opts);
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
         this[kNoProxyAgent] = new Agent(agentOpts);
@@ -11806,6 +11928,9 @@ var require_env_http_proxy_agent = __commonJS({
       #getProxyAgentForUrl(url) {
         let { protocol, host: hostname, port } = url;
         hostname = hostname.replace(/:\d*$/, "").replace(/^\[(.+)\]$/, "$1").toLowerCase();
+        if (hostname.length > 1 && hostname.charCodeAt(hostname.length - 1) === 46) {
+          hostname = hostname.slice(0, -1);
+        }
         port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0;
         if (!this.#shouldProxy(hostname, port)) {
           return this[kNoProxyAgent];
@@ -11861,8 +11986,8 @@ var require_env_http_proxy_agent = __commonJS({
             port = parsed ? Number.parseInt(parsed[2], 10) : 0;
           }
           noProxyEntries.push({
-            // strip leading dot or asterisk with dot
-            hostname: hostname.replace(/^\*?\./, "").toLowerCase(),
+            // strip leading dot or asterisk with dot, and any trailing dot
+            hostname: hostname.replace(/^\*?\./, "").replace(/^(.+)\.$/, "$1").toLowerCase(),
             port
           });
         }
@@ -13386,7 +13511,7 @@ var require_request2 = __commonJS({
         serviceWorkers: init.serviceWorkers ?? "all",
         initiator: init.initiator ?? "",
         destination: init.destination ?? "",
-        priority: init.priority ?? null,
+        priority: init.priority ?? "auto",
         origin: init.origin ?? "client",
         policyContainer: init.policyContainer ?? "client",
         referrer: init.referrer ?? "client",
@@ -13558,8 +13683,7 @@ var require_request2 = __commonJS({
       {
         key: "priority",
         converter: webidl.converters.DOMString,
-        allowedValues: ["high", "low", "auto"],
-        defaultValue: /* @__PURE__ */ __name(() => "auto", "defaultValue")
+        allowedValues: ["high", "low", "auto"]
       }
     ]);
     module2.exports = {
@@ -13777,6 +13901,7 @@ var require_fetch = __commonJS({
     var EE = require("node:events");
     var { Readable, pipeline, finished, isErrored, isReadable } = require("node:stream");
     var { addAbortListener, bufferToLowerCasedHeaderName } = require_util();
+    var { SocketError } = require_errors();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher: getGlobalDispatcher2 } = require_global2();
     var { webidl } = require_webidl();
@@ -14854,6 +14979,9 @@ var require_fetch = __commonJS({
               },
               onRequestUpgrade(controller, status, headers, socket) {
                 if (socket.session != null && status !== 200 || socket.session == null && status !== 101) {
+                  if (socket.session != null) {
+                    controller.abort(new SocketError("bad upgrade", null));
+                  }
                   return false;
                 }
                 const rawHeaders = controller?.rawHeaders ?? [];
@@ -15605,7 +15733,7 @@ var require_connection = __commonJS({
           const secProtocol = response.headersList.get("Sec-WebSocket-Protocol");
           if (secProtocol !== null) {
             const requestProtocols = getDecodeSplit("sec-websocket-protocol", request.headersList);
-            if (!requestProtocols.includes(secProtocol)) {
+            if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
               failWebsocketConnection(handler, 1002, "Protocol was not set in the opening handshake.");
               return;
             }
@@ -15729,6 +15857,7 @@ var require_permessage_deflate = __commonJS({
             if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
               callback(new MessageSizeExceededError());
               this.#inflate.removeAllListeners();
+              this.#inflate.destroy();
               this.#inflate = null;
               return;
             }
@@ -16768,6 +16897,7 @@ var require_util4 = __commonJS({
 var require_eventsource_stream = __commonJS({
   "lib/web/eventsource/eventsource-stream.js"(exports2, module2) {
     "use strict";
+    var buffer = require("node:buffer");
     var { Transform } = require("node:stream");
     var { isASCIINumber, isValidLastEventId } = require_util4();
     var BOM = [239, 187, 191];
@@ -16775,25 +16905,26 @@ var require_eventsource_stream = __commonJS({
     var CR = 13;
     var COLON = 58;
     var SPACE = 32;
+    var defaultMaxEventSize = buffer.kStringMaxLength;
     var DATA = Buffer.from("data");
     var EVENT = Buffer.from("event");
     var ID = Buffer.from("id");
     var RETRY = Buffer.from("retry");
-    function isASCIINumberBytes(buffer, start) {
-      if (start >= buffer.length) {
+    function isASCIINumberBytes(buffer2, start) {
+      if (start >= buffer2.length) {
         return false;
       }
-      for (let i = start; i < buffer.length; i++) {
-        if (buffer[i] < 48 || buffer[i] > 57) {
+      for (let i = start; i < buffer2.length; i++) {
+        if (buffer2[i] < 48 || buffer2[i] > 57) {
           return false;
         }
       }
       return true;
     }
     __name(isASCIINumberBytes, "isASCIINumberBytes");
-    function isValidLastEventIdBytes(buffer, start) {
-      for (let i = start; i < buffer.length; i++) {
-        if (buffer[i] === 0) {
+    function isValidLastEventIdBytes(buffer2, start) {
+      for (let i = start; i < buffer2.length; i++) {
+        if (buffer2[i] === 0) {
           return false;
         }
       }
@@ -16812,6 +16943,12 @@ var require_eventsource_stream = __commonJS({
       return true;
     }
     __name(isFieldName, "isFieldName");
+    function createMaxEventSizeExceededError() {
+      const error = new Error("EventSource message size exceeded");
+      error.aborted = false;
+      return error;
+    }
+    __name(createMaxEventSizeExceededError, "createMaxEventSizeExceededError");
     var EventSourceStream = class extends Transform {
       static {
         __name(this, "EventSourceStream");
@@ -16841,6 +16978,8 @@ var require_eventsource_stream = __commonJS({
       pos = 0;
       lineChunkIndex = 0;
       linePos = 0;
+      eventDataSize = 0;
+      maxEventSize;
       event = {
         data: void 0,
         event: void 0,
@@ -16850,6 +16989,7 @@ var require_eventsource_stream = __commonJS({
       /**
        * @param {object} options
        * @param {boolean} [options.readableObjectMode]
+       * @param {number} [options.maxEventSize]
        * @param {eventSourceSettings} [options.eventSourceSettings]
        * @param {(chunk: any, encoding?: BufferEncoding | undefined) => boolean} [options.push]
        */
@@ -16857,6 +16997,7 @@ var require_eventsource_stream = __commonJS({
         options.readableObjectMode = true;
         super(options);
         this.state = options.eventSourceSettings || {};
+        this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize;
         if (options.push) {
           this.push = options.push;
         }
@@ -16908,7 +17049,12 @@ var require_eventsource_stream = __commonJS({
             if (byte === CR) {
               this.crlfCheck = true;
             }
-            this.parseLine(this.readLine(), this.event);
+            try {
+              this.parseLine(this.readLine(), this.event);
+            } catch (error) {
+              callback(error);
+              return;
+            }
             this.consumeCurrentByte();
             this.eventEndCheck = true;
             continue;
@@ -16939,6 +17085,11 @@ var require_eventsource_stream = __commonJS({
           }
         }
         if (isFieldName(line, fieldLength, DATA)) {
+          const valueBytes = line.length - valueStart;
+          const eventDataSize = this.eventDataSize + (event.data === void 0 ? 0 : 1) + valueBytes;
+          if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+            throw createMaxEventSizeExceededError();
+          }
           const value = line.toString("utf8", valueStart);
           if (event.data === void 0) {
             event.data = value;
@@ -16946,6 +17097,7 @@ var require_eventsource_stream = __commonJS({
             event.data += `
 ${value}`;
           }
+          this.eventDataSize = eventDataSize;
           return;
         }
         if (isFieldName(line, fieldLength, RETRY)) {
@@ -16993,6 +17145,7 @@ ${value}`;
         this.event.event = void 0;
         this.event.id = void 0;
         this.event.retry = void 0;
+        this.eventDataSize = 0;
       }
       hasPendingEvent() {
         return this.event.data !== void 0 || this.event.event !== void 0 || this.event.id !== void 0 || this.event.retry !== void 0;
@@ -17122,9 +17275,12 @@ var require_eventsource = __commonJS({
     var { parseMIMEType } = require_data_url();
     var { createFastMessageEvent: createFastMessageEvent2 } = require_events();
     var { isNetworkError } = require_response();
-    var { kEnumerableProperty } = require_util();
+    var { isValidHeaderValue, kEnumerableProperty } = require_util();
     var { environmentSettingsObject } = require_util2();
     var { createPotentialCORSRequest } = require_util4();
+    var { getGlobalDispatcher: getGlobalDispatcher2 } = require_global2();
+    var { isomorphicDecode } = require_infra();
+    var textEncoder = new TextEncoder();
     var experimentalWarned = false;
     var defaultReconnectionTime = 3e3;
     var CONNECTING = 0;
@@ -17261,6 +17417,7 @@ var require_eventsource = __commonJS({
           this.#state.origin = response.urlList[response.urlList.length - 1].origin;
           const eventSourceStream = new EventSourceStream({
             eventSourceSettings: this.#state,
+            maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
             push: /* @__PURE__ */ __name((event) => {
               this.dispatchEvent(createFastMessageEvent2(
                 event.type,
@@ -17291,8 +17448,12 @@ var require_eventsource = __commonJS({
         this.dispatchEvent(new Event("error"));
         setTimeout(() => {
           if (this.#readyState !== CONNECTING) return;
+          this.#request.headersList.delete("last-event-id", true);
           if (this.#state.lastEventId.length) {
-            this.#request.headersList.set("last-event-id", this.#state.lastEventId, true);
+            const lastEventId = isomorphicDecode(textEncoder.encode(this.#state.lastEventId));
+            if (isValidHeaderValue(lastEventId)) {
+              this.#request.headersList.set("last-event-id", lastEventId, true);
+            }
           }
           this.#connect();
         }, this.#state.reconnectionTime)?.unref();
@@ -17397,7 +17558,8 @@ var require_eventsource = __commonJS({
       {
         key: "dispatcher",
         // undici only
-        converter: webidl.converters.any
+        converter: webidl.converters.any,
+        defaultValue: /* @__PURE__ */ __name(() => getGlobalDispatcher2(), "defaultValue")
       },
       {
         key: "node",
diff --git a/deps/uv/unofficial.gni b/deps/uv/unofficial.gni
index 0944d6ddd241..a2891887839b 100644
--- a/deps/uv/unofficial.gni
+++ b/deps/uv/unofficial.gni
@@ -4,113 +4,126 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("uv_gn_build") {
-  config("uv_external_config") {
-    include_dirs = [ "include" ]
-    if (is_clang || !is_win) {
-      cflags_cc = [
-        "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
-      ]
-    }
-  }
-
-  config("uv_internal_config") {
-    include_dirs = [
-      "include",
-      "src",
-    ]
+import("../../node.gni")
 
-    defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
-    if (is_posix) {
-      defines += [
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-      ]
+template("uv_gn_build") {
+  if (node_shared_libuv) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("uv_external_config") {
+      packages = [ "libuv" ]
     }
-    if (is_linux) {
-      defines += [
-        "_POSIX_C_SOURCE=200112",
-        "_GNU_SOURCE",
-      ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":uv_external_config" ]
     }
-    if (is_apple) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_DARWIN_UNLIMITED_SELECT=1",
-      ]
+  } else {
+    config("uv_external_config") {
+      include_dirs = [ "include" ]
+      if (is_clang || !is_win) {
+        cflags_cc = [
+          "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
+        ]
+      }
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-deprecated-declarations",
-        "-Wno-extra-semi",
-        "-Wno-implicit-fallthrough",
-        "-Wno-missing-braces",
-        "-Wno-sign-compare",
-        "-Wno-string-conversion",
-        "-Wno-shadow",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-        "-Wno-unused-but-set-parameter",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-result",
-        "-Wno-unused-variable",
+
+    config("uv_internal_config") {
+      include_dirs = [
+        "include",
+        "src",
       ]
+
+      defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
+      if (is_posix) {
+        defines += [
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+        ]
+      }
+      if (is_linux) {
+        defines += [
+          "_POSIX_C_SOURCE=200112",
+          "_GNU_SOURCE",
+        ]
+      }
+      if (is_apple) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_DARWIN_UNLIMITED_SELECT=1",
+        ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-deprecated-declarations",
+          "-Wno-extra-semi",
+          "-Wno-implicit-fallthrough",
+          "-Wno-missing-braces",
+          "-Wno-sign-compare",
+          "-Wno-string-conversion",
+          "-Wno-shadow",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+          "-Wno-unused-but-set-parameter",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-result",
+          "-Wno-unused-variable",
+        ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("uv.gyp") ],
-                            "scope",
-                            [ "uv.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("uv.gyp") ],
+                              "scope",
+                              [ "uv.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    configs += [ ":uv_internal_config" ]
-    public_configs = [ ":uv_external_config" ]
+      configs += [ ":uv_internal_config" ]
+      public_configs = [ ":uv_external_config" ]
 
-    if (is_posix) {
-      configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
-      configs += [ "//build/config/gcc:symbol_visibility_default" ]
-    }
+      if (is_posix) {
+        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
+        configs += [ "//build/config/gcc:symbol_visibility_default" ]
+      }
 
-    if (is_win) {
-      libs = [
-        "advapi32.lib",
-        "iphlpapi.lib",
-        "psapi.lib",
-        "shell32.lib",
-        "user32.lib",
-        "userenv.lib",
-        "ws2_32.lib",
-      ]
-    }
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
-    }
-    if (is_linux) {
-      libs = [
-        "m",
-        "dl",
-        "rt",
-      ]
-    }
+      if (is_win) {
+        libs = [
+          "advapi32.lib",
+          "iphlpapi.lib",
+          "psapi.lib",
+          "shell32.lib",
+          "user32.lib",
+          "userenv.lib",
+          "ws2_32.lib",
+        ]
+      }
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
+      if (is_linux) {
+        libs = [
+          "m",
+          "dl",
+          "rt",
+        ]
+      }
 
-    sources = gypi_values.uv_sources_common
-    if (is_win) {
-      sources += gypi_values.uv_sources_win
-    }
-    if (is_posix) {
-      sources += gypi_values.uv_sources_posix +
-                 [ "src/unix/proctitle.c" ]
-    }
-    if (is_linux) {
-      sources += gypi_values.uv_sources_linux
-    }
-    if (is_apple) {
-      sources += gypi_values.uv_sources_apple +
-                 gypi_values.uv_sources_bsd_common
+      sources = gypi_values.uv_sources_common
+      if (is_win) {
+        sources += gypi_values.uv_sources_win
+      }
+      if (is_posix) {
+        sources += gypi_values.uv_sources_posix +
+                   [ "src/unix/proctitle.c" ]
+      }
+      if (is_linux) {
+        sources += gypi_values.uv_sources_linux
+      }
+      if (is_apple) {
+        sources += gypi_values.uv_sources_apple +
+                   gypi_values.uv_sources_bsd_common
+      }
     }
   }
 }
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index fbd628370c0b..48da5b35b872 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -3741,14 +3741,6 @@ bool Value::IsTypedArray() const {
 TYPED_ARRAYS_BASE(VALUE_IS_TYPED_ARRAY)
 #undef VALUE_IS_TYPED_ARRAY
 
-bool Value::IsFloat16Array() const {
-  auto obj = *Utils::OpenDirectHandle(this);
-  return i::IsJSTypedArray(obj) &&
-         i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array &&
-         Utils::ApiCheck(i::v8_flags.js_float16array, "Value::IsFloat16Array",
-                         "Float16Array is not supported");
-}
-
 bool Value::IsDataView() const {
   auto obj = *Utils::OpenDirectHandle(this);
   return IsJSDataView(obj) || IsJSRabGsabDataView(obj);
@@ -4292,16 +4284,6 @@ void v8::TypedArray::CheckCast(Value* that) {
 TYPED_ARRAYS_BASE(CHECK_TYPED_ARRAY_CAST)
 #undef CHECK_TYPED_ARRAY_CAST
 
-void v8::Float16Array::CheckCast(Value* that) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::Cast",
-                  "Float16Array is not supported");
-  auto obj = *Utils::OpenDirectHandle(that);
-  Utils::ApiCheck(
-      i::IsJSTypedArray(obj) &&
-          i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array,
-      "v8::Float16Array::Cast()", "Value is not a Float16Array");
-}
-
 void v8::DataView::CheckCast(Value* that) {
   auto obj = *Utils::OpenDirectHandle(that);
   Utils::ApiCheck(i::IsJSDataView(obj) || IsJSRabGsabDataView(obj),
@@ -9347,44 +9329,6 @@ static_assert(v8::TypedArray::kMaxByteLength == i::JSTypedArray::kMaxByteLength,
 TYPED_ARRAYS_BASE(TYPED_ARRAY_NEW)
 #undef TYPED_ARRAY_NEW
 
-Local<Float16Array> Float16Array::New(Local<ArrayBuffer> array_buffer,
-                                      size_t byte_offset, size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<ArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-Local<Float16Array> Float16Array::New(
-    Local<SharedArrayBuffer> shared_array_buffer, size_t byte_offset,
-    size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<SharedArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*shared_array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-
 // TODO(v8:11111): Support creating length tracking DataViews via the API.
 Local<DataView> DataView::New(Local<ArrayBuffer> array_buffer,
                               size_t byte_offset, size_t byte_length) {
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index 34424db08dc0..0b6e43dde6ea 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -863,12 +863,6 @@ Builtins::JSBuiltinStateFlags Builtins::GetJSBuiltinState(Builtin builtin) {
       RETURN_FLAG_DEPENDENT_BUILTIN_STATE(
           v8_flags.js_explicit_resource_management);
 
-    // --js-float16array
-    case Builtin::kMathF16round:
-    case Builtin::kDataViewPrototypeGetFloat16:
-    case Builtin::kDataViewPrototypeSetFloat16:
-      RETURN_FLAG_DEPENDENT_BUILTIN_STATE(v8_flags.js_float16array);
-
     // --js-base-64
     case Builtin::kUint8ArrayFromBase64:
     case Builtin::kUint8ArrayFromHex:
diff --git a/deps/v8/src/deoptimizer/translated-state.cc b/deps/v8/src/deoptimizer/translated-state.cc
index a8c87dbd0242..6aa94999ac28 100644
--- a/deps/v8/src/deoptimizer/translated-state.cc
+++ b/deps/v8/src/deoptimizer/translated-state.cc
@@ -1889,6 +1889,31 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
   }
 }
 
+// static
+std::optional<Tagged<Object>> TranslatedState::TryResolveTaggedValue(
+    DeoptTranslationIterator* it, Address fp,
+    Tagged<DeoptimizationLiteralArray> literals) {
+  TranslationOpcode opcode = it->NextOpcode();
+  switch (opcode) {
+    case TranslationOpcode::LITERAL: {
+      int literal_index = it->NextOperand();
+      return literals->get(literal_index);
+    }
+    case TranslationOpcode::TAGGED_STACK_SLOT: {
+      int slot_offset =
+          OptimizedJSFrame::StackSlotOffsetRelativeToFp(it->NextOperand());
+      intptr_t value = *reinterpret_cast<intptr_t*>(fp + slot_offset);
+      return Tagged<Object>(DecompressIfNeeded(value));
+    }
+    default:
+      // Any other encoding (unboxed numerics, register-resident values,
+      // captured objects, etc.) requires the full TranslatedState path to
+      // materialize. Caller should fall back.
+      it->SkipOperands(TranslationOpcodeOperandCount(opcode));
+      return std::nullopt;
+  }
+}
+
 TranslatedState::TranslatedState(const JavaScriptFrame* frame)
     : purpose_(kFrameInspection) {
   int deopt_index = SafepointEntry::kNoDeoptIndex;
diff --git a/deps/v8/src/deoptimizer/translated-state.h b/deps/v8/src/deoptimizer/translated-state.h
index dfa5f11e8209..07daaf4be395 100644
--- a/deps/v8/src/deoptimizer/translated-state.h
+++ b/deps/v8/src/deoptimizer/translated-state.h
@@ -511,6 +511,17 @@ class TranslatedState {
   void VerifyMaterializedObjects();
   bool DoUpdateFeedback(DeoptimizeReason reason);
 
+  // Resolves one deopt translation value opcode to a raw Tagged<Object>,
+  // reading from the live frame if needed.  Only LITERAL and
+  // TAGGED_STACK_SLOT can be resolved cheaply; for any other opcode the
+  // iterator is left positioned just past the opcode and std::nullopt is
+  // returned so the caller can fall back to the full materialization path.
+  static std::optional<Tagged<Object>> TryResolveTaggedValue(
+      DeoptTranslationIterator* it, Address fp,
+      Tagged<DeoptimizationLiteralArray> literals);
+
+  static Address DecompressIfNeeded(intptr_t value);
+
  private:
   friend TranslatedValue;
 
@@ -529,7 +540,6 @@ class TranslatedState {
       int frame_index, DeoptTranslationIterator* iterator,
       const DeoptimizationLiteralProvider& literal_array, Address fp,
       RegisterValues* registers, FILE* trace_file);
-  Address DecompressIfNeeded(intptr_t value);
   void CreateArgumentsElementsTranslatedValues(int frame_index,
                                                Address input_frame_pointer,
                                                CreateArgumentsType type,
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 110abb96f250..f587dd49e36d 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -3179,7 +3179,118 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
         "Missing deoptimization information for OptimizedJSFrame::Summarize.");
   }
 
-  // Prepare iteration over translation. We must not materialize values here
+  // Lightweight walk: iterate frame headers only, resolving just the
+  // function and receiver from the live frame via ResolveTaggedValue.
+  // This avoids the expensive TranslatedState::Init + Prepare path that
+  // would parse every value in every inlined frame.
+
+  Tagged<DeoptimizationLiteralArray> literal_array = data->LiteralArray();
+
+  // Lightweight walk: resolve function and receiver from live frame headers
+  // and build JavaScriptFrameSummary objects directly.
+  bool needs_full_walk = false;
+  {
+    DisallowGarbageCollection no_gc;
+    DeoptimizationFrameTranslation::Iterator it(
+        data->FrameTranslation(), data->TranslationIndex(deopt_index).value());
+    bool is_constructor = IsConstructor();
+    int remaining = it.EnterBeginOpcode().total_frame_count;
+
+    while (remaining > 0) {
+      TranslationOpcode opcode = it.SeekNextFrame();
+      remaining--;
+
+      if (opcode == TranslationOpcode::CONSTRUCT_CREATE_STUB_FRAME ||
+          opcode == TranslationOpcode::CONSTRUCT_INVOKE_STUB_FRAME) {
+        is_constructor = true;
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      if (!IsTranslationJsFrameOpcode(opcode)) {
+#if V8_ENABLE_WEBASSEMBLY
+        // Wasm-inlined-into-JS frames need the full TranslatedState
+        // machinery to produce WasmFrameSummary entries.
+        if (opcode == TranslationOpcode::WASM_INLINED_INTO_JS_FRAME) {
+          needs_full_walk = true;
+          break;
+        }
+#endif
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      bool is_builtin_cont =
+          (opcode == TranslationOpcode::JAVASCRIPT_BUILTIN_CONTINUATION_FRAME ||
+           opcode == TranslationOpcode::
+                         JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH_FRAME);
+
+      int bytecode_offset = it.NextOperand();
+      int sfi_id = it.NextOperand();
+      Tagged<SharedFunctionInfo> sfi =
+          Cast<SharedFunctionInfo>(literal_array->get(sfi_id));
+
+      // Skip remaining header operands to reach the values.
+      it.SkipOperands(TranslationOpcodeOperandCount(opcode) - 2);
+
+      // Resolve closure and receiver from the live frame.  The closure is
+      // always tagged (LITERAL or TAGGED_STACK_SLOT), but the receiver is
+      // just parameter 0 of the (possibly inlined) frame and may be encoded
+      // in any representation the optimizer chose (e.g. DOUBLE_STACK_SLOT
+      // for an unboxed Float64). Fall back to the full materialization path
+      // in that case.
+      std::optional<Tagged<Object>> function_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      DCHECK(function_obj.has_value());
+      DCHECK(IsJSFunction(*function_obj));
+      std::optional<Tagged<Object>> receiver_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      if (!receiver_obj.has_value()) {
+        needs_full_walk = true;
+        break;
+      }
+
+      Tagged<AbstractCode> abstract_code;
+      int code_offset;
+      if (is_builtin_cont) {
+        code_offset = 0;
+        abstract_code = Cast<AbstractCode>(
+            isolate()->builtins()->code(Builtins::GetBuiltinFromBytecodeOffset(
+                BytecodeOffset(bytecode_offset))));
+      } else {
+        code_offset = bytecode_offset;
+        abstract_code = Cast<AbstractCode>(sfi->GetBytecodeArray(isolate()));
+      }
+
+      DirectHandle<FixedArray> params = GetParameters(never_allocate);
+      FrameSummary::JavaScriptFrameSummary summary(
+          isolate(), *receiver_obj, Cast<JSFunction>(*function_obj),
+          abstract_code, code_offset, is_constructor, *params);
+      summaries.frames.push_back(summary);
+      is_constructor = false;
+    }
+
+    if (!needs_full_walk && is_constructor) {
+      summaries.top_frame_is_construct_call = true;
+    }
+  }  // no_gc scope ends.
+
+  if (needs_full_walk) {
+    return SummarizeFull(data, deopt_index, never_allocate);
+  }
+
+  return summaries;
+}
+
+FrameSummaries OptimizedJSFrame::SummarizeFull(Tagged<DeoptimizationData> data,
+                                               int deopt_index,
+                                               bool never_allocate) const {
+  FrameSummaries summaries;
+
+  DCHECK_NE(deopt_index, SafepointEntry::kNoDeoptIndex);
+  DCHECK(!data.is_null());
+
+  // Prepare iteration over translation.  We must not materialize values here
   // because we do not deoptimize the function.
   TranslatedState translated(this);
   translated.Prepare(fp());
@@ -3204,7 +3315,21 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
       // Get the correct receiver in the optimized frame.
       static_assert(TranslatedFrame::kReceiverIsFirstParameterInJSFrames);
       CHECK(!translated_values->IsMaterializedObject());
-      DirectHandle<Object> receiver = translated_values->GetValue();
+      // Check GetRawValue() against arguments_marker() first to see whether
+      // calling GetValue() allocates.
+      Tagged<Object> receiver_obj = translated_values->GetRawValue();
+      DirectHandle<Object> receiver;
+      if (receiver_obj == ReadOnlyRoots(isolate()).arguments_marker() &&
+          never_allocate) {
+        // Calling GetValue() would definitely trigger allocation but with
+        // `never_allocate` allocations are not allowed. Simply pick `undefined`
+        // as receiver instead even though it is off. `never_allocate` is
+        // currently only used for OOM stacks, where we don't even emit the
+        // receiver but want to see as many stack frames as possible.
+        receiver = isolate()->factory()->undefined_value();
+      } else {
+        receiver = translated_values->GetValue();
+      }
       translated_values++;
 
       // Determine the underlying code object and the position within it from
@@ -3311,24 +3436,20 @@ int TurbofanJSFrame::FindReturnPCForTrampoline(Tagged<Code> code,
   return safepoints.find_return_pc(trampoline_pc);
 }
 
-Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
-    Tagged<Code> code, int* deopt_index) const {
-  DCHECK(is_optimized());
-
-  Address pc = maybe_unauthenticated_pc();
-
-  DCHECK(code->contains(isolate(), pc));
+// static
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationDataForPC(
+    Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index) {
+  DCHECK(code->contains(isolate, pc));
   DCHECK(CodeKindCanDeoptimize(code->kind()));
-
   if (code->is_maglevved()) {
     MaglevSafepointEntry safepoint_entry =
-        code->GetMaglevSafepointEntry(isolate(), pc);
+        code->GetMaglevSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
     }
   } else {
-    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate(), pc);
+    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
@@ -3338,6 +3459,14 @@ Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
   return {};
 }
 
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
+    Tagged<Code> code, int* deopt_index) const {
+  DCHECK(is_optimized());
+  Address pc = maybe_unauthenticated_pc();
+  DCHECK(code->contains(isolate(), pc));
+  return GetDeoptimizationDataForPC(isolate(), code, pc, deopt_index);
+}
+
 void OptimizedJSFrame::GetFunctions(
     std::vector<Tagged<SharedFunctionInfo>>* functions) const {
   DCHECK(functions->empty());
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index 017613a7305a..550fdde93671 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -1169,6 +1169,11 @@ class OptimizedJSFrame : public JavaScriptFrame {
   Tagged<DeoptimizationData> GetDeoptimizationData(Tagged<Code> code,
                                                    int* deopt_index) const;
 
+  // Like GetDeoptimizationData, but takes an explicit PC instead of reading
+  // it from the frame.  Can be used without a live frame.
+  static Tagged<DeoptimizationData> GetDeoptimizationDataForPC(
+      Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index);
+
   static int StackSlotOffsetRelativeToFp(int slot_index);
 
   // Lookup exception handler for current {pc}, returns -1 if none found.
@@ -1178,6 +1183,13 @@ class OptimizedJSFrame : public JavaScriptFrame {
   virtual int FindReturnPCForTrampoline(Tagged<Code> code,
                                         int trampoline_pc) const = 0;
 
+ private:
+  // Full TranslatedState-based walk, used as fallback when the lightweight
+  // path in Summarize() encounters frames it cannot handle (e.g.
+  // wasm-inlined-into-JS frames).
+  FrameSummaries SummarizeFull(Tagged<DeoptimizationData> data, int deopt_index,
+                               bool never_allocate) const;
+
  protected:
   inline explicit OptimizedJSFrame(StackFrameIteratorBase* iterator);
 };
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 06fa14bf6b10..74762de5a9aa 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -878,18 +878,21 @@ class CallSiteBuilder {
     // framework and library code, and stack depth tends to be more than
     // a dozen frames, so we over-allocate a bit here to avoid growing
     // the elements array in the common case.
-    elements_ = isolate->factory()->NewFixedArray(std::min(64, limit));
+    elements_ = isolate->factory()->NewFixedArray(CallSiteInfo::Fields::kCount *
+                                                  std::min(64, limit));
   }
 
   void SetPrevFrameAsConstructCall() {
     if (skipped_prev_frame_) return;
     DCHECK_GT(index_, 0);
-    Tagged<CallSiteInfo> info =
-        Tagged<CallSiteInfo>::cast(elements_->get(index_ - 1));
+    int base_index = (index_ - 1) * CallSiteInfo::Fields::kCount;
+    int flags =
+        Smi::ToInt(elements_->get(base_index + CallSiteInfo::Fields::kFlags));
 #if V8_ENABLE_WEBASSEMBLY
-    if (info->IsWasm()) return;
+    if (flags & CallSiteInfo::kIsWasm) return;
 #endif
-    info->set_flags(info->flags() | CallSiteInfo::kIsConstructor);
+    elements_->set(base_index + CallSiteInfo::Fields::kFlags,
+                   Smi::FromInt(flags | CallSiteInfo::kIsConstructor));
   }
 
   bool Visit(FrameSummary const& summary) {
@@ -1051,7 +1054,8 @@ class CallSiteBuilder {
   bool Full() { return index_ >= limit_; }
 
   Handle<FixedArray> Build() {
-    return FixedArray::RightTrimOrEmpty(isolate_, elements_, index_);
+    return FixedArray::RightTrimOrEmpty(isolate_, elements_,
+                                        CallSiteInfo::Fields::kCount * index_);
   }
 
  private:
@@ -1114,19 +1118,70 @@ class CallSiteBuilder {
     return true;
   }
 
+ public:
+  // Store a deferred entry for a baseline frame.
+  // Stores the Code + raw PC offset; bytecode offset resolution
+  // happens lazily in ExpandDeferredFrames().
+  bool AppendDeferredFrame(JavaScriptFrame* frame, int deferred_flag) {
+    if (Full()) return false;
+    DirectHandle<JSFunction> function(frame->function(), isolate_);
+    if (!IsVisibleInStackTrace(function)) {
+      skipped_prev_frame_ = true;
+      return true;
+    }
+    int flags = deferred_flag;
+    if (IsStrictFrame(function)) flags |= CallSiteInfo::kIsStrict;
+    if (frame->IsConstructor()) flags |= CallSiteInfo::kIsConstructor;
+
+    Tagged<Code> code = frame->LookupCode();
+    int pc_offset = static_cast<int>(frame->pc() - code->instruction_start());
+
+    AppendFrame(Cast<UnionOf<JSAny, Hole>>(handle(frame->receiver(), isolate_)),
+                function, handle(code, isolate_), pc_offset, flags,
+                frame->GetParameters(/*never_allocate=*/false));
+    return true;
+  }
+
   void AppendFrame(DirectHandle<UnionOf<JSAny, Hole>> receiver_or_instance,
                    DirectHandle<UnionOf<Smi, JSFunction>> function,
-                   DirectHandle<HeapObject> code, int offset, int flags,
+                   DirectHandle<HeapObject> code_obj, int offset, int flags,
                    DirectHandle<FixedArray> parameters) {
     if (IsTheHole(*receiver_or_instance, isolate_)) {
       // TODO(jgruber): Fix all cases in which frames give us a hole value
       // (e.g. the receiver in RegExp constructor frames).
       receiver_or_instance = isolate_->factory()->undefined_value();
     }
-    auto info = isolate_->factory()->NewCallSiteInfo(
-        Cast<JSAny>(receiver_or_instance), function, code, offset, flags,
-        parameters);
-    elements_ = FixedArray::SetAndGrow(isolate_, elements_, index_++, info);
+
+    int base_index = index_ * CallSiteInfo::Fields::kCount;
+
+    // Set the last field first and grow the array if needed.
+    static_assert(CallSiteInfo::Fields::kFlags ==
+                  CallSiteInfo::Fields::kCount - 1);
+    elements_ = FixedArray::SetAndGrow(
+        isolate_, elements_, base_index + CallSiteInfo::Fields::kFlags,
+        Smi::FromInt(flags));
+
+    elements_->set(base_index + CallSiteInfo::Fields::kReceiver,
+                   *receiver_or_instance);
+    elements_->set(base_index + CallSiteInfo::Fields::kFunction, *function);
+
+    if (DirectHandle<Code> code; TryCast(code_obj, &code)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode, code->wrapper());
+    } else if (DirectHandle<BytecodeArray> bytecode;
+               TryCast(code_obj, &bytecode)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     bytecode->wrapper());
+    } else {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     *isolate_->factory()->undefined_value());
+    }
+
+    elements_->set(base_index + CallSiteInfo::Fields::kOffset,
+                   Smi::FromInt(offset));
+    elements_->set(base_index + CallSiteInfo::Fields::kParameters,
+                   *parameters);
+
+    index_++;
     skipped_prev_frame_ = false;
   }
 
@@ -1357,18 +1412,16 @@ void CaptureAsyncStackTrace(Isolate* isolate, CallSiteBuilder* builder) {
   }
 }
 
+// Summarize a single frame and pass each logical frame to the visitor.
 template <typename Visitor>
 void VisitStack(Isolate* isolate, Visitor* visitor,
                 StackTrace::StackTraceOptions options = StackTrace::kDetailed,
                 bool never_allocate = false) {
   DisallowJavascriptExecution no_js(isolate);
-  // Keep track if we visited a stack frame, but did not visit any summarized
-  // frames. Either because the stack frame didn't create any summarized frames
-  // or due to security origin.
-  bool skipped_last_frame = true;
   for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
     StackFrame* frame = it.frame();
     switch (frame->type()) {
+      case StackFrame::BASELINE:
       case StackFrame::API_CALLBACK_EXIT:
       case StackFrame::API_CONSTRUCT_EXIT:
       case StackFrame::BUILTIN_EXIT:
@@ -1377,7 +1430,6 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
       case StackFrame::TURBOFAN_JS:
       case StackFrame::MAGLEV:
       case StackFrame::INTERPRETED:
-      case StackFrame::BASELINE:
       case StackFrame::BUILTIN:
 #if V8_ENABLE_WEBASSEMBLY
       case StackFrame::STUB:
@@ -1392,14 +1444,73 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
         // inlining).
         FrameSummaries summaries =
             CommonFrame::cast(frame)->Summarize(never_allocate);
+        for (auto& summary : base::Reversed(summaries.frames)) {
+          // Skip frames from other origins when asked to do so.
+          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
+              !summary.native_context()->HasSameSecurityTokenAs(
+                  isolate->context())) {
+            continue;
+          }
+          if (!visitor->Visit(summary)) return;
+        }
+        break;
+      }
+
+      default:
+        break;
+    }
+  }
+}
+
+// Specialized stack walk for CallSiteBuilder, handling deferred baseline
+// frames and the construct-call flag on the previous frame.
+void VisitStack_ForCallSiteBuilder(Isolate* isolate, CallSiteBuilder* visitor) {
+  DisallowJavascriptExecution no_js(isolate);
+  // Track whether the last physical frame produced any visited summarized
+  // frames. Used to correctly attribute construct-call flags.
+  bool skipped_last_frame = true;
+  for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+    StackFrame* frame = it.frame();
+    switch (frame->type()) {
+      case StackFrame::BASELINE:
+        // Baseline frames are captured as deferred entries so they can be
+        // expanded later without blocking the stack capture path.
+        if (!visitor->AppendDeferredFrame(
+                JavaScriptFrame::cast(frame),
+                CallSiteInfo::kIsDeferredBaselineFrame)) {
+          return;
+        }
+        skipped_last_frame = true;
+        break;
+      case StackFrame::API_CALLBACK_EXIT:
+      case StackFrame::API_CONSTRUCT_EXIT:
+      case StackFrame::BUILTIN_EXIT:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH:
+      case StackFrame::TURBOFAN_JS:
+      case StackFrame::MAGLEV:
+      case StackFrame::INTERPRETED:
+      case StackFrame::BUILTIN:
+#if V8_ENABLE_WEBASSEMBLY
+      case StackFrame::STUB:
+      case StackFrame::WASM:
+      case StackFrame::WASM_SEGMENT_START:
+#if V8_ENABLE_DRUMBRAKE
+      case StackFrame::WASM_INTERPRETER_ENTRY:
+#endif  // V8_ENABLE_DRUMBRAKE
+#endif  // V8_ENABLE_WEBASSEMBLY
+      {
+        // A standard frame may include many summarized frames (due to
+        // inlining).
+        FrameSummaries summaries = CommonFrame::cast(frame)->Summarize();
         if (summaries.top_frame_is_construct_call && !skipped_last_frame) {
           visitor->SetPrevFrameAsConstructCall();
         }
         skipped_last_frame = true;
         for (auto& summary : base::Reversed(summaries.frames)) {
-          // Skip frames from other origins when asked to do so.
-          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
-              !summary.native_context()->HasSameSecurityTokenAs(
+          // CaptureSimpleStackTrace uses kDetailed, which does not expose
+          // frames across security origins.
+          if (!summary.native_context()->HasSameSecurityTokenAs(
                   isolate->context())) {
             continue;
           }
@@ -1426,7 +1537,7 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 #endif  // V8_ENABLE_WEBASSEMBLY
 
   CallSiteBuilder builder(isolate, mode, limit, caller);
-  VisitStack(isolate, &builder);
+  VisitStack_ForCallSiteBuilder(isolate, &builder);
 
   // If --async-stack-traces are enabled and the "current microtask" is a
   // PromiseReactionJobTask, we try to enrich the stack trace with async
@@ -1442,13 +1553,21 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 }
 
 DirectHandle<StackTraceInfo> GetDetailedStackTraceFromCallSiteInfos(
-    Isolate* isolate, DirectHandle<FixedArray> call_site_infos, int limit) {
-  auto frames = isolate->factory()->NewFixedArray(
-      std::min(limit, call_site_infos->length()));
-  int index = 0;
-  for (int i = 0; i < call_site_infos->length() && index < limit; ++i) {
-    DirectHandle<CallSiteInfo> call_site_info(
-        Cast<CallSiteInfo>(call_site_infos->get(i)), isolate);
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos,
+    uint32_t limit) {
+  Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+      isolate, handle(*raw_data_for_call_site_infos, isolate));
+  raw_data_for_call_site_infos = expanded;
+  uint32_t call_site_infos_len =
+      raw_data_for_call_site_infos->length() /
+      CallSiteInfo::Fields::kCount;
+  auto frames =
+      isolate->factory()->NewFixedArray(std::min(limit, call_site_infos_len));
+  uint32_t index = 0;
+  for (uint32_t i = 0; i < call_site_infos_len && index < limit; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(isolate,
+                                           raw_data_for_call_site_infos, i);
     if (call_site_info->IsAsync()) {
       break;
     }
@@ -1519,14 +1638,19 @@ MaybeDirectHandle<JSObject> Isolate::CaptureAndSetErrorStack(
           stack_trace_for_uncaught_exceptions_frame_limit_,
           stack_trace_for_uncaught_exceptions_options_);
     } else {
-      auto call_site_infos =
+      auto raw_data_for_call_site_infos =
           Cast<FixedArray>(call_site_infos_or_formatted_stack);
       stack_trace = GetDetailedStackTraceFromCallSiteInfos(
-          this, call_site_infos,
-          stack_trace_for_uncaught_exceptions_frame_limit_);
-      if (stack_trace_limit < call_site_infos->length()) {
+          this, raw_data_for_call_site_infos,
+          static_cast<uint32_t>(
+              stack_trace_for_uncaught_exceptions_frame_limit_));
+      DCHECK_GE(stack_trace_limit, 0);
+      if (static_cast<int>(stack_trace_limit) *
+              CallSiteInfo::Fields::kCount <
+          raw_data_for_call_site_infos->length()) {
         call_site_infos_or_formatted_stack = FixedArray::RightTrimOrEmpty(
-            this, call_site_infos, stack_trace_limit);
+            this, raw_data_for_call_site_infos,
+            stack_trace_limit * CallSiteInfo::Fields::kCount);
       }
       // Notify the debugger.
       OnStackTraceCaptured(stack_trace);
@@ -1556,17 +1680,29 @@ Handle<FixedArray> Isolate::GetSimpleStackTrace(
   ErrorUtils::StackPropertyLookupResult lookup =
       ErrorUtils::GetErrorStackProperty(this, maybe_error_object);
 
+  Handle<FixedArray> raw_data;
   if (IsFixedArray(*lookup.error_stack)) {
-    return Cast<FixedArray>(lookup.error_stack);
-  }
-  if (!IsErrorStackData(*lookup.error_stack)) {
+    raw_data = Cast<FixedArray>(lookup.error_stack);
+  } else if (IsErrorStackData(*lookup.error_stack)) {
+    auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
+    if (!error_stack_data->HasRawDataForCallSiteInfos()) {
+      return factory()->empty_fixed_array();
+    }
+    raw_data = handle(error_stack_data->raw_data_for_call_site_infos(), this);
+  } else {
     return factory()->empty_fixed_array();
   }
-  auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
-  if (!error_stack_data->HasCallSiteInfos()) {
-    return factory()->empty_fixed_array();
+
+  raw_data = CallSiteInfo::ExpandDeferredFrames(this, raw_data);
+
+  int frame_count = raw_data->length() / CallSiteInfo::Fields::kCount;
+  Handle<FixedArray> call_site_infos = factory()->NewFixedArray(frame_count);
+  for (int i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(this, raw_data, i);
+    call_site_infos->set(i, *call_site_info);
   }
-  return handle(error_stack_data->call_site_infos(), this);
+  return call_site_infos;
 }
 
 Address Isolate::GetAbstractPC(int* line, int* column) {
@@ -1616,10 +1752,6 @@ class StackFrameBuilder {
         index_(0),
         limit_(limit) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Check if we have enough capacity left.
     if (index_ >= limit_) return false;
@@ -1664,10 +1796,6 @@ class CurrentScriptNameStackVisitor {
   explicit CurrentScriptNameStackVisitor(Isolate* isolate)
       : isolate_(isolate) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1696,10 +1824,6 @@ class CurrentScriptNameStackVisitor {
 
 class CurrentScriptIdStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1729,10 +1853,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
     DCHECK_LT(0, frame_data.size());
   }
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (!summary.is_subject_to_debugging()) return true;
 
@@ -1778,10 +1898,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
 
 class CurrentScriptStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1919,10 +2035,6 @@ class MinimalStackPrinter {
 
   explicit MinimalStackPrinter(size_t max_length) : max_length_(max_length) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (summary.IsJavaScript()) {
       const FrameSummary::JavaScriptFrameSummary& js_summary =
@@ -3164,12 +3276,16 @@ Tagged<Object> Isolate::ThrowIllegalOperation() {
 void Isolate::PrintCurrentStackTrace(
     std::ostream& out,
     PrintCurrentStackTraceFilterCallback should_include_frame_callback) {
-  DirectHandle<FixedArray> frames = CaptureSimpleStackTrace(
+  Handle<FixedArray> frames = CaptureSimpleStackTrace(
       this, FixedArray::kMaxLength, SKIP_NONE, factory()->undefined_value());
+  frames = CallSiteInfo::ExpandDeferredFrames(this, frames);
 
   IncrementalStringBuilder builder(this);
-  for (int i = 0; i < frames->length(); ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)), this);
+  uint32_t frame_count =
+      frames->length() / CallSiteInfo::Fields::kCount;
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame =
+        CallSiteInfo::ConstructFromRawData(this, frames, i);
 
     if (should_include_frame_callback) {
       Tagged<Object> raw_script_name = frame->GetScriptNameOrSourceURL();
@@ -3193,7 +3309,7 @@ void Isolate::PrintCurrentStackTrace(
       SerializeCallSiteInfo(this, frame, &builder);
     }
 
-    if (i != frames->length() - 1) builder.AppendCharacter('\n');
+    if (i != frame_count - 1) builder.AppendCharacter('\n');
   }
 
   DirectHandle<String> stack_trace = builder.Finish().ToHandleChecked();
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index b24aafc1be43..64800baec261 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -24,6 +24,7 @@
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/roots/roots.h"
+#include "src/sandbox/indirect-pointer-inl.h"
 #include "src/strings/string-builder-inl.h"
 
 namespace v8 {
@@ -202,15 +203,16 @@ namespace {
 
 // Convert the raw frames as written by Isolate::CaptureSimpleStackTrace into
 // a JSArray of JSCallSite objects.
-MaybeDirectHandle<JSArray> GetStackFrames(Isolate* isolate,
-                                          DirectHandle<FixedArray> frames) {
-  int frame_count = frames->length();
+MaybeDirectHandle<JSArray> GetStackFrames(
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos) {
+  uint32_t frame_count = raw_data_for_call_site_infos->length() /
+                         CallSiteInfo::Fields::kCount;
   DirectHandle<JSFunction> constructor = isolate->callsite_function();
   DirectHandle<FixedArray> sites =
       isolate->factory()->NewFixedArray(frame_count);
-  for (int i = 0; i < frame_count; ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)),
-                                     isolate);
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
     DirectHandle<JSObject> site;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, site,
                                JSObject::New(constructor, constructor,
@@ -292,7 +294,7 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
     return isolate->factory()->empty_string();
   }
   DCHECK(IsFixedArray(*raw_stack));
-  auto elems = Cast<FixedArray>(raw_stack);
+  auto raw_data_for_call_site_infos = Cast<FixedArray>(raw_stack);
 
   const bool in_recursion = isolate->formatting_stack_trace();
   const bool has_overflowed = i::StackLimitCheck{isolate}.HasOverflowed();
@@ -303,8 +305,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
       PrepareStackTraceScope scope(isolate);
 
       DirectHandle<JSArray> sites;
-      ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                 GetStackFrames(isolate, elems));
+      ASSIGN_RETURN_ON_EXCEPTION(
+          isolate, sites,
+          GetStackFrames(isolate, raw_data_for_call_site_infos));
 
       DirectHandle<Object> result;
       ASSIGN_RETURN_ON_EXCEPTION(
@@ -329,8 +332,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
         isolate->CountUsage(v8::Isolate::kErrorPrepareStackTrace);
 
         DirectHandle<JSArray> sites;
-        ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                   GetStackFrames(isolate, elems));
+        ASSIGN_RETURN_ON_EXCEPTION(
+            isolate, sites,
+            GetStackFrames(isolate, raw_data_for_call_site_infos));
 
         constexpr int argc = 2;
         std::array<DirectHandle<Object>, argc> args;
@@ -359,12 +363,16 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
 
   RETURN_ON_EXCEPTION(isolate, AppendErrorString(isolate, error, &builder));
 
-  for (int i = 0; i < elems->length(); ++i) {
+  int elems_len = raw_data_for_call_site_infos->length() /
+                       CallSiteInfo::Fields::kCount;
+  for (int i = 0; i < elems_len; ++i) {
     builder.AppendCStringLiteral("\n    at ");
 
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(elems->get(i)),
-                                     isolate);
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
 
+    // TODO(marja): Avoid CallSiteInfo creation since we serialize it right
+    // away.
     v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
     SerializeCallSiteInfo(isolate, frame, &builder);
 
@@ -1160,12 +1168,13 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
 
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate,
+        handle(error_stack_data->raw_data_for_call_site_infos(), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(
-            isolate, error_object,
-            direct_handle(error_stack_data->call_site_infos(), isolate)));
+        FormatStackTrace(isolate, error_object, expanded));
     error_stack_data->set_formatted_stack(*formatted_stack);
     return formatted_stack;
   }
@@ -1173,11 +1182,12 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
   if (IsFixedArray(*lookup.error_stack)) {
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate, handle(Cast<FixedArray>(*lookup.error_stack), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(isolate, error_object,
-                         Cast<FixedArray>(lookup.error_stack)));
+        FormatStackTrace(isolate, error_object, expanded));
     RETURN_ON_EXCEPTION(
         isolate, Object::SetProperty(isolate, error_object,
                                      isolate->factory()->error_stack_symbol(),
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index aab9435dbb53..15d4341ff84b 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -344,8 +344,6 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
   V(js_error_iserror, "Error.isError")                                       \
   V(js_regexp_escape, "RegExp.escape")                                       \
   V(js_explicit_resource_management, "explicit resource management")         \
-  V(js_float16array,                                                         \
-    "Float16Array, Math.f16round, DataView.getFloat16, DataView.setFloat16") \
   V(js_base_64, "Uint8Array to/from base64 and hex")                         \
   V(js_esm_ns_reexport,                                                      \
     "Support diamond-importing re-expored namespaces "                       \
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 32b47dee39ff..2fc11e822292 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -1589,13 +1589,14 @@ DirectHandle<InterceptorInfo> Factory::NewInterceptorInfo(
 }
 
 DirectHandle<ErrorStackData> Factory::NewErrorStackData(
-    DirectHandle<UnionOf<JSAny, FixedArray>> call_site_infos_or_formatted_stack,
+    DirectHandle<UnionOf<JSAny, FixedArray>>
+        raw_data_for_call_site_infos_or_formatted_stack,
     DirectHandle<StackTraceInfo> stack_trace) {
   Tagged<ErrorStackData> error_stack_data = NewStructInternal<ErrorStackData>(
       ERROR_STACK_DATA_TYPE, AllocationType::kYoung);
   DisallowGarbageCollection no_gc;
-  error_stack_data->set_call_site_infos_or_formatted_stack(
-      *call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
+  error_stack_data->set_raw_data_for_call_site_infos_or_formatted_stack(
+      *raw_data_for_call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
   error_stack_data->set_stack_trace(*stack_trace, SKIP_WRITE_BARRIER);
   return direct_handle(error_stack_data, isolate());
 }
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 67abd4458664..bba53c6a5872 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -472,7 +472,7 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   DirectHandle<ErrorStackData> NewErrorStackData(
       DirectHandle<UnionOf<JSAny, FixedArray>>
-          call_site_infos_or_formatted_stack,
+          raw_data_for_call_site_infos_or_formatted_stack,
       DirectHandle<StackTraceInfo> stack_trace);
 
   Handle<Script> CloneScript(DirectHandle<Script> script,
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index ba75a3a17df2..dca2648b3a93 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -3483,6 +3483,8 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     SimpleInstallFunction(isolate_, math, "exp", Builtin::kMathExp, 1, kAdapt);
     SimpleInstallFunction(isolate_, math, "floor", Builtin::kMathFloor, 1,
                           kAdapt);
+    SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
+                          kAdapt);
     SimpleInstallFunction(isolate_, math, "fround", Builtin::kMathFround, 1,
                           kAdapt);
     SimpleInstallFunction(isolate_, math, "hypot", Builtin::kMathHypot, 2,
@@ -4330,6 +4332,10 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
                           Builtin::kDataViewPrototypeGetUint32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setUint32",
                           Builtin::kDataViewPrototypeSetUint32, 2, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "getFloat16",
+                          Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "setFloat16",
+                          Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "getFloat32",
                           Builtin::kDataViewPrototypeGetFloat32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setFloat32",
@@ -5084,11 +5090,6 @@ DirectHandle<JSFunction> Genesis::InstallTypedArray(
           GetCorrespondingRabGsabElementsKind(elements_kind), 0);
   rab_gsab_initial_map->SetConstructor(*result);
 
-  if (rab_gsab_initial_map_index == Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX &&
-      v8_flags.js_float16array) {
-    LOG(isolate(), MapDetails(*rab_gsab_initial_map));
-  }
-
   native_context()->set(rab_gsab_initial_map_index, *rab_gsab_initial_map,
                         UPDATE_WRITE_BARRIER, kReleaseStore);
   Map::SetPrototype(isolate(), rab_gsab_initial_map, prototype);
@@ -5869,34 +5870,6 @@ void Genesis::InitializeGlobal_js_explicit_resource_management() {
       kAdapt);
 }
 
-void Genesis::InitializeGlobal_js_float16array() {
-  if (!v8_flags.js_float16array) return;
-
-  DirectHandle<JSGlobalObject> global(native_context()->global_object(),
-                                      isolate());
-  DirectHandle<JSObject> math = Cast<JSObject>(
-      JSReceiver::GetProperty(isolate(), global, "Math").ToHandleChecked());
-
-  SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
-                        kAdapt);
-
-  DirectHandle<JSObject> dataview_prototype(
-      Cast<JSObject>(native_context()->data_view_fun()->instance_prototype()),
-      isolate());
-
-  SimpleInstallFunction(isolate_, dataview_prototype, "getFloat16",
-                        Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
-  SimpleInstallFunction(isolate_, dataview_prototype, "setFloat16",
-                        Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
-
-  DirectHandle<JSFunction> fun = InstallTypedArray(
-      "Float16Array", FLOAT16_ELEMENTS, FLOAT16_TYPED_ARRAY_CONSTRUCTOR_TYPE,
-      Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX);
-
-  InstallWithIntrinsicDefaultProto(isolate_, fun,
-                                   Context::FLOAT16_ARRAY_FUN_INDEX);
-}
-
 void Genesis::InitializeGlobal_js_regexp_escape() {
   if (!v8_flags.js_regexp_escape) return;
 
diff --git a/deps/v8/src/objects/call-site-info.cc b/deps/v8/src/objects/call-site-info.cc
index f0a390cdf825..fa1a0f15a6b2 100644
--- a/deps/v8/src/objects/call-site-info.cc
+++ b/deps/v8/src/objects/call-site-info.cc
@@ -7,7 +7,9 @@
 #include <optional>
 
 #include "src/base/strings.h"
+#include "src/builtins/builtins.h"
 #include "src/objects/call-site-info-inl.h"
+#include "src/objects/code-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/strings/string-builder-inl.h"
 
@@ -17,6 +19,73 @@
 
 namespace v8::internal {
 
+// static
+DirectHandle<CallSiteInfo> CallSiteInfo::ConstructFromRawData(
+    Isolate* isolate, DirectHandle<FixedArray> frames, int index) {
+  int base_index = index * Fields::kCount;
+  DirectHandle<Object> receiver(frames->get(base_index + Fields::kReceiver),
+                                isolate);
+  DirectHandle<Object> function(frames->get(base_index + Fields::kFunction),
+                                isolate);
+  DirectHandle<Object> code_obj(frames->get(base_index + Fields::kCode),
+                                isolate);
+  DirectHandle<Union<Code, BytecodeArray, Undefined>> resolved_code;
+  if (IsCodeWrapper(*code_obj)) {
+    resolved_code = handle(Cast<CodeWrapper>(code_obj)->code(isolate), isolate);
+  } else if (IsBytecodeWrapper(*code_obj)) {
+    resolved_code =
+        handle(Cast<BytecodeWrapper>(code_obj)->bytecode(isolate), isolate);
+  } else if (IsUndefined(*code_obj)) {
+    resolved_code = isolate->factory()->undefined_value();
+  } else {
+    UNREACHABLE();
+  }
+
+  int offset = Smi::ToInt(frames->get(base_index + Fields::kOffset));
+  DirectHandle<FixedArray> parameters(
+      Cast<FixedArray>(frames->get(base_index + Fields::kParameters)), isolate);
+  int flags = Smi::ToInt(frames->get(base_index + Fields::kFlags));
+
+  return isolate->factory()->NewCallSiteInfo(
+      Cast<JSAny>(receiver), Cast<UnionOf<Smi, JSFunction>>(function),
+      resolved_code, offset, flags, parameters);
+}
+
+// static
+Handle<FixedArray> CallSiteInfo::ExpandDeferredFrames(
+    Isolate* isolate, Handle<FixedArray> raw_data) {
+  int entry_count = raw_data->length() / Fields::kCount;
+
+  // Resolve deferred baseline frames in-place (PC offset → bytecode offset).
+  for (int i = 0; i < entry_count; i++) {
+    int base = i * Fields::kCount;
+    int flags = Smi::ToInt(raw_data->get(base + Fields::kFlags));
+
+    if (flags & kIsDeferredBaselineFrame) {
+      // Resolve the bytecode offset from the raw PC offset.
+      Tagged<Object> code_obj = raw_data->get(base + Fields::kCode);
+      CHECK(IsCodeWrapper(code_obj));
+      Tagged<Code> code = Cast<CodeWrapper>(code_obj)->code(isolate);
+      int pc_offset = Smi::ToInt(raw_data->get(base + Fields::kOffset));
+      Tagged<BytecodeArray> bytecode_array =
+          Cast<JSFunction>(raw_data->get(base + Fields::kFunction))
+              ->shared()
+              ->GetBytecodeArray(isolate);
+      int bytecode_offset = code->GetBytecodeOffsetForBaselinePC(
+          code->instruction_start() + pc_offset, bytecode_array);
+
+      raw_data->set(base + Fields::kCode, bytecode_array->wrapper());
+      raw_data->set(base + Fields::kOffset, Smi::FromInt(bytecode_offset));
+
+      // Strip deferred flags.
+      int clean_flags = flags & ~kDeferredFlagsMask;
+      raw_data->set(base + Fields::kFlags, Smi::FromInt(clean_flags));
+    }
+  }
+
+  return raw_data;
+}
+
 bool CallSiteInfo::IsPromiseAll() const {
   if (!IsAsync()) return false;
   Tagged<JSFunction> fun = Cast<JSFunction>(function());
diff --git a/deps/v8/src/objects/call-site-info.h b/deps/v8/src/objects/call-site-info.h
index cb4d8433f141..bea45215aeaa 100644
--- a/deps/v8/src/objects/call-site-info.h
+++ b/deps/v8/src/objects/call-site-info.h
@@ -80,6 +80,33 @@ V8_OBJECT class CallSiteInfo : public StructLayout {
   // Used to signal that the requested field is unknown.
   static constexpr int kUnknown = kNoSourcePosition;
 
+  // For delayed CallSiteInfo creation (storing the raw data for several
+  // CallSiteInfos in a FixedArray).
+  // kFlags must stay last (see CallSiteBuilder::AppendFrame).
+  enum Fields {
+    kCode = 0,
+    kReceiver,
+    kFunction,
+    kOffset,
+    kParameters,
+    kFlags,
+    kCount
+  };
+
+  // Deferred flags: defined in the Torque bitfield, but only meaningful in
+  // raw capture arrays.  Stripped before creating actual CallSiteInfo objects.
+  static constexpr int kDeferredFlagsMask = kIsDeferredBaselineFrame;
+
+  static DirectHandle<CallSiteInfo> ConstructFromRawData(
+      Isolate* isolate, DirectHandle<FixedArray> frames, int index);
+
+  // Expand a raw stack-capture array that may contain deferred entries
+  // (optimized/baseline frames that were not Summarize'd at capture time)
+  // into a fully-resolved raw array where every entry corresponds to one
+  // logical JS frame.  Non-deferred entries are copied as-is.
+  static Handle<FixedArray> ExpandDeferredFrames(Isolate* isolate,
+                                                 Handle<FixedArray> raw_data);
+
   V8_EXPORT_PRIVATE static int GetLineNumber(DirectHandle<CallSiteInfo> info);
   V8_EXPORT_PRIVATE static int GetColumnNumber(DirectHandle<CallSiteInfo> info);
 
diff --git a/deps/v8/src/objects/call-site-info.tq b/deps/v8/src/objects/call-site-info.tq
index f9585b2324a3..3df40cee3b3c 100644
--- a/deps/v8/src/objects/call-site-info.tq
+++ b/deps/v8/src/objects/call-site-info.tq
@@ -14,6 +14,11 @@ bitfield struct CallSiteInfoFlags extends uint31 {
 
   // whether offset_or_source_position contains the source position.
   is_source_position_computed: bool: 1 bit;
+
+  // Only meaningful in raw capture arrays, stripped before creating
+  // CallSiteInfo objects.  Indicates the entry stores a Code + raw PC offset
+  // that needs resolution to a BytecodeArray + bytecode offset.
+  is_deferred_baseline_frame: bool: 1 bit;
 }
 
 @cppObjectLayoutDefinition
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index 1b282108b96e..41a4dea1cd8a 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -84,18 +84,20 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(StackTraceInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(ErrorStackData)
 
 bool ErrorStackData::HasFormattedStack() const {
-  return !IsFixedArray(call_site_infos_or_formatted_stack());
+  return !IsFixedArray(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 ACCESSORS_RELAXED_CHECKED2(ErrorStackData, formatted_stack, Tagged<Object>,
-                           kCallSiteInfosOrFormattedStackOffset,
+                           kRawDataForCallSiteInfosOrFormattedStackOffset,
                            HasFormattedStack(), true)
 
-bool ErrorStackData::HasCallSiteInfos() const { return !HasFormattedStack(); }
+bool ErrorStackData::HasRawDataForCallSiteInfos() const {
+  return !HasFormattedStack();
+}
 
-DEF_GETTER(ErrorStackData, call_site_infos, Tagged<FixedArray>) {
-  DCHECK(HasCallSiteInfos());
-  return Cast<FixedArray>(call_site_infos_or_formatted_stack());
+DEF_GETTER(ErrorStackData, raw_data_for_call_site_infos, Tagged<FixedArray>) {
+  DCHECK(HasRawDataForCallSiteInfos());
+  return Cast<FixedArray>(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index e4ffa7ecf174..2ae518dcc190 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -254,8 +254,8 @@ class ErrorStackData
  public:
   inline bool HasFormattedStack() const;
   DECL_ACCESSORS(formatted_stack, Tagged<Object>)
-  inline bool HasCallSiteInfos() const;
-  DECL_GETTER(call_site_infos, Tagged<FixedArray>)
+  inline bool HasRawDataForCallSiteInfos() const;
+  DECL_GETTER(raw_data_for_call_site_infos, Tagged<FixedArray>)
 
   DECL_VERIFIER(ErrorStackData)
 
diff --git a/deps/v8/src/objects/debug-objects.tq b/deps/v8/src/objects/debug-objects.tq
index 630a134971bb..607f2abf4418 100644
--- a/deps/v8/src/objects/debug-objects.tq
+++ b/deps/v8/src/objects/debug-objects.tq
@@ -102,10 +102,10 @@ extern class StackTraceInfo extends Struct {
 // (2) A valid JavaScript object and StackTraceInfo once
 //     error.stack was accessed.
 extern class ErrorStackData extends Struct {
-  // This holds either the FixedArray of CallSiteInfo instances or
-  // the formatted stack value (usually a string) that's returned
-  // from the error.stack property.
-  call_site_infos_or_formatted_stack: FixedArray|JSAny;
+  // This holds either the FixedArray of raw data for constructing the
+  // CallSiteInfo instances or the formatted stack value (usually a string)
+  // that's returned from the error.stack property.
+  raw_data_for_call_site_infos_or_formatted_stack: FixedArray|JSAny;
   // This holds the StackTraceInfo for inspector stack trace.
   stack_trace: StackTraceInfo;
 }
diff --git a/deps/v8/src/objects/elements-kind.h b/deps/v8/src/objects/elements-kind.h
index 7be923774f2c..2383a6a3a401 100644
--- a/deps/v8/src/objects/elements-kind.h
+++ b/deps/v8/src/objects/elements-kind.h
@@ -26,13 +26,10 @@ namespace internal {
   V(BigInt64, bigint64, BIGINT64, int64_t)               \
   V(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) \
   V(Float32, float32, FLOAT32, float)                    \
-  V(Float64, float64, FLOAT64, double)
+  V(Float64, float64, FLOAT64, double)                   \
+  V(Float16, float16, FLOAT16, uint16_t)
 
-#define TYPED_ARRAYS_FLOAT16(V) V(Float16, float16, FLOAT16, uint16_t)
-
-#define TYPED_ARRAYS(V) \
-  TYPED_ARRAYS_BASE(V)  \
-  TYPED_ARRAYS_FLOAT16(V)
+#define TYPED_ARRAYS(V) TYPED_ARRAYS_BASE(V)
 
 #define RAB_GSAB_TYPED_ARRAYS_BASE(V)                                    \
   V(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8, uint8_t)               \
@@ -46,14 +43,10 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, \
     uint8_t)                                                             \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)           \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)          \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
-#define RAB_GSAB_TYPED_ARRAYS(V) \
-  RAB_GSAB_TYPED_ARRAYS_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_FLOAT16(V)
+#define RAB_GSAB_TYPED_ARRAYS(V) RAB_GSAB_TYPED_ARRAYS_BASE(V)
 
 // The TypedArrays backed by RAB / GSAB are called Uint8Array, Uint16Array etc,
 // and not RabGsabUint8Array, RabGsabUint16Array etc. This macro is used for
@@ -69,14 +62,11 @@ namespace internal {
   V(BigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64, int64_t)               \
   V(Uint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) \
   V(Float32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)                    \
-  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V) \
+  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)                   \
   V(Float16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)
 
 // Like RAB_GSAB_TYPED_ARRAYS but has an additional parameter for
 // for the corresponding non-RAB/GSAB ElementsKind.
@@ -93,14 +83,11 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED,      \
     uint8_t, UINT8_CLAMPED)                                                   \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float, FLOAT32)       \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)      \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t, FLOAT16)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)
 
 enum ElementsKind : uint8_t {
   // The "fast" kind for elements that only contain SMI values. Must be first
diff --git a/deps/v8/src/objects/fixed-array.cc b/deps/v8/src/objects/fixed-array.cc
index 28eebb5acec0..88bbe5655c8f 100644
--- a/deps/v8/src/objects/fixed-array.cc
+++ b/deps/v8/src/objects/fixed-array.cc
@@ -21,10 +21,9 @@ bool FixedArrayBase::IsCowArray() const {
 template <template <typename> typename HandleType>
   requires(
       std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
-HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
-                                              HandleType<FixedArray> array,
-                                              int index,
-                                              DirectHandle<Object> value) {
+HandleType<FixedArray> FixedArray::Grow(Isolate* isolate,
+                                        HandleType<FixedArray> array,
+                                        int index) {
   int len = array->length();
   if (index >= len) {
     int new_capacity = FixedArray::NewCapacityForIndex(index, len);
@@ -33,7 +32,17 @@ HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
     // use `undefined` as a filler. Make this more explicit.
     array->FillWithHoles(len, new_capacity);
   }
+  return array;
+}
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              DirectHandle<Object> value) {
+  array = Grow(isolate, array, index);
   array->set(index, *value);
   return array;
 }
@@ -45,6 +54,25 @@ template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
     Isolate* isolate, IndirectHandle<FixedArray> array, int index,
     DirectHandle<Object> value);
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              Tagged<Smi> value) {
+  array = Grow(isolate, array, index);
+  array->set(index, value);
+  return array;
+}
+
+template DirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, DirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, IndirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+
 void FixedArray::RightTrim(Isolate* isolate, int new_capacity) {
   DCHECK_NE(map(), ReadOnlyRoots{isolate}.fixed_cow_array_map());
   Super::RightTrim(isolate, new_capacity);
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index e634550ae8f9..a0adf5e49011 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -259,6 +259,12 @@ V8_OBJECT class FixedArray
   V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
       Isolate* isolate, HandleType<FixedArray> array, int index,
       DirectHandle<Object> value);
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
+      Isolate* isolate, HandleType<FixedArray> array, int index,
+      Tagged<Smi> value);
 
   // Right-trim the array.
   // Invariant: 0 < new_length <= length()
@@ -289,6 +295,13 @@ V8_OBJECT class FixedArray
   static constexpr int kMaxRegularLength = FixedArray::kMaxRegularCapacity;
 
  private:
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  static HandleType<FixedArray> Grow(Isolate* isolate,
+                                     HandleType<FixedArray> array,
+                                     int index);
+
   inline static Handle<FixedArray> Resize(
       Isolate* isolate, DirectHandle<FixedArray> xs, int new_capacity,
       AllocationType allocation = AllocationType::kYoung,
diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc
index def468a73920..1cbe14d654bd 100644
--- a/deps/v8/src/objects/value-serializer.cc
+++ b/deps/v8/src/objects/value-serializer.cc
@@ -2301,13 +2301,6 @@ MaybeDirectHandle<JSArrayBufferView> ValueDeserializer::ReadJSArrayBufferView(
     break;
       TYPED_ARRAYS_BASE(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
-    case ArrayBufferViewTag::kFloat16Array: {
-      if (i::v8_flags.js_float16array) {
-        external_array_type = kExternalFloat16Array;
-        element_size = sizeof(uint16_t);
-      }
-      break;
-    }
   }
   if (element_size == 0 || byte_offset % element_size != 0 ||
       byte_length % element_size != 0) {
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index ace7c1370ad0..a74b20fa8eb1 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -1100,7 +1100,6 @@ TEST(SubclassArrayBuiltinNoInlineNew) {
 
 
 TEST(SubclassTypedArrayBuiltin) {
-  v8_flags.js_float16array = true;
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
 
diff --git a/deps/v8/test/cctest/test-typedarrays.cc b/deps/v8/test/cctest/test-typedarrays.cc
index ce256fec8f0b..40d3cdde0fc4 100644
--- a/deps/v8/test/cctest/test-typedarrays.cc
+++ b/deps/v8/test/cctest/test-typedarrays.cc
@@ -115,20 +115,17 @@ void TestSpeciesProtector(char* code,
 }
 
 UNINITIALIZED_TEST(SpeciesConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "x.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesConstructorAccessor) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(x, 'constructor',{get() {return MyTypedArray;}})";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesModified) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(constructor, Symbol.species, "
       "{value:MyTypedArray})";
@@ -136,7 +133,6 @@ UNINITIALIZED_TEST(SpeciesModified) {
 }
 
 UNINITIALIZED_TEST(SpeciesParentConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "constructor.prototype.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-499260582.js b/deps/v8/test/mjsunit/regress/regress-499260582.js
new file mode 100644
index 000000000000..08e4a2daf9b1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-499260582.js
@@ -0,0 +1,20 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --jit-fuzzing --single-threaded
+
+function f9(a10, a11) {
+    'use strict';
+    for (let v12 = 0; v12 < 5; v12++) {
+        const v15 = ({ maxByteLength: 1073741824 }).maxByteLength;
+        %OptimizeOsr();
+        function F16(a18, a19, a20) {
+            if (!new.target) { throw 'must be called with new'; }
+        }
+        try { F16.call(v15); } catch (e) {}
+    }
+    return f9;
+}
+%PrepareFunctionForOptimization(f9);
+f9(f9, f9);
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index aa93daaef0cd..07e03b07aaa9 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -59,7 +59,6 @@
     'import-attributes': '--harmony-import-attributes',
     'regexp-duplicate-named-groups': '--js-regexp-duplicate-named-groups',
     'regexp-modifiers': '--js-regexp-modifiers',
-    'Float16Array': '--js-float16array',
     'explicit-resource-management': '--js-explicit-resource-management',
     'decorators': '--js-decorators',
     'promise-try': '--js-promise-try',
diff --git a/deps/v8/test/unittests/objects/object-unittest.cc b/deps/v8/test/unittests/objects/object-unittest.cc
index 18032ea39fd9..d4421cd807d6 100644
--- a/deps/v8/test/unittests/objects/object-unittest.cc
+++ b/deps/v8/test/unittests/objects/object-unittest.cc
@@ -683,8 +683,6 @@ TEST_FUNCTION_KIND(IsStrictFunctionWithoutPrototype)
 #undef TEST_FUNCTION_KIND
 
 TEST_F(ObjectTest, ConstructorInstanceTypes) {
-  bool flag_was_enabled = i::v8_flags.js_float16array;
-  i::v8_flags.js_float16array = true;
   v8::HandleScope scope(isolate());
 
   DirectHandle<NativeContext> context = i_isolate()->native_context();
@@ -720,7 +718,6 @@ TEST_F(ObjectTest, ConstructorInstanceTypes) {
         break;
     }
   }
-  i::v8_flags.js_float16array = flag_was_enabled;
 }
 
 TEST_F(ObjectTest, AddDataPropertyNameCollision) {
diff --git a/deps/v8/test/unittests/objects/value-serializer-unittest.cc b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
index ee7e8acf26db..a6ce6cee63cc 100644
--- a/deps/v8/test/unittests/objects/value-serializer-unittest.cc
+++ b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
@@ -48,7 +48,6 @@ class ValueSerializerTest : public TestWithIsolate {
 
  protected:
   ValueSerializerTest() {
-    FLAG_SCOPE(js_float16array);
     Local<Context> serialization_context = Context::New(isolate());
     Local<Context> deserialization_context = Context::New(isolate());
     serialization_context_.Reset(isolate(), serialization_context);
@@ -2083,7 +2082,6 @@ TEST_F(ValueSerializerTestWithArrayBufferTransfer,
 }
 
 TEST_F(ValueSerializerTest, RoundTripTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2133,7 +2131,6 @@ TEST_F(ValueSerializerTest, RoundTripTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2158,7 +2155,6 @@ TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedNonLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
diff --git a/deps/zlib/BUILD.gn b/deps/zlib/BUILD.gn
index eff72b22a29b..c37b4252961e 100644
--- a/deps/zlib/BUILD.gn
+++ b/deps/zlib/BUILD.gn
@@ -98,10 +98,6 @@ source_set("zlib_adler32_simd") {
       "adler32_simd.c",
       "adler32_simd.h",
     ]
-
-    if (!is_win || is_clang) {
-      cflags = [ "-mssse3" ]
-    }
   }
 
   if (use_arm_neon_optimizations) {
@@ -168,6 +164,15 @@ if (use_arm_neon_optimizations) {
   }
 }
 
+# Enables 64-bit word-at-a-time compare256() in deflate's longest_match() on
+# 64-bit little-endian architectures (x64 and arm64). Follows the same pattern
+# as INFLATE_CHUNK_READ_64LE and DEFLATE_CHUNK_WRITE_64LE below.
+config("zlib_compare256_config") {
+  if (current_cpu == "x64" || current_cpu == "arm64") {
+    defines = [ "DEFLATE_COMPARE256_64LE" ]
+  }
+}
+
 config("zlib_data_chunk_simd_config") {
   if (use_x86_x64_optimizations) {
     defines = [ "INFLATE_CHUNK_SIMD_SSE2" ]
@@ -234,13 +239,6 @@ source_set("zlib_crc32_simd") {
       "crc32_simd.h",
       "crc_folding.c",
     ]
-
-    if (!is_win || is_clang) {
-      cflags = [
-        "-msse4.2",
-        "-mpclmul",
-      ]
-    }
   }
 
   configs += [ ":zlib_internal_config" ]
@@ -296,6 +294,7 @@ component("zlib") {
   sources = [
     "adler32.c",
     "chromeconf.h",
+    "compare256.h",
     "compress.c",
     "contrib/optimizations/insert_string.h",
     "cpu_features.c",
@@ -370,6 +369,7 @@ component("zlib") {
   public_configs = [ ":zlib_config" ]
 
   configs += [
+    ":zlib_compare256_config",
     ":zlib_internal_config",
 
     # Must be after no_chromium_code for warning flags to be ordered correctly.
diff --git a/deps/zlib/CMakeLists.txt b/deps/zlib/CMakeLists.txt
index b569804ace08..87d6613be3ff 100644
--- a/deps/zlib/CMakeLists.txt
+++ b/deps/zlib/CMakeLists.txt
@@ -94,6 +94,7 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
   SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pthread")
 
   if (CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
+    add_definitions(-DDEFLATE_COMPARE256_64LE)
     add_definitions(-DINFLATE_CHUNK_SIMD_SSE2)
     add_definitions(-DADLER32_SIMD_SSSE3)
     add_definitions(-DINFLATE_CHUNK_READ_64LE)
@@ -101,9 +102,6 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DCRC32_SIMD_SSE42_PCLMUL)
     if (ENABLE_SIMD_AVX512)
       add_definitions(-DCRC32_SIMD_AVX512_PCLMUL)
-      add_compile_options(-mvpclmulqdq -msse2 -mavx512f -mpclmul)
-    else()
-      add_compile_options(-msse4.2 -mpclmul)
     endif()
     add_definitions(-DDEFLATE_SLIDE_HASH_SSE2)
     # Required by CPU features detection code.
@@ -118,6 +116,7 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DDEFLATE_CHUNK_WRITE_64LE)
     add_definitions(-DCRC32_ARMV8_CRC32)
     add_definitions(-DDEFLATE_SLIDE_HASH_NEON)
+    add_definitions(-DDEFLATE_COMPARE256_64LE)
     # Required by CPU features detection code.
     if (APPLE)
       add_definitions(-DARMV8_OS_MACOS)
diff --git a/deps/zlib/adler32_simd.c b/deps/zlib/adler32_simd.c
index 08c21d3e953a..ce4ce7c5755a 100644
--- a/deps/zlib/adler32_simd.c
+++ b/deps/zlib/adler32_simd.c
@@ -53,7 +53,7 @@
 
 #include <tmmintrin.h>
 
-#if defined(__GNUC__)
+#if defined(__GNUC__) || defined(__clang__)
 __attribute__((__target__("ssse3")))
 #endif
 uint32_t ZLIB_INTERNAL adler32_simd_(  /* SSSE3 */
diff --git a/deps/zlib/compare256.h b/deps/zlib/compare256.h
new file mode 100644
index 000000000000..80061c3febbd
--- /dev/null
+++ b/deps/zlib/compare256.h
@@ -0,0 +1,56 @@
+/* compare256.h
+ *
+ * This does 256-byte match comparison for deflate's longest_match.
+ *
+ * Copyright 2026 The Chromium Authors
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+#ifndef COMPARE256_H
+#define COMPARE256_H
+
+#include <stdint.h>
+#include <string.h>
+#if defined(_MSC_VER) && !defined(__clang__)
+#include <intrin.h>
+#endif
+
+/* Safe unaligned 16-bit load. Compilers optimize this into a single load
+ * instruction. */
+static inline uint16_t read16(const void* p) {
+    uint16_t v;
+    memcpy(&v, p, sizeof(v));
+    return v;
+}
+
+/* Finds the byte offset (0..7) of the first difference in non-zero XOR mask
+ * `x`:
+ */
+static inline int compare256_diff(uint64_t x) {
+#if defined(_MSC_VER) && !defined(__clang__)
+    unsigned long i;
+    _BitScanForward64(&i, x);
+    return (int)i / 8;
+#else
+    return __builtin_ctzll(x) / 8;
+#endif
+}
+
+/* Returns the number of matching leading bytes (0 to 256) between src0 and
+ * src1. Compares 8 bytes per iteration with early exit. */
+static inline int compare256(const unsigned char* src0,
+                             const unsigned char* src1) {
+    int len = 0;
+    do {
+        uint64_t a, b, x;
+        memcpy(&a, src0 + len, sizeof(a));
+        memcpy(&b, src1 + len, sizeof(b));
+        x = a ^ b;
+        if (x)
+            return len + compare256_diff(x);
+        len += (int)sizeof(a);
+    } while (len < 256);
+    return 256;
+}
+
+#endif /* COMPARE256_H */
diff --git a/deps/zlib/contrib/tests/utils_unittest.cc b/deps/zlib/contrib/tests/utils_unittest.cc
index 6161e39f0262..51ace780d2e7 100644
--- a/deps/zlib/contrib/tests/utils_unittest.cc
+++ b/deps/zlib/contrib/tests/utils_unittest.cc
@@ -19,8 +19,17 @@
 #include "third_party/zlib/contrib/minizip/zip.h"
 #endif
 
+#include "compare256.h"
 #include "zlib.h"
 
+// Some tests are for little endian optimizations and should be skipped if
+// running on big endian.
+#if !defined(__BYTE_ORDER__) || __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#define ZLIB_TEST_LITTLE_ENDIAN 1
+#else
+#define ZLIB_TEST_LITTLE_ENDIAN 0
+#endif
+
 void TestPayloads(size_t input_size, zlib_internal::WrapperType type,
                   const int compression_level = Z_DEFAULT_COMPRESSION) {
   std::vector<unsigned char> input;
@@ -1475,4 +1484,32 @@ TEST(ZlibTest, Crbug500521311) {
   EXPECT_EQ(unzClose(uzf), UNZ_OK);
 }
 
+// compare256() returns the number of equal leading bytes. The buffers are
+// exactly the 256 bytes it may read, so ASan traps any over-read.
+TEST(ZlibTest, Compare256) {
+  if (!ZLIB_TEST_LITTLE_ENDIAN) {
+    GTEST_SKIP() << "compare256() is little-endian only";
+  }
+  for (int equal = 0; equal <= 256; ++equal) {
+    std::vector<unsigned char> a(256, 'a'), b(256, 'a');
+    if (equal < 256)
+      b[equal] = 'b';
+    EXPECT_EQ(compare256(a.data(), b.data()), equal);
+  }
+}
+
+// longest_match() computes 2 + compare256(scan + 2, match + 2), the first two
+// bytes being known equal, so a match must still reach MAX_MATCH (258).
+TEST(ZlibTest, Compare256ReachesMaxMatch) {
+  if (!ZLIB_TEST_LITTLE_ENDIAN) {
+    GTEST_SKIP() << "compare256() is little-endian only";
+  }
+  for (int match_len = 250; match_len <= 258; ++match_len) {
+    std::vector<unsigned char> a(258, 'a'), b(258, 'a');
+    if (match_len < 258)
+      b[match_len] = 'b';
+    EXPECT_EQ(2 + compare256(a.data() + 2, b.data() + 2), match_len);
+  }
+}
+
 #endif
diff --git a/deps/zlib/cpu_features.c b/deps/zlib/cpu_features.c
index 34ae7b913af9..6613a65e335f 100644
--- a/deps/zlib/cpu_features.c
+++ b/deps/zlib/cpu_features.c
@@ -160,6 +160,11 @@ static void _cpu_check_features(void)
 #include <immintrin.h>
 #include <xsaveintrin.h>
 #endif
+/* _xgetbv() below needs the xsave ISA. Annotate it here so the build does not
+ * need -mxsave. */
+#if defined(CRC32_SIMD_AVX512_PCLMUL) && (defined(__GNUC__) || defined(__clang__))
+__attribute__((__target__("xsave")))
+#endif
 static void _cpu_check_features(void)
 {
     int x86_cpu_has_sse2;
diff --git a/deps/zlib/crc32_simd.c b/deps/zlib/crc32_simd.c
index 1c60ae9bd3c1..20204e322ebe 100644
--- a/deps/zlib/crc32_simd.c
+++ b/deps/zlib/crc32_simd.c
@@ -21,6 +21,9 @@
 #include <wmmintrin.h>
 #include <immintrin.h>
 
+#if defined(__GNUC__) || defined(__clang__)
+__attribute__((__target__("avx512f,avx512vl,vpclmulqdq")))
+#endif
 uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
     const unsigned char *buf,
     z_size_t len,
@@ -212,6 +215,9 @@ uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
 #include <smmintrin.h>
 #include <wmmintrin.h>
 
+#if defined(__GNUC__) || defined(__clang__)
+__attribute__((__target__("sse4.2,pclmul")))
+#endif
 uint32_t ZLIB_INTERNAL crc32_sse42_simd_(  /* SSE4.2+PCLMUL */
     const unsigned char *buf,
     z_size_t len,
diff --git a/deps/zlib/crc_folding.c b/deps/zlib/crc_folding.c
index 1d54ee8d48cf..3e31ae4a7e44 100644
--- a/deps/zlib/crc_folding.c
+++ b/deps/zlib/crc_folding.c
@@ -25,6 +25,12 @@
 #include <immintrin.h>
 #include <wmmintrin.h>
 
+#if defined(__GNUC__) || defined(__clang__)
+#define TARGET_SSE42_PCLMUL __attribute__((__target__("sse4.2,pclmul")))
+#else
+#define TARGET_SSE42_PCLMUL
+#endif
+
 #define CRC_LOAD(s) \
     do { \
         __m128i xmm_crc0 = _mm_loadu_si128((__m128i *)s->crc0 + 0);\
@@ -41,6 +47,7 @@
         _mm_storeu_si128((__m128i *)s->crc0 + 4, xmm_crc_part);\
     } while (0);
 
+TARGET_SSE42_PCLMUL
 ZLIB_INTERNAL void crc_fold_init(deflate_state *const s)
 {
     CRC_LOAD(s)
@@ -55,6 +62,7 @@ ZLIB_INTERNAL void crc_fold_init(deflate_state *const s)
     s->strm->adler = 0;
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_1(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -81,6 +89,7 @@ local void fold_1(deflate_state *const s,
     *xmm_crc3 = _mm_castps_si128(ps_res);
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_2(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -115,6 +124,7 @@ local void fold_2(deflate_state *const s,
     *xmm_crc3 = _mm_castps_si128(ps_res31);
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_3(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -155,6 +165,7 @@ local void fold_3(deflate_state *const s,
     *xmm_crc3 = _mm_castps_si128(ps_res32);
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_4(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -221,6 +232,7 @@ local const unsigned zalign(32) pshufb_shf_table[60] = {
 	0x0201008f,0x06050403,0x0a090807,0x0e0d0c0b  /* shl  1 (16 -15)/shr15*/
 };
 
+TARGET_SSE42_PCLMUL
 local void partial_fold(deflate_state *const s, const size_t len,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3,
@@ -271,6 +283,7 @@ local void partial_fold(deflate_state *const s, const size_t len,
     *xmm_crc3 = _mm_castps_si128(ps_res);
 }
 
+TARGET_SSE42_PCLMUL
 ZLIB_INTERNAL void crc_fold_copy(deflate_state *const s,
         unsigned char *dst, const unsigned char *src, long len)
 {
@@ -427,6 +440,7 @@ local const unsigned zalign(16) crc_mask2[4] = {
     0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
 };
 
+TARGET_SSE42_PCLMUL
 unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state *const s)
 {
     const __m128i xmm_mask  = _mm_load_si128((__m128i *)crc_mask);
diff --git a/deps/zlib/deflate.c b/deps/zlib/deflate.c
index d95787f286d8..b98a985e5cac 100644
--- a/deps/zlib/deflate.c
+++ b/deps/zlib/deflate.c
@@ -57,6 +57,8 @@
 #include "slide_hash_simd.h"
 #endif
 
+#include "compare256.h"
+
 #if defined(QAT_COMPRESSION_ENABLED)
 #include "contrib/qat/deflate_qat.h"
 #endif
@@ -1492,7 +1494,13 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
     Posf *prev = s->prev;
     uInt wmask = s->w_mask;
 
-#ifdef UNALIGNED_OK
+#if defined(DEFLATE_COMPARE256_64LE)
+    /* Quickly reject non-matches with the 2-byte prefilter
+     * (scan_start/scan_end); candidates that pass are extended 8 bytes at a
+     * time with compare256(). */
+    uInt scan_start = read16(scan);
+    uInt scan_end   = read16(scan + best_len - 1);
+#elif defined(UNALIGNED_OK)
     /* Compare two bytes at a time. Note: this is not always beneficial.
      * Try with and without -DUNALIGNED_OK to check.
      */
@@ -1534,7 +1542,13 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
          * However the length of the match is limited to the lookahead, so
          * the output of deflate is not affected by the uninitialized values.
          */
-#if (defined(UNALIGNED_OK) && MAX_MATCH == 258)
+#if defined(DEFLATE_COMPARE256_64LE)
+        if (read16(match + best_len - 1) != scan_end ||
+            read16(match) != scan_start) continue;
+        /* scan_start matched, so bytes 0..1 are equal; compare the remaining
+         * up to 256 bytes so the length can still reach MAX_MATCH (258). */
+        len = 2 + compare256(scan + 2, match + 2);
+#elif (defined(UNALIGNED_OK) && MAX_MATCH == 258)
         /* This code assumes sizeof(unsigned short) == 2. Do not use
          * UNALIGNED_OK if your compiler uses a different size.
          */
@@ -1624,7 +1638,9 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
             s->match_start = cur_match;
             best_len = len;
             if (len >= nice_match) break;
-#ifdef UNALIGNED_OK
+#if defined(DEFLATE_COMPARE256_64LE)
+            scan_end = read16(scan + best_len - 1);
+#elif defined(UNALIGNED_OK)
             scan_end = *(ushf*)(scan + best_len - 1);
 #else
             scan_end1  = scan[best_len - 1];
diff --git a/deps/zstd/unofficial.gni b/deps/zstd/unofficial.gni
index fe6c2b425eac..733ddb965684 100644
--- a/deps/zstd/unofficial.gni
+++ b/deps/zstd/unofficial.gni
@@ -4,25 +4,38 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("zstd_gn_build") {
-  config("zstd_config") {
-    include_dirs = [ "./lib" ]
-  }
+  if (node_shared_zstd) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("zstd_config") {
+      packages = [ "libzstd" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+    }
+  } else {
+    config("zstd_config") {
+      include_dirs = [ "./lib" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("zstd.gyp") ],
-                            "scope",
-                            [ "zstd.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("zstd.gyp") ],
+                              "scope",
+                              [ "zstd.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":zstd_config" ]
-    sources = gypi_values.zstd_sources
-    defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
-    cflags_c = [ "-Wno-unused-function" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+      sources = gypi_values.zstd_sources
+      defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
+      cflags_c = [ "-Wno-unused-function" ]
 
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
     }
   }
 }
diff --git a/doc/api/async_hooks.md b/doc/api/async_hooks.md
index a863350fc2d2..ad566239cf19 100644
--- a/doc/api/async_hooks.md
+++ b/doc/api/async_hooks.md
@@ -814,9 +814,9 @@ See the section on [promise execution tracking][].
 
 ```js
 const server = net.createServer((conn) => {
-  // The resource that caused (or triggered) this callback to be called
-  // was that of the new connection. Thus the return value of triggerAsyncId()
-  // is the asyncId of "conn".
+  // Returns the triggerAsyncId of the server, not of the new connection,
+  // because the callback runs in the execution scope of the server's
+  // MakeCallback().
   async_hooks.triggerAsyncId();
 
 }).listen(port, () => {
diff --git a/doc/api/bench.md b/doc/api/bench.md
new file mode 100644
index 000000000000..122e32fe767e
--- /dev/null
+++ b/doc/api/bench.md
@@ -0,0 +1,849 @@
+# Benchmark runner
+
+<!--introduced_in=v26.9.0-->
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.0 - Early Development
+
+<!-- source_link=lib/bench.js -->
+
+The `node:bench` module supports defining and running JavaScript benchmarks in
+the current process, and running one benchmark file in a fresh child process.
+To access it:
+
+```mjs
+import { bench, suite } from 'node:bench';
+```
+
+```cjs
+const { bench, suite } = require('node:bench');
+```
+
+This module is only available under the `node:` scheme.
+
+## Example benchmark
+
+Save the following as `benchmark.mjs`:
+
+```mjs
+import { bench, suite } from 'node:bench';
+
+suite('URL', () => {
+  const input = 'https://example.com/a?b=c';
+
+  bench('construct', {
+    samples: 30,
+    params: { input: 'short' },
+  }, (b) => {
+    const operations = 10_000;
+    let totalLength = 0;
+
+    b.start();
+    for (let i = 0; i < operations; i++) {
+      totalLength += new URL(input).href.length;
+    }
+    b.end(operations);
+
+    if (totalLength !== operations * input.length) {
+      throw new Error('Unexpected URL result');
+    }
+  });
+});
+```
+
+Run the benchmark from the command line:
+
+```console
+node --bench benchmark.mjs
+```
+
+Benchmarks are executed serially in declaration order. Declared benchmarks are
+scheduled automatically. Call `run()` during the same turn as the declarations
+to consume the event stream or configure filtering.
+If an automatically scheduled run fails and `run()` was not called, the process
+exit code is set to `1`.
+
+## Measurement model
+
+Each warmup and measured sample invokes the benchmark function once with a
+fresh {BenchContext}. The function must either call `context.start()` and
+`context.end(operations)` exactly once, or call `context.record(sample)` exactly
+once to provide an externally measured sample. Setup before `start()` and
+cleanup after `end()` are outside the measured region. Promise-returning
+functions are awaited.
+
+By default, an event loop turn occurs between sample invocations. An embedded
+runner can disable this using `yieldBetweenSamples`. The runner executes
+benchmarks serially, but it does not provide process isolation. Other work in
+the process, JIT compilation, garbage collection, CPU frequency changes, and
+system load can all affect results. Keep raw samples when comparing results and
+investigate noisy or skewed distributions rather than treating a confidence
+interval as a pass/fail threshold.
+
+### Measurement integrity
+
+A statistically consistent result does not prove that a benchmark measured the
+intended work. An optimizing runtime can remove work whose result is unused or
+specialize it more narrowly than the workload being modeled. Framework and loop
+overhead can also dominate operations that are too short. To reduce these risks:
+
+* Make values produced by measured work observable outside the measured
+  interval, for example by validating an aggregate derived from every result.
+  Passing them only through unused local computations is insufficient.
+* Perform enough operations in each sample to amortize fixed timer reads and
+  calls to `context.start()` and `context.end()`. If loop bookkeeping is material
+  relative to one operation, batch multiple operations per iteration and report
+  the total operation count.
+* Inspect raw `samples` for trends that indicate insufficient warmup or
+  optimization tiering, pauses consistent with garbage collection, and
+  multimodal distributions.
+* Validate surprising results with an independent benchmark shape that performs
+  the same intended work differently.
+
+`node:bench` does not force a particular optimization state or infer whether an
+engine eliminated work. Such controls and diagnostics are runtime-specific and
+heuristic, and do not replace validating the benchmark workload.
+
+### Dynamic sampling and variable batches
+
+Calling `context.done()` during a measured sample completes the benchmark after
+that sample. This allows a higher-level tool to treat `samples` as a maximum and
+implement a dynamic sampling policy.
+
+The number of operations can differ between samples. Summary statistics treat
+each sample's `rate` as one equally weighted observation. In particular,
+`summary.mean` is the arithmetic mean of the per-sample rates. It is not the
+pooled throughput calculated as:
+
+```text
+1_000_000_000 * sum(sample.operations) / sum(sample.duration_ns)
+```
+
+The two values can differ when sample durations vary because pooled throughput
+weights each per-sample rate by its duration. A higher-level tool that varies
+batch sizes should choose the aggregation that matches its analysis. It can
+calculate pooled throughput from the raw `samples`; operation counts should be
+summed as `bigint` values because their total can exceed
+`Number.MAX_SAFE_INTEGER` even though each count cannot.
+
+### Comparing benchmark results
+
+`node:bench` does not designate a benchmark as a baseline or produce a pass/fail
+comparison between runs. It exposes raw samples, stable benchmark identities,
+parameters, and tags so that comparison policy can remain in higher-level
+tools. A tool can use `benchId` to match the same declaration and parameters
+across compatible source layouts, and use a tag or its own metadata to identify
+a baseline.
+
+Comparison tools should retain the raw sample rates and verify that execution
+plans and relevant environment details are comparable. The appropriate analysis
+depends on the experimental design and distribution. For example, independent
+samples might use Welch's t-test or a rank-based test, while observations that
+were deliberately paired require paired analysis. Tools should also consider
+effect sizes, uncertainty, and correction when testing multiple benchmarks.
+The general-purpose {Histogram} statistics in `node:perf_hooks` can support such
+analysis, but the runner does not select a method or significance threshold.
+
+## Reusable runners
+
+The module-level declaration functions use a shared runner and schedule it
+automatically. Higher-level tools can create isolated, explicitly started
+runners instead:
+
+```mjs
+import { createRunner } from 'node:bench';
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('example', { samples: 100 }, (b) => {
+  const operations = chooseOperationCount();
+  b.start();
+  runOperations(operations);
+  const sample = b.end(operations);
+
+  if (hasEnoughData(sample)) b.done();
+});
+
+for await (const record of runner.run()) {
+  // Consume structured benchmark records.
+}
+```
+
+Each runner has independent declarations, hooks, filtering, and output. Unlike
+the module-level declarations, creating a benchmark on an explicit runner does
+not schedule execution. This allows packages to collect declarations and start
+them later. Calling the explicit runner's `run()` function prevents additional
+declarations and a second call to `run()` is an error.
+
+## Command-line runner
+
+The `--bench` flag runs one or more explicit benchmark files or glob patterns:
+
+```console
+node --bench benchmark.mjs
+node --bench --bench-reporter=json 'benchmarks/**/*.js'
+```
+
+Files are sorted and executed serially. The default
+`--bench-isolation=process` mode runs each file in a separate child process and
+emits one aggregate summary. Structured events are transferred to the parent
+without JSON conversion, preserving BigInt durations, errors, and parameter
+values. Child writes to stdout and stderr are emitted as diagnostic records so
+they do not corrupt reporter output.
+
+`--bench-isolation=none` imports all files into the runner process. This mode
+has lower startup overhead, but module, heap, and process state carry between
+files, and user writes share stdout and stderr with reporters.
+
+Worker-thread isolation is not a CLI mode. Each newly constructed {Worker} has a
+separate V8 isolate, JavaScript heap, and event loop, typically with lower
+startup cost than a child process. Reusing a worker preserves its module and heap
+state. Workers also share libuv's process-wide thread pool and can share
+process-global native or addon state, so they do not provide the same boundary
+as process isolation.
+
+Higher-level tools can experiment with worker isolation by loading benchmark
+code inside a worker, measuring there, transferring structured sample data, and
+passing it to [`context.record()`][]. The reported `duration_ns` can exclude
+message transport when the worker captures both timestamps. Tools should
+identify worker modules and workloads explicitly. They should not stringify
+arbitrary functions or closures to move them between isolates, because closures
+cannot be reconstructed with their original lexical environment.
+
+Benchmark files passed to `--bench` should declare benchmarks but must not call
+`run()`. The CLI supports `--bench-name-pattern`, `--bench-samples`,
+`--bench-warmup`, `--bench-reporter`, and `--bench-reporter-destination`. See
+the [command-line options documentation][] for details.
+
+Preload modules passed through `--require` or `--import` should not declare
+benchmarks. Such declarations are not associated with an entry file and have
+an `entryFile` value of `null`. Their `fileRunId` identifies the runner or child
+execution in which they occurred. With process isolation, a preload is evaluated
+and its declarations run once for every benchmark child process.
+
+## Benchmark reporters
+
+The built-in reporters are available from the scheme-only
+`node:bench/reporters` module:
+
+```mjs
+import { json, spec } from 'node:bench/reporters';
+```
+
+```cjs
+const { json, spec } = require('node:bench/reporters');
+```
+
+Reporter values can be passed directly to `stream.compose()`:
+
+```mjs
+import { bench, run } from 'node:bench';
+import { spec } from 'node:bench/reporters';
+import process from 'node:process';
+
+bench('example', (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+run().compose(spec).pipe(process.stdout);
+```
+
+The `spec` reporter buffers results and outputs a concise table containing the
+sample count, mean rate, 95% confidence interval for the mean, median rate, and
+warnings. A coefficient of variation above 5% is reported as `noisy`, and an
+absolute skewness above 1 is reported as `skewed`. The exact human-readable
+format is subject to change.
+
+The `json` reporter emits every lifecycle record as newline-delimited JSON.
+BigInt values, including `duration_ns`, are encoded as decimal strings. Errors
+are represented using their `name`, `message`, `stack`, `code`, `cause`, and
+`errors` properties. As required by JSON, non-finite numbers are encoded as
+`null`.
+
+Custom reporters use the same composition contract. They can be transforms or
+functions accepted by `stream.compose()`. The composed readable can be piped to
+any writable destination:
+
+```mjs
+import { run } from 'node:bench';
+import process from 'node:process';
+
+async function* names(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:complete') {
+      yield `${data.name}\n`;
+    }
+  }
+}
+
+run().compose(names).pipe(process.stdout);
+```
+
+## `createRunner([options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `options` {Object}
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. Disabling this also prevents timer-based abort signals from
+    firing between synchronous callbacks. Benchmark timeouts continue to be
+    checked against a monotonic deadline. **Default:** `true`.
+* Returns: {Object} An isolated benchmark runner with bound `after`, `afterEach`,
+  `before`, `beforeEach`, `bench`, `describe`, `run`, and `suite` functions.
+
+Creates an explicitly started benchmark runner. Declarations made through one
+runner do not interact with declarations made through another runner or through
+the module-level functions. Call the returned `run()` function to start the
+runner and obtain its {BenchmarksStream}.
+
+Each runner can be started once. Its `run()` function accepts the same options
+as the module-level [`run()`][]. `run({ yieldBetweenSamples })` overrides the
+value passed to `createRunner()`.
+
+## `bench([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `name` {string} The benchmark name. **Default:** The `name` property of `fn`,
+  or `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names, deduplicated
+    and inherited from containing suites by union. Symbol values in the array
+    are silently ignored. **Default:** `[]`.
+  * `only` {boolean} When any benchmark or containing suite has `only` set,
+    benchmarks without `only` in their hierarchy are skipped. **Default:**
+    `false`.
+  * `params` {Object} String, finite number, or boolean metadata identifying
+    this benchmark configuration. Parameter keys are sorted when constructing
+    the stable benchmark identity. **Default:** An empty object.
+  * `samples` {number} The maximum number of measured callback invocations.
+    Must be a positive 32-bit unsigned integer. The benchmark may finish earlier
+    by calling `context.done()`. **Default:** `30`.
+  * `signal` {AbortSignal} Allows aborting this benchmark.
+  * `skip` {boolean|string} If truthy, the benchmark is skipped. A string is
+    included in the result as the skip reason. **Default:** `false`.
+  * `tags` {string\[]} Labels associated with the benchmark. Tags are
+    lowercased, deduplicated, and inherited from containing suites by union.
+    **Default:** `[]`.
+  * `timeout` {number} The number of milliseconds after which the benchmark
+    fails. **Default:** `Infinity`.
+  * `warmup` {number} The number of unreported callback invocations before
+    measured samples. Must be a 32-bit unsigned integer. **Default:** `0`.
+* `fn` {Function|AsyncFunction} The benchmark function. It receives a
+  {BenchContext}.
+* Returns: {Promise} Fulfilled with the benchmark result after a top-level
+  benchmark finishes, or with `undefined` immediately when declared in a
+  suite.
+
+Warmup invocations use the same callback and timing contract as measured
+samples, but their samples are discarded. An exception, rejection, timeout,
+abort, missing timing call, or duplicate timing call stops the current
+benchmark. Later benchmarks continue to run.
+
+After a timeout or abort, the runner briefly waits for asynchronous benchmark
+work to settle before continuing. If it remains pending, all later benchmarks
+that were selected to run fail without running so that their measurements
+cannot overlap with that work.
+
+For each warmup and measured callback, the runner subscribes to the configured
+diagnostics channels. Each publication queues a context diagnostic whose
+`message` is `{ name, message }`, containing the string channel name and the
+published message. Subscriptions are removed when the callback settles or is
+aborted.
+
+A timeout or abort cannot interrupt synchronous JavaScript and does not forcibly
+cancel asynchronous work that ignores `context.signal`.
+
+The `benchId` is based on the declaration source file, hierarchical suite and
+benchmark names, and canonicalized parameters. It is stable for repeated runs
+from the same source location, but the embedded source value is not normalized
+across checkout roots, module formats, operating systems, or path casing.
+
+Execution scope is represented separately. A `runId` identifies one logical
+run, while `fileRunId` identifies a file runner or child execution within that
+run. The `entryFile` field records which entry-file import caused a declaration
+and is `null` for declarations made by preload modules.
+The same `benchId` can therefore occur under multiple `fileRunId` values when
+entry files use a shared declaration helper. Declaring the same `benchId` more
+than once within one file execution scope reports an error rather than merging
+the samples.
+
+### `bench.skip([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Shorthand for `bench(name, { ...options, skip: true }, fn)`.
+
+### `bench.only([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Shorthand for `bench(name, { ...options, only: true }, fn)`.
+
+## `suite([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `name` {string} The suite name. **Default:** The `name` property of `fn`, or
+  `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names inherited by
+    nested suites and benchmarks. Symbol values in the array are silently
+    ignored. **Default:** `[]`.
+  * `only` {boolean} Selects all benchmarks nested in this suite. **Default:**
+    `false`.
+  * `skip` {boolean|string} Skips all benchmarks nested in this suite.
+    **Default:** `false`.
+  * `tags` {string\[]} Labels inherited by nested suites and benchmarks.
+    **Default:** `[]`.
+* `fn` {Function|AsyncFunction} A function that declares nested suites,
+  benchmarks, and hooks.
+* Returns: {Promise} Fulfilled when a top-level suite finishes, or with
+  `undefined` immediately when declared in another suite.
+
+Suite functions run while declarations are collected. Promise-returning suite
+functions are awaited before benchmark execution begins.
+
+## `describe([name][, options], fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Alias for `suite()`.
+
+## `before(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once before the benchmarks in the current suite.
+
+## `after(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once after the benchmarks in the current suite.
+
+## `beforeEach(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once before each complete logical benchmark in the
+current suite. It does not run before every sample. Per-sample setup belongs in
+the benchmark function before `context.start()` or `context.record()`.
+
+## `afterEach(fn)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once after each complete logical benchmark in the
+current suite. It does not run after every sample. Per-sample cleanup belongs
+in the benchmark function after `context.end()` or `context.record()`.
+
+## `run([options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `options` {Object}
+  * `namePattern` {string|RegExp} Only runs benchmarks whose full hierarchical
+    name matches the pattern. String values are interpreted as JavaScript
+    regular expressions.
+  * `samples` {number} Overrides the maximum number of measured callback
+    invocations for every benchmark. Must be a positive 32-bit unsigned integer.
+  * `signal` {AbortSignal} Allows aborting in-progress benchmark execution.
+  * `warmup` {number} Overrides the number of unreported warmup callback
+    invocations for every benchmark. Must be a 32-bit unsigned integer.
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. **Default:** `true`, or the value passed to `createRunner()` for
+    an explicit runner.
+* Returns: {BenchmarksStream}
+
+Returns the object-mode event stream for the in-process benchmark run. Call
+`run()` during the same turn in which benchmarks are declared, before automatic
+execution begins. Calling `run()` is optional when the returned stream is not
+needed. An explicit runner created by `createRunner()` does not run
+automatically, so its `run()` function may be called later.
+
+```mjs
+import { bench, run } from 'node:bench';
+
+bench('example', { samples: 3 }, (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+for await (const { type, data } of run()) {
+  if (type === 'bench:complete' && data.error === undefined) {
+    console.log(data.name, data.summary.mean);
+  }
+}
+```
+
+## `runFile(path[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `path` {string|Buffer|URL} The path of one benchmark module.
+* `options` {Object}
+  * `env` {Object} The child process environment. Property values must be
+    strings or `undefined`. This replaces, rather than extends, the parent
+    environment. **Default:** A snapshot of `process.env`.
+  * `execArgv` {string\[]} Node.js command-line options for the child process.
+    This replaces, rather than extends, inherited options. Benchmark runner
+    options, positional arguments, and options that select another execution
+    mode are not allowed. **Default:** Compatible options inherited from the
+    current process.
+  * `signal` {AbortSignal} Terminates the child process when aborted.
+* Returns: {BenchmarksStream}
+
+Runs exactly one benchmark module in a fresh child process and returns its
+object-mode event stream. A relative `path` is resolved from the current working
+directory when `runFile()` is called. `path` is not interpreted as a glob.
+Unless the signal is aborted or the stream is destroyed before startup, every
+call uses a new child. Input discovery, ordering, concurrency, retries, and
+multi-file scheduling remain the caller's responsibility.
+
+When the Permission Model is enabled, the caller must have file system read
+access to `path` and permission to create child processes.
+
+Records use advanced child process serialization, preserving supported
+structured values such as `bigint` and errors. Child writes to stdout and stderr
+become `'bench:diagnostic'` records. A permission failure, module loading error,
+abnormal child exit, or cancellation also emits an error diagnostic and produces
+a terminal `'bench:summary'` whose `success` property is `false`; these execution
+failures do not error the stream. If module evaluation fails after declaring
+benchmarks, those declarations still run before the unsuccessful summary.
+
+`env`, effective inherited options, and an explicitly provided `execArgv` are
+copied when `runFile()` is called. The runner removes `NODE_OPTIONS`, replaces
+IPC-related environment variables, and sets its private child-context, run
+identity, and file identity variables, overriding properties with those names
+in `env`. Pass child Node.js options through `execArgv`, not `NODE_OPTIONS`.
+Standard `child_process` environment propagation still applies, including
+`NODE_V8_COVERAGE`, permission-model options, and required z/OS variables.
+Aborting `signal` before the child starts produces an `AbortError` diagnostic
+without spawning it. Aborting during execution sends `SIGTERM` to the child and
+escalates to `SIGKILL` if it does not exit. Destroying the returned stream
+follows the same termination procedure.
+
+## Class: `BenchContext`
+
+An instance of `BenchContext` is passed to every benchmark invocation. A new
+instance is created for every warmup and measured sample.
+
+### `context.index`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {number}
+
+The zero-based invocation index within the current `context.phase`. Warmup and
+measured samples have separate index sequences.
+
+### `context.name`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string}
+
+The benchmark name.
+
+### `context.params`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {Object}
+
+The benchmark's canonicalized parameter metadata.
+
+### `context.phase`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string}
+
+The current sample phase. It is `'warmup'` for an unreported warmup invocation
+and `'measurement'` for a measured invocation.
+
+### `context.signal`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {AbortSignal}
+
+An abort signal that is triggered when the benchmark is aborted, times out, or
+finishes.
+
+### `context.start()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Starts the measured region using `process.hrtime.bigint()`. Calling `start()`
+more than once is an error.
+
+### `context.end(operations[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `operations` {number} The number of completed operations. Must be a positive
+  safe integer.
+* `options` {Object}
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The sample's `operations`, `duration_ns`, computed `rate`,
+  and optional cloned `detail`.
+
+Ends the measured region. The end timestamp is captured before `operations` is
+validated. Calling `end()` before `start()`, calling it more than once, or
+recording a zero-duration sample is an error. When provided, `detail` is cloned
+after the end timestamp is captured, so cloning time is outside the measured
+region.
+
+### `context.record(sample)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `sample` {Object}
+  * `operations` {number} The number of completed operations. Must be a positive
+    safe integer.
+  * `duration_ns` {bigint} An externally measured positive duration in
+    nanoseconds no greater than `Number.MAX_SAFE_INTEGER`.
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The normalized sample, including its computed `rate` and
+  optional cloned `detail`.
+
+Records a measurement made by another clock or execution environment. This is
+useful when a higher-level tool measures work in a worker and needs to exclude
+message transport from the duration. `record()` is mutually exclusive with
+`start()` and `end()` within one callback and must be called exactly once.
+
+### `context.diagnostic(message[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `message` {any} A structured-cloneable diagnostic value. With CLI process
+  isolation, it must also be supported by advanced child process serialization.
+* `options` {Object}
+  * `level` {string} Either `'info'` or `'warning'`. **Default:** `'info'`.
+  * `detail` {any} Additional structured-cloneable diagnostic data. With CLI
+    process isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {undefined}
+
+Queues a diagnostic associated with the current benchmark, phase, and sample
+index. Multiple diagnostics preserve call order. They are emitted after the
+sample callback settles and before that sample's `'bench:sample'` event. Warmup
+diagnostics are emitted even though warmup samples are not. Diagnostics queued
+before a callback failure are emitted before the failed `'bench:complete'`
+event and do not themselves cause the benchmark to fail. If a timeout or abort
+wins before the callback settles, queued diagnostics might not be emitted.
+
+The message and detail are cloned synchronously. Options are also validated
+synchronously. Calling `diagnostic()` between `context.start()` and
+`context.end()` therefore includes that work in the measured duration. Invalid
+arguments or an uncloneable message or detail violate the sample contract.
+
+### `context.done()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Requests successful benchmark completion after the current measured sample.
+The callback must still call either `start()` and `end()`, or `record()`.
+Calling `done()` during a warmup invocation is an error. The configured
+`samples` value remains the maximum number of measured invocations if `done()`
+is not called.
+
+## Class: `BenchmarksStream`
+
+`BenchmarksStream` is an object-mode {stream.Readable}. Each lifecycle record is
+both emitted as a named event and made available on the stream as
+`{ type, data }`.
+
+The events are emitted in execution order:
+
+* `'bench:plan'`
+* `'bench:start'`
+* `'bench:sample'`
+* `'bench:complete'`
+* `'bench:diagnostic'`
+* `'bench:summary'`
+
+Named event payloads, readable records, and benchmark completion values are
+independent snapshots. Mutating a value received through one delivery mechanism
+does not change values received through the others. As with other
+{EventEmitter} events, multiple listeners for the same named event receive the
+same event payload. Memory referenced through a {SharedArrayBuffer} remains
+shared, following structured clone semantics.
+
+Once a consumer starts reading, the runner honors the stream's object-mode
+high-water mark and waits between records when the consumer is slower than the
+producer. These waits occur after sample timing has ended, and records are not
+dropped. Snapshot creation and delivery waits are excluded from benchmark
+timeout accounting. Before readable consumption starts, records accumulate in
+the standard readable buffer and are included in `readableLength`. This keeps an
+unread stream and a consumer using only named events from deadlocking, but the
+buffer can grow without bound. A named-event-only consumer that does not need
+readable records should call `stream.resume()` to discard them. Destroying the
+stream stops readable delivery but does not cancel benchmark execution, so
+benchmark completion promises still settle. Automatically scheduled
+module-level runs drain their stream internally.
+
+With process isolation, each record sent by a child is acknowledged only after
+the parent has accepted it. A child sends no additional record until it receives
+that acknowledgement, bounding the IPC relay when a reporter is slow.
+
+Every benchmark-scoped event contains `runId`, `fileRunId`, `entryFile`,
+`benchId`, `parentId`, and `namePath`. `runId` and `fileRunId` are opaque and
+change between runs. `entryFile` identifies the top-level benchmark file whose
+loading caused the declaration, while `file` identifies the source location of
+the declaration itself. `parentId` is based on the containing suite's source
+file and hierarchical name path.
+
+After asynchronous suite declarations settle, an in-process runner emits one
+`'bench:plan'` event for every benchmark it collected, in declaration order.
+All plans from that runner are emitted before its suite hooks or benchmark
+callbacks run. With process isolation, files run in separate children, so plans
+for a later file are emitted after an earlier child has completed. With no
+isolation, all files share one runner and their plans are emitted before any
+benchmark executes. Plan data contains the benchmark-scoped identity, location,
+tags, and parameters described in [benchmark result][], together with:
+
+* `diagnosticChannels` {string\[]} The inherited string channel names
+  subscribed to during each callback.
+* `samples` {number} The effective maximum number of measured callback
+  invocations after run-level overrides.
+* `warmup` {number} The effective number of unreported warmup callback
+  invocations after run-level overrides.
+* `timeout` {number|null} The timeout in milliseconds, or `null` when no timeout
+  is configured.
+* `yieldBetweenSamples` {boolean} Whether an event loop turn is scheduled between
+  sample callbacks.
+* `selected` {boolean} Whether the benchmark is eligible to run after applying
+  `skip`, `only`, and `namePattern` selection. Execution can still be prevented
+  by a duplicate declaration, suite build, hook, abort, or other runtime failure.
+* `skip` {boolean|string} When `selected` is `false`, the explicit skip value or
+  the selection reason, such as `'only'` or `'name pattern'`.
+
+The plan contains execution settings known to the runner. Runtime version,
+operating system, processor, and other environment metadata are intentionally
+left for reporters and higher-level tools to collect.
+
+`'bench:complete'` data contains a [benchmark result][]. A failed result has an
+additional `error` property and may contain samples recorded before the error.
+A skipped result has an additional `skip` property and an empty `samples`
+array. `'bench:diagnostic'` reports loading, suite, and hook errors as well as
+public context diagnostics. A context diagnostic contains the benchmark-scoped
+identity fields, `phase`, `index`, `message`, `level`, source location, and
+optional `detail`. `'bench:summary'` contains overall `runId`, `fileRunId`,
+`entryFile`, `success`, `counts`, `duration_ns`, and `file` properties.
+`fileRunId`, `entryFile`, and `file` are {string|null}; they are `null` when the
+summary aggregates multiple files.
+
+## Sample result
+
+Each measured sample has the following properties:
+
+* `operations` {number} The positive operation count passed to
+  `context.end()` or `context.record()`.
+* `duration_ns` {bigint} The measured duration in nanoseconds.
+* `rate` {number} Operations per second.
+* `detail` {any} The optional cloned sample detail.
+
+## Benchmark result
+
+A completed benchmark result contains:
+
+* `runId` {string} The opaque logical run identity.
+* `fileRunId` {string} The opaque file runner or child execution identity.
+* `entryFile` {string|null} The top-level file that caused this declaration.
+* `benchId` {string} The stable declaration identity within the same source
+  layout.
+* `parentId` {string|null} The stable containing suite identity.
+* `name` {string} The benchmark name.
+* `namePath` {string\[]} The hierarchical suite and benchmark names.
+* `file` {string} The declaration source file.
+* `line` {number} The source line.
+* `column` {number} The source column.
+* `tags` {string\[]} The inherited canonical tags.
+* `params` {Object} The canonical parameter metadata.
+* `samples` {Object\[]} The exact measured samples in measurement invocation
+  order.
+* `summary` {Object}
+  * `mean` {number} The equally weighted arithmetic mean of per-sample rates,
+    not pooled throughput across all operations and durations.
+  * `median` {number} The median per-sample rate.
+  * `min` {number} The minimum per-sample rate.
+  * `max` {number} The maximum per-sample rate.
+  * `stddev` {number} The population standard deviation of rates.
+  * `coefficientOfVariation` {number} `stddev / mean`.
+  * `confidenceInterval` {Object} The 95% Student's t confidence interval for
+    the mean rate, with `lower` and `upper` properties.
+  * `medianConfidenceInterval` {Object} The 95% nonparametric confidence
+    interval for the median rate, with `lower` and `upper` properties.
+  * `skewness` {number} The skewness of the scaled rate histogram.
+
+[`context.record()`]: #contextrecordsample
+[`run()`]: #runoptions
+[benchmark result]: #benchmark-result
+[command-line options documentation]: cli.md#--bench
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index b89a91cee78e..53b2f3a08256 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5680,8 +5680,9 @@ since the extra bytes are not free.
 
 Because the address of a `Buffer`'s memory cannot be chosen directly, extra bytes
 have to be allocated or skipped to reach an aligned address.
-[`Buffer.allocUnsafeSlow()`][] over-allocates up to `alignment - 1` bytes and
-positions the returned `Buffer` at the first suitably aligned byte within them.
+[`Buffer.allocUnsafeSlow()`][] over-allocates `alignment` bytes, or 8 when
+`alignment` is smaller than that, and positions the returned `Buffer` at the
+first suitably aligned byte within them.
 [`Buffer.allocUnsafe()`][] instead pads its offset into the shared internal pool,
 whose start is always aligned to 64 bytes, and only falls back to an allocation
 of its own when `alignment` is larger than that. Either way,
diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index 68f4d7ef14a9..138fb52f8612 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -242,6 +242,11 @@ can be used to specify the character encoding used to decode the stdout and
 stderr output. If `encoding` is `'buffer'`, or an unrecognized character
 encoding, `Buffer` objects will be passed to the callback instead.
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 ```cjs
 const { exec } = require('node:child_process');
 exec('cat *.js missing_file | wc -l', (error, stdout, stderr) => {
@@ -390,6 +395,11 @@ except that it does not spawn a shell by default. Rather, the specified
 executable `file` is spawned directly as a new process making it slightly more
 efficient than [`child_process.exec()`][].
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 The same options as [`child_process.exec()`][] are supported. Since a shell is
 not spawned, behaviors such as I/O redirection and file globbing are not
 supported.
@@ -585,6 +595,11 @@ current process.
 The `shell` option available in [`child_process.spawn()`][] is not supported by
 `child_process.fork()` and will be ignored if set.
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 If the `signal` option is enabled, calling `.abort()` on the corresponding
 `AbortController` is similar to calling `.kill()` on the child process except
 the error passed to the callback will be an `AbortError`:
@@ -735,6 +750,11 @@ process, the default is [`process.env`][].
 
 `undefined` values in `env` will be ignored.
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 Example of running `ls -lh /usr`, capturing `stdout`, `stderr`, and the
 exit code:
 
@@ -1064,7 +1084,12 @@ pipes between the parent and child. The value is one of the following:
    as it may result in undefined behavior or dropped callbacks if the stream
    encounters errors. Always ensure that `stdin` is used as readable and
    `stdout`/`stderr` as writable to maintain the intended flow of data between
-   the parent and child processes.
+   the parent and child processes. The stream passed in the `stdin` position
+   is the source from which the child process reads its input, and the
+   streams in the `stdout`/`stderr` positions receive the output the child
+   writes. This is the opposite of [`subprocess.stdin`][] (writable) and
+   [`subprocess.stdout`][] (readable), which are the parent's ends of the
+   pipes created by `'pipe'`.
 7. Positive integer: The integer value is interpreted as a file descriptor
    that is open in the parent process. It is shared with the child
    process, similar to how {Stream} objects can be shared. Passing sockets
@@ -1179,7 +1204,8 @@ changes:
     `'/bin/sh'` on Unix, and `process.env.ComSpec` on Windows. A different
     shell can be specified as a string. See [Shell requirements][] and
     [Default Windows shell][]. **Default:** `false` (no shell).
-* Returns: {Buffer|string} The stdout from the command.
+* Returns: {Buffer|string|null} If `stdio` is `'pipe'`, the stdout from the
+  command, otherwise null.
 
 The `child_process.execFileSync()` method is generally identical to
 [`child_process.execFile()`][] with the exception that the method will not
@@ -1306,7 +1332,8 @@ changes:
     **Default:** `'buffer'`.
   * `windowsHide` {boolean} Hide the subprocess console window that would
     normally be created on Windows systems. **Default:** `false`.
-* Returns: {Buffer|string} The stdout from the command.
+* Returns: {Buffer|string|null} If `stdio` is `'pipe'`, the stdout from the
+  command, otherwise null.
 
 The `child_process.execSync()` method is generally identical to
 [`child_process.exec()`][] with the exception that the method will not return
@@ -1390,8 +1417,10 @@ changes:
 * Returns: {Object}
   * `pid` {number} Pid of the child process.
   * `output` {Array} Array of results from stdio output.
-  * `stdout` {Buffer|string} The contents of `output[1]`.
-  * `stderr` {Buffer|string} The contents of `output[2]`.
+  * `stdout` {Buffer|string|null} If `stdio` is `'pipe'`, the contents of
+    `output[1]`, otherwise null.
+  * `stderr` {Buffer|string|null} If `stdio` is `'pipe'`, the contents of
+    `output[2]`, otherwise null.
   * `status` {number|null} The exit code of the subprocess, or `null` if the
     subprocess terminated due to a signal.
   * `signal` {string|null} The signal used to kill the subprocess, or `null` if
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 642d4256852d..16f24d271a69 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -202,8 +202,8 @@ added: v26.1.0
 When using the [Permission Model][], the process will not be able to use FFI
 APIs by default. Attempts to use FFI APIs will throw an `ERR_ACCESS_DENIED`
 exception unless the user explicitly passes the `--allow-ffi` flag when
-starting Node.js. The [`node:ffi`][] module also requires the
-`--experimental-ffi` flag and is only available in builds with FFI support.
+starting Node.js. The [`node:ffi`][] module is only available in builds with
+FFI support.
 
 Example:
 
@@ -213,7 +213,7 @@ const lib = new DynamicLibrary(`./mylib.${suffix}`);
 ```
 
 ```console
-$ node --permission --experimental-ffi index.js
+$ node --permission index.js
 Error: Access to this API has been restricted. Use --allow-ffi to manage permissions.
     at node:internal/main/run_main_module:17:47 {
   code: 'ERR_ACCESS_DENIED',
@@ -268,6 +268,26 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 ```
 
+### `--allow-fs-vfs`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.1 - Active development
+
+When using the [Permission Model][], a [virtual file system][] cannot be
+mounted by default: [`vfs.mount()`][] throws `ERR_INVALID_STATE` unless the
+user explicitly passes the `--allow-fs-vfs` flag when starting Node.js.
+
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on `--allow-fs-read` or
+`--allow-fs-write`.
+
+```console
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+```
+
 ### `--allow-fs-write`
 
 <!-- YAML
@@ -450,6 +470,112 @@ Error: Access to this API has been restricted
 }
 ```
 
+### `--bench`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+
+```console
+node --bench benchmark.mjs
+node --bench 'benchmarks/**/*.js'
+```
+
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using `node:bench`; they must not
+call `run()` themselves. See the [benchmark runner][] documentation for more
+details.
+
+This flag cannot be combined with `--test`, `--watch`, `--watch-path`,
+`--check`, `--eval`, or `--interactive`.
+
+### `--bench-isolation=mode`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Configures benchmark file isolation. When `mode` is `'process'`, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+
+When `mode` is `'none'`, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+
+The supported modes are `'process'` and `'none'`.
+
+### `--bench-name-pattern=pattern`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression `pattern`. Non-matching benchmarks are reported as skipped.
+
+### `--bench-reporter-destination=destination`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Specifies the destination for the corresponding benchmark reporter. The value
+can be `stdout`, `stderr`, or a file path. A single reporter defaults to
+`stdout` when no destination is specified.
+
+### `--bench-reporter=reporter`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Specifies a benchmark reporter. The built-in reporters are `spec` and `json`.
+The `json` reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding `--bench-reporter-destination`. The default reporter is
+`spec`.
+
+### `--bench-samples=count`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+`context.done()`. `count` must be an integer between `1` and `4294967295`.
+
+### `--bench-warmup=count`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. `count` must be an integer between `0` and `4294967295`.
+
 ### `--build-sea=config`
 
 <!-- YAML
@@ -885,6 +1011,17 @@ Enable [FIPS mode][] at startup. With OpenSSL 3, a configured provider named
 `fips` must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 
+### `--enable-fips-indicator-events`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Publish OpenSSL FIPS indicator results to the
+[`'crypto.fips.indicator'`][] diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable [FIPS mode][] or change whether an operation
+is permitted.
+
 ### `--enable-source-maps`
 
 <!-- YAML
@@ -1244,27 +1381,26 @@ If present, Node.js will look for a
 `node.config.json` file in the current working directory and load it as a
 configuration file.
 
-### `--experimental-eventsource`
+### `--experimental-dtls`
 
 <!-- YAML
-added:
-  - v22.3.0
-  - v20.18.0
+added: v26.9.0
 -->
 
-Enable exposition of [EventSource Web API][] on the global scope.
+> Stability: 1 - Experimental
+
+Enable experimental support for the DTLS protocol. See the
+[dtls documentation][] for details.
 
-### `--experimental-ffi`
+### `--experimental-eventsource`
 
 <!-- YAML
-added: v26.1.0
+added:
+  - v22.3.0
+  - v20.18.0
 -->
 
-> Stability: 1 - Experimental
-
-Enable the experimental [`node:ffi`][] module.
-
-This flag is only available in builds with FFI support.
+Enable exposition of [EventSource Web API][] on the global scope.
 
 ### `--experimental-import-meta-resolve`
 
@@ -1542,6 +1678,14 @@ changes:
 
 Enable experimental WebAssembly System Interface (WASI) support.
 
+### `--experimental-web-worker`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Enable experimental support for the Web Worker API.
+
 ### `--experimental-worker-inspection`
 
 <!-- YAML
@@ -1562,15 +1706,32 @@ added: v12.12.0
 
 Disable loading native addons that are not [context-aware][].
 
-### `--force-fips`
+### `--force-fips[=mode]`
 
 <!-- YAML
 added: v6.0.0
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65645
+    description: Added the optional `provider` and `strict` modes.
 -->
 
 Enable [FIPS mode][] at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as [`--enable-fips`][] apply.
 
+An optional mode can be specified using `--force-fips=mode`:
+
+* `provider`: Preserve the OpenSSL FIPS provider's configured handling of
+  non-approved operations. This is the current default when the mode is
+  omitted.
+* `strict`: Reject non-approved operations reported through the OpenSSL FIPS
+  indicator callback. This mode requires OpenSSL 3.4 or later.
+
+The `strict` mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another `OSSL_LIB_CTX` or another copy of `libcrypto`, nor operation-specific
+indicators that do not invoke the callback.
+
 ### `--force-node-api-uncaught-exceptions-policy`
 
 <!-- YAML
@@ -2069,6 +2230,18 @@ changes:
 
 Disable using [syntax detection][] to determine module type.
 
+### `--no-experimental-ffi`
+
+<!-- YAML
+added: v26.1.0
+-->
+
+> Stability: 1 - Experimental
+
+Disable the experimental [`node:ffi`][] module.
+
+This flag is only available in builds with FFI support.
+
 ### `--no-experimental-global-navigator`
 
 <!-- YAML
@@ -2247,6 +2420,17 @@ added: v6.0.0
 
 Silence all process warnings (including deprecations).
 
+### `--no-worker-snapshot`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+
 ### `--node-memory-debug`
 
 <!-- YAML
@@ -2661,6 +2845,9 @@ forked processes, or clustered processes.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64606
+    description: Passing `--run` without a command lists the available scripts.
   - version: v22.3.0
     pr-url: https://github.com/nodejs/node/pull/53032
     description: NODE_RUN_SCRIPT_NAME environment variable is added.
@@ -2677,6 +2864,15 @@ changes:
 This runs a specified command from a package.json's `"scripts"` object.
 If a missing `"command"` is provided, it will list the available scripts.
 
+Passing `--run` without a command lists the available scripts and exits
+with a non-zero exit code:
+
+```console
+$ node --run
+Available scripts are:
+  test: node --test
+```
+
 `--run` will traverse up to the root directory and finds a `package.json`
 file to run the command from.
 
@@ -3458,19 +3654,21 @@ When both are set, `--use-env-proxy` takes precedence.
 added:
  - v13.6.0
  - v12.17.0
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65389
+    description: This option is now a no-op.
 -->
 
-Re-map the Node.js static code to large memory pages at startup. If supported on
-the target system, this will cause the Node.js static code to be moved onto 2
-MiB pages instead of 4 KiB pages.
+This option is no longer supported and a no-op. It used to re-map the Node.js
+static code to large memory pages at startup.
 
-The following values are valid for `mode`:
+It still accepts the following values for compatibility:
 
 * `off`: No mapping will be attempted. This is the default.
-* `on`: If supported by the OS, mapping will be attempted. Failure to map will
-  be ignored and a message will be printed to standard error.
-* `silent`: If supported by the OS, mapping will be attempted. Failure to map
-  will be ignored and will not be reported.
+* `on`: No mapping will be attempted and a message will be printed to
+  standard error stating it's no longer supported.
+* `silent`: Same as `off`.
 
 ### `--use-system-ca`
 
@@ -3833,12 +4031,19 @@ one is included in the list below.
 * `--allow-child-process`
 * `--allow-ffi`
 * `--allow-fs-read`
+* `--allow-fs-vfs`
 * `--allow-fs-write`
 * `--allow-inspector`
 * `--allow-net`
 * `--allow-openssl-store`
 * `--allow-wasi`
 * `--allow-worker`
+* `--bench-isolation`
+* `--bench-name-pattern`
+* `--bench-reporter-destination`
+* `--bench-reporter`
+* `--bench-samples`
+* `--bench-warmup`
 * `--conditions`, `-C`
 * `--cpu-prof-dir`
 * `--cpu-prof-interval`
@@ -3850,6 +4055,7 @@ one is included in the list below.
 * `--disable-warning`
 * `--disable-wasm-trap-handler`
 * `--dns-result-order`
+* `--enable-fips-indicator-events`
 * `--enable-fips`
 * `--enable-network-family-autoselection`
 * `--enable-source-maps`
@@ -3857,8 +4063,8 @@ one is included in the list below.
 * `--experimental-abortcontroller`
 * `--experimental-addon-modules`
 * `--experimental-detect-module`
+* `--experimental-dtls`
 * `--experimental-eventsource`
-* `--experimental-ffi`
 * `--experimental-import-meta-resolve`
 * `--experimental-import-text`
 * `--experimental-json-modules`
@@ -3876,6 +4082,7 @@ one is included in the list below.
 * `--experimental-vfs`
 * `--experimental-vm-modules`
 * `--experimental-wasi-unstable-preview1`
+* `--experimental-web-worker`
 * `--force-context-aware`
 * `--force-fips`
 * `--force-node-api-uncaught-exceptions-policy`
@@ -3903,6 +4110,7 @@ one is included in the list below.
 * `--no-addons`
 * `--no-async-context-frame`
 * `--no-deprecation`
+* `--no-experimental-ffi`
 * `--no-experimental-global-navigator`
 * `--no-experimental-repl-await`
 * `--no-experimental-sqlite`
@@ -3916,6 +4124,7 @@ one is included in the list below.
 * `--no-strip-types`
 * `--no-warnings`
 * `--no-webstorage`
+* `--no-worker-snapshot`
 * `--node-memory-debug`
 * `--openssl-config`
 * `--openssl-legacy-provider`
@@ -4486,6 +4695,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [V8 Inspector integration for Node.js]: debugger.md#v8-inspector-integration-for-nodejs
 [V8 JavaScript code coverage]: https://v8project.blogspot.com/2017/12/javascript-code-coverage.html
 [`"type"`]: packages.md#type
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-addons`]: #--allow-addons
 [`--allow-child-process`]: #--allow-child-process
 [`--allow-fs-read`]: #--allow-fs-read
@@ -4542,7 +4752,9 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`v8.startupSnapshot.addDeserializeCallback()`]: v8.md#v8startupsnapshotadddeserializecallbackcallback-data
 [`v8.startupSnapshot.setDeserializeMainFunction()`]: v8.md#v8startupsnapshotsetdeserializemainfunctioncallback-data
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
+[`vfs.mount()`]: vfs.md#vfsmount
 [asynchronous module customization hooks]: module.md#asynchronous-customization-hooks
+[benchmark runner]: bench.md#command-line-runner
 [captured by the built-in snapshot of Node.js]: https://github.com/nodejs/node/blob/b19525a33cc84033af4addd0f80acd4dc33ce0cf/test/parallel/test-bootstrap-modules.js#L24
 [collecting code coverage from tests]: test.md#collecting-code-coverage
 [conditional exports]: packages.md#conditional-exports
@@ -4550,6 +4762,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [debugger]: debugger.md
 [debugging security implications]: https://nodejs.org/learn/getting-started/debugging#security-implications
 [deprecation warnings]: deprecations.md#list-of-deprecated-apis
+[dtls documentation]: dtls.md
 [emit_warning]: process.md#processemitwarningwarning-options
 [environment_variables]: #environment-variables-1
 [filtering tests by name]: test.md#filtering-tests-by-name
@@ -4572,4 +4785,5 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [test runner execution model]: test.md#test-runner-execution-model
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [tracking issue for user-land snapshots]: https://github.com/nodejs/node/issues/44014
+[virtual file system]: vfs.md
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 66f596cd212a..2c25f117005e 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -7,8 +7,8 @@
 <!-- source_link=lib/crypto.js -->
 
 The `node:crypto` module provides cryptographic functionality that includes a
-set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify
-functions.
+set of wrappers for OpenSSL's hash, message authentication code (MAC), cipher,
+decipher, sign, verify, and key encapsulation mechanism (KEM) functions.
 
 ```mjs
 const { createHmac } = await import('node:crypto');
@@ -633,6 +633,10 @@ The [`crypto.createCipheriv()`][] method is
 used to create `Cipheriv` instances. `Cipheriv` objects are not to be created
 directly using the `new` keyword.
 
+The selected algorithm may impose additional restrictions on streaming and
+calls to [`cipher.update()`][]. See [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][].
+
 Example: Using `Cipheriv` objects as streams:
 
 ```mjs
@@ -905,14 +909,15 @@ added: v0.7.1
 * `autoPadding` {boolean} **Default:** `true`
 * Returns: {Cipheriv} The same `Cipheriv` instance for method chaining.
 
-When using block encryption algorithms, the `Cipheriv` class will automatically
-add padding to the input data to the appropriate block size. To disable the
-default padding call `cipher.setAutoPadding(false)`.
+When using block ciphers that use standard block padding, the `Cipheriv` class
+will automatically add padding to the input data to the appropriate block size.
+To disable the default padding call `cipher.setAutoPadding(false)`.
 
-When `autoPadding` is `false`, the length of the entire input data must be a
-multiple of the cipher's block size or [`cipher.final()`][] will throw an error.
-Disabling automatic padding is useful for non-standard padding, for instance
-using `0x0` instead of PKCS padding.
+For block ciphers that use standard block padding, when `autoPadding` is
+`false`, the length of the entire input data must be a multiple of the cipher's
+block size or [`cipher.final()`][] will throw an error. Disabling automatic
+padding is useful for non-standard padding, for instance using `0x0` instead of
+PKCS padding.
 
 The `cipher.setAutoPadding()` method must be called before
 [`cipher.final()`][].
@@ -946,9 +951,12 @@ is specified, a string using the specified encoding is returned. If no
 When `outputEncoding` is specified, it must use the same encoding as previous
 calls to `cipher.update()`.
 
-The `cipher.update()` method can be called multiple times with new data until
-[`cipher.final()`][] is called. Calling `cipher.update()` after
-[`cipher.final()`][] will result in an error being thrown.
+For most algorithms, `cipher.update()` can be called multiple times with new
+data until [`cipher.final()`][] is called. Some algorithms restrict calls to
+`cipher.update()`. For example, [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][] require the whole message
+in a single call. Calling `cipher.update()` after [`cipher.final()`][] will
+result in an error being thrown.
 
 ## Class: `Decipheriv`
 
@@ -970,6 +978,10 @@ The [`crypto.createDecipheriv()`][] method is
 used to create `Decipheriv` instances. `Decipheriv` objects are not to be created
 directly using the `new` keyword.
 
+The selected algorithm may impose additional restrictions on streaming and
+calls to [`decipher.update()`][]. See [CCM mode][], [CBC-CTS mode][],
+[XTS mode][], [AES key wrap modes][], and [SIV and GCM-SIV modes][].
+
 Example: Using `Decipheriv` objects as streams:
 
 ```mjs
@@ -1267,8 +1279,8 @@ When data has been encrypted without standard block padding, calling
 `decipher.setAutoPadding(false)` will disable automatic padding to prevent
 [`decipher.final()`][] from checking for and removing padding.
 
-Turning auto padding off will only work if the input data's length is a
-multiple of the ciphers block size.
+For block ciphers that use standard block padding, disabling it requires the
+input data's length to be a multiple of the cipher's block size.
 
 The `decipher.setAutoPadding()` method must be called before
 [`decipher.final()`][].
@@ -1291,19 +1303,23 @@ changes:
 Updates the decipher with `data`. If the `inputEncoding` argument is given,
 the `data`
 argument is a string using the specified encoding. If the `inputEncoding`
-argument is not given, `data` must be a [`Buffer`][]. If `data` is a
-[`Buffer`][] then `inputEncoding` is ignored.
+argument is not given, `data` must be a [`Buffer`][], `TypedArray`, or
+`DataView`. If `data` is a [`Buffer`][], `TypedArray`, or `DataView`, then
+`inputEncoding` is ignored.
 
-The `outputEncoding` specifies the output format of the enciphered
+The `outputEncoding` specifies the output format of the deciphered
 data. If the `outputEncoding`
 is specified, a string using the specified encoding is returned. If no
 `outputEncoding` is provided, a [`Buffer`][] is returned.
 When `outputEncoding` is specified, it must use the same encoding as previous
 calls to `decipher.update()`.
 
-The `decipher.update()` method can be called multiple times with new data until
-[`decipher.final()`][] is called. Calling `decipher.update()` after
-[`decipher.final()`][] will result in an error being thrown.
+For most algorithms, `decipher.update()` can be called multiple times with new
+data until [`decipher.final()`][] is called. Some algorithms restrict calls to
+`decipher.update()`. For example, [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][] require the whole message
+in a single call. Calling `decipher.update()` after [`decipher.final()`][] will
+result in an error being thrown.
 
 Even if the underlying cipher implements authentication, the authenticity and
 integrity of the plaintext returned from this function may be uncertain at this
@@ -2521,6 +2537,91 @@ Depending on the type of this `KeyObject`, this property is either
 `'secret'` for secret (symmetric) keys, `'public'` for public (asymmetric) keys
 or `'private'` for private (asymmetric) keys.
 
+## Class: `Mac`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Extends: {stream.Transform}
+
+The `Mac` class computes message authentication codes using MAC
+implementations supplied by OpenSSL providers. It can be used in one of two
+ways:
+
+* As a [stream][] that is both readable and writable, where data is written and
+  one authentication tag is produced on the readable side when the writable
+  side ends; or
+* By calling [`mac.update()`][] one or more times followed by [`mac.final()`][].
+
+Instances of `Mac` are created using [`crypto.createMac()`][]. The `Mac` class
+is not exported directly by the `node:crypto` module.
+
+Calling `mac.end()` without first writing data computes the authentication tag
+for an empty message. If the selected MAC produces a zero-byte tag, such as
+when a provider accepts `outputLength: 0`, the readable side ends without
+emitting a data chunk because Node.js streams do not emit zero-length chunks.
+When using `mac.final()` instead, it returns a zero-length [`Buffer`][] or an
+empty encoded string.
+
+`mac.end()` and `mac.final()` are alternative terminal operations and must not
+both be called on the same object. A `Mac` object cannot be used again after
+either operation attempts finalization or after an underlying MAC update fails.
+
+Example: Using [`mac.update()`][] and [`mac.final()`][]:
+
+```mjs
+const { createMac, randomBytes } = await import('node:crypto');
+
+const key = randomBytes(16);
+const mac = createMac('CMAC', key, {
+  cipher: 'AES-128-CBC',
+});
+
+mac.update('some data to authenticate');
+console.log(mac.final('hex'));
+```
+
+### `mac.final([outputEncoding])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `outputEncoding` {string} The [encoding][] of the return value.
+* Returns: {Buffer | string}
+
+Completes the MAC computation and returns the authentication tag. If
+`outputEncoding` is omitted or is `'buffer'`, a [`Buffer`][] is returned.
+Otherwise, a string is returned.
+
+To verify an authentication tag, compare equal-length [`Buffer`][] values using
+[`crypto.timingSafeEqual()`][].
+
+The `Mac` object cannot be used again after finalization is attempted,
+including when finalization fails. Later calls to `mac.update()` or
+`mac.final()` throw `ERR_CRYPTO_MAC_FINALIZED`.
+
+### `mac.update(data[, inputEncoding])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `data` {string|Buffer|TypedArray|DataView}
+* `inputEncoding` {string} The [encoding][] of the `data` string.
+* Returns: {Mac}
+
+Updates the MAC with `data` and returns the `Mac` object so that calls can be
+chained. When `data` is a string, `inputEncoding` defaults to `'utf8'`. When
+`data` is a [`Buffer`][], `TypedArray`, or `DataView`, `inputEncoding` is
+ignored.
+
+This method can be called multiple times before finalization. If an underlying
+MAC update fails, the `Mac` object cannot be used again. Calling this method
+after a previous underlying MAC update failure or after finalization throws
+`ERR_CRYPTO_MAC_FINALIZED`.
+
 ## Class: `Sign`
 
 <!-- YAML
@@ -3554,6 +3655,12 @@ operations. The specific constants currently defined are described in
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Additional ciphers available through OpenSSL providers (e.g.
+                 SM4-GCM, SM4-CCM, SM4-XTS, CBC-CTS, and AES key-wrap variants)
+                 are now supported. The `ctsMode` and `xtsStandard` options
+                 were added.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63411
     description: Ciphers in SIV and GCM-SIV modes are now supported.
@@ -3595,47 +3702,74 @@ changes:
 * `algorithm` {string}
 * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
 * `iv` {string|ArrayBuffer|Buffer|TypedArray|DataView|null}
-* `options` {Object} [`stream.transform` options][]
+* `options` {Object} [`stream.transform` options][] with these additional
+  properties:
+  * `authTagLength` {number} The authentication tag length in bytes. Its
+    requirements and default depend on the authenticated cipher, as described
+    below.
+  * `ctsMode` {string} The [CBC-CTS mode][] variant. One of `'CS1'`, `'CS2'`,
+    or `'CS3'`. The values are case-sensitive. **Default:** `'CS1'`.
+  * `encoding` {string} The [encoding][] to use when `key` is a string. This
+    option does not affect a string `iv`, which is always interpreted as UTF-8.
+    **Default:** `'utf8'`.
+  * `xtsStandard` {string} The standard used by `sm4-xts`. One of `'GB'` or
+    `'IEEE'`. The values are case-sensitive. **Default:** `'GB'`.
 * Returns: {Cipheriv}
 
 Creates and returns a `Cipheriv` object, with the given `algorithm`, `key` and
 initialization vector (`iv`).
 
-The `options` argument controls stream behavior and is optional except when a
-cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-`authTagLength` option is required and specifies the length of the
-authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
-option is not required but can be used to set the length of the authentication
-tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
+The `options` argument controls cipher-specific settings and stream behavior.
+It is optional except when a cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`)
+is used. In that case, the `authTagLength` option is required and specifies the
+length of the authentication tag in bytes, see [CCM mode][]. In GCM mode, the
+`authTagLength` option is not required but can be used to set the length of the
+authentication tag that will be returned by `getAuthTag()` and defaults to 16
+bytes.
 For `SIV`, `GCM-SIV`, and `chacha20-poly1305`, the `authTagLength` option
 defaults to 16 bytes. `SIV` and `GCM-SIV` only support 16-byte authentication
 tags.
 
-The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-recent OpenSSL releases, `openssl list -cipher-algorithms` will
-display the available cipher algorithms.
+The `ctsMode` and `xtsStandard` options configure parameters exposed by OpenSSL
+providers. They are available only with OpenSSL 3.0 or later and a provider
+that supports the corresponding parameter. `ctsMode` applies only to CBC-CTS
+ciphers, and `xtsStandard` applies only to `sm4-xts`. Supplying either option
+for an available cipher implementation that does not support it throws an
+`ERR_CRYPTO_UNSUPPORTED_OPERATION` error. See [CBC-CTS mode][] and [XTS mode][]
+for details.
+
+The available algorithms depend on OpenSSL. [`crypto.getCiphers()`][] lists the
+algorithms exposed by Node.js. On recent OpenSSL releases,
+`openssl list -cipher-algorithms` displays the algorithms available to OpenSSL,
+which can include algorithms that Node.js does not expose.
 
 The `key` is the raw key used by the `algorithm` and `iv` is an
-[initialization vector][]. Both arguments must be `'utf8'` encoded strings,
-[Buffers][`Buffer`], `TypedArray`, or `DataView`s. The `key` may optionally be
-a [`KeyObject`][] of type `secret`. If the cipher does not need
-an initialization vector, `iv` may be `null`.
+[initialization vector][]. Each may be a string, `ArrayBuffer`, [`Buffer`][],
+`TypedArray`, or `DataView`. A string `key` is decoded using `options.encoding`,
+which defaults to `'utf8'`; a string `iv` is always decoded as UTF-8. The `key`
+may optionally be a [`KeyObject`][] of type `secret`. If the cipher does not
+need an initialization vector, `iv` may be `null`.
 
 When passing strings for `key` or `iv`, please consider
 [caveats when using strings as inputs to cryptographic APIs][].
 
-Initialization vectors should be unpredictable and unique; ideally, they will be
-cryptographically random. They do not have to be secret: IVs are typically just
-added to ciphertext messages unencrypted. It may sound contradictory that
-something has to be unpredictable and unique, but does not have to be secret;
-remember that an attacker must not be able to predict ahead of time what a
-given IV will be.
+Initialization vector requirements depend on the algorithm. For some
+algorithms, an IV must be unpredictable and unique; for others, uniqueness
+alone is sufficient, a fixed value is required, or no IV is used. Follow the
+requirements for the selected algorithm. IVs typically do not have to be secret
+and can be transmitted with the ciphertext.
 
 ### `crypto.createDecipheriv(algorithm, key, iv[, options])`
 
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Additional ciphers available through OpenSSL providers (e.g.
+                 SM4-GCM, SM4-CCM, SM4-XTS, CBC-CTS, and AES key-wrap variants)
+                 are now supported. The `ctsMode` and `xtsStandard` options
+                 were added.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/63411
     description: Ciphers in SIV and GCM-SIV modes are now supported.
@@ -3673,40 +3807,59 @@ changes:
 * `algorithm` {string}
 * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
 * `iv` {string|ArrayBuffer|Buffer|TypedArray|DataView|null}
-* `options` {Object} [`stream.transform` options][]
+* `options` {Object} [`stream.transform` options][] with these additional
+  properties:
+  * `authTagLength` {number} The authentication tag length in bytes. Its
+    requirements and default depend on the authenticated cipher, as described
+    below.
+  * `ctsMode` {string} The [CBC-CTS mode][] variant. One of `'CS1'`, `'CS2'`,
+    or `'CS3'`. The values are case-sensitive. **Default:** `'CS1'`.
+  * `encoding` {string} The [encoding][] to use when `key` is a string. This
+    option does not affect a string `iv`, which is always interpreted as UTF-8.
+    **Default:** `'utf8'`.
+  * `xtsStandard` {string} The standard used by `sm4-xts`. One of `'GB'` or
+    `'IEEE'`. The values are case-sensitive. **Default:** `'GB'`.
 * Returns: {Decipheriv}
 
 Creates and returns a `Decipheriv` object that uses the given `algorithm`, `key`
 and initialization vector (`iv`).
 
-The `options` argument controls stream behavior and is optional except when a
-cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-`authTagLength` option is required and specifies the length of the
-authentication tag in bytes, see [CCM mode][].
-For AES-GCM and `chacha20-poly1305`, the `authTagLength` option defaults to 16
-bytes and must be set to a different value if a different length is used. For
-`SIV` and `GCM-SIV`, the `authTagLength` option defaults to 16 bytes and only
-16-byte authentication tags are supported.
-
-The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-recent OpenSSL releases, `openssl list -cipher-algorithms` will
-display the available cipher algorithms.
+The `options` argument controls cipher-specific settings and stream behavior.
+It is optional except when a cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`)
+is used. In that case, the `authTagLength` option is required and specifies the
+length of the authentication tag in bytes, see [CCM mode][]. For GCM and
+`chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes and must be
+set if a different length is used. For `SIV` and `GCM-SIV`, the `authTagLength`
+option defaults to 16 bytes and only 16-byte authentication tags are supported.
+
+The `ctsMode` and `xtsStandard` options configure parameters exposed by OpenSSL
+providers. They are available only with OpenSSL 3.0 or later and a provider
+that supports the corresponding parameter. `ctsMode` applies only to CBC-CTS
+ciphers, and `xtsStandard` applies only to `sm4-xts`. Supplying either option
+for an available cipher implementation that does not support it throws an
+`ERR_CRYPTO_UNSUPPORTED_OPERATION` error. See [CBC-CTS mode][] and [XTS mode][]
+for details.
+
+The available algorithms depend on OpenSSL. [`crypto.getCiphers()`][] lists the
+algorithms exposed by Node.js. On recent OpenSSL releases,
+`openssl list -cipher-algorithms` displays the algorithms available to OpenSSL,
+which can include algorithms that Node.js does not expose.
 
 The `key` is the raw key used by the `algorithm` and `iv` is an
-[initialization vector][]. Both arguments must be `'utf8'` encoded strings,
-[Buffers][`Buffer`], `TypedArray`, or `DataView`s. The `key` may optionally be
-a [`KeyObject`][] of type `secret`. If the cipher does not need
-an initialization vector, `iv` may be `null`.
+[initialization vector][]. Each may be a string, `ArrayBuffer`, [`Buffer`][],
+`TypedArray`, or `DataView`. A string `key` is decoded using `options.encoding`,
+which defaults to `'utf8'`; a string `iv` is always decoded as UTF-8. The `key`
+may optionally be a [`KeyObject`][] of type `secret`. If the cipher does not
+need an initialization vector, `iv` may be `null`.
 
 When passing strings for `key` or `iv`, please consider
 [caveats when using strings as inputs to cryptographic APIs][].
 
-Initialization vectors should be unpredictable and unique; ideally, they will be
-cryptographically random. They do not have to be secret: IVs are typically just
-added to ciphertext messages unencrypted. It may sound contradictory that
-something has to be unpredictable and unique, but does not have to be secret;
-remember that an attacker must not be able to predict ahead of time what a given
-IV will be.
+Initialization vector requirements depend on the algorithm. For some
+algorithms, an IV must be unpredictable and unique; for others, uniqueness
+alone is sufficient, a fixed value is required, or no IV is used. Follow the
+requirements for the selected algorithm. IVs typically do not have to be secret
+and can be transmitted with the ciphertext.
 
 ### `crypto.createDiffieHellman(prime[, primeEncoding][, generator][, generatorEncoding])`
 
@@ -3789,6 +3942,11 @@ and description of each available elliptic curve.
 <!-- YAML
 added: v0.1.92
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Hash algorithms exposed by OpenSSL providers are now
+                 supported. The `functionName` and `customization` options
+                 were added for cSHAKE hash functions.
   - version: v12.8.0
     pr-url: https://github.com/nodejs/node/pull/28805
     description: The `outputLength` option was added for XOF hash functions.
@@ -3796,6 +3954,14 @@ changes:
 
 * `algorithm` {string}
 * `options` {Object} [`stream.transform` options][]
+  * `customization` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the customization byte string. **Default:** an
+    empty byte string.
+  * `functionName` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the NIST function-name byte string. **Default:**
+    an empty byte string.
+  * `outputLength` {number} For XOF hash functions, specifies the desired
+    output length in bytes.
 * Returns: {Hash}
 
 Creates and returns a `Hash` object that can be used to generate hash digests
@@ -3803,12 +3969,23 @@ using the given `algorithm`. Optional `options` argument controls stream
 behavior. For XOF hash functions such as `'shake256'`, the `outputLength` option
 can be used to specify the desired output length in bytes.
 
+The `functionName` and `customization` options apply only to cSHAKE-128 and
+cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or
+later and the selected provider supports the corresponding digest parameters.
+Strings are encoded as UTF-8, and neither strings nor byte values may contain
+NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in
+providers, `functionName` is case-sensitive and must be `''`, `'TupleHash'`,
+`'ParallelHash'`, or `'KMAC'`. Other providers can impose different
+restrictions. With both options empty, cSHAKE produces the same output as the
+corresponding SHAKE function for the same output length. `cshake-128` and
+`cshake-256` default to output lengths of 32 and 64 bytes, respectively.
+
 When the data is small (< 5MB) and readily available, [`crypto.hash()`][] is usually faster.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`. Use
+[`crypto.getHashes()`][] to obtain the list of hash algorithms available to the
+Node.js process.
 
 Example: generating the sha256 sum of a file
 
@@ -3891,10 +4068,11 @@ changes:
 Creates and returns an `Hmac` object that uses the given `algorithm` and `key`.
 Optional `options` argument controls stream behavior.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`.
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+HMAC imposes additional restrictions, so not every listed algorithm is
+suitable.
 
 The `key` is the HMAC key used to generate the cryptographic HMAC hash. If it is
 a [`KeyObject`][], its type must be `secret`. If it is a string, please consider
@@ -3957,6 +4135,65 @@ input.on('readable', () => {
 });
 ```
 
+### `crypto.createMac(algorithm, key[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.2 - Release candidate
+
+* `algorithm` {string} The name of the MAC algorithm.
+* `key` {ArrayBuffer|Buffer|TypedArray|DataView|KeyObject}
+* `options` {Object} [`stream.transform` options][]
+  * `digest` {string} The digest used by a MAC such as HMAC.
+  * `cipher` {string} The cipher used by a MAC such as CMAC or GMAC.
+  * `iv` {ArrayBuffer|Buffer|TypedArray|DataView} The initialization vector for
+    a MAC such as GMAC.
+  * `customization` {ArrayBuffer|Buffer|TypedArray|DataView} A customization
+    byte string for MACs that support it, such as KMAC.
+  * `salt` {ArrayBuffer|Buffer|TypedArray|DataView} A salt byte string for MACs
+    that support it, such as BLAKE2 MACs.
+  * `outputLength` {number} The requested provider output size in bytes. Must be
+    an unsigned 32-bit integer. Provider-specific restrictions also apply.
+* Returns: {Mac}
+
+`algorithm` must be a non-empty provider MAC name. The MAC-specific properties
+listed above are extensions to the standard [`stream.transform` options][] and
+are passed only when the selected provider implementation advertises the
+corresponding parameter with the expected type. A supplied MAC-specific option
+that the selected implementation does not support causes an error.
+
+The following table summarizes the MAC-specific options accepted by MAC
+implementations in OpenSSL's built-in providers. The `key` argument is required
+for every MAC. The table lists only MAC-specific options; standard
+[`stream.transform` options][] remain available for every family.
+
+| MAC family | Required options                        | Optional options                        | Notes                                                                  |
+| ---------- | --------------------------------------- | --------------------------------------- | ---------------------------------------------------------------------- |
+| HMAC       | `digest`                                | None                                    |                                                                        |
+| CMAC       | `cipher` using CBC mode                 | None                                    |                                                                        |
+| GMAC       | `cipher` using GCM mode, non-empty `iv` | None                                    | Requires a unique IV for every message authenticated with a given key. |
+| KMAC       | None                                    | `customization`, `outputLength`         |                                                                        |
+| BLAKE2 MAC | None                                    | `customization`, `salt`, `outputLength` |                                                                        |
+| Poly1305   | None                                    | None                                    | Each key must be used for only one message.                            |
+| SipHash    | None                                    | `outputLength`                          |                                                                        |
+
+`outputLength` configures the output size of the provider MAC. It is never
+implemented by computing a longer tag and truncating it. A value of `0` is
+passed to the provider and is accepted only when that provider can initialize
+and finalize the MAC with a zero-byte output. When `outputLength` is omitted,
+the provider's default output size is used and must be nonzero.
+
+The `key` must contain bytes or be a [`KeyObject`][] of type `secret`. Key
+length and other key requirements are determined by the selected provider
+implementation.
+
+Available algorithms and their accepted parameters depend on the OpenSSL
+version, loaded providers, and active default property query. Use
+[`crypto.getMacs()`][] to list fetchable MAC names. A listed name can still
+require options or a key with provider-specific properties.
+
 ### `crypto.createPrivateKey(key)`
 
 <!-- YAML
@@ -4171,8 +4408,10 @@ added: v0.1.92
 * Returns: {Sign}
 
 Creates and returns a `Sign` object that uses the given `algorithm`. Use
-[`crypto.getHashes()`][] to obtain the names of the available digest algorithms.
-Optional `options` argument controls the `stream.Writable` behavior.
+[`crypto.getHashes()`][] to obtain the names available to the hashing APIs. The
+key type and signature scheme can impose additional restrictions on which
+digests can be used. Optional `options` argument controls the
+`stream.Writable` behavior.
 
 In some cases, a `Sign` instance can be created using the name of a signature
 algorithm, such as `'RSA-SHA256'`, instead of a digest algorithm. This will use
@@ -4191,8 +4430,9 @@ added: v0.1.92
 * Returns: {Verify}
 
 Creates and returns a `Verify` object that uses the given algorithm.
-Use [`crypto.getHashes()`][] to obtain an array of names of the available
-signing algorithms. Optional `options` argument controls the
+Use [`crypto.getHashes()`][] to obtain the names available to the hashing APIs.
+The key type and signature scheme can impose additional restrictions on which
+digests can be used. Optional `options` argument controls the
 `stream.Writable` behavior.
 
 In some cases, a `Verify` instance can be created using the name of a signature
@@ -4439,6 +4679,10 @@ changes:
 Generates a new asymmetric key pair of the given `type`. See the
 supported [asymmetric key types][].
 
+For RSA-PSS keys, [`crypto.getHashes()`][] lists algorithms available to the
+hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters
+or is supported by the active RSA implementation.
+
 If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
 behaves as if [`keyObject.export()`][] had been called on its result. Otherwise,
 the respective part of the key is returned as a [`KeyObject`][].
@@ -4561,6 +4805,10 @@ changes:
 Generates a new asymmetric key pair of the given `type`. See the
 supported [asymmetric key types][].
 
+For RSA-PSS keys, [`crypto.getHashes()`][] lists algorithms available to the
+hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters
+or is supported by the active RSA implementation.
+
 If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
 behaves as if [`keyObject.export()`][] had been called on its result. Otherwise,
 the respective part of the key is returned as a [`KeyObject`][].
@@ -4919,11 +5167,27 @@ mode][].
 
 <!-- YAML
 added: v0.9.3
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Names and aliases exposed by loaded OpenSSL providers that
+                 match the default property query are now included.
 -->
 
 * Returns: {string\[]} An array of the names of the supported hash algorithms,
   such as `'RSA-SHA256'`. Hash algorithms are also called "digest" algorithms.
 
+This is the authoritative Node.js list of hash algorithms available to
+[`crypto.createHash()`][] and [`crypto.hash()`][] in the current process. With
+OpenSSL 3 or later, the list depends on the loaded providers and the default
+property query in effect when the list is first generated. Some listed
+algorithms can require API-specific options, such as `outputLength` for XOF
+hash functions.
+
+A listed hash algorithm is not necessarily supported by APIs that combine a
+digest with another cryptographic operation, such as HMAC, key derivation, or
+signing. Those operations can apply additional restrictions.
+
 ```mjs
 const {
   getHashes,
@@ -4940,6 +5204,40 @@ const {
 console.log(getHashes()); // ['DSA', 'DSA-SHA', 'DSA-SHA1', ...]
 ```
 
+### `crypto.getMacs()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.2 - Release candidate
+
+* Returns: {string\[]} A fresh array containing the sorted, lowercase names
+  and aliases of fetchable MAC implementations.
+
+Returns MAC names exposed by loaded OpenSSL providers that match the active
+default property query. Duplicate names and numeric OID aliases are omitted.
+On builds without OpenSSL `EVP_MAC` support, this function returns an empty
+array.
+
+The returned names describe implementations that OpenSSL can fetch. They do not
+guarantee that [`crypto.createMac()`][] can initialize the MAC without
+additional options. A provider can require additional parameters or a key with
+algorithm-specific properties, and it can expose parameters that this API does
+not support.
+
+After a successful FIPS mode change made with [`crypto.setFips()`][], subsequent
+calls reflect the new mode, and newly created `Mac` objects use it. Existing
+`Mac` objects continue using the provider implementation selected when they
+were created.
+
+```mjs
+const { getMacs } = await import('node:crypto');
+
+console.log(getMacs());
+// ['blake2bmac', 'blake2smac', 'cmac', 'gmac', 'hmac', ...]
+```
+
 ### `crypto.getRandomValues(typedArray)`
 
 <!-- YAML
@@ -4960,6 +5258,11 @@ added:
  - v21.7.0
  - v20.12.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Hash algorithms exposed by OpenSSL providers are now
+                 supported. The `functionName` and `customization` options
+                 were added for cSHAKE hash functions.
   - version:
      - v25.5.0
      - v24.13.1
@@ -4977,6 +5280,12 @@ changes:
   into a `TypedArray` using either `TextEncoder` or `Buffer.from()` and passing
   the encoded `TypedArray` into this API instead.
 * `options` {Object|string}
+  * `customization` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the customization byte string. **Default:** an
+    empty byte string.
+  * `functionName` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the NIST function-name byte string. **Default:**
+    an empty byte string.
   * `outputEncoding` {string} [Encoding][encoding] used to encode the
     returned digest. **Default:** `'hex'`.
   * `outputLength` {number} For XOF hash functions such as 'shake256',
@@ -4988,10 +5297,21 @@ the object-based `crypto.createHash()` when hashing a smaller amount of data
 (<= 5MB) that's readily available. If the data can be big or if it is streamed,
 it's still recommended to use `crypto.createHash()` instead.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`. Use
+[`crypto.getHashes()`][] to obtain the list of hash algorithms available to the
+Node.js process.
+
+The `functionName` and `customization` options apply only to cSHAKE-128 and
+cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or
+later and the selected provider supports the corresponding digest parameters.
+Strings are encoded as UTF-8, and neither strings nor byte values may contain
+NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in
+providers, `functionName` is case-sensitive and must be `''`, `'TupleHash'`,
+`'ParallelHash'`, or `'KMAC'`. Other providers can impose different
+restrictions. With both options empty, cSHAKE produces the same output as the
+corresponding SHAKE function for the same output length. `cshake-128` and
+`cshake-256` default to output lengths of 32 and 64 bytes, respectively.
 
 If `options` is a string, then it specifies the `outputEncoding`.
 
@@ -5063,6 +5383,10 @@ changes:
 
 HKDF is a simple key derivation function defined in RFC 5869. The given `ikm`,
 `salt` and `info` are used with the `digest` to derive a key of `keylen` bytes.
+The available digest algorithms depend on the version and configuration of
+OpenSSL. HKDF uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or HKDF.
 
 The supplied `callback` function is called with two arguments: `err` and
 `derivedKey`. If an error occurs while deriving the key, `err` will be set;
@@ -5122,6 +5446,10 @@ changes:
 Provides a synchronous HKDF key derivation function as defined in RFC 5869. The
 given `ikm`, `salt` and `info` are used with the `digest` to derive a key of
 `keylen` bytes.
+The available digest algorithms depend on the version and configuration of
+OpenSSL. HKDF uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or HKDF.
 
 The successfully generated `derivedKey` will be returned as an {ArrayBuffer}.
 
@@ -5231,8 +5559,10 @@ pbkdf2('secret', 'salt', 100000, 64, 'sha512', (err, derivedKey) => {
 });
 ```
 
-An array of supported digest functions can be retrieved using
-[`crypto.getHashes()`][].
+The available digest algorithms depend on the version and configuration of
+OpenSSL. PBKDF2 uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or PBKDF2.
 
 This API uses libuv's threadpool, which can have surprising and
 negative performance implications for some applications; see the
@@ -5304,8 +5634,10 @@ const key = pbkdf2Sync('secret', 'salt', 100000, 64, 'sha512');
 console.log(key.toString('hex'));  // '3745e48...08d59ae'
 ```
 
-An array of supported digest functions can be retrieved using
-[`crypto.getHashes()`][].
+The available digest algorithms depend on the version and configuration of
+OpenSSL. PBKDF2 uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or PBKDF2.
 
 ### `crypto.privateDecrypt(privateKey, buffer)`
 
@@ -5361,6 +5693,10 @@ changes:
 Decrypts `buffer` with `privateKey`. `buffer` was previously encrypted using
 the corresponding public key, for example using [`crypto.publicEncrypt()`][].
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the active RSA implementation can impose additional restrictions on digests
+used for OAEP or MGF1.
+
 If `privateKey` is not a [`KeyObject`][], this function behaves as if
 `privateKey` had been passed to [`crypto.createPrivateKey()`][]. If it is an
 object, the `padding` property can be passed. Otherwise, this function uses
@@ -5509,6 +5845,10 @@ Encrypts the content of `buffer` with `key` and returns a new
 [`Buffer`][] with encrypted content. The returned data can be decrypted using
 the corresponding private key, for example using [`crypto.privateDecrypt()`][].
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the active RSA implementation can impose additional restrictions on digests
+used for OAEP or MGF1.
+
 If `key` is not a [`KeyObject`][], this function behaves as if
 `key` had been passed to [`crypto.createPublicKey()`][]. If it is an
 object, the `padding` property can be passed. Otherwise, this function uses
@@ -6173,11 +6513,14 @@ changes:
     description: Custom engine support in OpenSSL 3 is deprecated.
 -->
 
+> Stability: 0 - Deprecated
+
 * `engine` {string}
 * `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
 
 Load and set the `engine` for some or all OpenSSL functions (selected by flags).
-Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
+Use of this API is deprecated because custom engine support has been deprecated
+since OpenSSL 3.
 
 `engine` could be either an id or a path to the engine's shared library.
 
@@ -6282,6 +6625,10 @@ dependent upon the key type.
 `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
 ML-DSA.
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the key type and signature scheme determine whether a listed digest can be
+used for signing.
+
 If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
 passed to [`crypto.createPrivateKey()`][]. When `key` is a string, `ArrayBuffer`,
 [`Buffer`][], `TypedArray`, or `DataView`, it must contain PEM-encoded key
@@ -6419,6 +6766,10 @@ key type.
 `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
 ML-DSA.
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the key type and signature scheme determine whether a listed digest can be
+used for verification.
+
 If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
 passed to [`crypto.createPublicKey()`][]. When `key` is a string, `ArrayBuffer`,
 [`Buffer`][], `TypedArray`, or `DataView`, it must contain PEM-encoded key
@@ -6662,6 +7013,79 @@ try {
 console.log(receivedPlaintext);
 ```
 
+### CBC-CTS mode
+
+For CBC ciphertext stealing (CBC-CTS) ciphers, the `ctsMode` option to
+[`crypto.createCipheriv()`][] or [`crypto.createDecipheriv()`][] selects the
+variant:
+
+* `'CS1'` is the default. For block-aligned input, its output is the same as CBC
+  mode.
+* `'CS2'` is also the same as CBC for block-aligned input. For input with a
+  partial final block, it swaps the final full and partial ciphertext blocks
+  relative to CS1.
+* `'CS3'` is the Kerberos 5 variant. It uses the CS2 ordering for a partial
+  final block and swaps the final two ciphertext blocks even for block-aligned
+  input.
+
+Encryption and decryption must use the same variant. The option is available
+only with CBC-CTS provider ciphers on OpenSSL 3.0 or later.
+
+Applications which use this mode must adhere to these restrictions:
+
+* The plaintext or ciphertext must be at least one block long.
+* The ciphertext has the same length as the plaintext.
+* `cipher.update()` or `decipher.update()` must be called exactly once with all
+  input data. Stream methods such as `write(data)`, `end(data)`, or `pipe()` may
+  fail because CBC-CTS does not accept multiple data updates.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+* `crypto.getCipherInfo()` reports the base mode as `'cbc'`.
+
+### XTS mode
+
+XTS ciphers operate on independently tweakable data units. A `Cipheriv` or
+`Decipheriv` instance represents one complete data unit, and its `iv` argument
+provides the 16-byte tweak. Use a new instance with the appropriate positional
+tweak for each different logical data unit.
+
+Applications which use XTS mode must adhere to these restrictions:
+
+* The plaintext or ciphertext must be at least one 16-byte block. Its length
+  does not have to be a multiple of 16 bytes because XTS uses ciphertext
+  stealing for a final partial block.
+* The ciphertext has the same length as the plaintext.
+* `cipher.update()` or `decipher.update()` must be called exactly once with all
+  input data. Stream methods such as `write(data)`, `end(data)`, or `pipe()` may
+  fail because XTS does not accept multiple data updates.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+
+For `sm4-xts`, the `xtsStandard` option to [`crypto.createCipheriv()`][] or
+[`crypto.createDecipheriv()`][] selects either the default `'GB'` variant from
+GB/T 17964-2021 or the `'IEEE'` variant from IEEE Std 1619-2007. Encryption and
+decryption must use the same variant. The option is available only for
+`sm4-xts`; it does not apply to AES-XTS ciphers. OpenSSL's default provider
+supports `sm4-xts` in OpenSSL 3.2 or later.
+
+### AES key wrap modes
+
+AES key wrap (`AES-WRAP`) and AES key wrap with padding (`AES-WRAP-PAD`)
+ciphers operate on a complete key-data value rather than on an incremental byte
+stream. The inverse-transform variants have the same processing restrictions.
+
+Applications which use an AES key wrap cipher must adhere to these
+restrictions:
+
+* `cipher.update()` or `decipher.update()` must be called exactly once with the
+  complete, non-empty input value.
+* Do not use AES key wrap ciphers as generic [`stream.Transform`][] streams.
+  Methods such as `write(data)`, `end(data)`, and `pipe()` can split one value
+  across multiple updates, with each update being treated as a separate wrap or
+  unwrap operation.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+
 ### SIV and GCM-SIV modes
 
 `SIV`[^openssl30] and `GCM-SIV`[^openssl32] are supported [AEAD algorithms][]
@@ -6787,12 +7211,18 @@ startup. The following controls are also available:
 * [`--enable-fips`][] and [`--force-fips`][] enable the property query and
   additionally require the configured provider named `fips` to initialize and
   pass its self-test. Node.js exits if that check fails. `--force-fips` also
-  prevents FIPS mode from being disabled from script code.
+  prevents FIPS mode from being disabled from script code. With
+  `--force-fips=strict`, Node.js also rejects non-approved operations reported
+  through the OpenSSL FIPS indicator callback.
 * [`crypto.setFips()`][] changes the FIPS/property-query state. On OpenSSL 3, it
   does not install, load, initialize, or validate a provider. Implementations
   fetched before the call are not changed.
 * [`crypto.getFips()`][] reports the FIPS/property-query state. On OpenSSL 3, a
   return value of `1` does not prove that a FIPS provider is loaded or validated.
+* With [`--enable-fips-indicator-events`][], the
+  [`'crypto.fips.indicator'`][] diagnostics channel reports non-approved
+  operations permitted by an OpenSSL 3.4 or later FIPS provider configured for
+  backwards compatibility.
 
 With OpenSSL 1.1.1, these controls use the library's FIPS mode support and
 require a FIPS-capable OpenSSL build.
@@ -7087,6 +7517,8 @@ See the [list of SSL OP Flags][] for details.
 [^openssl35]: Requires OpenSSL >= 3.5
 
 [AEAD algorithms]: https://en.wikipedia.org/wiki/Authenticated_encryption
+[AES key wrap modes]: #aes-key-wrap-modes
+[CBC-CTS mode]: #cbc-cts-mode
 [CCM mode]: #ccm-mode
 [CVE-2021-44532]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
 [Caveats]: #support-for-weak-or-compromised-algorithms
@@ -7116,8 +7548,12 @@ See the [list of SSL OP Flags][] for details.
 [RFC 7517]: https://www.rfc-editor.org/rfc/rfc7517.txt
 [RFC 8032]: https://www.rfc-editor.org/rfc/rfc8032.txt
 [RFC 9562]: https://www.rfc-editor.org/rfc/rfc9562.txt
+[SIV and GCM-SIV modes]: #siv-and-gcm-siv-modes
 [Web Crypto API documentation]: webcrypto.md
+[XTS mode]: #xts-mode
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
 [`--enable-fips`]: cli.md#--enable-fips
 [`--force-fips`]: cli.md#--force-fips
 [`--openssl-config`]: cli.md#--openssl-configfile
@@ -7139,6 +7575,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.createECDH()`]: #cryptocreateecdhcurvename
 [`crypto.createHash()`]: #cryptocreatehashalgorithm-options
 [`crypto.createHmac()`]: #cryptocreatehmacalgorithm-key-options
+[`crypto.createMac()`]: #cryptocreatemacalgorithm-key-options
 [`crypto.createPrivateKey()`]: #cryptocreateprivatekeykey
 [`crypto.createPublicKey()`]: #cryptocreatepublickeykey
 [`crypto.createSecretKey()`]: #cryptocreatesecretkeykey-encoding
@@ -7146,10 +7583,12 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.createVerify()`]: #cryptocreateverifyalgorithm-options
 [`crypto.generateKey()`]: #cryptogeneratekeytype-options-callback
 [`crypto.generateKeyPair()`]: #cryptogeneratekeypairtype-options-callback
+[`crypto.getCiphers()`]: #cryptogetciphers
 [`crypto.getCurves()`]: #cryptogetcurves
 [`crypto.getDiffieHellman()`]: #cryptogetdiffiehellmangroupname
 [`crypto.getFips()`]: #cryptogetfips
 [`crypto.getHashes()`]: #cryptogethashes
+[`crypto.getMacs()`]: #cryptogetmacs
 [`crypto.hash()`]: #cryptohashalgorithm-data-options
 [`crypto.privateDecrypt()`]: #cryptoprivatedecryptprivatekey-buffer
 [`crypto.privateEncrypt()`]: #cryptoprivateencryptprivatekey-buffer
@@ -7159,6 +7598,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.randomFill()`]: #cryptorandomfillbuffer-offset-size-callback
 [`crypto.setFips()`]: #cryptosetfipsbool
 [`crypto.sign()`]: #cryptosignalgorithm-data-key-callback
+[`crypto.timingSafeEqual()`]: #cryptotimingsafeequala-b
 [`crypto.verify()`]: #cryptoverifyalgorithm-data-key-signature-callback
 [`crypto.webcrypto.getRandomValues()`]: webcrypto.md#cryptogetrandomvaluestypedarray
 [`crypto.webcrypto.subtle`]: webcrypto.md#class-subtlecrypto
@@ -7175,9 +7615,12 @@ See the [list of SSL OP Flags][] for details.
 [`hmac.update()`]: #hmacupdatedata-inputencoding
 [`import()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import
 [`keyObject.export()`]: #keyobjectexportoptions
+[`mac.final()`]: #macfinaloutputencoding
+[`mac.update()`]: #macupdatedata-inputencoding
 [`postMessage()`]: worker_threads.md#portpostmessagevalue-transferlist
 [`sign.sign()`]: #signsignprivatekey-outputencoding
 [`sign.update()`]: #signupdatedata-inputencoding
+[`stream.Transform`]: stream.md#class-streamtransform
 [`stream.Writable` options]: stream.md#new-streamwritableoptions
 [`stream.transform` options]: stream.md#new-streamtransformoptions
 [`util.promisify()`]: util.md#utilpromisifyoriginal
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 9b18c4ed486f..295285ffcd1b 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4612,6 +4612,104 @@ throwing an error. This behavior is inconsistent with `hash.digest()` and
 may lead to subtle bugs. Calling `hmac.digest()` on a finalized `Hmac` instance
 will throw an error in a future version.
 
+<!-- md-lint skip-deprecation DEP0207 -->
+
+### DEP0208: `Server.prototype._listen2`
+
+<!-- YAML
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64794
+    description: Documentation-only.
+-->
+
+Type: Documentation-only
+
+`net.Server.prototype._listen2` is an undocumented alias for an internal
+function that sets up the listening handle. It is kept only so that code
+replacing it keeps being called by [`server.listen()`][], and it will be
+removed in a future version of Node.js. Use [`server.listen()`][] instead of
+calling or overriding `_listen2`.
+
+### DEP0209: Using `AbortSignal` to dispose of resources
+
+<!-- YAML
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64342
+    description: Documentation-only deprecation.
+-->
+
+Type: Documentation-only
+
+Using `AbortSignal` to destroy long-lived resources is deprecated. Prefer
+`using` for resource cleanup.
+
+`AbortSignal` is still a good fit for canceling actions, propagating
+cancellation from the outside, and timeouts.
+
+```js
+// Deprecated
+async function example() {
+  const ac = new AbortController();
+  const server = http.createServer(handler);
+  server.listen({ port: 3000, signal: ac.signal });
+
+  await doWork();
+  ac.abort();
+}
+```
+
+```js
+// Use this instead
+async function example() {
+  await using server = http.createServer(handler);
+  server.listen(3000);
+
+  await doWork();
+}
+```
+
+```js
+// Deprecated
+async function example() {
+  const ac = new AbortController();
+  const stream = addAbortSignal(ac.signal, fs.createReadStream(file));
+
+  await consume(stream);
+  ac.abort();
+}
+```
+
+```js
+// Use this instead
+async function example() {
+  await using stream = fs.createReadStream(file);
+
+  await consume(stream);
+}
+```
+
+```js
+// Deprecated
+async function example() {
+  const ac = new AbortController();
+  const child = spawn(command, args, { signal: ac.signal });
+
+  await doWork();
+  ac.abort();
+}
+```
+
+```js
+// Use this instead
+async function example() {
+  using child = spawn(command, args);
+
+  await doWork();
+}
+```
+
 [DEP0142]: #dep0142-repl_builtinlibs
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
@@ -4740,6 +4838,7 @@ will throw an error in a future version.
 [`response.writableEnded`]: http.md#responsewritableended
 [`response.writableFinished`]: http.md#responsewritablefinished
 [`script.createCachedData()`]: vm.md#scriptcreatecacheddata
+[`server.listen()`]: net.md#serverlisten
 [`setInterval()`]: timers.md#setintervalcallback-delay-args
 [`setTimeout()`]: timers.md#settimeoutcallback-delay-args
 [`socket.bufferSize`]: net.md#socketbuffersize
diff --git a/doc/api/diagnostics_channel.md b/doc/api/diagnostics_channel.md
index 0971e04609b5..2dff06e2d92d 100644
--- a/doc/api/diagnostics_channel.md
+++ b/doc/api/diagnostics_channel.md
@@ -1570,6 +1570,72 @@ passed to `console.warn()`.
 Emitted when `console.error()` is called. Receives and array of the arguments
 passed to `console.error()`.
 
+#### Crypto
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+##### Event: `'crypto.fips.indicator'`
+
+* `operation` {string} The provider-defined operation type.
+* `reason` {string} The provider-defined description of why the operation is
+  not approved.
+* `blocked` {boolean} Whether an indicator callback blocked the operation.
+* `count` {number} The number of matching pending indicator invocations
+  represented by this message.
+* `dropped` {number} The number of additional indicator invocations dropped
+  before this message was delivered.
+
+Emitted when the OpenSSL FIPS provider used by Node.js detects an operation that
+is not FIPS approved after the corresponding provider check was relaxed. Such
+operations are possible when the provider is configured for backwards
+compatibility. The `operation` and `reason` values come from the provider and
+should be treated as opaque strings rather than stable enumerations.
+
+Start Node.js with [`--enable-fips-indicator-events`][] to enable this channel.
+Without the option, subscribing does not install the OpenSSL callback and no
+messages are published.
+
+Subscribing to the channel is observation-only and never changes the result of
+an operation. Node.js preserves the result from any native indicator callback
+installed before Node.js initializes its crypto support. When
+[`--force-fips=strict`][] is used, Node.js rejects callback-indicated
+non-approved operations whether or not indicator events are enabled or the
+channel has subscribers.
+
+Messages are published asynchronously on the main thread because OpenSSL
+indicators can originate from Workers or other threads. Only subscriptions on
+the main thread receive messages. Delivery order relative to the originating
+operation is not defined, and a message cannot be correlated with a particular
+call or Worker.
+
+One cryptographic operation can invoke the OpenSSL indicator more than once.
+Matching pending invocations are coalesced and reflected in `count`, which does
+not necessarily represent a number of cryptographic operations. At most 256
+distinct messages are queued. Additional invocations are reported in `dropped`
+on the first queued message. Queued messages do not keep the event loop active,
+so this channel is best-effort diagnostics rather than an authoritative audit
+log.
+
+This channel observes the default OpenSSL library context used by Node.js. It
+does not observe native addons or other code that uses another `OSSL_LIB_CTX`
+or another copy of `libcrypto`. It is active with OpenSSL 3.4 and later and is
+not available with BoringSSL. A provider configured to reject a check directly,
+including a pedantic OpenSSL FIPS provider, can reject an operation without
+emitting an indicator. Receiving or not receiving a message does not establish
+that Node.js or a cryptographic operation is FIPS validated.
+
+```mjs
+import diagnosticsChannel from 'node:diagnostics_channel';
+
+diagnosticsChannel.subscribe('crypto.fips.indicator', (message) => {
+  console.error('Non-approved cryptographic operation', message);
+});
+```
+
 #### HTTP
 
 > Stability: 1 - Experimental
@@ -1961,6 +2027,8 @@ statement, since both are still in use while the event is being delivered; see
 [BoundedChannel Channels]: #boundedchannel-channels
 [TracingChannel Channels]: #tracingchannel-channels
 [`'uncaughtException'`]: process.md#event-uncaughtexception
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
+[`--force-fips=strict`]: cli.md#--force-fips
 [`BoundedChannel`]: #class-boundedchannel
 [`DatabaseSync`]: sqlite.md#class-databasesync
 [`TracingChannel`]: #class-tracingchannel
diff --git a/doc/api/dtls.md b/doc/api/dtls.md
new file mode 100644
index 000000000000..33ea7445c82c
--- /dev/null
+++ b/doc/api/dtls.md
@@ -0,0 +1,584 @@
+# DTLS
+
+<!-- YAML
+added: v26.9.0
+-->
+
+<!-- introduced_in=v26.9.0 -->
+
+> Stability: 1 - Experimental
+
+<!-- source_link=lib/dtls.js -->
+
+The `node:dtls` module provides an implementation of the Datagram Transport
+Layer Security (DTLS) protocol over UDP. DTLS provides TLS-equivalent
+security guarantees for datagram-based communication, including
+confidentiality, integrity, and authentication.
+
+To use this module, it must be enabled at build time with the
+`--experimental-dtls` configure flag and at runtime with the
+`--experimental-dtls` CLI flag.
+
+```bash
+node --experimental-dtls app.mjs
+```
+
+```mjs
+import { listen, connect } from 'node:dtls';
+```
+
+```cjs
+const { listen, connect } = require('node:dtls');
+```
+
+## Permission model
+
+When using the [Permission Model][], the `--allow-net` flag must be passed to
+allow DTLS network operations. Without it, calling [`dtls.connect()`][] or
+[`dtls.listen()`][] will throw an `ERR_ACCESS_DENIED` error.
+
+```console
+node --permission --allow-fs-read=* --experimental-dtls index.mjs
+Error: Access to this API has been restricted. Use --allow-net to manage permissions.
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'Net',
+}
+```
+
+Creating a [`DTLSEndpoint`][] instance without connecting or listening
+is permitted even without `--allow-net`, since no network I/O occurs until
+[`dtls.connect()`][] or [`dtls.listen()`][] is called.
+
+## DTLS vs TLS
+
+DTLS is designed for UDP transport and differs from TLS in several key ways:
+
+* No stream guarantees: Messages may arrive out of order or be lost.
+  DTLS preserves datagram semantics.
+* One socket, many peers: A single UDP socket can serve multiple DTLS
+  sessions. The `DTLSEndpoint` manages this multiplexing.
+* Cookie exchange: DTLS servers use a stateless cookie mechanism
+  (HelloVerifyRequest) to prevent denial-of-service amplification attacks.
+* Retransmission: DTLS handles handshake retransmission internally since
+  UDP does not guarantee delivery.
+
+## `dtls.listen(callback, options)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `callback` {Function} Called for each new DTLS session accepted by the
+  server.
+  * `session` {DTLSSession} The new session.
+* `options` {Object}
+  * `cert` {string|Buffer} Server certificate in PEM format. **Required.**
+  * `key` {string|Buffer} Server private key in PEM format. **Required.**
+  * `port` {number} Port to bind to. **Required.**
+  * `host` {string} Address to bind to. **Default:** `'0.0.0.0'`.
+  * `ca` {string|Buffer|string\[]|Buffer\[]} CA certificates in PEM format.
+  * `ciphers` {string} OpenSSL cipher list string.
+  * `alpn` {string\[]|Buffer} ALPN protocol names.
+  * `srtp` {string} Colon-separated SRTP protection profile names
+    (e.g., `'SRTP_AES128_CM_SHA1_80:SRTP_AEAD_AES_128_GCM'`).
+  * `requestCert` {boolean} Request client certificate. **Default:** `false`.
+  * `mtu` {number} Maximum transmission unit for DTLS records.
+    **Default:** `1200`.
+* Returns: {DTLSEndpoint}
+
+Creates a DTLS server bound to the specified address and port. The server
+uses automatic HMAC-based cookie exchange for DoS protection.
+
+```mjs
+import { listen } from 'node:dtls';
+import { readFileSync } from 'node:fs';
+
+const endpoint = listen((session) => {
+  session.onmessage = (data) => {
+    console.log('Received:', data.toString());
+    session.send('pong');
+  };
+
+  session.onhandshake = (protocol) => {
+    console.log('Handshake complete:', protocol);
+  };
+}, {
+  cert: readFileSync('server-cert.pem'),
+  key: readFileSync('server-key.pem'),
+  port: 4433,
+});
+
+console.log('DTLS server listening on', endpoint.address);
+```
+
+## `dtls.connect(host, port[, options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `host` {string} Remote host to connect to.
+* `port` {number} Remote port to connect to.
+* `options` {Object}
+  * `ca` {string|Buffer|string\[]|Buffer\[]} CA certificates in PEM format.
+  * `cert` {string|Buffer} Client certificate in PEM format.
+  * `key` {string|Buffer} Client private key in PEM format.
+  * `rejectUnauthorized` {boolean} When `true`, the server's certificate must
+    both chain to a trusted CA and match the expected identity (`servername`,
+    or `host` when `servername` is not set); otherwise the handshake is
+    aborted and `session.opened` rejects. When `false`, the certificate is not
+    verified. **Default:** `true`.
+  * `servername` {string} Server name used for the SNI (Server Name
+    Indication) extension and as the identity checked during certificate
+    verification. **Default:** the `host` argument. Set to `''` to disable SNI.
+    SNI is never sent for IP address literals.
+  * `bindHost` {string} Local bind address. **Default:** `'0.0.0.0'`.
+  * `bindPort` {number} Local bind port. **Default:** `0` (ephemeral).
+  * `alpn` {string\[]|Buffer} ALPN protocol names.
+  * `srtp` {string} SRTP protection profile names.
+  * `mtu` {number} Maximum transmission unit. **Default:** `1200`.
+* Returns: {DTLSSession}
+
+Connects to a DTLS server. Returns a `DTLSSession` whose `opened` property
+is a `Promise` that resolves when the handshake completes.
+
+```mjs
+import { connect } from 'node:dtls';
+import { readFileSync } from 'node:fs';
+
+const session = connect('localhost', 4433, {
+  ca: [readFileSync('ca-cert.pem')],
+});
+
+await session.opened;
+session.send('hello');
+
+session.onmessage = (data) => {
+  console.log('Received:', data.toString());
+};
+```
+
+## Class: `DTLSEndpoint`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Manages a UDP socket and multiplexes DTLS sessions.
+
+### `endpoint.address`
+
+* Returns: {Object} `{ address, family, port }`
+
+The local address the endpoint is bound to.
+
+### `endpoint.state`
+
+* Returns: {DTLSEndpointState}
+
+Shared state object with properties:
+
+* `bound` {boolean}
+* `listening` {boolean}
+* `closing` {boolean}
+* `destroyed` {boolean}
+* `sessionCount` {number}
+* `busy` {boolean}
+
+### `endpoint.stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {DTLSEndpoint.Stats}
+
+The statistics collected for this endpoint. Read only. The stats object is
+live and updated by the C++ internals as data flows through the endpoint.
+
+### `endpoint.busy`
+
+* {boolean}
+
+When `true`, the endpoint rejects new incoming connections. Can be set
+to implement backpressure.
+
+### `endpoint.close()`
+
+* Returns: {Promise} Resolves when the endpoint is fully closed.
+
+Gracefully closes the endpoint. All active sessions are closed with
+`close_notify` alerts before the UDP socket is released.
+
+### `endpoint.destroy([error])`
+
+Immediately destroys the endpoint without sending `close_notify` alerts.
+
+### `endpoint.closed`
+
+* {Promise} Resolves when the endpoint has fully closed.
+
+### `endpoint[Symbol.asyncDispose]()`
+
+Equivalent to calling `endpoint.close()`.
+
+## Class: `DTLSEndpoint.Stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+A view of the collected statistics for an endpoint.
+
+### `endpointStats.createdAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the endpoint was created. Read only.
+
+### `endpointStats.destroyedAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the endpoint was destroyed. Read only.
+
+### `endpointStats.bytesReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of bytes received by this endpoint. Read only.
+
+### `endpointStats.bytesSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of bytes sent by this endpoint. Read only.
+
+### `endpointStats.packetsReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of UDP packets received by this endpoint. Read only.
+
+### `endpointStats.packetsSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of UDP packets sent by this endpoint. Read only.
+
+### `endpointStats.serverSessions`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of peer-initiated sessions accepted by this
+  endpoint. Read only.
+
+### `endpointStats.clientSessions`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of sessions initiated by this endpoint. Read only.
+
+### `endpointStats.serverBusyCount`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of incoming connections rejected because the
+  endpoint was marked busy. Read only.
+
+### `endpointStats.isConnected`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {boolean}
+
+`true` if the stats object is still connected to the underlying endpoint.
+Once the endpoint is destroyed, the stats become a stale snapshot.
+
+## Class: `DTLSSession`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Represents a DTLS association with a single remote peer.
+
+### `session.send(data)`
+
+* `data` {string|Buffer} The data to send.
+* Returns: {number} The number of bytes written to the DTLS layer.
+
+Send application data to the peer. The data is encrypted by DTLS before
+being sent over UDP. Can only be called after the handshake completes
+(`session.opened` has resolved).
+
+### `session.close()`
+
+* Returns: {Promise} Resolves when the session is closed.
+
+Initiates a graceful DTLS shutdown by sending a `close_notify` alert.
+
+### `session.destroy([error])`
+
+Immediately destroys the session without sending `close_notify`.
+
+### `session.opened`
+
+* {Promise} Resolves with `{ protocol }` when the DTLS handshake completes.
+
+### `session.closed`
+
+* {Promise} Resolves when the session is fully closed.
+
+### `session.remoteAddress`
+
+* Returns: {Object} `{ address, family, port }`
+
+### `session.protocol`
+
+* Returns: {string} The negotiated DTLS protocol version
+  (e.g., `'DTLSv1.2'`).
+
+### `session.cipher`
+
+* Returns: {Object} `{ name, standardName, version }`
+
+### `session.peerCertificate`
+
+* Returns: {string|undefined} The peer's certificate in PEM format.
+
+### `session.alpnProtocol`
+
+* Returns: {string|undefined} The negotiated ALPN protocol.
+
+### `session.srtpProfile`
+
+* Returns: {string|undefined} The negotiated SRTP protection profile name.
+
+### `session.stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {DTLSSession.Stats}
+
+The statistics collected for this session. Read only. The stats object is
+live and updated as data flows through the session.
+
+### `session.exportKeyingMaterial(length, label[, context])`
+
+* `length` {number} Number of bytes to export.
+* `label` {string} The label for the exported keying material.
+* `context` {Buffer} Optional context value.
+* Returns: {Buffer}
+
+Exports keying material from the DTLS session, as defined in
+[RFC 5705][]. This is commonly used with DTLS-SRTP to derive
+encryption keys for media streams.
+
+## Class: `DTLSSession.Stats`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+A view of the collected statistics for a session.
+
+### `sessionStats.createdAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the session was created. Read only.
+
+### `sessionStats.destroyedAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the session was destroyed. Read only.
+
+### `sessionStats.closingAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when `close()` was called. Read only.
+
+### `sessionStats.handshakeCompletedAt`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} A timestamp indicating when the DTLS handshake completed. Read only.
+
+### `sessionStats.bytesReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application data bytes received. Read only.
+
+### `sessionStats.bytesSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application data bytes sent. Read only.
+
+### `sessionStats.messagesReceived`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application messages received. Read only.
+
+### `sessionStats.messagesSent`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of application messages sent. Read only.
+
+### `sessionStats.retransmitCount`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {bigint} The total number of DTLS handshake retransmissions. Read only.
+
+### `sessionStats.isConnected`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {boolean}
+
+`true` if the stats object is still connected to the underlying session.
+Once the session is destroyed, the stats become a stale snapshot.
+
+### Callback properties
+
+#### `session.onmessage`
+
+* {Function}
+  * `data` {Buffer}
+
+Set to receive application data from the peer.
+
+#### `session.onerror`
+
+* {Function}
+  * `error` {Error}
+
+Set to receive error notifications.
+
+#### `session.onhandshake`
+
+* {Function}
+  * `protocol` {string}
+
+Set to receive handshake completion notifications.
+
+#### `session.onkeylog`
+
+* {Function}
+  * `line` {string}
+
+Set to receive TLS key log lines (for debugging with Wireshark).
+
+### `session[Symbol.asyncDispose]()`
+
+Equivalent to calling `session.close()`.
+
+## DTLS-SRTP example
+
+DTLS-SRTP is used by WebRTC for media encryption. The DTLS handshake
+negotiates the SRTP protection profile and provides keying material.
+
+```mjs
+import { listen, connect } from 'node:dtls';
+import { readFileSync } from 'node:fs';
+
+// Server with SRTP
+const server = listen((session) => {
+  session.onhandshake = () => {
+    console.log('SRTP profile:', session.srtpProfile);
+    const keys = session.exportKeyingMaterial(
+      60,
+      'EXTRACTOR-dtls_srtp',
+    );
+    console.log('SRTP keying material:', keys);
+  };
+}, {
+  cert: readFileSync('server-cert.pem'),
+  key: readFileSync('server-key.pem'),
+  port: 5004,
+  srtp: 'SRTP_AES128_CM_SHA1_80:SRTP_AEAD_AES_128_GCM',
+});
+
+// Client with SRTP
+const session = connect('localhost', 5004, {
+  rejectUnauthorized: false,
+  srtp: 'SRTP_AEAD_AES_128_GCM:SRTP_AES128_CM_SHA1_80',
+});
+
+await session.opened;
+console.log('Negotiated SRTP:', session.srtpProfile);
+const keys = session.exportKeyingMaterial(60, 'EXTRACTOR-dtls_srtp');
+```
+
+## MTU considerations
+
+Since libuv does not currently support path MTU discovery, the DTLS module
+uses a conservative default MTU of 1200 bytes. This value works across
+virtually all network paths but may be suboptimal for local networks.
+
+The MTU can be configured via the `mtu` option:
+
+```mjs
+// For a local network where you know the path MTU
+const endpoint = listen(callback, {
+  // ...
+  mtu: 1400,
+});
+```
+
+The minimum allowed MTU is 256 bytes. The maximum is 65535.
+
+[Permission Model]: permissions.md#permission-model
+[RFC 5705]: https://www.rfc-editor.org/rfc/rfc5705
+[`DTLSEndpoint`]: #class-dtlsendpoint
+[`dtls.connect()`]: #dtlsconnecthost-port-options
+[`dtls.listen()`]: #dtlslistencallback-options
diff --git a/doc/api/errors.md b/doc/api/errors.md
index 9084e2998f06..c1b2add02a60 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -934,7 +934,7 @@ be called no more than one time per instance of a `Hash` object.
 
 ### `ERR_CRYPTO_HASH_UPDATE_FAILED`
 
-[`hash.update()`][] failed for any reason. This should rarely, if ever, happen.
+[`hash.update()`][] failed for an unspecified reason.
 
 <a id="ERR_CRYPTO_INCOMPATIBLE_KEY"></a>
 
@@ -1050,6 +1050,16 @@ An invalid key type was provided.
 
 The given crypto key object's type is invalid for the attempted operation.
 
+<a id="ERR_CRYPTO_INVALID_MAC"></a>
+
+### `ERR_CRYPTO_INVALID_MAC`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+An invalid MAC algorithm was specified.
+
 <a id="ERR_CRYPTO_INVALID_MESSAGELEN"></a>
 
 ### `ERR_CRYPTO_INVALID_MESSAGELEN`
@@ -1123,6 +1133,37 @@ added: v24.7.0
 Attempted to use KEM operations while Node.js was not compiled with
 OpenSSL with KEM support.
 
+<a id="ERR_CRYPTO_MAC_FINALIZED"></a>
+
+### `ERR_CRYPTO_MAC_FINALIZED`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+An operation was attempted on a `Mac` object after finalization was attempted
+or an underlying MAC update failed.
+
+<a id="ERR_CRYPTO_MAC_NOT_SUPPORTED"></a>
+
+### `ERR_CRYPTO_MAC_NOT_SUPPORTED`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Node.js was built without support for the OpenSSL `EVP_MAC` API.
+
+<a id="ERR_CRYPTO_MAC_UPDATE_FAILED"></a>
+
+### `ERR_CRYPTO_MAC_UPDATE_FAILED`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+[`mac.update()`][] failed for an unspecified reason.
+
 <a id="ERR_CRYPTO_OPERATION_FAILED"></a>
 
 ### `ERR_CRYPTO_OPERATION_FAILED`
@@ -4684,6 +4725,7 @@ An error occurred trying to allocate memory. This should never happen.
 [`http`]: http.md
 [`https`]: https.md
 [`libuv Error handling`]: https://docs.libuv.org/en/v1.x/errors.html
+[`mac.update()`]: crypto.md#macupdatedata-inputencoding
 [`net.Server`]: net.md#class-netserver
 [`net.Socket.write()`]: net.md#socketwritedata-encoding-callback
 [`net.Socket`]: net.md#class-netsocket
diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index fcb39d223f01..ba7f866cebff 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -28,7 +28,7 @@ const ffi = require('node:ffi');
 ```
 
 This module is only available under the `node:` scheme in builds with FFI
-support and is gated by the `--experimental-ffi` flag.
+support. It can be disabled with the `--no-experimental-ffi` flag.
 
 Building Node.js with `node:ffi` support is available via the bundled `libffi` on
 platforms where `libffi` provides a compatible static backend, or via a
@@ -800,5 +800,5 @@ and keep callback and pointer lifetimes explicit on the native side.
 [`--allow-ffi`]: cli.md#--allow-ffi
 [`ffi.toBuffer(pointer, length, copy)`]: #ffitobufferpointer-length-copy
 [`library.functions`]: #libraryfunctions
-[`using`]: https://tc39.es/proposal-explicit-resource-management/#sec-using-declarations
+[`using`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/using
 [type names]: #type-names
diff --git a/doc/api/fs.md b/doc/api/fs.md
index 589ac1a5e939..315ecdb97c43 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1414,6 +1414,9 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64003
+    description: Add support for the `maxDepth` option.
   - version: v26.1.0
     pr-url: https://github.com/nodejs/node/pull/62695
     description: Add support for the `followSymlinks` option.
@@ -1448,6 +1451,8 @@ changes:
     not supported.
   * `followSymlinks` {boolean} When `true`, symbolic links to directories are
     followed while expanding `**` patterns. **Default:** `false`.
+  * `maxDepth` {integer} Maximum number of directory levels to traverse.
+    The `cwd` directory has a depth of `0`. **Default:** `Infinity`.
   * `withFileTypes` {boolean} `true` if the glob should return paths as Dirents,
     `false` otherwise. **Default:** `false`.
 * Returns: {AsyncIterator} An AsyncIterator that yields the paths of files
@@ -1635,8 +1640,10 @@ changes:
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
-* Returns: {Promise}  Fulfills with a string containing the file system path
-  of the newly created temporary directory.
+* Returns: {Promise} Fulfills with the created directory path.
+  If `encoding` is `'buffer'`, then the resulting directory
+  path is returned as a {Buffer}. Otherwise, the path is returned as a
+  {string} using the specified encoding.
 
 Creates a unique temporary directory. A unique directory name is generated by
 appending six random characters to the end of the provided `prefix`. Due to
@@ -1675,14 +1682,15 @@ added: v24.4.0
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
 * Returns: {Promise} Fulfills with a Promise for an async-disposable Object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {AsyncFunction} A function which removes the created directory.
   * `[Symbol.asyncDispose]` {AsyncFunction} The same as `remove`.
 
 The resulting Promise holds an async-disposable object whose `path` property
-holds the created directory path. When the object is disposed, the directory
-and its contents will be removed asynchronously if it still exists. If the
-directory cannot be deleted, disposal will throw an error. The object has an
+holds the created directory path. If `encoding` is `'buffer'`, the `path` will
+also be a {Buffer}, otherwise a {string}. When the object is disposed, the
+directory and its contents will be removed asynchronously if it still exists. If
+the directory cannot be deleted, disposal will throw an error. The object has an
 async `remove()` method which will perform the same task.
 
 Both this function and the disposal function on the resulting object are
@@ -2224,9 +2232,9 @@ added:
     should stop.
   * `maxQueue` {number} Specifies the number of events to queue between iterations
     of the {AsyncIterator} returned. **Default:** `2048`.
-  * `overflow` {string} Either `'ignore'` or `'throw'` when there are more events to be
+  * `overflow` {string} Either `'ignore'` or `'error'` when there are more events to be
     queued than `maxQueue` allows. `'ignore'` means overflow events are dropped and a
-    warning is emitted, while `'throw'` means to throw an exception. **Default:** `'ignore'`.
+    warning is emitted, while `'error'` means to throw an exception. **Default:** `'ignore'`.
   * `ignore` {string|RegExp|Function|Array} Pattern(s) to ignore. Strings are
     glob patterns (using [`minimatch`][]), RegExp patterns are tested against
     the filename, and functions receive the filename and return `true` to
@@ -3618,6 +3626,9 @@ descriptor. See [`fs.utimes()`][].
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64003
+    description: Add support for the `maxDepth` option.
   - version: v26.1.0
     pr-url: https://github.com/nodejs/node/pull/62695
     description: Add support for the `followSymlinks` option.
@@ -3650,6 +3661,8 @@ changes:
     `true` to exclude the item, `false` to include it. **Default:** `undefined`.
   * `followSymlinks` {boolean} When `true`, symbolic links to directories are
     followed while expanding `**` patterns. **Default:** `false`.
+  * `maxDepth` {integer} Maximum number of directory levels to traverse.
+    The `cwd` directory has a depth of `0`. **Default:** `Infinity`.
   * `withFileTypes` {boolean} `true` if the glob should return paths as Dirents,
     `false` otherwise. **Default:** `false`.
 
@@ -3982,7 +3995,7 @@ changes:
   * `encoding` {string} **Default:** `'utf8'`
 * `callback` {Function}
   * `err` {Error}
-  * `directory` {string}
+  * `directory` {string|Buffer}
 
 Creates a unique temporary directory.
 
@@ -3992,12 +4005,14 @@ inconsistencies, avoid trailing `X` characters in `prefix`. Some platforms,
 notably the BSDs, can return more than six random characters, and replace
 trailing `X` characters in `prefix` with random characters.
 
-The created directory path is passed as a string to the callback's second
-parameter.
-
 The optional `options` argument can be a string specifying an encoding, or an
 object with an `encoding` property specifying the character encoding to use.
 
+The created directory path is passed to the callback's second parameter. If
+`encoding` is `'buffer'`, then the resulting directory path is passed as a
+{Buffer}. Otherwise, the path is passed as a {string} using the specified
+encoding.
+
 ```mjs
 import { mkdtemp } from 'node:fs';
 import { join } from 'node:path';
@@ -6256,6 +6271,9 @@ Synchronous version of [`fs.futimes()`][]. Returns `undefined`.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64003
+    description: Add support for the `maxDepth` option.
   - version: v26.1.0
     pr-url: https://github.com/nodejs/node/pull/62695
     description: Add support for the `followSymlinks` option.
@@ -6287,6 +6305,8 @@ changes:
     `true` to exclude the item, `false` to include it. **Default:** `undefined`.
   * `followSymlinks` {boolean} When `true`, symbolic links to directories are
     followed while expanding `**` patterns. **Default:** `false`.
+  * `maxDepth` {integer} Maximum number of directory levels to traverse.
+    The `cwd` directory has a depth of `0`. **Default:** `Infinity`.
   * `withFileTypes` {boolean} `true` if the glob should return paths as Dirents,
     `false` otherwise. **Default:** `false`.
 * Returns: {string\[]} paths of files that match the pattern.
@@ -6463,9 +6483,11 @@ changes:
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
-* Returns: {string}
+* Returns: {string|Buffer}
 
-Returns the created directory path.
+Returns the created directory path. If `encoding` is `'buffer'`, then the
+resulting directory path is returned as a {Buffer}. Otherwise, the path
+is returned as a {string} using the specified encoding.
 
 For detailed information, see the documentation of the asynchronous version of
 this API: [`fs.mkdtemp()`][].
@@ -6483,15 +6505,15 @@ added: v24.4.0
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
 * Returns: {Object} A disposable object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {Function} A function which removes the created directory.
   * `[Symbol.dispose]` {Function} The same as `remove`.
 
 Returns a disposable object whose `path` property holds the created directory
-path. When the object is disposed, the directory and its contents will be
-removed if it still exists. If the directory cannot be deleted, disposal will
-throw an error. The object has a `remove()` method which will perform the same
-task.
+path. If `encoding` is `'buffer'`, the `path` will be a {Buffer}. When the
+object is disposed, the directory and its contents will be removed if it still
+exists. If the directory cannot be deleted, disposal will throw an error. The
+object has a `remove()` method which will perform the same task.
 
 See the [MDN documentation on `using` statements][`using`] for more information about
 explicit resource management.
@@ -8440,7 +8462,6 @@ of bytes written is passed as the first argument to the event handler.
     * `writeBufferLen` {number}
     * `remainingBufferLen`: {number}
   * `sync`: {boolean} Perform writes synchronously.
-* Returns: {fs.Utf8Stream}
 
 #### `utf8Stream.append`
 
diff --git a/doc/api/globals.md b/doc/api/globals.md
index 73d34250ac06..aee77dab6b44 100644
--- a/doc/api/globals.md
+++ b/doc/api/globals.md
@@ -1310,6 +1310,109 @@ changes:
 A browser-compatible implementation of {WebSocket}. Disable this API
 with the [`--no-experimental-websocket`][] CLI flag.
 
+## Class: `Worker`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental. Enable this API with the
+> [`--experimental-web-worker`][] CLI flag.
+
+A mostly browser-compatible implementation of Web Workers of the [HTML Standard][],
+implemented on top of [`node:worker_threads`][]. Threads created with it
+are given the {DedicatedWorkerGlobalScope} API (`self`,
+`name`, `location`, `navigator`, `postMessage()`, `close()`, and
+`importScripts()`), in addition to the usual Node.js globals, such as `process`.
+
+```js
+// worker.js
+addEventListener('message', (event) => {
+  postMessage(`${event.data} from ${name}!`);
+});
+```
+
+```js
+// main.js
+const worker = new Worker('./worker.js', { name: 'greeter' });
+
+worker.addEventListener('message', (event) => {
+  console.log(event.data); // Prints: Hello from greeter!
+  worker.terminate();
+});
+
+worker.postMessage('Hello');
+```
+
+Because their lifetime and sharing model depend on origins and
+browsing contexts, Node.js does not currently implement `SharedWorker`.
+
+### Loading worker scripts
+
+Worker scripts are read synchronously from the local file system or from
+memory rather than fetched over the network, which changes which URLs are
+accepted and how failures are reported:
+
+* `new Worker()` and `importScripts()` accept only `file:`, `data:`, and
+  `blob:` URLs. Any other scheme makes `new Worker()` throw a
+  `NotSupportedError` and `importScripts()` throw a `NetworkError`.
+* A script that cannot be read makes `importScripts()` throw a `NetworkError`;
+  for `new Worker()` it fires an `error` event at the `Worker` object.
+* Redirects, the `nosniff` check, and HTTP MIME type validation do not apply.
+  MIME types are validated only for `data:` and `blob:` URLs. The
+  `credentials` option is validated for API compatibility but has no effect,
+  since no network request is made.
+* On the main thread, relative script URLs are resolved against the current
+  working directory, because there is no document base URL. Within a worker
+  they are resolved against the worker's own URL (as is done in the spec).
+* For `blob:` URLs, the script must be held in memory, so blobs backed by a file,
+  such as those returned by [`fs.openAsBlob()`][], cannot be used.
+
+### Differences from the HTML Standard
+
+Besides script loading, mentioned above:
+
+* Node.js has no origin model, so same-origin and cross-origin distinctions do
+  not exist and `location.origin` is `'null'` for every supported scheme.
+* `close()` terminates the worker immediately instead of following the
+  specification's "closing flag" algorithm, so code remaining in the current
+  task after `close()` is not executed.
+* The worker global is the normal Node.js global object with
+  `DedicatedWorkerGlobalScope` inserted into its prototype chain, rather than
+  a fresh global created from the interface. Node.js globals such as
+  `process`, `Buffer`, and `require()` remain available to worker scripts.
+* `ErrorEvent`s dispatched at `Worker` instances include `message` and
+  `error`, but `filename`, `lineno`, and `colno` are always `''`, `0`, and
+  `0`. An uncaught exception terminates the worker thread, and an unhandled
+  `error` event is not propagated further: it neither reaches the parent's
+  global scope nor affects the exit code of the process.
+* The following {WorkerGlobalScope} events are never dispatched, although
+  their handler properties exist: `languagechange`, `online`, and `offline`,
+  since these concepts do not exist in Node.js; `rejectionhandled` and
+  `unhandledrejection`, since Node.js exposes the equivalent does not
+  implement the `PromiseRejectionEvent` interface or the per-rejection
+  `preventDefault()` behavior required by the HTML Standard.
+
+### Web Workers and `node:worker_threads`
+
+Every Web Worker is backed by a [`node:worker_threads`][] {Worker}, so the
+two APIs share their threading, structured clone, and transfer semantics.
+Inside a worker, \[`worker_threads.parentPort`]\[] is the port behind
+`self.postMessage()` and the worker's `message` events, `isMainThread` is
+`false`, and `workerData` is `undefined`.
+
+Web Workers, like `node:worker_threads` workers, keep the event loop alive by
+default. In Node.js, Web Workers implement the [Refable protocol][], and can be
+ref'd and unref'd using `process.ref(worker)` and `process.unref(worker)`.
+
+As a rule of thumb, use [`node:worker_threads`][] directly when a program
+needs `workerData`, a custom `env` or `execArgv`, resource limits, stdio
+redirection, the `'online'` and `'exit'` events, or `worker.threadId`;
+`Worker` accepts only the `name`, `type`, and `credentials` options and,
+per the specification, its `terminate()` returns `undefined`, rather than
+a promise. Threads started through [`node:worker_threads`][] are ordinary
+Node.js threads and do not get the worker global scope APIs.
+
 ## Class: `WritableStream`
 
 <!-- YAML
@@ -1355,10 +1458,13 @@ A browser-compatible implementation of [`WritableStreamDefaultWriter`][].
 [CommonJS module]: modules.md
 [CommonJS modules]: modules.md
 [ECMAScript module]: esm.md
+[HTML Standard]: https://html.spec.whatwg.org/multipage/workers.html
 [Navigator API]: https://html.spec.whatwg.org/multipage/system-state.html#the-navigator-object
 [RFC 5646]: https://www.rfc-editor.org/rfc/rfc5646.txt
+[Refable protocol]: process.md#processrefmayberefable
 [Web Crypto API]: webcrypto.md
 [`--experimental-eventsource`]: cli.md#--experimental-eventsource
+[`--experimental-web-worker`]: cli.md#--experimental-web-worker
 [`--localstorage-file`]: cli.md#--localstorage-filefile
 [`--no-experimental-global-navigator`]: cli.md#--no-experimental-global-navigator
 [`--no-experimental-websocket`]: cli.md#--no-experimental-websocket
@@ -1410,9 +1516,11 @@ A browser-compatible implementation of [`WritableStreamDefaultWriter`][].
 [`console`]: console.md
 [`exports`]: modules.md#exports
 [`fetch()`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch
+[`fs.openAsBlob()`]: fs.md#fsopenasblobpath-options
 [`globalThis`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis
 [`localStorage`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage
 [`module`]: modules.md#module
+[`node:worker_threads`]: worker_threads.md
 [`perf_hooks.performance`]: perf_hooks.md#perf_hooksperformance
 [`process.nextTick()`]: process.md#processnexttickcallback-args
 [`process` object]: process.md#process
diff --git a/doc/api/http.md b/doc/api/http.md
index 1f6d9541134d..c0dcfc3f7b8b 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -1127,7 +1127,7 @@ const hasContentType = request.hasHeader('content-type');
 
 ### `request.maxHeadersCount`
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 Limits maximum response headers count. If set to 0, no limit will be applied.
 
@@ -1914,7 +1914,7 @@ added: v5.7.0
 added: v0.7.0
 -->
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 Limits maximum incoming headers count. If set to 0, no limit will be applied.
 
diff --git a/doc/api/https.md b/doc/api/https.md
index 97501abf186b..74b759556c43 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -199,7 +199,7 @@ This method is identical to [`server.listen()`][] from [`net.Server`][].
 
 ### `server.maxHeadersCount`
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 See [`server.maxHeadersCount`][] in the `node:http` module.
 
diff --git a/doc/api/index.md b/doc/api/index.md
index 24c38d0f3a70..700814fa98a0 100644
--- a/doc/api/index.md
+++ b/doc/api/index.md
@@ -10,6 +10,7 @@
 * [Assertion testing](assert.md)
 * [Asynchronous context tracking](async_context.md)
 * [Async hooks](async_hooks.md)
+* [Benchmark runner](bench.md)
 * [Buffer](buffer.md)
 * [C++ addons](addons.md)
 * [C/C++ addons with Node-API](n-api.md)
diff --git a/doc/api/module.md b/doc/api/module.md
index 8272042cb1a6..272ce94c15bd 100644
--- a/doc/api/module.md
+++ b/doc/api/module.md
@@ -2,19 +2,30 @@
 
 <!--introduced_in=v12.20.0-->
 
+> Stability: 2 - Stable
+
+<!-- source_link=lib/module.js -->
+
+The `node:module` module provides utilities for interacting with the Node.js
+module system.
+
+It can be accessed using:
+
+```mjs
+import module from 'node:module';
+```
+
+## Class: `Module`
+
 <!-- YAML
-added: v0.3.7
+added: v0.3.5
 -->
 
-## The `Module` object
+`module` objects in [CommonJS][] modules are instances of this class.
 
-* Type: {Object}
+See the CommonJS documentation for [the `module` object][].
 
-Provides general utility methods when interacting with instances of
-`Module`, the [`module`][] variable often seen in [CommonJS][] modules. Accessed
-via `import 'node:module'` or `require('node:module')`.
-
-### `module.builtinModules`
+## `module.builtinModules`
 
 <!-- YAML
 added:
@@ -29,25 +40,18 @@ changes:
 
 * Type: {string\[]}
 
-A list of the names of all modules provided by Node.js. Can be used to verify
-if a module is maintained by a third party or not.
-
-`module` in this context isn't the same object that's provided
-by the [module wrapper][]. To access it, require the `Module` module:
+A list of the names of all modules provided by Node.js.
 
 ```mjs
-// module.mjs
-// In an ECMAScript module
-import { builtinModules as builtin } from 'node:module';
+import { builtinModules } from 'node:module';
+console.log(builtinModules.filter((name) => name.startsWith('path')));
+// Prints: [ 'path', 'path/posix', 'path/win32' ]
 ```
 
-```cjs
-// module.cjs
-// In a CommonJS module
-const builtin = require('node:module').builtinModules;
-```
+To test whether a module name corresponds to a builtin module, use
+[`module.isBuiltin()`][].
 
-### `module.createRequire(filename)`
+## `module.createRequire(filename)`
 
 <!-- YAML
 added: v12.2.0
@@ -66,7 +70,7 @@ const require = createRequire(import.meta.url);
 const siblingModule = require('./sibling-module');
 ```
 
-### `module.findPackageJSON(specifier[, base])`
+## `module.findPackageJSON(specifier[, base])`
 
 <!-- YAML
 added:
@@ -154,7 +158,7 @@ findPackageJSON('@foo/qux', __filename);
 // '/path/to/project/packages/qux/package.json'
 ```
 
-### `module.isBuiltin(moduleName)`
+## `module.isBuiltin(moduleName)`
 
 <!-- YAML
 added:
@@ -172,7 +176,7 @@ isBuiltin('fs'); // true
 isBuiltin('wss'); // false
 ```
 
-### `module.register(specifier[, parentURL][, options])`
+## `module.register(specifier[, parentURL][, options])`
 
 <!-- YAML
 added:
@@ -220,7 +224,7 @@ resolution and loading behavior. See [Customization hooks][].
 
 This feature requires `--allow-worker` if used with the [Permission Model][].
 
-### `module.registerHooks(options)`
+## `module.registerHooks(options)`
 
 <!-- YAML
 added:
@@ -249,7 +253,7 @@ Register [hooks][] that customize Node.js module resolution and loading behavior
 See [Customization hooks][]. The returned object can be used to
 [deregister the hooks][deregistration of synchronous customization hooks].
 
-### `module.stripTypeScriptTypes(code[, options])`
+## `module.stripTypeScriptTypes(code[, options])`
 
 <!-- YAML
 added:
@@ -314,7 +318,7 @@ console.log(strippedCode);
 // Prints: const a         = 1\n\n//# sourceURL=source.ts;
 ```
 
-### `module.syncBuiltinESMExports()`
+## `module.syncBuiltinESMExports()`
 
 <!-- YAML
 added: v12.12.0
@@ -2073,9 +2077,9 @@ returned object contains the following keys:
 [`module.enableCompileCache()`]: #moduleenablecompilecacheoptions
 [`module.flushCompileCache()`]: #moduleflushcompilecache
 [`module.getCompileCacheDir()`]: #modulegetcompilecachedir
+[`module.isBuiltin()`]: #moduleisbuiltinmodulename
 [`module.registerHooks()`]: #moduleregisterhooksoptions
 [`module.setSourceMapsSupport()`]: #modulesetsourcemapssupportenabled-options
-[`module`]: #the-module-object
 [`os.tmpdir()`]: os.md#ostmpdir
 [`register`]: #moduleregisterspecifier-parenturl-options
 [`util.TextDecoder`]: util.md#class-utiltextdecoder
@@ -2088,11 +2092,11 @@ returned object contains the following keys:
 [hooks]: #customization-hooks
 [load hook]: #synchronous-loadurl-context-nextload
 [module compile cache]: #module-compile-cache
-[module wrapper]: modules.md#the-module-wrapper
 [realm]: https://tc39.es/ecma262/#realm
 [resolve hook]: #synchronous-resolvespecifier-context-nextresolve
 [source map include directives]: https://tc39.es/ecma426/#sec-linking-generated-code
 [synchronous hook functions]: #hook-functions-accepted-by-moduleregisterhooks
+[the `module` object]: modules.md#the-module-object
 [the documentation of `Worker`]: worker_threads.md#new-workerfilename-options
 [transferable objects]: worker_threads.md#portpostmessagevalue-transferlist
 [type-stripping]: typescript.md#type-stripping
diff --git a/doc/api/net.md b/doc/api/net.md
index 686e1b11658a..42c054049459 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -743,6 +743,11 @@ Otherwise, if `path` is specified, it behaves the same as
 [`server.listen(path[, backlog][, callback])`][`server.listen(path)`].
 If none of them is specified, an error will be thrown.
 
+> Using the `signal` option to destroy a long-lived server as a resource cleanup
+> mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 If `exclusive` is `false` (default), then cluster workers will use the same
 underlying handle, allowing connection handling duties to be shared. When
 `exclusive` is `true`, the handle is not shared, and attempted port sharing
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 2d409517010f..9d48c45e65bb 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1091,6 +1091,54 @@ changes:
 The high resolution millisecond timestamp representing the time immediately
 before Node.js receives the first byte of the response from the server.
 
+### `performanceResourceTiming.finalResponseHeadersStart`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the final response,
+as opposed to an interim response.
+
+### `performanceResourceTiming.firstInterimResponseStart`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the first interim response, such as
+a `103 Early Hints` response.
+
+### `performanceResourceTiming.responseStart`
+
+<!-- YAML
+added:
+  - v18.2.0
+  - v16.17.0
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/65017
+    description: This property now returns `firstInterimResponseStart`
+                 when it is non-zero.
+  - version: v19.0.0
+    pr-url: https://github.com/nodejs/node/pull/44483
+    description: This property getter must be called with the
+                 `PerformanceResourceTiming` object as the receiver.
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the response from the server. This
+is `firstInterimResponseStart` when it is non-zero, and
+`finalResponseHeadersStart` otherwise.
+
 ### `performanceResourceTiming.responseEnd`
 
 <!-- YAML
@@ -1166,6 +1214,37 @@ A number representing the size (in octets) received from the fetch
 (HTTP or cache), of the message body, after removing any applied
 content-codings.
 
+### `performanceResourceTiming.renderBlockingStatus`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {string}
+
+The render blocking status of the resource. It is either `'blocking'` or `'non-blocking'`.
+
+### `performanceResourceTiming.contentType`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {string}
+
+The minimized MIME type of the content of the fetched resource, or an empty
+string if it cannot be determined.
+
+### `performanceResourceTiming.contentEncoding`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Type: {string}
+
+The content encoding of the fetched resource, such as `'gzip'` or `'br'`.
+
 ### `performanceResourceTiming.toJSON()`
 
 <!-- YAML
@@ -1639,6 +1718,34 @@ added:
 
 Returns a {RecordableHistogram}.
 
+## `perf_hooks.importHistogram(data)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `data` {Uint8Array} A CBOR-encoded histogram previously produced by
+  [`histogram.export()`][].
+* Returns: {RecordableHistogram}
+
+Reconstructs a histogram from a CBOR-encoded `Uint8Array`. The returned
+histogram is a full {RecordableHistogram} with all bucket data, configuration,
+and EWMA state restored. New values can be recorded into it.
+
+```js
+const { createHistogram, importHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 1000; i++) h.record(i);
+
+// Serialize and reconstruct
+const data = h.export();
+const h2 = importHistogram(data);
+
+console.log(h2.count);          // 1000
+console.log(h2.percentile(99)); // Same as h.percentile(99)
+```
+
 ## `perf_hooks.eventLoopUtilization([utilization1[, utilization2]])`
 
 <!-- YAML
@@ -1852,6 +1959,37 @@ invoked.
 added: v11.10.0
 -->
 
+### `histogram.burnRate(sloTarget)`
+
+<!-- YAML
+added: v26.8.0
+-->
+
+* `sloTarget` {number} The SLO target as a fraction between 0 and 1
+  (exclusive). For example, `0.999` for a 99.9% SLO.
+* Returns: {number}
+
+Returns the SLO burn rate: `ewmaErrorRate / (1 - sloTarget)`. A burn rate
+of 1 means the error budget will be exactly exhausted over the SLO window.
+A burn rate greater than 1 means it is being consumed faster than allowed.
+Requires the histogram to have been created with both `halfLife` and
+`threshold` options.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+// Track latency with a 200ms SLO threshold, half-life of 100 samples
+const h = createHistogram({ halfLife: 100, threshold: 200_000_000 });
+
+// ... record latency values ...
+
+// Check burn rate against a 99.9% SLO
+const rate = h.burnRate(0.999);
+if (rate > 1) {
+  console.log(`SLO burn rate: ${rate.toFixed(2)}x — error budget depleting`);
+}
+```
+
 ### `histogram.count`
 
 <!-- YAML
@@ -1969,6 +2107,43 @@ added:
 The number of times the event loop delay exceeded the maximum 1 hour event
 loop delay threshold.
 
+### `histogram.export()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Returns: {Uint8Array}
+
+Serializes the histogram to a [CBOR][]-encoded (RFC 8949) `Uint8Array`
+suitable for transmission or persistent storage. The encoding uses a
+delta-encoded sparse representation of the bucket counts, so the output size
+scales with the number of distinct recorded values rather than the total
+bucket count.
+
+The output includes all histogram configuration, bucket data, and EWMA
+state (when enabled). It can be reconstructed into a new histogram using
+[`perf_hooks.importHistogram()`][].
+
+The CBOR payload is a map with integer keys:
+
+| Key | Type    | Field                                         |
+| --- | ------- | --------------------------------------------- |
+| 0   | uint    | Format version (currently 1)                  |
+| 1   | uint    | Lowest discernible value                      |
+| 2   | uint    | Highest trackable value                       |
+| 3   | uint    | Significant figures                           |
+| 4   | uint    | Total count                                   |
+| 5   | uint    | Min value                                     |
+| 6   | uint    | Max value                                     |
+| 7   | uint    | Normalizing index offset                      |
+| 8   | float64 | Conversion ratio                              |
+| 9   | uint    | Counts array length                           |
+| 10  | array   | Delta-encoded sparse counts `[delta, c, ...]` |
+| 11  | map     | EWMA state (omitted when disabled)            |
+
+Any standard CBOR decoder can parse the output.
+
 ### `histogram.ewmaMean`
 
 <!-- YAML
@@ -2006,37 +2181,6 @@ The EWMA-smoothed probability of a recorded value exceeding the configured
 and `threshold` options. Returns `0` when not enabled or no values have been
 recorded.
 
-### `histogram.burnRate(sloTarget)`
-
-<!-- YAML
-added: v26.8.0
--->
-
-* `sloTarget` {number} The SLO target as a fraction between 0 and 1
-  (exclusive). For example, `0.999` for a 99.9% SLO.
-* Returns: {number}
-
-Returns the SLO burn rate: `ewmaErrorRate / (1 - sloTarget)`. A burn rate
-of 1 means the error budget will be exactly exhausted over the SLO window.
-A burn rate greater than 1 means it is being consumed faster than allowed.
-Requires the histogram to have been created with both `halfLife` and
-`threshold` options.
-
-```js
-const { createHistogram } = require('node:perf_hooks');
-
-// Track latency with a 200ms SLO threshold, half-life of 100 samples
-const h = createHistogram({ halfLife: 100, threshold: 200_000_000 });
-
-// ... record latency values ...
-
-// Check burn rate against a 99.9% SLO
-const rate = h.burnRate(0.999);
-if (rate > 1) {
-  console.log(`SLO burn rate: ${rate.toFixed(2)}x — error budget depleting`);
-}
-```
-
 ### `histogram.ksTest(other)`
 
 <!-- YAML
@@ -2140,6 +2284,41 @@ added: v11.10.0
 
 The mean of the recorded event loop delays.
 
+### `histogram.meanCI([options])`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `options` {Object}
+  * `confidence` {number} The confidence level for the interval, between
+    0 and 1 (exclusive). **Default:** `0.95`.
+* Returns: {Object}
+  * `mean` {number} The mean estimate, equivalent to `histogram.mean`.
+  * `lower` {number} The lower bound of the confidence interval.
+  * `upper` {number} The upper bound of the confidence interval.
+
+Returns a two-sided confidence interval for the mean using Student's
+t-distribution and the sample standard error. A higher confidence level
+produces a wider interval. This interval assumes that samples are independent
+and approximately normally distributed, although the approximation is robust
+for sufficiently large samples.
+
+The result reflects the histogram's configured precision and is calculated
+from the values represented by its buckets. With fewer than two recorded
+values, `lower` and `upper` are `NaN`. When all recorded values are equal,
+`lower` and `upper` equal `mean`.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 100; i++) h.record(i);
+
+const { mean, lower, upper } = h.meanCI();
+console.log(`mean=${mean}, 95% CI=[${lower}, ${upper}]`);
+```
+
 ### `histogram.min`
 
 <!-- YAML
@@ -2844,6 +3023,7 @@ dns.promises.resolve('localhost');
 ```
 
 [Async Hooks]: async_hooks.md
+[CBOR]: https://www.rfc-editor.org/rfc/rfc8949
 [Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Cliff's_delta
 [Cohen's d]: https://en.wikipedia.org/wiki/Effect_size#Cohen's_d
 [Fetch Response Body Info]: https://fetch.spec.whatwg.org/#response-body-info
@@ -2858,7 +3038,9 @@ dns.promises.resolve('localhost');
 [Worker threads]: worker_threads.md#worker-threads
 [`'exit'`]: process.md#event-exit
 [`child_process.spawnSync()`]: child_process.md#child_processspawnsynccommand-args-options
+[`histogram.export()`]: #histogramexport
 [`perf_hooks.eventLoopUtilization()`]: #perf_hookseventlooputilizationutilization1-utilization2
+[`perf_hooks.importHistogram()`]: #perf_hooksimporthistogramdata
 [`perf_hooks.monitorEventLoopDelay()`]: #perf_hooksmonitoreventloopdelayoptions
 [`perf_hooks.timerify()`]: #perf_hookstimerifyfn-options
 [`process.hrtime()`]: process.md#processhrtimetime
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index 0b46f42d982a..b677013d7978 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -82,8 +82,8 @@ using the [`--allow-child-process`][] and [`--allow-worker`][] respectively.
 To allow network access, use [`--allow-net`][] and for allowing native addons
 when using permission model, use the [`--allow-addons`][]
 flag. For WASI, use the [`--allow-wasi`][] flag. For FFI, use the
-[`--allow-ffi`][] flag. The [`node:ffi`](ffi.md) module also requires the
-`--experimental-ffi` flag and is only available in builds with FFI support.
+[`--allow-ffi`][] flag. The [`node:ffi`](ffi.md) module is only available in
+builds with FFI support.
 
 To allow use of OpenSSL STORE loaders, for example to load a private key
 from a {URL} passed to [`crypto.createPrivateKey()`][], use the
@@ -258,6 +258,14 @@ does not exist, the wildcard will not be added, and access will be limited to
 yet, make sure to explicitly include the wildcard:
 `/my-path/folder-do-not-exist/*`.
 
+Some `node:fs` operations act on an already-open file descriptor rather than a
+path, so they cannot be tied to a `--allow-fs-read` or `--allow-fs-write` grant.
+When the permission model is enabled these operations are disabled and throw
+`ERR_ACCESS_DENIED`, regardless of how the descriptor was obtained. This applies
+both to the top-level `node:fs` functions and to the equivalent
+`FileHandle` methods, and currently includes `fsync`/`fdatasync`,
+`fchmod`, and `fchown` (and their synchronous variants).
+
 #### Configuration file support
 
 In addition to passing permission flags on the command line, they can also be
diff --git a/doc/api/process.md b/doc/api/process.md
index b51f514cbc35..956e9d879abe 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -669,7 +669,8 @@ process.on('SIGTERM', handle);
 * `'SIGTERM'` and `'SIGINT'` have default handlers on non-Windows platforms that
   reset the terminal mode before exiting with code `128 + signal number`. If one
   of these signals has a listener installed, its default behavior will be
-  removed (Node.js will no longer exit).
+  removed. Signal events are emitted asynchronously, so Node.js may exit before
+  the listener is called if the event loop is otherwise empty.
 * `'SIGPIPE'` is ignored by default. It can have a listener installed.
 * `'SIGHUP'` is generated on Windows when the console window is closed, and on
   other platforms under various similar conditions. See signal(7). It can have a
diff --git a/doc/api/quic.md b/doc/api/quic.md
index 74e4644f8112..c99cd5d9314c 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -2948,10 +2948,10 @@ The ALPN (Application-Layer Protocol Negotiation) identifier(s).
 For **client** sessions, this is a single string specifying the protocol
 the client wants to use (e.g. `'h3'`).
 
-For **server** sessions, this is an array of protocol names in preference
-order that the server supports (e.g. `['h3', 'h3-29']`). During the TLS
-handshake, the server selects the first protocol from its list that the
-client also supports.
+For **server** sessions, this is a non-empty array of protocol names in
+preference order that the server supports (e.g. `['h3', 'h3-29']`).
+During the TLS handshake, the server selects the first protocol from its
+list that the client also supports.
 
 The negotiated ALPN determines which Application implementation is used
 for the session. `'h3'` and `'h3-*'` variants select the HTTP/3
diff --git a/doc/api/repl.md b/doc/api/repl.md
index 3c61adb450fd..c7c6a80af767 100644
--- a/doc/api/repl.md
+++ b/doc/api/repl.md
@@ -276,6 +276,15 @@ Uncaught SyntaxError: Identifier 'm' has already been declared
 
 [`--no-experimental-repl-await`][] shall disable top-level await in REPL.
 
+### Error handling
+
+By default, uncaught exceptions in the REPL are printed to the output stream
+(as with `Uncaught Error: REPL await` above). `uncaughtException` listeners
+can be added freely in both standalone and nested REPLs. The `handleError`
+option of [`repl.start()`][] can customize this behavior, including
+forwarding exceptions to [`'uncaughtException'`][] by returning
+`'unhandled'`.
+
 ### Reverse-i-search
 
 <!-- YAML
@@ -469,6 +478,9 @@ const firstInstance = repl.start(options);
 const secondInstance = new repl.REPLServer(options);
 ```
 
+Calling `repl.REPLServer()` without the `new` keyword throws a `TypeError`
+(see [DEP0185][]).
+
 ### Event: `'exit'`
 
 <!-- YAML
@@ -1170,6 +1182,7 @@ avoiding open network interfaces.
 
 Original code from <https://gist.github.com/TooTallNate/2053342>.
 
+[DEP0185]: deprecations.md#dep0185-instantiating-noderepl-classes-without-new
 [TTY keybindings]: readline.md#tty-keybindings
 [ZSH]: https://en.wikipedia.org/wiki/Z_shell
 [`'uncaughtException'`]: process.md#event-uncaughtexception
diff --git a/doc/api/single-executable-applications.md b/doc/api/single-executable-applications.md
index be5667cbd499..1032a14be6db 100644
--- a/doc/api/single-executable-applications.md
+++ b/doc/api/single-executable-applications.md
@@ -116,6 +116,7 @@ The configuration currently reads the following top-level fields:
   "disableExperimentalSEAWarning": true, // Default: false
   "useSnapshot": false,  // Default: false
   "useCodeCache": true, // Default: false
+  "useVfs": true, // Default: false
   "execArgv": ["--no-warnings", "--max-old-space-size=4096"], // Optional
   "execArgvExtension": "env", // Default: "env", options: "none", "env", "cli"
   "assets": {  // Optional
@@ -175,6 +176,105 @@ const raw = getRawAsset('a.jpg');
 See documentation of the [`sea.getAsset()`][], [`sea.getAssetAsBlob()`][],
 [`sea.getRawAsset()`][] and [`sea.getAssetKeys()`][] APIs for more information.
 
+### Virtual file system (VFS) for assets
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1.0 - Early development
+
+In addition to using the `node:sea` API to access individual assets, the
+bundled assets can be exposed as a read-only [virtual file system][] and
+accessed through standard `node:fs` APIs. To enable this, set
+`"useVfs": true` in the SEA configuration.
+
+A virtual file system never shadows the real file system: it is mounted at a
+reserved mount point that cannot exist on the real file system, and the mount
+point is chosen at runtime rather than being a fixed path. When `useVfs` is
+enabled, the injected main script itself is placed at the root of the mount
+and executed from there, so `__filename` and `__dirname` point inside the
+virtual file system instead of reflecting [`process.execPath`][]. Bundled
+code therefore reaches the assets through `__dirname`-relative paths and
+relative [`require()`][] calls, without having to know the mount point:
+
+```cjs
+const fs = require('node:fs');
+const path = require('node:path');
+
+// __dirname is the root of the virtual file system holding the assets.
+const rawConfig = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const data = fs.readFileSync(path.join(__dirname, 'data/file.txt'));
+
+// Directory operations work too.
+const files = fs.readdirSync(path.join(__dirname, 'assets'));
+
+// Check if a bundled file exists.
+if (fs.existsSync(path.join(__dirname, 'optional.json'))) {
+  // ...
+}
+```
+
+The VFS supports the `node:fs` operations for reading files and directories.
+Since the SEA VFS is read-only, write operations fail with `EROFS`. See the
+[VFS documentation][] for the full list of supported operations.
+
+#### Loading modules from the VFS in a SEA
+
+When `useVfs` is enabled, the main script is executed from inside the
+virtual file system, and `require()` uses the [module loader
+integration][] of the VFS to load modules from the bundled assets. This
+supports relative requires (e.g. `require('./helper.js')`) as well as
+`node_modules` package lookups, which are confined to the mount:
+
+```cjs
+// Require bundled modules using relative paths.
+const myModule = require('./lib/mymodule.js');
+
+// Packages bundled under the node_modules asset prefix also resolve.
+const dep = require('some-package');
+```
+
+#### ESM entry points
+
+`"useVfs": true` also supports `"mainFormat": "module"`. The ESM main
+script is loaded from inside the mount through the ESM loader, so
+`import.meta.url`, `import.meta.filename`, and `import.meta.dirname`
+reflect the location of the main script in the virtual file system, and
+static and dynamic imports resolve against the bundled assets:
+
+```mjs
+import fs from 'node:fs';
+import path from 'node:path';
+
+// import.meta.dirname is the root of the virtual file system.
+const data = fs.readFileSync(
+  path.join(import.meta.dirname, 'data/file.txt'));
+
+// Relative and bare specifier imports resolve inside the mount.
+import myModule from './lib/mymodule.mjs';
+const lazy = await import('./lib/lazy.mjs');
+```
+
+Module format detection works the same way as on the real file
+system: name bundled ES modules with the `.mjs` extension (or provide the
+relevant `package.json` files as assets) so they are interpreted as ESM.
+
+#### Snapshot and code caching limitations
+
+`"useVfs": true` cannot be used together with `"useSnapshot": true` or
+`"useCodeCache": true`. The code cache limitation is due to incomplete
+implementation, not a technical impossibility. Consider bundling the
+application if startup performance matters and do not rely on module loading
+from the VFS in that case.
+
+#### Native addon limitations
+
+Native addons (`.node` files) cannot be loaded directly from the VFS because
+`process.dlopen()` requires files on the real file system. To use native
+addons in a SEA with VFS, write the asset to a temporary file first. See
+[Using native addons in the injected main script][] for an example.
+
 ### Startup snapshot support
 
 The `useSnapshot` field can be used to enable startup snapshot support. In this
@@ -648,6 +748,8 @@ to help us document them.
 [Generating single executable preparation blobs]: #1-generating-single-executable-preparation-blobs
 [Mach-O]: https://en.wikipedia.org/wiki/Mach-O
 [PE]: https://en.wikipedia.org/wiki/Portable_Executable
+[Using native addons in the injected main script]: #using-native-addons-in-the-injected-main-script
+[VFS documentation]: vfs.md
 [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
 [`process.execPath`]: process.md#processexecpath
 [`require()`]: modules.md#requireid
@@ -660,8 +762,10 @@ to help us document them.
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
 [documentation about startup snapshot support in Node.js]: cli.md#--build-snapshot
 [fuse]: https://www.electronjs.org/docs/latest/tutorial/fuses
+[module loader integration]: vfs.md#module-loader-integration
 [postject]: https://github.com/nodejs/postject
 [postject-linux-arm64-issue]: https://github.com/nodejs/postject/issues/105
 [signtool]: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
 [single executable applications]: https://github.com/nodejs/single-executable
 [supported by Node.js]: https://github.com/nodejs/node/blob/main/BUILDING.md#platform-list
+[virtual file system]: vfs.md
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index bc41da391d4c..10e8df348678 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -241,7 +241,8 @@ Registers a new aggregate function with the SQLite database. This method is a wr
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `options.step` and `options.inverse` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `inverse` and `step` must be invoked with exactly `length` arguments.
+    `inverse` and `step` must be invoked with exactly `length` arguments, and
+    their `length` properties must be integers.
     **Default:** `false`.
   * `start` {number | string | null | Array | Object | Function} The identity
     value for the aggregation function. This value is used when the aggregation
@@ -428,7 +429,8 @@ added:
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `function` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `function` must be invoked with exactly `function.length` arguments.
+    `function` must be invoked with exactly `function.length` arguments, which
+    must be an integer.
     **Default:** `false`.
 * `fn` {Function} The JavaScript function to call when the SQLite function is
   invoked. The return value of this function should be a valid SQLite data type:
@@ -1006,8 +1008,11 @@ wrapper around [`sqlite3session_patchset()`][].
 ### `session.close()`
 
 Closes the session. An exception is thrown if the database or the session is not open,
-or if the session is currently generating a changeset or patchset. This method is a
-wrapper around [`sqlite3session_delete()`][].
+or if the session is currently generating a changeset or patchset. An
+[`ERR_INVALID_STATE`][] error is thrown if the method is called from a callback that
+SQLite invoked, such as an authorizer callback, a user-defined function, or a
+[`'sqlite.db.query'`][] subscriber, because SQLite may still be using the session.
+This method is a wrapper around [`sqlite3session_delete()`][].
 
 ### `session[Symbol.dispose]()`
 
@@ -1015,7 +1020,10 @@ wrapper around [`sqlite3session_delete()`][].
 added: v24.9.0
 -->
 
-Closes the session. If the session is already closed, does nothing.
+Closes the session. If the session is already closed, then this is a no-op. An
+[`ERR_INVALID_STATE`][] error is thrown if the session is currently generating
+a changeset or patchset, or if the method is called from a callback that SQLite
+invoked, under the same conditions as [`session.close()`][].
 
 ## Class: `StatementSync`
 
@@ -1907,6 +1915,7 @@ callback function to indicate what type of operation is being authorized.
 [`database.serialize()`]: #databaseserializedbname
 [`database.setAuthorizer()`]: #databasesetauthorizercallback
 [`diagnostics_channel`]: diagnostics_channel.md
+[`session.close()`]: #sessionclose
 [`sqlite3_backup_finish()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupfinish
 [`sqlite3_backup_init()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupinit
 [`sqlite3_backup_step()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupstep
diff --git a/doc/api/stream.md b/doc/api/stream.md
index bb1199a7365a..2198d9f84f5e 100644
--- a/doc/api/stream.md
+++ b/doc/api/stream.md
@@ -3566,6 +3566,10 @@ changes:
 Attaches an AbortSignal to a readable or writable stream. This lets code
 control stream destruction using an `AbortController`.
 
+> Stability: 0 - Deprecated. Using [`stream.addAbortSignal()`][] to destroy
+> long-lived stream resources is documentation-only deprecated. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 Calling `abort` on the `AbortController` corresponding to the passed
 `AbortSignal` will behave the same way as calling `.destroy(new AbortError())`
 on the stream, and `controller.error(new AbortError())` for webstreams.
diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index 899f19b38672..ab91bfdbb1dc 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -401,6 +401,12 @@ const { writer, readable } = push({
 A writer is any object conforming to the Writer interface. Only `write()` is
 required; all other methods are optional.
 
+Writer arguments use Web IDL conversion semantics. A non-`Uint8Array` chunk is
+converted to a `USVString` and then UTF-8 encoded. `writev()` and
+`writevSync()` accept any iterable object whose values can be converted to
+chunks. Writer option dictionaries treat `null` as an empty dictionary and
+ignore unknown members.
+
 Each async method has a synchronous `*Sync` counterpart designed for a
 try-fallback pattern: attempt the fast synchronous path first, and fall back
 to the async version only when the synchronous call indicates it could not
@@ -417,9 +423,13 @@ writer.fail(err);  // Always synchronous, no fallback needed
 
 * {boolean|null}
 
-Returns `true` if the next write is likely to be accepted (buffered data is
-below capacity), `false` if backpressure is active, or `null` if the writer
-is closed or the consumer has disconnected.
+Returns `true` if the slots buffer has physical capacity (buffered data is
+below the configured byte budget), `false` if the budget is exhausted, or
+`null` if the writer is closed or the consumer has disconnected.
+
+This reports physical capacity independently of the backpressure policy. With
+`'drop-oldest'` or `'drop-newest'`, writes still complete when this is `false`
+by evicting buffered data or discarding the incoming data, respectively.
 
 This is a hint, not a guarantee: the state can change between the check and
 the write. Use [`ondrain()`][] to wait for capacity rather than polling.
@@ -431,7 +441,11 @@ the write. Use [`ondrain()`][] to wait for capacity rather than polling.
     the pending `end()` call; it does not fail the writer itself.
 * Returns: {Promise} Fulfills with the total number of bytes written.
 
-Signals that no more data will be written and waits for buffered data to drain.
+Signals that no more data will be written. Writes already waiting for buffer
+space remain ordered before the end of the stream, while later writes fail. If
+data is outstanding, the returned promise fulfills after the consumer pulls
+`done: true` beyond the final batch. If no data is buffered or pending, the
+writer closes immediately.
 
 #### `writer.endSync()`
 
@@ -458,6 +472,12 @@ or errored, this is a no-op. Unlike `write()` and `end()`, `fail()` is
 unconditionally synchronous because failing a writer is a pure state
 transition with no async work to perform.
 
+#### `writer[Symbol.asyncDispose]()`
+
+If the writer is open, calls `writer.fail()`. If the writer is closing after
+`end()` or `endSync()`, waits for buffered data to drain. If the writer is
+already closed or errored, resolves immediately.
+
 #### `writer.write(chunk[, options])`
 
 * `chunk` {Uint8Array|string}
@@ -478,7 +498,7 @@ Synchronous write. Does not block; returns `false` if backpressure is active.
 
 #### `writer.writev(chunks[, options])`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * `options` {Object}
   * `signal` {AbortSignal} Cancel just this write operation. The signal cancels
     only the pending `writev()` call; it does not fail the writer itself.
@@ -488,7 +508,7 @@ Write multiple chunks as a single batch.
 
 #### `writer.writevSync(chunks)`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * Returns: {boolean} `true` if the write was accepted, `false` if the
   buffer is full.
 
@@ -507,6 +527,12 @@ import { from, pull, bytes, Stream } from 'node:stream/iter';
 Stream.from('hello');
 ```
 
+Options dictionaries defined by the Iterable Streams API use Web IDL
+conversion semantics. `null` is treated as an empty dictionary, unknown
+members are ignored, and known members are converted to their declared types
+before the operation runs. Conversion failures use Node.js error codes such as
+`ERR_INVALID_ARG_TYPE`, `ERR_INVALID_ARG_VALUE`, and `ERR_OUT_OF_RANGE`.
+
 ```cjs
 // Named exports
 const { from, pull, bytes, Stream } = require('node:stream/iter');
@@ -531,7 +557,8 @@ added: v25.9.0
 
 Create an async byte stream from the given input. Strings are UTF-8 encoded.
 `ArrayBuffer` and `ArrayBufferView` values are wrapped as `Uint8Array`. Arrays
-and iterables in `input` are recursively flattened and normalized.
+and iterables in `input` are recursively flattened and normalized. Flattened
+values may be split across implementation-defined bounded batches.
 
 Objects implementing `Symbol.for('Stream.toAsyncStreamable')` or
 `Symbol.for('Stream.toStreamable')` are converted via those protocols. The
@@ -599,7 +626,8 @@ added: v25.9.0
 * `...transforms` {Function|Object} Zero or more transforms to apply.
 * `writer` {Object} Destination with `write(chunk)` method.
 * `options` {Object}
-  * `signal` {AbortSignal} Abort the pipeline.
+  * `signal` {AbortSignal} Abort the pipeline. Aborting fails the destination
+    writer unless `preventFail` is `true`.
   * `preventClose` {boolean} If `true`, do not call `writer.end()` when
     the source ends. **Default:** `false`.
   * `preventFail` {boolean} If `true`, do not call `writer.fail()` on
@@ -678,8 +706,10 @@ added: v25.9.0
   * `signal` {AbortSignal} Abort the pipeline.
 * Returns: {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
 
-Create a lazy async pipeline. Data is not read from `source` until the
-returned iterable is consumed. Transforms are applied in order.
+Create a lazy async pipeline. Source conversion and streamable protocol
+dispatch occur when `pull()` is called, but data is not read from `source`
+until the returned iterable is consumed. A signal that is already aborted is
+thrown synchronously after source conversion. Transforms are applied in order.
 
 ```mjs
 import { from, pull, text } from 'node:stream/iter';
@@ -747,7 +777,8 @@ added: v25.9.0
 * `...transforms` {Function|Object} Zero or more sync transforms.
 * Returns: {Iterable} whose chunks return {Uint8Array\[]}
 
-Synchronous version of [`pull()`][]. All transforms must be synchronous.
+Synchronous version of [`pull()`][]. Source conversion and streamable protocol
+dispatch occur when `pullSync()` is called. All transforms must be synchronous.
 
 ## Push streams
 
@@ -765,7 +796,9 @@ added: v25.9.0
     **Default:** `16384`.
   * `backpressure` {string} Backpressure policy: `'strict'`, `'unbounded'`,
     `'drop-oldest'`, or `'drop-newest'`. **Default:** `'strict'`.
-  * `signal` {AbortSignal} Abort the stream.
+  * `signal` {AbortSignal} Abort the stream. The signal remains active while
+    buffered data drains after `writer.end()`; aborting during that time fails
+    the writer and rejects the pending `end()` promise.
 * Returns: {Object}
   * `writer` {Writable} The writer side.
   * `readable` {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
@@ -823,7 +856,7 @@ added: v25.9.0
 
 * `options` {Object}
   * `budget` {number} Buffer size in bytes for both directions.
-    **Default:** `16384`.
+    Must be >= 16384. **Default:** `16384`.
   * `backpressure` {string} Policy for both directions.
     **Default:** `'strict'`.
   * `signal` {AbortSignal} Cancellation signal for both channels.
@@ -1055,9 +1088,13 @@ added: v25.9.0
 * `drainable` {Object} An object implementing the drainable protocol.
 * Returns: {Promise|null}
 
-Wait for a drainable writer's backpressure to clear. Returns `null` if
-the object does not implement the drainable protocol, or a promise that
-fulfills with `true` when the writer can accept more data.
+Wait for a drainable writer to regain physical buffer capacity. Returns `null`
+if the object does not implement the drainable protocol, or a promise that
+fulfills with `true` when buffered data falls below the byte budget.
+
+For writers using `'drop-oldest'` or `'drop-newest'`, this waits for physical
+capacity even though writes do not block. This allows producers to avoid data
+loss by waiting before writing.
 
 ```mjs
 import { push, ondrain, text } from 'node:stream/iter';
@@ -1308,6 +1345,7 @@ added: v25.9.0
     **Default:** `65536`.
   * `backpressure` {string} `'strict'`, `'unbounded'`, `'drop-oldest'`, or
     `'drop-newest'`. **Default:** `'strict'`.
+  * `signal` {AbortSignal}
 * Returns: {Share}
 
 Create a pull-model multi-consumer shared stream. Unlike `broadcast()`, the
diff --git a/doc/api/test.md b/doc/api/test.md
index 1b47eaf70f75..40792d9e7852 100644
--- a/doc/api/test.md
+++ b/doc/api/test.md
@@ -3568,6 +3568,74 @@ Global events are emitted once per test run:
 The root test also emits [`'test:plan'`][] and [`'test:diagnostic'`][] events
 at the end of the run to report run level totals.
 
+### Event lifecycle
+
+The tables above group the events; the diagram below places them on a
+timeline. The declaration ordered events form the main spine, buffered so that
+a reporter sees them in source order, while each execution ordered twin is
+emitted immediately, when the work actually happens. In particular,
+[`'test:start'`][] marks when a test begins _reporting_ its own and its
+subtests' status, not when its body begins executing; that moment is
+[`'test:dequeue'`][].
+
+```text
+                     node:test reporter event lifecycle
+   main spine = DECLARATION order (buffered; matches source order)
+   right side = EXECUTION order (emitted immediately); ◄ marks each twin
+
+  LEAF TEST
+  ─────────
+   ┌──────────────┐                   test:enqueue
+   │ test:start   │ ◄──── twins ────  (queued for execution;
+   └──────────────┘                    type: 'suite' | 'test')
+        │  begins REPORTING           test:dequeue
+        │  (not the start of          (about to run; emitted right
+        │   the test body)             before the test body runs)
+        │
+        │     [ between the twins, on the execution timeline, the test
+        │       body runs: context.log() emits test:log live, and
+        │       test:stdout / test:stderr stream with --test ]
+        │
+        ▼
+   ┌───────────────────────┐
+   │ test:pass │ test:fail │ ◄──── twin ────  test:complete
+   └───────────────────────┘   result         (details.passed says which)
+        │
+        ▼
+   test:diagnostic    the test's own context.diagnostic() messages,
+                      buffered while it runs, flushed after its result
+
+
+  SUITE / PARENT TEST   (each subtest is the whole LEAF flow above)
+  ───────────────────
+   test:start ─► [ full flow of each subtest ... ] ─►
+        test:plan (count = subtests) ─► test:pass │ test:fail ─►
+        test:diagnostic
+
+
+  RUN-LEVEL FINALE   (root, after all top-level tests)
+  ────────────────
+   test:plan         top-level count
+        │
+        ▼
+   test:diagnostic   x N   tests, suites, pass, fail, cancelled,
+        │                  skipped, todo, duration_ms (+ coverage errors)
+        ▼
+   test:coverage     only if coverage is enabled
+        │
+        ▼
+   test:summary  ─►  stream ends
+
+
+  INTERRUPTION   (SIGINT, e.g. Ctrl+C, while tests are still running)
+  ────────────
+   test:interrupted   the innermost tests still running at that moment
+        │             (not emitted if none were running)
+        ▼
+   the run exits immediately — the buffered spine never flushes, so
+   neither the finale above nor those tests' own results are emitted
+```
+
 ### Event: `'test:coverage'`
 
 * `data` {Object}
diff --git a/doc/api/tls.md b/doc/api/tls.md
index 4917365e2c15..c8afdaa0784a 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -1094,6 +1094,11 @@ property is set only when `tlsSocket.authorized === false`.
 
 <!-- YAML
 added: v0.11.4
+changes:
+  - version: v26.9.0
+    pr-url: https://github.com/nodejs/node/pull/64677
+    description: On TLS 1.3, a resumed session where the client presented no
+                 certificate is no longer reported as authorized.
 -->
 
 * Type: {boolean}
@@ -1103,15 +1108,10 @@ specified when creating the `tls.TLSSocket` instance, otherwise `false`.
 
 The peer certificate is only verified during a full TLS handshake. When a
 connection is established by resuming a previous session (see
-[Session Resumption][]), verification is not repeated. If the client
-presented a certificate in the original handshake, `authorized` and
+[Session Resumption][]), verification is not repeated: `authorized` and
 `authorizationError` carry the result stored with the session, including
-any verification error. On TLS 1.3, a client that sent no certificate at
-all can resume a session and report `authorized` as `true`, while
-[`tls.TLSSocket.getPeerCertificate()`][] returns an empty object. Servers
-that authorize clients manually with `rejectUnauthorized: false` should
-therefore also check [`tls.TLSSocket.isSessionReused()`][] and that a peer
-certificate is present.
+any verification error and the case where the client presented no
+certificate at all.
 
 ### `tlsSocket.disableRenegotiation()`
 
@@ -2614,7 +2614,6 @@ added: v0.11.3
 [`tls.TLSSocket.getProtocol()`]: #tlssocketgetprotocol
 [`tls.TLSSocket.getSession()`]: #tlssocketgetsession
 [`tls.TLSSocket.getTLSTicket()`]: #tlssocketgettlsticket
-[`tls.TLSSocket.isSessionReused()`]: #tlssocketissessionreused
 [`tls.TLSSocket.servername`]: #tlssocketservername
 [`tls.TLSSocket`]: #class-tlstlssocket
 [`tls.connect()`]: #tlsconnectoptions-callback
diff --git a/doc/api/v8.md b/doc/api/v8.md
index cf8777db9734..45603fac1f6e 100644
--- a/doc/api/v8.md
+++ b/doc/api/v8.md
@@ -1853,6 +1853,39 @@ const profile = handle.stop();
 console.log(profile);
 ```
 
+## `v8.setHeapProfileNearHeapLimit(limit)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+> Stability: 1 - Experimental
+
+* `limit` {integer}
+
+Writes the active sampling heap profile as a `.heapprofile` file when V8 is
+near the heap limit, up to `limit` times. Files are written to the directory
+configured by `--diagnostic-dir` (or to the current working directory if the
+option is unset), using the
+`Heap.${yyyymmdd}.${hhmmss}.${pid}.${tid}.${seq}.heapprofile` naming
+convention.
+
+[`v8.startHeapProfile()`][] must be called before this API can capture a
+profile. If no sampling heap profile is active when V8 reaches the heap
+limit, the callback is uninstalled and V8 continues its normal
+out-of-memory behavior.
+
+This API can be used together with [`v8.setHeapSnapshotNearHeapLimit()`][].
+Each API maintains its own `limit`.
+
+Writing is best-effort. Materializing the sampled call tree can allocate V8
+and native memory, so the profile might not be completed if the process has
+insufficient memory available. The serialized profile is written by native code
+and is not exposed to JavaScript.
+
+Calling `setHeapProfileNearHeapLimit()` more than once is a no-op. `limit`
+must be a positive integer.
+
 [CppHeap]: https://v8docs.nodesource.com/node-22.4/d9/dc4/classv8_1_1_cpp_heap.html
 [HTML structured clone algorithm]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
 [Hook Callbacks]: #hook-callbacks
@@ -1887,6 +1920,8 @@ console.log(profile);
 [`serializer.transferArrayBuffer()`]: #serializertransferarraybufferid-arraybuffer
 [`serializer.writeRawBytes()`]: #serializerwriterawbytesbuffer
 [`settled` callback]: #settledpromise
+[`v8.setHeapSnapshotNearHeapLimit()`]: #v8setheapsnapshotnearheaplimitlimit
+[`v8.startHeapProfile()`]: #v8startheapprofileoptions
 [`v8.stopCoverage()`]: #v8stopcoverage
 [`v8.takeCoverage()`]: #v8takecoverage
 [`vm.Script`]: vm.md#new-vmscriptcode-options
diff --git a/doc/api/vfs.md b/doc/api/vfs.md
index 1551a18feac7..9be346439af5 100644
--- a/doc/api/vfs.md
+++ b/doc/api/vfs.md
@@ -38,10 +38,12 @@ Mounting a VFS only redirects supported [`node:fs`][] calls whose resolved paths
 are under the mount point. It does not prevent code from using other paths or
 other Node.js APIs to access resources available to the process.
 [`RealFSProvider`][] maps VFS paths under its configured root and rejects paths
-that resolve outside that root, but that check is not a security boundary. Do
-not rely on VFS to run untrusted code; use operating-system-level isolation,
-such as separate users, containers, or platform sandboxes, when a security
-boundary is required.
+that resolve outside that root, but that check is not a security boundary.
+[`ZipProvider`][] has no real file-system paths of its own to escape; its
+entries only ever exist within the archive's own namespace. Do not rely on VFS
+to run untrusted code; use operating-system-level isolation, such as separate
+users, containers, or platform sandboxes, when a security boundary is
+required.
 
 ## Basic usage
 
@@ -61,6 +63,11 @@ callback-based, and promise-based file system methods that mirror the
 shape of the [`node:fs`][] API. All paths are POSIX-style and absolute
 (starting with `/`).
 
+By default, the file tree is private to the VFS instance. To expose
+it through the global `node:fs` module, `require()`, and `import`,
+call [`vfs.mount()`][]; call [`vfs.unmount()`][] (or rely on a
+`using` declaration) to detach again.
+
 ## `vfs.create([provider][, options])`
 
 <!-- YAML
@@ -107,6 +114,124 @@ added: v26.4.0
   * `emitExperimentalWarning` {boolean} Whether to emit the experimental
     warning. **Default:** `true`.
 
+### `vfs.mount()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* Returns: {string} The absolute mount point.
+
+Mounts the virtual file system and returns the resulting mount point.
+After mounting, files in the VFS can be accessed through the
+`node:fs` module and resolved through `require()` and `import`
+using paths under the returned mount point.
+
+Mount points always live inside a reserved namespace that cannot have child file system entries,
+so virtual paths never conflate with (or shadow) real paths. The virtual path scheme is subject to
+change and users should not manually construct them based on assumptions. Instead, obtain
+them from what `vfs.mount()` returns or `vfs.mountPoint`.
+
+```cjs
+const vfs = require('node:vfs');
+const fs = require('node:fs');
+
+const myVfs = vfs.create();
+myVfs.writeFileSync('/data.txt', 'Hello');
+const mountPoint = myVfs.mount();
+// e.g. '/dev/null/vfs/0'
+
+fs.readFileSync(`${mountPoint}/data.txt`, 'utf8'); // 'Hello'
+```
+
+Each `VirtualFileSystem` instance may be mounted at most once at a
+time. Attempting to mount an already-mounted instance throws
+`ERR_INVALID_STATE`. Because each instance mounts inside its own
+per-layer namespace, mounts from different instances can never
+overlap.
+
+The VFS supports the [Explicit Resource Management][] proposal. Use
+a `using` declaration to unmount automatically when leaving scope:
+
+```cjs
+const vfs = require('node:vfs');
+const fs = require('node:fs');
+
+let mountPoint;
+{
+  using myVfs = vfs.create();
+  myVfs.writeFileSync('/data.txt', 'Hello');
+  mountPoint = myVfs.mount();
+
+  fs.readFileSync(`${mountPoint}/data.txt`, 'utf8'); // 'Hello'
+} // VFS is automatically unmounted here
+
+fs.existsSync(`${mountPoint}/data.txt`); // false
+```
+
+### `vfs.unmount()`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+Unmounts the virtual file system. After unmounting, virtual files
+are no longer reachable through `node:fs`, `require()`, or `import`.
+The same instance may be mounted again by calling `mount()`.
+
+This method is idempotent: calling `unmount()` on a VFS that is not
+currently mounted has no effect.
+
+### `vfs.mounted`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {boolean}
+
+`true` while the VFS is mounted; `false` otherwise.
+
+### `vfs.mountPoint`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string | null}
+
+The current mount point as an absolute string (the value returned by
+the last [`vfs.mount()`][] call), or `null` when the VFS is not
+mounted.
+
+### `vfs.mountPointURL`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* {string | null}
+
+The current mount point as a `file:` URL string (the [`vfs.mountPoint`][]
+path converted with [`url.pathToFileURL()`][]), or `null` when the VFS
+is not mounted.
+
+This is a convenience for addressing mounted files with URL-based
+APIs such as dynamic `import()`:
+
+```mjs
+import vfs from 'node:vfs';
+
+const myVfs = vfs.create();
+myVfs.writeFileSync('/mod.mjs', 'export const value = 42;');
+myVfs.mount();
+
+const { value } = await import(`${myVfs.mountPointURL}/mod.mjs`);
+console.log(value); // 42
+
+myVfs.unmount();
+```
+
 ### `vfs.provider`
 
 <!-- YAML
@@ -196,6 +321,141 @@ The promise namespace mirrors `fs.promises` and includes `readFile`,
 `access`, `rm`, `truncate`, `link`, `mkdtemp`, `chmod`, `chown`, `lchown`,
 `utimes`, `lutimes`, `open`, `lchmod`, and `watch`.
 
+## Module loader integration
+
+Once a `VirtualFileSystem` is mounted, paths under the mount point
+participate in module resolution and loading. The [CommonJS
+resolution algorithm][] used by [`require()`][] and
+[`require.resolve()`][] and the [ES modules resolution algorithm][]
+used by `import` and [`import.meta.resolve()`][] are unchanged;
+instead, every file system operation those algorithms perform is
+dispatched on the path being probed: paths under a mount point are
+served by the owning VFS, and all other paths are served by the real
+file system. Files served from the VFS therefore behave as
+first-class modules.
+
+Because mounted paths live in a reserved namespace that cannot exist
+on disk, any given path is served either by exactly one VFS or by
+the real file system, never both. There is no search order or
+fallback between the two: if a path under a mount point does not
+exist in the VFS, resolution fails with `ENOENT` without consulting
+the disk, and a mounted layer never shadows a real directory.
+
+For resolution purposes the mount point behaves as a file system
+root: `package.json` scope lookups and [loading from `node_modules`
+folders][] stop at the mount point. For example, when
+`${mountPoint}/foo/bar/main.cjs` calls `require('baz')`, the lookup
+goes through:
+
+* `${mountPoint}/foo/bar/node_modules/baz`
+* `${mountPoint}/foo/node_modules/baz`
+* `${mountPoint}/node_modules/baz`
+* If `$NODE_PATH` is set, the folders listed in `$NODE_PATH`
+* `$HOME/.node_modules/baz`
+* `$HOME/.node_libraries/baz`
+* `$PREFIX/lib/node/baz`
+
+The last four entries are [the global folders][], which are legacy
+CommonJS behavior and do not apply to `import`. Absolute specifiers
+may cross the boundary in either direction: a module on the real
+file system can `require()` a mounted path, and a virtual module can
+`require()` a real one.
+
+```cjs
+const vfs = require('node:vfs');
+
+const myVfs = vfs.create();
+myVfs.mkdirSync('/lib');
+myVfs.writeFileSync('/lib/greet.js', 'module.exports = () => "hi";');
+myVfs.writeFileSync(
+  '/lib/package.json', '{"main": "./greet.js"}');
+const mountPoint = myVfs.mount();
+
+const greet = require(`${mountPoint}/lib`);
+console.log(greet()); // 'hi'
+
+myVfs.unmount();
+```
+
+For ECMAScript modules, use `file:` URLs when passing mounted paths
+to dynamic `import()`. [`vfs.mountPointURL`][] provides the mount
+point in that form; this keeps VFS imports portable on Windows,
+where mounted paths use Windows path syntax.
+
+```mjs
+import vfs from 'node:vfs';
+
+const myVfs = vfs.create();
+myVfs.writeFileSync('/mod.mjs', 'export const value = 42;');
+myVfs.mount();
+
+const { value } = await import(`${myVfs.mountPointURL}/mod.mjs`);
+console.log(value); // 42
+
+myVfs.unmount();
+```
+
+CommonJS modules loaded from a mounted VFS are identified by their VFS paths
+that start with the mount point. This is reflected in, for example, `__filename` and
+`__dirname` in the module, or the errors stack traces involving functions from
+the VFS modules. ES modules in the VFS are similarly identified by the `file:` URL of
+their VFS paths and this is reflected in e.g. `import.meta.url`.
+
+Like modules loaded from the real file system, modules loaded from the VFS are
+cached on the first load. When `require()` or `import()` is used to load an absolute
+path or URL that falls under the mounted VFS multiple times, the module is only loaded
+once and subsequent calls return the same instance.
+
+Calling [`vfs.unmount()`][] invalidates the modules that were loaded
+from the mount point: a subsequent `require()` or `import` of a path
+under a re-created mount re-reads the file from the newly mounted
+VFS rather than returning a stale module. Modules loaded from other
+VFS instances or from the real file system are unaffected.
+
+Mounting and unmounting do not stop any module execution that is
+already started, or invalidate any objects materialized from VFS
+modules that are already executed. As with modules in the real file
+system, the callers are responsible for avoiding removal or
+invalidation of modules in the virtual file system while they are
+being loaded.
+
+Native addons (`.node` files) stored in a mounted VFS can be `require()`d as
+well. The operating system's dynamic loader cannot open a virtual path, so the
+addon's bytes are read from the VFS and loaded from a private, self-cleaning
+temporary image instead. Addons on the real file system are unaffected and
+load directly.
+
+## Use with Single Executable Applications
+
+When running as a [Single Executable Application][] built with
+`"useVfs": true` in the SEA configuration, the bundled assets are
+automatically mounted as a read-only virtual file system and the injected
+main script is executed from the root of the mount. No additional setup is
+required. Since the mount point is reserved and chosen at runtime, bundled
+code accesses the assets through `__dirname`-relative paths and relative
+`require()` calls rather than through a fixed path:
+
+```cjs
+// In the SEA main script, __dirname is the root of the mounted assets.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const config = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8'));
+const template = fs.readFileSync(
+  path.join(__dirname, 'templates/index.html'), 'utf8');
+```
+
+ESM entry points (`"mainFormat": "module"`) are supported: the main module
+is loaded from inside the mount through the ESM loader, and
+`import.meta.dirname` points at the mount root.
+
+`"useVfs"` cannot be used together with `"useSnapshot"` or `"useCodeCache"`.
+The SEA configuration parser will error if either combination is detected.
+
+See the [Single Executable Application][] documentation for more information
+on creating SEA builds with assets.
+
 ## Class: `VirtualProvider`
 
 <!-- YAML
@@ -302,6 +562,55 @@ added: v26.4.0
 
 The resolved absolute path used as the root.
 
+## Class: `ZipProvider`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+A provider that exposes the entries of a ZIP archive - either a
+[`zlib.ZipBuffer`][] (in memory) or a [`zlib.ZipFile`][] (on disk) - through
+the VFS API. `provider.readonly` reflects the archive's own
+[`zipFile.writable`][] flag: a `ZipBuffer` is always writable, and a
+`ZipFile` is writable only when opened with `{ writable: true }`.
+
+Directories are recognized both explicitly (an entry whose name ends in `/`)
+and implicitly (any entry name starting with `"<dir>/"`). `readdir()` does
+not support `{ recursive: true }`. Because a ZIP member cannot be edited or
+read in place - only fully written or fully decompressed - a file opened for
+writing only commits its content (as a new archive entry) when the handle is
+closed.
+
+Every method has a synchronous counterpart (`openSync()`, `statSync()`,
+`readdirSync()`, and so on), backed by the equally complete synchronous
+surface [`zlib.ZipBuffer`][]/[`zlib.ZipFile`][] expose. As with those, the
+synchronous methods here block the Node.js event loop and further JavaScript
+execution until the operation - including any deflate/inflate pass -
+completes.
+
+```cjs
+const vfs = require('node:vfs');
+const zlib = require('node:zlib');
+const { readFileSync } = require('node:fs');
+
+async function main() {
+  const zip = new zlib.ZipBuffer(readFileSync('archive.zip'));
+  const archiveVfs = vfs.create(new vfs.ZipProvider(zip));
+
+  console.log(await archiveVfs.promises.readdir('/'));
+  await archiveVfs.promises.writeFile('/new.txt', 'hello');
+}
+main();
+```
+
+### `new ZipProvider(source)`
+
+<!-- YAML
+added: v26.9.0
+-->
+
+* `source` {zlib.ZipBuffer|zlib.ZipFile} An already-open archive.
+
 ## Implementation details
 
 ### `Stats` objects
@@ -316,10 +625,28 @@ fields use synthetic but stable values:
 * `blocks` is `Math.ceil(size / 512)`.
 * Times default to the moment the entry was created/last modified.
 
+[CommonJS resolution algorithm]: modules.md#all-together
+[ES modules resolution algorithm]: esm.md#resolution-algorithm
+[Explicit Resource Management]: https://github.com/tc39/proposal-explicit-resource-management
+[Single Executable Application]: single-executable-applications.md
 [`MemoryProvider`]: #class-memoryprovider
 [`RealFSProvider`]: #class-realfsprovider
 [`VirtualFileSystem`]: #class-virtualfilesystem
 [`VirtualProvider`]: #class-virtualprovider
+[`ZipProvider`]: #class-zipprovider
 [`fs.BigIntStats`]: fs.md#class-fsstats
 [`fs.Stats`]: fs.md#class-fsstats
+[`import.meta.resolve()`]: esm.md#importmetaresolvespecifier
 [`node:fs`]: fs.md
+[`require()`]: modules.md#requireid
+[`require.resolve()`]: modules.md#requireresolverequest-options
+[`url.pathToFileURL()`]: url.md#urlpathtofileurlpath-options
+[`vfs.mount()`]: #vfsmount
+[`vfs.mountPointURL`]: #vfsmountpointurl
+[`vfs.mountPoint`]: #vfsmountpoint
+[`vfs.unmount()`]: #vfsunmount
+[`zipFile.writable`]: zlib.md#zipfilewritable
+[`zlib.ZipBuffer`]: zlib.md#class-zlibzipbuffer
+[`zlib.ZipFile`]: zlib.md#class-zlibzipfile
+[loading from `node_modules` folders]: modules.md#loading-from-node_modules-folders
+[the global folders]: modules.md#loading-from-the-global-folders
diff --git a/doc/changelogs/CHANGELOG_V26.md b/doc/changelogs/CHANGELOG_V26.md
index d88306ed1b34..56c374647e2a 100644
--- a/doc/changelogs/CHANGELOG_V26.md
+++ b/doc/changelogs/CHANGELOG_V26.md
@@ -8,6 +8,7 @@
 </tr>
 <tr>
 <td>
+<a href="#26.9.0">26.9.0</a><br/>
 <a href="#26.8.1">26.8.1</a><br/>
 <a href="#26.8.0">26.8.0</a><br/>
 <a href="#26.7.0">26.7.0</a><br/>
@@ -52,6 +53,308 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="26.9.0"></a>
+
+## 2026-09-08, Version 26.9.0 (Current), @aduh95
+
+### Notable Changes
+
+* \[[`93248801fa`](https://github.com/nodejs/node/commit/93248801fa)] - **(SEMVER-MINOR)** **crypto**: add a generic MAC API (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`9b52db81eb`](https://github.com/nodejs/node/commit/9b52db81eb)] - **(SEMVER-MINOR)** **crypto**: discover ciphers from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`d0d300f01f`](https://github.com/nodejs/node/commit/d0d300f01f)] - **(SEMVER-MINOR)** **crypto**: discover hashes from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`616bd3fa26`](https://github.com/nodejs/node/commit/616bd3fa26)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`4e69bef69a`](https://github.com/nodejs/node/commit/4e69bef69a)] - **(SEMVER-MINOR)** **ffi**: enable module by default (Matteo Collina) [#65475](https://github.com/nodejs/node/pull/65475)
+* \[[`203fbf1b71`](https://github.com/nodejs/node/commit/203fbf1b71)] - **(SEMVER-MINOR)** **lib**: implement node:bench (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`db036ea65e`](https://github.com/nodejs/node/commit/db036ea65e)] - **meta**: refine the security vuln posture for experimental features (James M Snell) [#65438](https://github.com/nodejs/node/pull/65438)
+* \[[`2808a903b8`](https://github.com/nodejs/node/commit/2808a903b8)] - **(SEMVER-MINOR)** **perf\_hooks**: implement Histogram meanCI API (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`587b9219e3`](https://github.com/nodejs/node/commit/587b9219e3)] - **(SEMVER-MINOR)** **perf\_hooks**: add CBOR export/import for histogram exchange (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`90871a34bb`](https://github.com/nodejs/node/commit/90871a34bb)] - **(SEMVER-MINOR)** **src**: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) [#65352](https://github.com/nodejs/node/pull/65352)
+* \[[`d86d7467e4`](https://github.com/nodejs/node/commit/d86d7467e4)] - **(SEMVER-MINOR)** **src,lib**: implement experimental DTLS API (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`e1c807a029`](https://github.com/nodejs/node/commit/e1c807a029)] - **(SEMVER-MINOR)** **vfs**: integrate with CJS and ESM module loaders (Matteo Collina) [#63653](https://github.com/nodejs/node/pull/63653)
+* \[[`0efd1f20b5`](https://github.com/nodejs/node/commit/0efd1f20b5)] - **(SEMVER-MINOR)** **worker**: add support for Web Workers (Aviv Keller) [#64894](https://github.com/nodejs/node/pull/64894)
+
+### Commits
+
+* \[[`692450651b`](https://github.com/nodejs/node/commit/692450651b)] - **(SEMVER-MINOR)** **benchmark**: implement node:bench version of bench tools (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`dcbb380d88`](https://github.com/nodejs/node/commit/dcbb380d88)] - **benchmark**: fix max-regressions detection in compare.js (James M Snell) [#65587](https://github.com/nodejs/node/pull/65587)
+* \[[`6062fc3ed1`](https://github.com/nodejs/node/commit/6062fc3ed1)] - **benchmark**: add --analyze option to benchmark/scatter.js (James M Snell) [#65594](https://github.com/nodejs/node/pull/65594)
+* \[[`3c78e86a11`](https://github.com/nodejs/node/commit/3c78e86a11)] - **benchmark**: add crypto class benchmarks (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`3f9236ab57`](https://github.com/nodejs/node/commit/3f9236ab57)] - **buffer**: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) [#65605](https://github.com/nodejs/node/pull/65605)
+* \[[`2f74486b3e`](https://github.com/nodejs/node/commit/2f74486b3e)] - **buffer**: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) [#65430](https://github.com/nodejs/node/pull/65430)
+* \[[`7c33c4d9bc`](https://github.com/nodejs/node/commit/7c33c4d9bc)] - **build**: add `--shared-perfetto` flag (Antoine du Hamel) [#65614](https://github.com/nodejs/node/pull/65614)
+* \[[`e499d032ee`](https://github.com/nodejs/node/commit/e499d032ee)] - **build**: enable V8 gdb/lldb plugin support (Chengzhong Wu) [#65786](https://github.com/nodejs/node/pull/65786)
+* \[[`b05f8e9094`](https://github.com/nodejs/node/commit/b05f8e9094)] - **build**: allow linking shared dependencies in the GN build (Shelley Vohr) [#65797](https://github.com/nodejs/node/pull/65797)
+* \[[`773c7d787a`](https://github.com/nodejs/node/commit/773c7d787a)] - **build**: enable the V8 sandbox in shared-cage builds (Shelley Vohr) [#62237](https://github.com/nodejs/node/pull/62237)
+* \[[`d0e941b502`](https://github.com/nodejs/node/commit/d0e941b502)] - **build**: add `--shared-highway` configure flag (Antoine du Hamel) [#65686](https://github.com/nodejs/node/pull/65686)
+* \[[`438224e120`](https://github.com/nodejs/node/commit/438224e120)] - **build**: add `--shared-abseil` configure flag (Antoine du Hamel) [#65682](https://github.com/nodejs/node/pull/65682)
+* \[[`6f347a1707`](https://github.com/nodejs/node/commit/6f347a1707)] - **build**: skip dockit on riscv64 (Stewart X Addison) [#62251](https://github.com/nodejs/node/pull/62251)
+* \[[`5245a6752d`](https://github.com/nodejs/node/commit/5245a6752d)] - **build**: activate correct default flags for riscv64 (Stewart X Addison) [#65708](https://github.com/nodejs/node/pull/65708)
+* \[[`cdbd354e72`](https://github.com/nodejs/node/commit/cdbd354e72)] - **build**: derive NODE\_ARCH from target\_cpu in the GN build (Shelley Vohr) [#65491](https://github.com/nodejs/node/pull/65491)
+* \[[`7e7e3fb1c8`](https://github.com/nodejs/node/commit/7e7e3fb1c8)] - **build**: define V8\_CONTIGUOUS\_COMPRESSED\_RO\_SPACE for shared cage (Shelley Vohr) [#65464](https://github.com/nodejs/node/pull/65464)
+* \[[`25711392a7`](https://github.com/nodejs/node/commit/25711392a7)] - **build**: remove obsolete configure flags (Chengzhong Wu) [#65456](https://github.com/nodejs/node/pull/65456)
+* \[[`9d741c0d44`](https://github.com/nodejs/node/commit/9d741c0d44)] - **build,src**: make --use-largepages a no-op (Joyee Cheung) [#65389](https://github.com/nodejs/node/pull/65389)
+* \[[`6fd0785458`](https://github.com/nodejs/node/commit/6fd0785458)] - **build,win**: remove LTO parallelisation limit (Stefan Stojanovic) [#65535](https://github.com/nodejs/node/pull/65535)
+* \[[`0c23ef542c`](https://github.com/nodejs/node/commit/0c23ef542c)] - **crypto**: fix multi-prime RSA JWKs (Filip Skokan) [#65649](https://github.com/nodejs/node/pull/65649)
+* \[[`e99975773d`](https://github.com/nodejs/node/commit/e99975773d)] - **crypto**: cache valid ECDH key pairs (Filip Skokan) [#65615](https://github.com/nodejs/node/pull/65615)
+* \[[`4e7015fb6c`](https://github.com/nodejs/node/commit/4e7015fb6c)] - **crypto**: add strict mode to --force-fips (Filip Skokan) [#65645](https://github.com/nodejs/node/pull/65645)
+* \[[`2aef11a140`](https://github.com/nodejs/node/commit/2aef11a140)] - **crypto**: add FIPS indicator diagnostics channel (Filip Skokan) [#65645](https://github.com/nodejs/node/pull/65645)
+* \[[`aab6dd1ca4`](https://github.com/nodejs/node/commit/aab6dd1ca4)] - **crypto**: fix public PKCS8 export error (한국) [#65609](https://github.com/nodejs/node/pull/65609)
+* \[[`93248801fa`](https://github.com/nodejs/node/commit/93248801fa)] - **(SEMVER-MINOR)** **crypto**: add a generic MAC API (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`8861722a7a`](https://github.com/nodejs/node/commit/8861722a7a)] - **crypto**: validate JWK usages before key\_ops (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`37df4ace61`](https://github.com/nodejs/node/commit/37df4ace61)] - **crypto**: fix private SPKI export error (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`3b203bf5fc`](https://github.com/nodejs/node/commit/3b203bf5fc)] - **crypto**: fix RSA-PSS oversized salt handling (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`358bf6a42e`](https://github.com/nodejs/node/commit/358bf6a42e)] - **crypto**: correct CCM decryption FIPS error message (kyungrae) [#65450](https://github.com/nodejs/node/pull/65450)
+* \[[`0f3c615e16`](https://github.com/nodejs/node/commit/0f3c615e16)] - **crypto**: harden X509Certificate state (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`cee1dbd260`](https://github.com/nodejs/node/commit/cee1dbd260)] - **crypto**: optimize key slot caching (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`8106d02a54`](https://github.com/nodejs/node/commit/8106d02a54)] - **crypto**: add null checks for OPENSSL\_INIT\_new() (Nora Dossche) [#63457](https://github.com/nodejs/node/pull/63457)
+* \[[`a7524cbfaf`](https://github.com/nodejs/node/commit/a7524cbfaf)] - **crypto**: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) [#65112](https://github.com/nodejs/node/pull/65112)
+* \[[`b2faeb6d55`](https://github.com/nodejs/node/commit/b2faeb6d55)] - **crypto**: avoid throwing CryptoKey brand checks (Filip Skokan) [#65503](https://github.com/nodejs/node/pull/65503)
+* \[[`ae6136e7ab`](https://github.com/nodejs/node/commit/ae6136e7ab)] - **crypto**: avoid throwing KeyObject brand checks (Filip Skokan) [#65503](https://github.com/nodejs/node/pull/65503)
+* \[[`9b52db81eb`](https://github.com/nodejs/node/commit/9b52db81eb)] - **(SEMVER-MINOR)** **crypto**: discover ciphers from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`d0d300f01f`](https://github.com/nodejs/node/commit/d0d300f01f)] - **(SEMVER-MINOR)** **crypto**: discover hashes from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`df0f833868`](https://github.com/nodejs/node/commit/df0f833868)] - **deps**: V8: backport 1a0089053443 (Jakob Linke) [#65764](https://github.com/nodejs/node/pull/65764)
+* \[[`bac695cfbf`](https://github.com/nodejs/node/commit/bac695cfbf)] - **deps**: V8: backport c9c0abfa51f0 (Jakob Linke) [#65764](https://github.com/nodejs/node/pull/65764)
+* \[[`e4444af2b3`](https://github.com/nodejs/node/commit/e4444af2b3)] - **deps**: V8: backport ebd15783b7ba (Marja Hölttä) [#65764](https://github.com/nodejs/node/pull/65764)
+* \[[`08033666de`](https://github.com/nodejs/node/commit/08033666de)] - **deps**: update undici to 8.10.2 (Node.js GitHub Bot) [#65788](https://github.com/nodejs/node/pull/65788)
+* \[[`0e1443ba2c`](https://github.com/nodejs/node/commit/0e1443ba2c)] - **deps**: V8: backport f3d4d458fe59 (Olivier Flückiger) [#65702](https://github.com/nodejs/node/pull/65702)
+* \[[`99ce7997ae`](https://github.com/nodejs/node/commit/99ce7997ae)] - **deps**: upgrade npm to 11.19.1 (npm team) [#65573](https://github.com/nodejs/node/pull/65573)
+* \[[`cf05a2ef43`](https://github.com/nodejs/node/commit/cf05a2ef43)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`8abc083a24`](https://github.com/nodejs/node/commit/8abc083a24)] - **deps**: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) [#65654](https://github.com/nodejs/node/pull/65654)
+* \[[`88b68ce745`](https://github.com/nodejs/node/commit/88b68ce745)] - **deps**: update simdjson to 4.6.9 (Node.js GitHub Bot) [#65655](https://github.com/nodejs/node/pull/65655)
+* \[[`d5641acccf`](https://github.com/nodejs/node/commit/d5641acccf)] - **deps**: update perfetto to 58.2 (Node.js GitHub Bot) [#65656](https://github.com/nodejs/node/pull/65656)
+* \[[`cde19de6f1`](https://github.com/nodejs/node/commit/cde19de6f1)] - **deps**: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) [#65494](https://github.com/nodejs/node/pull/65494)
+* \[[`221f4d5d37`](https://github.com/nodejs/node/commit/221f4d5d37)] - **deps**: update archs files for openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`f40e994d24`](https://github.com/nodejs/node/commit/f40e994d24)] - **deps**: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`b25de1e47c`](https://github.com/nodejs/node/commit/b25de1e47c)] - **diagnostics\_channel**: lazily create tracing context (Romain Lanz) [#65513](https://github.com/nodejs/node/pull/65513)
+* \[[`c518f9e501`](https://github.com/nodejs/node/commit/c518f9e501)] - **doc**: replace `node:modules` documentation header (René) [#65800](https://github.com/nodejs/node/pull/65800)
+* \[[`0fb3c18ef3`](https://github.com/nodejs/node/commit/0fb3c18ef3)] - **doc**: clarify node:bench significance policy (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`1e3af01d56`](https://github.com/nodejs/node/commit/1e3af01d56)] - **doc**: clarify isolation modes for node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`4694746efc`](https://github.com/nodejs/node/commit/4694746efc)] - **doc**: clarify measurement integrity details of node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`e986aeac6b`](https://github.com/nodejs/node/commit/e986aeac6b)] - **doc**: clarify return type of `fs.mkdtemp*` (Antoine du Hamel) [#65743](https://github.com/nodejs/node/pull/65743)
+* \[[`2284a18f92`](https://github.com/nodejs/node/commit/2284a18f92)] - **doc**: update `changelog-maker` instructions for releasing (Juan José) [#65707](https://github.com/nodejs/node/pull/65707)
+* \[[`fa4bc308be`](https://github.com/nodejs/node/commit/fa4bc308be)] - **doc**: add stability status to `crypto.setEngine` (Antoine du Hamel) [#65746](https://github.com/nodejs/node/pull/65746)
+* \[[`71b953786d`](https://github.com/nodejs/node/commit/71b953786d)] - **doc**: remove outdated TLS authorized warning (Tim Perry) [#65597](https://github.com/nodejs/node/pull/65597)
+* \[[`bcd6da7d1f`](https://github.com/nodejs/node/commit/bcd6da7d1f)] - **doc**: fix broken `using` link in ffi.md (Soul Lee) [#65632](https://github.com/nodejs/node/pull/65632)
+* \[[`6aedc56a82`](https://github.com/nodejs/node/commit/6aedc56a82)] - **doc**: fix some broken links (Antoine du Hamel) [#65583](https://github.com/nodejs/node/pull/65583)
+* \[[`1c981284a7`](https://github.com/nodejs/node/commit/1c981284a7)] - **doc**: fix stale TOC in maintaining-dependencies (greenhead) [#65523](https://github.com/nodejs/node/pull/65523)
+* \[[`b353cd6d90`](https://github.com/nodejs/node/commit/b353cd6d90)] - **doc**: refactor the AI guidelines (Joyee Cheung) [#65269](https://github.com/nodejs/node/pull/65269)
+* \[[`922d4c4c37`](https://github.com/nodejs/node/commit/922d4c4c37)] - **doc**: fix triggerAsyncId() comment in async\_hooks example (soreavis) [#64583](https://github.com/nodejs/node/pull/64583)
+* \[[`5b4521f4c8`](https://github.com/nodejs/node/commit/5b4521f4c8)] - **doc**: fix fsPromises.watch overflow value (Matt Radbourne) [#64605](https://github.com/nodejs/node/pull/64605)
+* \[[`ba1b44016b`](https://github.com/nodejs/node/commit/ba1b44016b)] - **doc**: clarify stream direction in options.stdio note (Avocado) [#65236](https://github.com/nodejs/node/pull/65236)
+* \[[`c98bb5210d`](https://github.com/nodejs/node/commit/c98bb5210d)] - **doc**: clarify signal listener behavior (Som Samantray) [#65243](https://github.com/nodejs/node/pull/65243)
+* \[[`91132e3eab`](https://github.com/nodejs/node/commit/91132e3eab)] - **doc**: add test reporter event lifecycle diagram (sangwook) [#63780](https://github.com/nodejs/node/pull/63780)
+* \[[`23f26eecb2`](https://github.com/nodejs/node/commit/23f26eecb2)] - **doc**: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) [#65436](https://github.com/nodejs/node/pull/65436)
+* \[[`037d651caa`](https://github.com/nodejs/node/commit/037d651caa)] - **(SEMVER-MINOR)** **doc**: move histogram.burnRate to correct location in doc (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`a4d1801fa3`](https://github.com/nodejs/node/commit/a4d1801fa3)] - **doc**: fix default limit of maxHeadersCount (Aryn H) [#65472](https://github.com/nodejs/node/pull/65472)
+* \[[`286cfd6ef0`](https://github.com/nodejs/node/commit/286cfd6ef0)] - **doc**: fix return types for sync methods (Chiang Fong Lee) [#58575](https://github.com/nodejs/node/pull/58575)
+* \[[`3b96fd8b33`](https://github.com/nodejs/node/commit/3b96fd8b33)] - **doc**: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) [#64342](https://github.com/nodejs/node/pull/64342)
+* \[[`cd0350fa65`](https://github.com/nodejs/node/commit/cd0350fa65)] - **doc**: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) [#64993](https://github.com/nodejs/node/pull/64993)
+* \[[`616bd3fa26`](https://github.com/nodejs/node/commit/616bd3fa26)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`6b99b5ba6f`](https://github.com/nodejs/node/commit/6b99b5ba6f)] - **errors**: validate constructor name (Christian Aurich) [#65607](https://github.com/nodejs/node/pull/65607)
+* \[[`4b7abe8652`](https://github.com/nodejs/node/commit/4b7abe8652)] - **events**: fix weak listener retention overwrite (Aryan) [#64024](https://github.com/nodejs/node/pull/64024)
+* \[[`a412d2ae28`](https://github.com/nodejs/node/commit/a412d2ae28)] - **ffi**: throw on missing memory helper arguments (Soul Lee) [#65500](https://github.com/nodejs/node/pull/65500)
+* \[[`60e085df5d`](https://github.com/nodejs/node/commit/60e085df5d)] - **ffi**: include SharedArrayBuffer in error message (Donghoon Kang) [#65735](https://github.com/nodejs/node/pull/65735)
+* \[[`4e69bef69a`](https://github.com/nodejs/node/commit/4e69bef69a)] - **(SEMVER-MINOR)** **ffi**: enable module by default (Matteo Collina) [#65475](https://github.com/nodejs/node/pull/65475)
+* \[[`de27fd7fd3`](https://github.com/nodejs/node/commit/de27fd7fd3)] - **ffi**: validate DynamicLibrary getter receivers (Trivikram Kamat) [#65415](https://github.com/nodejs/node/pull/65415)
+* \[[`d5ac0f4e36`](https://github.com/nodejs/node/commit/d5ac0f4e36)] - **fs**: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) [#65488](https://github.com/nodejs/node/pull/65488)
+* \[[`4f8195078c`](https://github.com/nodejs/node/commit/4f8195078c)] - **fs**: give directories created by cpSync the source directory's mode (Shelley Vohr) [#65488](https://github.com/nodejs/node/pull/65488)
+* \[[`9a6bef435c`](https://github.com/nodejs/node/commit/9a6bef435c)] - **fs**: write files in one thread pool round trip (Shelley Vohr) [#65489](https://github.com/nodejs/node/pull/65489)
+* \[[`e1de66d3f1`](https://github.com/nodejs/node/commit/e1de66d3f1)] - **fs**: handle recursive watch setup races (Filip Skokan) [#65699](https://github.com/nodejs/node/pull/65699)
+* \[[`187b299842`](https://github.com/nodejs/node/commit/187b299842)] - **fs**: apply nocase to literal glob exclude patterns (Yusuke Hayashi) [#64817](https://github.com/nodejs/node/pull/64817)
+* \[[`f2f6420a79`](https://github.com/nodejs/node/commit/f2f6420a79)] - **fs**: improve performance of recursive directory read (Aviv Keller) [#65524](https://github.com/nodejs/node/pull/65524)
+* \[[`1609883139`](https://github.com/nodejs/node/commit/1609883139)] - **fs**: do not descend into symlinks for \*\* unless following symlinks (RafaelGSS) [#65435](https://github.com/nodejs/node/pull/65435)
+* \[[`a6d4389438`](https://github.com/nodejs/node/commit/a6d4389438)] - **fs**: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) [#65486](https://github.com/nodejs/node/pull/65486)
+* \[[`fb1c62fed2`](https://github.com/nodejs/node/commit/fb1c62fed2)] - **fs**: preserve directory timestamps in cp (Abhinandan Kumar) [#65540](https://github.com/nodejs/node/pull/65540)
+* \[[`6be311eb68`](https://github.com/nodejs/node/commit/6be311eb68)] - **fs**: fix recursive watch error handling (Filip Skokan) [#65635](https://github.com/nodejs/node/pull/65635)
+* \[[`1918001482`](https://github.com/nodejs/node/commit/1918001482)] - **fs**: cancel in-flight stat on abort (Mert Can Altin) [#63142](https://github.com/nodejs/node/pull/63142)
+* \[[`1c4c3ed083`](https://github.com/nodejs/node/commit/1c4c3ed083)] - **fs**: fix rmSync error messages for non-ASCII paths (Yeaseen) [#61233](https://github.com/nodejs/node/pull/61233)
+* \[[`a7856ab8bc`](https://github.com/nodejs/node/commit/a7856ab8bc)] - **fs**: add maxDepth option to glob (Alexander Lichter) [#64003](https://github.com/nodejs/node/pull/64003)
+* \[[`84db72b15c`](https://github.com/nodejs/node/commit/84db72b15c)] - **http**: fast-forward teardown of unread messages (Matteo Collina) [#65732](https://github.com/nodejs/node/pull/65732)
+* \[[`6ead515f7f`](https://github.com/nodejs/node/commit/6ead515f7f)] - **http**: coalesce chunked writes during auto-corking (GetThatCookie) [#64987](https://github.com/nodejs/node/pull/64987)
+* \[[`d52e9bcea9`](https://github.com/nodejs/node/commit/d52e9bcea9)] - **http2**: fix async context loss when trailers carry END\_STREAM (Orgad Shaneh) [#63814](https://github.com/nodejs/node/pull/63814)
+* \[[`fee97e10e4`](https://github.com/nodejs/node/commit/fee97e10e4)] - **http2**: fix write deadlock exposed by larger window sizes (Tim Perry) [#65440](https://github.com/nodejs/node/pull/65440)
+* \[[`a21044c008`](https://github.com/nodejs/node/commit/a21044c008)] - **https**: limit proxy CONNECT response headers (Matteo Collina) [#64545](https://github.com/nodejs/node/pull/64545)
+* \[[`312ca1c1d8`](https://github.com/nodejs/node/commit/312ca1c1d8)] - **lib**: fixup node:bench handling of --require option (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`36ea3299c6`](https://github.com/nodejs/node/commit/36ea3299c6)] - **lib**: improve diagnostic message support (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`6fa840441a`](https://github.com/nodejs/node/commit/6fa840441a)] - **lib**: have runFile honor permissions and accept URL/Buffer paths (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`1c641c3352`](https://github.com/nodejs/node/commit/1c641c3352)] - **lib**: add runFile api to node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`5c92c72d8c`](https://github.com/nodejs/node/commit/5c92c72d8c)] - **lib**: add context.diagnostic api to node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`970e2d1256`](https://github.com/nodejs/node/commit/970e2d1256)] - **lib**: add `bench:plan` event to `node:bench` (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`b89d5d1763`](https://github.com/nodejs/node/commit/b89d5d1763)] - **lib**: clarify mean in node:bench docs (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`34afd81972`](https://github.com/nodejs/node/commit/34afd81972)] - **lib**: improve node:bench stream handling (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`e7c571488a`](https://github.com/nodejs/node/commit/e7c571488a)] - **lib**: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`5bc9f7ec08`](https://github.com/nodejs/node/commit/5bc9f7ec08)] - **(SEMVER-MINOR)** **lib**: add `node:bench` explicit createRunner (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`798abea07f`](https://github.com/nodejs/node/commit/798abea07f)] - **(SEMVER-MINOR)** **lib**: complete the implementation of node:bench and cli (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`385d7505fb`](https://github.com/nodejs/node/commit/385d7505fb)] - **(SEMVER-MINOR)** **lib**: implement bench/reporters (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`203fbf1b71`](https://github.com/nodejs/node/commit/203fbf1b71)] - **(SEMVER-MINOR)** **lib**: implement node:bench (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`d34c3af68e`](https://github.com/nodejs/node/commit/d34c3af68e)] - **lib**: use `Float16Array` from primordials (Antoine du Hamel) [#65702](https://github.com/nodejs/node/pull/65702)
+* \[[`76239139a6`](https://github.com/nodejs/node/commit/76239139a6)] - **lib**: defer source map payload decoding until first use (Shelley Vohr) [#65490](https://github.com/nodejs/node/pull/65490)
+* \[[`86c0a7f1a5`](https://github.com/nodejs/node/commit/86c0a7f1a5)] - **lib**: optimize async context frame activation (Tim Perry) [#65519](https://github.com/nodejs/node/pull/65519)
+* \[[`5196a5610d`](https://github.com/nodejs/node/commit/5196a5610d)] - **lib**: use validateArray for array arguments (JunHwan Choi) [#65344](https://github.com/nodejs/node/pull/65344)
+* \[[`aa9df8134b`](https://github.com/nodejs/node/commit/aa9df8134b)] - **lib**: apply minor dtls cleanups (James M Snell) [#63539](https://github.com/nodejs/node/pull/63539)
+* \[[`2f70f2d6f9`](https://github.com/nodejs/node/commit/2f70f2d6f9)] - **lib,benchmark**: address multiple review issues (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`33d588ce81`](https://github.com/nodejs/node/commit/33d588ce81)] - **meta**: cleanup targos emeritus changes (Antoine du Hamel) [#65738](https://github.com/nodejs/node/pull/65738)
+* \[[`1e39c1d59b`](https://github.com/nodejs/node/commit/1e39c1d59b)] - **meta**: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65714](https://github.com/nodejs/node/pull/65714)
+* \[[`5982295329`](https://github.com/nodejs/node/commit/5982295329)] - **meta**: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65717](https://github.com/nodejs/node/pull/65717)
+* \[[`f3cd08b746`](https://github.com/nodejs/node/commit/f3cd08b746)] - **meta**: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot\[bot]) [#65718](https://github.com/nodejs/node/pull/65718)
+* \[[`37d6430467`](https://github.com/nodejs/node/commit/37d6430467)] - **meta**: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot\[bot]) [#65719](https://github.com/nodejs/node/pull/65719)
+* \[[`4deaeeef33`](https://github.com/nodejs/node/commit/4deaeeef33)] - **meta**: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot\[bot]) [#65720](https://github.com/nodejs/node/pull/65720)
+* \[[`719c42a14c`](https://github.com/nodejs/node/commit/719c42a14c)] - **meta**: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot\[bot]) [#65721](https://github.com/nodejs/node/pull/65721)
+* \[[`5481c2556b`](https://github.com/nodejs/node/commit/5481c2556b)] - **meta**: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65722](https://github.com/nodejs/node/pull/65722)
+* \[[`032ebf1f24`](https://github.com/nodejs/node/commit/032ebf1f24)] - **meta**: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65723](https://github.com/nodejs/node/pull/65723)
+* \[[`b091d933bf`](https://github.com/nodejs/node/commit/b091d933bf)] - **meta**: document collaborator automation (Filip Skokan) [#65671](https://github.com/nodejs/node/pull/65671)
+* \[[`db036ea65e`](https://github.com/nodejs/node/commit/db036ea65e)] - **meta**: refine the security vuln posture for experimental features (James M Snell) [#65438](https://github.com/nodejs/node/pull/65438)
+* \[[`1f57046f1c`](https://github.com/nodejs/node/commit/1f57046f1c)] - **module**: derive builtinModules from enabled builtin set (Jungwon Sohn) [#65418](https://github.com/nodejs/node/pull/65418)
+* \[[`d234dbb617`](https://github.com/nodejs/node/commit/d234dbb617)] - **net**: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) [#64125](https://github.com/nodejs/node/pull/64125)
+* \[[`f1f6d17e84`](https://github.com/nodejs/node/commit/f1f6d17e84)] - **net**: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) [#63619](https://github.com/nodejs/node/pull/63619)
+* \[[`027d5285ee`](https://github.com/nodejs/node/commit/027d5285ee)] - **net**: improve dtls cert verification (James M Snell) [#64314](https://github.com/nodejs/node/pull/64314)
+* \[[`75fcb1b6ec`](https://github.com/nodejs/node/commit/75fcb1b6ec)] - **node-api**: make object property arrays const (Yilong Li) [#65621](https://github.com/nodejs/node/pull/65621)
+* \[[`00add61659`](https://github.com/nodejs/node/commit/00add61659)] - **node-api**: enter env context for async callbacks (Shelley Vohr) [#65406](https://github.com/nodejs/node/pull/65406)
+* \[[`2808a903b8`](https://github.com/nodejs/node/commit/2808a903b8)] - **(SEMVER-MINOR)** **perf\_hooks**: implement Histogram meanCI API (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`9ff86e471d`](https://github.com/nodejs/node/commit/9ff86e471d)] - **perf\_hooks**: add missing resource timing attributes (greenhead) [#65017](https://github.com/nodejs/node/pull/65017)
+* \[[`587b9219e3`](https://github.com/nodejs/node/commit/587b9219e3)] - **(SEMVER-MINOR)** **perf\_hooks**: add CBOR export/import for histogram exchange (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`db81249fcf`](https://github.com/nodejs/node/commit/db81249fcf)] - **permission**: do not enforce fs and addons in audit mode (Issac) [#65659](https://github.com/nodejs/node/pull/65659)
+* \[[`e46f5e1781`](https://github.com/nodejs/node/commit/e46f5e1781)] - **permission**: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) [#65492](https://github.com/nodejs/node/pull/65492)
+* \[[`f78b2477ee`](https://github.com/nodejs/node/commit/f78b2477ee)] - **permission**: block FileHandle fsync and fdatasync (Rafael Gonzaga) [#65431](https://github.com/nodejs/node/pull/65431)
+* \[[`9c736a11db`](https://github.com/nodejs/node/commit/9c736a11db)] - **quic**: stop guarding ngtcp2\_recv\_stop\_sending callback field (René) [#65688](https://github.com/nodejs/node/pull/65688)
+* \[[`310505e38a`](https://github.com/nodejs/node/commit/310505e38a)] - **quic**: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) [#65522](https://github.com/nodejs/node/pull/65522)
+* \[[`1db96e7c30`](https://github.com/nodejs/node/commit/1db96e7c30)] - **quic**: remove unused fin flag from blob reader wakeup (trivenay) [#65315](https://github.com/nodejs/node/pull/65315)
+* \[[`02e0f3a41e`](https://github.com/nodejs/node/commit/02e0f3a41e)] - **quic**: apply multiple fixes to flow control signaling (James M Snell) [#65309](https://github.com/nodejs/node/pull/65309)
+* \[[`c6789e89dc`](https://github.com/nodejs/node/commit/c6789e89dc)] - **quic**: release stream arenas before cleanup (Trivikram Kamat) [#65410](https://github.com/nodejs/node/pull/65410)
+* \[[`ce7866e00e`](https://github.com/nodejs/node/commit/ce7866e00e)] - **sea**: mount bundled assets as a virtual file system (Matteo Collina) [#65675](https://github.com/nodejs/node/pull/65675)
+* \[[`aeb78a5015`](https://github.com/nodejs/node/commit/aeb78a5015)] - **sea**: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) [#65564](https://github.com/nodejs/node/pull/65564)
+* \[[`2ba8fa0379`](https://github.com/nodejs/node/commit/2ba8fa0379)] - **sqlite**: re-validate database state after reading options (Trevor Burnham) [#65595](https://github.com/nodejs/node/pull/65595)
+* \[[`113180ad3f`](https://github.com/nodejs/node/commit/113180ad3f)] - **sqlite**: run backup completion in callback scope (Filip Skokan) [#65666](https://github.com/nodejs/node/pull/65666)
+* \[[`9bf28b5e90`](https://github.com/nodejs/node/commit/9bf28b5e90)] - **sqlite**: copy changeset before applying it (Matteo Collina) [#65286](https://github.com/nodejs/node/pull/65286)
+* \[[`21f18aafe7`](https://github.com/nodejs/node/commit/21f18aafe7)] - **sqlite**: reject closing a session from a callback (Trevor Burnham) [#65454](https://github.com/nodejs/node/pull/65454)
+* \[[`035a9b8bfd`](https://github.com/nodejs/node/commit/035a9b8bfd)] - **sqlite**: keep sessions alive across SQLite callbacks (Trevor Burnham) [#65465](https://github.com/nodejs/node/pull/65465)
+* \[[`09202e8a6b`](https://github.com/nodejs/node/commit/09202e8a6b)] - **sqlite**: throw on disposal of an in-use session (Guilherme Araújo) [#65449](https://github.com/nodejs/node/pull/65449)
+* \[[`4eb613360a`](https://github.com/nodejs/node/commit/4eb613360a)] - **src**: fix use-after-free in CleanupHookThunkRun (Caleb Everett) [#65630](https://github.com/nodejs/node/pull/65630)
+* \[[`03f211924b`](https://github.com/nodejs/node/commit/03f211924b)] - **(SEMVER-MINOR)** **src**: fixup histogram and options linting issues (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`62a0e088f7`](https://github.com/nodejs/node/commit/62a0e088f7)] - **src**: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) [#65684](https://github.com/nodejs/node/pull/65684)
+* \[[`90871a34bb`](https://github.com/nodejs/node/commit/90871a34bb)] - **(SEMVER-MINOR)** **src**: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) [#65352](https://github.com/nodejs/node/pull/65352)
+* \[[`0dfd6910f7`](https://github.com/nodejs/node/commit/0dfd6910f7)] - **src**: fix live lock between environments with blocked requests (Ilyas Shabi) [#65520](https://github.com/nodejs/node/pull/65520)
+* \[[`a2548a08b4`](https://github.com/nodejs/node/commit/a2548a08b4)] - **src**: apply IsolateSettings when using a snapshot (Shelley Vohr) [#65407](https://github.com/nodejs/node/pull/65407)
+* \[[`75e93e9980`](https://github.com/nodejs/node/commit/75e93e9980)] - **src**: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) [#64327](https://github.com/nodejs/node/pull/64327)
+* \[[`e7c28635d8`](https://github.com/nodejs/node/commit/e7c28635d8)] - **src**: reuse cached strings in CompileSerializeMain (agape1225) [#65453](https://github.com/nodejs/node/pull/65453)
+* \[[`527f148556`](https://github.com/nodejs/node/commit/527f148556)] - **src**: add missing vector include (Filip Skokan) [#65622](https://github.com/nodejs/node/pull/65622)
+* \[[`8909c749f3`](https://github.com/nodejs/node/commit/8909c749f3)] - **src**: disable V8 external memory reasonable size check (Paul Bouchon) [#65589](https://github.com/nodejs/node/pull/65589)
+* \[[`d2bc30f865`](https://github.com/nodejs/node/commit/d2bc30f865)] - **src**: report libuv error when openAsBlob cannot stat (Paul Bouchon) [#65517](https://github.com/nodejs/node/pull/65517)
+* \[[`f4908cc50d`](https://github.com/nodejs/node/commit/f4908cc50d)] - **src**: list scripts when `--run` has no command (James Ross) [#64606](https://github.com/nodejs/node/pull/64606)
+* \[[`6d7428a7e2`](https://github.com/nodejs/node/commit/6d7428a7e2)] - **src**: fixup manual new/delete usages (James M Snell) [#65348](https://github.com/nodejs/node/pull/65348)
+* \[[`caf49636dc`](https://github.com/nodejs/node/commit/caf49636dc)] - **src**: make the options structs smaller with packed bits (James M Snell) [#65145](https://github.com/nodejs/node/pull/65145)
+* \[[`faa7bb1e67`](https://github.com/nodejs/node/commit/faa7bb1e67)] - **(SEMVER-MINOR)** **src, lib**: add stats to dtls (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`64920aecd6`](https://github.com/nodejs/node/commit/64920aecd6)] - **(SEMVER-MINOR)** **src,lib**: add dtls interop tests (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`d86d7467e4`](https://github.com/nodejs/node/commit/d86d7467e4)] - **(SEMVER-MINOR)** **src,lib**: implement experimental DTLS API (James M Snell) [#63182](https://github.com/nodejs/node/pull/63182)
+* \[[`2f5a60ffaf`](https://github.com/nodejs/node/commit/2f5a60ffaf)] - **stream**: use webidl validation semantics for args (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`c6979b467e`](https://github.com/nodejs/node/commit/c6979b467e)] - **stream**: ensure that stateful transforms preserve this (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`3816b8f7d4`](https://github.com/nodejs/node/commit/3816b8f7d4)] - **stream**: fix nested async flushing with infinite sources (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`52b7199025`](https://github.com/nodejs/node/commit/52b7199025)] - **stream**: ensure from() observes returned rejecting promise correctly (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`d8f6dd64cf`](https://github.com/nodejs/node/commit/d8f6dd64cf)] - **stream**: apply source normalization once at call time (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`6e1e4ccc71`](https://github.com/nodejs/node/commit/6e1e4ccc71)] - **stream**: make consumer signals on longer alter source precedence (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`04406b834d`](https://github.com/nodejs/node/commit/04406b834d)] - **stream**: make pipeTo source normalization independent of Writer (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`0b859b133b`](https://github.com/nodejs/node/commit/0b859b133b)] - **stream**: pre-aborted pipeTo now applies dest failure handling (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`9c664ee035`](https://github.com/nodejs/node/commit/9c664ee035)] - **stream**: ensure pre-existing writes drain before EOF and end() waits (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`71045912ed`](https://github.com/nodejs/node/commit/71045912ed)] - **stream**: ensure async dispoal after endSync awaits for drain (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`5532080f6d`](https://github.com/nodejs/node/commit/5532080f6d)] - **stream**: ensure factory signals remain active through closing (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`e2a348ed08`](https://github.com/nodejs/node/commit/e2a348ed08)] - **stream**: canWrite and ondrain now reflect physical capacity (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`630018358b`](https://github.com/nodejs/node/commit/630018358b)] - **stream**: skip unobserved 'readable' emission at EOF (Matteo Collina) [#65749](https://github.com/nodejs/node/pull/65749)
+* \[[`3e345b6cca`](https://github.com/nodejs/node/commit/3e345b6cca)] - **stream**: avoid per-chunk promises in webstream adapters (Matteo Collina) [#65548](https://github.com/nodejs/node/pull/65548)
+* \[[`7a1fc2bae4`](https://github.com/nodejs/node/commit/7a1fc2bae4)] - **stream**: address stream/iter review feedback (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`ba9144aee4`](https://github.com/nodejs/node/commit/ba9144aee4)] - **stream**: replace object sentinel with symbol (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`217a5de4d1`](https://github.com/nodejs/node/commit/217a5de4d1)] - **stream**: ensure pipeToSync requires synchronous close (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`ab1f40d2e3`](https://github.com/nodejs/node/commit/ab1f40d2e3)] - **stream**: cancel active stream/iter pulls (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`21cc4b7ee6`](https://github.com/nodejs/node/commit/21cc4b7ee6)] - **stream**: fix merge settlement tagging and falsy error tracking (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`1ba8787e07`](https://github.com/nodejs/node/commit/1ba8787e07)] - **stream**: ensure full-close semantics when closed (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`9a9246a108`](https://github.com/nodejs/node/commit/9a9246a108)] - **stream**: defend against re-entrancy in writev (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`2b5e062d1d`](https://github.com/nodejs/node/commit/2b5e062d1d)] - **stream**: ensure stability of stored metadata (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`4f7b87e91b`](https://github.com/nodejs/node/commit/4f7b87e91b)] - **stream**: fixup writer to terminate on consumer return/throw (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`0ae81818b4`](https://github.com/nodejs/node/commit/0ae81818b4)] - **stream**: ensure iterator cleanup on done, reject, etc (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`16451fcee1`](https://github.com/nodejs/node/commit/16451fcee1)] - **stream**: fixup cancelation handling in pull() (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`81abe3b61f`](https://github.com/nodejs/node/commit/81abe3b61f)] - **stream**: fix early drain after Utf8Stream reopen (Matteo Collina) [#65633](https://github.com/nodejs/node/pull/65633)
+* \[[`f635931242`](https://github.com/nodejs/node/commit/f635931242)] - **test**: make node:bench test samples survive a coarse clock (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`1222ab33ad`](https://github.com/nodejs/node/commit/1222ab33ad)] - **test**: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`379f9c3ff0`](https://github.com/nodejs/node/commit/379f9c3ff0)] - **test**: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`142c166360`](https://github.com/nodejs/node/commit/142c166360)] - **test**: only count restarts after the write in watch emit-restarted test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`9b5b185dde`](https://github.com/nodejs/node/commit/9b5b185dde)] - **test**: do not dump core in external memory limit test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`e0d76c7a09`](https://github.com/nodejs/node/commit/e0d76c7a09)] - **test**: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`8108dab655`](https://github.com/nodejs/node/commit/8108dab655)] - **test**: handle EPIPE in closed channel test (Christian Aurich) [#65770](https://github.com/nodejs/node/pull/65770)
+* \[[`8c12bd67e9`](https://github.com/nodejs/node/commit/8c12bd67e9)] - **test**: deflake test-permission-net-udp-handle (Christian Aurich) [#65767](https://github.com/nodejs/node/pull/65767)
+* \[[`70118dc627`](https://github.com/nodejs/node/commit/70118dc627)] - **test**: zero-fill buffers before the string length limit check (Christian Aurich) [#65755](https://github.com/nodejs/node/pull/65755)
+* \[[`7446e5bfaf`](https://github.com/nodejs/node/commit/7446e5bfaf)] - **test**: expand test coverage of node:bench (James M Snell) [#65631](https://github.com/nodejs/node/pull/65631)
+* \[[`433117d224`](https://github.com/nodejs/node/commit/433117d224)] - **test**: deflake test-runner-coverage (Christian Aurich) [#65728](https://github.com/nodejs/node/pull/65728)
+* \[[`d2b6bf4f69`](https://github.com/nodejs/node/commit/d2b6bf4f69)] - **(SEMVER-MINOR)** **test**: fix node:bench test timing (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`4be08e0b86`](https://github.com/nodejs/node/commit/4be08e0b86)] - **(SEMVER-MINOR)** **test**: improve node:bench test coverage (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`75f77c6a0d`](https://github.com/nodejs/node/commit/75f77c6a0d)] - **(SEMVER-MINOR)** **test**: update bench tests to not fail on no-crypto (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`b570e180e2`](https://github.com/nodejs/node/commit/b570e180e2)] - **test**: fix flaky cleanup in http2 test (Tim Perry) [#65701](https://github.com/nodejs/node/pull/65701)
+* \[[`8c90fa8d87`](https://github.com/nodejs/node/commit/8c90fa8d87)] - **test**: set type=none on IBM i for empty source (Abdirahim Musse) [#65545](https://github.com/nodejs/node/pull/65545)
+* \[[`8095849aaf`](https://github.com/nodejs/node/commit/8095849aaf)] - **test**: bump WPT webidl and interfaces (Filip Skokan) [#65679](https://github.com/nodejs/node/pull/65679)
+* \[[`1311e08e02`](https://github.com/nodejs/node/commit/1311e08e02)] - **test**: deflake WASI poll timing checks (Filip Skokan) [#65672](https://github.com/nodejs/node/pull/65672)
+* \[[`1304474083`](https://github.com/nodejs/node/commit/1304474083)] - **test**: skip `fs-watch-recursive-delete-race` on AIX (Antoine du Hamel) [#65698](https://github.com/nodejs/node/pull/65698)
+* \[[`5173d2ecb9`](https://github.com/nodejs/node/commit/5173d2ecb9)] - **test**: update WPT for url to c23755a144 (Node.js GitHub Bot) [#65651](https://github.com/nodejs/node/pull/65651)
+* \[[`b84e0d7ab8`](https://github.com/nodejs/node/commit/b84e0d7ab8)] - **test**: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) [#65584](https://github.com/nodejs/node/pull/65584)
+* \[[`8916332504`](https://github.com/nodejs/node/commit/8916332504)] - **test**: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) [#65623](https://github.com/nodejs/node/pull/65623)
+* \[[`9966aa0722`](https://github.com/nodejs/node/commit/9966aa0722)] - **test**: fix recursive fs.watch error fixture (Filip Skokan) [#65683](https://github.com/nodejs/node/pull/65683)
+* \[[`47dc433038`](https://github.com/nodejs/node/commit/47dc433038)] - **test**: avoid orphaned child on Windows abort test (Kirill Saied) [#65451](https://github.com/nodejs/node/pull/65451)
+* \[[`06ecd220e2`](https://github.com/nodejs/node/commit/06ecd220e2)] - **test**: update streams WPT (Jeong SeokChan) [#65638](https://github.com/nodejs/node/pull/65638)
+* \[[`cadab22284`](https://github.com/nodejs/node/commit/cadab22284)] - **test**: remove `console.log` call in `node_run_list` (Antoine du Hamel) [#65572](https://github.com/nodejs/node/pull/65572)
+* \[[`6438c5b218`](https://github.com/nodejs/node/commit/6438c5b218)] - **test**: expect node:ffi to be enabled by default (Matteo Collina) [#65636](https://github.com/nodejs/node/pull/65636)
+* \[[`96fc61a151`](https://github.com/nodejs/node/commit/96fc61a151)] - **test**: fix link-local dgram scope assertion (Filip Skokan) [#65629](https://github.com/nodejs/node/pull/65629)
+* \[[`fe95256225`](https://github.com/nodejs/node/commit/fe95256225)] - **(SEMVER-MINOR)** **test**: use native builder for legacy SEA tests (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`f01ddafe07`](https://github.com/nodejs/node/commit/f01ddafe07)] - **test**: riscv64: skip node-api sea test (Stewart X Addison) [#65569](https://github.com/nodejs/node/pull/65569)
+* \[[`aa51e43121`](https://github.com/nodejs/node/commit/aa51e43121)] - **test**: mark platform-specific tests as flaky (Filip Skokan) [#65562](https://github.com/nodejs/node/pull/65562)
+* \[[`8507c27bf6`](https://github.com/nodejs/node/commit/8507c27bf6)] - **test**: account for varied OpenSSL CCM final behaviours (Filip Skokan) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`3e908d12d3`](https://github.com/nodejs/node/commit/3e908d12d3)] - **test**: use common spawnSync helpers in more tests (greenhead) [#65552](https://github.com/nodejs/node/pull/65552)
+* \[[`b925c8f694`](https://github.com/nodejs/node/commit/b925c8f694)] - **test**: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) [#65245](https://github.com/nodejs/node/pull/65245)
+* \[[`06ef4e98a7`](https://github.com/nodejs/node/commit/06ef4e98a7)] - **test**: deflake fastutf8stream destroy and reopen tests (Christian Aurich) [#65554](https://github.com/nodejs/node/pull/65554)
+* \[[`566f819f8b`](https://github.com/nodejs/node/commit/566f819f8b)] - **test**: cover Readable.from() sync iterator errors (jakecastelli) [#65515](https://github.com/nodejs/node/pull/65515)
+* \[[`75096a61d9`](https://github.com/nodejs/node/commit/75096a61d9)] - **test**: support inspecting WPTs in child processes (Filip Skokan) [#65510](https://github.com/nodejs/node/pull/65510)
+* \[[`b351c90309`](https://github.com/nodejs/node/commit/b351c90309)] - **test**: document WPT runner workflows (Filip Skokan) [#65510](https://github.com/nodejs/node/pull/65510)
+* \[[`dd8c8c9982`](https://github.com/nodejs/node/commit/dd8c8c9982)] - **test**: simplify test-worker-heap-profile.js (Donghoon Kang) [#65372](https://github.com/nodejs/node/pull/65372)
+* \[[`9dc9ac3c7e`](https://github.com/nodejs/node/commit/9dc9ac3c7e)] - **test**: keep WPT backend checks alive (Filip Skokan) [#65320](https://github.com/nodejs/node/pull/65320)
+* \[[`5e4c04c134`](https://github.com/nodejs/node/commit/5e4c04c134)] - **(SEMVER-MINOR)** **test**: enable multi-global WPTs (Filip Skokan) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`8c924691dd`](https://github.com/nodejs/node/commit/8c924691dd)] - **(SEMVER-MINOR)** **test**: add opt-in process WPT runner (Filip Skokan) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`553d94e21d`](https://github.com/nodejs/node/commit/553d94e21d)] - **(SEMVER-MINOR)** **test**: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`a62dd97b70`](https://github.com/nodejs/node/commit/a62dd97b70)] - **test**: fix lint in dtls tests (Matteo Collina) [#64902](https://github.com/nodejs/node/pull/64902)
+* \[[`714a7875eb`](https://github.com/nodejs/node/commit/714a7875eb)] - **tls**: read the peer certificate chain without consuming it (Tony Gies) [#65602](https://github.com/nodejs/node/pull/65602)
+* \[[`1347b738f6`](https://github.com/nodejs/node/commit/1347b738f6)] - **tls,quic**: commonize TLS cert handling between tls, dtls & quic (Tim Perry) [#64711](https://github.com/nodejs/node/pull/64711)
+* \[[`08a3fc8d40`](https://github.com/nodejs/node/commit/08a3fc8d40)] - **tools**: add GHA workflow to test vendored Perfetto (Antoine du Hamel) [#65614](https://github.com/nodejs/node/pull/65614)
+* \[[`66bf4b200a`](https://github.com/nodejs/node/commit/66bf4b200a)] - **tools**: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot\[bot]) [#65757](https://github.com/nodejs/node/pull/65757)
+* \[[`a3a8229cc9`](https://github.com/nodejs/node/commit/a3a8229cc9)] - **tools**: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot\[bot]) [#65758](https://github.com/nodejs/node/pull/65758)
+* \[[`e70e099a0c`](https://github.com/nodejs/node/commit/e70e099a0c)] - **tools**: do not hardcode `yamllint` path (Antoine du Hamel) [#65747](https://github.com/nodejs/node/pull/65747)
+* \[[`087314e368`](https://github.com/nodejs/node/commit/087314e368)] - **tools**: refine contributor guidance workflow (Filip Skokan) [#65745](https://github.com/nodejs/node/pull/65745)
+* \[[`2485a2509f`](https://github.com/nodejs/node/commit/2485a2509f)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#65716](https://github.com/nodejs/node/pull/65716)
+* \[[`af67dc717d`](https://github.com/nodejs/node/commit/af67dc717d)] - **tools**: do not flag force push as invalid message (Antoine du Hamel) [#65700](https://github.com/nodejs/node/pull/65700)
+* \[[`aa0fc9e0a6`](https://github.com/nodejs/node/commit/aa0fc9e0a6)] - **tools**: do not hardcode path to Ruff (Antoine du Hamel) [#65681](https://github.com/nodejs/node/pull/65681)
+* \[[`3abe134a11`](https://github.com/nodejs/node/commit/3abe134a11)] - **tools**: retry first-time contributor query (Filip Skokan) [#65648](https://github.com/nodejs/node/pull/65648)
+* \[[`033e7272d0`](https://github.com/nodejs/node/commit/033e7272d0)] - **tools**: query first-time contributor status (Filip Skokan) [#65592](https://github.com/nodejs/node/pull/65592)
+* \[[`5814d60e7b`](https://github.com/nodejs/node/commit/5814d60e7b)] - **tools**: offset GitHub crons by 3 minutes (Michaël Zasso) [#65612](https://github.com/nodejs/node/pull/65612)
+* \[[`655a8cd1d9`](https://github.com/nodejs/node/commit/655a8cd1d9)] - **tools**: label PRs lacking second approval (Filip Skokan) [#65538](https://github.com/nodejs/node/pull/65538)
+* \[[`8823a5c27a`](https://github.com/nodejs/node/commit/8823a5c27a)] - **tools**: welcome first-time contributors (Filip Skokan) [#65533](https://github.com/nodejs/node/pull/65533)
+* \[[`36aaae885e`](https://github.com/nodejs/node/commit/36aaae885e)] - **tools**: enable concurrency for eslint (Huáng Jùnliàng) [#62352](https://github.com/nodejs/node/pull/62352)
+* \[[`cd933a0f89`](https://github.com/nodejs/node/commit/cd933a0f89)] - **tools**: fix the list of globals in ESLint config files (Antoine du Hamel) [#65281](https://github.com/nodejs/node/pull/65281)
+* \[[`141b722394`](https://github.com/nodejs/node/commit/141b722394)] - **typings**: fix fs\_event\_wrap start filename type (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`5ba95e5639`](https://github.com/nodejs/node/commit/5ba95e5639)] - **typings**: add fs\_event\_wrap internal binding types (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`becb5e332e`](https://github.com/nodejs/node/commit/becb5e332e)] - **typings**: add stream\_pipe internal binding types (Seongeun Lee) [#65664](https://github.com/nodejs/node/pull/65664)
+* \[[`3a7054aab7`](https://github.com/nodejs/node/commit/3a7054aab7)] - **typings**: add profiler internal binding types (Seongeun Lee) [#65660](https://github.com/nodejs/node/pull/65660)
+* \[[`a694b91262`](https://github.com/nodejs/node/commit/a694b91262)] - **typings**: add ffi internal binding types (Donghoon Kang) [#65734](https://github.com/nodejs/node/pull/65734)
+* \[[`26e7e6fd12`](https://github.com/nodejs/node/commit/26e7e6fd12)] - **typings**: add types for performance binding (Jungwon Sohn) [#65574](https://github.com/nodejs/node/pull/65574)
+* \[[`0aef8ceb6b`](https://github.com/nodejs/node/commit/0aef8ceb6b)] - **typings**: update zlib binding declarations (이혜미) [#65639](https://github.com/nodejs/node/pull/65639)
+* \[[`f4aa1a6b7f`](https://github.com/nodejs/node/commit/f4aa1a6b7f)] - **typings**: add encodeIntoResults to EncodingBinding (greenhead) [#65350](https://github.com/nodejs/node/pull/65350)
+* \[[`8d8dca006a`](https://github.com/nodejs/node/commit/8d8dca006a)] - **typings**: add typing for permission binding (Seungmin Nam) [#65385](https://github.com/nodejs/node/pull/65385)
+* \[[`ed80eef48d`](https://github.com/nodejs/node/commit/ed80eef48d)] - **url**: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) [#65498](https://github.com/nodejs/node/pull/65498)
+* \[[`c3d0976242`](https://github.com/nodejs/node/commit/c3d0976242)] - **util**: canonicalize namespaced tags in inspect() (René) [#63257](https://github.com/nodejs/node/pull/63257)
+* \[[`7254bc1217`](https://github.com/nodejs/node/commit/7254bc1217)] - **v8**: add setHeapProfileNearHeapLimit (Ilyas Shabi) [#64676](https://github.com/nodejs/node/pull/64676)
+* \[[`cc768069d1`](https://github.com/nodejs/node/commit/cc768069d1)] - **vfs**: load native addons from a mounted file system (Philipp Dunkel) [#65680](https://github.com/nodejs/node/pull/65680)
+* \[[`5c869646be`](https://github.com/nodejs/node/commit/5c869646be)] - **vfs**: fix rename over non-empty directory (Christian Aurich) [#65613](https://github.com/nodejs/node/pull/65613)
+* \[[`01f2e2ee3a`](https://github.com/nodejs/node/commit/01f2e2ee3a)] - **vfs**: add ZipProvider (Philipp Dunkel) [#64915](https://github.com/nodejs/node/pull/64915)
+* \[[`e1c807a029`](https://github.com/nodejs/node/commit/e1c807a029)] - **(SEMVER-MINOR)** **vfs**: integrate with CJS and ESM module loaders (Matteo Collina) [#63653](https://github.com/nodejs/node/pull/63653)
+* \[[`141a1548c5`](https://github.com/nodejs/node/commit/141a1548c5)] - **worker**: start worker threads from the built-in snapshot (Shelley Vohr) [#65336](https://github.com/nodejs/node/pull/65336)
+* \[[`2aafc4cb89`](https://github.com/nodejs/node/commit/2aafc4cb89)] - **worker**: add ref/unref to web workers (Aviv Keller) [#65507](https://github.com/nodejs/node/pull/65507)
+* \[[`257c712bb2`](https://github.com/nodejs/node/commit/257c712bb2)] - **(SEMVER-MINOR)** **worker**: add wpt tests for Web Workers (Aviv Keller) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`0efd1f20b5`](https://github.com/nodejs/node/commit/0efd1f20b5)] - **(SEMVER-MINOR)** **worker**: add support for Web Workers (Aviv Keller) [#64894](https://github.com/nodejs/node/pull/64894)
+* \[[`211ec5ac4c`](https://github.com/nodejs/node/commit/211ec5ac4c)] - **zlib**: avoid waiting for paused ZIP iterators (Trivikram Kamat) [#65278](https://github.com/nodejs/node/pull/65278)
+
 <a id="26.8.1"></a>
 
 ## 2026-08-26, Version 26.8.1 (Current), @aduh95
diff --git a/doc/contributing/ai-guidelines.md b/doc/contributing/ai-guidelines.md
index baebe5dc6c80..f83c573d6cd1 100644
--- a/doc/contributing/ai-guidelines.md
+++ b/doc/contributing/ai-guidelines.md
@@ -1,35 +1,30 @@
 # AI use policy and guidelines
 
-* [Core principle](#core-principle)
-* [When AI is used in contributions](#when-ai-is-used-in-contributions)
-* [When AI is used in communications](#when-ai-is-used-in-communications)
+* [Node.js AI use policy](#nodejs-ai-use-policy)
+* [Practical guidelines](#practical-guidelines)
+  * [Naming AI tools in disclosures](#naming-ai-tools-in-disclosures)
+  * [When AI is used in code contributions](#when-ai-is-used-in-code-contributions)
+  * [When AI is used in communications](#when-ai-is-used-in-communications)
 
 This document aligns with the [OpenJS Foundation AI Coding Assistants Policy][].
 
-## Core principle
+## Node.js AI use policy
 
-Tools should never replace human judgment, regardless of whether they are
-powered by AI.
+In the Node.js project, decision making should always be based on human judgement
+instead of machine automation, regardless of whether the automation
+is powered by AI. Contributors must take full responsibility for their actions in
+the Node.js project.
 
-Node.js requires contributors to understand and take full responsibility for
-every change they propose. The answer to "Why is X an improvement?" can
-never be "I'm not sure. The AI did it."
+The Node.js project does not prohibit the use of AI tools in contributions, but
+when the contribution is generated with AI, the contributor should disclose the use
+of such tools, and what the contributor does to personally verify the generated output.
+The changes submitted to the Node.js code base must still satisfy
+the project's [Developer's Certificate of Origin][] and licensing requirements.
 
-If AI tools assisted in generating a contribution, acknowledge that honestly.
-Regardless of how much code is generated by AI, disclosure does not serve
-as a disclaimer of responsibility.
-
-Be aware that the mention of for-profit trademarks or commercial brands in
-commit messages, which are part of the code base, can be abused for
-profit-driven marketing. If the disclosure involves for-profit trademarks or
-commercial brands, it's recommended to either anonymize the branding (e.g. say
-`a frontier reasoning model`, `a closed-source coding agent` instead of
-`<brand>`), or only mention the for-profit brand/trademark in the PR
-description, but not in the commit message, unless the message would not have
-made sense without mentioning the specific brand/trademark. These
-recommendations only apply to for-profit tools/models, not any non-profit ones.
-
-Pull requests that contain AI-generated code the contributor has not
+Contributors who choose to submit changes generated with AI must be able to explain
+the value proposition and the implementation of their contributions during the
+review process. Disclosure about the use of AI does not serve as a disclaimer of this
+responsibility. Pull requests with AI-generated code that the contributor has not
 personally understood, tested, and verified waste collaborator time and
 will be subject to closure without additional review. Contributors who
 repeatedly submit such changes, show no understanding of the project or
@@ -42,53 +37,59 @@ approved in advance by the project. To request approval, either open an issue in
 be done in the form of a GitHub workflow, submit a pull request to add the
 workflow and use the usual pull request review process to seek consensus.
 
-## When AI is used in contributions
-
-Contributors may use AI tools to assist with contributions, but such tools
-never replace human judgment.
-
-When using AI as a coding assistant:
-
-* **Understand the codebase first.** Do not skip familiarizing yourself with
-  the relevant subsystem. Always verify analysis generated by tools against
-  the actual source code with human judgement.
+It's prohibited to use AI to automate fixes to issues marked as "good first issue".
+These issues are meant to help new human contributors, not an AI, learn about the
+code base and the contribution processes.
 
-* **Own every line you submit.** You are responsible for all code in your
-  pull request, regardless of how it was created. The submitted changes
-  must satisfy the project's [Developer's Certificate of Origin][] and licensing
-  requirements. Be prepared to explain any change in detail during review.
+## Practical guidelines
 
-* **Keep the commits logical.** The [commit message guidelines][]
-  and [commit squashing guidelines](./pull-requests.md#commit-squashing)
-  must be followed regardless of what tool is used in the pull request.
+### Naming AI tools in disclosures
 
-* **Test thoroughly.** Existing tests should not be removed or modified
-  without human verification. It is crucial to verify, with human judgement,
-  the correctness of new tests against the intended behavior of the feature
-  being tested, independently of how the implementation happens to behave.
-
-* **Do not disappear.** If you open a PR, follow it through. Respond to
-  feedback and iterate until the work lands or is explicitly closed. If you
-  can no longer pursue it, close the PR. Stalled PRs block progress.
-
-* **Do not use AI to claim "good first issue" tasks.** These issues exist to
-  help new contributors learn the codebase and processes hands-on.
-
-* **Keep the comments useful.** Verify with human judgement that the
-  comments are necessary and accurate. Remove comments that simply
-  restate what the code does. Add comments only where the logic is non-obvious.
-
-## When AI is used in communications
+Be aware that the mention of for-profit trademarks or commercial brands in
+commit messages, which are part of the code base, can be abused for
+profit-driven marketing. If the disclosure involves for-profit trademarks or
+commercial brands, it's recommended to either anonymize the branding (e.g. say
+`a frontier reasoning model`, `a closed-source coding agent` instead of
+`<brand>`), or only mention the for-profit brand/trademark in the PR
+description, but not in the commit message, unless the message would not have
+made sense without mentioning the specific brand/trademark. These
+recommendations only apply to for-profit tools/models, not any non-profit ones.
 
-Node.js values concise, precise communication that respects collaborator and
-contributor time.
+### When AI is used in code contributions
+
+* Contributors should treat the analysis generated by AI tools as a hypothesis
+  instead of a fact, and verify the output against the actual source code before
+  making any decisions.
+* Commits must still follow the [commit message guidelines][] and
+  [commit squashing guidelines](./pull-requests.md#commit-squashing),
+  even if they are organized with the help of AI tools.
+* Existing tests should not be removed or modified without human verification.
+  When new tests are added with the help of AI, contributors should personally
+  verify that the new tests are necessary and test the intended behavior
+  instead of merely reflecting how the implementation happens to behave.
+* If the comments are generated by AI, contributors should personally verify
+  that the comments are accurate. The comments should not restate what the code
+  does but instead should provide additional context that's not obvious from the code
+  itself, such as the history or motivation behind the choices.
+* During the review process, responses to feedback should be made by contributors
+  based on their own judgement and must not be automated by AI tools. Contributors
+  are expected to iterate in this manner until the work lands or is explicitly closed.
+  If they are unable to follow the review process personally, they should close
+  the PR so that someone else can take over the work.
+
+### When AI is used in communications
+
+In the Node.js project, if a contributor chooses to use AI for assistance in communications, they
+should respect the time spent by other contributors reading and responding to their
+communication, and avoid increasing the cognitive load of others with their own use of AI.
 
 * **Do not paste messages generated entirely by AI** in pull requests, issues,
   or the project's communication channels. Such communication may be removed in
-  accordance to [the Node.js moderation policy][].
-* **Verify claims about the code with human judgement before using them in
-  communications**. Results from AI tools should only be treated as hypothesis.
-  Link to actual code, documentation and specifications as source of truth.
+  accordance with [the Node.js moderation policy][].
+* When making a claim based on AI output in discussions, contributors should
+  personally verify the claim. Contributors are expected to provide a link
+  to actual code, documentation or specifications, instead of an AI summary of
+  them, as source of truth during discussions.
 * Grammar and spell-check tools are acceptable when they improve clarity and
   conciseness.
 
diff --git a/doc/contributing/collaborator-guide.md b/doc/contributing/collaborator-guide.md
index b81a86bd86c0..e9dc344dcd38 100644
--- a/doc/contributing/collaborator-guide.md
+++ b/doc/contributing/collaborator-guide.md
@@ -5,8 +5,10 @@
 * [Issues and pull requests](#issues-and-pull-requests)
   * [Welcoming first-time contributors](#welcoming-first-time-contributors)
   * [Closing issues and pull requests](#closing-issues-and-pull-requests)
+  * [Stale issues and pull requests](#stale-issues-and-pull-requests)
   * [Author ready pull requests](#author-ready-pull-requests)
   * [Handling own pull requests](#handling-own-pull-requests)
+  * [Repository triage views](#repository-triage-views)
   * [Security issues](#managing-security-issues)
 * [Accepting modifications](#accepting-modifications)
   * [Code reviews](#code-reviews)
@@ -66,6 +68,18 @@ request open for several days to allow for discussion. Where this does not yield
 evidence that the issue or pull request has relevance, close it. Remember that
 issues and pull requests can always be re-opened if necessary.
 
+### Stale issues and pull requests
+
+The [stale workflow](../../.github/workflows/stale.yml) runs on all open issues
+and pull requests. It adds the `stale` label after 90 days without activity and
+closes the item after another 30 days without activity. New activity removes
+the `stale` label automatically.
+
+The `never-stale` label exempts both issues and pull requests from this
+automation. The `confirmed-bug` label also exempts issues. Reserve
+`never-stale` for items that need a permanent exemption. Otherwise, leave an
+update when an item remains relevant or close it when it does not.
+
 ### Author ready pull requests
 
 A pull request is _author ready_ when:
@@ -77,6 +91,11 @@ A pull request is _author ready_ when:
 Please always add the `author ready` label to the pull request in that case.
 Please always remove it again as soon as the conditions are not met anymore.
 
+When approving a pull request that qualifies, add `author ready` and, if a
+Jenkins CI run is required but has not started, `request-ci`. When the pull
+request author is not a collaborator, it is helpful to follow the CI run through
+completion and add `commit-queue` after the required CI is green.
+
 ### Handling own pull requests
 
 When you open a pull request, [start a CI](#testing-and-ci) right away. Later,
@@ -88,6 +107,28 @@ to land but is [author ready](#author-ready-pull-requests), add the
 `author ready` label. If you wish to land the pull request yourself, use the
 "assign yourself" link to self-assign it.
 
+### Repository triage views
+
+The repository has several pinned
+[triage views](https://github.com/nodejs/node/issues/views) for managing pull
+requests:
+
+* [PR action queue](https://github.com/nodejs/node/issues/views/15196):
+  Non-stale, human-authored pull requests labeled `author ready` or
+  `review wanted` that are not yet in the commit queue.
+* [PR attention queue](https://github.com/nodejs/node/issues/views/15058):
+  Non-stale pull requests awaiting a second approval, requesting fast-track, or
+  addressing flaky tests.
+* [Bot PRs queue](https://github.com/nodejs/node/issues/views/15198): Open,
+  non-stale Node.js GitHub Bot and Dependabot pull requests that are not yet in
+  the commit queue.
+* [My Active PRs](https://github.com/nodejs/node/issues/views/15142): Open pull
+  requests authored by the signed-in viewer that are not yet in the commit
+  queue.
+
+Keep `author ready`, `review wanted`, `commit-queue`, and `stale` accurate so
+these views remain useful.
+
 ### Managing security issues
 
 Use the process outlined in [SECURITY.md][] to report security
@@ -210,15 +251,18 @@ delay. For example:
   * Regressions that break the workflow (red CI or broken compilation).
   * Regressions that happen right before a release, or reported soon after.
 
-To propose fast-tracking a pull request, apply the `fast-track` label. Then a
-GitHub Actions workflow will add a comment that collaborators can upvote.
+To propose fast-tracking a pull request, apply the `fast-track` label. A GitHub
+Actions workflow then adds a comment. Collaborators approve the fast-track
+request by adding a 👍 reaction to that comment. Reactions elsewhere on the pull
+request do not count.
 
 If someone disagrees with the fast-tracking request, remove the label. Do not
 fast-track the pull request in that case.
 
 The pull request can be fast-tracked if two collaborators approve the
-fast-tracking request. To land, the pull request itself still needs two
-collaborator approvals and a passing CI.
+fast-tracking request. Fast-track approval is additional to code-review
+approval, not a replacement for it. To land, the pull request itself still
+needs two collaborator approvals and a passing CI.
 
 Collaborators can request fast-tracking of pull requests they did not author.
 In that case only, the request itself is also one fast-track approval. Upvote
@@ -235,6 +279,13 @@ yellow) [Jenkins CI](https://ci.nodejs.org/) is also required if the pull
 request contains changes that will affect the `node` binary. This is because
 GitHub Actions CI does not cover all the environments supported by Node.js.
 
+The `needs-ci` label identifies pull requests that require a full Jenkins CI
+run. It is a classification, not an indication that CI is still pending. Leave
+it in place after CI completes. Removing it does not waive the underlying CI
+requirement or make a pull request eligible to land without the required
+checks. Removing it also makes it harder for releasers to identify the scope of
+a change when working on a release proposal.
+
 <details>
 <summary>Changes that affect the `node` binary</summary>
 
@@ -940,20 +991,29 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help.
 ### General labels
 
 * `confirmed-bug`: Bugs you have verified
+* `commit-queue`: Pull requests queued for automated landing. See the
+  [commit queue guide][commit-queue.md]
 * `discuss`: Things that need larger discussion
 * `fast-track`: PRs that need to land faster - see
   [Waiting for approvals](#waiting-for-approvals)
 * `feature request`: Any issue that requests a new feature
 * `good first issue`: Issues suitable for newcomers to fix
+* `lacks-second-approval`: An automatically managed label for queued pull
+  requests awaiting another approval or completion of the required wait
 * `meta`: Governance, policies, procedures, etc.
+* `needs-ci`: Pull requests that require a full Jenkins CI run. See
+  [Testing and CI](#testing-and-ci)
+* `never-stale`: Issues and pull requests exempt from automatic stale handling
 * `request-ci`: When this label is added to a PR, CI will be started
   automatically. See [Starting a Jenkins CI job](#starting-a-jenkins-ci-job)
+* `stale`: Issues and pull requests with no activity for 90 days. See
+  [Stale issues and pull requests](#stale-issues-and-pull-requests)
 * `tsc-agenda`: Open issues and pull requests with this label will be added to
   the Technical Steering Committee meeting agenda
 
 ***
 
-* `author-ready` - A pull request is _author ready_ when:
+* `author ready` - A pull request is _author ready_ when:
   * There is a CI run in progress or completed.
   * There is at least one collaborator approval (or two TSC approvals for
     semver-major pull requests).
diff --git a/doc/contributing/commit-queue.md b/doc/contributing/commit-queue.md
index e9669bf33183..43fd52f59709 100644
--- a/doc/contributing/commit-queue.md
+++ b/doc/contributing/commit-queue.md
@@ -3,13 +3,29 @@
 _tl;dr: You can ask the queue to land pull requests by adding the
 `commit-queue` label to them._
 
-Commit Queue is a feature for the project which simplifies the
-landing process by automating it via GitHub Actions. With it, collaborators can
-queue pull requests for landing by adding the `commit-queue` label to a PR. The
-selector checks readiness with `@node-core/utils`. If the pull request is only
-blocked on a deferrable condition, currently wait time, the queue leaves the
-label in place and retries later. Other failures continue to the existing
-landing and failure-reporting path.
+Commit Queue simplifies the landing process by automating it with GitHub
+Actions. Once a pull request is [author ready][] and its current CI has passed, a
+collaborator can queue it for landing by adding the `commit-queue` label. A
+second approval is not required before adding the label.
+
+The queue checks readiness with `@node-core/utils`, including the required wait
+time measured from when the pull request was opened:
+
+* Pull requests with at least two approvals must be open for 48 hours.
+* Pull requests with one approval must be open for seven days.
+* Correctly approved [fast-track pull requests][] have no minimum wait time.
+
+If wait time is the only unmet condition, the queue leaves the `commit-queue`
+label in place and retries later. For queued pull requests that are at least two
+days old and still waiting for a second approval, it also adds the
+`lacks-second-approval` label. Another approval makes the pull request eligible
+for the next queue run, provided that all other requirements remain satisfied.
+The queue removes `lacks-second-approval` automatically when it removes
+`commit-queue`; collaborators do not need to remove it manually.
+
+Hard failures remove `commit-queue`, add `commit-queue-failed`, and post a
+comment with the actionable failure reason and retry instructions. To resolve the
+failure, remove `commit-queue-failed`, and add `commit-queue` to retry.
 
 To make the Commit Queue squash all the commits of a pull request into the
 first one, add the `commit-queue-squash` label.
@@ -32,3 +48,6 @@ These are the currently known limitations of the commit queue:
 4. Only Jenkins CI and GitHub Actions are checked (V8 CI and CITGM are ignored).
 5. The PR must target the `main` branch (PRs opened against other branches, such
    as backport PRs, are ignored).
+
+[author ready]: ./collaborator-guide.md#author-ready-pull-requests
+[fast-track pull requests]: ./collaborator-guide.md#waiting-for-approvals
diff --git a/doc/contributing/first-contributions.md b/doc/contributing/first-contributions.md
index b3c539101073..174fb38d0585 100644
--- a/doc/contributing/first-contributions.md
+++ b/doc/contributing/first-contributions.md
@@ -146,8 +146,10 @@ for the technical how-tos. After a rebase, you will need a new approval from the
 Node.js uses two CI systems: [Jenkins](https://ci.nodejs.org/) and GitHub Actions. Jenkins is the primary
 CI system for testing pull requests, while GitHub Actions is used for quick checks and additional
 verifications. Pull requests that only touch documentation need to pass only the GitHub Actions
-checks. Pull requests that touch more than just documentation will be labeled `needs-ci` and will need
-to run the Jenkins CI before they can be merged.
+checks. Pull requests that affect the `node` binary also need to pass Jenkins CI before they can be
+merged. The automation determines this requirement from the changed files and may add the `needs-ci`
+label. The label describes the kind of CI required; it does not indicate that CI is still pending and
+remains applicable after a successful run. Removing it does not waive the CI requirement.
 
 ### Q: How do I trigger the CI runs?
 
@@ -194,9 +196,12 @@ for more details on how to get started.
 ### Q: My pull request has enough approvals and passed CI, but it still hasn't been merged. What should I do?
 
 Pull requests need to be merged by collaborators or triagers (normally by applying the `commit-queue`
-label). The [commit queue automation](../../.github/workflows/commit-queue.yml)
-will verify that the pull request meets all the requirements before merging it, but the
-triggering of the commit queue still requires human judgement and depends on volunteers.
+label). Once a pull request is author ready and its current CI has passed, a collaborator can add it
+to the queue without waiting for a second approval. The
+[commit queue automation](../../.github/workflows/commit-queue.yml) verifies the requirements and
+waits until the pull request has either two approvals and has been open for 48 hours, or one approval
+and has been open for seven days. Triggering the commit queue still requires human judgement and
+depends on volunteers.
 You can ask for help either in the pull request or in the Slack channel similar
 to how you ask for help to get reviews and trigger CI runs.
 
diff --git a/doc/contributing/maintaining/maintaining-dependencies.md b/doc/contributing/maintaining/maintaining-dependencies.md
index 3b85745e6a5d..0d19ac67eace 100644
--- a/doc/contributing/maintaining/maintaining-dependencies.md
+++ b/doc/contributing/maintaining/maintaining-dependencies.md
@@ -11,7 +11,6 @@ This a list of all the dependencies:
 * [acorn][]
 * [ada][]
 * [amaro][]
-* [base64][]
 * [brotli][]
 * [c-ares][]
 * [merve][]
@@ -267,7 +266,7 @@ C++ testing and mocking framework.
 The [histogram](https://github.com/HdrHistogram/HdrHistogram_c) dependency is
 a C port of High Dynamic Range (HDR) Histogram.
 
-### ic
+### icu-small
 
 The [icu](http://site.icu-project.org) is widely used set of C/C++
 and Java libraries providing Unicode and Globalization
@@ -415,7 +414,6 @@ according to [RFC 8878](https://datatracker.ietf.org/doc/html/rfc8878).
 [acorn]: #acorn
 [ada]: #ada
 [amaro]: #amaro
-[base64]: #base64
 [brotli]: #brotli
 [c-ares]: #c-ares
 [corepack]: #corepack
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index c214f8c97cc5..57bf2dc31bf8 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -460,7 +460,7 @@ Collect a formatted list of commits since the last release. Use
 [`changelog-maker`](https://github.com/nodejs/changelog-maker) to do this:
 
 ```bash
-changelog-maker --group --markdown
+changelog-maker --group --format=markdown
 ```
 
 `changelog-maker` counts commits since the last tag and if the last tag
@@ -468,7 +468,7 @@ in the repository was not on the current branch you may have to supply a
 `--start-ref` argument:
 
 ```bash
-changelog-maker --group --markdown --filter-release --start-ref v1.2.2
+changelog-maker --group --format=markdown --filter-release --start-ref v1.2.2
 ```
 
 `--filter-release` will remove the release commit from the previous release.
diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index a7ee78f42aae..1b275178f9ee 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -11,6 +11,7 @@ agenda to ensure they are active and have the support they need.
 | QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Unified HTTP API       | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Shadow Realm           | [Chengzhong Wu][legendecas]      | <https://github.com/nodejs/node/issues/42528> |
+| V8 Currency            |                                  |                                               |
 | Next-10                | [Jacob Smith][JakobJingleheimer] | <https://github.com/nodejs/next-10>           |
 | Single executable apps | [Darshan Sen][RaisinTen]         | <https://github.com/nodejs/single-executable> |
 | Performance            | [Rafael Gonzaga][RafaelGSS]      | <https://github.com/nodejs/performance>       |
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index a31e0e82aabc..a4c8e20244cd 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -17,6 +17,7 @@
     * [Using `--analyze` (no external tools needed)](#using---analyze-no-external-tools-needed)
     * [Using R scripts or node-benchmark-compare](#using-r-scripts-or-node-benchmark-compare)
   * [Comparing parameters](#comparing-parameters)
+  * [Evaluating `node:bench` ports](#evaluating-nodebench-ports)
   * [Running benchmarks on the CI](#running-benchmarks-on-the-ci)
 * [Creating a benchmark](#creating-a-benchmark)
   * [Basics of a benchmark](#basics-of-a-benchmark)
@@ -521,6 +522,124 @@ run `node benchmark/scatter.js`.
 node benchmark/scatter.js benchmark/string_decoder/string-decoder.js > scatter.csv
 ```
 
+#### Analyzing the results without R
+
+Pass `--analyze` to summarize the results directly, without generating a csv
+or installing R. It needs `--xaxis` to know which benchmark variable to
+summarize against, and takes an optional `--category` to break each point
+down by a second variable. Any remaining variable that is not constant is
+averaged over, and reported as an aggregated variable.
+
+```bash
+node benchmark/scatter.js --analyze --xaxis chunkLen --category encoding \
+    benchmark/string_decoder/string-decoder.js
+```
+
+```console
+chunkLen  encoding   samples          rate  confidence.interval        median    median.interval
+      16  'ascii'          6   2,248,111.0    61,570.3 (±2.74%)   2,241,996.7   [-3.75%, +4.47%]
+      16  'utf16le'        6   2,004,145.9    33,363.7 (±1.66%)   1,990,015.9   [-1.03%, +3.44%]
+      16  'utf8'           6   1,156,990.9    84,288.2 (±7.29%)   1,186,284.7  [-16.23%, +1.15%]  (!)
+     256  'ascii'          6  11,271,912.4   398,786.9 (±3.54%)  10,991,001.5   [-0.47%, +7.61%]
+     256  'utf16le'        6  10,243,336.8   792,495.2 (±7.74%)   9,908,838.3  [-4.73%, +17.25%]  (!)
+     256  'utf8'           6   8,247,482.7   316,510.5 (±3.84%)   8,282,009.5   [-5.80%, +3.19%]
+    1024  'ascii'          6  11,130,650.9   438,019.6 (±3.94%)  10,838,937.5   [-1.34%, +7.10%]
+    1024  'utf16le'        6   9,786,274.4   186,207.1 (±1.90%)   9,690,675.1   [-0.77%, +4.20%]
+    1024  'utf8'           6   8,479,690.1   405,762.8 (±4.79%)   8,525,516.7   [-9.01%, +4.06%]  (!)
+
+Rate in operations/second; longer is faster. │ marks the mean and the
+shaded band (░) is its 95% confidence interval, so bars whose bands
+overlap are not clearly different.
+
+                                  0                           11,670,699.3
+                                  +--------------------------------------+
+chunkLen=16 encoding='ascii'      ███████│                                   2,248,111.0
+chunkLen=16 encoding='utf16le'    ██████│                                    2,004,145.9
+chunkLen=16 encoding='utf8'       ███│                                       1,156,990.9
+
+chunkLen=256 encoding='ascii'     █████████████████████████████████████░│░  11,271,912.4
+chunkLen=256 encoding='utf16le'   ████████████████████████████████░░░│░░    10,243,336.8
+chunkLen=256 encoding='utf8'      ███████████████████████████░│              8,247,482.7
+
+chunkLen=1024 encoding='ascii'    █████████████████████████████████████░│░  11,130,650.9
+chunkLen=1024 encoding='utf16le'  █████████████████████████████████│         9,786,274.4
+chunkLen=1024 encoding='utf8'     ████████████████████████████░│             8,479,690.1
+
+Change between consecutive chunkLen values (Mann-Whitney U, Cliff's delta):
+
+  encoding='ascii'
+    16 -> 256    +401.39%  16.0x  exponent=+0.58  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    -1.25%   4.0x  exponent=-0.01  p=0.3367  delta=-0.333 (medium)
+
+  encoding='utf16le'
+    16 -> 256    +411.11%  16.0x  exponent=+0.59  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    -4.46%   4.0x  exponent=-0.03  p=0.1495  delta=-0.500 (large)
+
+  encoding='utf8'
+    16 -> 256    +612.84%  16.0x  exponent=+0.71  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    +2.82%   4.0x  exponent=+0.02  p=0.2002  delta=+0.444 (medium)
+```
+
+The table gives, for each group, the mean rate with the 95% confidence
+interval of the mean, and the median with the 95% confidence interval of the
+median. The median interval is computed with the exact binomial method, which
+assumes nothing about the shape of the distribution, so it is the more
+trustworthy of the two when a benchmark is noisy.
+
+Rows marked `(!)` are exactly those cases: the median falls outside the mean's
+confidence interval, or the sample is strongly skewed. The mean is then being
+pulled by a few unusually slow or fast runs — commonly GC or JIT tiering — and
+more `--runs` will not necessarily fix it.
+
+The final section answers the question the sweep is usually asked to settle:
+whether the parameter changes the rate at all. It compares each x-axis value
+with the previous one using a [Mann-Whitney U test][] and [Cliff's delta][],
+holding the category fixed. Both are non-parametric, because a parameter sweep
+routinely changes the shape and spread of the distribution and not just its
+centre. Above, going from `chunkLen=16` to `256` is a large, unambiguous win
+for every encoding, while `256` to `1024` is negligible — the benchmark has
+already plateaued.
+
+When the x-axis is numeric, each comparison also reports how far the parameter
+moved and the resulting scaling exponent, which is the complexity question
+these sweeps are usually run to answer. Above, a 16× larger chunk yields an
+exponent near `+0.6` (strongly sublinear), and the next 4× yields `-0.01`
+(saturated). The exponent is reported per step rather than as a single fit
+across the whole sweep, because one exponent spanning a curve that changes
+regime describes neither part of it.
+
+A p-value has to be read against what the test was capable of producing. Below
+roughly six runs per group, the smallest p-value the Mann-Whitney test can
+return rises above the usual thresholds — at `--runs 2` the floor is `0.1213`,
+so no comparison can reach significance no matter how large the real effect
+is. `scatter.js` computes that floor and warns when a non-significant result
+therefore carries no information.
+
+Aggregated variables are reported with the share of within-group variance they
+account for. This matters more than it sounds: running the example above
+without `--set inLen=128` reports
+
+```console
+aggregating variable: inLen (explains >99% of within-group variance)
+
+Note: inLen explains most of the spread within each group, so the intervals
+below describe that variable rather than the benchmark's own noise, and more
+--runs will not narrow them. Pin it with --set inLen=<value>, or pass as
+--category, for intervals that can be acted on.
+```
+
+and the confidence intervals widen from around ±3% to over ±50%. That spread
+is a genuine effect of the averaged-over variable, not sampling noise, so
+increasing `--runs` cannot reduce it.
+
+Long or non-printable variable values are abbreviated in the output and listed
+in full under `Abbreviated values:` at the end.
+
+Pass `--no-chart` to omit the bar chart, and `--no-progress` to suppress the
+progress indicator.
+
+#### Analyzing the results with R
+
 After generating the csv, a comparison table can be created using the
 `scatter.R` tool. Even more useful it creates an actual scatter plot when using
 the `--plot filename` option.
@@ -561,7 +680,7 @@ afterwards using tools such as `sed` or `grep`. In the `sed` case be
 sure to keep the first line since that contains the header information.
 
 ```console
-$ cat scatter.csv | sed -E '1p;/([^,]+, ){3}128,/!d' | Rscript benchmark/scatter.R --xaxis chunkLen --category encoding --plot scatter-plot.png --log
+$ cat scatter.csv | sed -E '1p;/([^,]+,){3}128,/!d' | Rscript benchmark/scatter.R --xaxis chunkLen --category encoding --plot scatter-plot.png --log
 
 chunkLen     encoding      rate confidence.interval
       16        ascii 1302078.5            71692.27
@@ -588,6 +707,42 @@ chunkLen     encoding      rate confidence.interval
 
 ![compare tool boxplot](doc_img/scatter-plot.png)
 
+### Evaluating `node:bench` ports
+
+The experimental `compare-node-bench.js` and `scatter-node-bench.js` tools are
+parallel versions of the existing tools for explicit `node:bench` files. They
+do not modify or replace the legacy benchmark framework. Each repeated
+observation for a benchmark identity uses one measured sample from a separate
+process invocation. Configurations declared in the same file still execute
+serially in that process, unlike the legacy framework's configuration-level
+process isolation, and can share runtime state.
+
+Both parallel tools support inline analysis. `scatter-node-bench.js --analyze`
+uses the same `--xaxis`, `--category`, and `--no-chart` interface described for
+`scatter.js`. `compare-node-bench.js --analyze` performs Welch's t-test, while
+`--max-regression N` adds a corrected regression gate. The gate requires both a
+Holm-Bonferroni-adjusted one-sided p-value against the `N%` threshold below 0.05
+and a 95% confidence interval lying entirely beyond `-N%`; the point estimate
+alone cannot fail the command.
+Scatter analysis reduces aggregated configurations to one value per outer
+process and uses disjoint process sets for consecutive Mann-Whitney comparisons
+so configurations sharing a process are not treated as independent samples.
+
+Underscore-prefixed ports are kept beside selected legacy benchmarks and are
+excluded from legacy discovery. For example:
+
+```console
+./node benchmark/scatter.js --runs 30 \
+  benchmark/crypto/create-hash.js > legacy.csv
+./node benchmark/scatter-node-bench.js --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > node-bench.csv
+```
+
+The port uses the legacy relative filename as its benchmark name and preserves
+the same parameter names. The two CSV files can therefore be analyzed with the
+same scripts to check whether their rate distributions and measurement units
+agree. See [`benchmark/README.md`][] for compare and scatter examples.
+
 ### Running benchmarks on the CI
 
 To see the performance impact of a pull request by running benchmarks on
@@ -769,6 +924,9 @@ Supported options keys are:
 * `benchmarker` - benchmarker to use, defaults to the first available http
   benchmarker
 
+[Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Effect_size_for_ordinal_data
+[Mann-Whitney U test]: https://en.wikipedia.org/wiki/Mann%E2%80%93Whitney_U_test
+[`benchmark/README.md`]: ../../benchmark/README.md#nodebench-evaluation-tools
 [autocannon]: https://github.com/mcollina/autocannon
 [benchmark-ci]: https://github.com/nodejs/benchmarking/blob/HEAD/docs/core_benchmarks.md
 [git-for-windows]: https://git-scm.com/download/win
diff --git a/doc/node-config-schema.json b/doc/node-config-schema.json
index bacf0fba64ad..0942f591789b 100644
--- a/doc/node-config-schema.json
+++ b/doc/node-config-schema.json
@@ -758,7 +758,7 @@
             },
             "use-largepages": {
               "type": "string",
-              "description": "Map the Node.js static code to large pages. Options are 'off' (the default value, meaning do not map), 'on' (map and ignore failure, reporting it to stderr), or 'silent' (map and silently ignore failure)"
+              "description": "This option is no longer supported and a no-op. Options are 'off' (default), 'on' (report a warning to stderr), or 'silent' (same as 'off')."
             },
             "use-openssl-ca": {
               "type": "boolean",
diff --git a/doc/node.1 b/doc/node.1
index 96532ee48376..9e650695a41b 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -122,15 +122,15 @@ directly through the process arguments.
 When using the Permission Model, the process will not be able to use FFI
 APIs by default. Attempts to use FFI APIs will throw an \fBERR_ACCESS_DENIED\fR
 exception unless the user explicitly passes the \fB--allow-ffi\fR flag when
-starting Node.js. The \fBnode:ffi\fR module also requires the
-\fB--experimental-ffi\fR flag and is only available in builds with FFI support.
+starting Node.js. The \fBnode:ffi\fR module is only available in builds with
+FFI support.
 Example:
 .Bd -literal
 const { DynamicLibrary, suffix } = require('node:ffi');
 const lib = new DynamicLibrary(`./mylib.${suffix}`);
 .Ed
 .Bd -literal
-$ node --permission --experimental-ffi index.js
+$ node --permission index.js
 Error: Access to this API has been restricted. Use --allow-ffi to manage permissions.
     at node:internal/main/run_main_module:17:47 {
   code: 'ERR_ACCESS_DENIED',
@@ -166,6 +166,17 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 .Ed
 .
+.It Fl -allow-fs-vfs
+When using the Permission Model, a virtual file system cannot be
+mounted by default: \fBvfs.mount()\fR throws \fBERR_INVALID_STATE\fR unless the
+user explicitly passes the \fB--allow-fs-vfs\fR flag when starting Node.js.
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on \fB--allow-fs-read\fR or
+\fB--allow-fs-write\fR.
+.Bd -literal
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+.Ed
+.
 .It Fl -allow-fs-write
 This flag configures file system write permissions using
 the Permission Model.
@@ -281,6 +292,57 @@ Error: Access to this API has been restricted
 }
 .Ed
 .
+.It Fl -bench
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+.Bd -literal
+node --bench benchmark.mjs
+node --bench 'benchmarks/**/*.js'
+.Ed
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using \fBnode:bench\fR; they must not
+call \fBrun()\fR themselves. See the benchmark runner documentation for more
+details.
+This flag cannot be combined with \fB--test\fR, \fB--watch\fR, \fB--watch-path\fR,
+\fB--check\fR, \fB--eval\fR, or \fB--interactive\fR.
+.
+.It Fl -bench-isolation Ns = Ns Ar mode
+Configures benchmark file isolation. When \fBmode\fR is \fB'process'\fR, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+When \fBmode\fR is \fB'none'\fR, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+The supported modes are \fB'process'\fR and \fB'none'\fR.
+.
+.It Fl -bench-name-pattern Ns = Ns Ar pattern
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression \fBpattern\fR. Non-matching benchmarks are reported as skipped.
+.
+.It Fl -bench-reporter-destination Ns = Ns Ar destination
+Specifies the destination for the corresponding benchmark reporter. The value
+can be \fBstdout\fR, \fBstderr\fR, or a file path. A single reporter defaults to
+\fBstdout\fR when no destination is specified.
+.
+.It Fl -bench-reporter Ns = Ns Ar reporter
+Specifies a benchmark reporter. The built-in reporters are \fBspec\fR and \fBjson\fR.
+The \fBjson\fR reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding \fB--bench-reporter-destination\fR. The default reporter is
+\fBspec\fR.
+.
+.It Fl -bench-samples Ns = Ns Ar count
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+\fBcontext.done()\fR. \fBcount\fR must be an integer between \fB1\fR and \fB4294967295\fR.
+.
+.It Fl -bench-warmup Ns = Ns Ar count
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. \fBcount\fR must be an integer between \fB0\fR and \fB4294967295\fR.
+.
 .It Fl -build-sea Ns = Ns Ar config
 Generates a single executable application from a JSON
 configuration file. The argument must be a path to the configuration file. If
@@ -517,6 +579,12 @@ Enable FIPS mode at startup. With OpenSSL 3, a configured provider named
 \fBfips\fR must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 .
+.It Fl -enable-fips-indicator-events
+Publish OpenSSL FIPS indicator results to the
+\fB'crypto.fips.indicator'\fR diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable FIPS mode or change whether an operation
+is permitted.
+.
 .It Fl -enable-source-maps
 Enable Source Map support for stack traces.
 When using a transpiler, such as TypeScript, stack traces thrown by an
@@ -741,13 +809,13 @@ If present, Node.js will look for a
 \fBnode.config.json\fR file in the current working directory and load it as a
 configuration file.
 .
+.It Fl -experimental-dtls
+Enable experimental support for the DTLS protocol. See the
+dtls documentation for details.
+.
 .It Fl -experimental-eventsource
 Enable exposition of EventSource Web API on the global scope.
 .
-.It Fl -experimental-ffi
-Enable the experimental \fBnode:ffi\fR module.
-This flag is only available in builds with FFI support.
-.
 .It Fl -experimental-import-meta-resolve
 Enable experimental \fBimport.meta.resolve()\fR parent URL support, which allows
 passing a second \fBparentURL\fR argument for contextual resolution.
@@ -832,15 +900,32 @@ Enable experimental ES Module support in the \fBnode:vm\fR module.
 .It Fl -experimental-wasi-unstable-preview1
 Enable experimental WebAssembly System Interface (WASI) support.
 .
+.It Fl -experimental-web-worker
+Enable experimental support for the Web Worker API.
+.
 .It Fl -experimental-worker-inspection
 Enable experimental support for the worker inspection with Chrome DevTools.
 .
 .It Fl -force-context-aware
 Disable loading native addons that are not context-aware.
 .
-.It Fl -force-fips
+.It Fl -force-fips Ns = Ns Ar [mode]
 Enable FIPS mode at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as \fB--enable-fips\fR apply.
+An optional mode can be specified using \fB--force-fips=mode\fR:
+.Bl -bullet
+.It
+\fBprovider\fR: Preserve the OpenSSL FIPS provider's configured handling of
+non-approved operations. This is the current default when the mode is
+omitted.
+.It
+\fBstrict\fR: Reject non-approved operations reported through the OpenSSL FIPS
+indicator callback. This mode requires OpenSSL 3.4 or later.
+.El
+The \fBstrict\fR mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another \fBOSSL_LIB_CTX\fR or another copy of \fBlibcrypto\fR, nor operation-specific
+indicators that do not invoke the callback.
 .
 .It Fl -force-node-api-uncaught-exceptions-policy
 Enforces \fBuncaughtException\fR event on Node-API asynchronous callbacks.
@@ -1094,6 +1179,10 @@ Silence deprecation warnings.
 .It Fl -no-experimental-detect-module
 Disable using syntax detection to determine module type.
 .
+.It Fl -no-experimental-ffi
+Disable the experimental \fBnode:ffi\fR module.
+This flag is only available in builds with FFI support.
+.
 .It Fl -no-experimental-global-navigator
 Disable exposition of Navigator API on the global scope.
 .
@@ -1138,6 +1227,10 @@ For more information, see the TypeScript type-stripping documentation.
 .It Fl -no-warnings
 Silence all process warnings (including deprecations).
 .
+.It Fl -no-worker-snapshot
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+.
 .It Fl -node-memory-debug
 Enable extra debug checks for memory leaks in Node.js internals. This is
 usually only useful for developers debugging Node.js itself.
@@ -1328,6 +1421,13 @@ forked processes, or clustered processes.
 .It Fl -run
 This runs a specified command from a package.json's \fB"scripts"\fR object.
 If a missing \fB"command"\fR is provided, it will list the available scripts.
+Passing \fB--run\fR without a command lists the available scripts and exits
+with a non-zero exit code:
+.Bd -literal
+$ node --run
+Available scripts are:
+  test: node --test
+.Ed
 \fB--run\fR will traverse up to the root directory and finds a \fBpackage.json\fR
 file to run the command from.
 \fB--run\fR prepends \fB./node_modules/.bin\fR for each ancestor of
@@ -1687,19 +1787,17 @@ This is equivalent to setting the \fBNODE_USE_ENV_PROXY=1\fR environment variabl
 When both are set, \fB--use-env-proxy\fR takes precedence.
 .
 .It Fl -use-largepages Ns = Ns Ar mode
-Re-map the Node.js static code to large memory pages at startup. If supported on
-the target system, this will cause the Node.js static code to be moved onto 2
-MiB pages instead of 4 KiB pages.
-The following values are valid for \fBmode\fR:
+This option is no longer supported and a no-op. It used to re-map the Node.js
+static code to large memory pages at startup.
+It still accepts the following values for compatibility:
 .Bl -bullet
 .It
 \fBoff\fR: No mapping will be attempted. This is the default.
 .It
-\fBon\fR: If supported by the OS, mapping will be attempted. Failure to map will
-be ignored and a message will be printed to standard error.
+\fBon\fR: No mapping will be attempted and a message will be printed to
+standard error stating it's no longer supported.
 .It
-\fBsilent\fR: If supported by the OS, mapping will be attempted. Failure to map
-will be ignored and will not be reported.
+\fBsilent\fR: Same as \fBoff\fR.
 .El
 .
 .It Fl -use-system-ca
@@ -1938,6 +2036,8 @@ one is included in the list below.
 .It
 \fB--allow-fs-read\fR
 .It
+\fB--allow-fs-vfs\fR
+.It
 \fB--allow-fs-write\fR
 .It
 \fB--allow-inspector\fR
@@ -1950,6 +2050,18 @@ one is included in the list below.
 .It
 \fB--allow-worker\fR
 .It
+\fB--bench-isolation\fR
+.It
+\fB--bench-name-pattern\fR
+.It
+\fB--bench-reporter-destination\fR
+.It
+\fB--bench-reporter\fR
+.It
+\fB--bench-samples\fR
+.It
+\fB--bench-warmup\fR
+.It
 \fB--conditions\fR, \fB-C\fR
 .It
 \fB--cpu-prof-dir\fR
@@ -1972,6 +2084,8 @@ one is included in the list below.
 .It
 \fB--dns-result-order\fR
 .It
+\fB--enable-fips-indicator-events\fR
+.It
 \fB--enable-fips\fR
 .It
 \fB--enable-network-family-autoselection\fR
@@ -1986,9 +2100,9 @@ one is included in the list below.
 .It
 \fB--experimental-detect-module\fR
 .It
-\fB--experimental-eventsource\fR
+\fB--experimental-dtls\fR
 .It
-\fB--experimental-ffi\fR
+\fB--experimental-eventsource\fR
 .It
 \fB--experimental-import-meta-resolve\fR
 .It
@@ -2024,6 +2138,8 @@ one is included in the list below.
 .It
 \fB--experimental-wasi-unstable-preview1\fR
 .It
+\fB--experimental-web-worker\fR
+.It
 \fB--force-context-aware\fR
 .It
 \fB--force-fips\fR
@@ -2078,6 +2194,8 @@ one is included in the list below.
 .It
 \fB--no-deprecation\fR
 .It
+\fB--no-experimental-ffi\fR
+.It
 \fB--no-experimental-global-navigator\fR
 .It
 \fB--no-experimental-repl-await\fR
@@ -2104,6 +2222,8 @@ one is included in the list below.
 .It
 \fB--no-webstorage\fR
 .It
+\fB--no-worker-snapshot\fR
+.It
 \fB--node-memory-debug\fR
 .It
 \fB--openssl-config\fR
diff --git a/doc/type-map.json b/doc/type-map.json
index 0483bd15f5e5..9e24eaca3e50 100644
--- a/doc/type-map.json
+++ b/doc/type-map.json
@@ -88,6 +88,7 @@
   "LockManager": "worker_threads.html#class-lockmanager",
   "MessagePort": "worker_threads.html#class-messageport",
   "MIMEParams": "util.html#class-utilmimeparams",
+  "MIMEType": "util.html#class-utilmimetype",
   "MockModuleContext": "test.html#class-mockmodulecontext",
   "module": "modules.html#the-module-object",
   "ModuleRequest": "vm.html#type-modulerequest",
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 5248a5fbb616..c19e8f3cf46e 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -122,35 +122,39 @@ export default [
         ByteLengthQueuingStrategy: 'readonly',
         CompressionStream: 'readonly',
         CountQueuingStrategy: 'readonly',
-        CustomEvent: 'readonly',
         crypto: 'readonly',
         Crypto: 'readonly',
         CryptoKey: 'readonly',
+        CustomEvent: 'readonly',
         DecompressionStream: 'readonly',
         DisposableStack: 'readonly',
         EventSource: 'readonly',
         fetch: 'readonly',
         Float16Array: 'readonly',
         FormData: 'readonly',
+        localStorage: 'readonly',
         navigator: 'readonly',
         QuotaExceededError: 'readonly',
+        ReadableByteStreamController: 'readonly',
         ReadableStream: 'readonly',
-        ReadableStreamDefaultReader: 'readonly',
         ReadableStreamBYOBReader: 'readonly',
         ReadableStreamBYOBRequest: 'readonly',
-        ReadableByteStreamController: 'readonly',
         ReadableStreamDefaultController: 'readonly',
+        ReadableStreamDefaultReader: 'readonly',
         Response: 'readonly',
+        sessionStorage: 'readonly',
+        ShadowRealm: 'readonly',
+        Storage: 'readonly',
+        SubtleCrypto: 'readonly',
         TextDecoderStream: 'readonly',
         TextEncoderStream: 'readonly',
         TransformStream: 'readonly',
         TransformStreamDefaultController: 'readonly',
-        ShadowRealm: 'readonly',
-        SubtleCrypto: 'readonly',
+        WebSocket: 'readonly',
+        Worker: 'readonly',
         WritableStream: 'readonly',
-        WritableStreamDefaultWriter: 'readonly',
         WritableStreamDefaultController: 'readonly',
-        WebSocket: 'readonly',
+        WritableStreamDefaultWriter: 'readonly',
       },
     },
   },
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index ef149e3d4a61..13ff5b6b30fc 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -292,6 +292,13 @@ IncomingMessage.prototype._destroy = function _destroy(err, cb) {
       cleanup();
       process.nextTick(onError, this, e || err, cb);
     });
+  } else if (err == null && !this.aborted) {
+    // The message was received completely and is being destroyed cleanly:
+    // complete the destroy synchronously. 'close' is still emitted on a
+    // later tick by the stream machinery. The deferral below only exists
+    // so that 'error' listeners attached right after destroy(err) still
+    // receive the error, which cannot matter when there is no error.
+    cb();
   } else {
     process.nextTick(onError, this, err, cb);
   }
@@ -505,7 +512,14 @@ IncomingMessage.prototype._dump = function _dump() {
     // If there is buffered data, it may trigger 'data' events.
     // Remove 'data' event listeners explicitly.
     this.removeAllListeners('data');
-    this.resume();
+    if (this.complete && !this.destroyed && this.readableLength === 0) {
+      // The message was fully received and never read: there is nothing to
+      // pull off the wire. Go straight to the 'end' emission instead of
+      // paying for the resume() and flow() scheduling machinery.
+      this.read(0);
+    } else {
+      this.resume();
+    }
   }
 };
 
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index 23e2856e0b99..4edfc8d7af3d 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -67,6 +67,7 @@ const {
     ERR_STREAM_DESTROYED,
     ERR_STREAM_NULL_VALUES,
     ERR_STREAM_WRITE_AFTER_END,
+    ERR_UNKNOWN_ENCODING,
   },
   hideStackFrames,
 } = require('internal/errors');
@@ -223,7 +224,12 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'writableObjectMode', {
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableLength', {
   __proto__: null,
   get() {
-    return this.outputSize + this[kChunkedLength] + (this[kSocket] ? this[kSocket].writableLength : 0);
+    let bufferedLength = this[kChunkedLength];
+    if (bufferedLength !== 0) {
+      bufferedLength += bufferedLength.toString(16).length + 4 +
+        (!this._headerSent && this._header !== null ? this._header.length : 0);
+    }
+    return this.outputSize + bufferedLength + (this[kSocket] ? this[kSocket].writableLength : 0);
   },
 });
 
@@ -294,37 +300,45 @@ OutgoingMessage.prototype.cork = function cork() {
 
 OutgoingMessage.prototype.uncork = function uncork() {
   this[kCorked]--;
-  if (this[kSocket]) {
-    this[kSocket].uncork();
-  }
-
-  if (this[kCorked] || this[kChunkedBuffer].length === 0) {
-    return;
-  }
-
-  const len = this[kChunkedLength];
-  const buf = this[kChunkedBuffer];
+  const socket = this[kSocket];
+  try {
+    if (this[kCorked] || this[kChunkedBuffer].length === 0) {
+      return;
+    }
 
-  assert(this.chunkedEncoding);
+    const len = this[kChunkedLength];
+    const buf = this[kChunkedBuffer];
+    if (this.destroyed || socket?.destroyed) {
+      const error = this[kErrored] || socket?._writableState?.errored || new ERR_STREAM_DESTROYED('write');
+      for (let n = 2; n < buf.length; n += 3) {
+        if (buf[n] !== nop) {
+          process.nextTick(buf[n], error);
+        }
+      }
+      buf.length = 0;
+      this[kChunkedLength] = 0;
+      return;
+    }
+    assert(this.chunkedEncoding);
 
-  let callbacks;
-  this._send(len.toString(16), 'latin1', null);
-  this._send(crlf_buf, null, null);
-  for (let n = 0; n < buf.length; n += 3) {
-    this._send(buf[n + 0], buf[n + 1], null);
-    if (buf[n + 2]) {
-      callbacks ??= [];
+    const callbacks = [];
+    this._send(len.toString(16), 'latin1', null);
+    this._send(crlf_buf, null, null);
+    for (let n = 0; n < buf.length; n += 3) {
+      this._send(buf[n + 0], buf[n + 1], null);
       callbacks.push(buf[n + 2]);
     }
-  }
-  this._send(crlf_buf, null, callbacks.length ? (err) => {
-    for (const callback of callbacks) {
-      callback(err);
-    }
-  } : null);
+    this._send(crlf_buf, null, (err) => {
+      for (const callback of callbacks) {
+        callback(err);
+      }
+    });
 
-  this[kChunkedBuffer].length = 0;
-  this[kChunkedLength] = 0;
+    this[kChunkedBuffer].length = 0;
+    this[kChunkedLength] = 0;
+  } finally {
+    socket?.uncork();
+  }
 
   // If we had a pending drain and flushed all data, emit the drain event.
   if (this[kNeedDrain] && this.writableLength === 0) {
@@ -360,6 +374,10 @@ OutgoingMessage.prototype.destroy = function destroy(error) {
   this.destroyed = true;
 
   this[kErrored] = error;
+  if (this[kChunkedBuffer].length !== 0) {
+    this[kCorked] = 1;
+    this.uncork();
+  }
 
   if (this[kSocket]) {
     this[kSocket].destroy(error);
@@ -999,24 +1017,34 @@ function write_(msg, chunk, encoding, callback, fromEnd) {
     }
   }
 
+  if (msg.chunkedEncoding && typeof chunk === 'string' && encoding && !Buffer.isEncoding(encoding)) {
+    throw new ERR_UNKNOWN_ENCODING(encoding);
+  }
+
   if (!fromEnd && msg.socket && !msg.socket.writableCorked) {
-    msg.socket.cork();
-    process.nextTick(connectionCorkNT, msg.socket);
+    msg.cork();
+    process.nextTick(connectionCorkNT, msg);
   }
 
   let ret;
   if (msg.chunkedEncoding && chunk.length !== 0) {
     len ??= typeof chunk === 'string' ? Buffer.byteLength(chunk, encoding) : chunk.byteLength;
-    if (msg[kCorked] && msg._headerSent) {
+    if (msg[kCorked]) {
+      if (typeof chunk !== 'string' && !(chunk instanceof Buffer)) {
+        chunk = Stream._uint8ArrayToBuffer(chunk);
+      }
       msg[kChunkedBuffer].push(chunk, encoding, callback);
       msg[kChunkedLength] += len;
-      ret = msg[kChunkedLength] < msg[kHighWaterMark];
+      ret = msg.writableLength < msg.writableHighWaterMark;
     } else {
       msg._send(len.toString(16), 'latin1', null);
       msg._send(crlf_buf, null, null);
       msg._send(chunk, encoding, null, len);
       ret = msg._send(crlf_buf, null, callback);
     }
+  } else if (msg.chunkedEncoding && msg[kCorked] && msg[kChunkedBuffer].length !== 0) {
+    msg[kChunkedBuffer].push(chunk, encoding, callback);
+    ret = msg.writableLength < msg.writableHighWaterMark;
   } else {
     ret = msg._send(chunk, encoding, callback, len);
   }
@@ -1045,8 +1073,10 @@ function maybePrepareFinalChunk(msg, chunk, encoding) {
   return !!msg._header && msg._hasBody && !msg.chunkedEncoding;
 }
 
-function connectionCorkNT(conn) {
-  conn.uncork();
+function connectionCorkNT(msg) {
+  if (msg[kCorked]) {
+    msg.uncork();
+  }
 }
 
 OutgoingMessage.prototype.addTrailers = function addTrailers(headers) {
@@ -1197,6 +1227,13 @@ OutgoingMessage.prototype.end = function end(chunk, encoding, callback) {
     throw new ERR_HTTP_CONTENT_LENGTH_MISMATCH(this[kBytesWritten], this._contentLength);
   }
 
+  // Flush buffered chunks before terminating the response.
+  if (this[kChunkedBuffer].length !== 0) {
+    this[kSocket]?.cork();
+    this[kCorked] = 1;
+    this.uncork();
+  }
+
   if (finishCallback === null) {
     // If we didn't early finish, send the last data and schedule 'finish' now:
     finishCallback = onFinish.bind(undefined, this);
diff --git a/lib/bench.js b/lib/bench.js
new file mode 100644
index 000000000000..96e199773d90
--- /dev/null
+++ b/lib/bench.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const {
+  ObjectAssign,
+} = primordials;
+
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  suite,
+} = require('internal/bench_runner/harness');
+const {
+  createRunner,
+  run,
+  runFile,
+} = require('internal/bench_runner/runner');
+
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+module.exports = bench;
+ObjectAssign(module.exports, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  createRunner,
+  describe: suite,
+  run,
+  runFile,
+  suite,
+});
diff --git a/lib/bench/reporters.js b/lib/bench/reporters.js
new file mode 100644
index 000000000000..8f33b423c9ad
--- /dev/null
+++ b/lib/bench/reporters.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const {
+  ObjectDefineProperties,
+  ReflectConstruct,
+} = primordials;
+const { emitExperimentalWarning } = require('internal/util');
+
+let json;
+let specFn;
+
+emitExperimentalWarning('Benchmarks');
+
+ObjectDefineProperties(module.exports, {
+  __proto__: null,
+  json: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() {
+      json ??= require('internal/bench_runner/reporter/json');
+      return json;
+    },
+  },
+  spec: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    value: function spec() {
+      specFn ??= require('internal/bench_runner/reporter/spec');
+      return ReflectConstruct(specFn, arguments);
+    },
+  },
+});
diff --git a/lib/buffer.js b/lib/buffer.js
index 19574064ad12..7b0e37239abb 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -141,6 +141,7 @@ const {
   addBufferPrototypeMethods,
   createUnsafeBuffer,
   createUnsafeAlignedBuffer,
+  alignmentPadding,
   asciiWrite,
   latin1Write,
   utf8Write,
@@ -482,9 +483,9 @@ Buffer.allocUnsafe = function allocUnsafe(size, alignment) {
  *
  * If `alignment` is given, the memory backing the returned buffer starts at an
  * address that is a multiple of `alignment`, which is required by e.g. reads
- * and writes on file descriptors opened with `O_DIRECT`. Note that up to
- * `alignment - 1` extra bytes are allocated to satisfy the request, and that
- * the returned buffer's `byteOffset` is therefore usually non-zero.
+ * and writes on file descriptors opened with `O_DIRECT`. Note that at least
+ * `alignment` extra bytes are allocated to satisfy the request, and that the
+ * returned buffer's `byteOffset` is therefore usually non-zero.
  * @param {number} size
  * @param {number} [alignment] A power of two, at most 2 ** 30
  * @returns {FastBuffer}
@@ -504,10 +505,10 @@ function validateAlignment(size, alignment) {
     throw new ERR_INVALID_ARG_VALUE(
       'alignment', alignment, 'must be a power of two');
   }
-  // Satisfying the alignment costs up to `alignment - 1` extra bytes.
-  if (size > kMaxLength - (alignment - 1)) {
+  const padding = alignmentPadding(alignment);
+  if (size > kMaxLength - padding) {
     throw new ERR_OUT_OF_RANGE(
-      'size', `<= ${kMaxLength - (alignment - 1)}`, size);
+      'size', `<= ${kMaxLength - padding}`, size);
   }
 }
 
diff --git a/lib/child_process.js b/lib/child_process.js
index 0e3e04af0d6e..887f5668e37a 100644
--- a/lib/child_process.js
+++ b/lib/child_process.js
@@ -873,8 +873,8 @@ function spawn(file, args, options) {
  * @returns {{
  *   pid: number;
  *   output: Array;
- *   stdout: Buffer | string;
- *   stderr: Buffer | string;
+ *   stdout: Buffer | string | null;
+ *   stderr: Buffer | string | null;
  *   status: number | null;
  *   signal: string | null;
  *   error: Error;
@@ -962,7 +962,7 @@ function checkExecSyncError(ret, args, cmd) {
  *   windowsHide?: boolean;
  *   shell?: boolean | string;
  *   }} [options]
- * @returns {Buffer | string}
+ * @returns {Buffer | string | null}
  */
 function execFileSync(file, args, options) {
   ({ file, args, options } = normalizeExecFileArgs(file, args, options));
@@ -1000,7 +1000,7 @@ function execFileSync(file, args, options) {
  *   encoding?: string;
  *   windowsHide?: boolean;
  *   }} [options]
- * @returns {Buffer | string}
+ * @returns {Buffer | string | null}
  */
 function execSync(command, options) {
   const opts = normalizeExecArgs(command, options, null);
diff --git a/lib/crypto.js b/lib/crypto.js
index ac4b0a33efb8..b44ae9de4e5d 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -112,6 +112,9 @@ const {
   Hmac,
   hash,
 } = require('internal/crypto/hash');
+const {
+  Mac,
+} = require('internal/crypto/provider_mac');
 const {
   X509Certificate,
 } = require('internal/crypto/x509');
@@ -119,6 +122,7 @@ const {
   getCiphers,
   getCurves,
   getHashes,
+  getMacs,
   setEngine,
   secureHeapUsed,
 } = require('internal/crypto/util');
@@ -170,6 +174,10 @@ function createHmac(hmac, key, options) {
   return new Hmac(hmac, key, options);
 }
 
+function createMac(algorithm, key, options) {
+  return new Mac(algorithm, key, options);
+}
+
 function createSign(algorithm, options) {
   return new Sign(algorithm, options);
 }
@@ -191,6 +199,7 @@ module.exports = {
   createECDH,
   createHash,
   createHmac,
+  createMac,
   createPrivateKey,
   createPublicKey,
   createSecretKey,
@@ -204,6 +213,7 @@ module.exports = {
   getCurves,
   getDiffieHellman: createDiffieHellmanGroup,
   getHashes,
+  getMacs,
   hkdf,
   hkdfSync,
   pbkdf2,
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 7c1f4fa845ed..54c25839e611 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -522,11 +522,15 @@ class TracingChannel {
     return done;
   }
 
-  traceSync(fn, context = { __proto__: null }, thisArg, ...args) {
+  traceSync(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       return ReflectApply(fn, thisArg, args);
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
 
     // eslint-disable-next-line no-unused-vars
@@ -542,7 +546,7 @@ class TracingChannel {
     }
   }
 
-  tracePromise(fn, context = { __proto__: null }, thisArg, ...args) {
+  tracePromise(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       const result = ReflectApply(fn, thisArg, args);
       if (typeof result?.then !== 'function') {
@@ -551,6 +555,10 @@ class TracingChannel {
       return result;
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
     const continuationWindow = this.#continuationWindow;
 
diff --git a/lib/dtls.js b/lib/dtls.js
new file mode 100644
index 000000000000..5749ee028334
--- /dev/null
+++ b/lib/dtls.js
@@ -0,0 +1,20 @@
+'use strict';
+
+const {
+  emitExperimentalWarning,
+} = require('internal/util');
+emitExperimentalWarning('dtls');
+
+const {
+  connect,
+  listen,
+  DTLSEndpoint,
+  DTLSSession,
+} = require('internal/dtls/dtls');
+
+module.exports = {
+  connect,
+  listen,
+  DTLSEndpoint,
+  DTLSSession,
+};
diff --git a/lib/eslint.config_partial.mjs b/lib/eslint.config_partial.mjs
index 335692e2cf4a..58a2cda0296f 100644
--- a/lib/eslint.config_partial.mjs
+++ b/lib/eslint.config_partial.mjs
@@ -252,6 +252,10 @@ export default [
           name: 'SharedArrayBuffer',
           message: "Use `const { constructSharedArrayBuffer } = require('internal/util');` instead of the global.",
         },
+        {
+          name: 'Storage',
+          message: "Use `const { Storage } = require('internal/webstorage');` instead of the global.",
+        },
         // Temporal is not available in primordials because it can be
         // disabled with --no-harmony-temporal CLI flag.
         {
@@ -286,6 +290,10 @@ export default [
           name: 'URL',
           message: "Use `const { URL } = require('internal/url');` instead of the global.",
         },
+        {
+          name: 'URLPattern',
+          message: "Use `const { URLPattern } = require('internal/url');` instead of the global.",
+        },
         {
           name: 'URLSearchParams',
           message: "Use `const { URLSearchParams } = require('internal/url');` instead of the global.",
@@ -296,6 +304,14 @@ export default [
           name: 'WebAssembly',
           message: 'Use `const { WebAssembly } = globalThis;` instead of the global.',
         },
+        {
+          name: 'WebSocket',
+          message: 'Use `const { WebSocket } = require("internal/deps/undici/src/lib/web/websocket/websocket.js");` instead of the global.',
+        },
+        {
+          name: 'Worker',
+          message: "Use `const { Worker } = require('internal/webworker');` instead of the global.",
+        },
         {
           name: 'WritableStream',
           message: "Use `const { WritableStream } = require('internal/webstreams/writablestream')` instead of the global.",
@@ -360,6 +376,10 @@ export default [
           name: 'globalThis',
           message: 'Use `const { globalThis } = primordials;` instead of the global.',
         },
+        {
+          name: 'localStorage',
+          message: "Use `const { localStorage } = require('internal/webstorage');` instead of the global.",
+        },
         {
           name: 'performance',
           message: "Use `const { performance } = require('perf_hooks');` instead of the global.",
@@ -368,6 +388,10 @@ export default [
           name: 'queueMicrotask',
           message: "Use `const { queueMicrotask } = require('internal/process/task_queues');` instead of the global.",
         },
+        {
+          name: 'sessionStorage',
+          message: "Use `const { sessionStorage } = require('internal/webstorage');` instead of the global.",
+        },
         {
           name: 'setImmediate',
           message: "Use `const { setImmediate } = require('timers');` instead of the global.",
@@ -388,12 +412,6 @@ export default [
           name: 'SubtleCrypto',
           message: "Use `const { SubtleCrypto } = require('internal/crypto/webcrypto');` instead of the global.",
         },
-        // Float16Array is not available in primordials because it can be
-        // disabled with --no-js-float16array CLI flag.
-        {
-          name: 'Float16Array',
-          message: 'Use `const { Float16Array } = globalThis;` instead of the global.',
-        },
         // DisposableStack and AsyncDisposableStack are not available in primordials because they can be
         // disabled with --no-js-explicit-resource-management CLI flag.
         {
@@ -421,8 +439,8 @@ export default [
       'node-core/lowercase-name-for-primitive': 'error',
       'node-core/non-ascii-character': 'error',
       'node-core/no-array-destructuring': 'error',
+      'node-core/no-crypto-class-instanceof': 'error',
       'node-core/no-cryptokey-public-accessors': 'error',
-      'node-core/no-keyobject-cryptokey-instanceof': 'error',
       'node-core/no-keyobject-public-accessors': 'error',
       'node-core/prefer-primordials': [
         'error',
@@ -454,6 +472,7 @@ export default [
           name: 'FinalizationRegistry',
           into: 'Safe',
         },
+        { name: 'Float16Array' },
         { name: 'Float32Array' },
         { name: 'Float64Array' },
         { name: 'Function' },
diff --git a/lib/fs.js b/lib/fs.js
index d1823ce97298..b858902cf44a 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -28,7 +28,6 @@ const {
   ArrayFromAsync,
   ArrayPrototypePush,
   BigIntPrototypeToString,
-  Boolean,
   FunctionPrototypeCall,
   MathMax,
   Number,
@@ -57,9 +56,6 @@ const {
   F_OK,
   O_WRONLY,
   O_SYMLINK,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const pathModule = require('path');
@@ -83,6 +79,7 @@ const {
 const {
   FSReqCallback,
   ReadFileJob,
+  WriteFileJob,
 } = binding;
 const { toPathIfFileURL } = require('internal/url');
 const {
@@ -103,10 +100,11 @@ const {
     kReadFileBufferLength,
     kMaxUserId,
   },
+  collectRecursiveReaddirResult,
   copyObject,
   Dirent,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getValidatedFd,
   getValidatedPath,
@@ -395,6 +393,7 @@ function bindSignalToReq(req, signal, callback) {
   let aborted = false;
   const onAbort = () => {
     aborted = true;
+    req.cancel();
     callback(new AbortError(undefined, { cause: signal.reason }));
   };
   kResistStopPropagation ??= require('internal/event_target').kResistStopPropagation;
@@ -1743,57 +1742,40 @@ function mkdirSync(path, options) {
 }
 
 /**
- * Appends one directory's entries to `context.results` and the subdirectories
- * still to visit to `context.dirs` (with the prefix their entries get in
- * string results in `context.prefixes`). `result` is a `binding.readdir()`
- * result with file types, so only symbolic links and entries of unknown type
- * need a stat() to find out whether they lead to a directory.
- * @param {string} dir
- * @param {string} prefix
- * @param {[string[], number[]]} result
- * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
- */
-function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
-  const { length } = names;
-  for (let i = 0; i < length; i++) {
-    const name = names[i];
-    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-    let isDirectory;
-    if (context.withFileTypes) {
-      const dirent = getDirent(dir, name, types[i]);
-      ArrayPrototypePush(context.results, dirent);
-      // Follow symbolic links to directories, see https://github.com/nodejs/node/issues/52663
-      isDirectory = dirent.isDirectory() ||
-        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    } else {
-      ArrayPrototypePush(context.results, relative);
-      const type = types[i];
-      isDirectory = type === UV_DIRENT_DIR ||
-        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    }
-    if (isDirectory) {
-      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
-      ArrayPrototypePush(context.prefixes, relative);
-    }
-  }
-}
-
-/*
- * An recursive algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Reads the entire contents of the `basePath` directory. This function does
+ * not validate `basePath` as a directory. It is passed directly to
+ * `binding.readdirRecursive`, or to `binding.readdir` for each directory when
+ * the permission model is enabled, since that checks every directory on the
+ * main thread where the native walk can not.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
  * @param {(
  *   err?: Error,
  *   files?: string[] | Buffer[] | Dirent[]
  * ) => any} callback
  * @returns {void}
-*/
+ */
 function readdirRecursive(basePath, options, callback) {
+  if (permission.isEnabled()) {
+    readdirRecursiveWithPermissionModel(basePath, options, callback);
+    return;
+  }
+  const withFileTypes = !!options.withFileTypes;
+  const req = new FSReqCallback();
+  req.oncomplete = (err, result) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    callback(null, withFileTypes ? getRecursiveDirents(basePath, result) : result);
+  };
+  binding.readdirRecursive(basePath, options.encoding, withFileTypes, req);
+}
+
+function readdirRecursiveWithPermissionModel(basePath, options, callback) {
+  const { encoding } = options;
   const context = {
-    withFileTypes: Boolean(options.withFileTypes),
+    withFileTypes: !!options.withFileTypes,
     results: [],
     dirs: [basePath],
     prefixes: [''],
@@ -1815,11 +1797,6 @@ function readdirRecursive(basePath, options, callback) {
         return;
       }
 
-      if (result === undefined) {
-        callback(null, context.results);
-        return;
-      }
-
       try {
         collectRecursiveReaddirResult(path, prefix, result, context);
       } catch (err) {
@@ -1834,37 +1811,37 @@ function readdirRecursive(basePath, options, callback) {
       }
     };
 
-    binding.readdir(path, options.encoding, true, req);
+    binding.readdir(path, encoding, true, req);
   }
 
   read(context.dirs[i], context.prefixes[i++]);
 }
 
 /**
- * An iterative algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Synchronously reads the entire contents of the `basePath` directory, see
+ * `readdirRecursive`.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
- * @returns {string[] | Dirent[]}
+ * @returns {string[] | Buffer[] | Dirent[]}
  */
 function readdirSyncRecursive(basePath, options) {
-  const context = {
-    withFileTypes: Boolean(options.withFileTypes),
-    results: [],
-    dirs: [basePath],
-    prefixes: [''],
-  };
-
-  for (let i = 0; i < context.dirs.length; i++) {
-    const dir = context.dirs[i];
-    const result = binding.readdir(dir, options.encoding, true);
-    if (result !== undefined) {
+  const withFileTypes = !!options.withFileTypes;
+  if (permission.isEnabled()) {
+    const context = {
+      withFileTypes,
+      results: [],
+      dirs: [basePath],
+      prefixes: [''],
+    };
+    for (let i = 0; i < context.dirs.length; i++) {
+      const dir = context.dirs[i];
+      const result = binding.readdir(dir, options.encoding, true);
       collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
     }
+    return context.results;
   }
-
-  return context.results;
+  const result = binding.readdirRecursive(basePath, options.encoding, withFileTypes);
+  return result !== undefined && withFileTypes ? getRecursiveDirents(basePath, result) : result;
 }
 
 /**
@@ -1898,9 +1875,6 @@ function readdir(path, options, callback) {
   }
 
   if (options.recursive) {
-    // Make shallow copy to prevent mutating options from affecting results
-    options = copyObject(options);
-
     readdirRecursive(path, options, callback);
     return;
   }
@@ -2018,7 +1992,8 @@ function lstat(path, options = { __proto__: null, bigint: false }, callback) {
 
   callback = makeStatsCallback(callback);
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     callback(new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource));
     return;
@@ -2127,11 +2102,17 @@ function fstatSync(fd, options = { __proto__: null, bigint: false }) {
 function lstatSync(path, options = { __proto__: null, bigint: false, throwIfNoEntry: true }) {
   const h = vfsState.handlers;
   if (h !== null) {
-    const result = h.lstatSync(path, options);
-    if (result !== undefined) return result;
+    try {
+      const result = h.lstatSync(path, options);
+      if (result !== undefined) return result;
+    } catch (err) {
+      if (err?.code === 'ENOENT' && options?.throwIfNoEntry === false) return;
+      throw err;
+    }
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2161,8 +2142,13 @@ function lstatSync(path, options = { __proto__: null, bigint: false, throwIfNoEn
 function statSync(path, options = { __proto__: null, bigint: false, throwIfNoEntry: true }) {
   const h = vfsState.handlers;
   if (h !== null) {
-    const result = h.statSync(path, options);
-    if (result !== undefined) return result;
+    try {
+      const result = h.statSync(path, options);
+      if (result !== undefined) return result;
+    } catch (err) {
+      if (err?.code === 'ENOENT' && options?.throwIfNoEntry === false) return undefined;
+      throw err;
+    }
   }
   const stats = binding.stat(
     getValidatedPath(path),
@@ -2253,7 +2239,8 @@ function symlink(target, path, type, callback) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     callback(new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.'));
     return;
   }
@@ -2327,7 +2314,8 @@ function symlinkSync(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -2946,6 +2934,23 @@ function writeFile(path, data, options, callback) {
   if (checkAborted(options.signal, callback))
     return;
 
+  if (!flush) {
+    // Open + write + close in one thread pool round trip.
+    const signal = options.signal;
+    path = getValidatedPath(path);
+    const job = new WriteFileJob(path, stringToFlags(flag, 'options.flag'),
+                                 parseFileMode(options.mode, 'mode', 0o666), data);
+    job.ondone = signal == null ? callback : (err) => {
+      // An abort that arrived while the write was in flight still wins.
+      callback(signal.aborted && !err ? new AbortError(undefined, { cause: signal.reason }) : err);
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      callback(accessError);
+    }
+    return;
+  }
+
   fs.open(path, flag, options.mode, (openErr, fd) => {
     if (openErr) {
       callback(openErr);
diff --git a/lib/https.js b/lib/https.js
index 6ae2e5d8a213..75ec8bb3f895 100644
--- a/lib/https.js
+++ b/lib/https.js
@@ -70,6 +70,7 @@ let debug = require('internal/util/debuglog').debuglog('https', (fn) => {
   debug = fn;
 });
 const net = require('net');
+const { Buffer } = require('buffer');
 const { URL, urlToHttpOptions, isURL } = require('internal/url');
 const { validateObject } = require('internal/validators');
 const { isIP } = require('internal/net');
@@ -204,6 +205,7 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
   const result = {
     __proto__: null,
     proxyTunnelPayload: payload,
+    maxHeaderSize: reqOptions.maxHeaderSize || getOptionValue('--max-http-header-size'),
     requestOptions: {  // Options used for the request sent after the tunnel is established.
       __proto__: null,
       servername: reqOptions.servername || ipType ? undefined : reqOptions.host,
@@ -215,17 +217,17 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
 };
 
 function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
-  const { proxyTunnelPayload } = tunnelConfig;
+  const { proxyTunnelPayload, maxHeaderSize } = tunnelConfig;
   // By default, the socket is in paused mode. Read to look for the 200
   // connection established response.
   function read() {
     let chunk;
     while ((chunk = socket.read()) !== null) {
-      if (onProxyData(chunk) !== -1) {
-        break;
+      if (onProxyData(chunk)) {
+        return;
       }
     }
-    socket.on('readable', read);
+    socket.once('readable', read);
   }
 
   function cleanup() {
@@ -243,14 +245,25 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
 
   // Read the headers from the chunks and check for the status code. If it fails we
   // clean up the socket and return an error. Otherwise we establish the tunnel.
-  let buffer = '';
+  let buffer;
   function onProxyData(chunk) {
-    const str = chunk.toString();
-    debug('onProxyData', str);
-    buffer += str;
+    debug('onProxyData', chunk.length);
+    buffer = buffer === undefined ? chunk :
+      Buffer.concat([buffer, chunk], buffer.length + chunk.length);
     const headerEndIndex = buffer.indexOf('\r\n\r\n');
-    if (headerEndIndex === -1) return headerEndIndex;
-    const statusLine = buffer.substring(0, buffer.indexOf('\r\n'));
+    const headerLength = headerEndIndex === -1 ?
+      buffer.length : headerEndIndex + 4;
+    if (headerLength > maxHeaderSize) {
+      debug(`Proxy response headers exceed ${maxHeaderSize} bytes, cleaning up`);
+      cleanup();
+      const err = new ERR_PROXY_TUNNEL(
+        `Proxy response headers exceeded ${maxHeaderSize} bytes`);
+      afterSocket(err, socket);
+      return true;
+    }
+    if (headerEndIndex === -1) return false;
+    const statusLineEndIndex = buffer.indexOf('\r\n');
+    const statusLine = buffer.subarray(0, statusLineEndIndex).toString();
     const statusCode = statusLine.split(' ')[1];
     if (statusCode !== '200') {
       debug(`onProxyData receives ${statusCode}, cleaning up`);
@@ -292,7 +305,7 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
       });
       tunneldSocket.on('error', onTLSHandshakeError);
     }
-    return headerEndIndex;
+    return true;
   }
 
   function onProxyEnd() {
diff --git a/lib/internal/async_context_frame.js b/lib/internal/async_context_frame.js
index cac193e33188..cd03eafe6fa6 100644
--- a/lib/internal/async_context_frame.js
+++ b/lib/internal/async_context_frame.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ObjectSetPrototypeOf,
   SafeMap,
 } = primordials;
 
@@ -10,45 +9,22 @@ const {
   setContinuationPreservedEmbedderData,
 } = internalBinding('async_context_frame');
 
-let enabled_;
-
-class ActiveAsyncContextFrame extends SafeMap {
-  static get enabled() {
-    return true;
-  }
-
-  static current() {
-    return getContinuationPreservedEmbedderData();
-  }
-
-  static set(frame) {
-    setContinuationPreservedEmbedderData(frame);
-  }
-
-  static exchange(frame) {
-    const prior = this.current();
-    this.set(frame);
-    return prior;
-  }
-
-  static disable(store) {
-    const frame = this.current();
-    frame?.disable(store);
-  }
+function activeCurrent() {
+  return getContinuationPreservedEmbedderData();
 }
 
-function checkEnabled() {
-  const enabled = require('internal/options')
-    .getOptionValue('--async-context-frame');
+function activeSet(frame) {
+  setContinuationPreservedEmbedderData(frame);
+}
 
-  // If enabled, swap to active prototype so we don't need to check status
-  // on every interaction with the async context frame.
-  if (enabled) {
-    // eslint-disable-next-line no-use-before-define
-    ObjectSetPrototypeOf(AsyncContextFrame, ActiveAsyncContextFrame);
-  }
+function activeExchange(frame) {
+  const prior = getContinuationPreservedEmbedderData();
+  setContinuationPreservedEmbedderData(frame);
+  return prior;
+}
 
-  return enabled;
+function activeDisable(store) {
+  getContinuationPreservedEmbedderData()?.disable(store);
 }
 
 class InactiveAsyncContextFrame extends SafeMap {
@@ -74,4 +50,22 @@ class AsyncContextFrame extends InactiveAsyncContextFrame {
   }
 }
 
+let enabled_;
+
+function checkEnabled() {
+  const enabled = require('internal/options')
+    .getOptionValue('--async-context-frame');
+
+  // If enabled, install the active implementations directly. We use props
+  // rather than a prototype replacement to preserve V8 optimizations.
+  if (enabled) {
+    AsyncContextFrame.current = activeCurrent;
+    AsyncContextFrame.set = activeSet;
+    AsyncContextFrame.exchange = activeExchange;
+    AsyncContextFrame.disable = activeDisable;
+  }
+
+  return enabled;
+}
+
 module.exports = AsyncContextFrame;
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
new file mode 100644
index 000000000000..375f8e6b635f
--- /dev/null
+++ b/lib/internal/bench_runner/benchmark.js
@@ -0,0 +1,591 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSort,
+  JSONStringify,
+  MathFloor,
+  MathMax,
+  MathMin,
+  MathRound,
+  MathSqrt,
+  Number,
+  NumberIsFinite,
+  NumberMAX_SAFE_INTEGER,
+  ObjectFreeze,
+  ObjectKeys,
+  PromiseWithResolvers,
+  SafeSet,
+  StringPrototypeToLowerCase,
+} = primordials;
+const { AsyncResource } = require('async_hooks');
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+    ERR_OUT_OF_RANGE,
+  },
+} = require('internal/errors');
+const { createHistogram } = require('internal/histogram');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateFunction,
+  validateInteger,
+  validateNumber,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+const { structuredClone } = require('internal/worker/js_transferable');
+
+const { bigint: hrtime } = process.hrtime;
+const kDefaultSamples = 30;
+const kDefaultWarmup = 0;
+const kEmptyDiagnosticChannels = ObjectFreeze([]);
+const kEmptyNamePath = ObjectFreeze([]);
+const kEmptyParams = ObjectFreeze({ __proto__: null });
+const kEmptyTags = ObjectFreeze([]);
+
+function validateSkip(skip) {
+  if (skip !== undefined && typeof skip !== 'boolean' &&
+      typeof skip !== 'string') {
+    throw new ERR_INVALID_ARG_TYPE('options.skip', ['boolean', 'string'], skip);
+  }
+}
+
+function canonicalizeTags(tags, parentTags = kEmptyTags) {
+  if (tags === undefined) return parentTags;
+  if (!ArrayIsArray(tags)) {
+    throw new ERR_INVALID_ARG_TYPE('options.tags', 'Array', tags);
+  }
+
+  const result = ArrayPrototypeSlice(parentTags);
+  const seen = new SafeSet(parentTags);
+  for (let i = 0; i < tags.length; i++) {
+    validateString(tags[i], `options.tags[${i}]`);
+    if (tags[i].length === 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        `options.tags[${i}]`, tags[i], 'must not be empty');
+    }
+    const tag = StringPrototypeToLowerCase(tags[i]);
+    if (!seen.has(tag)) {
+      seen.add(tag);
+      ArrayPrototypePush(result, tag);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeDiagnosticChannels(
+  diagnosticChannels,
+  parentDiagnosticChannels = kEmptyDiagnosticChannels,
+) {
+  if (diagnosticChannels === undefined) return parentDiagnosticChannels;
+  if (!ArrayIsArray(diagnosticChannels)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.diagnosticChannels', 'Array', diagnosticChannels);
+  }
+
+  const result = ArrayPrototypeSlice(parentDiagnosticChannels);
+  const seen = new SafeSet(parentDiagnosticChannels);
+  for (let i = 0; i < diagnosticChannels.length; i++) {
+    const name = diagnosticChannels[i];
+    if (typeof name === 'symbol') continue;
+    if (typeof name !== 'string') {
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.diagnosticChannels[${i}]`, ['string', 'symbol'], name);
+    }
+    if (!seen.has(name)) {
+      seen.add(name);
+      ArrayPrototypePush(result, name);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeParams(params) {
+  if (params === undefined) return kEmptyParams;
+  validateObject(params, 'options.params');
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(params);
+  ArrayPrototypeSort(keys);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const value = params[key];
+    if (typeof value !== 'string' && typeof value !== 'boolean' &&
+        (typeof value !== 'number' || !NumberIsFinite(value))) {
+      if (typeof value === 'number') {
+        throw new ERR_OUT_OF_RANGE(
+          `options.params.${key}`, 'a finite number', value);
+      }
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.params.${key}`, ['string', 'number', 'boolean'], value);
+    }
+    result[key] = value;
+  }
+  return ObjectFreeze(result);
+}
+
+function validateNodeOptions(options, parentTags, parentDiagnosticChannels) {
+  validateObject(options, 'options');
+  const { diagnosticChannels, only = false, skip, tags } = options;
+  if (typeof only !== 'boolean') {
+    throw new ERR_INVALID_ARG_TYPE('options.only', 'boolean', only);
+  }
+  validateSkip(skip);
+  return {
+    __proto__: null,
+    diagnosticChannels: canonicalizeDiagnosticChannels(
+      diagnosticChannels, parentDiagnosticChannels),
+    only,
+    skip,
+    tags: canonicalizeTags(tags, parentTags),
+  };
+}
+
+function createLocation(loc, fallbackFile) {
+  return {
+    __proto__: null,
+    file: loc?.[2] ?? fallbackFile,
+    line: loc?.[0],
+    column: loc?.[1],
+  };
+}
+
+function getNamePath(parent, name) {
+  const path = [];
+  for (let current = parent; current?.parent !== null; current = current.parent) {
+    ArrayPrototypePush(path, current.name);
+  }
+  ArrayPrototypeReverse(path);
+  ArrayPrototypePush(path, name);
+  return path;
+}
+
+function cloneSample(sample) {
+  const result = {
+    __proto__: null,
+    operations: sample.operations,
+    duration_ns: sample.duration_ns,
+    rate: sample.rate,
+  };
+  if (sample.detail !== undefined) {
+    result.detail = structuredClone(sample.detail);
+  }
+  return result;
+}
+
+class Suite extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc, isRoot = false) {
+    super('BenchSuite');
+    const validated = validateNodeOptions(
+      options,
+      parent?.tags ?? kEmptyTags,
+      parent?.diagnosticChannels ?? kEmptyDiagnosticChannels,
+    );
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.isRoot = isRoot;
+    this.fileScope = isRoot ? null :
+      (parent.isRoot ? harness.getFileScope() : parent.fileScope);
+    this.namePath = isRoot ? kEmptyNamePath :
+      ObjectFreeze(getNamePath(parent, name));
+    this.suiteId = isRoot ? null : JSONStringify([
+      this.loc.file,
+      this.namePath,
+    ]);
+    this.parentId = isRoot || parent.isRoot ? null : parent.suiteId;
+    this.diagnosticChannels = validated.diagnosticChannels;
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.children = [];
+    this.hooks = {
+      __proto__: null,
+      after: [],
+      afterEach: [],
+      before: [],
+      beforeEach: [],
+    };
+    this.buildError = null;
+    this.buildPromise = null;
+    this.finished = false;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class Bench extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc) {
+    super('Benchmark');
+    const validated = validateNodeOptions(
+      options, parent.tags, parent.diagnosticChannels);
+    const {
+      params,
+      samples = kDefaultSamples,
+      signal,
+      timeout = Infinity,
+      warmup = kDefaultWarmup,
+    } = options;
+
+    validateUint32(samples, 'options.samples', true);
+    validateUint32(warmup, 'options.warmup');
+    validateAbortSignal(signal, 'options.signal');
+    if (timeout !== Infinity) {
+      validateNumber(timeout, 'options.timeout', 0, TIMEOUT_MAX);
+    }
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.diagnosticChannels = validated.diagnosticChannels;
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.params = canonicalizeParams(params);
+    this.samples = samples;
+    this.warmup = warmup;
+    this.timeout = timeout;
+    this.outerSignal = signal;
+    this.fileScope = parent.isRoot ? harness.getFileScope() : parent.fileScope;
+    this.namePath = ObjectFreeze(getNamePath(parent, name));
+    this.fullName = ArrayPrototypeJoin(this.namePath, ' ');
+    this.benchId = JSONStringify([
+      this.loc.file,
+      this.namePath,
+      this.params,
+    ]);
+    this.parentId = parent.suiteId;
+    this.finished = false;
+    this.result = null;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class BenchContext {
+  #closed = false;
+  #done = false;
+  #endCalled = false;
+  #index;
+  #invalid = false;
+  #onDiagnostic;
+  #phase;
+  #recordCalled = false;
+  #sample = null;
+  #startCalled = false;
+  #startTime;
+
+  constructor(bench, signal, phase, index, onDiagnostic) {
+    this.name = bench.name;
+    this.params = bench.params;
+    this.signal = signal;
+    this.#phase = phase;
+    this.#index = index;
+    this.#onDiagnostic = onDiagnostic;
+  }
+
+  get index() {
+    return this.#index;
+  }
+
+  get phase() {
+    return this.#phase;
+  }
+
+  diagnostic(message, options = kEmptyObject) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    try {
+      const clonedMessage = structuredClone(message);
+      validateObject(options, 'options');
+      const { detail, level = 'info' } = options;
+      validateString(level, 'options.level');
+      if (level !== 'info' && level !== 'warning') {
+        throw new ERR_INVALID_ARG_VALUE(
+          'options.level', level, "must be 'info' or 'warning'");
+      }
+      const diagnostic = { __proto__: null, level, message: clonedMessage };
+      if (detail !== undefined) diagnostic.detail = structuredClone(detail);
+      this.#onDiagnostic(diagnostic);
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+  }
+
+  start() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() cannot be combined with record()');
+    }
+    if (this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() must be called exactly once per benchmark sample');
+    }
+    this.#startCalled = true;
+    this.#startTime = hrtime();
+  }
+
+  end(operations, options = kEmptyObject) {
+    const endTime = hrtime();
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() cannot be combined with record()');
+    }
+    if (this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() must be called exactly once per benchmark sample');
+    }
+    this.#endCalled = true;
+    if (!this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('end() cannot be called before start()');
+    }
+
+    try {
+      validateObject(options, 'options');
+      const { detail } = options;
+      validateInteger(operations, 'operations', 1, NumberMAX_SAFE_INTEGER);
+      const duration = endTime - this.#startTime;
+      if (duration === 0n) {
+        throw new ERR_INVALID_STATE(
+          'insufficient clock precision for benchmark sample');
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns: duration,
+        rate: operations / (Number(duration) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  record(sample) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() must be called exactly once per benchmark sample');
+    }
+    if (this.#startCalled || this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() cannot be combined with start() or end()');
+    }
+    this.#recordCalled = true;
+
+    try {
+      validateObject(sample, 'sample');
+      const { detail, duration_ns, operations } = sample;
+      validateInteger(
+        operations, 'sample.operations', 1, NumberMAX_SAFE_INTEGER);
+      if (typeof duration_ns !== 'bigint') {
+        throw new ERR_INVALID_ARG_TYPE(
+          'sample.duration_ns', 'bigint', duration_ns);
+      }
+      if (duration_ns <= 0n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns', 'a positive bigint', duration_ns);
+      }
+      if (duration_ns > 9_007_199_254_740_991n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns',
+          'less than or equal to Number.MAX_SAFE_INTEGER',
+          duration_ns);
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns,
+        rate: operations / (Number(duration_ns) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  done() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#phase !== 'measurement') {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'done() can only be called during a measured sample');
+    }
+    this.#done = true;
+  }
+
+  finish() {
+    this.#closed = true;
+    if (this.#invalid) {
+      throw new ERR_INVALID_STATE(
+        'benchmark sample violated the context method contract');
+    }
+    if (!this.#recordCalled && !this.#startCalled) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call start() or record()');
+    }
+    if (!this.#recordCalled && (!this.#endCalled || this.#sample === null)) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call end()');
+    }
+    return {
+      __proto__: null,
+      done: this.#done,
+      sample: this.#sample,
+    };
+  }
+
+  close() {
+    this.#closed = true;
+  }
+}
+
+function arithmeticMean(values) {
+  let sum = 0;
+  let compensation = 0;
+  for (let i = 0; i < values.length; i++) {
+    const adjusted = values[i] - compensation;
+    const next = sum + adjusted;
+    compensation = (next - sum) - adjusted;
+    sum = next;
+  }
+  return sum / values.length;
+}
+
+function summarizeSamples(samples) {
+  const rates = [];
+  let min = Infinity;
+  let max = -Infinity;
+  for (let i = 0; i < samples.length; i++) {
+    const rate = samples[i].rate;
+    ArrayPrototypePush(rates, rate);
+    min = MathMin(min, rate);
+    max = MathMax(max, rate);
+  }
+
+  const mean = arithmeticMean(rates);
+  let variance = 0;
+  for (let i = 0; i < rates.length; i++) {
+    const difference = rates[i] - mean;
+    variance += difference * difference;
+  }
+  variance /= rates.length;
+  const stddev = MathSqrt(variance);
+
+  const sorted = ArrayPrototypeSlice(rates);
+  ArrayPrototypeSort(sorted, (a, b) => a - b);
+  const middle = MathFloor(sorted.length / 2);
+  const median = sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+
+  const scale = MathMin(1_000_000, NumberMAX_SAFE_INTEGER / max);
+  const histogram = createHistogram({ __proto__: null, figures: 5 });
+  for (let i = 0; i < rates.length; i++) {
+    const value = MathMax(
+      1,
+      MathMin(NumberMAX_SAFE_INTEGER, MathRound(rates[i] * scale)),
+    );
+    histogram.record(value);
+  }
+
+  const meanCI = histogram.meanCI();
+  const histogramMean = meanCI.mean / scale;
+  const medianCI = histogram.percentileCI(50);
+
+  return {
+    __proto__: null,
+    mean,
+    median,
+    min,
+    max,
+    stddev,
+    coefficientOfVariation: stddev / mean,
+    confidenceInterval: {
+      __proto__: null,
+      lower: mean + meanCI.lower / scale - histogramMean,
+      upper: mean + meanCI.upper / scale - histogramMean,
+    },
+    medianConfidenceInterval: {
+      __proto__: null,
+      lower: medianCI.lower / scale,
+      upper: medianCI.upper / scale,
+    },
+    skewness: histogram.skewness,
+  };
+}
+
+function normalizeArgs(type, name, options, fn) {
+  if (typeof name === 'function') {
+    fn = name;
+    name = fn.name || '<anonymous>';
+    options = kEmptyObject;
+  } else if (name !== null && typeof name === 'object') {
+    fn = options;
+    options = name;
+    name = fn?.name || '<anonymous>';
+  } else if (typeof options === 'function') {
+    fn = options;
+    options = kEmptyObject;
+  }
+
+  validateFunction(fn, `${type} function`);
+  validateString(name, `${type} name`);
+  if (name.length === 0) {
+    throw new ERR_INVALID_ARG_VALUE(`${type} name`, name, 'must not be empty');
+  }
+  validateObject(options, 'options');
+  return { __proto__: null, fn, name, options };
+}
+
+module.exports = {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+};
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
new file mode 100644
index 000000000000..295aa20483ce
--- /dev/null
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -0,0 +1,291 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayIsArray,
+  ArrayPrototypePush,
+  MapPrototypeClear,
+  MapPrototypeEntries,
+  MapPrototypeSet,
+  ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetOwnPropertyNames,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectSetPrototypeOf,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  SafeMap,
+  SetPrototypeAdd,
+  SetPrototypeClear,
+  SetPrototypeValues,
+  Symbol,
+} = primordials;
+const Readable = require('internal/streams/readable');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { isError } = require('internal/util');
+const { isMap, isSet } = require('internal/util/types');
+const { structuredClone } = require('internal/worker/js_transferable');
+
+const kEmitMessage = Symbol('kEmitMessage');
+
+function repairError(source, clone, seen) {
+  const serialized = deserializeError(serializeError(source));
+  let sourceName;
+  try {
+    sourceName = source.name;
+  } catch {
+    // The serialized form already omits properties whose getters throw.
+  }
+  let repaired = clone;
+  if (!isError(repaired) ||
+      (sourceName !== undefined && repaired.name !== sourceName)) {
+    repaired = serialized;
+  }
+  if (repaired === null || typeof repaired !== 'object') return repaired;
+  seen.set(source, repaired);
+
+  if (serialized !== null && typeof serialized === 'object') {
+    const serializedKeys = ObjectGetOwnPropertyNames(serialized);
+    for (let i = 0; i < serializedKeys.length; i++) {
+      const key = serializedKeys[i];
+      if (ObjectPrototypeHasOwnProperty(repaired, key)) continue;
+      const descriptor = ObjectGetOwnPropertyDescriptor(serialized, key);
+      ObjectSetPrototypeOf(descriptor, null);
+      ObjectDefineProperty(repaired, key, descriptor);
+    }
+  }
+
+  const keys = ObjectGetOwnPropertyNames(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value') ||
+        typeof descriptor.value === 'function' ||
+        typeof descriptor.value === 'symbol') {
+      continue;
+    }
+    const existing = ObjectGetOwnPropertyDescriptor(repaired, key);
+    const value = descriptor.value !== null &&
+      typeof descriptor.value === 'object' ?
+      repairClone(descriptor.value, existing?.value, seen) : descriptor.value;
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(repaired, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  return repaired;
+}
+
+function repairClone(source, clone, seen) {
+  if (source === null || (typeof source !== 'object' &&
+                          typeof source !== 'function')) {
+    return clone === undefined ? source : clone;
+  }
+  if (typeof source === 'function') return clone;
+  if (seen.has(source)) return seen.get(source);
+  if (isError(source)) return repairError(source, clone, seen);
+  if (clone === null || typeof clone !== 'object') {
+    try {
+      clone = structuredClone(source);
+    } catch {
+      const prototype = ObjectGetPrototypeOf(source);
+      if (!ArrayIsArray(source) && prototype !== null &&
+          prototype !== ObjectPrototype) {
+        return clone;
+      }
+      clone = ArrayIsArray(source) ? [] : { __proto__: prototype };
+    }
+  }
+  seen.set(source, clone);
+  if (isMap(source) && isMap(clone)) {
+    const sourceEntries = ArrayFrom(MapPrototypeEntries(source));
+    const cloneEntries = ArrayFrom(MapPrototypeEntries(clone));
+    const repairedEntries = [];
+    for (let i = 0; i < sourceEntries.length; i++) {
+      ArrayPrototypePush(repairedEntries, [
+        repairClone(sourceEntries[i][0], cloneEntries[i][0], seen),
+        repairClone(sourceEntries[i][1], cloneEntries[i][1], seen),
+      ]);
+    }
+    MapPrototypeClear(clone);
+    for (let i = 0; i < repairedEntries.length; i++) {
+      MapPrototypeSet(clone, repairedEntries[i][0], repairedEntries[i][1]);
+    }
+    return clone;
+  }
+  if (isSet(source) && isSet(clone)) {
+    const sourceValues = ArrayFrom(SetPrototypeValues(source));
+    const cloneValues = ArrayFrom(SetPrototypeValues(clone));
+    const repairedValues = [];
+    for (let i = 0; i < sourceValues.length; i++) {
+      ArrayPrototypePush(
+        repairedValues, repairClone(sourceValues[i], cloneValues[i], seen));
+    }
+    SetPrototypeClear(clone);
+    for (let i = 0; i < repairedValues.length; i++) {
+      SetPrototypeAdd(clone, repairedValues[i]);
+    }
+    return clone;
+  }
+  const prototype = ObjectGetPrototypeOf(source);
+  if (prototype === null) ObjectSetPrototypeOf(clone, null);
+  if (prototype !== null && prototype !== ObjectPrototype &&
+      !ArrayIsArray(source)) {
+    return clone;
+  }
+  const keys = ObjectKeys(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value')) continue;
+    const existing = ObjectGetOwnPropertyDescriptor(clone, key);
+    const value = repairClone(descriptor.value, existing?.value, seen);
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(clone, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  if (ArrayIsArray(source)) {
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, 'length');
+    ObjectSetPrototypeOf(descriptor, null);
+    ObjectDefineProperty(clone, 'length', descriptor);
+  }
+  return clone;
+}
+
+function cloneRecordData(data) {
+  let clone;
+  try {
+    clone = structuredClone(data);
+  } catch (error) {
+    if (data.error === undefined) throw error;
+    clone = structuredClone({ __proto__: null, ...data, error: undefined });
+    clone.error = deserializeError(serializeError(data.error));
+  }
+  try {
+    return repairClone(data, clone, new SafeMap());
+  } catch {
+    return clone;
+  }
+}
+
+class BenchmarksStream extends Readable {
+  #blocked = false;
+  #drainWaiters = [];
+  #hasReader = false;
+
+  constructor() {
+    super({
+      __proto__: null,
+      objectMode: true,
+    });
+  }
+
+  _read() {
+    if (this.#blocked) {
+      this.#blocked = false;
+      const waiters = this.#drainWaiters;
+      this.#drainWaiters = [];
+      for (let i = 0; i < waiters.length; i++) waiters[i].resolve();
+    }
+  }
+
+  read(size) {
+    if (size !== 0) this.#hasReader = true;
+    return super.read(size);
+  }
+
+  _destroy(error, callback) {
+    const failure = error ??
+      new ERR_INVALID_STATE('benchmark stream is closed');
+    const waiters = this.#drainWaiters;
+    this.#drainWaiters = [];
+    for (let i = 0; i < waiters.length; i++) waiters[i].reject(failure);
+    callback(error);
+  }
+
+  waitForDrain() {
+    if (this.destroyed) {
+      return PromiseReject(this.errored ??
+        new ERR_INVALID_STATE('benchmark stream is closed'));
+    }
+    if (!this.#blocked) return PromiseResolve();
+    const waiter = PromiseWithResolvers();
+    ArrayPrototypePush(this.#drainWaiters, waiter);
+    return waiter.promise;
+  }
+
+  plan(data) {
+    return this[kEmitMessage]('bench:plan', data);
+  }
+
+  start(data) {
+    return this[kEmitMessage]('bench:start', data);
+  }
+
+  sample(data) {
+    return this[kEmitMessage]('bench:sample', data);
+  }
+
+  complete(data) {
+    return this[kEmitMessage]('bench:complete', data);
+  }
+
+  diagnostic(data) {
+    return this[kEmitMessage]('bench:diagnostic', data);
+  }
+
+  summary(data) {
+    return this[kEmitMessage]('bench:summary', data);
+  }
+
+  end() {
+    return this.#tryPush(null);
+  }
+
+  [kEmitMessage](type, data) {
+    const recordData = cloneRecordData(data);
+    const record = { __proto__: null, type, data: recordData };
+    if (this.listenerCount(type) > 0) {
+      this.emit(type, cloneRecordData(recordData));
+    }
+    return this.#tryPush(record);
+  }
+
+  #tryPush(record) {
+    if (this.destroyed) return false;
+    const canPush = this.push(record);
+    if (record !== null && !canPush && this.#hasReader) {
+      this.#blocked = true;
+      return false;
+    }
+    return true;
+  }
+}
+
+module.exports = {
+  BenchmarksStream,
+};
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
new file mode 100644
index 000000000000..5eaf0a317147
--- /dev/null
+++ b/lib/internal/bench_runner/cli.js
@@ -0,0 +1,1311 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayIsArray,
+  ArrayPrototypeFilter,
+  ArrayPrototypeIncludes,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypePushApply,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSome,
+  ArrayPrototypeSort,
+  MathMax,
+  NumberIsFinite,
+  NumberIsSafeInteger,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectValues,
+  Promise,
+  PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  RegExp,
+  SafeMap,
+  SafePromiseAllReturnVoid,
+  SafeSet,
+  String,
+  StringPrototypeIndexOf,
+  StringPrototypeReplaceAll,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+  StringPrototypeToUpperCase,
+  SymbolDispose,
+  uncurryThis,
+} = primordials;
+const { Buffer } = require('buffer');
+const BufferToString = uncurryThis(Buffer.prototype.toString);
+const { spawn } = require('child_process');
+const { createWriteStream, statSync } = require('fs');
+const { Glob } = require('internal/fs/glob');
+const { getValidatedPath } = require('internal/fs/utils');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+const {
+  configureRunScope,
+  createRunId,
+  runInFileScope,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  AbortError,
+  codes: {
+    ERR_ACCESS_DENIED,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  getCLIOptionsInfo,
+  getOptionValue,
+  getOptionsAsFlagsFromBinding,
+} = require('internal/options');
+const permission = require('internal/process/permission');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateArray,
+  validateObject,
+  validateStringWithoutNullBytes,
+  validateUint32,
+} = require('internal/validators');
+const { pathToFileURL } = require('internal/url');
+const { pipeline } = require('stream/promises');
+const { resolve, sep } = require('path');
+const { clearTimeout, setTimeout } = require('timers');
+
+const console = require('internal/console/global');
+const esmLoader = require('internal/modules/esm/loader');
+const { bigint: hrtime } = process.hrtime;
+
+const kBuiltinDestinations = new SafeMap([
+  ['stdout', process.stdout],
+  ['stderr', process.stderr],
+]);
+const kBuiltinReporters = new SafeMap([
+  ['json', 'internal/bench_runner/reporter/json'],
+  ['spec', 'internal/bench_runner/reporter/spec'],
+]);
+const kChildAckMessageType = 'node:bench:ack';
+const kChildMessageType = 'node:bench:record';
+const kEventTypes = new SafeSet([
+  'bench:plan',
+  'bench:start',
+  'bench:sample',
+  'bench:complete',
+  'bench:diagnostic',
+  'bench:summary',
+]);
+const kFilterArgs = ['--bench', '--experimental-default-config-file'];
+const kFilterArgValues = [
+  '--bench-isolation',
+  '--bench-name-pattern',
+  '--bench-reporter',
+  '--bench-reporter-destination',
+  '--bench-samples',
+  '--bench-warmup',
+  '--experimental-config-file',
+];
+const kIncompatibleExecArgv = new SafeSet([
+  '--build-sea',
+  '--build-snapshot',
+  '--build-snapshot-config',
+  '--check',
+  '--completion-bash',
+  '--eval',
+  '--experimental-sea-config',
+  '--help',
+  '--help-all',
+  '--input-type',
+  '--interactive',
+  '--print',
+  '--prof-process',
+  '--run',
+  '--test',
+  '--version',
+  '--v8-options',
+  '--watch',
+  '--watch-path',
+  '-c',
+  '-e',
+  '-h',
+  '-i',
+  '-p',
+  '-v',
+]);
+const kExecArgvWithValue = new SafeSet([
+  '--eval',
+  '--input-type',
+  '--print',
+  '--run',
+  '--watch-path',
+  '-e',
+  '-p',
+]);
+const kIPCEnvironmentVariables = new SafeSet([
+  'NODE_CHANNEL_FD',
+  'NODE_CHANNEL_SERIALIZATION_MODE',
+  'NODE_BENCH_CONTEXT',
+  'NODE_BENCH_FILE_RUN_ID',
+  'NODE_BENCH_RUN_ID',
+  'NODE_OPTIONS',
+]);
+const kForceKillDelay = 1_000;
+
+function createBenchmarkFileList(patterns, cwd) {
+  if (patterns.length === 0) {
+    console.error('--bench requires at least one file or glob pattern');
+    return null;
+  }
+
+  const glob = new Glob(patterns, { __proto__: null, cwd });
+  const files = ArrayPrototypeFilter(glob.globSync(), (path) => {
+    try {
+      return statSync(resolve(cwd, path)).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if (files.length === 0) {
+    console.error(`Could not find '${ArrayPrototypeJoin(patterns, ', ')}'`);
+    return null;
+  }
+  return ArrayPrototypeSort(files);
+}
+
+function createChildFileList(patterns, cwd) {
+  if (patterns.length !== 1) {
+    console.error('benchmark child process requires exactly one file');
+    return null;
+  }
+  const path = resolve(cwd, patterns[0]);
+  try {
+    if (statSync(path).isFile()) return [path];
+  } catch {
+    // Fall through to the standard not-found diagnostic.
+  }
+  console.error(`Could not find '${patterns[0]}'`);
+  return null;
+}
+
+function createFileScopes(files, options) {
+  const scopes = [];
+  for (let i = 0; i < files.length; i++) {
+    ArrayPrototypePush(scopes, {
+      __proto__: null,
+      entryFile: resolve(options.cwd, files[i]),
+      fileRunId: options.isChild && i === 0 &&
+        options.fileRunId !== undefined ? options.fileRunId : createRunId(),
+    });
+  }
+  return scopes;
+}
+
+function parseNamePattern(value) {
+  if (value.length === 0) return undefined;
+  try {
+    return new RegExp(value);
+  } catch (error) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-name-pattern', value,
+      `is an invalid regular expression. ${error.message}`);
+  }
+}
+
+function parseCommandLine() {
+  const reporters = getOptionValue('--bench-reporter');
+  const destinations = getOptionValue('--bench-reporter-destination');
+  const isChild = process.env.NODE_BENCH_CONTEXT === 'child' &&
+    typeof process.send === 'function';
+
+  if (!isChild) {
+    if (reporters.length === 0 && destinations.length === 0) {
+      ArrayPrototypePush(reporters, 'spec');
+    }
+    if (reporters.length === 1 && destinations.length === 0) {
+      ArrayPrototypePush(destinations, 'stdout');
+    }
+    if (reporters.length !== destinations.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        '--bench-reporter', reporters,
+        'must match the number of specified ' +
+        "'--bench-reporter-destination'");
+    }
+  }
+
+  const samples = getOptionValue('[has_bench_samples]') ?
+    getOptionValue('--bench-samples') : undefined;
+  const warmup = getOptionValue('[has_bench_warmup]') ?
+    getOptionValue('--bench-warmup') : undefined;
+  if (samples !== undefined) {
+    validateUint32(samples, '--bench-samples', true);
+  }
+  if (warmup !== undefined) {
+    validateUint32(warmup, '--bench-warmup');
+  }
+
+  return {
+    __proto__: null,
+    cwd: process.cwd(),
+    destinations,
+    fileRunId: isChild && process.env.NODE_BENCH_FILE_RUN_ID ?
+      process.env.NODE_BENCH_FILE_RUN_ID : undefined,
+    isChild,
+    isolation: getOptionValue('--bench-isolation'),
+    namePattern: parseNamePattern(getOptionValue('--bench-name-pattern')),
+    namePatternSource: getOptionValue('--bench-name-pattern'),
+    reporters,
+    runId: isChild && process.env.NODE_BENCH_RUN_ID ?
+      process.env.NODE_BENCH_RUN_ID : undefined,
+    samples,
+    warmup,
+  };
+}
+
+async function loadReporter(name) {
+  const builtin = kBuiltinReporters.get(name);
+  let reporter;
+  if (builtin !== undefined) {
+    reporter = require(builtin);
+  } else {
+    let parentURL;
+    try {
+      parentURL = pathToFileURL(`${process.cwd()}${sep}`).href;
+    } catch {
+      parentURL = 'file:///';
+    }
+    const loader = esmLoader.getOrInitializeCascadedLoader();
+    reporter = await loader.import(name, parentURL, kEmptyObject);
+  }
+
+  reporter = reporter?.default ?? reporter;
+  if (reporter?.prototype &&
+      ObjectGetOwnPropertyDescriptor(reporter.prototype, 'constructor')) {
+    reporter = new reporter();
+  }
+  if (!reporter) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-reporter', name, 'is not a valid reporter');
+  }
+  return reporter;
+}
+
+async function setupReporters(stream, reporters, destinations) {
+  const state = { __proto__: null, error: undefined, pending: [] };
+  try {
+    for (let i = 0; i < reporters.length; i++) {
+      const reporter = await loadReporter(reporters[i]);
+      const builtinDestination = kBuiltinDestinations.get(destinations[i]);
+      const destination = builtinDestination ??
+        createWriteStream(destinations[i], { __proto__: null, flush: true });
+      const pending = PromisePrototypeThen(pipeline(
+        stream,
+        reporter,
+        destination,
+        { __proto__: null, end: builtinDestination === undefined },
+      ), undefined, (error) => {
+        state.error ??= error;
+      });
+      ArrayPrototypePush(state.pending, pending);
+    }
+  } catch (error) {
+    stream.destroy();
+    await SafePromiseAllReturnVoid(state.pending);
+    throw error;
+  }
+  return state;
+}
+
+async function finishReporters(state) {
+  await SafePromiseAllReturnVoid(state.pending);
+  if (state.error !== undefined) throw state.error;
+}
+
+function emitRecord(stream, record) {
+  switch (record.type) {
+    case 'bench:plan':
+      return stream.plan(record.data);
+    case 'bench:start':
+      return stream.start(record.data);
+    case 'bench:sample':
+      return stream.sample(record.data);
+    case 'bench:complete':
+      return stream.complete(record.data);
+    case 'bench:diagnostic':
+      return stream.diagnostic(record.data);
+    case 'bench:summary':
+      return stream.summary(record.data);
+    default:
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark event type', record.type, 'is not recognized');
+  }
+}
+
+function emitRecordAndWait(stream, record) {
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  if (emitRecord(stream, record)) return undefined;
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  return stream.waitForDrain();
+}
+
+function serializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: serializeError(record.data.error),
+    },
+  };
+}
+
+function deserializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: deserializeError(record.data.error),
+    },
+  };
+}
+
+function isStringArray(value) {
+  if (!ArrayIsArray(value)) return false;
+  for (let i = 0; i < value.length; i++) {
+    if (typeof value[i] !== 'string') return false;
+  }
+  return true;
+}
+
+function isContextDiagnostic(record) {
+  return record.type === 'bench:diagnostic' &&
+    (record.data.benchId !== undefined ||
+     record.data.phase !== undefined ||
+     record.data.index !== undefined ||
+     record.data.detail !== undefined);
+}
+
+function validateRecord(record) {
+  if (record === null || typeof record !== 'object' ||
+      !kEventTypes.has(record.type) || record.data === null ||
+      typeof record.data !== 'object' ||
+      typeof record.data.runId !== 'string' ||
+      (record.data.fileRunId !== null &&
+       typeof record.data.fileRunId !== 'string') ||
+      (record.data.entryFile !== null &&
+       typeof record.data.entryFile !== 'string')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  const contextDiagnostic = isContextDiagnostic(record);
+  if ((record.type === 'bench:plan' || record.type === 'bench:start' ||
+       record.type === 'bench:sample' || record.type === 'bench:complete' ||
+       contextDiagnostic) &&
+      (typeof record.data.fileRunId !== 'string' ||
+       typeof record.data.benchId !== 'string' ||
+       (record.data.parentId !== null &&
+         typeof record.data.parentId !== 'string') ||
+        typeof record.data.name !== 'string' ||
+        !isStringArray(record.data.namePath))) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  if (record.type === 'bench:plan') {
+    const {
+      samples,
+      selected,
+      skip,
+      timeout,
+      warmup,
+      yieldBetweenSamples,
+    } = record.data;
+    if (!isStringArray(record.data.diagnosticChannels) ||
+        typeof record.data.file !== 'string' ||
+        !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+        !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+        !isStringArray(record.data.tags) ||
+        record.data.params === null ||
+        typeof record.data.params !== 'object' ||
+        ArrayIsArray(record.data.params) ||
+        (ObjectGetPrototypeOf(record.data.params) !== null &&
+         ObjectGetPrototypeOf(record.data.params) !== ObjectPrototype) ||
+        ArrayPrototypeSome(ObjectValues(record.data.params), (value) =>
+          typeof value !== 'string' && typeof value !== 'boolean' &&
+          (typeof value !== 'number' || !NumberIsFinite(value))) ||
+        !NumberIsSafeInteger(samples) || samples <= 0 ||
+        samples > 0xFFFFFFFF ||
+        !NumberIsSafeInteger(warmup) || warmup < 0 || warmup > 0xFFFFFFFF ||
+        (timeout !== null &&
+         (!NumberIsFinite(timeout) || timeout < 0 || timeout > TIMEOUT_MAX)) ||
+        typeof yieldBetweenSamples !== 'boolean' ||
+        typeof selected !== 'boolean' ||
+        (selected && skip !== undefined) ||
+        (!selected && skip !== true && typeof skip !== 'string')) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child plan', record.data,
+        'is not a valid benchmark plan');
+    }
+  }
+  if (contextDiagnostic &&
+      ((record.data.phase !== 'warmup' &&
+        record.data.phase !== 'measurement') ||
+       !NumberIsSafeInteger(record.data.index) || record.data.index < 0 ||
+       record.data.index > 0xFFFFFFFF ||
+       !ObjectPrototypeHasOwnProperty(record.data, 'message') ||
+       (record.data.level !== 'info' && record.data.level !== 'warning') ||
+       typeof record.data.file !== 'string' ||
+       !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+       !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+       record.data.error !== undefined)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child diagnostic', record.data,
+      'is not a valid benchmark diagnostic');
+  }
+  if (record.type === 'bench:summary') {
+    const { counts, duration_ns, success } = record.data;
+    if (typeof success !== 'boolean' || typeof duration_ns !== 'bigint' ||
+        counts === null || typeof counts !== 'object' ||
+        !NumberIsSafeInteger(counts.completed) || counts.completed < 0 ||
+        !NumberIsSafeInteger(counts.failed) || counts.failed < 0 ||
+        !NumberIsSafeInteger(counts.skipped) || counts.skipped < 0 ||
+        !NumberIsSafeInteger(counts.total) || counts.total < 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child summary', record.data,
+        'is not a valid benchmark summary');
+    }
+  }
+  return record;
+}
+
+let nextChildRecordId = 0;
+let listeningForAcks = false;
+const pendingChildRecordAcks = new SafeMap();
+
+function listenForAcks() {
+  if (listeningForAcks) return;
+  listeningForAcks = true;
+  process.on('message', (message) => {
+    if (message?.type !== kChildAckMessageType) return;
+    const pending = pendingChildRecordAcks.get(message.id);
+    if (pending === undefined) return;
+    pendingChildRecordAcks.delete(message.id);
+    pending.resolve();
+  });
+  process.once('disconnect', () => {
+    const error = new ERR_INVALID_STATE(
+      'benchmark IPC channel closed before acknowledging records');
+    for (const pending of pendingChildRecordAcks.values()) {
+      pending.reject(error);
+    }
+    pendingChildRecordAcks.clear();
+  });
+}
+
+function sendRecord(record) {
+  listenForAcks();
+  const id = nextChildRecordId++;
+  const acknowledged = PromiseWithResolvers();
+  pendingChildRecordAcks.set(id, acknowledged);
+  try {
+    process.send({
+      __proto__: null,
+      id,
+      type: kChildMessageType,
+      record: serializeRecord(record),
+    }, undefined, undefined, (error) => {
+      if (error) {
+        pendingChildRecordAcks.delete(id);
+        acknowledged.reject(error);
+      }
+    });
+  } catch (error) {
+    pendingChildRecordAcks.delete(id);
+    acknowledged.reject(error);
+  }
+  return acknowledged.promise;
+}
+
+function sendAck(child, id) {
+  return new Promise((resolve, reject) => {
+    if (!child.connected) {
+      reject(new ERR_INVALID_STATE(
+        'benchmark child disconnected before acknowledgement'));
+      return;
+    }
+    child.send({ __proto__: null, id, type: kChildAckMessageType },
+               undefined, undefined, (error) => {
+                 if (error) reject(error);
+                 else resolve();
+               });
+  });
+}
+
+async function loadUserImports(options) {
+  const parentURL = pathToFileURL(`${options.cwd}${sep}`).href;
+  const loader = esmLoader.getOrInitializeCascadedLoader();
+  const userImports = getOptionValue('--import');
+  for (let i = 0; i < userImports.length; i++) {
+    await loader.import(userImports[i], parentURL, kEmptyObject);
+  }
+  return { __proto__: null, loader, parentURL };
+}
+
+async function loadBenchmarkFiles(files, options, modules, onRecord) {
+  const { loader, parentURL } = modules;
+  let loadFailed = false;
+  for (let i = 0; i < files.length; i++) {
+    const file = resolve(options.cwd, files[i]);
+    try {
+      await runInFileScope(options.fileScopes[i], () =>
+        loader.import(pathToFileURL(file), parentURL, kEmptyObject));
+    } catch (error) {
+      loadFailed = true;
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...options.fileScopes[i],
+          message: error?.message ?? String(error),
+          error,
+          level: 'error',
+          file,
+        },
+      });
+    }
+  }
+
+  const stream = runBenchmarks({
+    __proto__: null,
+    namePattern: options.namePattern,
+    samples: options.samples,
+    warmup: options.warmup,
+  }, true);
+  let summary;
+  for await (const record of stream) {
+    if (record.type === 'bench:summary' && (process.exitCode ?? 0) !== 0) {
+      const scope = files.length === 1 ? options.fileScopes[0] : {
+        __proto__: null,
+        entryFile: null,
+        fileRunId: null,
+      };
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: `Benchmark process set exit code ${process.exitCode}`,
+          level: 'error',
+          file: files.length === 1 ?
+            resolve(options.cwd, files[0]) : null,
+        },
+      });
+    }
+    if (record.type === 'bench:summary' &&
+        (loadFailed || (process.exitCode ?? 0) !== 0)) {
+      record.data.success = false;
+    }
+    if (record.type === 'bench:summary') {
+      record.data.file = files.length === 1 ?
+        resolve(options.cwd, files[0]) : null;
+      record.data.fileRunId = files.length === 1 ?
+        options.fileScopes[0].fileRunId : null;
+      record.data.entryFile = files.length === 1 ?
+        options.fileScopes[0].entryFile : null;
+      summary = record.data;
+    }
+    await onRecord(record);
+  }
+  return summary;
+}
+
+function filterExecArgv(arg, index, args) {
+  const name = getOptionName(arg);
+  return !ArrayPrototypeIncludes(kFilterArgs, name) &&
+    !ArrayPrototypeSome(kFilterArgValues, (option) => {
+      return name === option ||
+        (option !== '--experimental-config-file' &&
+         index > 0 &&
+         StringPrototypeIndexOf(args[index - 1], '=') === -1 &&
+         getOptionName(args[index - 1]) === option);
+    });
+}
+
+function getOptionName(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  const name = equals === -1 ? arg : StringPrototypeSlice(arg, 0, equals);
+  return StringPrototypeReplaceAll(name, '_', '-');
+}
+
+function getRunFileOptionName(arg) {
+  if (StringPrototypeStartsWith(arg, '-') &&
+      !StringPrototypeStartsWith(arg, '--') && arg.length > 2) {
+    const shortName = StringPrototypeSlice(arg, 0, 2);
+    if (kIncompatibleExecArgv.has(shortName)) return shortName;
+  }
+  return getOptionName(arg);
+}
+
+function filterRunFileExecArgv(arg, index, args) {
+  if (!filterExecArgv(arg, index, args)) return false;
+  if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+    return false;
+  }
+  const name = getRunFileOptionName(arg);
+  if (kIncompatibleExecArgv.has(name)) return false;
+  if (index > 0) {
+    const previous = getRunFileOptionName(args[index - 1]);
+    if (kExecArgvWithValue.has(previous) &&
+        StringPrototypeIndexOf(args[index - 1], '=') === -1) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function runFileOptionRequiresValue(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  let name = getRunFileOptionName(arg);
+  const { aliases, options } = getCLIOptionsInfo();
+  let info = options.get(name);
+  if (info === undefined) {
+    const alias = aliases.get(name);
+    if (alias !== undefined) info = options.get(alias[0]);
+  }
+  if (info === undefined && StringPrototypeStartsWith(name, '--no-')) {
+    name = `--${StringPrototypeSlice(name, 5)}`;
+    info = options.get(name);
+  }
+  return info !== undefined && info.type >= 3 &&
+    (equals === -1 || equals === arg.length - 1);
+}
+
+const kOptionAliases = new SafeMap([
+  ['--loader', '--experimental-loader'],
+  ['-C', '--conditions'],
+  ['-r', '--require'],
+]);
+
+function getInheritedChildArgs() {
+  const nodeOptions = getOptionsAsFlagsFromBinding();
+  const args = ArrayPrototypeFilter(nodeOptions, filterExecArgv);
+  const nodeOptionNames = new SafeSet();
+  for (let i = 0; i < nodeOptions.length; i++) {
+    nodeOptionNames.add(getOptionName(nodeOptions[i]));
+  }
+  const unknownExecArgv = ArrayPrototypeFilter(
+    process.execArgv,
+    (arg, index, values) => {
+      if (!filterExecArgv(arg, index, values)) return false;
+      const optionName = getOptionName(arg);
+      const name = kOptionAliases.get(optionName) ?? optionName;
+      if (nodeOptionNames.has(name)) return false;
+      if (!StringPrototypeStartsWith(arg, '-') && index > 0) {
+        const previousName = getOptionName(values[index - 1]);
+        const previous = kOptionAliases.get(previousName) ?? previousName;
+        if (nodeOptionNames.has(previous)) return false;
+      }
+      return true;
+    },
+  );
+  ArrayPrototypePushApply(args, unknownExecArgv);
+  // Option serialization omits port 0, which would otherwise become 9229.
+  if (process.debugPort === 0) ArrayPrototypePush(args, '--inspect-port=0');
+  return args;
+}
+
+function getChildArgs(path, options) {
+  const args = options.execArgv === undefined ?
+    getInheritedChildArgs() : ArrayPrototypeSlice(options.execArgv);
+  ArrayPrototypePush(args, '--bench', '--bench-isolation=none');
+  if (options.namePatternSource.length > 0) {
+    ArrayPrototypePush(
+      args, `--bench-name-pattern=${options.namePatternSource}`);
+  }
+  if (options.samples !== undefined) {
+    ArrayPrototypePush(args, `--bench-samples=${options.samples}`);
+  }
+  if (options.warmup !== undefined) {
+    ArrayPrototypePush(args, `--bench-warmup=${options.warmup}`);
+  }
+  ArrayPrototypePush(args, '--', resolve(options.cwd, path));
+  return args;
+}
+
+async function runChild(path, options, scope, onRecord) {
+  if (options.signal?.aborted) {
+    return {
+      __proto__: null,
+      aborted: true,
+      error: new AbortError(undefined, {
+        __proto__: null,
+        cause: options.signal.reason,
+      }),
+    };
+  }
+  const resource = resolve(options.cwd, path);
+  if (permission.isEnabled() &&
+      !permission.has('fs.read', resource) &&
+      !permission.isAuditMode()) {
+    throw new ERR_ACCESS_DENIED(
+      'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+      'FileSystemRead',
+      resource,
+    );
+  }
+  const child = spawn(
+    options.execPath ?? process.execPath,
+    getChildArgs(path, options),
+    {
+      __proto__: null,
+      cwd: options.cwd,
+      env: {
+        __proto__: null,
+        ...(options.env ?? process.env),
+        NODE_BENCH_CONTEXT: 'child',
+        NODE_BENCH_FILE_RUN_ID: scope.fileRunId,
+        NODE_BENCH_RUN_ID: options.runId,
+      },
+      serialization: 'advanced',
+      stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
+    },
+  );
+  let childClosed = false;
+  let forceKillTimer;
+  const terminateChild = () => {
+    if (childClosed) return;
+    child.kill();
+    forceKillTimer ??= setTimeout(() => {
+      child.kill('SIGKILL');
+    }, kForceKillDelay);
+  };
+  const closed = PromiseWithResolvers();
+  let closeTracked = false;
+  let spawnError;
+  try {
+    child.once('close', (...status) => closed.resolve(status));
+    closeTracked = true;
+    child.once('error', (error) => {
+      spawnError ??= error;
+      terminateChild();
+    });
+  } catch (error) {
+    terminateChild();
+    if (closeTracked) {
+      try {
+        await closed.promise;
+      } catch {
+        // Preserve the setup error.
+      }
+    }
+    throw error;
+  }
+  let protocolError;
+  let abortError;
+  let aborted = false;
+  let activeBenchId;
+  let plansComplete = false;
+  let recordPending = false;
+  let summaryReceived = false;
+  let abortListener;
+  const closeListener = () => {
+    terminateChild();
+  };
+  try {
+    if (options.signal !== undefined) {
+      abortListener = addAbortListener(options.signal, () => {
+        aborted = true;
+        abortError = new AbortError(undefined, {
+          __proto__: null,
+          cause: options.signal.reason,
+        });
+        terminateChild();
+      });
+    }
+    options.output?.once('close', closeListener);
+    if (options.output?.destroyed) closeListener();
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  const pendingRecords = new SafeSet();
+  const handleRecord = (record) => {
+    if (protocolError !== undefined) return;
+    try {
+      return onRecord(record);
+    } catch (error) {
+      protocolError = error;
+      terminateChild();
+    }
+  };
+  const trackPending = (pending, source) => {
+    if (pending === undefined) return;
+    source?.pause();
+    const tracked = PromisePrototypeThen(PromiseResolve(pending), () => {
+      pendingRecords.delete(tracked);
+      source?.resume();
+    }, (error) => {
+      pendingRecords.delete(tracked);
+      if (!aborted) protocolError ??= error;
+      terminateChild();
+    });
+    pendingRecords.add(tracked);
+  };
+  const reportOutput = (source, stream, message) => {
+    const pending = handleRecord({
+      __proto__: null,
+      type: 'bench:diagnostic',
+      data: {
+        __proto__: null,
+        runId: options.runId,
+        ...scope,
+        message,
+        level: 'info',
+        file: path,
+        stream,
+      },
+    });
+    trackPending(pending, source);
+  };
+  try {
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (data) => {
+      reportOutput(child.stdout, 'stdout', data);
+    });
+    child.stderr.on('data', (data) => {
+      reportOutput(child.stderr, 'stderr', data);
+    });
+    child.on('message', (message) => {
+      if (message?.type !== kChildMessageType) return;
+      try {
+        if (!NumberIsSafeInteger(message.id) || message.id < 0 || recordPending) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid record sequence');
+        }
+        recordPending = true;
+        const record = deserializeRecord(validateRecord(message.record));
+        const contextDiagnostic = isContextDiagnostic(record);
+        if (summaryReceived || (record.type === 'bench:plan' && plansComplete) ||
+            (record.type === 'bench:start' && activeBenchId !== undefined) ||
+            ((record.type === 'bench:sample' || contextDiagnostic) &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:complete' && activeBenchId !== undefined &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:summary' && activeBenchId !== undefined)) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid lifecycle sequence');
+        }
+        if (record.type !== 'bench:plan' &&
+            record.type !== 'bench:diagnostic') {
+          plansComplete = true;
+        }
+        if (record.type === 'bench:start') {
+          activeBenchId = record.data.benchId;
+        } else if (record.type === 'bench:complete' &&
+                   activeBenchId === record.data.benchId) {
+          activeBenchId = undefined;
+        }
+        if (record.type === 'bench:summary') summaryReceived = true;
+        record.data.runId = options.runId;
+        record.data.fileRunId = scope.fileRunId;
+        if (record.data.entryFile !== null) {
+          record.data.entryFile = scope.entryFile;
+        }
+        const pending = handleRecord(record);
+        if (protocolError === undefined) {
+          const acknowledged = PromisePrototypeThen(
+            PromiseResolve(pending), () => sendAck(child, message.id));
+          trackPending(PromisePrototypeThen(acknowledged, () => {
+            recordPending = false;
+          }));
+        }
+      } catch (error) {
+        if (!aborted) protocolError ??= error;
+        terminateChild();
+      }
+    });
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  let status;
+  try {
+    status = await closed.promise;
+  } finally {
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+  }
+  const { 0: code, 1: signal } = status;
+  await SafePromiseAllReturnVoid(ArrayFrom(pendingRecords));
+  if (!aborted && spawnError !== undefined) throw spawnError;
+  if (!aborted && protocolError !== undefined) throw protocolError;
+  return {
+    __proto__: null,
+    aborted,
+    code,
+    error: abortError,
+    signal,
+  };
+}
+
+async function runIsolated(files, options, output) {
+  const counts = {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 0,
+  };
+  const start = hrtime();
+  let success = true;
+
+  for (let i = 0; i < files.length; i++) {
+    const path = files[i];
+    const scope = options.fileScopes[i];
+    const observedCounts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    let childSummary;
+    let result;
+    try {
+      result = await runChild(path, options, scope, (record) => {
+        if (record.type === 'bench:summary') {
+          childSummary = record.data;
+          return;
+        }
+        if (record.type === 'bench:plan') observedCounts.total++;
+        if (record.type === 'bench:complete') {
+          if (ObjectPrototypeHasOwnProperty(record.data, 'error')) {
+            observedCounts.failed++;
+          } else if (ObjectPrototypeHasOwnProperty(record.data, 'skip')) {
+            observedCounts.skipped++;
+          } else {
+            observedCounts.completed++;
+          }
+        }
+        return emitRecordAndWait(output, record);
+      });
+    } catch (error) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: error.message,
+          error,
+          level: 'error',
+          file: path,
+        },
+      });
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
+      continue;
+    }
+
+    if (result.aborted) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: result.error.message,
+          error: result.error,
+          level: 'error',
+          file: path,
+        },
+      });
+    }
+    if (childSummary !== undefined) {
+      success &&= childSummary.success;
+      counts.completed += childSummary.counts.completed;
+      counts.failed += childSummary.counts.failed;
+      counts.skipped += childSummary.counts.skipped;
+      counts.total += childSummary.counts.total;
+    } else {
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
+    }
+    if (!result.aborted && (childSummary === undefined || result.code !== 0 ||
+        result.signal !== null)) {
+      success = false;
+      if (childSummary === undefined || childSummary.success) {
+        const status = result.signal === null ?
+          `exit code ${result.code}` : `signal ${result.signal}`;
+        await emitRecordAndWait(output, {
+          __proto__: null,
+          type: 'bench:diagnostic',
+          data: {
+            __proto__: null,
+            runId: options.runId,
+            ...scope,
+            message: `Benchmark file '${path}' failed with ${status}`,
+            level: 'error',
+            file: path,
+          },
+        });
+      }
+    }
+  }
+
+  const scope = files.length === 1 ? options.fileScopes[0] : null;
+  const summary = {
+    __proto__: null,
+    runId: options.runId,
+    fileRunId: scope?.fileRunId ?? null,
+    entryFile: scope?.entryFile ?? null,
+    success: success && (options.useProcessExitCode === false ||
+      (process.exitCode ?? 0) === 0),
+    counts,
+    duration_ns: hrtime() - start,
+    file: files.length === 1 ? resolve(options.cwd, files[0]) : null,
+  };
+  await emitRecordAndWait(output, {
+    __proto__: null,
+    type: 'bench:summary',
+    data: summary,
+  });
+  return summary;
+}
+
+function runFile(path, options = kEmptyObject) {
+  path = getValidatedPath(path);
+  if (typeof path !== 'string') path = BufferToString(path);
+  const file = resolve(path);
+  validateObject(options, 'options');
+  const {
+    env = process.env,
+    execArgv,
+    signal,
+  } = options;
+  let childExecArgv;
+  if (execArgv !== undefined) {
+    validateArray(execArgv, 'options.execArgv');
+    childExecArgv = [];
+    const length = execArgv.length;
+    for (let i = 0; i < length; i++) {
+      const arg = execArgv[i];
+      validateStringWithoutNullBytes(arg, `options.execArgv[${i}]`);
+      if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must be a Node.js command-line option');
+      }
+      if (kIncompatibleExecArgv.has(getRunFileOptionName(arg))) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'is not compatible with benchmark execution');
+      }
+      if (runFileOptionRequiresValue(arg)) {
+        const equals = StringPrototypeIndexOf(arg, '=');
+        if (equals !== -1) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must include a non-empty value');
+        }
+        if (i + 1 >= length) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must be followed by a value');
+        }
+        ArrayPrototypePush(childExecArgv, arg);
+        i++;
+        const value = execArgv[i];
+        validateStringWithoutNullBytes(value, `options.execArgv[${i}]`);
+        if (value.length === 0) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, value,
+            'must not be empty');
+        }
+        ArrayPrototypePush(childExecArgv, value);
+        continue;
+      }
+      if (!StringPrototypeStartsWith(arg, '--') &&
+          StringPrototypeIndexOf(arg, '=') !== -1) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must not use = with a short option');
+      }
+      ArrayPrototypePush(childExecArgv, arg);
+    }
+    if (ArrayPrototypeFilter(childExecArgv, filterExecArgv).length !==
+        childExecArgv.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.execArgv', childExecArgv,
+        'must not contain benchmark runner options');
+    }
+  } else {
+    childExecArgv = ArrayPrototypeFilter(
+      getInheritedChildArgs(), filterRunFileExecArgv);
+  }
+  validateObject(env, 'options.env');
+  const childEnv = { __proto__: null };
+  const envKeys = ObjectKeys(env);
+  for (let i = 0; i < envKeys.length; i++) {
+    const key = envKeys[i];
+    validateStringWithoutNullBytes(key, 'options.env key');
+    const value = env[key];
+    if (value === undefined) continue;
+    validateStringWithoutNullBytes(value, `options.env.${key}`);
+    if (kIPCEnvironmentVariables.has(StringPrototypeToUpperCase(key))) continue;
+    childEnv[key] = value;
+  }
+  validateAbortSignal(signal, 'options.signal');
+  if (signal !== undefined &&
+      (typeof signal.addEventListener !== 'function' ||
+       typeof signal.removeEventListener !== 'function')) {
+    throw new ERR_INVALID_ARG_TYPE('options.signal', 'AbortSignal', signal);
+  }
+
+  const runId = createRunId();
+  const scope = {
+    __proto__: null,
+    entryFile: file,
+    fileRunId: createRunId(),
+  };
+  const output = new BenchmarksStream();
+  const runOptions = {
+    __proto__: null,
+    cwd: process.cwd(),
+    env: childEnv,
+    execPath: process.execPath,
+    execArgv: childExecArgv,
+    fileScopes: [scope],
+    namePatternSource: '',
+    output,
+    runId,
+    signal,
+    useProcessExitCode: false,
+  };
+  const execution = PromisePrototypeThen(PromiseResolve(), () =>
+    (output.destroyed ? undefined : runIsolated([file], runOptions, output)));
+  PromisePrototypeThen(execution, () => output.end(),
+                       (error) => output.destroy(error));
+  return output;
+}
+
+async function run(patterns) {
+  const options = parseCommandLine();
+  const files = options.isChild ?
+    createChildFileList(patterns, options.cwd) :
+    createBenchmarkFileList(patterns, options.cwd);
+  if (files === null) return { __proto__: null, success: false };
+
+  options.runId ??= createRunId();
+  options.fileScopes = createFileScopes(files, options);
+  const scope = files.length === 1 ? options.fileScopes[0] : {
+    __proto__: null,
+    entryFile: null,
+    fileRunId: options.runId,
+  };
+  configureRunScope({
+    __proto__: null,
+    runId: options.runId,
+    ...scope,
+  });
+
+  if (options.isChild) {
+    try {
+      const modules = await loadUserImports(options);
+      return await loadBenchmarkFiles(
+        files, options, modules, sendRecord);
+    } finally {
+      if (process.connected) process.disconnect();
+    }
+  }
+
+  const output = new BenchmarksStream();
+  let executionError;
+  let reporterState;
+  let summary;
+  try {
+    options.modules = await loadUserImports(options);
+    reporterState = await setupReporters(
+      output, options.reporters, options.destinations);
+    if (options.isolation === 'process') {
+      summary = await runIsolated(files, options, output);
+    } else {
+      summary = await loadBenchmarkFiles(
+        files,
+        options,
+        options.modules,
+        (record) => emitRecordAndWait(output, record),
+      );
+    }
+  } catch (error) {
+    executionError = error;
+  } finally {
+    output.end();
+  }
+  if (reporterState !== undefined) await finishReporters(reporterState);
+  if (executionError !== undefined) throw executionError;
+  return summary;
+}
+
+module.exports = { run, runFile };
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
new file mode 100644
index 000000000000..985440634217
--- /dev/null
+++ b/lib/internal/bench_runner/harness.js
@@ -0,0 +1,1139 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  BigInt,
+  FunctionPrototypeCall,
+  JSONStringify,
+  MathCeil,
+  Number,
+  Promise,
+  PromisePrototypeThen,
+  PromiseResolve,
+  PromiseWithResolvers,
+  ReflectApply,
+  RegExp,
+  RegExpPrototypeExec,
+  SafeMap,
+  SafePromiseRace,
+  String,
+  SymbolDispose,
+} = primordials;
+const { getCallerLocation } = internalBinding('util');
+const { exitCodes: { kGenericUserError } } = internalBinding('errors');
+const { AsyncLocalStorage } = require('async_hooks');
+const {
+  subscribe: subscribeToChannel,
+  unsubscribe: unsubscribeFromChannel,
+} = require('diagnostics_channel');
+const { AbortController } = require('internal/abort_controller');
+const {
+  AbortError,
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_OPERATION_FAILED,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  kEmptyObject,
+} = require('internal/util');
+const { isRegExp } = require('internal/util/types');
+const {
+  validateAbortSignal,
+  validateBoolean,
+  validateFunction,
+  validateObject,
+  validateUint32,
+} = require('internal/validators');
+const { queueMicrotask } = require('internal/process/task_queues');
+const { getOptionValue } = require('internal/options');
+const { clearTimeout, setImmediate, setTimeout } = require('timers');
+const {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+} = require('internal/bench_runner/benchmark');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+
+const { bigint: hrtime } = process.hrtime;
+const kCancellationGracePeriod = 100;
+const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
+const kIsCliRunner = getOptionValue('--bench');
+let nextRunId = 0;
+
+function createRunId() {
+  return `${process.pid}:${String(hrtime())}:${nextRunId++}`;
+}
+
+function eventLoopTurn() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+async function settlesPromptly(work) {
+  const timeout = PromiseWithResolvers();
+  const timer = setTimeout(
+    () => timeout.resolve(false), kCancellationGracePeriod);
+  try {
+    return await SafePromiseRace([
+      PromisePrototypeThen(work, () => true, () => true),
+      timeout.promise,
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function createAbortError(signal) {
+  return new AbortError(undefined, { __proto__: null, cause: signal.reason });
+}
+
+function createTimeoutError(benchmark) {
+  return new ERR_OPERATION_FAILED(
+    `Benchmark timed out after ${benchmark.timeout}ms`);
+}
+
+class Harness {
+  #abortReason = null;
+  #autoRun;
+  #buildPromises = [];
+  #duplicateErrors = new SafeMap();
+  #explicitRun = false;
+  #fileScopeStorage = new AsyncLocalStorage();
+  #hasOnly = false;
+  #runPromise = null;
+  #scheduled = false;
+  #starting = false;
+  #storage = new AsyncLocalStorage();
+  #yieldBetweenSamples;
+
+  constructor(options = kEmptyObject) {
+    validateObject(options, 'options');
+    const {
+      autoRun = true,
+      yieldBetweenSamples = true,
+    } = options;
+    validateBoolean(autoRun, 'options.autoRun');
+    validateBoolean(
+      yieldBetweenSamples, 'options.yieldBetweenSamples');
+    this.#autoRun = autoRun;
+    this.#yieldBetweenSamples = yieldBetweenSamples;
+    this.runId = createRunId();
+    this.fileRunId = this.runId;
+    this.entryFile = process.argv?.[1] ?? null;
+    this.stream = new BenchmarksStream();
+    this.state = 'collecting';
+    this.namePattern = null;
+    this.outerSignal = undefined;
+    this.samples = undefined;
+    this.success = true;
+    this.warmup = undefined;
+    this.counts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    this.root = new Suite(
+      this,
+      null,
+      '<root>',
+      kEmptyObject,
+      undefined,
+      undefined,
+      true,
+    );
+  }
+
+  getFileScope() {
+    return this.#fileScopeStorage.getStore() ?? null;
+  }
+
+  runInFileScope(scope, fn) {
+    return this.#fileScopeStorage.run(scope, fn);
+  }
+
+  setRunScope({ entryFile, fileRunId, runId }) {
+    if (this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE(
+        'benchmark execution scope cannot change after execution has started');
+    }
+    this.entryFile = entryFile;
+    this.fileRunId = fileRunId;
+    this.runId = runId;
+  }
+
+  #ensureCollecting() {
+    if (this.state === 'building' &&
+        this.#storage.getStore() instanceof Suite) return;
+    if (!this.#explicitRun && !this.#starting &&
+        this.state === 'collecting') return;
+    throw new ERR_INVALID_STATE(
+      'benchmarks cannot be declared after execution has started');
+  }
+
+  #getParent() {
+    const current = this.#storage.getStore();
+    return current instanceof Suite ? current : this.root;
+  }
+
+  createBench(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('benchmark', name, options, fn);
+    const parent = this.#getParent();
+    const benchmark = new Bench(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, benchmark);
+    this.#schedule();
+    return parent.isRoot ? benchmark.completion.promise : PromiseResolve();
+  }
+
+  createSuite(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('suite', name, options, fn);
+    const parent = this.#getParent();
+    const suite = new Suite(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, suite);
+    this.#buildSuite(suite);
+    this.#schedule();
+    return parent.isRoot ? suite.completion.promise : PromiseResolve();
+  }
+
+  createHook(name, fn, options = kEmptyObject) {
+    this.#ensureCollecting();
+    validateFunction(fn, 'hook function');
+    validateObject(options, 'options');
+    const parent = this.#getParent();
+    ArrayPrototypePush(parent.hooks[name], {
+      __proto__: null,
+      fileScope: parent.isRoot ? this.getFileScope() : parent.fileScope,
+      fn,
+      loc: getCallerLocation(),
+    });
+    this.#schedule();
+  }
+
+  #buildSuite(suite) {
+    let result;
+    try {
+      result = suite.runInAsyncScope(() => this.#storage.run(
+        suite,
+        () => FunctionPrototypeCall(suite.fn),
+      ));
+    } catch (error) {
+      suite.buildError = error;
+      result = undefined;
+    }
+
+    suite.buildPromise = PromisePrototypeThen(
+      PromiseResolve(result),
+      undefined,
+      (error) => {
+        suite.buildError = error;
+      },
+    );
+    ArrayPrototypePush(this.#buildPromises, suite.buildPromise);
+  }
+
+  configure(options = kEmptyObject) {
+    validateObject(options, 'options');
+
+    const {
+      namePattern,
+      samples,
+      signal,
+      warmup,
+      yieldBetweenSamples,
+    } = options;
+    let nextNamePattern = this.namePattern;
+    let nextSamples = this.samples;
+    let nextWarmup = this.warmup;
+    let nextYieldBetweenSamples = this.#yieldBetweenSamples;
+    if (namePattern !== undefined) {
+      if (typeof namePattern === 'string') {
+        nextNamePattern = new RegExp(namePattern);
+      } else if (isRegExp(namePattern)) {
+        nextNamePattern = new RegExp(namePattern);
+      } else {
+        throw new ERR_INVALID_ARG_TYPE(
+          'options.namePattern', ['string', 'RegExp'], namePattern);
+      }
+    }
+    if (samples !== undefined) {
+      validateUint32(samples, 'options.samples', true);
+      nextSamples = samples;
+    }
+    validateAbortSignal(signal, 'options.signal');
+    if (warmup !== undefined) {
+      validateUint32(warmup, 'options.warmup');
+      nextWarmup = warmup;
+    }
+    if (yieldBetweenSamples !== undefined) {
+      validateBoolean(
+        yieldBetweenSamples, 'options.yieldBetweenSamples');
+      nextYieldBetweenSamples = yieldBetweenSamples;
+    }
+
+    this.namePattern = nextNamePattern;
+    this.samples = nextSamples;
+    this.outerSignal = signal;
+    this.warmup = nextWarmup;
+    this.#yieldBetweenSamples = nextYieldBetweenSamples;
+  }
+
+  #ensureCanRun() {
+    if (this.#explicitRun || this.#starting || this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE('benchmark execution has already started');
+    }
+  }
+
+  run(options = kEmptyObject, force = false) {
+    if (kIsCliRunner && !force) {
+      throw new ERR_INVALID_STATE(
+        'run() cannot be called from a file run with --bench');
+    }
+    this.#ensureCanRun();
+    this.#starting = true;
+    try {
+      this.configure(options);
+      this.#explicitRun = true;
+    } finally {
+      this.#starting = false;
+    }
+    this.#schedule(force, true);
+    return this.stream;
+  }
+
+  #schedule(force = false, explicit = false) {
+    if (!force && kIsCliRunner) return;
+    if (!explicit && !this.#autoRun) return;
+    if (this.#scheduled) return;
+    this.#scheduled = true;
+    queueMicrotask(() => {
+      if (this.#runPromise === null) {
+        if (!this.#explicitRun) this.stream.resume();
+        this.#runPromise = PromisePrototypeThen(
+          this.#execute(), undefined, (error) => this.#recover(error));
+      }
+    });
+  }
+
+  async #recover(error) {
+    this.#settleSubtree(this.root, error);
+    if (this.state !== 'finished') {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the original error.
+      }
+    }
+    try {
+      await this.#finish();
+    } catch {
+      // Stream failure has already been reported to its consumer.
+    }
+  }
+
+  #settleSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child.finished) continue;
+      if (child instanceof Suite) {
+        this.#settleSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+      } else {
+        this.success = false;
+        this.counts.failed++;
+        const result = this.#createResult(
+          child, [], { __proto__: null, error });
+        child.finished = true;
+        child.result = result;
+        child.completion.resolve(result);
+      }
+      child.emitDestroy();
+    }
+  }
+
+  async #waitForBuild() {
+    for (let i = 0; i < this.#buildPromises.length; i++) {
+      await this.#buildPromises[i];
+    }
+  }
+
+  #walk(node, callback) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      callback(child);
+      if (child instanceof Suite) this.#walk(child, callback);
+    }
+  }
+
+  #prepare() {
+    const identities = new SafeMap();
+    this.#walk(this.root, (node) => {
+      if (node.only) this.#hasOnly = true;
+      if (!(node instanceof Bench)) return;
+
+      this.counts.total++;
+      const identity = JSONStringify([
+        this.#getRecordScope(node).fileRunId,
+        node.benchId,
+      ]);
+      const existing = identities.get(identity);
+      if (existing === undefined) {
+        identities.set(identity, node);
+      } else {
+        this.#duplicateErrors.set(node, new ERR_INVALID_STATE(
+          `duplicate benchmark identity for "${node.fullName}"`));
+      }
+    });
+  }
+
+  async #emitPlans() {
+    const benchmarks = [];
+    this.#walk(this.root, (node) => {
+      if (node instanceof Bench) ArrayPrototypePush(benchmarks, node);
+    });
+    for (let i = 0; i < benchmarks.length; i++) {
+      const benchmark = benchmarks[i];
+      const skip = this.#getSkip(benchmark);
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        diagnosticChannels: ArrayPrototypeSlice(benchmark.diagnosticChannels),
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+        tags: ArrayPrototypeSlice(benchmark.tags),
+        params: benchmark.params,
+        samples: this.samples ?? benchmark.samples,
+        warmup: this.warmup ?? benchmark.warmup,
+        timeout: benchmark.timeout === Infinity ? null : benchmark.timeout,
+        yieldBetweenSamples: this.#yieldBetweenSamples,
+        selected: skip === null,
+      };
+      if (skip !== null) data.skip = skip;
+      await this.#waitForStream(this.stream.plan(data));
+    }
+  }
+
+  #hasSelectedAncestor(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.only) return true;
+    }
+    return false;
+  }
+
+  #getSkip(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.skip !== undefined && current.skip !== false) {
+        return current.skip;
+      }
+    }
+    if (this.#hasOnly && !this.#hasSelectedAncestor(benchmark)) return 'only';
+    if (this.namePattern !== null) {
+      this.namePattern.lastIndex = 0;
+      if (RegExpPrototypeExec(this.namePattern, benchmark.fullName) === null) {
+        return 'name pattern';
+      }
+    }
+    return null;
+  }
+
+  #suiteHasActiveBench(suite) {
+    for (let i = 0; i < suite.children.length; i++) {
+      const child = suite.children[i];
+      if (child instanceof Suite) {
+        if (this.#suiteHasActiveBench(child)) return true;
+      } else if (this.#getSkip(child) === null) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  async #invoke(resource, store, fn, args) {
+    const result = resource.runInAsyncScope(() => this.#storage.run(
+      store,
+      () => ReflectApply(fn, undefined, args),
+    ));
+    return PromiseResolve(result);
+  }
+
+  async #runHooks(suite, name, resource, store, context) {
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      await this.#invoke(resource, store, hooks[i].fn, [context]);
+    }
+  }
+
+  async #runSuiteHooks(suite, name) {
+    const context = {
+      __proto__: null,
+      name: suite.name,
+      signal: this.outerSignal,
+    };
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      try {
+        await this.#invoke(suite, suite, hooks[i].fn, [context]);
+      } catch (error) {
+        return { __proto__: null, error, hook: hooks[i] };
+      }
+    }
+    return null;
+  }
+
+  #getRecordScope(node = undefined) {
+    const scope = node?.fileScope;
+    if (scope !== null && scope !== undefined) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: scope.fileRunId,
+        entryFile: scope.entryFile,
+      };
+    }
+    if (node !== undefined && kIsCliRunner) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: this.fileRunId,
+        entryFile: null,
+      };
+    }
+    return {
+      __proto__: null,
+      runId: this.runId,
+      fileRunId: this.fileRunId,
+      entryFile: this.entryFile,
+    };
+  }
+
+  async #waitForStream(canContinue) {
+    if (canContinue) return;
+    try {
+      await this.stream.waitForDrain();
+    } catch (error) {
+      if (!this.stream.destroyed) throw error;
+    }
+  }
+
+  async #diagnostic(error, loc, level = 'info', node = undefined) {
+    this.success = false;
+    await this.#waitForStream(this.stream.diagnostic({
+      __proto__: null,
+      ...this.#getRecordScope(node),
+      message: error?.message ?? `${error}`,
+      error,
+      level,
+      file: loc?.file ?? loc?.[2],
+      line: loc?.line ?? loc?.[0],
+      column: loc?.column ?? loc?.[1],
+    }));
+  }
+
+  async #emitSampleDiagnostics(benchmark, phase, index, diagnostics) {
+    for (let i = 0; i < diagnostics.length; i++) {
+      const diagnostic = diagnostics[i];
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        phase,
+        index,
+        message: diagnostic.message,
+        level: diagnostic.level,
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+      };
+      if (diagnostic.detail !== undefined) data.detail = diagnostic.detail;
+      await this.#waitForStream(this.stream.diagnostic(data));
+    }
+  }
+
+  async #completeSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child instanceof Suite) {
+        await this.#completeSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+        child.emitDestroy();
+      } else {
+        await this.#executeBench(child, error);
+      }
+    }
+  }
+
+  async #executeSuite(suite) {
+    if (this.#abortReason !== null) {
+      await this.#completeSubtree(suite, this.#abortReason);
+      suite.finished = true;
+      suite.completion.resolve();
+      if (!suite.isRoot) suite.emitDestroy();
+      return;
+    }
+
+    if (suite.buildError !== null) {
+      await this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
+      await this.#completeSubtree(suite, suite.buildError);
+      suite.finished = true;
+      suite.completion.resolve();
+      suite.emitDestroy();
+      return;
+    }
+
+    const active = this.#suiteHasActiveBench(suite);
+    let beforeError;
+    if (active) {
+      const failure = await this.#runSuiteHooks(suite, 'before');
+      if (failure !== null) {
+        beforeError = failure.error;
+        await this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
+      }
+    }
+
+    if (beforeError !== undefined) {
+      await this.#completeSubtree(suite, beforeError);
+    } else {
+      for (let i = 0; i < suite.children.length; i++) {
+        const child = suite.children[i];
+        if (child instanceof Suite) {
+          await this.#executeSuite(child);
+        } else {
+          await this.#executeBench(child);
+        }
+      }
+    }
+
+    if (active && this.#abortReason === null) {
+      const failure = await this.#runSuiteHooks(suite, 'after');
+      if (failure !== null) {
+        await this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
+      }
+    }
+    suite.finished = true;
+    suite.completion.resolve();
+    if (!suite.isRoot) suite.emitDestroy();
+  }
+
+  #getHookSuites(benchmark) {
+    const suites = [];
+    for (let current = benchmark.parent; current !== null; current = current.parent) {
+      ArrayPrototypePush(suites, current);
+    }
+    ArrayPrototypeReverse(suites);
+    return suites;
+  }
+
+  async #runBenchHooks(benchmark, name, context) {
+    const suites = this.#getHookSuites(benchmark);
+    if (name === 'afterEach') ArrayPrototypeReverse(suites);
+    for (let i = 0; i < suites.length; i++) {
+      await this.#runHooks(
+        suites[i], name, benchmark, benchmark, context);
+    }
+  }
+
+  async #runWithStop(benchmark, controller, callback, deadline) {
+    const signals = [];
+    if (this.outerSignal !== undefined) {
+      ArrayPrototypePush(signals, this.outerSignal);
+    }
+    if (benchmark.outerSignal !== undefined &&
+        benchmark.outerSignal !== this.outerSignal) {
+      ArrayPrototypePush(signals, benchmark.outerSignal);
+    }
+
+    for (let i = 0; i < signals.length; i++) {
+      if (signals[i].aborted) {
+        const error = createAbortError(signals[i]);
+        controller.abort(error);
+        throw error;
+      }
+    }
+
+    const stop = PromiseWithResolvers();
+    const listeners = [];
+    let pausedWork;
+    let timer;
+    for (let i = 0; i < signals.length; i++) {
+      const signal = signals[i];
+      ArrayPrototypePush(listeners, addAbortListener(signal, () => {
+        const error = createAbortError(signal);
+        controller.abort(error);
+        stop.reject(error);
+      }));
+    }
+    const armTimer = () => {
+      let remaining = deadline.value - hrtime();
+      if (remaining < 0n) remaining = 0n;
+      timer = setTimeout(() => {
+        const error = createTimeoutError(benchmark);
+        controller.abort(error);
+        stop.reject(error);
+      }, Number(remaining) / 1e6);
+    };
+    if (deadline !== null) armTimer();
+
+    const pause = (work) => {
+      pausedWork = (async () => {
+        if (deadline === null) return work();
+        clearTimeout(timer);
+        timer = undefined;
+        const start = hrtime();
+        try {
+          return await work();
+        } finally {
+          deadline.value += hrtime() - start;
+          if (!controller.signal.aborted) armTimer();
+        }
+      })();
+      return pausedWork;
+    };
+
+    const work = callback(pause);
+    try {
+      if (signals.length === 0 && timer === undefined) return await work;
+      return await SafePromiseRace([work, stop.promise]);
+    } catch (error) {
+      try {
+        await pausedWork;
+      } catch {
+        // Preserve the error that stopped benchmark execution.
+      }
+      if (!await settlesPromptly(work) && this.#abortReason === null) {
+        this.#abortReason = new AbortError(
+          'The benchmark run was aborted because asynchronous work did not ' +
+          'settle after cancellation',
+          { __proto__: null, cause: error },
+        );
+      }
+      throw error;
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+      for (let i = 0; i < listeners.length; i++) {
+        listeners[i][SymbolDispose]();
+      }
+    }
+  }
+
+  async #runSample(benchmark, signal, phase, index) {
+    const diagnostics = [];
+    const context = new BenchContext(
+      benchmark, signal, phase, index,
+      (diagnostic) => ArrayPrototypePush(diagnostics, diagnostic));
+    const channels = benchmark.diagnosticChannels;
+    let abortSubscription;
+    let diagnosticError;
+    let diagnosticFailed = false;
+    let subscribed = 0;
+    const onMessage = (message, name) => {
+      if (signal.aborted || diagnosticFailed) return;
+      try {
+        context.diagnostic({ __proto__: null, name, message });
+      } catch (error) {
+        diagnosticError = error;
+        diagnosticFailed = true;
+      }
+    };
+    const unsubscribe = () => {
+      while (subscribed > 0) {
+        subscribed--;
+        unsubscribeFromChannel(channels[subscribed], onMessage);
+      }
+    };
+    try {
+      for (let i = 0; i < channels.length; i++) {
+        subscribeToChannel(channels[i], onMessage);
+        subscribed++;
+      }
+      if (subscribed > 0) {
+        abortSubscription = addAbortListener(signal, unsubscribe);
+      }
+      await this.#invoke(
+        benchmark, benchmark, benchmark.fn, [context]);
+      if (diagnosticFailed) throw diagnosticError;
+      const { done, sample } = context.finish();
+      return {
+        __proto__: null,
+        diagnostics,
+        done,
+        failed: false,
+        sample,
+      };
+    } catch (error) {
+      context.close();
+      return {
+        __proto__: null,
+        diagnostics,
+        error,
+        failed: true,
+      };
+    } finally {
+      abortSubscription?.[SymbolDispose]();
+      unsubscribe();
+    }
+  }
+
+  #createResult(benchmark, samples, extra = kEmptyObject) {
+    return {
+      __proto__: null,
+      ...this.#getRecordScope(benchmark),
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+      samples,
+      ...extra,
+    };
+  }
+
+  async #recordResult(benchmark, result) {
+    benchmark.finished = true;
+    benchmark.result = result;
+    let canContinue;
+    try {
+      canContinue = this.stream.complete(result);
+    } finally {
+      benchmark.completion.resolve(result);
+      benchmark.emitDestroy();
+    }
+    await this.#waitForStream(canContinue);
+  }
+
+  async #executeBench(benchmark, forcedError = undefined) {
+    const duplicateError = this.#duplicateErrors.get(benchmark);
+    if (duplicateError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: duplicateError },
+      ));
+      return;
+    }
+
+    const skip = this.#getSkip(benchmark);
+    if (skip !== null) {
+      this.counts.skipped++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, skip },
+      ));
+      return;
+    }
+
+    if (this.#abortReason !== null) forcedError = this.#abortReason;
+    if (forcedError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: forcedError },
+      ));
+      return;
+    }
+
+    await this.#waitForStream(this.stream.start({
+      __proto__: null,
+      ...this.#getRecordScope(benchmark),
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+    }));
+
+    const controller = new AbortController();
+    const deadline = benchmark.timeout === Infinity ? null : {
+      __proto__: null,
+      value: hrtime() + BigInt(MathCeil(benchmark.timeout * 1e6)),
+    };
+    const checkDeadline = () => {
+      if (deadline !== null && hrtime() >= deadline.value) {
+        const timeoutError = createTimeoutError(benchmark);
+        controller.abort(timeoutError);
+        throw timeoutError;
+      }
+    };
+    const samples = [];
+    const hookContext = {
+      __proto__: null,
+      name: benchmark.name,
+      params: benchmark.params,
+      signal: controller.signal,
+    };
+    let error;
+    let failed = false;
+    const runAfterEach = async () => {
+      await this.#runBenchHooks(
+        benchmark, 'afterEach', hookContext);
+      checkDeadline();
+    };
+
+    try {
+      await this.#runWithStop(benchmark, controller, async (pause) => {
+        try {
+          await this.#runBenchHooks(
+            benchmark, 'beforeEach', hookContext);
+          checkDeadline();
+          const warmup = this.warmup ?? benchmark.warmup;
+          const total = warmup + (this.samples ?? benchmark.samples);
+          for (let i = 0; i < total; i++) {
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            const phase = i < warmup ? 'warmup' : 'measurement';
+            const index = phase === 'warmup' ? i : i - warmup;
+            const outcome = await this.#runSample(
+              benchmark, controller.signal, phase, index);
+            if (!outcome.failed) {
+              checkDeadline();
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+              if (i >= warmup) {
+                ArrayPrototypePush(samples, outcome.sample);
+              }
+            }
+
+            let diagnosticError;
+            let diagnosticFailed = false;
+            if (outcome.diagnostics.length > 0 &&
+                !controller.signal.aborted) {
+              try {
+                await pause(() => this.#emitSampleDiagnostics(
+                  benchmark, phase, index, outcome.diagnostics));
+              } catch (cause) {
+                diagnosticFailed = true;
+                diagnosticError = cause;
+              }
+            }
+            if (outcome.failed) throw outcome.error;
+            if (diagnosticFailed) throw diagnosticError;
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            if (i >= warmup) {
+              await pause(() => this.#waitForStream(this.stream.sample({
+                __proto__: null,
+                ...this.#getRecordScope(benchmark),
+                benchId: benchmark.benchId,
+                parentId: benchmark.parentId,
+                name: benchmark.name,
+                namePath: ArrayPrototypeSlice(benchmark.namePath),
+                index: i - warmup,
+                ...outcome.sample,
+              })));
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+            }
+            if (outcome.done) break;
+            if (i + 1 < total && this.#yieldBetweenSamples) {
+              await eventLoopTurn();
+            }
+          }
+        } finally {
+          await runAfterEach();
+        }
+      }, deadline);
+    } catch (cause) {
+      failed = true;
+      error = cause;
+    } finally {
+      controller.abort();
+    }
+
+    if (failed) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        samples,
+        { __proto__: null, error },
+      ));
+      return;
+    }
+
+    this.counts.completed++;
+    await this.#recordResult(benchmark, this.#createResult(
+      benchmark,
+      samples,
+      { __proto__: null, summary: summarizeSamples(samples) },
+    ));
+  }
+
+  async #finish(startTime) {
+    if (this.state === 'finished') return;
+    this.state = 'finished';
+    const duration = startTime === undefined ? 0n : hrtime() - startTime;
+    try {
+      await this.#waitForStream(this.stream.summary({
+        __proto__: null,
+        ...this.#getRecordScope(),
+        success: this.success,
+        counts: this.counts,
+        duration_ns: duration,
+        file: this.entryFile,
+      }));
+    } catch (error) {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the summary listener error.
+      }
+    } finally {
+      this.stream.end();
+      this.root.finished = true;
+      this.root.completion.resolve();
+      this.root.emitDestroy();
+      this.#storage.disable();
+      if (!this.#explicitRun && !this.success) {
+        process.exitCode = kGenericUserError;
+      }
+    }
+  }
+
+  async #execute() {
+    this.state = 'building';
+    const startTime = hrtime();
+    await this.#waitForBuild();
+    this.#fileScopeStorage.disable();
+    this.#prepare();
+    this.state = 'running';
+    await this.#emitPlans();
+    await this.#executeSuite(this.root);
+    await this.#finish(startTime);
+  }
+}
+
+let globalHarness;
+
+function lazyHarness() {
+  globalHarness ??= new Harness();
+  return globalHarness;
+}
+
+function createDeclaration(type, getHarness) {
+  const declare = (name, options, fn, overrides = kEmptyObject) => {
+    const harness = getHarness();
+    const loc = getCallerLocation();
+    const declarationOptions = { __proto__: null, ...overrides, loc };
+    return type === 'benchmark' ?
+      harness.createBench(name, options, fn, declarationOptions) :
+      harness.createSuite(name, options, fn, declarationOptions);
+  };
+
+  if (type === 'benchmark') {
+    declare.skip = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, skip: true });
+    declare.only = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, only: true });
+  }
+  return declare;
+}
+
+function createHook(name, getHarness) {
+  return (fn, options) => getHarness().createHook(name, fn, options);
+}
+
+const bench = createDeclaration('benchmark', lazyHarness);
+const suite = createDeclaration('suite', lazyHarness);
+
+function createRunner(options = kEmptyObject) {
+  validateObject(options, 'options');
+  const harness = new Harness({
+    __proto__: null,
+    autoRun: false,
+    yieldBetweenSamples: options.yieldBetweenSamples === undefined ?
+      true : options.yieldBetweenSamples,
+  });
+  const getHarness = () => harness;
+  const runnerBench = createDeclaration('benchmark', getHarness);
+  const runnerSuite = createDeclaration('suite', getHarness);
+  return {
+    __proto__: null,
+    after: createHook(kHookNames[0], getHarness),
+    afterEach: createHook(kHookNames[1], getHarness),
+    before: createHook(kHookNames[2], getHarness),
+    beforeEach: createHook(kHookNames[3], getHarness),
+    bench: runnerBench,
+    describe: runnerSuite,
+    run: (runOptions = kEmptyObject) => harness.run(runOptions),
+    suite: runnerSuite,
+  };
+}
+
+function configureRunScope(scope) {
+  lazyHarness().setRunScope(scope);
+}
+
+function runInFileScope(scope, fn) {
+  return lazyHarness().runInFileScope(scope, fn);
+}
+
+function runBenchmarks(options, force) {
+  return lazyHarness().run(options, force);
+}
+
+module.exports = {
+  Harness,
+  after: createHook(kHookNames[0], lazyHarness),
+  afterEach: createHook(kHookNames[1], lazyHarness),
+  before: createHook(kHookNames[2], lazyHarness),
+  beforeEach: createHook(kHookNames[3], lazyHarness),
+  bench,
+  configureRunScope,
+  createRunId,
+  createRunner,
+  runInFileScope,
+  runBenchmarks,
+  suite,
+};
diff --git a/lib/internal/bench_runner/reporter/json.js b/lib/internal/bench_runner/reporter/json.js
new file mode 100644
index 000000000000..3237a3e1b26c
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/json.js
@@ -0,0 +1,64 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypePush,
+  JSONStringify,
+  ObjectKeys,
+  SafeWeakSet,
+  String,
+} = primordials;
+const { isError } = require('internal/util');
+
+function toJSONValue(value, seen) {
+  if (typeof value === 'bigint') return String(value);
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+
+  if (isError(value)) {
+    const result = {
+      __proto__: null,
+      name: value.name,
+      message: value.message,
+      stack: value.stack,
+      code: value.code,
+    };
+    if (value.cause !== undefined) {
+      result.cause = toJSONValue(value.cause, seen);
+    }
+    if (value.errors !== undefined) {
+      result.errors = toJSONValue(value.errors, seen);
+    }
+    return result;
+  }
+
+  if (ArrayIsArray(value)) {
+    const result = [];
+    for (let i = 0; i < value.length; i++) {
+      ArrayPrototypePush(result, toJSONValue(value[i], seen));
+    }
+    return result;
+  }
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(value);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    result[key] = toJSONValue(value[key], seen);
+  }
+  return result;
+}
+
+function stringify(record) {
+  return JSONStringify(record === undefined ? null :
+    toJSONValue(record, new SafeWeakSet()));
+}
+
+async function* jsonReporter(source) {
+  for await (const record of source) {
+    yield `${stringify(record)}\n`;
+  }
+}
+
+module.exports = jsonReporter;
diff --git a/lib/internal/bench_runner/reporter/spec.js b/lib/internal/bench_runner/reporter/spec.js
new file mode 100644
index 000000000000..34f5831553f3
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/spec.js
@@ -0,0 +1,149 @@
+'use strict';
+
+const {
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  JSONStringify,
+  MathAbs,
+  NumberIsFinite,
+  NumberPrototypeToFixed,
+  NumberPrototypeToPrecision,
+  ObjectEntries,
+  String,
+  StringPrototypeReplaceAll,
+} = primordials;
+const Transform = require('internal/streams/transform');
+
+const kHeader =
+  'benchmark | samples | mean rate | 95% CI | median rate | warning\n';
+
+function escapeCell(value) {
+  let result = String(value);
+  result = StringPrototypeReplaceAll(result, '\r', '\\r');
+  result = StringPrototypeReplaceAll(result, '\n', '\\n');
+  return StringPrototypeReplaceAll(result, '|', '\\|');
+}
+
+function formatName(data) {
+  const name = escapeCell(data.name);
+  const entries = ObjectEntries(data.params);
+  if (entries.length === 0) return name;
+
+  const params = [];
+  for (let i = 0; i < entries.length; i++) {
+    const { 0: key, 1: value } = entries[i];
+    ArrayPrototypePush(
+      params, `${escapeCell(key)}=${escapeCell(JSONStringify(value))}`);
+  }
+  return `${name} [${ArrayPrototypeJoin(params, ', ')}]`;
+}
+
+function formatRate(rate) {
+  if (!NumberIsFinite(rate)) return '-';
+
+  const absolute = MathAbs(rate);
+  let divisor = 1;
+  let prefix = '';
+  if (absolute >= 1e9) {
+    divisor = 1e9;
+    prefix = 'G';
+  } else if (absolute >= 1e6) {
+    divisor = 1e6;
+    prefix = 'M';
+  } else if (absolute >= 1e3) {
+    divisor = 1e3;
+    prefix = 'k';
+  }
+
+  const scaled = rate / divisor;
+  const formatted = MathAbs(scaled) > 0 && MathAbs(scaled) < 1 ?
+    NumberPrototypeToPrecision(scaled, 3) :
+    NumberPrototypeToFixed(scaled, 2);
+  return `${formatted}${prefix} ops/s`;
+}
+
+function formatWarning(summary) {
+  const warnings = [];
+  if (NumberIsFinite(summary.coefficientOfVariation) &&
+      summary.coefficientOfVariation > 0.05) {
+    ArrayPrototypePush(warnings, 'noisy');
+  }
+  if (NumberIsFinite(summary.skewness) && MathAbs(summary.skewness) > 1) {
+    ArrayPrototypePush(warnings, 'skewed');
+  }
+  return ArrayPrototypeJoin(warnings, ', ');
+}
+
+function formatResult(data) {
+  const name = formatName(data);
+  if (data.skip !== undefined) {
+    const reason = typeof data.skip === 'string' && data.skip.length > 0 ?
+      `: ${escapeCell(data.skip)}` : '';
+    return `${name} | 0 | - | - | - | skipped${reason}\n`;
+  }
+  if (data.error !== undefined) {
+    const message = data.error?.message ?? data.error;
+    return `${name} | ${data.samples.length} | - | - | - | ` +
+      `error: ${escapeCell(message)}\n`;
+  }
+
+  const { confidenceInterval, median } = data.summary;
+  return `${name} | ${data.samples.length} | ` +
+    `${formatRate(data.summary.mean)} | ` +
+    `[${formatRate(confidenceInterval.lower)}, ` +
+    `${formatRate(confidenceInterval.upper)}] | ` +
+    `${formatRate(median)} | ${formatWarning(data.summary)}\n`;
+}
+
+class SpecReporter extends Transform {
+  #diagnostics = [];
+  #reported = false;
+  #results = [];
+
+  constructor() {
+    super({ __proto__: null, writableObjectMode: true });
+  }
+
+  #format(summary = undefined) {
+    let output = kHeader;
+    for (let i = 0; i < this.#results.length; i++) {
+      output += formatResult(this.#results[i]);
+    }
+    for (let i = 0; i < this.#diagnostics.length; i++) {
+      output += `diagnostic: ${escapeCell(this.#diagnostics[i].message)}\n`;
+    }
+    if (summary !== undefined) {
+      const { completed, failed, skipped } = summary.counts;
+      output += `\n${completed} completed, ${failed} failed, ` +
+        `${skipped} skipped\n`;
+    }
+    return output;
+  }
+
+  _transform({ type, data }, _encoding, callback) {
+    switch (type) {
+      case 'bench:complete':
+        ArrayPrototypePush(this.#results, data);
+        break;
+      case 'bench:diagnostic':
+        ArrayPrototypePush(this.#diagnostics, data);
+        break;
+      case 'bench:summary':
+        this.#reported = true;
+        callback(null, this.#format(data));
+        return;
+    }
+    callback();
+  }
+
+  _flush(callback) {
+    if (this.#reported ||
+        (this.#results.length === 0 && this.#diagnostics.length === 0)) {
+      callback();
+      return;
+    }
+    callback(null, this.#format());
+  }
+}
+
+module.exports = SpecReporter;
diff --git a/lib/internal/bench_runner/runner.js b/lib/internal/bench_runner/runner.js
new file mode 100644
index 000000000000..c48a0a5339fa
--- /dev/null
+++ b/lib/internal/bench_runner/runner.js
@@ -0,0 +1,21 @@
+'use strict';
+
+const { kEmptyObject } = require('internal/util');
+const {
+  createRunner,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+
+function run(options = kEmptyObject) {
+  return runBenchmarks(options);
+}
+
+function runFile(path, options = kEmptyObject) {
+  return require('internal/bench_runner/cli').runFile(path, options);
+}
+
+module.exports = {
+  createRunner,
+  run,
+  runFile,
+};
diff --git a/lib/internal/blob.js b/lib/internal/blob.js
index 25626f0ed906..316518ca401b 100644
--- a/lib/internal/blob.js
+++ b/lib/internal/blob.js
@@ -30,7 +30,7 @@ const {
 } = internalBinding('buffer');
 
 const {
-  TextDecoder,
+  getUtf8Decoder,
   TextEncoder,
 } = require('internal/encoding');
 const { URL } = require('internal/url');
@@ -88,7 +88,6 @@ let ReadableStream;
 let TextDecoderStream;
 
 const enc = new TextEncoder();
-let dec;
 
 // Yes, lazy loading is annoying but because of circular
 // references between the url, internal/blob, and buffer
@@ -306,7 +305,7 @@ class Blob {
     if (!isBlob(this))
       return PromiseReject(new ERR_INVALID_THIS('Blob'));
 
-    dec ??= new TextDecoder();
+    const dec = getUtf8Decoder();
 
     return PromisePrototypeThen(
       arrayBuffer(this),
@@ -460,6 +459,43 @@ function arrayBuffer(blob) {
   return promise;
 }
 
+/**
+ * Read a blob's data synchronously. This is only possible when every part
+ * of the blob is memory-resident, in which case the reader's pull callbacks
+ * are invoked synchronously; otherwise (e.g. for file-backed blobs)
+ * undefined is returned.
+ * @param {Blob} blob
+ * @returns {ArrayBuffer|undefined}
+ */
+function getBlobDataSync(blob) {
+  const reader = blob[kHandle].getReader();
+  const buffers = [];
+  let result;
+  let ended = false;
+  while (!ended) {
+    let sync = false;
+    reader.pull((status, buffer) => {
+      sync = true;
+      if (status === 0) {
+        // EOS; buffer should be undefined here.
+        result = concat(buffers);
+        ended = true;
+        return;
+      } else if (status < 0) {
+        ended = true;
+        return;
+      }
+      if (buffer !== undefined)
+        ArrayPrototypePush(buffers, buffer);
+    });
+    if (!sync) {
+      // The data is not available synchronously.
+      break;
+    }
+  }
+  return result;
+}
+
 function createBlobReaderStream(reader) {
   return new lazyReadableStream({
     type: 'bytes',
@@ -568,17 +604,31 @@ function createBlobReaderStream(reader) {
   }, { highWaterMark: 0 });
 }
 
-// Maximum number of chunks to collect in a single batch to prevent
-// unbounded memory growth when the DataQueue has a large burst of data.
+// Upper bound on the number of chunks collected in a single batch. This is
+// only a cap on the length of the yielded array -- the primary limit is the
+// byte budget below, since under a byte-budget backpressure model the size of
+// a batch is what matters, not how many pieces it arrives in.
 const kMaxBatchChunks = 16;
 
+// Default number of bytes to collect in a single batch. Entries in the
+// DataQueue can each be as large as the peer's flow control window, so a
+// purely count-based limit could produce enormous batches (16 entries of
+// 1 MB each).
+//
+// This matters for more than just the size of the yielded array. Consumers
+// like QUIC return flow control credit from the reader's pull path -- once
+// per pull, not once per batch -- so every pull this loop performs invites
+// the peer to send that many more bytes. Pulling greedily therefore grants
+// credit for data the consumer has not looked at yet. Bounding the loop by
+// bytes limits how far ahead of actual consumption that credit can run,
+// which is what keeps the amount of data buffered in JS bounded.
+const kDefaultMaxBatchBytes = 65536;
+
 async function* createBlobReaderIterable(reader, options = kEmptyObject) {
-  const { getReadError } = options;
+  const { getReadError, maxBatchBytes = kDefaultMaxBatchBytes } = options;
   let wakeup = PromiseWithResolvers();
   let immediate;
-  let fin = false;
-  reader.setWakeup((setfin) => {
-    fin ||= setfin;
+  reader.setWakeup(() => {
     immediate ??= setImmediate(() => {
       immediate = undefined;
       wakeup.resolve?.();
@@ -588,6 +638,7 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
   try {
     while (true) {
       const batch = [];
+      let batchBytes = 0;
       let blocked = false;
       let eos = false;
       let error = null;
@@ -616,8 +667,15 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
           blocked = true;
           break;
         }
-        ArrayPrototypePush(batch, new Uint8Array(pullResult.buffer));
-        if (batch.length >= kMaxBatchChunks) break;
+        const chunk = new Uint8Array(pullResult.buffer);
+        ArrayPrototypePush(batch, chunk);
+        // Stop collecting once the batch is large enough. The byte budget is
+        // the primary limit; the chunk count is a secondary bound so that a
+        // long run of tiny chunks cannot produce an unwieldy array.
+        batchBytes += chunk.byteLength;
+        if (batchBytes >= maxBatchBytes || batch.length >= kMaxBatchChunks) {
+          break;
+        }
       }
 
       if (batch.length > 0) {
@@ -630,12 +688,6 @@ async function* createBlobReaderIterable(reader, options = kEmptyObject) {
       if (blocked) {
         await wakeup.promise;
         wakeup = PromiseWithResolvers();
-        // If the wakeup was triggered by FIN (EndReadable), the DataQueue
-        // is capped. Continue the loop to pull again -- the next pull will
-        // return EOS. Without this, a race between the data notification
-        // and the FIN notification can leave the iterator waiting for a
-        // wakeup that will never come.
-        if (fin) continue;
       }
     }
   } finally {
@@ -649,8 +701,10 @@ module.exports = {
   createBlobFromFilePath,
   createBlobReaderIterable,
   createBlobReaderStream,
+  getBlobDataSync,
   isBlob,
   kHandle,
+  kType,
   resolveObjectURL,
   TransferableBlob,
 };
diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js
index f290c7ada405..9436078eaa2c 100644
--- a/lib/internal/blocklist.js
+++ b/lib/internal/blocklist.js
@@ -46,7 +46,7 @@ const {
   ERR_INVALID_ARG_TYPE,
 } = require('internal/errors').codes;
 
-const { validateInt32, validateString } = require('internal/validators');
+const { validateArray, validateInt32, validateString } = require('internal/validators');
 
 function parseCIDR(cidr) {
   validateString(cidr, 'cidr');
@@ -131,9 +131,7 @@ class BlockList {
    * @param {string} [family]
    */
   addAddresses(addresses, family = 'ipv4') {
-    if (!ArrayIsArray(addresses)) {
-      throw new ERR_INVALID_ARG_TYPE('addresses', 'Array', addresses);
-    }
+    validateArray(addresses, 'addresses');
     validateString(family, 'family');
     const handles = [];
     for (let i = 0; i < addresses.length; i++) {
@@ -215,9 +213,7 @@ class BlockList {
    * @param {string[]} cidrs
    */
   addCIDRs(cidrs) {
-    if (!ArrayIsArray(cidrs)) {
-      throw new ERR_INVALID_ARG_TYPE('cidrs', 'Array', cidrs);
-    }
+    validateArray(cidrs, 'cidrs');
     // Validate and parse all entries first so that an exception mid-array
     // does not leave the blocklist half-modified.
     const parsed = [];
@@ -387,7 +383,7 @@ class BlockList {
         // - 2001:db8:85a3::8a2e:370:7334/64 (compressed)
         // - 2001:db8:85a3::192.0.2.128/64 (mixed)
         const ipv6SubnetMatch = item.match(
-          /Subnet: IPv6 ([0-9a-fA-F:]{1,39})\/([0-9]{1,3})/i,
+          /Subnet: IPv6 ([0-9a-fA-F:.]{1,45})\/([0-9]{1,3})/i,
         );
         if (ipv6SubnetMatch) {
           const { 1: network, 2: prefix } = ipv6SubnetMatch;
@@ -400,7 +396,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full)
         // - 2001:db8:85a3::8a2e:370:7334 (compressed)
         // - 2001:db8:85a3::192.0.2.128 (mixed)
-        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:]{1,39})/i);
+        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:.]{1,45})/i);
         if (ipv6AddressMatch) {
           const { 1: address } = ipv6AddressMatch;
           this.addAddress(address, 'ipv6');
@@ -412,7 +408,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334-2001:0db8:85a3:0000:0000:8a2e:0370:7335 (full)
         // - 2001:db8:85a3::8a2e:370:7334-2001:db8:85a3::8a2e:370:7335 (compressed)
         // - 2001:db8:85a3::192.0.2.128-2001:db8:85a3::192.0.2.129 (mixed)
-        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:]{1,39})-([0-9a-fA-F:]{1,39})/i);
+        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:.]{1,45})-([0-9a-fA-F:.]{1,45})/i);
         if (ipv6RangeMatch) {
           const { 1: start, 2: end } = ipv6RangeMatch;
           this.addRange(start, end, 'ipv6');
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index 8bb014426a03..bde4cb2be84b 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -285,6 +285,11 @@ const features = {
   get require_module() {
     return getOptionValue('--require-module');
   },
+  get dtls() {
+    return process.config.variables.node_use_dtls &&
+           hasOpenSSL &&
+           getOptionValue('--experimental-dtls');
+  },
   get quic() {
     // TODO(@jasnell): When the implementation is updated to support Boring,
     // then this should be refactored to depend not only on the OpenSSL version.
diff --git a/lib/internal/bootstrap/realm.js b/lib/internal/bootstrap/realm.js
index 4e45a85a12b2..81ac2a0e398e 100644
--- a/lib/internal/bootstrap/realm.js
+++ b/lib/internal/bootstrap/realm.js
@@ -124,6 +124,9 @@ const legacyWrapperList = new SafeSet([
 // beginning with "internal/".
 // Modules that can only be imported via the node: scheme.
 const schemelessBlockList = new SafeSet([
+  'bench',
+  'bench/reporters',
+  'dtls',
   'ffi',
   'sea',
   'sqlite',
@@ -134,6 +137,7 @@ const schemelessBlockList = new SafeSet([
 ]);
 // Modules that will only be enabled at run time.
 const experimentalModuleList = new SafeSet([
+  'dtls',
   'ffi',
   'quic',
   'sqlite',
@@ -332,7 +336,16 @@ class BuiltinModule {
 
   static getAllBuiltinModuleIds() {
     const allBuiltins = ArrayFrom(canBeRequiredByUsersWithoutSchemeList);
-    ArrayPrototypePushApply(allBuiltins, ArrayFrom(schemelessBlockList, (x) => `node:${x}`));
+    ArrayPrototypePushApply(
+      allBuiltins,
+      ArrayPrototypeMap(
+        ArrayPrototypeFilter(
+          ArrayFrom(schemelessBlockList),
+          (id) => canBeRequiredByUsersList.has(id),
+        ),
+        (id) => 'node:' + id,
+      ),
+    );
     return allBuiltins;
   }
 
diff --git a/lib/internal/bootstrap/switches/is_not_main_thread.js b/lib/internal/bootstrap/switches/is_not_main_thread.js
index 6fa30aec748a..1716bea20149 100644
--- a/lib/internal/bootstrap/switches/is_not_main_thread.js
+++ b/lib/internal/bootstrap/switches/is_not_main_thread.js
@@ -6,6 +6,12 @@ const {
 
 delete process._debugProcess;
 delete process._debugEnd;
+// Also drop the other main-thread-only helpers is_main_thread.js installs, so
+// that this switch can be applied on top of a context bootstrapped for the
+// main thread (as when a worker starts from the built-in snapshot).
+delete process._debugPause;
+delete process._startProfilerIdleNotifier;
+delete process._stopProfilerIdleNotifier;
 
 function defineStream(name, getter) {
   ObjectDefineProperty(process, name, {
diff --git a/lib/internal/bootstrap/web/exposed-window-or-worker.js b/lib/internal/bootstrap/web/exposed-window-or-worker.js
index e9edc4ceb616..35cb1d5120e1 100644
--- a/lib/internal/bootstrap/web/exposed-window-or-worker.js
+++ b/lib/internal/bootstrap/web/exposed-window-or-worker.js
@@ -51,6 +51,8 @@ exposeLazyInterfaces(globalThis, 'internal/worker/io', ['BroadcastChannel']);
 exposeLazyInterfaces(globalThis, 'internal/worker/io', [
   'MessageChannel', 'MessagePort',
 ]);
+// https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-worker-interface
+exposeLazyInterfaces(globalThis, 'internal/webworker', ['Worker']);
 // https://www.w3.org/TR/FileAPI/#dfn-Blob
 exposeLazyInterfaces(globalThis, 'internal/blob', ['Blob']);
 // https://www.w3.org/TR/FileAPI/#dfn-file
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 5977bdf23768..325df6ca01ad 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -5,6 +5,7 @@ const {
   Float32Array,
   Float64Array,
   MathFloor,
+  MathMax,
   Number,
   Symbol,
   Uint8Array,
@@ -1114,24 +1115,33 @@ function createUnsafeBuffer(size) {
   return new FastBuffer(createUnsafeArrayBuffer(size));
 }
 
+// Reaching an aligned address needs at most `alignment - 1` extra bytes, but a
+// multiple of 8 is padded instead. Backing store addresses are 8 byte aligned
+// too, so the bytes left over after the buffer then remain a whole number of
+// elements of any typed array created over its ArrayBuffer.
+function alignmentPadding(alignment) {
+  return MathMax(alignment, 8);
+}
+
 // Returns an uninitialized buffer of `size` bytes whose first byte is located at
 // a memory address that is a multiple of `alignment`. `alignment` must be a
-// power of two, and `size + alignment - 1` must not exceed the maximum buffer
-// length. Since the address of a backing store cannot be chosen, `alignment - 1`
-// extra bytes are allocated and skipped, which leaves the returned buffer with a
-// non-zero `byteOffset` into a larger ArrayBuffer.
+// power of two, and `size` plus its padding must not exceed the maximum buffer
+// length. Since the address of a backing store cannot be chosen, that padding is
+// allocated and skipped, which leaves the returned buffer with a non-zero
+// `byteOffset` into a larger ArrayBuffer.
 function createUnsafeAlignedBuffer(size, alignment) {
   if (size === 0) {
     return new FastBuffer();
   }
 
-  const ab = createUnsafeArrayBuffer(size + alignment - 1);
+  const ab = createUnsafeArrayBuffer(size + alignmentPadding(alignment));
   return new FastBuffer(ab, arrayBufferAlignedOffset(ab, alignment), size);
 }
 
 module.exports = {
   FastBuffer,
   addBufferPrototypeMethods,
+  alignmentPadding,
   markAsUntransferable,
   isMarkedAsUntransferable,
   createUnsafeBuffer,
diff --git a/lib/internal/crypto/cfrg.js b/lib/internal/crypto/cfrg.js
index 9eea26aa36a0..1f7b3202fb10 100644
--- a/lib/internal/crypto/cfrg.js
+++ b/lib/internal/crypto/cfrg.js
@@ -146,6 +146,12 @@ function cfrgImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = (name === 'X25519' || name === 'X448') ? 'enc' : 'sig';
       validateJwk(keyData, 'OKP', extractable, usagesSet, expectedUse);
 
@@ -159,11 +165,6 @@ function cfrgImportKey(
             'JWK "alg" does not match the requested algorithm', 'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/cipher.js b/lib/internal/crypto/cipher.js
index dafcc59d5066..4b4165c55084 100644
--- a/lib/internal/crypto/cipher.js
+++ b/lib/internal/crypto/cipher.js
@@ -33,6 +33,7 @@ const {
 
 const {
   validateEncoding,
+  validateOneOf,
   validateUint32,
   validateObject,
   validateString,
@@ -60,6 +61,9 @@ const { normalizeEncoding, kEmptyObject } = require('internal/util');
 
 const { StringDecoder } = require('string_decoder');
 
+const kCtsModes = ['CS1', 'CS2', 'CS3'];
+const kXtsStandards = ['GB', 'IEEE'];
+
 function rsaFunctionFor(method, defaultPadding, keyType) {
   const keyName = keyType === 'private' ? 'privateKey' : undefined;
   return (key, buffer) => {
@@ -119,8 +123,32 @@ function getUIntOption(options, key) {
 }
 
 function createCipherBase(cipher, credential, options, isEncrypt, iv) {
-  const authTagLength = getUIntOption(options, 'authTagLength');
-  this[kHandle] = new CipherBase(isEncrypt, cipher, credential, iv, authTagLength);
+  let authTagLength = -1;
+  let ctsMode;
+  let xtsStandard;
+  if (options != null) {
+    authTagLength = getUIntOption(options, 'authTagLength');
+    ctsMode = getStringOption(options, 'ctsMode') ?? undefined;
+    xtsStandard = getStringOption(options, 'xtsStandard') ?? undefined;
+    if (ctsMode !== undefined)
+      validateOneOf(ctsMode, 'options.ctsMode', kCtsModes);
+    if (xtsStandard !== undefined)
+      validateOneOf(xtsStandard, 'options.xtsStandard', kXtsStandards);
+  }
+
+  if (ctsMode === undefined && xtsStandard === undefined) {
+    this[kHandle] = new CipherBase(
+      isEncrypt, cipher, credential, iv, authTagLength);
+  } else {
+    this[kHandle] = new CipherBase(
+      isEncrypt,
+      cipher,
+      credential,
+      iv,
+      authTagLength,
+      ctsMode,
+      xtsStandard);
+  }
   this._decoder = null;
 
   FunctionPrototypeCall(LazyTransform, this, options);
diff --git a/lib/internal/crypto/ec.js b/lib/internal/crypto/ec.js
index cbd89dd11c7e..0f1e0555202d 100644
--- a/lib/internal/crypto/ec.js
+++ b/lib/internal/crypto/ec.js
@@ -164,6 +164,12 @@ function ecImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = name === 'ECDH' ? 'enc' : 'sig';
       validateJwk(keyData, 'EC', extractable, usagesSet, expectedUse);
 
@@ -185,11 +191,6 @@ function ecImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/hash.js b/lib/internal/crypto/hash.js
index a32d74f65cb4..3c727543248a 100644
--- a/lib/internal/crypto/hash.js
+++ b/lib/internal/crypto/hash.js
@@ -7,6 +7,7 @@ const {
   StringPrototypeToLowerCase,
   Symbol,
   TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeIncludes,
 } = primordials;
 
 const {
@@ -31,6 +32,8 @@ const {
   kHandle,
   getCachedHashId,
   getHashCache,
+  getArrayBufferOrView,
+  getBufferSourceBytes,
   getOptionalByteLength,
 } = require('internal/crypto/util');
 
@@ -93,6 +96,17 @@ const maybeEmitDeprecationWarning = getDeprecationWarningEmitter(
   },
 );
 
+function normalizeCShakeParameter(value, name) {
+  if (value === undefined) return undefined;
+
+  value = getArrayBufferOrView(value, name);
+  if (TypedArrayPrototypeIncludes(getBufferSourceBytes(value), 0)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      name, value, 'must not contain NUL bytes');
+  }
+  return value;
+}
+
 function Hash(algorithm, options) {
   if (!new.target)
     return new Hash(algorithm, options);
@@ -106,10 +120,36 @@ function Hash(algorithm, options) {
     // Coerce -0 to +0.
     xofLen += 0;
   }
+  let functionName;
+  let customization;
+  if (!isCopy && options !== undefined && options !== null) {
+    const functionNameOption = options.functionName;
+    if (functionNameOption !== undefined) {
+      functionName = normalizeCShakeParameter(
+        functionNameOption, 'options.functionName');
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeCShakeParameter(
+        customizationOption, 'options.customization');
+    }
+  }
   // Lookup the cached ID from JS land because it's faster than decoding
   // the string in C++ land.
   const algorithmId = isCopy ? -1 : getCachedHashId(algorithm);
-  this[kHandle] = new _Hash(algorithm, xofLen, algorithmId, getHashCache());
+  if (functionName === undefined && customization === undefined) {
+    this[kHandle] = new _Hash(
+      algorithm, xofLen, algorithmId, getHashCache());
+  } else {
+    this[kHandle] = new _Hash(
+      algorithm,
+      xofLen,
+      algorithmId,
+      getHashCache(),
+      functionName,
+      customization,
+    );
+  }
   this[kState] = {
     [kFinalized]: false,
   };
@@ -205,7 +245,12 @@ Hmac.prototype.digest = function digest(outputEncoding) {
   return ret;
 };
 
-Hmac.prototype._flush = Hash.prototype._flush;
+Hmac.prototype._flush = function _flush(callback) {
+  this.push(this[kHandle].digest());
+  this[kState][kFinalized] = true; // This diverges from Hash.prototype._flush:
+  // Hash instances are still usable after a flush, Hmac are not, see DEP0206.
+  callback();
+};
 Hmac.prototype._transform = Hash.prototype._transform;
 
 // Implementation for WebCrypto subtle.digest()
@@ -294,8 +339,15 @@ function hash(algorithm, input, options) {
   if (typeof input !== 'string' && !isArrayBufferView(input)) {
     throw new ERR_INVALID_ARG_TYPE('input', ['Buffer', 'TypedArray', 'DataView', 'string'], input);
   }
+  if (options === undefined) {
+    maybeEmitDeprecationWarning(algorithm);
+    return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
+                         input, 'hex', encodingsMap.hex, undefined);
+  }
   let outputEncoding;
   let outputLength;
+  let functionName;
+  let customization;
 
   if (typeof options === 'string') {
     outputEncoding = options;
@@ -303,6 +355,16 @@ function hash(algorithm, input, options) {
     validateObject(options, 'options');
     outputLength = options.outputLength;
     outputEncoding = options.outputEncoding;
+    const functionNameOption = options.functionName;
+    if (functionNameOption !== undefined) {
+      functionName = normalizeCShakeParameter(
+        functionNameOption, 'options.functionName');
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeCShakeParameter(
+        customizationOption, 'options.customization');
+    }
   }
 
   outputEncoding ??= 'hex';
@@ -333,8 +395,13 @@ function hash(algorithm, input, options) {
     maybeEmitDeprecationWarning(algorithm);
   }
 
+  if (functionName === undefined && customization === undefined) {
+    return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
+                         input, normalized, encodingsMap[normalized], outputLength);
+  }
   return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
-                       input, normalized, encodingsMap[normalized], outputLength);
+                       input, normalized, encodingsMap[normalized], outputLength,
+                       functionName, customization);
 }
 
 module.exports = {
diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
index d55968907541..fcff7070164f 100644
--- a/lib/internal/crypto/hkdf.js
+++ b/lib/internal/crypto/hkdf.js
@@ -22,7 +22,6 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
-  getDigestSizeInBytes,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -142,6 +141,22 @@ function hkdfSync(hash, key, salt, info, length) {
   return bits;
 }
 
+function getDigestSizeInBytes(name) {
+  switch (name) {
+    case 'SHA-1':
+      return 20;
+    case 'SHA-256': // Fall through
+    case 'SHA3-256':
+      return 32;
+    case 'SHA-384': // Fall through
+    case 'SHA3-384':
+      return 48;
+    case 'SHA-512': // Fall through
+    case 'SHA3-512':
+      return 64;
+  }
+}
+
 function validateHkdfDeriveBitsLength(length, hash) {
   if (length === null)
     throw lazyDOMException('length cannot be null', 'OperationError');
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index a7f3b4f47cfb..e82e48ad653f 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -16,9 +16,11 @@ const {
   createNativeKeyObjectClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getKeyObjectSlots: nativeGetKeyObjectSlots,
+  isKeyObject: isNativeKeyObject,
   createCryptoKeyClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getCryptoKeySlots: nativeGetCryptoKeySlots,
+  isCryptoKey: isNativeCryptoKey,
   kKeyTypeSecret,
   kKeyTypePublic,
   kKeyTypePrivate,
@@ -115,11 +117,13 @@ for (const m of [[kKeyEncodingPKCS1, 'pkcs1'], [kKeyEncodingPKCS8, 'pkcs8'],
                  [kKeyEncodingSPKI, 'spki'], [kKeyEncodingSEC1, 'sec1']])
   encodingNames[m[0]] = m[1];
 
-// KeyObject state lives on the native NativeKeyObject base class. JS reads
-// the native type enum and a KeyObjectHandle in one call and caches that
-// slot tuple in a private field so no forgeable own Symbols are exposed on
-// public KeyObject instances.
+// KeyObject state lives on the native NativeKeyObject base class. JS caches
+// the constructor-known type enum in a private field, then replaces it with
+// the native type and KeyObjectHandle tuple when the handle is first needed.
+// No forgeable own Symbols are exposed on public KeyObject instances.
 let getKeyObjectSlots; // Populated by the createNativeKeyObjectClass callback.
+let isKeyObject;
+let getKeyObjectTypeValue;
 
 const kKeyObjectSlotType = 0;
 const kKeyObjectSlotHandle = 1;
@@ -159,12 +163,18 @@ const {
     #slots;
 
     constructor(type, handle) {
-      if (type !== 'secret' && type !== 'public' && type !== 'private')
-        throw new ERR_INVALID_ARG_VALUE('type', type);
+      let keyType;
+      switch (type) {
+        case 'secret': keyType = kKeyTypeSecret; break;
+        case 'public': keyType = kKeyTypePublic; break;
+        case 'private': keyType = kKeyTypePrivate; break;
+        default: throw new ERR_INVALID_ARG_VALUE('type', type);
+      }
       if (typeof handle !== 'object' || !(handle instanceof KeyObjectHandle))
         throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
 
       super(handle);
+      this.#slots = keyType;
     }
 
     get type() {
@@ -225,12 +235,27 @@ const {
     }
 
     static {
+      isKeyObject = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeKeyObject(key);
+      };
+      getKeyObjectTypeValue = (key) => {
+        if (!key || typeof key !== 'object')
+          throw new ERR_INVALID_THIS('KeyObject');
+        if (#slots in key) {
+          const cached = key.#slots;
+          if (typeof cached === 'number') return cached;
+          if (cached !== undefined) return cached[kKeyObjectSlotType];
+        }
+        return getKeyObjectSlots(key)[kKeyObjectSlotType];
+      };
+
       getKeyObjectSlots = (key) => {
         if (!key || typeof key !== 'object')
           throw new ERR_INVALID_THIS('KeyObject');
         if (#slots in key) {
           const cached = key.#slots;
-          if (cached !== undefined) return cached;
+          if (cached !== undefined && typeof cached !== 'number') return cached;
         }
         const slots = nativeGetKeyObjectSlots(key);
         key.#slots = slots;
@@ -954,7 +979,7 @@ function keyObjectTypeToString(type) {
  * @returns {'secret' | 'public' | 'private'}
  */
 function getKeyObjectType(key) {
-  return keyObjectTypeToString(getKeyObjectSlots(key)[kKeyObjectSlotType]);
+  return keyObjectTypeToString(getKeyObjectTypeValue(key));
 }
 
 /**
@@ -1044,18 +1069,6 @@ function getKeyObjectAsymmetricKeyDetails(key) {
   return cached;
 }
 
-function isKeyObject(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
-
-  try {
-    getKeyObjectSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // CryptoKey is a plain JS class whose prototype's [[Prototype]] is
 // Object.prototype, as Web Crypto requires. Instance storage (type enum,
 // extractable, algorithm, usages mask, and the KeyObject handle) lives
@@ -1067,11 +1080,11 @@ function isKeyObject(obj) {
 //            -> CryptoKey.prototype
 //            -> Object.prototype
 //
-// All five internal slots are read from C++ in a single call via
-// `getCryptoKeySlots`. The resulting array is cached in a private
-// class field on `InternalCryptoKey` so that it is invisible to
-// reflection (`Object.getOwnPropertySymbols` etc.) and leaves each
-// CryptoKey's hidden class pristine. The `getCryptoKey{Type,
+// Normal construction caches all five internal slots in a private class
+// field on `InternalCryptoKey`. Partially initialized transferred keys read
+// them from C++ in a single `getCryptoKeySlots` call on first access. The
+// cache is invisible to reflection (`Object.getOwnPropertySymbols` etc.) and
+// leaves each CryptoKey's hidden class pristine. The `getCryptoKey{Type,
 // Extractable,Algorithm,Usages,Handle}` helpers index into that
 // array and convert native enums/masks back to Web Crypto strings.
 // The internal algorithm object is stored as a null-prototype clone
@@ -1081,6 +1094,7 @@ function isKeyObject(obj) {
 // requires repeat reads to return the same object so a consumer's
 // mutation is visible next time).
 let getSlots; // Populated by the createCryptoKeyClass callback below.
+let isCryptoKey;
 
 const kSlotType = 0;
 const kSlotExtractable = 1;
@@ -1179,9 +1193,22 @@ const {
       if (algorithm !== undefined)
         algorithm = cloneInternalAlgorithm(algorithm);
       super(handle, algorithm, usagesMask, extractable);
+      if (algorithm !== undefined) {
+        this.#slots = [
+          handle.getKeyType(),
+          extractable,
+          algorithm,
+          usagesMask,
+          handle,
+        ];
+      }
     }
 
     static {
+      isCryptoKey = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeCryptoKey(key);
+      };
       getSlots = (key) => {
         if (!key || typeof key !== 'object')
           throw new ERR_INVALID_THIS('CryptoKey');
@@ -1215,12 +1242,10 @@ const {
   return [CryptoKey, InternalCryptoKey];
 });
 
-// The helpers below return a CryptoKey's internal slot value,
-// populating the per-instance cache on first access via a single
-// native call. The public `type` getter converts the native enum to
-// the Web Crypto string. The `usages` helper converts the native usage
-// mask to Web Crypto strings. The public `algorithm` / `usages` getters
-// on `CryptoKey.prototype` cache their returned objects.
+// The helpers below return a CryptoKey's internal slot value. The public
+// `type` getter converts the native enum to the Web Crypto string. The
+// `usages` helper converts the native usage mask to Web Crypto strings. The
+// public `algorithm` / `usages` getters cache their returned objects.
 
 /**
  * Returns the value of a CryptoKey's `[[type]]` internal slot.
@@ -1313,18 +1338,6 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
-function isCryptoKey(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
-
-  try {
-    getSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function importGenericSecretKey(
   algorithm,
   format,
diff --git a/lib/internal/crypto/ml_dsa.js b/lib/internal/crypto/ml_dsa.js
index 0756198312c0..108ec22fc791 100644
--- a/lib/internal/crypto/ml_dsa.js
+++ b/lib/internal/crypto/ml_dsa.js
@@ -158,17 +158,18 @@ function mlDsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'sig');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/ml_kem.js b/lib/internal/crypto/ml_kem.js
index c917c88c0f29..da077ac8344d 100644
--- a/lib/internal/crypto/ml_kem.js
+++ b/lib/internal/crypto/ml_kem.js
@@ -169,17 +169,18 @@ function mlKemImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'enc');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/provider_mac.js b/lib/internal/crypto/provider_mac.js
new file mode 100644
index 000000000000..f972ac00be21
--- /dev/null
+++ b/lib/internal/crypto/provider_mac.js
@@ -0,0 +1,262 @@
+'use strict';
+
+const {
+  FunctionPrototypeCall,
+  ObjectSetPrototypeOf,
+  StringPrototypeIncludes,
+  StringPrototypeToLowerCase,
+  Symbol,
+} = primordials;
+
+const {
+  Mac: _Mac,
+} = internalBinding('crypto');
+
+const {
+  getCachedMacId,
+  getMacCache,
+  kHandle,
+} = require('internal/crypto/util');
+
+const {
+  getKeyObjectHandle,
+  getKeyObjectType,
+  isKeyObject,
+} = require('internal/crypto/keys');
+
+const {
+  normalizeEncoding,
+} = require('internal/util');
+
+const {
+  codes: {
+    ERR_CRYPTO_MAC_FINALIZED,
+    ERR_CRYPTO_MAC_UPDATE_FAILED,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+  },
+} = require('internal/errors');
+
+const {
+  validateEncoding,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+
+const {
+  isAnyArrayBuffer,
+  isArrayBufferView,
+} = require('internal/util/types');
+
+const LazyTransform = require('internal/streams/lazy_transform');
+
+const kState = Symbol('kState');
+const kFinalized = Symbol('kFinalized');
+
+function validateName(value, name) {
+  validateString(value, name);
+  if (value.length === 0 || StringPrototypeIncludes(value, '\0')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      name, value, 'must be non-empty and contain no NUL bytes');
+  }
+  return value;
+}
+
+function normalizeBytes(value, name) {
+  if (!isArrayBufferView(value) && !isAnyArrayBuffer(value)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      name, ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'], value);
+  }
+  return value;
+}
+
+function createHandle(algorithm, key, options) {
+  const name = validateName(algorithm, 'algorithm');
+  let digest;
+  let cipher;
+  let iv;
+  let customization;
+  let salt;
+  let outputLength;
+  let hasExtendedOptions = false;
+
+  if (options !== undefined) {
+    validateObject(options, 'options');
+
+    const digestOption = options.digest;
+    if (digestOption !== undefined) {
+      digest = validateName(digestOption, 'options.digest');
+    }
+    const cipherOption = options.cipher;
+    if (cipherOption !== undefined) {
+      cipher = validateName(cipherOption, 'options.cipher');
+      hasExtendedOptions = true;
+    }
+    const ivOption = options.iv;
+    if (ivOption !== undefined) {
+      iv = normalizeBytes(ivOption, 'options.iv');
+      hasExtendedOptions = true;
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeBytes(
+        customizationOption, 'options.customization');
+      hasExtendedOptions = true;
+    }
+    const saltOption = options.salt;
+    if (saltOption !== undefined) {
+      salt = normalizeBytes(saltOption, 'options.salt');
+      hasExtendedOptions = true;
+    }
+    const outputLengthOption = options.outputLength;
+    if (outputLengthOption !== undefined) {
+      outputLength = outputLengthOption;
+      validateUint32(outputLength, 'options.outputLength');
+      outputLength += 0;
+      hasExtendedOptions = true;
+    }
+  }
+
+  key = normalizeKey(key);
+  const id = getCachedMacId(name);
+  const cache = getMacCache();
+  if (!hasExtendedOptions) {
+    return new _Mac(name, id, cache, key, digest);
+  }
+  return new _Mac(
+    name,
+    id,
+    cache,
+    key,
+    digest,
+    cipher,
+    iv,
+    customization,
+    salt,
+    outputLength,
+  );
+}
+
+function normalizeKey(key) {
+  if (isKeyObject(key)) {
+    if (getKeyObjectType(key) !== 'secret') {
+      throw new ERR_INVALID_ARG_TYPE(
+        'key', ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView', 'KeyObject'], key);
+    }
+    return getKeyObjectHandle(key);
+  }
+  if (!isArrayBufferView(key) && !isAnyArrayBuffer(key)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'key', ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView', 'KeyObject'], key);
+  }
+  return key;
+}
+
+function normalizeOutputEncoding(outputEncoding) {
+  if (outputEncoding === undefined) return 'buffer';
+  validateString(outputEncoding, 'outputEncoding');
+  if (StringPrototypeToLowerCase(outputEncoding) === 'buffer') return 'buffer';
+  const normalized = normalizeEncoding(outputEncoding);
+  if (normalized === undefined) {
+    throw new ERR_INVALID_ARG_VALUE('outputEncoding', outputEncoding);
+  }
+  return normalized;
+}
+
+function normalizeInputEncoding(data, inputEncoding) {
+  if (inputEncoding === undefined) return undefined;
+  validateString(inputEncoding, 'inputEncoding');
+  const normalized = normalizeEncoding(inputEncoding);
+  if (normalized === undefined) {
+    throw new ERR_INVALID_ARG_VALUE('inputEncoding', inputEncoding);
+  }
+  validateEncoding(data, normalized);
+  return normalized;
+}
+
+function updateHandle(mac, data, encoding) {
+  const state = mac[kState];
+  let updated;
+  try {
+    updated = mac[kHandle].update(data, encoding);
+  } catch (error) {
+    state[kFinalized] = true;
+    throw error;
+  }
+  if (!updated) {
+    state[kFinalized] = true;
+    throw new ERR_CRYPTO_MAC_UPDATE_FAILED();
+  }
+}
+
+function finalizeHandle(mac, outputEncoding) {
+  const state = mac[kState];
+  state[kFinalized] = true;
+  return mac[kHandle].final(outputEncoding);
+}
+
+function Mac(algorithm, key, options) {
+  if (!new.target) return new Mac(algorithm, key, options);
+  this[kHandle] = createHandle(algorithm, key, options);
+  this[kState] = {
+    [kFinalized]: false,
+  };
+  FunctionPrototypeCall(LazyTransform, this, options);
+}
+
+ObjectSetPrototypeOf(Mac.prototype, LazyTransform.prototype);
+ObjectSetPrototypeOf(Mac, LazyTransform);
+
+Mac.prototype._transform = function _transform(chunk, encoding, callback) {
+  if (this[kState][kFinalized]) {
+    callback(new ERR_CRYPTO_MAC_FINALIZED());
+    return;
+  }
+  try {
+    updateHandle(this, chunk, encoding);
+  } catch (error) {
+    callback(error);
+    return;
+  }
+  callback();
+};
+
+Mac.prototype._flush = function _flush(callback) {
+  if (this[kState][kFinalized]) {
+    callback(new ERR_CRYPTO_MAC_FINALIZED());
+    return;
+  }
+  try {
+    const result = finalizeHandle(this);
+    if (result.length !== 0) this.push(result);
+  } catch (error) {
+    callback(error);
+    return;
+  }
+  callback();
+};
+
+Mac.prototype.update = function update(data, encoding) {
+  if (this[kState][kFinalized]) throw new ERR_CRYPTO_MAC_FINALIZED();
+  if (typeof data === 'string') {
+    encoding = normalizeInputEncoding(data, encoding);
+  } else if (!isArrayBufferView(data)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'data', ['string', 'Buffer', 'TypedArray', 'DataView'], data);
+  }
+  updateHandle(this, data, encoding);
+  return this;
+};
+
+Mac.prototype.final = function final(outputEncoding) {
+  if (this[kState][kFinalized]) throw new ERR_CRYPTO_MAC_FINALIZED();
+  if (outputEncoding === undefined) return finalizeHandle(this);
+  outputEncoding = normalizeOutputEncoding(outputEncoding);
+  if (outputEncoding === 'buffer') return finalizeHandle(this);
+  return finalizeHandle(this, outputEncoding);
+};
+
+module.exports = {
+  Mac,
+};
diff --git a/lib/internal/crypto/rsa.js b/lib/internal/crypto/rsa.js
index 846b6b7bf748..27b23087d563 100644
--- a/lib/internal/crypto/rsa.js
+++ b/lib/internal/crypto/rsa.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  MathCeil,
   TypedArrayPrototypeGetBuffer,
   Uint8Array,
 } = primordials;
@@ -24,12 +23,11 @@ const {
 } = internalBinding('crypto');
 
 const {
-  validateInt32,
+  isInt32,
 } = require('internal/validators');
 
 const {
   bigIntArrayToUnsignedInt,
-  getDigestSizeInBytes,
   getUsagesMask,
   jobPromise,
   normalizeHashName,
@@ -188,6 +186,12 @@ function rsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        algorithm.name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = algorithm.name === 'RSA-OAEP' ? 'enc' : 'sig';
       validateJwk(keyData, 'RSA', extractable, usagesSet, expectedUse);
 
@@ -204,11 +208,6 @@ function rsaImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        algorithm.name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
@@ -241,19 +240,16 @@ function rsaSignVerify(key, data, { saltLength }, signature) {
     throw lazyDOMException(`Key must be a ${type} key`, 'InvalidAccessError');
 
   const algorithm = getCryptoKeyAlgorithm(key);
-  if (algorithm.name === 'RSA-PSS') {
-    try {
-      validateInt32(
-        saltLength,
-        'algorithm.saltLength',
-        0,
-        MathCeil((algorithm.modulusLength - 1) / 8) -
-          getDigestSizeInBytes(algorithm.hash.name) - 2);
-    } catch (err) {
-      throw lazyDOMException(
-        'The operation failed for an operation-specific reason',
-        { name: 'OperationError', cause: err });
-    }
+  // RsaPssParams converts saltLength to an unsigned long, but SignJob only
+  // accepts int32 values.
+  if (algorithm.name === 'RSA-PSS' && !isInt32(saltLength)) {
+    // EMSA-PSS-VERIFY treats an impossible salt length as inconsistent.
+    if (mode === kSignJobModeVerify)
+      return false;
+
+    throw lazyDOMException(
+      'The operation failed for an operation-specific reason',
+      'OperationError');
   }
 
   return jobPromise(() => new SignJob(
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 08088069f9f6..ebaf0bfd620c 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -5,6 +5,7 @@ const {
   ArrayBufferPrototypeGetByteLength,
   ArrayPrototypeIncludes,
   ArrayPrototypePush,
+  ArrayPrototypeSlice,
   BigInt,
   DataViewPrototypeGetBuffer,
   DataViewPrototypeGetByteLength,
@@ -35,9 +36,11 @@ const {
   getCiphers: _getCiphers,
   getCurves: _getCurves,
   getHashes: _getHashes,
+  getMacs: _getMacs,
   setEngine: _setEngine,
   secureHeapUsed: _secureHeapUsed,
   getCachedAliases,
+  getCachedMacAliases,
   getOpenSSLSecLevelCrypto: getOpenSSLSecLevel,
   EVP_PKEY_ML_DSA_44,
   EVP_PKEY_ML_DSA_65,
@@ -48,6 +51,7 @@ const {
   kKeyVariantAES_OCB_128: hasAesOcbMode,
   Argon2Job,
   getFipsCrypto,
+  getFipsCryptoGeneration,
   KmacJob,
 } = internalBinding('crypto');
 
@@ -117,24 +121,82 @@ function toBuf(val, encoding) {
 }
 
 let _hashCache;
+let _macCache;
+if (isBuildingSnapshot()) {
+  addSerializeCallback(() => {
+    _hashCache = undefined;
+    _macCache = undefined;
+  });
+}
+
 function getHashCache() {
-  if (_hashCache === undefined) {
-    _hashCache = getCachedAliases();
-    if (isBuildingSnapshot()) {
-      // For dynamic linking, clear the map.
-      addSerializeCallback(() => { _hashCache = undefined; });
-    }
+  while (_hashCache === undefined) {
+    const generation = getFipsCryptoGeneration();
+    const cache = getCachedAliases();
+    if (generation !== getFipsCryptoGeneration()) continue;
+    _hashCache = cache;
   }
   return _hashCache;
 }
 
+function getMacCache() {
+  while (_macCache === undefined) {
+    const generation = getFipsCryptoGeneration();
+    const cache = getCachedMacAliases();
+    if (generation !== getFipsCryptoGeneration()) continue;
+    _macCache = cache;
+  }
+  return _macCache;
+}
+
+function cachedArrayByFipsGeneration(fn, onRefresh) {
+  let result;
+  let generation;
+  if (isBuildingSnapshot()) {
+    addSerializeCallback(() => {
+      result = undefined;
+      generation = undefined;
+    });
+  }
+
+  return () => {
+    while (true) {
+      const current = getFipsCryptoGeneration();
+      if (result === undefined || generation !== current) {
+        const next = fn();
+        if (current !== getFipsCryptoGeneration()) continue;
+        result = next;
+        generation = current;
+        if (onRefresh !== undefined) onRefresh();
+      }
+      return ArrayPrototypeSlice(result);
+    }
+  };
+}
+
 function getCachedHashId(algorithm) {
   const result = getHashCache()[algorithm];
   return result === undefined ? -1 : result;
 }
 
-const getCiphers = cachedResult(() => filterDuplicateStrings(_getCiphers()));
-const getHashes = cachedResult(() => filterDuplicateStrings(_getHashes()));
+function getCachedMacId(algorithm) {
+  const result = getMacCache()[algorithm];
+  return result === undefined ? -1 : result;
+}
+
+const getCiphers = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getCiphers()));
+const getHashes = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getHashes()),
+  () => {
+    _hashCache = undefined;
+  });
+const getMacs = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getMacs(), true),
+  () => {
+    _macCache = undefined;
+  });
+
 const getCurves = cachedResult(() => filterDuplicateStrings(_getCurves()));
 
 function setEngine(id, flags) {
@@ -1034,22 +1096,6 @@ function getBlockSize(name) {
   }
 }
 
-function getDigestSizeInBytes(name) {
-  switch (name) {
-    case 'SHA-1':
-      return 20;
-    case 'SHA-256': // Fall through
-    case 'SHA3-256':
-      return 32;
-    case 'SHA-384': // Fall through
-    case 'SHA3-384':
-      return 48;
-    case 'SHA-512': // Fall through
-    case 'SHA3-512':
-      return 64;
-  }
-}
-
 function validateKeyOps(keyOps, usagesSet) {
   if (keyOps === undefined) return;
   validateArray(keyOps, 'keyData.key_ops');
@@ -1099,6 +1145,7 @@ module.exports = {
   getCurves,
   getDataViewOrTypedArrayBuffer,
   getHashes,
+  getMacs,
   getOptionalByteLength,
   kHandle,
   setEngine,
@@ -1123,7 +1170,6 @@ module.exports = {
   bigIntArrayToUnsignedBigInt,
   bigIntArrayToUnsignedInt,
   getBlockSize,
-  getDigestSizeInBytes,
   getStringOption,
   getUsagesMask,
   getUsagesFromMask,
@@ -1132,5 +1178,7 @@ module.exports = {
   secureHeapUsed,
   getCachedHashId,
   getHashCache,
+  getCachedMacId,
+  getMacCache,
   getOpenSSLSecLevel,
 };
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index 55953d8e4745..f8a1ef8d00e7 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -482,19 +482,20 @@ function deriveKeyImpl(
 }
 
 function exportKeySpki(key) {
+  let exporter;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'RSASSA-PKCS1-v1_5':
       // Fall through
     case 'RSA-PSS':
       // Fall through
     case 'RSA-OAEP':
-      return require('internal/crypto/rsa')
-        .rsaExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/rsa').rsaExportKey;
+      break;
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -502,41 +503,47 @@ function exportKeySpki(key) {
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'public')
+    throw lazyDOMException('Key must be a public key', 'InvalidAccessError');
+
+  return exporter(key, kWebCryptoKeyFormatSPKI);
 }
 
 function exportKeyPkcs8(key) {
+  let exporter;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'RSASSA-PKCS1-v1_5':
       // Fall through
     case 'RSA-PSS':
       // Fall through
     case 'RSA-OAEP':
-      return require('internal/crypto/rsa')
-        .rsaExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/rsa').rsaExportKey;
+      break;
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -544,25 +551,30 @@ function exportKeyPkcs8(key) {
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'private')
+    throw lazyDOMException('Key must be a private key', 'InvalidAccessError');
+
+  return exporter(key, kWebCryptoKeyFormatPKCS8);
 }
 
 function exportKeyRawPublic(key, format) {
@@ -767,15 +779,11 @@ function exportKeySync(format, key) {
   let result;
   switch (format) {
     case 'spki': {
-      if (type === 'public') {
-        result = exportKeySpki(key);
-      }
+      result = exportKeySpki(key);
       break;
     }
     case 'pkcs8': {
-      if (type === 'private') {
-        result = exportKeyPkcs8(key);
-      }
+      result = exportKeyPkcs8(key);
       break;
     }
     case 'jwk': {
diff --git a/lib/internal/crypto/x509.js b/lib/internal/crypto/x509.js
index a75425ffcac8..cf1de4474756 100644
--- a/lib/internal/crypto/x509.js
+++ b/lib/internal/crypto/x509.js
@@ -1,13 +1,15 @@
 'use strict';
 
 const {
+  FunctionPrototypeCall,
+  ObjectGetPrototypeOf,
   ObjectSetPrototypeOf,
-  SafeMap,
-  Symbol,
+  SafeWeakMap,
 } = primordials;
 
 const {
-  parseX509,
+  createX509CertificateClass,
+  isX509Certificate: isNativeX509Certificate,
   X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT,
   X509_CHECK_FLAG_NEVER_CHECK_SUBJECT,
   X509_CHECK_FLAG_NO_WILDCARDS,
@@ -46,26 +48,13 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_THIS,
   },
 } = require('internal/errors');
 
-const {
-  markTransferMode,
-  kClone,
-  kDeserialize,
-} = require('internal/worker/js_transferable');
-
-const {
-  kHandle,
-} = require('internal/crypto/util');
-
 let lazyTranslatePeerCertificate;
 
-const kInternalState = Symbol('kInternalState');
-
-function isX509Certificate(value) {
-  return value[kInternalState] !== undefined;
-}
+let isX509Certificate;
 
 function getFlags(options = kEmptyObject) {
   validateObject(options, 'options');
@@ -96,312 +85,347 @@ function getFlags(options = kEmptyObject) {
   return flags;
 }
 
-class InternalX509Certificate {
-  [kInternalState] = new SafeMap();
-
-  constructor(handle) {
-    markTransferMode(this, true, false);
-    this[kHandle] = handle;
-  }
+const crossRealmState = new SafeWeakMap();
+
+const kSlotSubject = 0;
+const kSlotSubjectAltName = 1;
+const kSlotIssuer = 2;
+const kSlotIssuerCertificate = 3;
+const kSlotInfoAccess = 4;
+const kSlotValidFrom = 5;
+const kSlotValidTo = 6;
+const kSlotValidFromDate = 7;
+const kSlotValidToDate = 8;
+const kSlotFingerprint = 9;
+const kSlotFingerprint256 = 10;
+const kSlotFingerprint512 = 11;
+const kSlotKeyUsage = 12;
+const kSlotSerialNumber = 13;
+const kSlotSignatureAlgorithm = 14;
+const kSlotSignatureAlgorithmOid = 15;
+const kSlotRaw = 16;
+const kSlotPublicKey = 17;
+const kSlotPem = 18;
+const kSlotCA = 19;
+const kStateCacheMask = 20;
+
+function createState() {
+  const state = [];
+  state[kStateCacheMask] = 0;
+  return state;
 }
 
-class X509Certificate {
-  [kInternalState] = new SafeMap();
-
-  constructor(buffer) {
-    if (typeof buffer === 'string')
-      buffer = Buffer.from(buffer);
-    if (!isArrayBufferView(buffer)) {
-      throw new ERR_INVALID_ARG_TYPE(
-        'buffer',
-        ['string', 'Buffer', 'TypedArray', 'DataView'],
-        buffer);
+let InternalX509Certificate;
+
+const {
+  0: X509Certificate,
+  1: InternalX509CertificateConstructor,
+} = createX509CertificateClass((NativeX509Certificate) => {
+  const {
+    checkCA: nativeCheckCA,
+    checkEmail: nativeCheckEmail,
+    checkHost: nativeCheckHost,
+    checkIP: nativeCheckIP,
+    checkIssued: nativeCheckIssued,
+    checkPrivateKey: nativeCheckPrivateKey,
+    fingerprint: nativeFingerprint,
+    fingerprint256: nativeFingerprint256,
+    fingerprint512: nativeFingerprint512,
+    getIssuerCert: nativeGetIssuerCert,
+    infoAccess: nativeInfoAccess,
+    issuer: nativeIssuer,
+    keyUsage: nativeKeyUsage,
+    pem: nativePem,
+    publicKey: nativePublicKey,
+    raw: nativeRaw,
+    serialNumber: nativeSerialNumber,
+    signatureAlgorithm: nativeSignatureAlgorithm,
+    signatureAlgorithmOid: nativeSignatureAlgorithmOid,
+    subject: nativeSubject,
+    subjectAltName: nativeSubjectAltName,
+    toLegacy: nativeToLegacy,
+    validFrom: nativeValidFrom,
+    validFromDate: nativeValidFromDate,
+    validTo: nativeValidTo,
+    validToDate: nativeValidToDate,
+    verify: nativeVerify,
+  } = NativeX509Certificate.prototype;
+
+  let getState;
+
+  function getCachedValue(cert, index, getter) {
+    const state = getState(cert);
+    const bit = 1 << index;
+    if ((state[kStateCacheMask] & bit) === 0) {
+      state[index] = FunctionPrototypeCall(getter, cert);
+      state[kStateCacheMask] |= bit;
+    }
+    return state[index];
+  }
+
+  class X509Certificate {
+    constructor(buffer) {
+      if (typeof buffer === 'string')
+        buffer = Buffer.from(buffer);
+      if (!isArrayBufferView(buffer)) {
+        throw new ERR_INVALID_ARG_TYPE(
+          'buffer',
+          ['string', 'Buffer', 'TypedArray', 'DataView'],
+          buffer);
+      }
+      const prototype = ObjectGetPrototypeOf(this);
+      const certificate = new InternalX509Certificate(buffer);
+      ObjectSetPrototypeOf(certificate, prototype);
+      // eslint-disable-next-line no-constructor-return
+      return certificate;
     }
-    markTransferMode(this, true, false);
-    this[kHandle] = parseX509(buffer);
-  }
 
-  [kInspect](depth, options) {
-    if (depth < 0)
-      return this;
-
-    const opts = {
-      ...options,
-      depth: options.depth == null ? null : options.depth - 1,
-    };
-
-    return `X509Certificate ${inspect({
-      subject: this.subject,
-      subjectAltName: this.subjectAltName,
-      issuer: this.issuer,
-      infoAccess: this.infoAccess,
-      validFrom: this.validFrom,
-      validTo: this.validTo,
-      validFromDate: this.validFromDate,
-      validToDate: this.validToDate,
-      fingerprint: this.fingerprint,
-      fingerprint256: this.fingerprint256,
-      fingerprint512: this.fingerprint512,
-      keyUsage: this.keyUsage,
-      serialNumber: this.serialNumber,
-      signatureAlgorithm: this.signatureAlgorithm,
-      signatureAlgorithmOid: this.signatureAlgorithmOid,
-    }, opts)}`;
-  }
+    [kInspect](depth, options) {
+      if (depth < 0)
+        return this;
+
+      const opts = {
+        ...options,
+        depth: options.depth == null ? null : options.depth - 1,
+      };
+
+      return `X509Certificate ${inspect({
+        subject: getCachedValue(this, kSlotSubject, nativeSubject),
+        subjectAltName:
+          getCachedValue(this, kSlotSubjectAltName, nativeSubjectAltName),
+        issuer: getCachedValue(this, kSlotIssuer, nativeIssuer),
+        infoAccess: getCachedValue(this, kSlotInfoAccess, nativeInfoAccess),
+        validFrom: getCachedValue(this, kSlotValidFrom, nativeValidFrom),
+        validTo: getCachedValue(this, kSlotValidTo, nativeValidTo),
+        validFromDate:
+          getCachedValue(this, kSlotValidFromDate, nativeValidFromDate),
+        validToDate:
+          getCachedValue(this, kSlotValidToDate, nativeValidToDate),
+        fingerprint:
+          getCachedValue(this, kSlotFingerprint, nativeFingerprint),
+        fingerprint256:
+          getCachedValue(this, kSlotFingerprint256, nativeFingerprint256),
+        fingerprint512:
+          getCachedValue(this, kSlotFingerprint512, nativeFingerprint512),
+        keyUsage: getCachedValue(this, kSlotKeyUsage, nativeKeyUsage),
+        serialNumber:
+          getCachedValue(this, kSlotSerialNumber, nativeSerialNumber),
+        signatureAlgorithm:
+          getCachedValue(
+            this, kSlotSignatureAlgorithm, nativeSignatureAlgorithm),
+        signatureAlgorithmOid:
+          getCachedValue(
+            this, kSlotSignatureAlgorithmOid, nativeSignatureAlgorithmOid),
+      }, opts)}`;
+    }
 
-  [kClone]() {
-    const handle = this[kHandle];
-    return {
-      data: { handle },
-      deserializeInfo: 'internal/crypto/x509:InternalX509Certificate',
-    };
-  }
+    get subject() {
+      return getCachedValue(this, kSlotSubject, nativeSubject);
+    }
 
-  [kDeserialize]({ handle }) {
-    this[kHandle] = handle;
-  }
+    get subjectAltName() {
+      return getCachedValue(
+        this, kSlotSubjectAltName, nativeSubjectAltName);
+    }
 
-  get subject() {
-    let value = this[kInternalState].get('subject');
-    if (value === undefined) {
-      value = this[kHandle].subject();
-      this[kInternalState].set('subject', value);
+    get issuer() {
+      return getCachedValue(this, kSlotIssuer, nativeIssuer);
     }
-    return value;
-  }
 
-  get subjectAltName() {
-    let value = this[kInternalState].get('subjectAltName');
-    if (value === undefined) {
-      value = this[kHandle].subjectAltName();
-      this[kInternalState].set('subjectAltName', value);
+    get issuerCertificate() {
+      const state = getState(this);
+      const bit = 1 << kSlotIssuerCertificate;
+      if ((state[kStateCacheMask] & bit) === 0) {
+        const cert = FunctionPrototypeCall(nativeGetIssuerCert, this);
+        state[kSlotIssuerCertificate] = cert ?
+          new InternalX509Certificate(cert) : undefined;
+        state[kStateCacheMask] |= bit;
+      }
+      return state[kSlotIssuerCertificate];
     }
-    return value;
-  }
 
-  get issuer() {
-    let value = this[kInternalState].get('issuer');
-    if (value === undefined) {
-      value = this[kHandle].issuer();
-      this[kInternalState].set('issuer', value);
+    get infoAccess() {
+      return getCachedValue(this, kSlotInfoAccess, nativeInfoAccess);
     }
-    return value;
-  }
 
-  get issuerCertificate() {
-    let value = this[kInternalState].get('issuerCertificate');
-    if (value === undefined) {
-      const cert = this[kHandle].getIssuerCert();
-      if (cert)
-        value = new InternalX509Certificate(cert);
-      this[kInternalState].set('issuerCertificate', value);
+    get validFrom() {
+      return getCachedValue(this, kSlotValidFrom, nativeValidFrom);
     }
-    return value;
-  }
 
-  get infoAccess() {
-    let value = this[kInternalState].get('infoAccess');
-    if (value === undefined) {
-      value = this[kHandle].infoAccess();
-      this[kInternalState].set('infoAccess', value);
+    get validTo() {
+      return getCachedValue(this, kSlotValidTo, nativeValidTo);
     }
-    return value;
-  }
 
-  get validFrom() {
-    let value = this[kInternalState].get('validFrom');
-    if (value === undefined) {
-      value = this[kHandle].validFrom();
-      this[kInternalState].set('validFrom', value);
+    get validFromDate() {
+      return getCachedValue(this, kSlotValidFromDate, nativeValidFromDate);
     }
-    return value;
-  }
 
-  get validTo() {
-    let value = this[kInternalState].get('validTo');
-    if (value === undefined) {
-      value = this[kHandle].validTo();
-      this[kInternalState].set('validTo', value);
+    get validToDate() {
+      return getCachedValue(this, kSlotValidToDate, nativeValidToDate);
     }
-    return value;
-  }
 
-  get validFromDate() {
-    let value = this[kInternalState].get('validFromDate');
-    if (value === undefined) {
-      value = this[kHandle].validFromDate();
-      this[kInternalState].set('validFromDate', value);
+    get fingerprint() {
+      return getCachedValue(this, kSlotFingerprint, nativeFingerprint);
     }
-    return value;
-  }
 
-  get validToDate() {
-    let value = this[kInternalState].get('validToDate');
-    if (value === undefined) {
-      value = this[kHandle].validToDate();
-      this[kInternalState].set('validToDate', value);
+    get fingerprint256() {
+      return getCachedValue(this, kSlotFingerprint256, nativeFingerprint256);
     }
-    return value;
-  }
 
-  get fingerprint() {
-    let value = this[kInternalState].get('fingerprint');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint();
-      this[kInternalState].set('fingerprint', value);
+    get fingerprint512() {
+      return getCachedValue(this, kSlotFingerprint512, nativeFingerprint512);
     }
-    return value;
-  }
 
-  get fingerprint256() {
-    let value = this[kInternalState].get('fingerprint256');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint256();
-      this[kInternalState].set('fingerprint256', value);
+    get keyUsage() {
+      return getCachedValue(this, kSlotKeyUsage, nativeKeyUsage);
     }
-    return value;
-  }
 
-  get fingerprint512() {
-    let value = this[kInternalState].get('fingerprint512');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint512();
-      this[kInternalState].set('fingerprint512', value);
+    get serialNumber() {
+      return getCachedValue(this, kSlotSerialNumber, nativeSerialNumber);
     }
-    return value;
-  }
 
-  get keyUsage() {
-    let value = this[kInternalState].get('keyUsage');
-    if (value === undefined) {
-      value = this[kHandle].keyUsage();
-      this[kInternalState].set('keyUsage', value);
+    get signatureAlgorithm() {
+      return getCachedValue(
+        this, kSlotSignatureAlgorithm, nativeSignatureAlgorithm);
     }
-    return value;
-  }
 
-  get serialNumber() {
-    let value = this[kInternalState].get('serialNumber');
-    if (value === undefined) {
-      value = this[kHandle].serialNumber();
-      this[kInternalState].set('serialNumber', value);
+    get signatureAlgorithmOid() {
+      return getCachedValue(
+        this, kSlotSignatureAlgorithmOid, nativeSignatureAlgorithmOid);
     }
-    return value;
-  }
 
-  get signatureAlgorithm() {
-    let value = this[kInternalState].get('signatureAlgorithm');
-    if (value === undefined) {
-      value = this[kHandle].signatureAlgorithm();
-      this[kInternalState].set('signatureAlgorithm', value);
+    get raw() {
+      return getCachedValue(this, kSlotRaw, nativeRaw);
     }
-    return value;
-  }
 
-  get signatureAlgorithmOid() {
-    let value = this[kInternalState].get('signatureAlgorithmOid');
-    if (value === undefined) {
-      value = this[kHandle].signatureAlgorithmOid();
-      this[kInternalState].set('signatureAlgorithmOid', value);
+    get publicKey() {
+      const state = getState(this);
+      const bit = 1 << kSlotPublicKey;
+      if ((state[kStateCacheMask] & bit) === 0) {
+        state[kSlotPublicKey] = new PublicKeyObject(
+          FunctionPrototypeCall(nativePublicKey, this));
+        state[kStateCacheMask] |= bit;
+      }
+      return state[kSlotPublicKey];
     }
-    return value;
-  }
 
-  get raw() {
-    let value = this[kInternalState].get('raw');
-    if (value === undefined) {
-      value = this[kHandle].raw();
-      this[kInternalState].set('raw', value);
+    toString() {
+      return getCachedValue(this, kSlotPem, nativePem);
     }
-    return value;
-  }
 
-  get publicKey() {
-    let value = this[kInternalState].get('publicKey');
-    if (value === undefined) {
-      value = new PublicKeyObject(this[kHandle].publicKey());
-      this[kInternalState].set('publicKey', value);
+    // There's no standardized JSON encoding for X509 certs so we
+    // fallback to providing the PEM encoding as a string.
+    toJSON() { return getCachedValue(this, kSlotPem, nativePem); }
+
+    get ca() {
+      return getCachedValue(this, kSlotCA, nativeCheckCA);
     }
-    return value;
-  }
 
-  toString() {
-    let value = this[kInternalState].get('pem');
-    if (value === undefined) {
-      value = this[kHandle].pem();
-      this[kInternalState].set('pem', value);
+    checkHost(name, options) {
+      getState(this);
+      validateString(name, 'name');
+      return FunctionPrototypeCall(
+        nativeCheckHost, this, name, getFlags(options));
     }
-    return value;
-  }
 
-  // There's no standardized JSON encoding for X509 certs so we
-  // fallback to providing the PEM encoding as a string.
-  toJSON() { return this.toString(); }
+    checkEmail(email, options) {
+      getState(this);
+      validateString(email, 'email');
+      return FunctionPrototypeCall(
+        nativeCheckEmail, this, email, getFlags(options));
+    }
 
-  get ca() {
-    let value = this[kInternalState].get('ca');
-    if (value === undefined) {
-      value = this[kHandle].checkCA();
-      this[kInternalState].set('ca', value);
+    checkIP(ip, options) {
+      getState(this);
+      validateString(ip, 'ip');
+      // The options argument is currently undocumented since none of the
+      // options have any effect on the behavior of this function. However, we
+      // still parse the options argument in case OpenSSL adds flags in the
+      // future that do affect the behavior of X509_check_ip. This ensures that
+      // no invalid values are passed as the second argument in the meantime.
+      return FunctionPrototypeCall(
+        nativeCheckIP, this, ip, getFlags(options));
     }
-    return value;
-  }
 
-  checkHost(name, options) {
-    validateString(name, 'name');
-    return this[kHandle].checkHost(name, getFlags(options));
-  }
+    checkIssued(otherCert) {
+      getState(this);
+      if (!isX509Certificate(otherCert)) {
+        throw new ERR_INVALID_ARG_TYPE(
+          'otherCert', 'X509Certificate', otherCert);
+      }
+      return FunctionPrototypeCall(nativeCheckIssued, this, otherCert);
+    }
 
-  checkEmail(email, options) {
-    validateString(email, 'email');
-    return this[kHandle].checkEmail(email, getFlags(options));
-  }
+    checkPrivateKey(pkey) {
+      getState(this);
+      if (!isKeyObject(pkey))
+        throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
+      if (getKeyObjectType(pkey) !== 'private')
+        throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
+      return FunctionPrototypeCall(
+        nativeCheckPrivateKey, this, getKeyObjectHandle(pkey));
+    }
 
-  checkIP(ip, options) {
-    validateString(ip, 'ip');
-    // The options argument is currently undocumented since none of the options
-    // have any effect on the behavior of this function. However, we still parse
-    // the options argument in case OpenSSL adds flags in the future that do
-    // affect the behavior of X509_check_ip. This ensures that no invalid values
-    // are passed as the second argument in the meantime.
-    return this[kHandle].checkIP(ip, getFlags(options));
-  }
+    verify(pkey) {
+      getState(this);
+      if (!isKeyObject(pkey))
+        throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
+      if (getKeyObjectType(pkey) !== 'public')
+        throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
+      return FunctionPrototypeCall(
+        nativeVerify, this, getKeyObjectHandle(pkey));
+    }
 
-  checkIssued(otherCert) {
-    if (!isX509Certificate(otherCert))
-      throw new ERR_INVALID_ARG_TYPE('otherCert', 'X509Certificate', otherCert);
-    return this[kHandle].checkIssued(otherCert[kHandle]);
+    toLegacyObject() {
+      getState(this);
+      // TODO(tniessen): do not depend on translatePeerCertificate here, return
+      // the correct legacy representation from the binding
+      lazyTranslatePeerCertificate ??=
+        require('internal/tls/common').translatePeerCertificate;
+      return lazyTranslatePeerCertificate(
+        FunctionPrototypeCall(nativeToLegacy, this));
+    }
   }
 
-  checkPrivateKey(pkey) {
-    if (!isKeyObject(pkey))
-      throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
-    if (getKeyObjectType(pkey) !== 'private')
-      throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
-    return this[kHandle].checkPrivateKey(getKeyObjectHandle(pkey));
-  }
+  InternalX509Certificate = class InternalX509Certificate
+    extends NativeX509Certificate {
+    #state = createState();
+
+    static {
+      isX509Certificate = (value) => {
+        if (value == null || typeof value !== 'object') return false;
+        return #state in value || isNativeX509Certificate(value);
+      };
+
+      getState = (cert) => {
+        try {
+          return cert.#state;
+        } catch {
+          // Continue with the cross-realm native brand check.
+        }
+        if (!isNativeX509Certificate(cert)) {
+          throw new ERR_INVALID_THIS('X509Certificate');
+        }
+        let state = crossRealmState.get(cert);
+        if (state === undefined) {
+          state = createState();
+          crossRealmState.set(cert, state);
+        }
+        return state;
+      };
+    }
+  };
 
-  verify(pkey) {
-    if (!isKeyObject(pkey))
-      throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
-    if (getKeyObjectType(pkey) !== 'public')
-      throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
-    return this[kHandle].verify(getKeyObjectHandle(pkey));
-  }
+  InternalX509Certificate.prototype.constructor = X509Certificate;
+  ObjectSetPrototypeOf(
+    InternalX509Certificate.prototype,
+    X509Certificate.prototype);
 
-  toLegacyObject() {
-    // TODO(tniessen): do not depend on translatePeerCertificate here, return
-    // the correct legacy representation from the binding
-    lazyTranslatePeerCertificate ??=
-      require('internal/tls/common').translatePeerCertificate;
-    return lazyTranslatePeerCertificate(this[kHandle].toLegacy());
-  }
-}
+  return [X509Certificate, InternalX509Certificate];
+});
 
-InternalX509Certificate.prototype.constructor = X509Certificate;
-ObjectSetPrototypeOf(
-  InternalX509Certificate.prototype,
-  X509Certificate.prototype);
+// Keep the binding-returned constructor and the closure reference aligned.
+InternalX509Certificate = InternalX509CertificateConstructor;
 
 module.exports = {
   X509Certificate,
diff --git a/lib/internal/dtls/dtls.js b/lib/internal/dtls/dtls.js
new file mode 100644
index 000000000000..e6017e3e8761
--- /dev/null
+++ b/lib/internal/dtls/dtls.js
@@ -0,0 +1,703 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  ArrayIsArray,
+  FunctionPrototypeBind,
+  PromisePrototypeThen,
+  PromiseWithResolvers,
+  SafeSet,
+  SymbolAsyncDispose,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+// DTLS requires that Node.js be compiled with crypto support.
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+const {
+  codes: {
+    ERR_ILLEGAL_CONSTRUCTOR,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_MISSING_ARGS,
+  },
+} = require('internal/errors');
+
+const {
+  validateFunction,
+  validateObject,
+  validateString,
+  validateInteger,
+} = require('internal/validators');
+
+const {
+  Buffer,
+} = require('buffer');
+
+const {
+  isIP,
+} = require('internal/net');
+
+const {
+  DTLSEndpointState,
+  DTLSSessionState,
+} = require('internal/dtls/state');
+
+const {
+  DTLSEndpointStats,
+  DTLSSessionStats,
+} = require('internal/dtls/stats');
+
+const {
+  kOwner,
+  kPrivateConstructor,
+  kSessionHandshake,
+  kSessionMessage,
+  kSessionError,
+  kSessionClose,
+  kSessionKeylog,
+} = require('internal/dtls/symbols');
+
+const {
+  DTLSContext: DTLSContext_,
+  DTLSEndpoint: DTLSEndpoint_,
+  SSL_VERIFY_NONE_VALUE,
+  SSL_VERIFY_PEER_VALUE,
+  SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE,
+} = internalBinding('dtls');
+
+const kEmptyObject = { __proto__: null };
+
+// ============================================================================
+// DTLSSession -- represents a single DTLS peer association
+// ============================================================================
+
+class DTLSSession {
+  #handle;
+  #endpoint;
+  #state;
+  #stats;
+  #pendingOpen;
+  #pendingClose;
+  #onmessage;
+  #onerror;
+  #onhandshake;
+  #onkeylog;
+  #ownsEndpoint = false;
+
+  constructor(privateSymbol, handle, endpoint) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+
+    this.#handle = handle;
+    this.#handle[kOwner] = this;
+    this.#endpoint = endpoint;
+    this.#state = new DTLSSessionState(
+      kPrivateConstructor, handle.getState());
+    this.#stats = new DTLSSessionStats(
+      kPrivateConstructor, handle.getStats());
+    this.#pendingOpen = PromiseWithResolvers();
+    this.#pendingClose = PromiseWithResolvers();
+    // opened/closed may reject (handshake error, destroy(error)). Attach a
+    // no-op rejection handler so a caller that uses the callback API and never
+    // awaits them does not trigger an unhandled rejection; an explicit
+    // await/then/catch on opened/closed still observes the rejection.
+    PromisePrototypeThen(this.#pendingOpen.promise, undefined, () => {});
+    PromisePrototypeThen(this.#pendingClose.promise, undefined, () => {});
+  }
+
+  // --- Callback setters ---
+
+  set onmessage(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onmessage');
+      this.#onmessage = FunctionPrototypeBind(fn, this);
+      this.#state.hasMessageListener = true;
+    } else {
+      this.#onmessage = undefined;
+      this.#state.hasMessageListener = false;
+    }
+  }
+
+  get onmessage() { return this.#onmessage; }
+
+  set onerror(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onerror');
+      this.#onerror = FunctionPrototypeBind(fn, this);
+    } else {
+      this.#onerror = undefined;
+    }
+  }
+
+  get onerror() { return this.#onerror; }
+
+  set onhandshake(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onhandshake');
+      this.#onhandshake = FunctionPrototypeBind(fn, this);
+    } else {
+      this.#onhandshake = undefined;
+    }
+  }
+
+  get onhandshake() { return this.#onhandshake; }
+
+  set onkeylog(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onkeylog');
+      this.#onkeylog = FunctionPrototypeBind(fn, this);
+    } else {
+      this.#onkeylog = undefined;
+    }
+  }
+
+  get onkeylog() { return this.#onkeylog; }
+
+  // --- Send data ---
+
+  send(data) {
+    if (this.#handle === null) {
+      throw new ERR_INVALID_STATE('Session is destroyed');
+    }
+    if (typeof data === 'string') {
+      data = Buffer.from(data);
+    }
+    if (!Buffer.isBuffer(data)) {
+      throw new ERR_INVALID_ARG_TYPE('data', ['string', 'Buffer'], data);
+    }
+    return this.#handle.send(data);
+  }
+
+  // --- Lifecycle ---
+
+  close() {
+    if (this.#handle === null) return this.closed;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.close();
+    return this.closed;
+  }
+
+  destroy(error) {
+    if (this.#handle === null) return;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.destroy();
+    if (error) {
+      this.#pendingClose.reject(error);
+    } else {
+      this.#pendingClose.resolve();
+    }
+  }
+
+  get opened() { return this.#pendingOpen.promise; }
+  get closed() { return this.#pendingClose.promise; }
+
+  // --- Properties ---
+
+  get remoteAddress() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getRemoteAddress();
+  }
+
+  get protocol() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getProtocol();
+  }
+
+  get cipher() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getCipher();
+  }
+
+  get peerCertificate() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getPeerCertificate();
+  }
+
+  get alpnProtocol() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getALPNProtocol();
+  }
+
+  get srtpProfile() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getSRTPProfile();
+  }
+
+  get servername() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getServername();
+  }
+
+  get state() { return this.#state; }
+  get stats() { return this.#stats; }
+  get endpoint() { return this.#endpoint; }
+
+  exportKeyingMaterial(length, label, context) {
+    if (this.#handle === null) {
+      throw new ERR_INVALID_STATE('Session is destroyed');
+    }
+    return this.#handle.exportKeyingMaterial(length, label, context);
+  }
+
+  // --- Internal callbacks (called from C++ via endpoint dispatch) ---
+
+  [kSessionHandshake](protocol) {
+    this.#pendingOpen.resolve({ protocol });
+    if (this.#onhandshake) {
+      this.#onhandshake(protocol);
+    }
+  }
+
+  [kSessionMessage](data) {
+    if (this.#onmessage) {
+      this.#onmessage(data);
+    }
+  }
+
+  [kSessionError](message) {
+    const error = new ERR_INVALID_STATE(message);
+    if (this.#onerror) {
+      this.#onerror(error);
+    }
+    this.#pendingOpen.reject(error);
+
+    // The session has failed and cannot continue. Tear it down so it does not
+    // linger in the endpoint's table, and -- for a client session that owns
+    // its internal endpoint -- close the endpoint too so the event loop can
+    // drain. destroy() removes the session from the C++ table first, so the
+    // endpoint.close() below won't try to re-close it. Reentrant destroy from
+    // within the error emit is safe: Cycle()/the timer hold a strong ref.
+    const endpoint = this.#endpoint;
+    const ownsEndpoint = this.#ownsEndpoint;
+    this.destroy();
+    if (endpoint) {
+      endpoint.sessions.delete(this);
+      if (ownsEndpoint) {
+        endpoint.close();
+      }
+    }
+  }
+
+  [kSessionClose]() {
+    this.#pendingClose.resolve();
+    this.#handle = null;
+    // Remove from the endpoint's JS-side session set.
+    if (this.#endpoint) {
+      this.#endpoint.sessions.delete(this);
+    }
+    // If this session owns its endpoint (client-side connect()),
+    // close the endpoint too so the process can exit.
+    if (this.#ownsEndpoint && this.#endpoint) {
+      this.#endpoint.close();
+    }
+  }
+
+  // Mark that this session owns its endpoint (for client sessions
+  // created by connect() where the endpoint is internal).
+  get ownsEndpoint() { return this.#ownsEndpoint; }
+  set ownsEndpoint(val) { this.#ownsEndpoint = val; }
+
+  [kSessionKeylog](line) {
+    if (this.#onkeylog) {
+      this.#onkeylog(line);
+    }
+  }
+
+  async [SymbolAsyncDispose]() {
+    await this.close();
+  }
+}
+
+// ============================================================================
+// DTLSEndpoint -- manages a UDP socket and routes datagrams to sessions
+// ============================================================================
+
+class DTLSEndpoint {
+  #handle;
+  #state;
+  #stats;
+  #sessions = new SafeSet();
+  #pendingClose;
+  #onsession;
+  #onerror;
+
+  constructor(options = kEmptyObject) {
+    this.#handle = new DTLSEndpoint_();
+    this.#handle[kOwner] = this;
+    this.#state = new DTLSEndpointState(
+      kPrivateConstructor, this.#handle.getState());
+    this.#stats = new DTLSEndpointStats(
+      kPrivateConstructor, this.#handle.getStats());
+    this.#pendingClose = PromiseWithResolvers();
+    // See DTLSSession: keep an unobserved closed rejection from surfacing as an
+    // unhandled rejection.
+    PromisePrototypeThen(this.#pendingClose.promise, undefined, () => {});
+
+    if (options.mtu !== undefined) {
+      validateInteger(options.mtu, 'options.mtu', 256, 65535);
+      this.#handle.setMTU(options.mtu);
+    }
+
+    // Set up the callback dispatch from C++ to JS.
+    this.#handle.setCallbacks({
+      __proto__: null,
+      onEndpointClose: () => this.#onEndpointClose(),
+      onEndpointError: (msg) => this.#onEndpointError(msg),
+      onSessionNew: (handle) => this.#onSessionNew(handle),
+      onSessionClose: function() {
+        this[kOwner]?.[kSessionClose]();
+      },
+      onSessionError: function(msg) {
+        this[kOwner]?.[kSessionError](msg);
+      },
+      onSessionHandshake: function(protocol) {
+        this[kOwner]?.[kSessionHandshake](protocol);
+      },
+      onSessionMessage: function(data) {
+        this[kOwner]?.[kSessionMessage](data);
+      },
+      onSessionKeylog: function(line) {
+        this[kOwner]?.[kSessionKeylog](line);
+      },
+      onSessionTicket: function() {
+        // Session ticket handling - placeholder for resumption.
+      },
+    });
+  }
+
+  // --- Server mode ---
+
+  listen(callback, context) {
+    validateFunction(callback, 'callback');
+    this.#onsession = callback;
+    this.#handle.listen(context);
+    return this;
+  }
+
+  // --- Client mode ---
+
+  connect(context, host, port, servername) {
+    // Resolve SNI and the expected peer identity here so that every caller of
+    // the endpoint API -- not only the top-level dtls.connect() -- gets safe
+    // defaults. The identity is always bound to the requested servername (or,
+    // failing that, the host). OpenSSL only *enforces* it when the context is
+    // in a verifying mode, so binding it is a no-op for non-verifying
+    // (rejectUnauthorized: false) contexts.
+    //
+    // These are applied to the client SSL inside the binding, before the
+    // handshake's ClientHello is emitted; they cannot be set afterwards.
+    let sni = servername !== undefined ? (servername || undefined) : host;
+    if (sni !== undefined && isIP(sni) !== 0) {
+      sni = undefined;  // SNI is never sent for IP literals (matching TLS).
+    }
+    const verifyHost = servername || host;
+    const verifyIsIp = isIP(verifyHost) !== 0;
+
+    const sessionHandle = this.#handle.connect(
+      context, host, port, sni, verifyHost, verifyIsIp);
+    const session = new DTLSSession(
+      kPrivateConstructor, sessionHandle, this);
+    this.#sessions.add(session);
+    return session;
+  }
+
+  // --- Bind ---
+
+  bind(host, port) {
+    this.#handle.bind(host, port);
+    return this;
+  }
+
+  // --- Lifecycle ---
+
+  close() {
+    if (this.#handle === null) return this.closed;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.close();
+    return this.closed;
+  }
+
+  destroy(error) {
+    if (this.#handle === null) return;
+    const handle = this.#handle;
+    this.#handle = null;
+    handle.destroy();
+    if (error) {
+      this.#pendingClose.reject(error);
+    } else {
+      this.#pendingClose.resolve();
+    }
+  }
+
+  get closed() { return this.#pendingClose.promise; }
+
+  // --- Properties ---
+
+  get address() {
+    if (this.#handle === null) return undefined;
+    return this.#handle.getAddress();
+  }
+
+  get state() { return this.#state; }
+  get stats() { return this.#stats; }
+  get sessions() { return this.#sessions; }
+
+  get onerror() { return this.#onerror; }
+  set onerror(fn) {
+    if (fn !== undefined && fn !== null) {
+      validateFunction(fn, 'onerror');
+      this.#onerror = fn;
+    } else {
+      this.#onerror = undefined;
+    }
+  }
+
+  set busy(val) {
+    this.#state.busy = !!val;
+  }
+
+  get busy() {
+    return this.#state.busy;
+  }
+
+  // --- Internal callbacks ---
+
+  #onEndpointClose() {
+    this.#sessions.clear();
+    this.#pendingClose.resolve();
+    this.#handle = null;
+  }
+
+  #onEndpointError(message) {
+    if (this.#onerror) {
+      this.#onerror(new ERR_INVALID_STATE(message));
+    }
+  }
+
+  #onSessionNew(handle) {
+    const session = new DTLSSession(kPrivateConstructor, handle, this);
+    this.#sessions.add(session);
+    if (this.#onsession) {
+      this.#onsession(session);
+    }
+  }
+
+  async [SymbolAsyncDispose]() {
+    await this.close();
+  }
+}
+
+// ============================================================================
+// Public API functions
+// ============================================================================
+
+function createContext(options = kEmptyObject) {
+  validateObject(options, 'options');
+
+  const isServer = options.isServer === true;
+  const context = new DTLSContext_(isServer);
+
+  // Certificate
+  if (options.cert !== undefined) {
+    let cert = options.cert;
+    if (Buffer.isBuffer(cert)) cert = cert.toString();
+    validateString(cert, 'options.cert');
+    context.setCert(cert);
+  }
+
+  // Private key
+  if (options.key !== undefined) {
+    let key = options.key;
+    if (Buffer.isBuffer(key)) key = key.toString();
+    validateString(key, 'options.key');
+    context.setKey(key);
+  }
+
+  // CA certificates: if custom CAs are provided, use only those.
+  // Otherwise load system default CAs. This matches Node.js TLS behavior.
+  if (options.ca !== undefined) {
+    const cas = ArrayIsArray(options.ca) ? options.ca : [options.ca];
+    for (let ca of cas) {
+      if (Buffer.isBuffer(ca)) ca = ca.toString();
+      validateString(ca, 'options.ca');
+      context.addCACert(ca);
+    }
+  } else {
+    context.loadDefaultCAs();
+  }
+
+  // Ciphers
+  if (options.ciphers !== undefined) {
+    validateString(options.ciphers, 'options.ciphers');
+    context.setCiphers(options.ciphers);
+  }
+
+  // ECDH curve (default: 'auto' = OpenSSL default selection)
+  const ecdhCurve = options.ecdhCurve || 'auto';
+  validateString(ecdhCurve, 'options.ecdhCurve');
+  context.setECDHCurve(ecdhCurve);
+
+  // ALPN protocols
+  if (options.alpn !== undefined) {
+    let protocols = options.alpn;
+    if (ArrayIsArray(protocols)) {
+      // Convert string array to wire-format buffer.
+      const bufs = [];
+      for (const proto of protocols) {
+        validateString(proto, 'options.alpn[]');
+        const buf = Buffer.from(proto);
+        bufs.push(Buffer.from([buf.length]), buf);
+      }
+      protocols = Buffer.concat(bufs);
+    }
+    if (!Buffer.isBuffer(protocols)) {
+      throw new ERR_INVALID_ARG_TYPE(
+        'options.alpn', ['string[]', 'Buffer'], protocols);
+    }
+    context.setALPN(protocols);
+  }
+
+  // SRTP profiles
+  if (options.srtp !== undefined) {
+    validateString(options.srtp, 'options.srtp');
+    context.setSRTP(options.srtp);
+  }
+
+  // Verification mode
+  if (options.rejectUnauthorized !== undefined) {
+    const mode = options.rejectUnauthorized ?
+      (SSL_VERIFY_PEER_VALUE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE) :
+      SSL_VERIFY_NONE_VALUE;
+    context.setVerifyMode(mode);
+  } else if (options.requestCert) {
+    context.setVerifyMode(
+      SSL_VERIFY_PEER_VALUE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE);
+  }
+
+  return context;
+}
+
+/**
+ * Start a DTLS server.
+ * @param {Function} onsession Callback invoked for each new DTLS session.
+ * @param {object} options Server configuration.
+ * @param {string|Buffer} options.cert Server certificate (PEM).
+ * @param {string|Buffer} options.key Server private key (PEM).
+ * @param {string|Buffer|Array} [options.ca] CA certificates (PEM).
+ * @param {string} [options.host] Bind address.
+ * @param {number} options.port Bind port.
+ * @param {number} [options.mtu] MTU for DTLS records.
+ * @param {string[]} [options.alpn] ALPN protocol list.
+ * @param {string} [options.srtp] SRTP profile string.
+ * @param {boolean} [options.requestCert] Request client certificates.
+ * @returns {DTLSEndpoint}
+ */
+function listen(onsession, options = kEmptyObject) {
+  validateFunction(onsession, 'onsession');
+  validateObject(options, 'options');
+
+  if (options.cert === undefined) {
+    throw new ERR_MISSING_ARGS('options.cert');
+  }
+  if (options.key === undefined) {
+    throw new ERR_MISSING_ARGS('options.key');
+  }
+  if (options.port === undefined) {
+    throw new ERR_MISSING_ARGS('options.port');
+  }
+
+  const host = options.host || '0.0.0.0';
+  const port = options.port;
+
+  validateString(host, 'options.host');
+  validateInteger(port, 'options.port', 0, 65535);
+
+  const context = createContext({
+    ...options,
+    isServer: true,
+  });
+
+  const endpoint = new DTLSEndpoint({
+    mtu: options.mtu,
+  });
+
+  endpoint.bind(host, port);
+  endpoint.listen(onsession, context);
+
+  return endpoint;
+}
+
+/**
+ * Connect to a DTLS server.
+ * @param {string} host Remote host.
+ * @param {number} port Remote port.
+ * @param {object} [options] Client configuration.
+ * @param {string|Buffer|Array} [options.ca] CA certificates (PEM).
+ * @param {string|Buffer} [options.cert] Client certificate (PEM).
+ * @param {string|Buffer} [options.key] Client private key (PEM).
+ * @param {boolean} [options.rejectUnauthorized] When true (default), verify
+ *   the server certificate against the trusted CAs and check its identity
+ *   against servername (or host); aborts the handshake on failure.
+ * @param {string} [options.servername] Server name for the SNI extension and
+ *   the identity checked during certificate verification. Defaults to host;
+ *   set to '' to disable SNI. Never sent for IP address literals.
+ * @param {string} [options.bindHost] Local bind address.
+ * @param {number} [options.bindPort] Local bind port (0 = ephemeral).
+ * @param {number} [options.mtu] MTU for DTLS records.
+ * @param {string[]} [options.alpn] ALPN protocol list.
+ * @param {string} [options.srtp] SRTP profile string.
+ * @returns {DTLSSession}
+ */
+function connect(host, port, options = kEmptyObject) {
+  validateString(host, 'host');
+  validateInteger(port, 'port', 0, 65535);
+  validateObject(options, 'options');
+
+  const bindHost = options.bindHost || '0.0.0.0';
+  const bindPort = options.bindPort || 0;
+
+  const context = createContext({
+    ...options,
+    isServer: false,
+    rejectUnauthorized: options.rejectUnauthorized !== false,
+  });
+
+  const endpoint = new DTLSEndpoint({
+    mtu: options.mtu,
+  });
+
+  endpoint.bind(bindHost, bindPort);
+
+  // SNI and peer-identity verification are resolved inside
+  // DTLSEndpoint.connect(), which defaults both to the host argument (matching
+  // Node.js TLS). The identity is enforced whenever the context verifies, i.e.
+  // unless rejectUnauthorized is false.
+  const session = endpoint.connect(context, host, port, options.servername);
+  // Mark that this session owns the endpoint so it gets closed
+  // automatically when the session closes, allowing process exit.
+  session.ownsEndpoint = true;
+  return session;
+}
+
+module.exports = {
+  connect,
+  listen,
+  createContext,
+  DTLSEndpoint,
+  DTLSSession,
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/dtls/state.js b/lib/internal/dtls/state.js
new file mode 100644
index 000000000000..5d86b556f1ad
--- /dev/null
+++ b/lib/internal/dtls/state.js
@@ -0,0 +1,174 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  DataView,
+  DataViewPrototypeGetByteLength,
+  DataViewPrototypeGetUint32,
+  DataViewPrototypeGetUint8,
+  DataViewPrototypeSetUint8,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+const {
+  codes: {
+    ERR_ILLEGAL_CONSTRUCTOR,
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+
+const {
+  kPrivateConstructor,
+} = require('internal/dtls/symbols');
+
+const {
+  IDX_ENDPOINT_STATE_BOUND,
+  IDX_ENDPOINT_STATE_LISTENING,
+  IDX_ENDPOINT_STATE_CLOSING,
+  IDX_ENDPOINT_STATE_DESTROYED,
+  IDX_ENDPOINT_STATE_SESSION_COUNT,
+  IDX_ENDPOINT_STATE_BUSY,
+  IDX_SESSION_STATE_HANDSHAKING,
+  IDX_SESSION_STATE_OPEN,
+  IDX_SESSION_STATE_CLOSING,
+  IDX_SESSION_STATE_DESTROYED,
+  IDX_SESSION_STATE_HAS_MESSAGE_LISTENER,
+} = internalBinding('dtls');
+
+function isAlive(view) {
+  return DataViewPrototypeGetByteLength(view) > 0;
+}
+
+// DTLSEndpointState wraps the shared ArrayBuffer from C++.
+// The C++ struct layout (DTLSEndpointStateData) is:
+//   uint8_t bound;          // offset 0
+//   uint8_t listening;      // offset 1
+//   uint8_t closing;        // offset 2
+//   uint8_t destroyed;      // offset 3
+//   uint32_t session_count; // offset 4 (4-byte aligned)
+//   uint8_t busy;           // offset 8
+class DTLSEndpointState {
+  #handle;
+
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    this.#handle = new DataView(buffer);
+  }
+
+  get bound() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_BOUND) === 1;
+  }
+
+  get listening() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_LISTENING) === 1;
+  }
+
+  get closing() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_CLOSING) === 1;
+  }
+
+  get destroyed() {
+    if (!isAlive(this.#handle)) return true;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_DESTROYED) === 1;
+  }
+
+  get sessionCount() {
+    if (!isAlive(this.#handle)) return 0;
+    return DataViewPrototypeGetUint32(
+      this.#handle, IDX_ENDPOINT_STATE_SESSION_COUNT, true);
+  }
+
+  get busy() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_BUSY) === 1;
+  }
+
+  set busy(val) {
+    if (!isAlive(this.#handle)) {
+      throw new ERR_INVALID_STATE('Endpoint is destroyed');
+    }
+    DataViewPrototypeSetUint8(
+      this.#handle, IDX_ENDPOINT_STATE_BUSY, val ? 1 : 0);
+  }
+}
+
+// DTLSSessionState wraps the shared ArrayBuffer from C++.
+// The C++ struct layout (DTLSSessionStateData) is:
+//   uint8_t handshaking;          // offset 0
+//   uint8_t open;                 // offset 1
+//   uint8_t closing;              // offset 2
+//   uint8_t destroyed;            // offset 3
+//   uint8_t has_message_listener; // offset 4
+class DTLSSessionState {
+  #handle;
+
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    this.#handle = new DataView(buffer);
+  }
+
+  get handshaking() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_HANDSHAKING) === 1;
+  }
+
+  get open() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_OPEN) === 1;
+  }
+
+  get closing() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_CLOSING) === 1;
+  }
+
+  get destroyed() {
+    if (!isAlive(this.#handle)) return true;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_DESTROYED) === 1;
+  }
+
+  get hasMessageListener() {
+    if (!isAlive(this.#handle)) return false;
+    return DataViewPrototypeGetUint8(
+      this.#handle, IDX_SESSION_STATE_HAS_MESSAGE_LISTENER) === 1;
+  }
+
+  set hasMessageListener(val) {
+    if (!isAlive(this.#handle)) return;
+    DataViewPrototypeSetUint8(
+      this.#handle, IDX_SESSION_STATE_HAS_MESSAGE_LISTENER, val ? 1 : 0);
+  }
+}
+
+module.exports = {
+  DTLSEndpointState,
+  DTLSSessionState,
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/dtls/stats.js b/lib/internal/dtls/stats.js
new file mode 100644
index 000000000000..b3393fe6b76d
--- /dev/null
+++ b/lib/internal/dtls/stats.js
@@ -0,0 +1,341 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  BigUint64Array,
+  JSONStringify,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+const {
+  isArrayBuffer,
+} = require('util/types');
+
+const {
+  codes: {
+    ERR_ILLEGAL_CONSTRUCTOR,
+    ERR_INVALID_ARG_TYPE,
+  },
+} = require('internal/errors');
+
+const { inspect } = require('internal/util/inspect');
+const assert = require('internal/assert');
+
+const {
+  kFinishClose,
+  kPrivateConstructor,
+} = require('internal/dtls/symbols');
+
+// This file defines the helper objects for accessing statistics collected
+// by DTLS endpoints and sessions. Each wraps a BigUint64Array backed by
+// a shared ArrayBuffer that is updated by the C++ internals.
+
+const {
+  IDX_STATS_ENDPOINT_CREATED_AT,
+  IDX_STATS_ENDPOINT_DESTROYED_AT,
+  IDX_STATS_ENDPOINT_BYTES_RECEIVED,
+  IDX_STATS_ENDPOINT_BYTES_SENT,
+  IDX_STATS_ENDPOINT_PACKETS_RECEIVED,
+  IDX_STATS_ENDPOINT_PACKETS_SENT,
+  IDX_STATS_ENDPOINT_SERVER_SESSIONS,
+  IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
+  IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
+
+  IDX_STATS_SESSION_CREATED_AT,
+  IDX_STATS_SESSION_DESTROYED_AT,
+  IDX_STATS_SESSION_CLOSING_AT,
+  IDX_STATS_SESSION_HANDSHAKE_COMPLETED_AT,
+  IDX_STATS_SESSION_BYTES_RECEIVED,
+  IDX_STATS_SESSION_BYTES_SENT,
+  IDX_STATS_SESSION_MESSAGES_RECEIVED,
+  IDX_STATS_SESSION_MESSAGES_SENT,
+  IDX_STATS_SESSION_RETRANSMIT_COUNT,
+} = internalBinding('dtls');
+
+assert(IDX_STATS_ENDPOINT_CREATED_AT !== undefined);
+assert(IDX_STATS_ENDPOINT_DESTROYED_AT !== undefined);
+assert(IDX_STATS_ENDPOINT_BYTES_RECEIVED !== undefined);
+assert(IDX_STATS_ENDPOINT_BYTES_SENT !== undefined);
+assert(IDX_STATS_ENDPOINT_PACKETS_RECEIVED !== undefined);
+assert(IDX_STATS_ENDPOINT_PACKETS_SENT !== undefined);
+assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
+assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS !== undefined);
+assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT !== undefined);
+assert(IDX_STATS_SESSION_CREATED_AT !== undefined);
+assert(IDX_STATS_SESSION_DESTROYED_AT !== undefined);
+assert(IDX_STATS_SESSION_CLOSING_AT !== undefined);
+assert(IDX_STATS_SESSION_HANDSHAKE_COMPLETED_AT !== undefined);
+assert(IDX_STATS_SESSION_BYTES_RECEIVED !== undefined);
+assert(IDX_STATS_SESSION_BYTES_SENT !== undefined);
+assert(IDX_STATS_SESSION_MESSAGES_RECEIVED !== undefined);
+assert(IDX_STATS_SESSION_MESSAGES_SENT !== undefined);
+assert(IDX_STATS_SESSION_RETRANSMIT_COUNT !== undefined);
+
+class DTLSEndpointStats {
+  /** @type {BigUint64Array} */
+  #handle;
+  /** @type {boolean} */
+  #disconnected = false;
+
+  /**
+   * @param {symbol} privateSymbol
+   * @param {ArrayBuffer} buffer
+   */
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    if (!isArrayBuffer(buffer)) {
+      throw new ERR_INVALID_ARG_TYPE('buffer', ['ArrayBuffer'], buffer);
+    }
+    this.#handle = new BigUint64Array(buffer);
+  }
+
+  /** @type {bigint} */
+  get createdAt() {
+    return this.#handle[IDX_STATS_ENDPOINT_CREATED_AT];
+  }
+
+  /** @type {bigint} */
+  get destroyedAt() {
+    return this.#handle[IDX_STATS_ENDPOINT_DESTROYED_AT];
+  }
+
+  /** @type {bigint} */
+  get bytesReceived() {
+    return this.#handle[IDX_STATS_ENDPOINT_BYTES_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get bytesSent() {
+    return this.#handle[IDX_STATS_ENDPOINT_BYTES_SENT];
+  }
+
+  /** @type {bigint} */
+  get packetsReceived() {
+    return this.#handle[IDX_STATS_ENDPOINT_PACKETS_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get packetsSent() {
+    return this.#handle[IDX_STATS_ENDPOINT_PACKETS_SENT];
+  }
+
+  /** @type {bigint} */
+  get serverSessions() {
+    return this.#handle[IDX_STATS_ENDPOINT_SERVER_SESSIONS];
+  }
+
+  /** @type {bigint} */
+  get clientSessions() {
+    return this.#handle[IDX_STATS_ENDPOINT_CLIENT_SESSIONS];
+  }
+
+  /** @type {bigint} */
+  get serverBusyCount() {
+    return this.#handle[IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT];
+  }
+
+  toString() {
+    return JSONStringify(this.toJSON());
+  }
+
+  toJSON() {
+    return {
+      __proto__: null,
+      connected: this.isConnected,
+      createdAt: `${this.createdAt}`,
+      destroyedAt: `${this.destroyedAt}`,
+      bytesReceived: `${this.bytesReceived}`,
+      bytesSent: `${this.bytesSent}`,
+      packetsReceived: `${this.packetsReceived}`,
+      packetsSent: `${this.packetsSent}`,
+      serverSessions: `${this.serverSessions}`,
+      clientSessions: `${this.clientSessions}`,
+      serverBusyCount: `${this.serverBusyCount}`,
+    };
+  }
+
+  [inspect.custom](depth, options) {
+    if (depth < 0)
+      return this;
+
+    const opts = {
+      __proto__: null,
+      ...options,
+      depth: options.depth == null ? null : options.depth - 1,
+    };
+
+    return `DTLSEndpointStats ${inspect({
+      connected: this.isConnected,
+      createdAt: this.createdAt,
+      destroyedAt: this.destroyedAt,
+      bytesReceived: this.bytesReceived,
+      bytesSent: this.bytesSent,
+      packetsReceived: this.packetsReceived,
+      packetsSent: this.packetsSent,
+      serverSessions: this.serverSessions,
+      clientSessions: this.clientSessions,
+      serverBusyCount: this.serverBusyCount,
+    }, opts)}`;
+  }
+
+  /**
+   * True if this stats object is still connected to the underlying
+   * stats source. If false, the stats are stale.
+   * @type {boolean}
+   */
+  get isConnected() {
+    return !this.#disconnected;
+  }
+
+  [kFinishClose]() {
+    // Snapshot the stats into a new BigUint64Array since the underlying
+    // buffer will be destroyed.
+    this.#handle = new BigUint64Array(this.#handle);
+    this.#disconnected = true;
+  }
+}
+
+class DTLSSessionStats {
+  /** @type {BigUint64Array} */
+  #handle;
+  /** @type {boolean} */
+  #disconnected = false;
+
+  /**
+   * @param {symbol} privateSymbol
+   * @param {ArrayBuffer} buffer
+   */
+  constructor(privateSymbol, buffer) {
+    if (privateSymbol !== kPrivateConstructor) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+    if (!isArrayBuffer(buffer)) {
+      throw new ERR_INVALID_ARG_TYPE('buffer', ['ArrayBuffer'], buffer);
+    }
+    this.#handle = new BigUint64Array(buffer);
+  }
+
+  /** @type {bigint} */
+  get createdAt() {
+    return this.#handle[IDX_STATS_SESSION_CREATED_AT];
+  }
+
+  /** @type {bigint} */
+  get destroyedAt() {
+    return this.#handle[IDX_STATS_SESSION_DESTROYED_AT];
+  }
+
+  /** @type {bigint} */
+  get closingAt() {
+    return this.#handle[IDX_STATS_SESSION_CLOSING_AT];
+  }
+
+  /** @type {bigint} */
+  get handshakeCompletedAt() {
+    return this.#handle[IDX_STATS_SESSION_HANDSHAKE_COMPLETED_AT];
+  }
+
+  /** @type {bigint} */
+  get bytesReceived() {
+    return this.#handle[IDX_STATS_SESSION_BYTES_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get bytesSent() {
+    return this.#handle[IDX_STATS_SESSION_BYTES_SENT];
+  }
+
+  /** @type {bigint} */
+  get messagesReceived() {
+    return this.#handle[IDX_STATS_SESSION_MESSAGES_RECEIVED];
+  }
+
+  /** @type {bigint} */
+  get messagesSent() {
+    return this.#handle[IDX_STATS_SESSION_MESSAGES_SENT];
+  }
+
+  /** @type {bigint} */
+  get retransmitCount() {
+    return this.#handle[IDX_STATS_SESSION_RETRANSMIT_COUNT];
+  }
+
+  toString() {
+    return JSONStringify(this.toJSON());
+  }
+
+  toJSON() {
+    return {
+      __proto__: null,
+      connected: this.isConnected,
+      createdAt: `${this.createdAt}`,
+      destroyedAt: `${this.destroyedAt}`,
+      closingAt: `${this.closingAt}`,
+      handshakeCompletedAt: `${this.handshakeCompletedAt}`,
+      bytesReceived: `${this.bytesReceived}`,
+      bytesSent: `${this.bytesSent}`,
+      messagesReceived: `${this.messagesReceived}`,
+      messagesSent: `${this.messagesSent}`,
+      retransmitCount: `${this.retransmitCount}`,
+    };
+  }
+
+  [inspect.custom](depth, options) {
+    if (depth < 0)
+      return this;
+
+    const opts = {
+      __proto__: null,
+      ...options,
+      depth: options.depth == null ? null : options.depth - 1,
+    };
+
+    return `DTLSSessionStats ${inspect({
+      connected: this.isConnected,
+      createdAt: this.createdAt,
+      destroyedAt: this.destroyedAt,
+      closingAt: this.closingAt,
+      handshakeCompletedAt: this.handshakeCompletedAt,
+      bytesReceived: this.bytesReceived,
+      bytesSent: this.bytesSent,
+      messagesReceived: this.messagesReceived,
+      messagesSent: this.messagesSent,
+      retransmitCount: this.retransmitCount,
+    }, opts)}`;
+  }
+
+  /**
+   * True if this stats object is still connected to the underlying
+   * stats source. If false, the stats are stale.
+   * @type {boolean}
+   */
+  get isConnected() {
+    return !this.#disconnected;
+  }
+
+  [kFinishClose]() {
+    // Snapshot the stats into a new BigUint64Array since the underlying
+    // buffer will be destroyed.
+    this.#handle = new BigUint64Array(this.#handle);
+    this.#disconnected = true;
+  }
+}
+
+module.exports = {
+  DTLSEndpointStats,
+  DTLSSessionStats,
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/dtls/symbols.js b/lib/internal/dtls/symbols.js
new file mode 100644
index 000000000000..fbeeadc562a0
--- /dev/null
+++ b/lib/internal/dtls/symbols.js
@@ -0,0 +1,43 @@
+'use strict';
+
+// TODO(@jasnell) Temporarily ignoring c8 coverage for this file while tests
+// are still being developed.
+/* c8 ignore start */
+
+const {
+  Symbol,
+} = primordials;
+
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.dtls || !getOptionValue('--experimental-dtls')) {
+  return;
+}
+
+module.exports = {
+  // Private symbols for internal communication between classes.
+  kOwner: Symbol('kOwner'),
+  kHandle: Symbol('kHandle'),
+  kListen: Symbol('kListen'),
+  kConnect: Symbol('kConnect'),
+  kFinishClose: Symbol('kFinishClose'),
+  kNewSession: Symbol('kNewSession'),
+  kRemoveSession: Symbol('kRemoveSession'),
+  kHandshake: Symbol('kHandshake'),
+  kReceive: Symbol('kReceive'),
+  kError: Symbol('kError'),
+  kClose: Symbol('kClose'),
+  kMessage: Symbol('kMessage'),
+  kKeylog: Symbol('kKeylog'),
+  kTicket: Symbol('kTicket'),
+  kPrivateConstructor: Symbol('kPrivateConstructor'),
+  kSessionHandshake: Symbol('dtls.session.handshake'),
+  kSessionMessage: Symbol('dtls.session.message'),
+  kSessionError: Symbol('dtls.session.error'),
+  kSessionClose: Symbol('dtls.session.close'),
+  kSessionKeylog: Symbol('dtls.session.keylog'),
+};
+
+/* c8 ignore stop */
diff --git a/lib/internal/encoding.js b/lib/internal/encoding.js
index 7d4747abc23b..11003db8bc51 100644
--- a/lib/internal/encoding.js
+++ b/lib/internal/encoding.js
@@ -614,8 +614,17 @@ ObjectDefineProperties(TextDecoder.prototype, {
   },
 });
 
+// A lazily created TextDecoder for the common case of decoding UTF-8 with
+// the default options, shared between internal modules.
+let utf8Decoder;
+function getUtf8Decoder() {
+  utf8Decoder ??= new TextDecoder();
+  return utf8Decoder;
+}
+
 module.exports = {
   getEncodingFromLabel,
+  getUtf8Decoder,
   TextDecoder,
   TextEncoder,
 };
diff --git a/lib/internal/error_serdes.js b/lib/internal/error_serdes.js
index efe75192d9f5..d473da06fd49 100644
--- a/lib/internal/error_serdes.js
+++ b/lib/internal/error_serdes.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  AggregateError,
   ArrayPrototypeForEach,
   Error,
   EvalError,
@@ -41,7 +42,14 @@ const kCircularReference = 5;
 const kSymbolStringLength = 'Symbol('.length;
 
 const errors = {
-  Error, TypeError, RangeError, URIError, SyntaxError, ReferenceError, EvalError,
+  AggregateError,
+  Error,
+  EvalError,
+  RangeError,
+  ReferenceError,
+  SyntaxError,
+  TypeError,
+  URIError,
 };
 const errorConstructorNames = new SafeSet(ObjectKeys(errors));
 
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index d98495aa6566..b9b1490c31ee 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1035,11 +1035,16 @@ function determineSpecificType(value) {
       return `type symbol (${String(value)})`;
     case 'function':
       return `function ${value.name}`;
-    case 'object':
-      if (value.constructor && 'name' in value.constructor) {
-        return `an instance of ${value.constructor.name}`;
+    case 'object': {
+      // `constructor` may be user-controlled: it need not be an object, and
+      // its `name` need not be a non-empty string. Reading either can invoke
+      // an accessor, so read each one once.
+      const name = value.constructor?.name;
+      if (typeof name === 'string' && name !== '') {
+        return `an instance of ${name}`;
       }
       return `${lazyInternalUtilInspect().inspect(value, { depth: -1 })}`;
+    }
     case 'string':
       value.length > 28 && (value = `${StringPrototypeSlice(value, 0, 25)}...`);
       if (StringPrototypeIndexOf(value, "'") === -1) {
@@ -1186,8 +1191,12 @@ E('ERR_CRYPTO_INVALID_DIGEST', 'Invalid digest: %s', TypeError);
 E('ERR_CRYPTO_INVALID_JWK', 'Invalid JWK data', TypeError);
 E('ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE',
   'Invalid key object type %s, expected %s.', TypeError);
+E('ERR_CRYPTO_INVALID_MAC', 'Invalid MAC: %s', TypeError);
 E('ERR_CRYPTO_INVALID_STATE', 'Invalid state for operation %s', Error);
 E('ERR_CRYPTO_KEM_NOT_SUPPORTED', 'KEM is not supported', Error);
+E('ERR_CRYPTO_MAC_FINALIZED', 'MAC already finalized', Error);
+E('ERR_CRYPTO_MAC_NOT_SUPPORTED', 'MAC is not supported', Error);
+E('ERR_CRYPTO_MAC_UPDATE_FAILED', 'MAC update failed', Error);
 E('ERR_CRYPTO_PBKDF2_ERROR', 'PBKDF2 error', Error);
 E('ERR_CRYPTO_SCRYPT_NOT_SUPPORTED', 'Scrypt algorithm not supported', Error);
 // Switch to TypeError. The current implementation does not seem right.
diff --git a/lib/internal/event_target.js b/lib/internal/event_target.js
index bfb948bb1ced..23a2ef702739 100644
--- a/lib/internal/event_target.js
+++ b/lib/internal/event_target.js
@@ -14,6 +14,7 @@ const {
   ReflectApply,
   SafeFinalizationRegistry,
   SafeMap,
+  SafeSet,
   SafeWeakMap,
   SafeWeakRef,
   SafeWeakSet,
@@ -491,8 +492,17 @@ class Listener {
         listener: this,
         eventType,
       }, this);
-      // Make the retainer retain the listener in a WeakMap
-      weakListeners().map.set(weak, listener);
+      // Store only a WeakRef to the retainer here. Listener instances are
+      // Strongly reachable from the EventTarget's listener list for as long
+      // as they're registered, so a plain strong reference would keep the
+      // retainer (and listener) alive forever, defeating weak retention
+      this.weakKeyRef = new SafeWeakRef(weak);
+      let retained = weakListeners().map.get(weak);
+      if (retained === undefined) {
+        retained = new SafeSet();
+        weakListeners().map.set(weak, retained);
+      }
+      retained.add(listener);
       this.listener = this.callback;
     } else if (typeof listener === 'function') {
       this.callback = listener;
@@ -545,8 +555,19 @@ class Listener {
     if (this.next !== undefined)
       this.next.previous = this.previous;
     this.removed = true;
-    if (this.weak)
+    if (this.weak) {
       weakListeners().registry.unregister(this);
+      const weakKey = this.weakKeyRef?.deref();
+      const listener = this.callback?.deref();
+      if (weakKey !== undefined && listener !== undefined) {
+        const retained = weakListeners().map.get(weakKey);
+        if (retained !== undefined) {
+          retained.delete(listener);
+          if (retained.size === 0)
+            weakListeners().map.delete(weakKey);
+        }
+      }
+    }
   }
 }
 
@@ -722,7 +743,10 @@ class EventTarget {
       return;
 
     type = webidl.converters.DOMString(type);
-    const capture = options?.capture === true;
+    // Flatten the options argument like addEventListener does.
+    // Refs: https://dom.spec.whatwg.org/#concept-flatten-options
+    const capture = typeof options === 'boolean' ?
+      options : options?.capture === true;
 
     if (this[kEvents] === undefined)
       return;
@@ -1155,6 +1179,13 @@ function defineEventHandler(emitter, name, event = name) {
 
   function set(value) {
     validateThisInternalField(this, kHandlers, 'EventTarget');
+    // Event handler IDL attributes are [LegacyTreatNonObjectAsNull]: values
+    // that are neither callable nor objects deactivate the handler.
+    // Refs: https://html.spec.whatwg.org/multipage/webappapis.html#event-handler-idl-attributes
+    if (typeof value !== 'function' &&
+        (typeof value !== 'object' || value === null)) {
+      value = null;
+    }
     if (this[kHandlers] === undefined)
       this[kHandlers] = new SafeMap();
     let wrappedHandler = this[kHandlers].get(event);
diff --git a/lib/internal/freeze_intrinsics.js b/lib/internal/freeze_intrinsics.js
index 05437199726c..5dd425cb0934 100644
--- a/lib/internal/freeze_intrinsics.js
+++ b/lib/internal/freeze_intrinsics.js
@@ -54,6 +54,8 @@ const {
   EvalErrorPrototype,
   FinalizationRegistry,
   FinalizationRegistryPrototype,
+  Float16Array,
+  Float16ArrayPrototype,
   Float32Array,
   Float32ArrayPrototype,
   Float64Array,
@@ -196,6 +198,7 @@ module.exports = function() {
     Uint16ArrayPrototype,
     Int32ArrayPrototype,
     Uint32ArrayPrototype,
+    Float16ArrayPrototype,
     Float32ArrayPrototype,
     Float64ArrayPrototype,
     BigInt64ArrayPrototype,
@@ -296,6 +299,7 @@ module.exports = function() {
     Uint16Array,
     Int32Array,
     Uint32Array,
+    Float16Array,
     Float32Array,
     Float64Array,
     BigInt64Array,
diff --git a/lib/internal/fs/cp/cp-sync.js b/lib/internal/fs/cp/cp-sync.js
index f2b00f3f82bb..ecd06dfd6002 100644
--- a/lib/internal/fs/cp/cp-sync.js
+++ b/lib/internal/fs/cp/cp-sync.js
@@ -179,6 +179,9 @@ function copyDir(src, dest, opts, mkDir, srcMode) {
   } finally {
     dir.closeSync();
 
+    if (opts.preserveTimestamps) {
+      setDestTimestamps(src, dest);
+    }
     if (srcMode !== undefined) {
       setDestMode(dest, srcMode);
     }
diff --git a/lib/internal/fs/cp/cp.js b/lib/internal/fs/cp/cp.js
index 2eb4f0ffdd83..1ec5a2d89cac 100644
--- a/lib/internal/fs/cp/cp.js
+++ b/lib/internal/fs/cp/cp.js
@@ -6,6 +6,8 @@ const {
   ArrayPrototypeEvery,
   ArrayPrototypeFilter,
   Boolean,
+  ErrorCaptureStackTrace,
+  Promise,
   PromisePrototypeThen,
   PromiseReject,
   SafePromiseAll,
@@ -55,6 +57,7 @@ const {
   sep,
 } = require('path');
 const fsBinding = internalBinding('fs');
+const permission = require('internal/process/permission');
 
 async function cpFn(src, dest, opts) {
   // Warn about using preserveTimestamps on 32-bit node
@@ -211,30 +214,19 @@ async function getStatsForCopy(destStat, src, dest, opts) {
     return onFile(srcStat, destStat, src, dest, opts);
   } else if (srcStat.isSymbolicLink()) {
     return onLink(destStat, src, dest, opts);
-  } else if (srcStat.isSocket()) {
-    throw new ERR_FS_CP_SOCKET({
-      message: `cannot copy a socket file: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
-  } else if (srcStat.isFIFO()) {
-    throw new ERR_FS_CP_FIFO_PIPE({
-      message: `cannot copy a FIFO pipe: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
   }
-  throw new ERR_FS_CP_UNKNOWN({
-    message: `cannot copy an unknown file type: ${dest}`,
-    path: dest,
-    syscall: 'cp',
-    errno: EINVAL,
-    code: 'EINVAL',
-  });
+  throw errorForSpecialFile(srcStat.isSocket() ? 'socket' : srcStat.isFIFO() ? 'fifo' : 'unknown', dest);
+}
+
+function errorForSpecialFile(kind, dest) {
+  const info = { path: dest, syscall: 'cp', errno: EINVAL, code: 'EINVAL' };
+  if (kind === 'socket') {
+    return new ERR_FS_CP_SOCKET({ message: `cannot copy a socket file: ${dest}`, ...info });
+  }
+  if (kind === 'fifo') {
+    return new ERR_FS_CP_FIFO_PIPE({ message: `cannot copy a FIFO pipe: ${dest}`, ...info });
+  }
+  return new ERR_FS_CP_UNKNOWN({ message: `cannot copy an unknown file type: ${dest}`, ...info });
 }
 
 function onFile(srcStat, destStat, src, dest, opts) {
@@ -311,15 +303,51 @@ async function onDir(srcStat, destStat, src, dest, opts) {
       code: 'EEXIST',
     });
   }
-  return copyDir(src, dest, opts);
+  await copyDir(src, dest, opts);
+  if (opts.preserveTimestamps) {
+    await setDestTimestamps(src, dest);
+  }
 }
 
 async function mkDirAndCopy(srcMode, src, dest, opts) {
+  // A destination directory that does not exist yet is filled in one thread
+  // pool request by the walk fs.cpSync() uses, unless a filter has to run per
+  // entry, links inside the tree must be dereferenced, or the permission model
+  // has to check each path. Copying into an existing tree keeps the per-entry
+  // walk below and its rules for what may already be there.
+  if (!opts.filter && !opts.dereference && !permission.isEnabled()) {
+    // Creates dest itself, with the mode of src.
+    return copyDirNative(src, dest, opts);
+  }
   await mkdir(dest);
   await copyDir(src, dest, opts);
+  if (opts.preserveTimestamps) {
+    await setDestTimestamps(src, dest);
+  }
   return setDestMode(dest, srcMode);
 }
 
+function copyDirNative(src, dest, opts) {
+  return new Promise((resolve, reject) => {
+    const job = new fsBinding.CpDirJob(src, dest, opts.force, opts.dereference, opts.errorOnExist,
+                                       opts.verbatimSymlinks, opts.preserveTimestamps, opts.mode);
+    // Sockets, FIFOs and unknown entries come back as (kind, path) so that
+    // they reject with the same errors as the walk above.
+    job.ondone = (err, specialFile, specialFilePath) => {
+      if (specialFile !== undefined) {
+        err = errorForSpecialFile(specialFile, specialFilePath);
+      }
+      if (err != null) {
+        ErrorCaptureStackTrace(err, copyDirNative);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    job.run();
+  });
+}
+
 async function copyDir(src, dest, opts) {
   const dir = await opendir(src);
 
diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index efa590a55749..b5949c471813 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -5,6 +5,7 @@ const {
   ArrayIsArray,
   ArrayPrototypeAt,
   ArrayPrototypeFlatMap,
+  ArrayPrototypeJoin,
   ArrayPrototypeMap,
   ArrayPrototypePop,
   ArrayPrototypePush,
@@ -14,6 +15,10 @@ const {
   SafeMap,
   SafeSet,
   StringPrototypeEndsWith,
+  StringPrototypeSlice,
+  StringPrototypeSplit,
+  StringPrototypeStartsWith,
+  StringPrototypeToLowerCase,
 } = primordials;
 
 const {
@@ -22,13 +27,14 @@ const {
   realpathSync,
   statSync,
 } = require('fs');
+const realpathSyncNative = realpathSync.native;
 const {
   lstat,
   readdir,
   realpath,
   stat,
 } = require('fs/promises');
-const { join, resolve, basename, isAbsolute, dirname } = require('path');
+const { join, resolve, relative, basename, isAbsolute, dirname, parse, sep } = require('path');
 
 const {
   kEmptyObject,
@@ -37,6 +43,7 @@ const {
 } = require('internal/util');
 const {
   validateBoolean,
+  validateInteger,
   validateObject,
   validateString,
   validateStringArray,
@@ -132,10 +139,71 @@ function cloneSet(values) {
   return cloned;
 }
 
+function isOutsidePath(path) {
+  return isAbsolute(path) ||
+    path === '..' ||
+    StringPrototypeStartsWith(path, `..${sep}`);
+}
+
+function isStrictDescendant(path) {
+  return path !== '' && !isOutsidePath(path);
+}
+
+function pathDepth(path) {
+  if (path === '') {
+    return 0;
+  }
+  if (isAbsolute(path)) {
+    return Infinity;
+  }
+  return StringPrototypeSplit(path, sep).length;
+}
+
+function ancestorAtDepth(path, relativePath) {
+  let ancestor = path;
+  if (relativePath !== '') {
+    const depth = pathDepth(relativePath);
+    for (let i = 0; i < depth; i++) {
+      ancestor = dirname(ancestor);
+    }
+  }
+  return ancestor;
+}
+
+function caseSensitiveRelative(path, otherPath) {
+  const pathRoot = parse(path).root;
+  const otherPathRoot = parse(otherPath).root;
+  if (StringPrototypeToLowerCase(pathRoot) !==
+      StringPrototypeToLowerCase(otherPathRoot)) {
+    return otherPath;
+  }
+  const pathTail = StringPrototypeSlice(path, pathRoot.length);
+  const otherPathTail = StringPrototypeSlice(otherPath, otherPathRoot.length);
+  const pathParts = pathTail === '' ? [] : StringPrototypeSplit(pathTail, sep);
+  const otherPathParts = otherPathTail === '' ?
+    [] : StringPrototypeSplit(otherPathTail, sep);
+  let common = 0;
+  while (common < pathParts.length &&
+         common < otherPathParts.length &&
+         pathParts[common] === otherPathParts[common]) {
+    common++;
+  }
+  const parts = [];
+  for (let i = common; i < pathParts.length; i++) {
+    ArrayPrototypePush(parts, '..');
+  }
+  for (let i = common; i < otherPathParts.length; i++) {
+    ArrayPrototypePush(parts, otherPathParts[i]);
+  }
+  return ArrayPrototypeJoin(parts, sep);
+}
+
 class Cache {
   #cache = new SafeMap();
   #statsCache = new SafeMap();
   #followStatsCache = new SafeMap();
+  #identityCache = new SafeMap();
+  #identityRealpathCache = new SafeMap();
   #readdirCache = new SafeMap();
   #realpathCache = new SafeMap();
 
@@ -181,6 +249,57 @@ class Cache {
     this.#followStatsCache.set(path, val);
     return val;
   }
+  identity(path) {
+    const cached = this.#identityCache.get(path);
+    if (cached) {
+      return cached;
+    }
+    const promise = PromisePrototypeThen(
+      lstat(path),
+      ({ dev, ino }) => `${dev}:${ino}`,
+      () => null,
+    );
+    this.#identityCache.set(path, promise);
+    return promise;
+  }
+  identitySync(path) {
+    const cached = this.#identityCache.get(path);
+    if (cached && !(cached instanceof Promise)) {
+      return cached;
+    }
+    let val;
+    try {
+      const { dev, ino } = lstatSync(path);
+      val = `${dev}:${ino}`;
+    } catch {
+      val = null;
+    }
+    this.#identityCache.set(path, val);
+    return val;
+  }
+  identityRealpath(path) {
+    const cached = this.#identityRealpathCache.get(path);
+    if (cached) {
+      return cached;
+    }
+    const promise = PromisePrototypeThen(realpath(path), null, () => null);
+    this.#identityRealpathCache.set(path, promise);
+    return promise;
+  }
+  identityRealpathSync(path) {
+    const cached = this.#identityRealpathCache.get(path);
+    if (cached && !(cached instanceof Promise)) {
+      return cached;
+    }
+    let val;
+    try {
+      val = realpathSyncNative(path);
+    } catch {
+      val = null;
+    }
+    this.#identityRealpathCache.set(path, val);
+    return val;
+  }
   realpath(path) {
     const cached = this.#realpathCache.get(path);
     if (cached) {
@@ -245,6 +364,192 @@ class Cache {
   }
 }
 
+class DepthLimiter {
+  #root;
+  #maxDepth;
+  #cache;
+  #relativeCache = new SafeMap();
+
+  constructor(root, maxDepth, cache) {
+    this.#root = resolve(root);
+    this.#maxDepth = maxDepth;
+    this.#cache = cache;
+  }
+
+  #relativeCandidate(path) {
+    const fullpath = resolve(this.#root, path);
+    const pathFromRoot = relative(this.#root, fullpath);
+    if (isWindows && !isOutsidePath(pathFromRoot)) {
+      return {
+        __proto__: null,
+        pathFromRoot,
+        caseVariantRoot: ancestorAtDepth(fullpath, pathFromRoot),
+        differentPath: caseSensitiveRelative(this.#root, fullpath),
+      };
+    }
+    if (isMacOS && !isAbsolute(pathFromRoot) && isOutsidePath(pathFromRoot)) {
+      const foldedPathFromRoot = relative(
+        StringPrototypeToLowerCase(this.#root),
+        StringPrototypeToLowerCase(fullpath),
+      );
+      if (!isOutsidePath(foldedPathFromRoot)) {
+        return {
+          __proto__: null,
+          pathFromRoot: foldedPathFromRoot,
+          caseVariantRoot: ancestorAtDepth(fullpath, foldedPathFromRoot),
+          differentPath: pathFromRoot,
+        };
+      }
+    }
+    return { __proto__: null, pathFromRoot };
+  }
+
+  #isSamePath(path, otherPath) {
+    if (path === otherPath) {
+      return true;
+    }
+    if (isWindows) {
+      const realPath = this.#cache.identityRealpathSync(path);
+      return realPath !== null &&
+        realPath === this.#cache.identityRealpathSync(otherPath);
+    }
+    const identity = this.#cache.identitySync(path);
+    return identity !== null &&
+      identity === this.#cache.identitySync(otherPath);
+  }
+
+  async #isSamePathAsync(path, otherPath) {
+    if (path === otherPath) {
+      return true;
+    }
+    if (isWindows) {
+      const realPath = await this.#cache.identityRealpath(path);
+      return realPath !== null &&
+        realPath === await this.#cache.identityRealpath(otherPath);
+    }
+    const identity = await this.#cache.identity(path);
+    return identity !== null &&
+      identity === await this.#cache.identity(otherPath);
+  }
+
+  #relativeFromRoot(path) {
+    const cached = this.#relativeCache.get(path);
+    if (cached !== undefined && !(cached instanceof Promise)) {
+      return cached;
+    }
+    const candidate = this.#relativeCandidate(path);
+    const relativePath = candidate.caseVariantRoot === undefined ||
+        this.#isSamePath(this.#root, candidate.caseVariantRoot) ?
+      candidate.pathFromRoot :
+      candidate.differentPath;
+    this.#relativeCache.set(path, relativePath);
+    return relativePath;
+  }
+
+  #relativeFromRootAsync(path) {
+    const cached = this.#relativeCache.get(path);
+    if (cached !== undefined) {
+      return cached;
+    }
+    const candidate = this.#relativeCandidate(path);
+    if (candidate.caseVariantRoot === undefined) {
+      this.#relativeCache.set(path, candidate.pathFromRoot);
+      return candidate.pathFromRoot;
+    }
+    const promise = PromisePrototypeThen(
+      this.#isSamePathAsync(this.#root, candidate.caseVariantRoot),
+      (isSamePath) => (isSamePath ?
+        candidate.pathFromRoot :
+        candidate.differentPath),
+    );
+    this.#relativeCache.set(path, promise);
+    return promise;
+  }
+
+  #ancestorCandidate(path) {
+    const fullpath = resolve(this.#root, path);
+    const rootFromPath = relative(fullpath, this.#root);
+    if (isStrictDescendant(rootFromPath)) {
+      return { __proto__: null, fullpath, needsIdentity: isWindows };
+    }
+    if (isMacOS) {
+      const foldedRootFromPath = relative(
+        StringPrototypeToLowerCase(fullpath),
+        StringPrototypeToLowerCase(this.#root),
+      );
+      if (isStrictDescendant(foldedRootFromPath)) {
+        return { __proto__: null, fullpath, needsIdentity: true };
+      }
+    }
+    return null;
+  }
+
+  #isAncestorOfRoot(path) {
+    const candidate = this.#ancestorCandidate(path);
+    if (candidate === null) {
+      return false;
+    }
+    if (!candidate.needsIdentity) {
+      return true;
+    }
+    const realRoot = this.#cache.identityRealpathSync(this.#root);
+    const realFullpath = this.#cache.identityRealpathSync(candidate.fullpath);
+    if (realRoot === null || realFullpath === null) {
+      return false;
+    }
+    const realRootFromPath = isWindows ?
+      caseSensitiveRelative(realFullpath, realRoot) :
+      relative(realFullpath, realRoot);
+    return isStrictDescendant(realRootFromPath);
+  }
+
+  async #isAncestorOfRootAsync(path) {
+    const candidate = this.#ancestorCandidate(path);
+    if (candidate === null) {
+      return false;
+    }
+    if (!candidate.needsIdentity) {
+      return true;
+    }
+    const realRoot = await this.#cache.identityRealpath(this.#root);
+    const realFullpath =
+      await this.#cache.identityRealpath(candidate.fullpath);
+    if (realRoot === null || realFullpath === null) {
+      return false;
+    }
+    const realRootFromPath = isWindows ?
+      caseSensitiveRelative(realFullpath, realRoot) :
+      relative(realFullpath, realRoot);
+    return isStrictDescendant(realRootFromPath);
+  }
+
+  includes(path) {
+    return pathDepth(this.#relativeFromRoot(path)) <= this.#maxDepth;
+  }
+
+  async includesAsync(path) {
+    return pathDepth(await this.#relativeFromRootAsync(path)) <= this.#maxDepth;
+  }
+
+  canTraverse(path, isAbsolutePattern) {
+    return (isAbsolutePattern && this.#isAncestorOfRoot(path)) ||
+      pathDepth(this.#relativeFromRoot(path)) < this.#maxDepth;
+  }
+
+  async canTraverseAsync(path, isAbsolutePattern) {
+    return (isAbsolutePattern && await this.#isAncestorOfRootAsync(path)) ||
+      pathDepth(await this.#relativeFromRootAsync(path)) < this.#maxDepth;
+  }
+}
+
+function createDepthLimiter(root, maxDepth, cache) {
+  if (maxDepth == null || maxDepth === Infinity) {
+    return null;
+  }
+  validateInteger(maxDepth, 'options.maxDepth', 0);
+  return new DepthLimiter(root, maxDepth, cache);
+}
+
 class Pattern {
   #pattern;
   #globStrings;
@@ -252,12 +557,14 @@ class Pattern {
   symlinks;
   realpaths;
   last;
+  isAbsolute;
 
-  constructor(pattern, globStrings, indexes, symlinks, realpaths = new SafeSet()) {
+  constructor(pattern, globStrings, indexes, symlinks, isAbsolute, realpaths = new SafeSet()) {
     this.#pattern = pattern;
     this.#globStrings = globStrings;
     this.indexes = indexes;
     this.symlinks = symlinks;
+    this.isAbsolute = isAbsolute;
     this.realpaths = realpaths;
     this.last = pattern.length - 1;
   }
@@ -277,7 +584,7 @@ class Pattern {
     return ArrayPrototypeAt(this.#pattern, index);
   }
   child(indexes, symlinks = new SafeSet(), realpaths = this.realpaths) {
-    return new Pattern(this.#pattern, this.#globStrings, indexes, symlinks, realpaths);
+    return new Pattern(this.#pattern, this.#globStrings, indexes, symlinks, this.isAbsolute, realpaths);
   }
   test(index, path) {
     if (index > this.#pattern.length) {
@@ -336,15 +643,18 @@ class Glob {
   #patterns;
   #withFileTypes;
   #followSymlinks = false;
+  #depthLimiter;
   #isExcluded = () => false;
   constructor(pattern, options = kEmptyObject) {
     validateObject(options, 'options');
-    const { exclude, cwd, followSymlinks, withFileTypes } = options;
+    const { exclude, cwd, followSymlinks, maxDepth, withFileTypes } = options;
     this.#root = toPathIfFileURL(cwd) ?? '.';
     if (followSymlinks != null) {
       validateBoolean(followSymlinks, 'options.followSymlinks');
       this.#followSymlinks = followSymlinks;
     }
+    this.#depthLimiter =
+      createDepthLimiter(this.#root, maxDepth, this.#cache);
     this.#withFileTypes = !!withFileTypes;
     if (exclude != null) {
       validateStringArrayOrFunction(exclude, 'options.exclude');
@@ -354,7 +664,10 @@ class Glob {
         // consistent comparison before instantiating matchers.
         const matchers = exclude
           .map((pattern) => resolve(this.#root, pattern))
-          .map((pattern) => createMatcher(pattern));
+          // Exclude matching is a pure string comparison with no filesystem
+          // lookups, so unlike include patterns, literal patterns must also
+          // match case-insensitively on case-insensitive platforms.
+          .map((pattern) => createMatcher(pattern, { nocaseMagicOnly: false }));
         this.#isExcluded = (value) =>
           matchers.some((matcher) => matcher.match(value));
         this.#results.setup(this.#root, this.#isExcluded);
@@ -371,13 +684,34 @@ class Glob {
       patterns = [pattern];
     }
     this.matchers = ArrayPrototypeMap(patterns, (pattern) => createMatcher(pattern));
-    this.#patterns = ArrayPrototypeFlatMap(this.matchers, (matcher) => ArrayPrototypeMap(matcher.set,
-                                                                                         (pattern, i) => new Pattern(
-                                                                                           pattern,
-                                                                                           matcher.globParts[i],
-                                                                                           new SafeSet().add(0),
-                                                                                           new SafeSet(),
-                                                                                         )));
+    this.#patterns = ArrayPrototypeFlatMap(this.matchers, (matcher) =>
+      ArrayPrototypeMap(matcher.set, (pattern, i) => new Pattern(
+        pattern,
+        matcher.globParts[i],
+        new SafeSet().add(0),
+        new SafeSet(),
+        isAbsolute(ArrayPrototypeJoin(matcher.globParts[i], sep)),
+      )));
+  }
+
+  #addResult(path) {
+    return (this.#depthLimiter === null ||
+      this.#depthLimiter.includes(path)) &&
+      this.#results.add(path);
+  }
+
+  async #addResultAsync(path) {
+    return await this.#depthLimiter.includesAsync(path) &&
+      this.#results.add(path);
+  }
+
+  #canTraverse(path, pattern) {
+    return this.#depthLimiter === null ||
+      this.#depthLimiter.canTraverse(path, pattern.isAbsolute);
+  }
+
+  async #canTraverseAsync(path, pattern) {
+    return this.#depthLimiter.canTraverseAsync(path, pattern.isAbsolute);
   }
 
   globSync() {
@@ -532,7 +866,7 @@ class Glob {
       const p = pattern.at(-1);
       const stat = this.#cache.statSync(join(fullpath, p));
       if (stat && (p || isDirectory)) {
-        this.#results.add(join(path, p));
+        this.#addResult(join(path, p));
       }
       if (pattern.indexes.size === 1 && pattern.indexes.has(last)) {
         return;
@@ -541,10 +875,12 @@ class Glob {
      (path !== '.' || pattern.at(0) === '.' || (last === 0 && stat))) {
       // If pattern ends with **, add to results
       // if path is ".", add it only if pattern starts with "." or pattern is exactly "**"
-      this.#results.add(path);
+      this.#addResult(path);
     }
 
-    if (!isDirectory || this.#isCyclicSync(fullpath, isDirectory, pattern)) {
+    if (!isDirectory ||
+        !this.#canTraverse(path, pattern) ||
+        this.#isCyclicSync(fullpath, isDirectory, pattern)) {
       return;
     }
 
@@ -601,14 +937,14 @@ class Glob {
             subPatterns.add(index);
           } else if (!fromSymlink && index === last) {
             // If ** is last, add to results
-            this.#results.add(entryPath);
+            this.#addResult(entryPath);
           }
 
           // Any pattern after ** is also a potential pattern
           // so we can already test it here
           if (nextMatches && nextIndex === last && !isLast) {
             // If next pattern is the last one, add to results
-            this.#results.add(entryPath);
+            this.#addResult(entryPath);
           } else if (nextMatches && entryIsDirectory) {
             // Pattern matched, meaning two patterns forward
             // are also potential patterns
@@ -616,9 +952,9 @@ class Glob {
             subPatterns.add(index + 2);
           }
           if ((nextMatches || pattern.at(0) === '.') &&
-           (entryIsDirectory || entry.isSymbolicLink()) && !fromSymlink) {
+           entryIsDirectory && !fromSymlink) {
             // If pattern after ** matches, or pattern starts with "."
-            // and entry is a directory or symlink, add to potential patterns
+            // and entry is a directory, add to potential patterns
             subPatterns.add(nextIndex);
           }
 
@@ -641,11 +977,11 @@ class Glob {
             } else {
               if (!this.#cache.seen(path, pattern, nextIndex)) {
                 this.#cache.add(path, pattern.child(new SafeSet().add(nextIndex)));
-                this.#results.add(path);
+                this.#addResult(path);
               }
               if (!this.#cache.seen(path, pattern, nextIndex) || !this.#cache.seen(parent, pattern, nextIndex)) {
                 this.#cache.add(parent, pattern.child(new SafeSet().add(nextIndex)));
-                this.#results.add(parent);
+                this.#addResult(parent);
               }
             }
           }
@@ -658,7 +994,7 @@ class Glob {
           } else if (current === '.' && pattern.test(nextIndex, entry.name)) {
             // If current pattern is ".", proceed to test next pattern
             if (nextIndex === last) {
-              this.#results.add(entryPath);
+              this.#addResult(entryPath);
             } else {
               subPatterns.add(nextIndex + 1);
             }
@@ -668,7 +1004,7 @@ class Glob {
           // If current pattern is a regex that matches entry name (e.g *.js)
           // add next pattern to potential patterns, or to results if it's the last pattern
           if (index === last) {
-            this.#results.add(entryPath);
+            this.#addResult(entryPath);
           } else if (entryIsDirectory) {
             subPatterns.add(nextIndex);
           }
@@ -705,6 +1041,7 @@ class Glob {
     const isDirectory = await this.#isDirectory(fullpath, stat, pattern);
     const isLast = pattern.isLast(isDirectory);
     const isFirst = pattern.isFirst();
+    const finiteDepth = this.#depthLimiter !== null;
 
     if (this.#isExcluded(fullpath)) {
       return;
@@ -737,7 +1074,9 @@ class Glob {
       if (stat && (p || isDirectory)) {
         const result = join(path, p);
         if (!this.#results.has(result)) {
-          if (this.#results.add(result)) {
+          if (!finiteDepth ?
+            this.#results.add(result) :
+            await this.#addResultAsync(result)) {
             yield this.#withFileTypes ? stat : result;
           }
         }
@@ -750,13 +1089,21 @@ class Glob {
       // If pattern ends with **, add to results
       // if path is ".", add it only if pattern starts with "." or pattern is exactly "**"
       if (!this.#results.has(path)) {
-        if (this.#results.add(path)) {
+        if (!finiteDepth ?
+          this.#results.add(path) :
+          await this.#addResultAsync(path)) {
           yield this.#withFileTypes ? stat : path;
         }
       }
     }
 
-    if (!isDirectory || await this.#isCyclic(fullpath, isDirectory, pattern)) {
+    let canTraverse = true;
+    if (isDirectory && finiteDepth) {
+      canTraverse = await this.#canTraverseAsync(path, pattern);
+    }
+    if (!isDirectory ||
+        !canTraverse ||
+        await this.#isCyclic(fullpath, isDirectory, pattern)) {
       return;
     }
 
@@ -815,7 +1162,10 @@ class Glob {
             subPatterns.add(index);
           } else if (!fromSymlink && index === last) {
             // If ** is last, add to results
-            if (!this.#results.has(entryPath) && this.#results.add(entryPath)) {
+            if (!this.#results.has(entryPath) &&
+                (!finiteDepth ?
+                  this.#results.add(entryPath) :
+                  await this.#addResultAsync(entryPath))) {
               yield this.#withFileTypes ? entry : entryPath;
             }
           }
@@ -824,7 +1174,10 @@ class Glob {
           // so we can already test it here
           if (nextMatches && nextIndex === last && !isLast) {
             // If next pattern is the last one, add to results
-            if (!this.#results.has(entryPath) && this.#results.add(entryPath)) {
+            if (!this.#results.has(entryPath) &&
+                (!finiteDepth ?
+                  this.#results.add(entryPath) :
+                  await this.#addResultAsync(entryPath))) {
               yield this.#withFileTypes ? entry : entryPath;
             }
           } else if (nextMatches && entryIsDirectory) {
@@ -834,9 +1187,9 @@ class Glob {
             subPatterns.add(index + 2);
           }
           if ((nextMatches || pattern.at(0) === '.') &&
-           (entryIsDirectory || entry.isSymbolicLink()) && !fromSymlink) {
+           entryIsDirectory && !fromSymlink) {
             // If pattern after ** matches, or pattern starts with "."
-            // and entry is a directory or symlink, add to potential patterns
+            // and entry is a directory, add to potential patterns
             subPatterns.add(nextIndex);
           }
 
@@ -860,7 +1213,9 @@ class Glob {
               if (!this.#cache.seen(path, pattern, nextIndex)) {
                 this.#cache.add(path, pattern.child(new SafeSet().add(nextIndex)));
                 if (!this.#results.has(path)) {
-                  if (this.#results.add(path)) {
+                  if (!finiteDepth ?
+                    this.#results.add(path) :
+                    await this.#addResultAsync(path)) {
                     yield this.#withFileTypes ? this.#cache.statSync(fullpath) : path;
                   }
                 }
@@ -868,7 +1223,9 @@ class Glob {
               if (!this.#cache.seen(path, pattern, nextIndex) || !this.#cache.seen(parent, pattern, nextIndex)) {
                 this.#cache.add(parent, pattern.child(new SafeSet().add(nextIndex)));
                 if (!this.#results.has(parent)) {
-                  if (this.#results.add(parent)) {
+                  if (!finiteDepth ?
+                    this.#results.add(parent) :
+                    await this.#addResultAsync(parent)) {
                     yield this.#withFileTypes ? this.#cache.statSync(join(this.#root, parent)) : parent;
                   }
                 }
@@ -885,7 +1242,9 @@ class Glob {
             // If current pattern is ".", proceed to test next pattern
             if (nextIndex === last) {
               if (!this.#results.has(entryPath)) {
-                if (this.#results.add(entryPath)) {
+                if (!finiteDepth ?
+                  this.#results.add(entryPath) :
+                  await this.#addResultAsync(entryPath)) {
                   yield this.#withFileTypes ? entry : entryPath;
                 }
               }
@@ -899,7 +1258,9 @@ class Glob {
           // add next pattern to potential patterns, or to results if it's the last pattern
           if (index === last) {
             if (!this.#results.has(entryPath)) {
-              if (this.#results.add(entryPath)) {
+              if (!finiteDepth ?
+                this.#results.add(entryPath) :
+                await this.#addResultAsync(entryPath)) {
                 yield this.#withFileTypes ? entry : entryPath;
               }
             }
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index ce69512fa5c9..d5a6b9a2c853 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayPrototypePop,
   ArrayPrototypePush,
   Error,
   ErrorCaptureStackTrace,
@@ -32,9 +31,6 @@ const {
   O_WRONLY,
   S_IFMT,
   S_IFREG,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const binding = internalBinding('fs');
@@ -65,9 +61,10 @@ const {
     kReadFileUnknownBufferLength,
     kWriteFileMaxChunkSize,
   },
+  collectRecursiveReaddirResult,
   copyObject,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getStatFsFromBinding,
   getStatsFromBinding,
@@ -164,8 +161,9 @@ const lazyReadableStream = getLazy(() =>
 let newStreamsPull;
 let newStreamsPullSync;
 let newStreamsParsePullArgs;
-let newStreamsToUint8Array;
+let newStreamsToWriterUint8Array;
 let newStreamsConvertChunks;
+let newStreamsGetWriterSignal;
 function lazyNewStreams() {
   if (newStreamsPull === undefined) {
     const pullModule = require('internal/streams/iter/pull');
@@ -173,8 +171,9 @@ function lazyNewStreams() {
     newStreamsPullSync = pullModule.pullSync;
     const utils = require('internal/streams/iter/utils');
     newStreamsParsePullArgs = utils.parsePullArgs;
-    newStreamsToUint8Array = utils.toUint8Array;
+    newStreamsToWriterUint8Array = utils.toWriterUint8Array;
     newStreamsConvertChunks = utils.convertChunks;
+    newStreamsGetWriterSignal = utils.getWriterSignal;
   }
 }
 
@@ -885,6 +884,8 @@ if (getOptionValue('--experimental-stream-iter')) {
     return {
       __proto__: null,
       write(chunk, options = kNullPrototo) {
+        chunk = newStreamsToWriterUint8Array(chunk);
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -892,17 +893,9 @@ if (getOptionValue('--experimental-stream-iter')) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunk = newStreamsToUint8Array(chunk);
         if (bytesRemaining >= 0 && chunk.byteLength > bytesRemaining) {
           return PromiseReject(
             new ERR_OUT_OF_RANGE('write', `<= ${bytesRemaining} bytes`,
@@ -915,6 +908,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writev(chunks, options = kNullPrototo) {
+        chunks = newStreamsConvertChunks(chunks);
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -922,17 +917,9 @@ if (getOptionValue('--experimental-stream-iter')) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal?.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunks = newStreamsConvertChunks(chunks);
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -949,8 +936,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writeSync(chunk) {
+        chunk = newStreamsToWriterUint8Array(chunk);
         if (error || closed || asyncPending) return false;
-        chunk = newStreamsToUint8Array(chunk);
         const length = chunk.byteLength;
         if (length > syncWriteThreshold) return false;
         if (length === 0) return true;
@@ -980,8 +967,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writevSync(chunks) {
-        if (error || closed || asyncPending) return false;
         chunks = newStreamsConvertChunks(chunks);
+        if (error || closed || asyncPending) return false;
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -1016,6 +1003,7 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       end(options = kNullPrototo) {
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -1025,15 +1013,8 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (closing) {
           return pendingEndPromise;
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
         closing = true;
         pendingEndPromise = PromisePrototypeThen(
@@ -1598,6 +1579,9 @@ async function rmdir(path, options) {
 }
 
 async function fdatasync(handle) {
+  if (permission.isEnabled()) {
+    throw new ERR_ACCESS_DENIED('fdatasync API is disabled when Permission Model is enabled.');
+  }
   return await PromisePrototypeThen(
     binding.fdatasync(handle.fd, kUsePromises),
     undefined,
@@ -1606,6 +1590,9 @@ async function fdatasync(handle) {
 }
 
 async function fsync(handle) {
+  if (permission.isEnabled()) {
+    throw new ERR_ACCESS_DENIED('fsync API is disabled when Permission Model is enabled.');
+  }
   return await PromisePrototypeThen(
     binding.fsync(handle.fd, kUsePromises),
     undefined,
@@ -1642,42 +1629,42 @@ async function mkdir(path, options) {
 }
 
 async function readdirRecursive(originalPath, options) {
+  if (permission.isEnabled()) {
+    return readdirRecursiveWithPermissionModel(originalPath, options);
+  }
   const withFileTypes = !!options.withFileTypes;
-  const readdirWithTypes = (path) => PromisePrototypeThen(
-    binding.readdir(path, options.encoding, true, kUsePromises),
+  const result = await PromisePrototypeThen(
+    binding.readdirRecursive(
+      originalPath,
+      options.encoding,
+      withFileTypes,
+      kUsePromises,
+    ),
     undefined,
     handleErrorFromBinding,
   );
-  const result = [];
-  const queue = [[originalPath, '', await readdirWithTypes(originalPath)]];
-
-  while (queue.length > 0) {
-    // If we want to implement BFS make this a `shift` call instead of `pop`
-    const { 0: path, 1: prefix, 2: { 0: names, 1: types } } = ArrayPrototypePop(queue);
-    for (let i = 0; i < names.length; i++) {
-      const name = names[i];
-      const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-      let isDirectory;
-      if (withFileTypes) {
-        const dirent = getDirent(path, name, types[i]);
-        ArrayPrototypePush(result, dirent);
-        isDirectory = dirent.isDirectory();
-      } else {
-        ArrayPrototypePush(result, relative);
-        // Entries that are, or may be, symbolic links to directories are followed.
-        const type = types[i];
-        isDirectory = type === UV_DIRENT_DIR ||
-          ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-           binding.internalModuleStat(pathModule.join(path, name)) === 1);
-      }
-      if (isDirectory) {
-        const direntPath = pathModule.join(path, name);
-        ArrayPrototypePush(queue, [direntPath, relative, await readdirWithTypes(direntPath)]);
-      }
-    }
-  }
+  return withFileTypes ? getRecursiveDirents(originalPath, result) : result;
+}
 
-  return result;
+// TODO: native?
+async function readdirRecursiveWithPermissionModel(basePath, options) {
+  const { encoding } = options;
+  const context = {
+    withFileTypes: !!options.withFileTypes,
+    results: [],
+    dirs: [basePath],
+    prefixes: [''],
+  };
+  for (let i = 0; i < context.dirs.length; i++) {
+    const dir = context.dirs[i];
+    const result = await PromisePrototypeThen(
+      binding.readdir(dir, encoding, true, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    );
+    collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
+  }
+  return context.results;
 }
 
 async function readdir(path, options) {
@@ -1745,7 +1732,8 @@ async function symlink(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -1790,7 +1778,8 @@ async function lstat(path, options = { __proto__: null, bigint: false }) {
     if (promise !== undefined) return await promise;
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = pathModule.toNamespacedPath(BufferIsBuffer(path) ? BufferToString(path) : path);
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2113,6 +2102,14 @@ async function writeFile(path, data, options) {
 
   checkAborted(options.signal);
 
+  if (!flush && !isCustomIterable(data) && data.byteLength <= kWriteFileMaxChunkSize) {
+    path = getValidatedPath(path);
+    await writeFileInOneRoundTrip(path, stringToFlags(flag, 'options.flag'),
+                                  parseFileMode(options.mode, 'mode', 0o666), data);
+    checkAborted(options.signal);  // An abort during the write still wins.
+    return;
+  }
+
   const fd = await open(path, flag, options.mode);
   let writeOp = writeFileHandle(fd, data, options.signal, options.encoding);
 
@@ -2123,6 +2120,33 @@ async function writeFile(path, data, options) {
   return handleFdClose(writeOp, fd.close);
 }
 
+/**
+ * Open + write + close as one thread pool round trip.
+ * @param {string|Buffer} path Validated path
+ * @param {number} flagsNumber
+ * @param {number} mode
+ * @param {ArrayBufferView} data
+ * @returns {Promise<void>}
+ */
+function writeFileInOneRoundTrip(path, flagsNumber, mode, data) {
+  return new Promise((resolve, reject) => {
+    const job = new binding.WriteFileJob(path, flagsNumber, mode, data);
+    job.ondone = (err) => {
+      if (err != null) {
+        ErrorCaptureStackTrace(err, writeFileInOneRoundTrip);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      ErrorCaptureStackTrace(accessError, writeFileInOneRoundTrip);
+      reject(accessError);
+    }
+  });
+}
+
 function isCustomIterable(obj) {
   return isIterable(obj) && !isArrayBufferView(obj) && typeof obj !== 'string';
 }
diff --git a/lib/internal/fs/recursive_watch.js b/lib/internal/fs/recursive_watch.js
index 2f71aeda9f79..85d84f9dd8f3 100644
--- a/lib/internal/fs/recursive_watch.js
+++ b/lib/internal/fs/recursive_watch.js
@@ -17,7 +17,7 @@ const {
   },
 } = require('internal/errors');
 const { getValidatedPath } = require('internal/fs/utils');
-const { createIgnoreMatcher, kFSWatchStart, StatWatcher } = require('internal/fs/watchers');
+const { createIgnoreMatcher, kFSWatchStart } = require('internal/fs/watchers');
 const { kEmptyObject } = require('internal/util');
 const { validateBoolean, validateAbortSignal, validateIgnoreOption } = require('internal/validators');
 const {
@@ -37,14 +37,40 @@ function lazyLoadFsSync() {
 
 let kResistStopPropagation;
 
+const kIsAIX = process.platform === 'aix';
+
+function isPathMissingForWatch(error, file) {
+  if (error.code === 'ENOENT') {
+    return true;
+  }
+  // AIX reports ENODEV when the path disappears before fs.watch() starts.
+  // Check that it is actually gone so other ENODEV errors still propagate.
+  if (!kIsAIX || error.code !== 'ENODEV') {
+    return false;
+  }
+  try {
+    return lazyLoadFsSync().statSync(file, { throwIfNoEntry: false }) === undefined;
+  } catch {
+    return false;
+  }
+}
+
+// Inotify reports changes to a directory's entries, with their names, on the
+// directory's own watch, so one watcher per directory is enough on Linux.
+// kqueue and event ports only report that the directory itself changed, so
+// elsewhere every file keeps a watcher of its own as well.
+const kDirectoryWatchReportsEntries = process.platform === 'linux';
+
 class FSWatcher extends EventEmitter {
   #options = null;
   #closed = false;
-  #files = new SafeMap();
+  // Every path below the root that has been reported (or existed at start).
+  #entries = new SafeSet();
+  // One fs.watch() per directory and symbolic link (and per file where the
+  // directory watch does not report its entries).
   #watchers = new SafeMap();
-  #symbolicFiles = new SafeSet();
+  #symbolicLinks = new SafeSet();
   #rootPath = pathResolve();
-  #watchingFile = false;
   #ignoreMatcher = null;
 
   constructor(options = kEmptyObject) {
@@ -94,129 +120,199 @@ class FSWatcher extends EventEmitter {
 
     this.#closed = true;
 
-    for (const file of this.#files.keys()) {
-      this.#watchers.get(file)?.close();
-      this.#watchers.delete(file);
+    for (const watcher of this.#watchers.values()) {
+      watcher.close();
     }
-
-    this.#files.clear();
-    this.#symbolicFiles.clear();
+    this.#watchers.clear();
+    this.#entries.clear();
+    this.#symbolicLinks.clear();
     this.emit('close');
   }
 
-  #unwatchFiles(file) {
-    this.#symbolicFiles.delete(file);
+  #emit(eventType, file) {
+    this.emit('change', eventType, pathRelative(this.#rootPath, file));
+  }
+
+  #forget(file) {
+    const watcher = this.#watchers.get(file);
+    if (watcher !== undefined) {
+      watcher.close();
+      this.#watchers.delete(file);
+    }
+    this.#entries.delete(file);
+    this.#symbolicLinks.delete(file);
 
     const childPrefix = file + pathSep;
-    for (const filename of this.#files.keys()) {
-      if (filename === file ||
-          StringPrototypeStartsWith(filename, childPrefix)) {
-        this.#files.delete(filename);
-        this.#watchers.get(filename)?.close();
-        this.#watchers.delete(filename);
+    for (const entry of this.#entries) {
+      if (StringPrototypeStartsWith(entry, childPrefix)) {
+        this.#entries.delete(entry);
+        this.#symbolicLinks.delete(entry);
+        const childWatcher = this.#watchers.get(entry);
+        if (childWatcher !== undefined) {
+          childWatcher.close();
+          this.#watchers.delete(entry);
+        }
       }
     }
   }
 
-  #watchFolder(folder) {
-    const { readdirSync } = lazyLoadFsSync();
-
+  // Report an entry that vanished between being listed and being watched so
+  // the caller can discard its stale bookkeeping.
+  #watch(file, onChange) {
+    if (this.#closed) {
+      return false;
+    }
+    if (this.#watchers.has(file)) {
+      return true;
+    }
+    const { watch } = lazyLoadFsSync();
+    let watcher;
     try {
-      const files = readdirSync(folder, {
-        withFileTypes: true,
-      });
-
-      for (const file of files) {
-        if (this.#closed) {
-          break;
-        }
+      watcher = watch(file, { persistent: this.#options.persistent }, onChange);
+    } catch (err) {
+      if (isPathMissingForWatch(err, file) &&
+          (file !== this.#rootPath || !this.#options.throwIfNoEntry)) {
+        return false;
+      }
+      throw err;
+    }
+    this.#watchers.set(file, watcher);
+    return true;
+  }
 
-        const f = pathJoin(folder, file.name);
-        const relativePath = pathRelative(this.#rootPath, f);
+  // Arms one watcher for `folder`, then registers entries that are not known
+  // yet (emitting 'rename' for them unless this is the initial scan);
+  // #addEntry() descends into subdirectories.
+  #scanFolder(folder, initial) {
+    if (!this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename))) {
+      this.#forget(folder);
+      return;
+    }
 
-        // Skip watching ignored paths entirely to avoid kernel resource pressure
-        if (this.#ignoreMatcher?.(relativePath)) {
-          continue;
+    const { readdirSync } = lazyLoadFsSync();
+    let entries;
+    try {
+      entries = readdirSync(folder, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+        if (folder === this.#rootPath && initial &&
+            (error.code !== 'ENOENT' || this.#options.throwIfNoEntry)) {
+          throw error;
         }
-
-        if (!this.#files.has(f)) {
-          this.emit('change', 'rename', relativePath);
-
-          if (file.isSymbolicLink()) {
-            this.#symbolicFiles.add(f);
-          }
-
-          try {
-            this.#watchFile(f);
-            if (file.isDirectory() && !file.isSymbolicLink()) {
-              this.#watchFolder(f);
-            }
-          } catch (err) {
-            // Ignore ENOENT
-            if (err.code !== 'ENOENT') {
-              throw err;
-            }
-          }
+        if (!initial && !this.#closed) {
+          this.#emit('rename', folder);
         }
-      }
-    } catch (error) {
-      if (error.code !== 'ENOENT') {
+        this.#forget(folder);
+      } else {
         this.emit('error', error);
       }
+      return;
+    }
+
+    for (const entry of entries) {
+      if (this.#closed) {
+        break;
+      }
+      const file = pathJoin(folder, entry.name);
+      if (!this.#entries.has(file) && !this.#ignoreMatcher?.(pathRelative(this.#rootPath, file))) {
+        this.#addEntry(file, entry, initial);
+      }
+    }
+  }
+
+  // `entry` is the Dirent or the lstat() Stats of `file`.
+  #addEntry(file, entry, initial) {
+    this.#entries.add(file);
+    if (!initial) {
+      this.#emit('rename', file);
+    }
+    if (entry.isSymbolicLink()) {
+      // The link target is watched so that changes behind the link surface
+      // as a 'rename' of the link, as they always have on this code path.
+      this.#symbolicLinks.add(file);
+      if (!this.#watch(file, () => this.#emit('rename', file))) {
+        this.#forget(file);
+      }
+    } else if (entry.isDirectory()) {
+      this.#scanFolder(file, initial);
+    } else if (!kDirectoryWatchReportsEntries) {
+      if (!this.#watch(file, () => this.#onEntryEvent(file))) {
+        this.#forget(file);
+      }
     }
   }
 
-  #watchFile(file) {
+  #onFolderEvent(folder, filename) {
     if (this.#closed) {
       return;
     }
+    const { lstatSync, statSync } = lazyLoadFsSync();
+    if (!kDirectoryWatchReportsEntries || filename == null) {
+      // All that is known is that something about `folder` changed.
+      if (statSync(folder, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', folder);
+        this.#forget(folder);
+      } else {
+        this.#scanFolder(folder, false);
+      }
+      return;
+    }
+    // Events about the watched directory itself are reported under its own
+    // name; those take the "unknown entry" path and are resolved by the parent.
+    const file = pathJoin(folder, filename);
 
-    const { watch, statSync } = lazyLoadFsSync();
-
-    if (this.#files.has(file)) {
+    if (!this.#entries.has(file)) {
+      if (this.#ignoreMatcher?.(pathRelative(this.#rootPath, file))) {
+        return;
+      }
+      const entry = lstatSync(file, { throwIfNoEntry: false });
+      if (entry !== undefined) {
+        this.#addEntry(file, entry, false);
+      } else if (folder === this.#rootPath && statSync(folder, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', folder);
+        this.#forget(folder);
+      }
       return;
     }
 
-    {
-      const existingStat = statSync(file);
-      this.#files.set(file, existingStat);
+    this.#onEntryEvent(file);
+  }
+
+  // Something happened to a known entry: work out what from its current state.
+  #onEntryEvent(file) {
+    if (this.#closed) {
+      return;
+    }
+    const { statSync } = lazyLoadFsSync();
+    const stats = statSync(file, { throwIfNoEntry: false });
+    if (stats === undefined) {
+      this.#emit('rename', file);
+      this.#forget(file);
+    } else if (this.#symbolicLinks.has(file)) {
+      this.#emit('rename', file);
+    } else if (stats.isDirectory()) {
+      this.#scanFolder(file, false);
+    } else {
+      this.#emit('change', file);
     }
+  }
 
-    const watcher = watch(file, {
-      persistent: this.#options.persistent,
-    }, (eventType, filename) => {
-      const existingStat = this.#files.get(file);
-      let currentStats;
-
-      try {
-        currentStats = statSync(file);
-        this.#files.set(file, currentStats);
-      } catch {
-        // This happens if the file was removed
+  #watchRootFile(file) {
+    const { statSync } = lazyLoadFsSync();
+    this.#entries.add(file);
+    if (!this.#watch(file, () => {
+      if (this.#closed) {
+        return;
       }
-
-      if (currentStats === undefined || (currentStats.birthtimeMs === 0 && existingStat.birthtimeMs !== 0)) {
-        // The file is now deleted
-        this.#files.delete(file);
-        this.#watchers.delete(file);
-        watcher.close();
-        this.emit('change', 'rename', pathRelative(this.#rootPath, file));
-        this.#unwatchFiles(file);
-      } else if (file === this.#rootPath && this.#watchingFile) {
-        // This case will only be triggered when watching a file with fs.watch
-        this.emit('change', 'change', pathBasename(file));
-      } else if (this.#symbolicFiles.has(file)) {
-        // Stats from watchFile does not return correct value for currentStats.isSymbolicLink()
-        // Since it is only valid when using fs.lstat(). Therefore, check the existing symbolic files.
-        this.emit('change', 'rename', pathRelative(this.#rootPath, file));
-      } else if (currentStats.isDirectory()) {
-        this.#watchFolder(file);
+      if (statSync(file, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', file);
+        this.#forget(file);
       } else {
-        // Watching a directory will trigger a change event for child files)
-        this.emit('change', 'change', pathRelative(this.#rootPath, file));
+        this.emit('change', 'change', pathBasename(file));
       }
-    });
-    this.#watchers.set(file, watcher);
+    })) {
+      this.#forget(file);
+    }
   }
 
   [kFSWatchStart](filename) {
@@ -227,15 +323,16 @@ class FSWatcher extends EventEmitter {
 
       this.#rootPath = filename;
       this.#closed = false;
-      this.#watchingFile = file.isFile();
 
-      this.#watchFile(filename);
       if (file.isDirectory()) {
-        this.#watchFolder(filename);
+        this.#scanFolder(filename, true);
+      } else {
+        this.#watchRootFile(filename);
       }
     } catch (error) {
-      if (!this.#options.throwIfNoEntry && error.code === 'ENOENT') {
+      if (this.#options.throwIfNoEntry || error.code !== 'ENOENT') {
         error.filename = filename;
+        this.close();
         throw error;
       }
     }
@@ -243,19 +340,15 @@ class FSWatcher extends EventEmitter {
   }
 
   ref() {
-    this.#files.forEach((file) => {
-      if (file instanceof StatWatcher) {
-        file.ref();
-      }
-    });
+    for (const watcher of this.#watchers.values()) {
+      watcher.ref();
+    }
   }
 
   unref() {
-    this.#files.forEach((file) => {
-      if (file instanceof StatWatcher) {
-        file.unref();
-      }
-    });
+    for (const watcher of this.#watchers.values()) {
+      watcher.unref();
+    }
   }
 
   [SymbolAsyncIterator]() {
diff --git a/lib/internal/fs/utils.js b/lib/internal/fs/utils.js
index 70aaa7e7c58e..3aadc19c4732 100644
--- a/lib/internal/fs/utils.js
+++ b/lib/internal/fs/utils.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayIsArray,
+  ArrayPrototypePush,
   BigInt,
   Date,
   DateNow,
@@ -65,6 +66,11 @@ const {
   validateUint32,
 } = require('internal/validators');
 const pathModule = require('path');
+const binding = internalBinding('fs');
+const {
+  CHAR_BACKWARD_SLASH,
+  CHAR_FORWARD_SLASH,
+} = require('internal/constants');
 const kType = Symbol('type');
 const kStats = Symbol('stats');
 const kPartialAtimeNs = Symbol('partialAtimeNs');
@@ -323,6 +329,81 @@ function getDirent(path, name, type, callback) {
   }
 }
 
+/**
+ * Builds the Dirent objects for a `binding.readdirRecursive()` result, whose
+ * entries are grouped by directory: `counts[i]` entries under `dirs[i]`.
+ * @param {string | Buffer} basePath
+ * @param {[string[] | Buffer[], Uint8Array, Uint32Array, string[] | Buffer[]]} result
+ * @returns {Dirent[]}
+ */
+function getRecursiveDirents(basePath, { 0: names, 1: types, 2: counts, 3: dirs }) {
+  let i = 0;
+  for (let d = 0; d < dirs.length; d++) {
+    // The root keeps the path as given, the directories below it get the
+    // relative directory joined onto it.
+    const parentPath = d === 0 ? basePath : joinParentPath(basePath, dirs[d]);
+    for (const end = i + counts[d]; i < end; i++) {
+      names[i] = new Dirent(names[i], types[i], parentPath);
+    }
+  }
+  return names;
+}
+
+/**
+ * Joins the relative path of a directory onto the path a recursive readdir
+ * was given.
+ * @param {string | Buffer} basePath
+ * @param {string | Buffer} relative
+ * @returns {string | Buffer}
+ */
+function joinParentPath(basePath, relative) {
+  if (typeof basePath === 'string' && typeof relative === 'string') {
+    return pathModule.join(basePath, relative);
+  }
+  const base = typeof basePath === 'string' ? Buffer.from(basePath) : basePath;
+  const parts = [base];
+  const last = base.length === 0 ? -1 : base[base.length - 1];
+  if (last !== CHAR_FORWARD_SLASH && (!isWindows || last !== CHAR_BACKWARD_SLASH)) {
+    ArrayPrototypePush(parts, Buffer.from(pathModule.sep));
+  }
+  ArrayPrototypePush(parts, typeof relative === 'string' ? Buffer.from(relative) : relative);
+  return Buffer.concat(parts);
+}
+
+/**
+ * Appends one directory's entries to `context.results` and the subdirectories
+ * still to visit to `context.dirs`.
+ * @param {string} dir
+ * @param {string} prefix
+ * @param {[string[], number[]]} result
+ * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
+ */
+function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
+  const { length } = names;
+  for (let i = 0; i < length; i++) {
+    const name = names[i];
+    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
+    let isDirectory;
+    if (context.withFileTypes) {
+      const dirent = getDirent(dir, name, types[i]);
+      ArrayPrototypePush(context.results, dirent);
+      // https://github.com/nodejs/node/issues/52663
+      isDirectory = dirent.isDirectory() ||
+        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    } else {
+      ArrayPrototypePush(context.results, relative);
+      const type = types[i];
+      isDirectory = type === UV_DIRENT_DIR ||
+        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
+         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    }
+    if (isDirectory) {
+      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
+      ArrayPrototypePush(context.prefixes, relative);
+    }
+  }
+}
+
 function getOptions(options, defaultOptions = kEmptyObject) {
   if (options == null || typeof options === 'function') {
     return defaultOptions;
@@ -1111,6 +1192,7 @@ const vfsState = { __proto__: null, handlers: null };
 function setVfsHandlers(handlers) { vfsState.handlers = handlers; }
 
 module.exports = {
+  collectRecursiveReaddirResult,
   constants: {
     kIoMaxLength,
     kMaxUserId,
@@ -1128,6 +1210,7 @@ module.exports = {
   getDirent,
   getDirents,
   getOptions,
+  getRecursiveDirents,
   getValidatedFd,
   getValidatedPath,
   handleErrorFromBinding,
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index 952f6058019f..f325adab484e 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayIsArray,
   Float64Array,
   Map,
   MapPrototypeEntries,
@@ -33,11 +32,16 @@ const {
 } = require('internal/errors');
 
 const {
+  validateArray,
   validateInteger,
   validateNumber,
   validateObject,
 } = require('internal/validators');
 
+const {
+  isUint8Array,
+} = require('internal/util/types');
+
 const kDestroy = Symbol('kDestroy');
 const kHandle = Symbol('kHandle');
 const kRecordable = Symbol('kRecordable');
@@ -193,6 +197,30 @@ class Histogram {
     return this[kHandle]?.mean();
   }
 
+  /**
+   * Returns a confidence interval for the mean using Student's t-distribution.
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ mean: number, lower: number, upper: number }}
+   */
+  meanCI(options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.meanCI(confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      mean: result[0],
+      lower: result[1],
+      upper: result[2],
+    };
+  }
+
   /**
    * @readonly
    * @type {number}
@@ -213,6 +241,18 @@ class Histogram {
     return this[kHandle]?.exceedsBigInt();
   }
 
+  /**
+   * Serializes the histogram to a CBOR-encoded Uint8Array suitable for
+   * transmission or storage. The data can be reconstructed into a new
+   * histogram using `importHistogram()`.
+   * @returns {Uint8Array}
+   */
+  export() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.export();
+  }
+
   /**
    * Returns the exponentially weighted moving average of recorded values.
    * Only active when the histogram was created with a `halfLife` option.
@@ -539,8 +579,7 @@ class Histogram {
   percentilesAt(percentiles) {
     if (!isHistogram(this))
       throw new ERR_INVALID_THIS('Histogram');
-    if (!ArrayIsArray(percentiles))
-      throw new ERR_INVALID_ARG_TYPE('percentiles', 'Array', percentiles);
+    validateArray(percentiles, 'percentiles');
     for (let i = 0; i < percentiles.length; i++) {
       validateNumber(percentiles[i], `percentiles[${i}]`);
       if (NumberIsNaN(percentiles[i]) ||
@@ -756,6 +795,18 @@ function createHistogram(options = kEmptyObject) {
     new _Histogram(lowest, highest, figures, halfLife, threshold));
 }
 
+/**
+ * Reconstructs a histogram from a CBOR-encoded Uint8Array previously
+ * produced by `histogram.export()`.
+ * @param {Uint8Array} data
+ * @returns {RecordableHistogram}
+ */
+function importHistogram(data) {
+  if (!isUint8Array(data))
+    throw new ERR_INVALID_ARG_TYPE('data', 'Uint8Array', data);
+  return createRecordableHistogram(_Histogram.import(data));
+}
+
 module.exports = {
   Histogram,
   RecordableHistogram,
@@ -766,4 +817,5 @@ module.exports = {
   kHandle,
   kSkipThrow,
   createHistogram,
+  importHistogram,
 };
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 8042ae2b6782..9894da3646c6 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -470,7 +470,11 @@ function onSessionHeaders(handle, id, cat, flags, headers, sensitiveHeaders) {
     }
   }
   if (endOfStream) {
-    stream.push(null);
+    const reqAsync = stream[kRequestAsyncResource];
+    if (reqAsync)
+      reqAsync.runInAsyncScope(() => stream.push(null));
+    else
+      stream.push(null);
   }
 }
 
diff --git a/lib/internal/main/bench_runner.js b/lib/internal/main/bench_runner.js
new file mode 100644
index 000000000000..ff3647fe785c
--- /dev/null
+++ b/lib/internal/main/bench_runner.js
@@ -0,0 +1,31 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  PromisePrototypeThen,
+} = primordials;
+const {
+  markBootstrapComplete,
+  prepareTestRunnerMainExecution,
+} = require('internal/process/pre_execution');
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  triggerUncaughtException,
+  exitCodes: { kGenericUserError },
+} = internalBinding('errors');
+
+prepareTestRunnerMainExecution();
+markBootstrapComplete();
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+const { run } = require('internal/bench_runner/cli');
+const patterns = ArrayPrototypeSlice(process.argv, 1);
+
+PromisePrototypeThen(run(patterns), ({ success }) => {
+  if (!success) process.exitCode = kGenericUserError;
+}, (error) => {
+  triggerUncaughtException(error, true /* fromPromise */);
+});
diff --git a/lib/internal/main/embedding.js b/lib/internal/main/embedding.js
index 863f90a32f40..31c55459a13e 100644
--- a/lib/internal/main/embedding.js
+++ b/lib/internal/main/embedding.js
@@ -12,10 +12,15 @@
 const {
   prepareMainThreadExecution,
 } = require('internal/process/pre_execution');
-const { isExperimentalSeaWarningNeeded, isSea } = internalBinding('sea');
+const {
+  isExperimentalSeaWarningNeeded,
+  isSea,
+  isVfsEnabled,
+  mainCodePath: seaMainCodePath,
+} = internalBinding('sea');
 const { emitExperimentalWarning } = require('internal/util');
 const { emitWarningSync } = require('internal/process/warning');
-const { Module } = require('internal/modules/cjs/loader');
+const { Module, wrapModuleLoad } = require('internal/modules/cjs/loader');
 const { compileFunctionForCJSLoader } = internalBinding('contextify');
 const { maybeCacheSourceMap } = require('internal/source_map/source_map_cache');
 const { pathToFileURL } = require('internal/url');
@@ -120,10 +125,54 @@ function embedderRunESM(content, filename) {
   return wrap.getNamespace();
 }
 
+/* c8 ignore start -- only reachable in an actual SEA binary */
+/**
+ * Mounts the SEA virtual file system with the main script placed at the
+ * mount point root, and returns the path of the main script inside the
+ * mount, or null when the VFS could not be set up.
+ * @param {string} content The source of the SEA main script
+ * @returns {string|null} The VFS path of the main script
+ */
+function setUpSeaVfs(content) {
+  const mainName = path.basename(seaMainCodePath || process.execPath);
+  const { initSeaVfs } = require('internal/vfs/sea');
+  const seaVfs = initSeaVfs({ extraFiles: { [mainName]: content } });
+  if (seaVfs === null) {
+    return null;
+  }
+  return path.join(seaVfs.mountPoint, mainName);
+}
+/* c8 ignore stop */
+
 function embedderRunEntryPoint(content, format, filename) {
   format ||= moduleFormats.kCommonJS;
   filename ||= process.execPath;
 
+  /* c8 ignore start -- only reachable in an actual SEA binary */
+  if (isLoadingSea && isVfsEnabled()) {
+    // Run the main script from inside the SEA VFS mount so that
+    // `__filename`, `__dirname`, `import.meta`, relative requires and
+    // imports, and `node_modules` lookups all resolve against the
+    // bundled assets.
+    const vfsMain = setUpSeaVfs(content);
+    if (vfsMain !== null) {
+      if (format === moduleFormats.kCommonJS) {
+        return wrapModuleLoad(vfsMain, null, true);
+      } else if (format === moduleFormats.kModule) {
+        const { runEntryPointWithESMLoader } =
+          require('internal/modules/run_main');
+        const mainURL = pathToFileURL(vfsMain);
+        return runEntryPointWithESMLoader((cascadedLoader) => {
+          // Note that if the graph contains unsettled TLA, this may never
+          // resolve even after the event loop stops running.
+          return cascadedLoader.import(
+            mainURL, undefined, { __proto__: null }, undefined, true);
+        });
+      }
+    }
+  }
+  /* c8 ignore stop */
+
   if (format === moduleFormats.kCommonJS) {
     return embedderRunCjs(content, filename);
   } else if (format === moduleFormats.kModule) {
diff --git a/lib/internal/main/worker_thread.js b/lib/internal/main/worker_thread.js
index 8a58dc0cba0f..45e5efddb6f8 100644
--- a/lib/internal/main/worker_thread.js
+++ b/lib/internal/main/worker_thread.js
@@ -100,6 +100,7 @@ port.on('message', (message) => {
       hasStdin,
       publicPort,
       workerData,
+      webWorkerData,
       mainThreadPort,
     } = message;
 
@@ -116,6 +117,11 @@ port.on('message', (message) => {
     require('internal/worker').assignEnvironmentData(environmentData);
     setupMainThreadPort(mainThreadPort);
 
+    if (webWorkerData !== undefined) {
+      require('internal/webworker')
+        .installDedicatedWorkerGlobalScope(webWorkerData.url, webWorkerData);
+    }
+
     // The counter is only passed to the workers created by the main thread,
     // not to workers created by other workers.
     let cachedCwd = '';
@@ -155,7 +161,12 @@ port.on('message', (message) => {
         break;
       }
 
-      case 'classic': if (getOptionValue('--input-type') !== 'module') {
+      case 'classic': if (webWorkerData?.source !== undefined) {
+        // The source of a web Worker script loaded from a blob: or data:
+        // URL.
+        runWebWorkerScript(webWorkerData.source, webWorkerData);
+        break;
+      } else if (getOptionValue('--input-type') !== 'module') {
         const name = '[worker eval]';
         // This is necessary for CJS module compilation.
         // TODO: pass this with something really internal.
@@ -215,6 +226,13 @@ port.on('message', (message) => {
       }
 
       default: {
+        if (webWorkerData !== undefined) {
+          // A web Worker script loaded from a file: URL. Its type decides
+          // how the source is run, regardless of the file extension.
+          const source = require('fs').readFileSync(filename, 'utf8');
+          runWebWorkerScript(source, webWorkerData);
+          break;
+        }
         // script filename
         // runMain here might be monkey-patched by users in --require.
         // XXX: the monkey-patchability here should probably be deprecated.
@@ -289,6 +307,21 @@ function workerOnGlobalUncaughtException(error, fromPromise) {
   process.exit();
 }
 
+function runWebWorkerScript(source, webWorkerData) {
+  const webworker = require('internal/webworker');
+  if (webWorkerData.type === 'module') {
+    PromisePrototypeThen(
+      webworker.runModuleScriptSource(source, webWorkerData.url),
+      undefined,
+      (error) => workerOnGlobalUncaughtException(error, true),
+    );
+  } else {
+    // Unlike a worker eval, "run a classic script" evaluates the source in
+    // the worker's global scope.
+    webworker.runClassicScriptSource(source, webWorkerData.url);
+  }
+}
+
 // Patch the global uncaught exception handler so it gets picked up by
 // node::errors::TriggerUncaughtException().
 process._fatalException = workerOnGlobalUncaughtException;
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index 554746b6e2b3..1995eef579e8 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -113,6 +113,7 @@ const kFormat = Symbol('kFormat');
 
 // Set first due to cycle with ESM loader functions.
 module.exports = {
+  purgeModuleCachesForPrefix,
   kModuleSource,
   kModuleExport,
   kModuleExportNames,
@@ -155,19 +156,18 @@ const {
 } = internalBinding('contextify');
 
 const assert = require('internal/assert');
-const fs = require('fs');
 const path = require('path');
-const internalFsBinding = internalBinding('fs');
 const { safeGetenv } = internalBinding('credentials');
 const {
+  cleanForVfsPrefix,
   getCjsConditions,
   getCjsConditionsArray,
   initializeCjsConditions,
+  loaderMethods,
   loadBuiltinModule,
   makeRequireFunction,
   setHasStartedUserCJSExecution,
   stripBOM,
-  toRealPath,
   getRequireStack,
 } = require('internal/modules/helpers');
 const {
@@ -278,7 +278,7 @@ function stat(filename) {
     const result = statCache.get(filename);
     if (result !== undefined) { return result; }
   }
-  const result = internalFsBinding.internalModuleStat(filename);
+  const result = loaderMethods.internalModuleStat(filename);
   if (statCache !== null && result >= 0) {
     // Only set cache when `internalModuleStat(filename)` succeeds.
     statCache.set(filename, result);
@@ -286,6 +286,22 @@ function stat(filename) {
   return result;
 }
 
+/**
+ * Drop every module-loader cache entry (Module._cache,
+ * Module._pathCache, the stat cache) whose filename lives under
+ * `mountPoint`. Called by internal/vfs/setup.js when a VFS is
+ * unmounted. VFS mount points live in a reserved namespace that
+ * cannot collide with real paths, so a prefix scan is exact:
+ * real-fs entries and other-VFS entries never match.
+ * @param {string} mountPoint Absolute mount-point path
+ */
+function purgeModuleCachesForPrefix(mountPoint) {
+  cleanForVfsPrefix(Module._cache, mountPoint);
+  // Module._pathCache keys are `request\0parent` tokens; match on value.
+  cleanForVfsPrefix(Module._pathCache, mountPoint, true);
+  if (statCache !== null) { cleanForVfsPrefix(statCache, mountPoint); }
+}
+
 let _stat = stat;
 ObjectDefineProperty(Module, '_stat', {
   __proto__: null,
@@ -492,17 +508,7 @@ Module.isBuiltin = BuiltinModule.isBuiltin;
 function initializeCJS() {
   // This need to be done at runtime in case --expose-internals is set.
 
-  let modules = Module.builtinModules = BuiltinModule.getAllBuiltinModuleIds();
-  if (!getOptionValue('--experimental-quic')) {
-    modules = modules.filter((i) => i !== 'node:quic');
-  }
-  if (!getOptionValue('--experimental-ffi')) {
-    modules = modules.filter((i) => i !== 'node:ffi');
-  }
-  if (!getOptionValue('--experimental-vfs')) {
-    modules = modules.filter((i) => i !== 'node:vfs');
-  }
-  Module.builtinModules = ObjectFreeze(modules);
+  Module.builtinModules = ObjectFreeze(BuiltinModule.getAllBuiltinModuleIds());
 
   initializeCjsConditions();
 
@@ -595,7 +601,7 @@ function tryFile(requestPath, isMain) {
   if (getOptionValue(isMain ? '--preserve-symlinks-main' : '--preserve-symlinks')) {
     return path.resolve(requestPath);
   }
-  return toRealPath(requestPath);
+  return loaderMethods.realpathSync(requestPath);
 }
 
 /**
@@ -839,7 +845,7 @@ Module._findPath = function(request, paths, isMain, conditions = getCjsCondition
           if (getOptionValue('--preserve-symlinks')) {
             filename = path.resolve(basePath);
           } else {
-            filename = toRealPath(basePath);
+            filename = loaderMethods.realpathSync(basePath);
           }
         } else if (getOptionValue('--preserve-symlinks-main')) {
           // For the main module, we use the --preserve-symlinks-main flag instead
@@ -852,7 +858,7 @@ Module._findPath = function(request, paths, isMain, conditions = getCjsCondition
           // is needed.
           filename = path.resolve(basePath);
         } else {
-          filename = toRealPath(basePath);
+          filename = loaderMethods.realpathSync(basePath);
         }
       }
 
@@ -913,6 +919,11 @@ if (isWindows) {
       return [from + 'node_modules'];
     }
 
+    // The walk stops at the resolution root (e.g. a VFS mount point)
+    // instead of continuing to the file system root.
+    const resolutionRoot = loaderMethods.getResolutionRoot(from);
+    const stopLen = resolutionRoot === undefined ? -1 : resolutionRoot.length;
+
     /** @type {string[]} */
     const paths = [];
     for (let i = from.length - 1, p = 0, last = from.length; i >= 0; --i) {
@@ -931,6 +942,9 @@ if (isWindows) {
             StringPrototypeSlice(from, 0, last) + '\\node_modules',
           );
         }
+        if (last === stopLen) {
+          return paths;
+        }
         last = i;
         p = 0;
       } else if (p !== -1) {
@@ -959,6 +973,11 @@ if (isWindows) {
       return ['/node_modules'];
     }
 
+    // The walk stops at the resolution root (e.g. a VFS mount point)
+    // instead of continuing to the file system root.
+    const resolutionRoot = loaderMethods.getResolutionRoot(from);
+    const stopLen = resolutionRoot === undefined ? -1 : resolutionRoot.length;
+
     // note: this approach *only* works when the path is guaranteed
     // to be absolute.  Doing a fully-edge-case-correct path.split
     // that works on both Windows and Posix is non-trivial.
@@ -973,6 +992,9 @@ if (isWindows) {
             StringPrototypeSlice(from, 0, last) + '/node_modules',
           );
         }
+        if (last === stopLen) {
+          return paths;
+        }
         last = i;
         p = 0;
       } else if (p !== -1) {
@@ -1245,7 +1267,7 @@ function defaultLoadImpl(filename, format) {
     case 'module-typescript':
     case 'commonjs-typescript':
     case 'typescript': {
-      return fs.readFileSync(filename, 'utf8');
+      return loaderMethods.readFileSync(filename, 'utf8');
     }
     case 'builtin':
       return null;
diff --git a/lib/internal/modules/esm/get_format.js b/lib/internal/modules/esm/get_format.js
index b486337fac83..e69a0a01d996 100644
--- a/lib/internal/modules/esm/get_format.js
+++ b/lib/internal/modules/esm/get_format.js
@@ -10,7 +10,6 @@ const {
 } = primordials;
 const { getOptionValue } = require('internal/options');
 const { getValidatedPath } = require('internal/fs/utils');
-const fsBindings = internalBinding('fs');
 const { internal: internalConstants } = internalBinding('constants');
 
 const extensionFormatMap = {
@@ -66,7 +65,8 @@ function mimeToFormat(mime) {
  */
 function getFormatOfExtensionlessFile(url) {
   const path = getValidatedPath(url);
-  switch (fsBindings.getFormatOfExtensionlessFile(path)) {
+  const { loaderMethods } = require('internal/modules/helpers');
+  switch (loaderMethods.getFormatOfExtensionlessFile(path)) {
     case internalConstants.EXTENSIONLESS_FORMAT_WASM:
       return 'wasm';
     default:
diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
index f8487eda020d..06f60f9f6725 100644
--- a/lib/internal/modules/esm/load.js
+++ b/lib/internal/modules/esm/load.js
@@ -9,7 +9,7 @@ const {
 
 const { defaultGetFormat } = require('internal/modules/esm/get_format');
 const { validateAttributes, emitImportAssertionWarning } = require('internal/modules/esm/assert');
-const fs = require('fs');
+const { loaderMethods } = require('internal/modules/helpers');
 
 const { Buffer: { from: BufferFrom } } = require('buffer');
 
@@ -35,7 +35,7 @@ function getSourceSync(url, context) {
     // behavior - DO NOT depend on the patchability in new code: Node.js
     // internals may stop going through the JavaScript fs module entirely.
     // Prefer module.registerHooks() or other more formal fs hooks released in the future.
-    source = fs.readFileSync(url);
+    source = loaderMethods.readFileSync(url);
   } else if (protocol === 'data:') {
     const { dataURLProcessor } = require('internal/data_url');  // Only for data: URLs.
     const result = dataURLProcessor(url);
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index 3916e79328ed..0d00f014147d 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -9,7 +9,6 @@ const {
   ObjectPrototypeHasOwnProperty,
   RegExpPrototypeExec,
   RegExpPrototypeSymbolReplace,
-  SafeMap,
   SafeSet,
   String,
   StringPrototypeEndsWith,
@@ -23,16 +22,13 @@ const {
   encodeURIComponent,
 } = primordials;
 const assert = require('internal/assert');
-const internalFS = require('internal/fs/utils');
 const { BuiltinModule } = require('internal/bootstrap/realm');
-const fs = require('fs');
 const { getOptionValue } = require('internal/options');
 // Do not eagerly grab .manifest, it may be in TDZ
 const { sep, posix: { relative: relativePosixPath }, resolve, join } = require('path');
 const { URL, pathToFileURL, fileURLToPath, isURL, URLParse } = require('internal/url');
 const { getCWDURL, setOwnProperty, kEmptyObject } = require('internal/util');
 const { canParse: URLCanParse } = internalBinding('url');
-const { legacyMainResolve: FSLegacyMainResolve } = internalBinding('fs');
 const {
   ERR_INPUT_TYPE_NOT_ALLOWED,
   ERR_INVALID_ARG_TYPE,
@@ -49,7 +45,11 @@ const {
 const { defaultGetFormatWithoutErrors } = require('internal/modules/esm/get_format');
 const { getConditionsSet } = require('internal/modules/esm/utils');
 const packageJsonReader = require('internal/modules/package_json_reader');
-const internalFsBinding = internalBinding('fs');
+const {
+  legacyMainResolveExtensions,
+  legacyMainResolveExtensionsIndexes,
+  loaderMethods,
+} = require('internal/modules/helpers');
 
 /**
  * @typedef {import('internal/modules/esm/package_config.js').PackageConfig} PackageConfig
@@ -150,37 +150,6 @@ function emitLegacyIndexDeprecation(url, path, pkgPath, base, main) {
   }
 }
 
-const realpathCache = new SafeMap();
-
-const legacyMainResolveExtensions = [
-  '',
-  '.js',
-  '.json',
-  '.node',
-  '/index.js',
-  '/index.json',
-  '/index.node',
-  './index.js',
-  './index.json',
-  './index.node',
-];
-
-const legacyMainResolveExtensionsIndexes = {
-  // 0-6: when packageConfig.main is defined
-  kResolvedByMain: 0,
-  kResolvedByMainJs: 1,
-  kResolvedByMainJson: 2,
-  kResolvedByMainNode: 3,
-  kResolvedByMainIndexJs: 4,
-  kResolvedByMainIndexJson: 5,
-  kResolvedByMainIndexNode: 6,
-  // 7-9: when packageConfig.main is NOT defined,
-  //      or when the previous case didn't found the file
-  kResolvedByPackageAndJs: 7,
-  kResolvedByPackageAndJson: 8,
-  kResolvedByPackageAndNode: 9,
-};
-
 /**
  * Legacy CommonJS main resolution:
  * 1. let M = pkg_url + (json main field)
@@ -199,7 +168,7 @@ function legacyMainResolve(packageJSONUrl, packageConfig, base) {
 
   const baseStringified = isURL(base) ? base.href : base;
 
-  const resolvedOption = FSLegacyMainResolve(pkgPath, packageConfig.main, baseStringified);
+  const resolvedOption = loaderMethods.legacyMainResolve(pkgPath, packageConfig.main, baseStringified);
 
   const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
     packageConfig.main || './' : '';
@@ -245,7 +214,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
     throw err;
   }
 
-  const stats = internalFsBinding.internalModuleStat(
+  const stats = loaderMethods.internalModuleStat(
     StringPrototypeEndsWith(path, '/') ? StringPrototypeSlice(path, -1) : path,
   );
 
@@ -278,9 +247,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
     // behavior - DO NOT depend on the patchability in new code: Node.js
     // internals may stop going through the JavaScript fs module entirely.
     // Prefer module.registerHooks() or other more formal fs hooks released in the future.
-    const real = fs.realpathSync(path, {
-      [internalFS.realpathCacheKey]: realpathCache,
-    });
+    const real = loaderMethods.realpathSync(path);
     const { search, hash } = resolved;
     resolved =
         pathToFileURL(real + (StringPrototypeEndsWith(path, sep) ? '/' : ''));
diff --git a/lib/internal/modules/helpers.js b/lib/internal/modules/helpers.js
index dec084b291bb..83ead57520cc 100644
--- a/lib/internal/modules/helpers.js
+++ b/lib/internal/modules/helpers.js
@@ -3,15 +3,20 @@
 const {
   ArrayPrototypeForEach,
   ArrayPrototypePush,
+  MapPrototypeForEach,
+  MapPrototypeGet,
   ObjectDefineProperty,
   ObjectFreeze,
+  ObjectKeys,
   ObjectPrototypeHasOwnProperty,
+  ReflectApply,
   SafeMap,
   SafeSet,
   StringPrototypeCharCodeAt,
   StringPrototypeIncludes,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
+  Symbol,
 } = primordials;
 const {
   ERR_INVALID_ARG_TYPE,
@@ -28,7 +33,7 @@ const { pathToFileURL, fileURLToPath, URL } = require('internal/url');
 const assert = require('internal/assert');
 
 const { getOptionValue } = require('internal/options');
-const { setOwnProperty, getLazy } = require('internal/util');
+const { kEmptyObject, setOwnProperty, getLazy } = require('internal/util');
 const { inspect } = require('internal/util/inspect');
 const { emitWarningSync } = require('internal/process/warning');
 const {
@@ -39,13 +44,15 @@ const {
 const lazyTmpdir = getLazy(() => require('os').tmpdir());
 const { join } = path;
 
+const internalFsBinding = internalBinding('fs');
 const { canParse: URLCanParse } = internalBinding('url');
+const modulesBinding = internalBinding('modules');
 const {
   enableCompileCache: _enableCompileCache,
   getCompileCacheDir: _getCompileCacheDir,
   compileCacheStatus: _compileCacheStatus,
   flushCompileCache,
-} = internalBinding('modules');
+} = modulesBinding;
 
 const lazyCJSLoader = getLazy(() => require('internal/modules/cjs/loader'));
 let debug = require('internal/util/debuglog').debuglog('module', (fn) => {
@@ -61,15 +68,128 @@ let debug = require('internal/util/debuglog').debuglog('module', (fn) => {
  * @type {Map<string, string>}
  */
 const realpathCache = new SafeMap();
+
+// Toggleable loader hooks for VFS support. Overrides that return
+// `undefined` fall through to the pinned native implementation.
+const nativeLoaderMethods = {
+  internalModuleStat: (filename) => internalFsBinding.internalModuleStat(filename),
+  readFileSync: (filename, options) => fs.readFileSync(filename, options),
+  realpathSync: (requestPath) => fs.realpathSync(requestPath, {
+    [internalFS.realpathCacheKey]: realpathCache,
+  }),
+  legacyMainResolve: (pkgPath, main, base) =>
+    internalFsBinding.legacyMainResolve(pkgPath, main, base),
+  getFormatOfExtensionlessFile: (filePath) =>
+    internalFsBinding.getFormatOfExtensionlessFile(filePath),
+  readPackageJSON: (jsonPath, isESM, base, specifier) =>
+    modulesBinding.readPackageJSON(jsonPath, isESM, base, specifier),
+  getNearestParentPackageJSON: (checkPath) =>
+    modulesBinding.getNearestParentPackageJSON(checkPath),
+  getPackageScopeConfig: (resolved) =>
+    modulesBinding.getPackageScopeConfig(resolved),
+  getPackageType: (url) => modulesBinding.getPackageType(url),
+  // Synthetic hook with no native counterpart: returns the directory at
+  // which upward walks (node_modules lookups) must stop for `path`, or
+  // undefined to walk to the file system root.
+  getResolutionRoot: () => undefined,
+};
+const loaderMethodKeys = ObjectKeys(nativeLoaderMethods);
+// Overrides use this sentinel when they handled a request but their method's
+// meaningful result is `undefined`. A plain `undefined` means fall through to
+// the native implementation.
+const kLoaderOverrideNoResult = Symbol('kLoaderOverrideNoResult');
+const loaderOverrides = new SafeMap();
+let hasLoaderOverrides = false;
+
 /**
- * Resolves the path of a given `require` specifier, following symlinks.
- * @param {string} requestPath The `require` specifier
- * @returns {string}
+ * @param {string} key Name of the wrapped method in `nativeLoaderMethods`.
+ * @param {Function} originalFn Native fallback pinned at load time.
+ * @returns {Function} Wrapper that consults `loaderOverrides` and falls
+ *   through to `originalFn` when no override is set or when the
+ *   override returns `undefined`.
  */
-function toRealPath(requestPath) {
-  return fs.realpathSync(requestPath, {
-    [internalFS.realpathCacheKey]: realpathCache,
-  });
+function wrapLoaderMethod(key, originalFn) {
+  return function loaderMethodWrapper(...args) {
+    if (hasLoaderOverrides) {
+      const override = MapPrototypeGet(loaderOverrides, key);
+      if (override !== undefined) {
+        const result = ReflectApply(override, undefined, args);
+        if (result === kLoaderOverrideNoResult) { return undefined; }
+        if (result !== undefined) { return result; }
+      }
+    }
+    return ReflectApply(originalFn, undefined, args);
+  };
+}
+
+/**
+ * Toggleable versions of the loader's fs and package.json methods, keyed
+ * like `nativeLoaderMethods`. The module loader calls these instead of the
+ * native implementations so that VFS overrides can be consulted first.
+ */
+const loaderMethods = { __proto__: null };
+for (let i = 0; i < loaderMethodKeys.length; i++) {
+  const key = loaderMethodKeys[i];
+  loaderMethods[key] = wrapLoaderMethod(key, nativeLoaderMethods[key]);
+}
+
+/**
+ * Set override functions for the module loader's fs and package.json
+ * operations. Fields are keyed like `nativeLoaderMethods`; missing or
+ * nullish fields disable that hook (fast-path restored).
+ * @param {Record<string, Function|undefined>} overrides
+ */
+function setLoaderOverrides(overrides = kEmptyObject) {
+  for (let i = 0; i < loaderMethodKeys.length; i++) {
+    const key = loaderMethodKeys[i];
+    const override = overrides[key];
+    if (override) {
+      loaderOverrides.set(key, override);
+    } else {
+      loaderOverrides.delete(key);
+    }
+  }
+  hasLoaderOverrides = loaderOverrides.size > 0;
+}
+
+/**
+ * Delete every entry in `cache` whose owned string is under
+ * `mountPoint`. `cache` is either a plain object (Module._cache,
+ * Module._pathCache) or a SafeMap (statCache, realpathCache,
+ * the package.json caches). By default the entry KEY is tested;
+ * pass `byValue: true` to test the entry value instead (used for
+ * Module._pathCache whose keys are `request\0parent` tokens and
+ * whose values are the resolved filenames).
+ *
+ * Mount points live in the reserved VFS namespace so a prefix scan
+ * on strings is exact - real-fs entries never match.
+ * @param {object|Map<string, *>} cache
+ * @param {string} mountPoint Absolute mount-point path
+ * @param {boolean} [byValue] Test the entry value instead of the key
+ */
+function cleanForVfsPrefix(cache, mountPoint, byValue = false) {
+  const prefix = mountPoint + path.sep;
+  const owns = (s) =>
+    typeof s === 'string' &&
+    (s === mountPoint || StringPrototypeStartsWith(s, prefix));
+  if (typeof cache.forEach === 'function') {
+    MapPrototypeForEach(cache, (v, k) => {
+      if (owns(byValue ? v : k)) { cache.delete(k); }
+    });
+  } else {
+    ArrayPrototypeForEach(ObjectKeys(cache), (k) => {
+      if (owns(byValue ? cache[k] : k)) { delete cache[k]; }
+    });
+  }
+}
+
+/**
+ * Drop realpath-cache entries under an unmounted VFS mount point.
+ * Called by internal/vfs/setup.js.
+ * @param {string} mountPoint Absolute mount-point path
+ */
+function purgeRealpathCacheForPrefix(mountPoint) {
+  cleanForVfsPrefix(realpathCache, mountPoint);
 }
 
 /** @type {Set<string>} */
@@ -446,8 +566,6 @@ function assertBufferSource(body, allowString, hookName) {
   );
 }
 
-let DECODER = null;
-
 /**
  * Converts a buffer or buffer-like object to a string.
  * @param {string | ArrayBuffer | ArrayBufferView} body - The buffer or buffer-like object to convert to a string.
@@ -456,9 +574,7 @@ let DECODER = null;
 function stringify(body) {
   if (typeof body === 'string') { return body; }
   assertBufferSource(body, false, 'load');
-  const { TextDecoder } = require('internal/encoding');
-  DECODER = DECODER === null ? new TextDecoder() : DECODER;
-  return DECODER.decode(body);
+  return require('internal/encoding').getUtf8Decoder().decode(body);
 }
 
 /**
@@ -536,9 +652,41 @@ function getRequireStack(parent) {
   return requireStack;
 }
 
+// Suffixes tried by legacy CommonJS `main` resolution; indexes match
+// the values returned by the `legacyMainResolve` C++ binding.
+const legacyMainResolveExtensions = [
+  '',
+  '.js',
+  '.json',
+  '.node',
+  '/index.js',
+  '/index.json',
+  '/index.node',
+  './index.js',
+  './index.json',
+  './index.node',
+];
+
+const legacyMainResolveExtensionsIndexes = {
+  // 0-6: when packageConfig.main is defined
+  kResolvedByMain: 0,
+  kResolvedByMainJs: 1,
+  kResolvedByMainJson: 2,
+  kResolvedByMainNode: 3,
+  kResolvedByMainIndexJs: 4,
+  kResolvedByMainIndexJson: 5,
+  kResolvedByMainIndexNode: 6,
+  // 7-9: when packageConfig.main is not defined
+  kResolvedByPackageAndJs: 7,
+  kResolvedByPackageAndJson: 8,
+  kResolvedByPackageAndNode: 9,
+};
+
 module.exports = {
   addBuiltinLibsToObject,
   assertBufferSource,
+  cleanForVfsPrefix,
+  purgeRealpathCacheForPrefix,
   constants,
   enableCompileCache,
   flushCompileCache,
@@ -547,13 +695,17 @@ module.exports = {
   getCjsConditionsArray,
   getCompileCacheDir,
   initializeCjsConditions,
+  legacyMainResolveExtensions,
+  legacyMainResolveExtensionsIndexes,
+  kLoaderOverrideNoResult,
+  loaderMethods,
   loadBuiltinModuleForEmbedder,
   loadBuiltinModule,
   makeRequireFunction,
   normalizeReferrerURL,
+  setLoaderOverrides,
   stringify,
   stripBOM,
-  toRealPath,
   hasStartedUserCJSExecution() {
     return _hasStartedUserCJSExecution;
   },
diff --git a/lib/internal/modules/package_json_reader.js b/lib/internal/modules/package_json_reader.js
index c33cf166f53b..ea6b7d26395e 100644
--- a/lib/internal/modules/package_json_reader.js
+++ b/lib/internal/modules/package_json_reader.js
@@ -8,6 +8,7 @@ const {
   SafeMap,
   StringPrototypeIndexOf,
   StringPrototypeSlice,
+  StringPrototypeStartsWith,
 } = primordials;
 const {
   fileURLToPath,
@@ -25,10 +26,12 @@ const {
 } = require('internal/errors');
 const { kEmptyObject, isWindows } = require('internal/util');
 const permission = require('internal/process/permission');
-const modulesBinding = internalBinding('modules');
 const path = require('path');
 const { validateString } = require('internal/validators');
-const internalFsBinding = internalBinding('fs');
+const {
+  cleanForVfsPrefix,
+  loaderMethods,
+} = require('internal/modules/helpers');
 
 
 /**
@@ -123,7 +126,7 @@ const requiresJSONParse = (value) => (value !== undefined && (value[0] === '[' |
 function read(jsonPath, { base, specifier, isESM } = kEmptyObject) {
   // This function will be called by both CJS and ESM, so we need to make sure
   // non-null attributes are converted to strings.
-  const parsed = modulesBinding.readPackageJSON(
+  const parsed = loaderMethods.readPackageJSON(
     jsonPath,
     isESM,
     base == null ? undefined : `${base}`,
@@ -194,7 +197,7 @@ function getNearestParentPackageJSON(checkPath) {
   const key = permissionEnabled ? checkPath : getTraversalStartDirectory(checkPath);
   let parentPackageJSONPath = cache.get(key);
   if (parentPackageJSONPath === undefined) {
-    const result = modulesBinding.getNearestParentPackageJSON(checkPath);
+    const result = loaderMethods.getNearestParentPackageJSON(checkPath);
     if (result === undefined) {
       parentPackageJSONPath = null;
     } else {
@@ -220,7 +223,7 @@ function getNearestParentPackageJSON(checkPath) {
  * @returns {import('typings/internalBinding/modules').PackageConfig} - The package configuration.
  */
 function getPackageScopeConfig(resolved) {
-  const result = modulesBinding.getPackageScopeConfig(`${resolved}`);
+  const result = loaderMethods.getPackageScopeConfig(`${resolved}`);
 
   if (ArrayIsArray(result)) {
     const { data, exists, path } = deserializePackageJSON(`${resolved}`, result);
@@ -249,7 +252,7 @@ function getPackageScopeConfig(resolved) {
  * @returns {string}
  */
 function getPackageType(url) {
-  const type = modulesBinding.getPackageType(`${url}`);
+  const type = loaderMethods.getPackageType(`${url}`);
   return type ?? 'none';
 }
 
@@ -308,9 +311,14 @@ function getPackageJSONURL(specifier, base) {
 
   let packageJSONUrl = new URL(`./node_modules/${packageName}/package.json`, base);
   let packageJSONPath = fileURLToPath(packageJSONUrl);
+  // The walk stops at the resolution root (e.g. a VFS mount point)
+  // instead of continuing to the file system root.
+  const resolutionRoot = loaderMethods.getResolutionRoot(packageJSONPath);
+  const resolutionRootPrefix =
+    resolutionRoot === undefined ? undefined : resolutionRoot + path.sep;
   let lastPath;
   do {
-    const stat = internalFsBinding.internalModuleStat(
+    const stat = loaderMethods.internalModuleStat(
       StringPrototypeSlice(packageJSONPath, 0, packageJSONPath.length - 13),
     );
     // Check for !stat.isDirectory()
@@ -321,6 +329,10 @@ function getPackageJSONURL(specifier, base) {
         packageJSONUrl,
       );
       packageJSONPath = fileURLToPath(packageJSONUrl);
+      if (resolutionRootPrefix !== undefined &&
+          !StringPrototypeStartsWith(packageJSONPath, resolutionRootPrefix)) {
+        break;
+      }
       continue;
     }
 
@@ -383,6 +395,20 @@ function findPackageJSON(specifier, base = 'data:') {
   return pkg?.path;
 }
 
+/**
+ * Drop package.json-cache entries under an unmounted VFS mount point.
+ * Called by internal/vfs/setup.js. A module path and its owning
+ * package.json path always live in the same mount (the pjson search
+ * walks up from the module and stops at the mount root), so a single
+ * key test on each map is exact.
+ * @param {string} mountPoint Absolute mount-point path
+ */
+function purgePackageJSONCacheForPrefix(mountPoint) {
+  cleanForVfsPrefix(directoryToParentPackageJSONPathCache, mountPoint);
+  cleanForVfsPrefix(moduleToParentPackageJSONCache, mountPoint);
+  cleanForVfsPrefix(deserializedPackageJSONCache, mountPoint);
+}
+
 module.exports = {
   read,
   getNearestParentPackageJSON,
@@ -390,4 +416,5 @@ module.exports = {
   getPackageType,
   getPackageJSONURL,
   findPackageJSON,
+  purgePackageJSONCacheForPrefix,
 };
diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
index 2974459755ec..50ae8c281b02 100644
--- a/lib/internal/modules/run_main.js
+++ b/lib/internal/modules/run_main.js
@@ -37,8 +37,8 @@ function resolveMainPath(main) {
 
   const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
   if (!preserveSymlinksMain) {
-    const { toRealPath } = require('internal/modules/helpers');
-    mainPath = toRealPath(mainPath);
+    const { loaderMethods } = require('internal/modules/helpers');
+    mainPath = loaderMethods.realpathSync(mainPath);
   }
 
   return mainPath;
diff --git a/lib/internal/navigator.js b/lib/internal/navigator.js
index d8681c899904..35d2c8266502 100644
--- a/lib/internal/navigator.js
+++ b/lib/internal/navigator.js
@@ -159,6 +159,7 @@ ObjectDefineProperties(Navigator.prototype, {
 
 module.exports = {
   getNavigatorPlatform,
+  kInitialize,
   navigator: new Navigator(kInitialize),
   Navigator,
 };
diff --git a/lib/internal/net.js b/lib/internal/net.js
index cea3dda23d61..2553449f0505 100644
--- a/lib/internal/net.js
+++ b/lib/internal/net.js
@@ -94,7 +94,9 @@ function isLoopback(host) {
     hostLower === 'localhost' ||
     hostLower.startsWith('127.') ||
     hostLower === '[::1]' ||
-    hostLower === '[0:0:0:0:0:0:0:1]'
+    hostLower === '::1' ||
+    hostLower === '[0:0:0:0:0:0:0:1]' ||
+    hostLower === '0:0:0:0:0:0:0:1'
   );
 }
 
diff --git a/lib/internal/per_context/primordials.js b/lib/internal/per_context/primordials.js
index 49576c2d9497..2e610f4ab508 100644
--- a/lib/internal/per_context/primordials.js
+++ b/lib/internal/per_context/primordials.js
@@ -196,6 +196,7 @@ function copyPrototype(src, dest, prefix) {
   'Error',
   'EvalError',
   'FinalizationRegistry',
+  'Float16Array',
   'Float32Array',
   'Float64Array',
   'Function',
diff --git a/lib/internal/perf/resource_timing.js b/lib/internal/perf/resource_timing.js
index f8459efa48e3..6b8f0d2aa524 100644
--- a/lib/internal/perf/resource_timing.js
+++ b/lib/internal/perf/resource_timing.js
@@ -17,6 +17,7 @@ const { enqueue, bufferResourceTiming } = require('internal/perf/observe');
 const { validateThisInternalField } = require('internal/validators');
 const { kEnumerableProperty } = require('internal/util');
 
+const kBodyInfo = Symbol('kBodyInfo');
 const kCacheMode = Symbol('kCacheMode');
 const kRequestedUrl = Symbol('kRequestedUrl');
 const kTimingInfo = Symbol('kTimingInfo');
@@ -110,11 +111,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kTimingInfo].finalNetworkRequestStartTime;
   }
 
-  get responseStart() {
+  get finalResponseHeadersStart() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].finalNetworkResponseStartTime;
   }
 
+  get firstInterimResponseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ?? 0;
+  }
+
+  get responseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ||
+      this[kTimingInfo].finalNetworkResponseStartTime;
+  }
+
   get responseEnd() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].endTime;
@@ -148,6 +160,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kResponseStatus];
   }
 
+  get renderBlockingStatus() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].renderBlocking === true ?
+      'blocking' : 'non-blocking';
+  }
+
+  get contentType() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentType ?? '';
+  }
+
+  get contentEncoding() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentEncoding ?? '';
+  }
+
   toJSON() {
     validateThisInternalField(this, kInitiatorType, 'PerformanceResourceTiming');
     return {
@@ -167,6 +195,8 @@ class PerformanceResourceTiming extends PerformanceEntry {
       connectEnd: this.connectEnd,
       secureConnectionStart: this.secureConnectionStart,
       requestStart: this.requestStart,
+      finalResponseHeadersStart: this.finalResponseHeadersStart,
+      firstInterimResponseStart: this.firstInterimResponseStart,
       responseStart: this.responseStart,
       responseEnd: this.responseEnd,
       transferSize: this.transferSize,
@@ -174,6 +204,9 @@ class PerformanceResourceTiming extends PerformanceEntry {
       decodedBodySize: this.decodedBodySize,
       deliveryType: this.deliveryType,
       responseStatus: this.responseStatus,
+      renderBlockingStatus: this.renderBlockingStatus,
+      contentType: this.contentType,
+      contentEncoding: this.contentEncoding,
     };
   }
 }
@@ -191,6 +224,8 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   connectEnd: kEnumerableProperty,
   secureConnectionStart: kEnumerableProperty,
   requestStart: kEnumerableProperty,
+  finalResponseHeadersStart: kEnumerableProperty,
+  firstInterimResponseStart: kEnumerableProperty,
   responseStart: kEnumerableProperty,
   responseEnd: kEnumerableProperty,
   transferSize: kEnumerableProperty,
@@ -198,6 +233,9 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   decodedBodySize: kEnumerableProperty,
   deliveryType: kEnumerableProperty,
   responseStatus: kEnumerableProperty,
+  renderBlockingStatus: kEnumerableProperty,
+  contentType: kEnumerableProperty,
+  contentEncoding: kEnumerableProperty,
   toJSON: kEnumerableProperty,
   [SymbolToStringTag]: {
     __proto__: null,
@@ -224,6 +262,7 @@ function createPerformanceResourceTiming(
   // The spec doesn't say to validate it in the class construction.
   resourceTiming[kTimingInfo] = timingInfo;
   resourceTiming[kCacheMode] = cacheMode;
+  resourceTiming[kBodyInfo] = bodyInfo;
   resourceTiming[kDeliveryType] = deliveryType;
   resourceTiming[kResponseStatus] = responseStatus;
 
diff --git a/lib/internal/process/per_thread.js b/lib/internal/process/per_thread.js
index 86a5e8080974..6f43502a0c6c 100644
--- a/lib/internal/process/per_thread.js
+++ b/lib/internal/process/per_thread.js
@@ -392,6 +392,9 @@ function buildAllowedFlags() {
 
   const allowedNodeEnvironmentFlags = [];
   for (const { 0: name, 1: info } of options) {
+    // Bracketed options are internal parser targets. They can be allowed in
+    // NODE_OPTIONS so aliases expand to them, but are not public flags.
+    if (name[0] === '[') continue;
     if (info.envVarSettings === kAllowedInEnvvar) {
       ArrayPrototypePush(allowedNodeEnvironmentFlags, name);
       if (info.type === kBoolean) {
diff --git a/lib/internal/process/permission.js b/lib/internal/process/permission.js
index 8dd92b1709b2..acfbab036bbb 100644
--- a/lib/internal/process/permission.js
+++ b/lib/internal/process/permission.js
@@ -3,17 +3,44 @@
 const {
   ArrayPrototypePush,
   ObjectFreeze,
+  StringPrototypeStartsWith,
 } = primordials;
 
 const permission = internalBinding('permission');
-const { validateString, validateBuffer } = require('internal/validators');
-const { Buffer } = require('buffer');
-const { isBuffer } = Buffer;
+const { validateString } = require('internal/validators');
+const { isUint8Array } = require('internal/util/types');
+const { isURL, fileURLToPath } = require('internal/url');
 
 let _permission;
 let _audit;
 let _ffi;
 
+function normalizeReference(scope, reference, name) {
+  if (reference == null) {
+    return reference;
+  }
+
+  if (isURL(reference)) {
+    // Reference is only meaningful for fs.* scopes (FSPermission does
+    // per-path checks); every other scope ignores it (BooleanPermission),
+    // so only fs.* scopes require a file: URL.
+    if (StringPrototypeStartsWith(scope, 'fs')) {
+      return fileURLToPath(reference);
+    }
+    return reference.href;
+  }
+
+  if (isUint8Array(reference)) {
+    // Passed through as-is: the native binding copies the raw bytes
+    // directly instead of forcing a (potentially lossy) UTF-8 string
+    // conversion, since paths are not guaranteed to be valid UTF-8.
+    return reference;
+  }
+
+  validateString(reference, name);
+  return reference;
+}
+
 module.exports = ObjectFreeze({
   __proto__: null,
   isEnabled() {
@@ -32,28 +59,11 @@ module.exports = ObjectFreeze({
   },
   has(scope, reference) {
     validateString(scope, 'scope');
-    if (reference != null) {
-      // TODO: add support for WHATWG URLs and Uint8Arrays.
-      if (isBuffer(reference)) {
-        validateBuffer(reference, 'reference');
-      } else {
-        validateString(reference, 'reference');
-      }
-    }
-
-    return permission.has(scope, reference);
+    return permission.has(scope, normalizeReference(scope, reference, 'reference'));
   },
   drop(scope, reference) {
     validateString(scope, 'scope');
-    if (reference != null) {
-      if (isBuffer(reference)) {
-        validateBuffer(reference, 'reference');
-      } else {
-        validateString(reference, 'reference');
-      }
-    }
-
-    permission.drop(scope, reference);
+    permission.drop(scope, normalizeReference(scope, reference, 'reference'));
   },
   availableFlags() {
     if (_ffi === undefined) {
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index 59c63d59ed64..74bf41ed4262 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -117,9 +117,11 @@ function prepareExecution(options) {
   setupFFI();
   setupSQLite();
   setupStreamIter();
+  setupDTLS();
   setupVfs();
   setupQuic();
   setupWebStorage();
+  removeWebWorkersIfDisabled();
   setupWebsocket();
   setupEventsource();
   setupCodeCoverage();
@@ -127,7 +129,7 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
-  setupDiagnosticsChannel();
+  setupDiagnosticsChannel(isMainThread);
 
   // Load permission system API
   initializePermission();
@@ -162,14 +164,12 @@ function prepareExecution(options) {
     // channel. This needs to be done before any user code gets executed
     // (including preload modules).
     initializeClusterIPC();
-
-    // TODO(joyeecheung): do this for worker threads as well.
-    runDeserializeCallbacks();
   } else {
     assert(!internalBinding('worker').isMainThread);
     // The setup should be called in LOAD_SCRIPT message handler.
     assert(!initializeModules);
   }
+  runDeserializeCallbacks();
 
   const { initializeExtensionFormatMap } = require('internal/modules/esm/get_format');
   initializeExtensionFormatMap();
@@ -364,6 +364,13 @@ function setupWebsocket() {
   }
 }
 
+// https://html.spec.whatwg.org/multipage/workers.html
+function removeWebWorkersIfDisabled() {
+  if (!getOptionValue('--experimental-web-worker')) {
+    delete globalThis.Worker;
+  }
+}
+
 // https://html.spec.whatwg.org/multipage/server-sent-events.html
 function setupEventsource() {
   if (!getOptionValue('--experimental-eventsource')) {
@@ -418,6 +425,15 @@ function setupStreamIter() {
   BuiltinModule.allowRequireByUsers('zlib/iter');
 }
 
+function setupDTLS() {
+  if (!getOptionValue('--experimental-dtls')) {
+    return;
+  }
+
+  const { BuiltinModule } = require('internal/bootstrap/realm');
+  BuiltinModule.allowRequireByUsers('dtls');
+}
+
 function setupQuic() {
   if (!getOptionValue('--experimental-quic')) {
     return;
@@ -659,7 +675,7 @@ function initializeClusterIPC() {
   }
 }
 
-function setupDiagnosticsChannel() {
+function setupDiagnosticsChannel(isMainThread) {
   // Re-link native channels after snapshot deserialization since
   // JS references are cleared during serialization.
   // Keep this callback in sync with the initial registration in
@@ -674,6 +690,11 @@ function setupDiagnosticsChannel() {
       (channel._stores?.size || 0);
     return channel;
   });
+  if (isMainThread &&
+      process.versions.openssl !== undefined &&
+      getOptionValue('--enable-fips-indicator-events')) {
+    internalBinding('crypto').setupFipsIndicatorChannel();
+  }
 }
 
 function initializePermission() {
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 11152f070add..8ecd5fc776a3 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -138,8 +138,9 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
-  toUint8Array,
   convertChunks,
+  getWriterSignal,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -164,7 +165,6 @@ const {
 } = require('internal/fs/promises');
 
 const {
-  validateAbortSignal,
   validateBoolean,
   validateFunction,
   validateInteger,
@@ -2197,7 +2197,7 @@ class QuicStream {
     // signals backpressure additional writes are rejected until the buffer has
     // capacity again.
 
-    function writeSync(chunk) {
+    function writeConvertedSync(chunk) {
       // If the stream is closed, errored, or write-ended, we cannot accept
       // more data. Refuse the sync write.
       // If a drain is already pending, another operation is waiting
@@ -2205,7 +2205,6 @@ class QuicStream {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunk = toUint8Array(chunk);
       const len = TypedArrayPrototypeGetByteLength(chunk);
       if (len === 0) return true;
       // Refuse the write only when there is no available capacity at
@@ -2223,13 +2222,18 @@ class QuicStream {
       return true;
     }
 
-    async function write(chunk, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writeSync(chunk) {
+      return writeConvertedSync(toWriterUint8Array(chunk));
+    }
+
+    function write(chunk, options = kEmptyObject) {
+      chunk = toWriterUint8Array(chunk);
+      const signal = getWriterSignal(options);
+      return writeAsync(chunk, signal);
+    }
+
+    async function writeAsync(chunk, signal) {
+      signal?.throwIfAborted();
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
@@ -2242,16 +2246,15 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writeSync(chunk)) {
+      if (!writeConvertedSync(chunk)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
 
-    function writevSync(chunks) {
+    function writevConvertedSync(chunks) {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunks = convertChunks(chunks);
       let len = 0;
       for (const c of chunks) len += TypedArrayPrototypeGetByteLength(c);
       if (len === 0) return true;
@@ -2262,13 +2265,18 @@ class QuicStream {
       return true;
     }
 
-    async function writev(chunks, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writevSync(chunks) {
+      return writevConvertedSync(convertChunks(chunks));
+    }
+
+    function writev(chunks, options = kEmptyObject) {
+      chunks = convertChunks(chunks);
+      const signal = getWriterSignal(options);
+      return writevAsync(chunks, signal);
+    }
+
+    async function writevAsync(chunks, signal) {
+      signal?.throwIfAborted();
 
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
@@ -2283,7 +2291,7 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writevSync(chunks)) {
+      if (!writevConvertedSync(chunks)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
@@ -2308,11 +2316,13 @@ class QuicStream {
       return totalBytesWritten;
     }
 
-    async function end(options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
+    function end(options = kEmptyObject) {
+      const signal = getWriterSignal(options);
+      return endAsync(signal);
+    }
+
+    async function endAsync(signal) {
       if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
         signal.throwIfAborted();
         // TODO(@jasnell): The stream/iter spec allows individual sync end
         // calls to be canceled via an AbortSignal. We currently do not support
@@ -5144,6 +5154,12 @@ function processTlsOptions(tls, forServer) {
     if (!forServer) {
       validateString(alpn, 'options.alpn');
     }
+    // QUIC has no default application protocol: a server that offers none
+    // cannot complete a handshake with anyone.
+    if (protocols.length === 0) {
+      throw new ERR_INVALID_ARG_VALUE('options.alpn', alpn,
+                                      'must offer at least one protocol');
+    }
     let totalLen = 0;
     for (let i = 0; i < protocols.length; i++) {
       validateString(protocols[i], `options.alpn[${i}]`);
diff --git a/lib/internal/source_map/source_map_cache.js b/lib/internal/source_map/source_map_cache.js
index 95b09090c473..e1fa55c5caba 100644
--- a/lib/internal/source_map/source_map_cache.js
+++ b/lib/internal/source_map/source_map_cache.js
@@ -9,6 +9,7 @@ const {
   RegExpPrototypeSymbolSplit,
   SafeMap,
   StringPrototypeCodePointAt,
+  StringPrototypeIndexOf,
   StringPrototypeSplit,
   StringPrototypeStartsWith,
 } = primordials;
@@ -176,16 +177,14 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   // Normalize the sourceURL to a file URL if it is a path.
   sourceURL = normalizeReferrerURL(sourceURL);
 
-  const data = dataFromUrl(filename, sourceMapURL);
-  // `data` could be null if the source map is invalid.
-  // In this case, create a cache entry with null data with source url for test coverage.
-
+  // The payload is resolved on first use (see sourceMapData()), except under
+  // coverage, where it is serialized at exit when no more JS may run.
   const entry = {
     __proto__: null,
     lineLengths: lineLengths(content),
-    data,
-    // Save the source map url if it is not a data url.
-    sourceMapURL: data ? null : sourceMapURL,
+    data: process.env.NODE_V8_COVERAGE ? dataFromUrl(filename, sourceMapURL) : undefined,
+    filename,
+    sourceMapURL,
     sourceURL,
   };
 
@@ -254,20 +253,36 @@ function dataFromUrl(sourceURL, sourceMappingURL) {
   return sourceMapFromFile(mapURL);
 }
 
+const kUnicodeLineTerminators = /[\u2028\u2029]/;
+
 // Cache the length of each line in the file that a source map was extracted
 // from. This allows translation from byte offset V8 coverage reports,
 // to line/column offset Source Map V3.
 function lineLengths(content) {
+  if (RegExpPrototypeExec(kUnicodeLineTerminators, content) !== null) {
+    return lineLengthsWithUnicodeTerminators(content);
+  }
+  // We purposefully keep \r as part of the line-length calculation, in
+  // cases where there is a \r\n separator, so that this can be taken into
+  // account in coverage calculations.
+  const output = [];
+  let lineStart = 0;
+  let lineEnd;
+  while ((lineEnd = StringPrototypeIndexOf(content, '\n', lineStart)) !== -1) {
+    ArrayPrototypePush(output, lineEnd - lineStart);
+    lineStart = lineEnd + 1;
+  }
+  ArrayPrototypePush(output, content.length - lineStart);
+  return output;
+}
+
+function lineLengthsWithUnicodeTerminators(content) {
   const contentLength = content.length;
   const output = [];
   let lineLength = 0;
   for (let i = 0; i < contentLength; i++, lineLength++) {
     const codePoint = StringPrototypeCodePointAt(content, i);
-
-    // We purposefully keep \r as part of the line-length calculation, in
-    // cases where there is a \r\n separator, so that this can be taken into
-    // account in coverage calculations.
-    // codepoints for \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
+    // \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
     if (codePoint === 10 || codePoint === 0x2028 || codePoint === 0x2029) {
       ArrayPrototypePush(output, lineLength);
       lineLength = -1; // To not count the matched codePoint such as \n character
@@ -351,16 +366,31 @@ function sourceMapCacheToObject() {
 
   const obj = { __proto__: null };
   for (const { 0: k, 1: v } of moduleSourceMapCache) {
+    const data = v.data ?? null;
     obj[k] = {
       __proto__: null,
       lineLengths: v.lineLengths,
-      data: v.data,
-      url: v.sourceMapURL,
+      data,
+      // Save the source map url if it is not a data url.
+      url: data ? null : v.sourceMapURL,
     };
   }
   return obj;
 }
 
+/**
+ * Resolve and parse the payload of a cache entry the first time it is needed;
+ * `null` marks a source map that could not be loaded.
+ * @param {object} entry
+ * @returns {object|null}
+ */
+function sourceMapData(entry) {
+  if (entry.data === undefined) {
+    entry.data = dataFromUrl(entry.filename, entry.sourceMapURL);
+  }
+  return entry.data;
+}
+
 /**
  * Find a source map for a given actual source URL or path.
  *
@@ -390,7 +420,7 @@ function findSourceMap(sourceURL) {
       sourceURL = pathToFileURL(sourceURL).href;
     }
     const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
-    if (entry?.data == null) {
+    if (entry === undefined || sourceMapData(entry) === null) {
       return undefined;
     }
 
diff --git a/lib/internal/streams/fast-utf8-stream.js b/lib/internal/streams/fast-utf8-stream.js
index 51d80bbe5e74..8a1b6185e828 100644
--- a/lib/internal/streams/fast-utf8-stream.js
+++ b/lib/internal/streams/fast-utf8-stream.js
@@ -500,7 +500,9 @@ class Utf8Stream extends EventEmitter {
       // start
       if ((!this.#writing && this.#len > this.#minLength) || this.#flushPending) {
         this.#actualWrite();
-      } else if (reopening) {
+      } else if (reopening && !this.#writing) {
+        // Do not emit 'drain' if a 'ready' listener started a write:
+        // #release() will emit the real 'drain' when that write completes.
         process.nextTick(() => this.emit('drain'));
       }
     };
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0674d4d57037..16cb4c06533c 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -21,7 +21,6 @@ const {
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const { lazyDOMException } = require('internal/util');
@@ -34,10 +33,7 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 const {
@@ -52,22 +48,26 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   kMultiConsumerDefaultBudget,
   kResolvedPromise,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
   parsePullArgs,
   wrapError,
-  toUint8Array,
-  validateBackpressure,
+  toWriterUint8Array,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -134,9 +134,13 @@ class BroadcastImpl {
   }
 
   push(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -157,12 +161,7 @@ class BroadcastImpl {
     // When no transforms, return rawConsumer directly (controller elided
     // per PULL-02 optimization -- no transforms means no signal recipient).
     if (transforms.length > 0 || signal) {
-      const pullArgs = [...transforms];
-      if (signal) {
-        ArrayPrototypePush(pullArgs,
-                           { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...pullArgs);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -220,7 +219,8 @@ class BroadcastImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
+              if (chunk === null) return PromiseReject(self.#error);
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -309,10 +309,11 @@ class BroadcastImpl {
 
   // Methods accessed by BroadcastWriter via symbol keys
 
-  [kWrite](chunk) {
+  [kWrite](entry) {
     if (this.#ended || this.#cancelled) return false;
 
-    const batchSize = this.#batchByteSize(chunk);
+    const batchSize = entry.byteLength;
+    let droppedOldest = false;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -324,10 +325,11 @@ class BroadcastImpl {
         case 'unbounded':
           return false;
         case 'drop-oldest':
+          droppedOldest = true;
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -343,9 +345,13 @@ class BroadcastImpl {
       }
     }
 
-    this.#buffer.push(chunk);
+    this.#buffer.push(entry);
     this.#bufferedBytes += batchSize;
     this.#notifyConsumers();
+    if (droppedOldest &&
+        this.#bufferedBytes < this.#options.budget) {
+      this[kOnBufferDrained]?.();
+    }
     return true;
   }
 
@@ -357,7 +363,8 @@ class BroadcastImpl {
       while (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -401,15 +408,13 @@ class BroadcastImpl {
   }
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if ended/cancelled, true/false otherwise.
    * @returns {boolean | null}
    */
   [kCanWrite]() {
     if (this.#ended || this.#cancelled) return null;
-    if ((this.#options.backpressure === 'strict' ||
-        this.#options.backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#options.budget) {
+    if (this.#bufferedBytes >= this.#options.budget) {
       return false;
     }
     return true;
@@ -438,7 +443,7 @@ class BroadcastImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -450,12 +455,16 @@ class BroadcastImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.#writer.fail(error);
+      if (this.#error === undefined) this[kAbort](error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      return null;
     }
-    return size;
   }
 
   #notifyConsumers() {
@@ -469,7 +478,8 @@ class BroadcastImpl {
       if (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -588,33 +598,34 @@ class BroadcastWriter {
   }
 
   write(chunk, options) {
+    const converted = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = toUint8Array(chunk);
-      this.#broadcast[kWrite]([converted]);
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+      const batch = createBatchEntry([converted]);
+      this.#broadcast[kWrite](batch);
+      this.#totalBytes += batch.byteLength;
       return kResolvedPromise;
     }
-    return this.#writevSlow([chunk], signal);
+    return this.#writeBatchSlow(createBatchEntry([converted]), signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const converted = convertChunks(chunks);
     const signal = getWriterSignal(options);
+    const batch = createBatchEntry(converted);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = convertChunks(chunks);
-      this.#broadcast[kWrite](converted);
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
+      if (this.#state === 'open' && this.#broadcast[kWrite](batch)) {
+        this.#totalBytes += batch.byteLength;
+        return kResolvedPromise;
       }
-      return kResolvedPromise;
+      return this.#writeBatchSlow(batch, signal);
     }
-    return this.#writevSlow(chunks, signal);
+    return this.#writeBatchSlow(batch, signal);
   }
 
-  async #writevSlow(chunks, signal) {
+  async #writeBatchSlow(batch, signal) {
     if (this.#state === 'errored') {
       throw this.#error;
     }
@@ -624,12 +635,8 @@ class BroadcastWriter {
 
     signal?.throwIfAborted();
 
-    const converted = convertChunks(chunks);
-
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return;
     }
 
@@ -641,34 +648,30 @@ class BroadcastWriter {
           'Backpressure violation: too many pending writes. ' +
           'Await each write() call to respect backpressure.');
       }
-      return this.#createPendingWrite(converted, signal);
+      return this.#createPendingWrite(batch, signal);
     }
 
     // 'unbounded' policy
-    return this.#createPendingWrite(converted, signal);
+    return this.#createPendingWrite(batch, signal);
   }
 
   writeSync(chunk) {
+    const converted = toWriterUint8Array(chunk);
     if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
-    const converted =
-      toUint8Array(chunk);
-    if (this.#broadcast[kWrite]([converted])) {
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+    const batch = createBatchEntry([converted]);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
-    if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#state !== 'open') return false;
+    const batch = createBatchEntry(converted);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
@@ -757,9 +760,9 @@ class BroadcastWriter {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunk, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunk, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
     if (signal) {
       wireBroadcastWriteSignal(entry, signal, resolve, reject, this);
@@ -770,14 +773,17 @@ class BroadcastWriter {
   #resolvePendingWrites() {
     while (this.#pendingWrites.length > 0 && this.#broadcast[kCanWrite]()) {
       const pending = this.#pendingWrites.shift();
-      if (this.#broadcast[kWrite](pending.chunk)) {
-        for (let i = 0; i < pending.chunk.length; i++) {
-          this.#totalBytes += TypedArrayPrototypeGetByteLength(pending.chunk[i]);
+      try {
+        validateBatchEntry(pending.batch);
+        if (this.#broadcast[kWrite](pending.batch)) {
+          this.#totalBytes += pending.batch.byteLength;
+          pending.resolve();
+        } else {
+          this.#pendingWrites.unshift(pending);
+          break;
         }
-        pending.resolve();
-      } else {
-        this.#pendingWrites.unshift(pending);
-        break;
+      } catch (error) {
+        pending.reject(error);
       }
     }
     this.#finishEndIfReady();
@@ -811,18 +817,18 @@ function wireBroadcastWriteSignal(entry, signal, resolve, reject, self) {
     const pendingWrites = getBroadcastPendingWrites(self);
     const idx = pendingWrites.indexOf(entry);
     if (idx !== -1) pendingWrites.removeAt(idx);
-    entry.chunk = null;
+    entry.batch = null;
     reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
     if (idx !== -1) self[kPendingWriteRemoved]();
   };
   entry.resolve = function() {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     resolve();
   };
   entry.reject = function(reason) {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     reject(reason);
   };
   signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
@@ -842,17 +848,16 @@ function onBroadcastCancel(broadcastImpl, signal) {
  * @returns {{ writer: Writer, broadcast: Broadcast }}
  */
 function broadcast(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.BroadcastOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -895,8 +900,12 @@ const Broadcast = {
         'input', ['Broadcastable', 'AsyncIterable', 'Iterable'], input);
     }
 
+    options = converters.BroadcastOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const result = broadcast(options);
-    const signal = options?.signal;
+    const { signal } = options;
 
     const pump = async () => {
       const w = result.writer;
diff --git a/lib/internal/streams/iter/classic.js b/lib/internal/streams/iter/classic.js
index 0769348a3981..28f6079e6fe2 100644
--- a/lib/internal/streams/iter/classic.js
+++ b/lib/internal/streams/iter/classic.js
@@ -40,7 +40,6 @@ const {
 } = require('internal/errors');
 
 const {
-  validateArray,
   validateInteger,
   validateObject,
 } = require('internal/validators');
@@ -60,9 +59,10 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
+  convertChunks,
   getWriterSignal,
   validateBackpressure,
-  toUint8Array,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const { Buffer } = require('buffer');
@@ -538,7 +538,7 @@ function fromWritable(writable, options = kNullPrototype) {
   function writeChunks(chunks) {
     let ok = true;
     for (let i = 0; i < chunks.length; i++) {
-      const bytes = toUint8Array(chunks[i]);
+      const bytes = chunks[i];
       totalBytes += TypedArrayPrototypeGetByteLength(bytes);
       ok = writable.write(bytes);
     }
@@ -554,10 +554,12 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writeSync(chunk) {
+      toWriterUint8Array(chunk);
       return false;
     },
 
     writevSync(chunks) {
+      convertChunks(chunks);
       return false;
     },
 
@@ -576,18 +578,12 @@ function fromWritable(writable, options = kNullPrototype) {
     // otherwise ignored. Classic stream.Writable has no per-write abort signal
     // support; cancellation should be handled at the pipeline level instead.
     write(chunk, options) {
+      const bytes = toWriterUint8Array(chunk);
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
 
-      let bytes;
-      try {
-        bytes = toUint8Array(chunk);
-      } catch (err) {
-        return PromiseReject(err);
-      }
-
       if (backpressure === 'strict' && isFull()) {
         return PromiseReject(new ERR_INVALID_STATE.RangeError(
           'Backpressure violation: buffer is full. ' +
@@ -619,7 +615,7 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writev(chunks, options) {
-      validateArray(chunks, 'chunks');
+      chunks = convertChunks(chunks);
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
@@ -634,8 +630,7 @@ function fromWritable(writable, options = kNullPrototype) {
       if (backpressure === 'drop-newest' && isFull()) {
         // Discard entire batch.
         for (let i = 0; i < chunks.length; i++) {
-          totalBytes +=
-            TypedArrayPrototypeGetByteLength(toUint8Array(chunks[i]));
+          totalBytes += TypedArrayPrototypeGetByteLength(chunks[i]);
         }
         return PromiseResolve();
       }
diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index e3bd7856dcd4..75ad4026ad7c 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -18,6 +18,8 @@ const {
   Promise,
   PromisePrototypeThen,
   SafePromiseAllReturnVoid,
+  SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -34,11 +36,7 @@ const {
 } = require('internal/errors');
 const { TextDecoder } = require('internal/encoding');
 const {
-  validateAbortSignal,
   validateFunction,
-  validateInteger,
-  validateObject,
-  validateString,
 } = require('internal/validators');
 
 const {
@@ -54,6 +52,8 @@ const {
 
 const {
   concatBytes,
+  createBatchEntry,
+  validateBatchEntry,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
 
@@ -62,6 +62,9 @@ const {
   toAsyncStreamable,
   toStreamable,
 } = require('internal/streams/iter/types');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   isAnyArrayBuffer,
@@ -89,6 +92,17 @@ function isMergeOptions(value) {
 // Shared chunk collection helpers
 // =============================================================================
 
+function flattenBatchEntries(entries) {
+  const chunks = [];
+  for (let i = 0; i < entries.length; i++) {
+    const batch = validateBatchEntry(entries[i]);
+    for (let j = 0; j < batch.length; j++) {
+      ArrayPrototypePush(chunks, batch[j]);
+    }
+  }
+  return chunks;
+}
+
 /**
  * Collect chunks from a sync source into an array.
  * @param {Iterable<Uint8Array[]>} source
@@ -98,23 +112,23 @@ function isMergeOptions(value) {
 function collectSync(source, limit) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  const chunks = [];
+  const entries = [];
   let totalBytes = 0;
 
   for (const batch of normalized) {
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -128,19 +142,15 @@ async function collectAsync(source, signal, limit) {
   signal?.throwIfAborted();
 
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
-  const abortableSource = signal && isAsyncIterable(source) ?
-    yieldAbortable(source, signal) : source;
-  const normalized = from(abortableSource);
-  const chunks = [];
+  const normalized = from(source);
+  const entries = [];
 
   // Fast path: no signal and no limit
   if (!signal && limit === undefined) {
     for await (const batch of normalized) {
-      for (let i = 0; i < batch.length; i++) {
-        ArrayPrototypePush(chunks, batch[i]);
-      }
+      ArrayPrototypePush(entries, createBatchEntry(batch));
     }
-    return chunks;
+    return flattenBatchEntries(entries);
   }
 
   // Slow path: with signal or limit checks
@@ -149,19 +159,19 @@ async function collectAsync(source, signal, limit) {
 
   for await (const batch of iterable) {
     signal?.throwIfAborted();
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -186,37 +196,6 @@ function toArrayBuffer(data) {
                                    byteOffset + byteLength);
 }
 
-// =============================================================================
-// Shared option validation
-// =============================================================================
-
-function validateBaseConsumerOptions(options) {
-  validateObject(options, 'options');
-  if (options.limit !== undefined) {
-    validateInteger(options.limit, 'options.limit', 0);
-  }
-  if (options.encoding !== undefined) {
-    validateString(options.encoding, 'options.encoding');
-    try {
-      new TextDecoder(options.encoding);
-    } catch {
-      throw new ERR_INVALID_ARG_VALUE.RangeError(
-        'options.encoding', options.encoding);
-    }
-  }
-}
-
-function validateConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-  if (options.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
-}
-
-function validateSyncConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-}
-
 // =============================================================================
 // Sync Consumers
 // =============================================================================
@@ -230,7 +209,10 @@ const kNullPrototype = { __proto__: null };
  * @returns {Uint8Array}
  */
 function bytesSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return concatBytes(collectSync(source, options.limit));
 }
 
@@ -241,9 +223,18 @@ function bytesSync(source, options = kNullPrototype) {
  * @returns {string}
  */
 function textSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.TextConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const data = concatBytes(collectSync(source, options.limit));
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -257,7 +248,10 @@ function textSync(source, options = kNullPrototype) {
  * @returns {ArrayBuffer}
  */
 function arrayBufferSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return toArrayBuffer(concatBytes(collectSync(source, options.limit)));
 }
 
@@ -268,7 +262,10 @@ function arrayBufferSync(source, options = kNullPrototype) {
  * @returns {Uint8Array[]}
  */
 function arraySync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectSync(source, options.limit);
 }
 
@@ -283,7 +280,10 @@ function arraySync(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array>}
  */
 async function bytes(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return concatBytes(chunks);
 }
@@ -295,10 +295,19 @@ async function bytes(source, options = kNullPrototype) {
  * @returns {Promise<string>}
  */
 async function text(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.TextConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const chunks = await collectAsync(source, options.signal, options.limit);
   const data = concatBytes(chunks);
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -312,7 +321,10 @@ async function text(source, options = kNullPrototype) {
  * @returns {Promise<ArrayBuffer>}
  */
 async function arrayBuffer(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return toArrayBuffer(concatBytes(chunks));
 }
@@ -324,7 +336,10 @@ async function arrayBuffer(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array[]>}
  */
 async function array(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectAsync(source, options.signal, options.limit);
 }
 
@@ -390,6 +405,8 @@ function ondrain(drainable) {
 // Merge Utility
 // =============================================================================
 
+const kNoMergeError = Symbol('kNoMergeError');
+
 /**
  * Merge multiple async iterables by yielding values in temporal order.
  * @param {...(AsyncIterable<Uint8Array[]>|object)} args
@@ -406,9 +423,10 @@ function merge(...args) {
     sources = args;
   }
 
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  options = converters.MergeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
 
   // Normalize each source via from()
   const normalized = ArrayPrototypeMap(sources, (source) => from(source));
@@ -416,7 +434,7 @@ function merge(...args) {
   return {
     __proto__: null,
     async *[SymbolAsyncIterator]() {
-      const signal = options?.signal;
+      const { signal } = options;
 
       signal?.throwIfAborted();
 
@@ -437,9 +455,11 @@ function merge(...args) {
       // async tick per batch. Each source has at most one pending .next()
       // at a time. Every batch from every source is preserved.
       const ready = [];
+      const pendingPulls = new SafeSet();
       let activeCount = normalized.length;
       let waitResolve = null;
       let onAbort;
+      let stopped = false;
 
       if (signal) {
         onAbort = () => {
@@ -457,11 +477,14 @@ function merge(...args) {
       // Called when a source's .next() settles. Pushes the result into
       // the ready queue and wakes the consumer if it's waiting.
       const onSettled = (iterator, result) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
         if (result.done) {
           activeCount--;
         } else {
           ArrayPrototypePush(ready, {
             __proto__: null,
+            kind: 'value',
             iterator,
             value: result.value,
           });
@@ -472,25 +495,34 @@ function merge(...args) {
         }
       };
 
+      const onRejected = (iterator, reason) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
+        ArrayPrototypePush(ready, {
+          __proto__: null,
+          kind: 'error',
+          reason,
+        });
+        if (waitResolve) {
+          waitResolve();
+          waitResolve = null;
+        }
+      };
+
       // Start one .next() per source
       const iterators = [];
       for (let i = 0; i < normalized.length; i++) {
         const iterator = normalized[i][SymbolAsyncIterator]();
         ArrayPrototypePush(iterators, iterator);
+        pendingPulls.add(iterator);
         PromisePrototypeThen(
           iterator.next(),
           (r) => onSettled(iterator, r),
-          (err) => {
-            ArrayPrototypePush(ready, { __proto__: null, error: err });
-            if (waitResolve) {
-              waitResolve();
-              waitResolve = null;
-            }
-          },
+          (reason) => onRejected(iterator, reason),
         );
       }
 
-      let primaryError;
+      let primaryError = kNoMergeError;
       try {
         while (activeCount > 0 || ready.length > 0) {
           signal?.throwIfAborted();
@@ -498,20 +530,15 @@ function merge(...args) {
           // Drain ready queue synchronously
           while (ready.length > 0) {
             const item = ArrayPrototypeShift(ready);
-            if (item?.error) {
-              throw item.error;
+            if (item.kind === 'error') {
+              throw item.reason;
             }
             yield item.value;
+            pendingPulls.add(item.iterator);
             PromisePrototypeThen(
               item.iterator.next(),
               (r) => onSettled(item.iterator, r),
-              (err) => {
-                ArrayPrototypePush(ready, { __proto__: null, error: err });
-                if (waitResolve) {
-                  waitResolve();
-                  waitResolve = null;
-                }
-              },
+              (reason) => onRejected(item.iterator, reason),
             );
           }
 
@@ -529,6 +556,7 @@ function merge(...args) {
       } catch (err) {
         primaryError = err;
       } finally {
+        stopped = true;
         if (onAbort !== undefined) {
           signal.removeEventListener('abort', onAbort);
         }
@@ -538,32 +566,32 @@ function merge(...args) {
         await cleanupIterators(
           iterators,
           primaryError,
-          signal?.aborted && primaryError === signal.reason,
+          pendingPulls,
         );
       }
     },
   };
 }
 
-async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
-  let cleanupError;
+async function cleanupIterators(iterators, primaryError, pendingPulls) {
+  let cleanupError = kNoMergeError;
   await SafePromiseAllReturnVoid(iterators, async (iterator) => {
     if (iterator.return) {
       try {
         const result = iterator.return();
-        if (skipAwaitCleanup) {
+        if (pendingPulls.has(iterator)) {
           markPromiseAsHandled(result);
         } else {
           await result;
         }
       } catch (err) {
         // Keep the first cleanup error encountered.
-        cleanupError ??= err;
+        if (cleanupError === kNoMergeError) cleanupError = err;
       }
     }
   });
-  if (cleanupError !== undefined) {
-    if (primaryError !== undefined) {
+  if (cleanupError !== kNoMergeError) {
+    if (primaryError !== kNoMergeError) {
       // Both a primary error and a cleanup error occurred.
       // Wrap in SuppressedError so neither is lost:
       // .error = primaryError, .suppressed = cleanupError.
@@ -573,7 +601,7 @@ async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
     // No primary error - the cleanup error is the only error.
     throw cleanupError;
   }
-  if (primaryError !== undefined) {
+  if (primaryError !== kNoMergeError) {
     throw primaryError;
   }
 }
diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index b37b91279232..674ef81a53c9 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -6,17 +6,18 @@
 // channel's writer appears in the other channel's readable.
 
 const {
+  SafePromiseAllReturnVoid,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
 } = primordials;
 
 const {
+  isConsumerReturnError,
   push,
 } = require('internal/streams/iter/push');
 const {
-  validateAbortSignal,
-  validateObject,
-} = require('internal/validators');
+  converters,
+} = require('internal/streams/iter/webidl');
 
 /**
  * Create a pair of connected duplex channels for bidirectional communication.
@@ -25,17 +26,11 @@ const {
  * @returns {[DuplexChannel, DuplexChannel]}
  */
 function duplex(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.DuplexOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const { budget, backpressure, signal, a, b } = options;
-  if (a !== undefined) {
-    validateObject(a, 'options.a');
-  }
-  if (b !== undefined) {
-    validateObject(b, 'options.b');
-  }
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   // Channel A writes to B's readable (A->B direction).
   // Signal is NOT passed to push() -- we handle abort via close() below.
@@ -50,68 +45,8 @@ function duplex(options = { __proto__: null }) {
     backpressure: b?.backpressure ?? backpressure,
   });
 
-  let aClosed = false;
-  let bClosed = false;
-  // Track active iterators so close() can call .return() on them
-  let aReadableIterator = null;
-  let bReadableIterator = null;
-
-  const channelA = {
-    __proto__: null,
-    get writer() { return aWriter; },
-    // Wrap readable to track the iterator for cleanup on close()
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = aReadable[SymbolAsyncIterator]();
-          aReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (aClosed) return;
-      aClosed = true;
-      // End the writer (signals end-of-stream to B's readable)
-      aWriter.endSync();
-      // Stop iteration of this channel's readable
-      if (aReadableIterator?.return) {
-        await aReadableIterator.return();
-        aReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
-
-  const channelB = {
-    __proto__: null,
-    get writer() { return bWriter; },
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = bReadable[SymbolAsyncIterator]();
-          bReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (bClosed) return;
-      bClosed = true;
-      bWriter.endSync();
-      if (bReadableIterator?.return) {
-        await bReadableIterator.return();
-        bReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
+  const channelA = createDuplexChannel(aWriter, aReadable);
+  const channelB = createDuplexChannel(bWriter, bReadable);
 
   // Signal handler: fail both writers with the abort reason so consumers
   // see the error. This is an error-path shutdown, not a clean close.
@@ -132,6 +67,42 @@ function duplex(options = { __proto__: null }) {
   return [channelA, channelB];
 }
 
+function createDuplexChannel(writer, readable) {
+  // A push readable has one shared consumer state. Keeping an iterator from
+  // creation lets close() terminate that state even if no caller has iterated.
+  const closeIterator = readable[SymbolAsyncIterator]();
+  let closePromise;
+
+  return {
+    __proto__: null,
+    get writer() { return writer; },
+    get readable() { return readable; },
+    close() {
+      closePromise ??= closeDuplexChannel(writer, closeIterator);
+      return closePromise;
+    },
+    [SymbolAsyncDispose]() {
+      return this.close();
+    },
+  };
+}
+
+async function closeDuplexChannel(writer, closeIterator) {
+  const result = writer.endSync();
+  const endPromise = result < 0 ? writer.end() : undefined;
+  const returnPromise = closeIterator.return();
+
+  if (endPromise !== undefined) {
+    try {
+      await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+    } catch (error) {
+      if (!isConsumerReturnError(error)) throw error;
+    }
+  } else {
+    await returnPromise;
+  }
+}
+
 module.exports = {
   duplex,
 };
diff --git a/lib/internal/streams/iter/from.js b/lib/internal/streams/iter/from.js
index 59ac6a15775b..7fe03511861f 100644
--- a/lib/internal/streams/iter/from.js
+++ b/lib/internal/streams/iter/from.js
@@ -15,6 +15,7 @@ const {
   DataViewPrototypeGetByteLength,
   DataViewPrototypeGetByteOffset,
   FunctionPrototypeCall,
+  PromisePrototypeThen,
   SymbolAsyncIterator,
   SymbolIterator,
   TypedArrayPrototypeGetBuffer,
@@ -23,6 +24,8 @@ const {
   Uint8Array,
 } = primordials;
 
+const { markPromiseAsHandled } = internalBinding('util');
+
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
@@ -360,9 +363,13 @@ async function* normalizeAsyncSource(source) {
         continue;
       }
       // Slow path: normalize the value
-      const batch = [];
+      let batch = [];
       for await (const chunk of normalizeAsyncValue(value)) {
         ArrayPrototypePush(batch, chunk);
+        if (batch.length === FROM_BATCH_SIZE) {
+          yield batch;
+          batch = [];
+        }
       }
       if (batch.length > 0) {
         yield batch;
@@ -594,7 +601,11 @@ function from(input) {
   // Check toAsyncStreamable protocol (takes precedence over toStreamable and
   // iteration protocols)
   if (typeof input[toAsyncStreamable] === 'function') {
-    const result = input[toAsyncStreamable]();
+    let result = input[toAsyncStreamable]();
+    if (isPromise(result)) {
+      result = PromisePrototypeThen(result, undefined, undefined);
+      markPromiseAsHandled(result);
+    }
     // Synchronous validated source (e.g. Readable batched iterator)
     if (result?.[kValidatedSource]) {
       return result;
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index b6c2d9849c42..6b44f5c5e431 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -8,15 +8,13 @@
 
 const {
   ArrayBufferIsView,
-  ArrayFromAsync,
-  ArrayIsArray,
   ArrayPrototypePush,
   ArrayPrototypeSlice,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   SymbolAsyncIterator,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
   Uint8Array,
 } = primordials;
 
@@ -24,17 +22,20 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
     ERR_OUT_OF_RANGE,
   },
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
-const { validateAbortSignal } = require('internal/validators');
 const {
   isAnyArrayBuffer,
   isPromise,
   isUint8Array,
 } = require('internal/util/types');
-const { AbortController } = require('internal/abort_controller');
+const {
+  AbortController,
+  AbortSignal,
+} = require('internal/abort_controller');
 
 const {
   arrayBufferViewToUint8Array,
@@ -42,26 +43,26 @@ const {
   fromSync,
   isSyncIterable,
   isAsyncIterable,
-  isPrimitiveChunk,
   isUint8ArrayBatch,
-  normalizeAsyncValue,
 } = require('internal/streams/iter/from');
 
 const {
-  isPullOptions,
+  createBatchEntry,
   isTransform,
   isTransformObject,
   parsePullArgs,
   toUint8Array,
+  validateBatchEntry,
+  validateByteView,
   wrapError,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
-  kValidatedSource,
   kValidatedTransform,
-  toAsyncStreamable,
-  toStreamable,
 } = require('internal/streams/iter/types');
 
 // =============================================================================
@@ -80,7 +81,7 @@ function hasMethod(value, name) {
  * Parse pipeTo/pipeToSync arguments: [...transforms, writer, options?]
  * @param {Array} args
  * @param {string} requiredMethod - 'write' for pipeTo, 'writeSync' for pipeToSync
- * @returns {{ transforms: Array, writer: object, options: object }}
+ * @returns {{ transforms: Array, writer: object, options: unknown }}
  */
 function parsePipeToArgs(args, requiredMethod) {
   if (args.length === 0) {
@@ -92,7 +93,7 @@ function parsePipeToArgs(args, requiredMethod) {
 
   // Check if last arg is options
   const last = args[args.length - 1];
-  if (isPullOptions(last) && !hasMethod(last, requiredMethod)) {
+  if (!isTransform(last) && !hasMethod(last, requiredMethod)) {
     options = last;
     writerIndex = args.length - 2;
   }
@@ -124,22 +125,6 @@ function parsePipeToArgs(args, requiredMethod) {
   };
 }
 
-function canUseSyncIterablePipeToFastPath(source, transforms, signal) {
-  if (signal !== undefined ||
-      transforms.length !== 0 ||
-      isPrimitiveChunk(source) ||
-      ArrayIsArray(source) ||
-      source?.[kValidatedSource] ||
-      !isSyncIterable(source) ||
-      isAsyncIterable(source)) {
-    return false;
-  }
-
-  // Preserve from()'s top-level protocol precedence for custom iterables.
-  return typeof source[toAsyncStreamable] !== 'function' &&
-    typeof source[toStreamable] !== 'function';
-}
-
 // =============================================================================
 // Transform Output Flattening
 // =============================================================================
@@ -521,8 +506,9 @@ function* withFlushSync(source) {
   yield null;
 }
 
-function* applyStatefulSyncTransform(source, transform) {
-  const output = transform(withFlushSync(source));
+function* applyStatefulSyncTransform(source, transform, receiver) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushSync(source));
   for (const item of output) {
     if (item === null) continue;
     const batch = [];
@@ -553,7 +539,8 @@ function* createSyncPipeline(source, transforms) {
         current = applyFusedStatelessSyncTransforms(current, statelessRun);
         statelessRun = [];
       }
-      current = applyStatefulSyncTransform(current, transform.transform);
+      current = applyStatefulSyncTransform(
+        current, transform.transform, transform);
     } else {
       ArrayPrototypePush(statelessRun, transform);
     }
@@ -664,8 +651,10 @@ async function* withFlushAsync(source) {
   yield null;
 }
 
-async function* applyStatefulAsyncTransform(source, transform, options) {
-  const output = transform(withFlushAsync(source), options);
+async function* applyStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushAsync(source), options);
   for await (const item of output) {
     if (item === null) continue;
     // Fast path: item is already a Uint8Array[] batch (e.g. compression transforms)
@@ -697,8 +686,10 @@ async function* applyStatefulAsyncTransform(source, transform, options) {
  * skips isUint8ArrayBatch validation (transform guarantees valid output).
  * @yields {Uint8Array[]}
  */
-async function* applyValidatedStatefulAsyncTransform(source, transform, options) {
-  const output = transform(source, options);
+async function* applyValidatedStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, source, options);
   for await (const batch of output) {
     if (batch.length > 0) {
       yield batch;
@@ -766,10 +757,10 @@ async function* createAsyncPipeline(source, transforms, signal) {
       const opts = { __proto__: null, signal: transformSignal };
       if (transform[kValidatedTransform]) {
         current = applyValidatedStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       } else {
         current = applyStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       }
     } else {
       ArrayPrototypePush(statelessRun, transform);
@@ -821,6 +812,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
  * @returns {Iterable<Uint8Array[]>}
  */
 function pullSync(source, ...transforms) {
+  const normalized = fromSync(source);
   for (let i = 0; i < transforms.length; i++) {
     if (!isTransform(transforms[i])) {
       throw new ERR_INVALID_ARG_TYPE(
@@ -831,7 +823,7 @@ function pullSync(source, ...transforms) {
   return {
     __proto__: null,
     *[SymbolIterator]() {
-      yield* createSyncPipeline(fromSync(source), transforms);
+      yield* createSyncPipeline(normalized, transforms);
     },
   };
 }
@@ -844,26 +836,127 @@ function pullSync(source, ...transforms) {
  * @returns {AsyncIterable<Uint8Array[]>}
  */
 function pull(source, ...args) {
-  const { transforms, options } = parsePullArgs(args);
-  const signal = options?.signal;
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-    // Eagerly check abort at call time per spec
-    if (signal.aborted) {
+  const parsed = parsePullArgs(args);
+  const { transforms } = parsed;
+  const options = converters.PullOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
+  const normalized = from(source);
+  signal?.throwIfAborted();
+
+  return {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      const controller = new AbortController();
+      const iteratorSignal = signal === undefined ?
+        controller.signal : AbortSignal.any([signal, controller.signal]);
+
+      async function* pipeline() {
+        yield* createAsyncPipeline(normalized, transforms, iteratorSignal);
+      }
+      const iterator = pipeline();
+
       return {
         __proto__: null,
-        // eslint-disable-next-line require-yield
-        async *[SymbolAsyncIterator]() {
-          throw signal.reason;
+        next(value) {
+          return iterator.next(value);
+        },
+        return(value) {
+          controller.abort(lazyDOMException('Aborted', 'AbortError'));
+          return iterator.return(value);
+        },
+        throw(error) {
+          controller.abort(error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
         },
       };
+    },
+  };
+}
+
+// Keep ownership of a bonded consumer outside the transform pipeline so it can
+// be detached even when the pipeline never starts or terminates early.
+function pullWithConsumerCleanup(source, transforms, signal) {
+  const sourceIterator = source[SymbolAsyncIterator]();
+  const pipelineSource = {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      return sourceIterator;
+    },
+  };
+  let sourceClosed = false;
+  let abortHandler;
+
+  function closeSource(method, value) {
+    if (sourceClosed) return;
+    sourceClosed = true;
+    if (abortHandler !== undefined) {
+      signal.removeEventListener('abort', abortHandler);
+    }
+    const close = sourceIterator[method] ?? sourceIterator.return;
+    if (typeof close === 'function') {
+      const result = FunctionPrototypeCall(close, sourceIterator, value);
+      PromisePrototypeThen(PromiseResolve(result), undefined, () => {});
     }
   }
 
+  if (signal?.aborted) {
+    closeSource('throw', signal.reason);
+    return {
+      __proto__: null,
+      // eslint-disable-next-line require-yield
+      async *[SymbolAsyncIterator]() {
+        throw signal.reason;
+      },
+    };
+  }
+
+  const pipeline = signal === undefined ?
+    pull(pipelineSource, ...transforms) :
+    pull(pipelineSource, ...transforms, { __proto__: null, signal });
+
+  if (signal !== undefined) {
+    abortHandler = () => closeSource('throw', signal.reason);
+    signal.addEventListener('abort', abortHandler,
+                            { __proto__: null, once: true });
+    if (signal.aborted) abortHandler();
+  }
+
   return {
     __proto__: null,
-    async *[SymbolAsyncIterator]() {
-      yield* createAsyncPipeline(from(source), transforms, signal);
+    [SymbolAsyncIterator]() {
+      const iterator = pipeline[SymbolAsyncIterator]();
+      return {
+        __proto__: null,
+        next(value) {
+          return PromisePrototypeThen(
+            iterator.next(value),
+            (result) => {
+              if (result.done) closeSource('return');
+              return result;
+            },
+            (error) => {
+              closeSource('throw', error);
+              throw error;
+            });
+        },
+        return(value) {
+          closeSource('return', value);
+          return iterator.return(value);
+        },
+        throw(error) {
+          closeSource('throw', error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
+        },
+      };
     },
   };
 }
@@ -879,7 +972,19 @@ function pull(source, ...args) {
  * @returns {number} Total bytes written
  */
 function pipeToSync(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'writeSync');
+  const parsed = parsePipeToArgs(args, 'writeSync');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToSyncOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const hasWritevSync = typeof writer.writevSync === 'function';
+  const endSync = writer.endSync;
+
+  if (!options.preventClose && typeof endSync !== 'function') {
+    throw new ERR_INVALID_ARG_TYPE(
+      'writer.endSync', 'Function', endSync);
+  }
 
   // Normalize source and create pipeline
   const normalized = fromSync(source);
@@ -888,38 +993,41 @@ function pipeToSync(source, ...args) {
     normalized;
 
   let totalBytes = 0;
-  const hasWritevSync = typeof writer.writevSync === 'function';
-  const hasEndSync = typeof writer.endSync === 'function';
 
   try {
     for (const batch of pipeline) {
+      const entry = createBatchEntry(batch);
       if (hasWritevSync && batch.length > 1) {
-        if (writer.writevSync(batch) === false) {
+        const accepted = writer.writevSync(validateBatchEntry(entry));
+        validateBatchEntry(entry);
+        if (accepted === false) {
           throw new ERR_OUT_OF_RANGE(
             'write', 'within byte budget', 'budget exhausted');
         }
-        for (let i = 0; i < batch.length; i++) {
-          totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-        }
+        totalBytes += entry.byteLength;
       } else {
-        for (let i = 0; i < batch.length; i++) {
-          const chunk = batch[i];
-          if (writer.writeSync(chunk) === false) {
+        for (let i = 0; i < entry.views.length; i++) {
+          const view = entry.views[i];
+          const chunk = validateByteView(view);
+          const accepted = writer.writeSync(chunk);
+          validateByteView(view);
+          if (accepted === false) {
             throw new ERR_OUT_OF_RANGE(
               'write', 'within byte budget', 'budget exhausted');
           }
-          totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+          totalBytes += view.byteLength;
         }
       }
     }
 
-    if (!options?.preventClose) {
-      if (!hasEndSync || writer.endSync() < 0) {
-        writer.end?.();
+    if (!options.preventClose) {
+      if (FunctionPrototypeCall(endSync, writer) < 0) {
+        throw new ERR_INVALID_STATE(
+          'Writer could not be closed synchronously');
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
+    if (!options.preventFail) {
       writer.fail?.(wrapError(error));
     }
     throw error;
@@ -935,20 +1043,29 @@ function pipeToSync(source, ...args) {
  * @returns {Promise<number>} Total bytes written
  */
 async function pipeTo(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'write');
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  const parsed = parsePipeToArgs(args, 'write');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
 
-  const signal = options?.signal;
+  function failWriter(error) {
+    if (!options.preventFail) {
+      writer.fail?.(wrapError(error));
+    }
+  }
 
-  // Check for abort
-  signal?.throwIfAborted();
+  try {
+    signal?.throwIfAborted();
+  } catch (error) {
+    failWriter(error);
+    throw error;
+  }
 
   const hasWriteSync = typeof writer.writeSync === 'function';
-  const useSyncIterableFastPath =
-    hasWriteSync && canUseSyncIterablePipeToFastPath(source, transforms, signal);
-  const normalized = useSyncIterableFastPath ? undefined : from(source);
+  const normalized = from(source);
 
   let totalBytes = 0;
   const hasWritev = typeof writer.writev === 'function';
@@ -957,19 +1074,26 @@ async function pipeTo(source, ...args) {
 
   // Async fallback for writeBatch when sync write fails partway through.
   // Continues writing from batch[startIndex] using async write().
-  async function writeBatchAsyncFallback(batch, startIndex) {
-    for (let i = startIndex; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (hasWriteSync && writer.writeSync(chunk)) {
-        // Sync retry succeeded
-      } else {
-        const result = writer.write(
-          chunk, signal ? { __proto__: null, signal } : undefined);
-        if (result !== undefined) {
-          await result;
+  async function writeBatchAsyncFallback(entry, startIndex) {
+    for (let i = startIndex; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      if (hasWriteSync) {
+        const chunk = validateByteView(view);
+        if (writer.writeSync(chunk)) {
+          validateByteView(view);
+          totalBytes += view.byteLength;
+          continue;
         }
+        validateByteView(view);
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      const result = writer.write(
+        validateByteView(view),
+        signal ? { __proto__: null, signal } : undefined);
+      if (result !== undefined) {
+        await result;
+      }
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
@@ -977,63 +1101,42 @@ async function pipeTo(source, ...args) {
   // Returns undefined on sync success, or a Promise when async fallback
   // is required. Callers must check: const p = writeBatch(b); if (p) await p;
   function writeBatch(batch) {
+    const entry = createBatchEntry(batch);
     if (hasWritev && batch.length > 1) {
-      if (!hasWritevSync || !writer.writevSync(batch)) {
+      if (!hasWritevSync ||
+          !writer.writevSync(validateBatchEntry(entry))) {
+        validateBatchEntry(entry);
         const opts = signal ? { __proto__: null, signal } : undefined;
-        const writevResult = writer.writev(batch, opts);
+        const writevResult = writer.writev(validateBatchEntry(entry), opts);
         if (writevResult === undefined) {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
           return;
         }
         return PromisePrototypeThen(PromiseResolve(writevResult), () => {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
         });
       }
-      for (let i = 0; i < batch.length; i++) {
-        totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-      }
+      validateBatchEntry(entry);
+      totalBytes += entry.byteLength;
       return;
     }
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
+    for (let i = 0; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      const chunk = validateByteView(view);
       if (!hasWriteSync || !writer.writeSync(chunk)) {
+        if (hasWriteSync) validateByteView(view);
         // Sync path failed at index i - fall back to async for the rest.
-        return writeBatchAsyncFallback(batch, i);
+        return writeBatchAsyncFallback(entry, i);
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
   try {
-    if (useSyncIterableFastPath) {
-      // Avoid from()'s async sync-iterable batching path. This keeps writes
-      // incremental for synchronous sources while preserving async
-      // normalization for non-primitive yielded values.
-      for (const value of source) {
-        if (isUint8ArrayBatch(value)) {
-          if (value.length > 0) {
-            const p = writeBatch(value);
-            if (p) await p;
-          }
-          continue;
-        }
-        if (isUint8Array(value)) {
-          const p = writeBatch([value]);
-          if (p) await p;
-          continue;
-        }
-
-        const batch = await ArrayFromAsync(normalizeAsyncValue(value));
-        if (batch.length > 0) {
-          const p = writeBatch(batch);
-          if (p) await p;
-        }
-      }
-    } else if (transforms.length === 0) {
+    if (transforms.length === 0) {
       // Fast path: no transforms - iterate normalized source directly
       if (signal) {
         for await (const batch of yieldAbortable(normalized, signal)) {
@@ -1064,15 +1167,13 @@ async function pipeTo(source, ...args) {
       }
     }
 
-    if (!options?.preventClose) {
+    if (!options.preventClose) {
       if (!hasEndSync || writer.endSync() < 0) {
         await writer.end?.(signal ? { __proto__: null, signal } : undefined);
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
-      writer.fail?.(wrapError(error));
-    }
+    failWriter(error);
     throw error;
   }
 
@@ -1084,4 +1185,5 @@ module.exports = {
   pipeToSync,
   pull,
   pullSync,
+  pullWithConsumerCleanup,
 };
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index cc7bfc900cec..0536d8212c2a 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -11,11 +11,11 @@ const {
   PromiseReject,
   PromiseResolve,
   PromiseWithResolvers,
+  SafeWeakSet,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -25,8 +25,6 @@ const {
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
 } = require('internal/validators');
 
@@ -37,16 +35,20 @@ const {
 const {
   kPushDefaultBudget,
   kResolvedPromise,
+  createBatchEntry,
   onSignalAbort,
-  toUint8Array,
+  toWriterUint8Array,
   convertChunks,
   getWriterSignal,
   parsePullArgs,
-  validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -54,6 +56,11 @@ const {
 } = require('internal/streams/iter/ringbuffer');
 
 const kNoFailReason = Symbol('kNoFailReason');
+const consumerReturnErrors = new SafeWeakSet();
+
+function isConsumerReturnError(error) {
+  return consumerReturnErrors.has(error);
+}
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -117,16 +124,16 @@ class PushQueue {
   #bufferedBytes = 0;
 
   constructor(options = { __proto__: null }) {
+    options = converters.PushStreamOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const {
       budget = kPushDefaultBudget,
       backpressure = 'strict',
       signal,
     } = options;
     validateInteger(budget, 'options.budget', 16384);
-    validateBackpressure(backpressure);
-    if (signal !== undefined) {
-      validateAbortSignal(signal, 'options.signal');
-    }
     this.#budget = budget;
     this.#backpressure = backpressure;
     this.#signal = signal;
@@ -145,7 +152,7 @@ class PushQueue {
   // ===========================================================================
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if writer is closed/errored or consumer has terminated.
    * @returns {boolean | null}
    */
@@ -153,14 +160,16 @@ class PushQueue {
     if (this.#writerState !== 'open' || this.#consumerState !== 'active') {
       return null;
     }
-    if ((this.#backpressure === 'strict' ||
-          this.#backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#budget) {
+    if (this.#bufferedBytes >= this.#budget) {
       return false;
     }
     return true;
   }
 
+  get signal() {
+    return this.#signal;
+  }
+
   /**
    * Check if a sync write would be accepted.
    * @returns {boolean}
@@ -185,7 +194,11 @@ class PushQueue {
     if (this.#writerState !== 'open') return false;
     if (this.#consumerState !== 'active') return false;
 
-    const batchSize = this.#batchByteSize(chunks);
+    return this.#writeEntry(createBatchEntry(chunks));
+  }
+
+  #writeEntry(entry) {
+    const batchSize = entry.byteLength;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -201,7 +214,7 @@ class PushQueue {
           while (this.#bufferedBytes >= this.#budget &&
                  this.#slots.length > 0) {
             const evicted = this.#slots.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
           }
           break;
         case 'drop-newest':
@@ -211,7 +224,7 @@ class PushQueue {
       }
     }
 
-    this.#slots.push(chunks);
+    this.#slots.push(entry);
     this.#bufferedBytes += batchSize;
     this.#bytesWritten += batchSize;
 
@@ -253,8 +266,8 @@ class PushQueue {
     // Check for pre-aborted signal (after state checks per spec)
     signal?.throwIfAborted();
 
-    // Try sync first
-    if (this.writeSync(chunks)) {
+    const entry = createBatchEntry(chunks);
+    if (this.#writeEntry(entry)) {
       return;
     }
 
@@ -266,9 +279,9 @@ class PushQueue {
             'Backpressure violation: too many pending writes. ' +
             'Await each write() call to respect backpressure.');
         }
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       case 'unbounded':
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       default:
         throw new ERR_INVALID_STATE(
           'Unexpected: writeSync should have handled non-strict policy');
@@ -281,16 +294,19 @@ class PushQueue {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunks, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunks, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
 
     if (signal) {
       const onAbort = () => {
         // Remove from queue so it doesn't occupy a slot
         const idx = this.#pendingWrites.indexOf(entry);
-        if (idx !== -1) this.#pendingWrites.removeAt(idx);
+        if (idx !== -1) {
+          this.#pendingWrites.removeAt(idx);
+          this.#resolvePendingReads();
+        }
         reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
       };
 
@@ -325,31 +341,33 @@ class PushQueue {
       return this.#bytesWritten; // Idempotent
     }
 
-    this.#cleanup();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Writer closed'));
     this.#resolvePendingDrains(false);
 
-    // If buffer is empty, close immediately
-    if (this.#slots.length === 0) {
+    // If there is no accepted work to drain, close immediately.
+    if (this.#slots.length === 0 && this.#pendingWrites.length === 0) {
       this.#writerState = 'closed';
+      this.#cleanup();
       this.#resolvePendingReads();
       return this.#bytesWritten;
     }
 
-    // Buffer has data: transition to closing, defer completion until drained
+    // Accepted work remains: close after it drains and the consumer pulls EOF.
     this.#writerState = 'closing';
     return -3; // Signal to PushWriter: create deferred end promise
   }
 
   /**
-   * Called by the read path when the consumer has drained all data while
-   * the writer is in the 'closing' state. Transitions to 'closed' and
-   * resolves the pending end promise.
+   * Called when the consumer pulls past all accepted data while the writer is
+   * closing. Transitions to 'closed' and resolves the pending end promise.
    */
   endDrained() {
-    if (this.#writerState !== 'closing') return;
+    if (this.#writerState !== 'closing' ||
+        this.#slots.length > 0 ||
+        this.#pendingWrites.length > 0) {
+      return;
+    }
     this.#writerState = 'closed';
+    this.#cleanup();
     if (this.#pendingEnd) {
       this.#pendingEnd.resolve(this.#bytesWritten);
       this.#pendingEnd = null;
@@ -374,6 +392,7 @@ class PushQueue {
     this.#cleanup();
     this.#rejectPendingReads(this.#error);
     this.#rejectPendingDrains(this.#error);
+    this.#rejectPendingWrites(this.#error);
 
     if (wasClosing) {
       // Short-circuit the graceful drain: reject the pending end promise
@@ -381,8 +400,6 @@ class PushQueue {
         this.#pendingEnd.reject(this.#error);
         this.#pendingEnd = null;
       }
-    } else {
-      this.#rejectPendingWrites(this.#error);
     }
   }
 
@@ -402,12 +419,12 @@ class PushQueue {
     return this.#writerState;
   }
 
-  get pendingEndPromise() {
-    return this.#pendingEnd?.promise ?? null;
-  }
-
-  setPendingEnd(pending) {
-    this.#pendingEnd = pending;
+  getPendingEndPromise() {
+    if (this.#pendingEnd === null) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      this.#pendingEnd = { __proto__: null, promise, resolve, reject };
+    }
+    return this.#pendingEnd.promise;
   }
 
   /**
@@ -425,14 +442,17 @@ class PushQueue {
   // ===========================================================================
 
   async read() {
+    if (this.#consumerState === 'returned') {
+      return { __proto__: null, done: true, value: undefined };
+    }
+    if (this.#consumerState === 'thrown') {
+      throw this.#error;
+    }
+
     // If there's data in the buffer, return it immediately
     if (this.#slots.length > 0) {
       const result = this.#drain();
       this.#resolvePendingWrites();
-      // After draining, check if writer was closing and buffer is now empty
-      if (this.#writerState === 'closing' && this.#slots.length === 0) {
-        this.endDrained();
-      }
       return { __proto__: null, done: false, value: result };
     }
 
@@ -458,16 +478,10 @@ class PushQueue {
   consumerReturn() {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'returned';
-    this.#cleanup();
+    const error = new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+    consumerReturnErrors.add(error);
+    this.#terminateWriterFromConsumer(error);
     this.#resolvePendingReads();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-    // If closing, reject the pending end promise
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-      this.#pendingEnd = null;
-    }
     // Resolve pending drains with false - no more data will be consumed
     this.#resolvePendingDrains(false);
   }
@@ -476,13 +490,8 @@ class PushQueue {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'thrown';
     this.#error = error;
-    this.#cleanup();
+    this.#terminateWriterFromConsumer(error);
     this.#rejectPendingReads(error);
-    this.#rejectPendingWrites(error);
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(error);
-      this.#pendingEnd = null;
-    }
     // Reject pending drains - the consumer errored
     this.#rejectPendingDrains(error);
   }
@@ -492,38 +501,66 @@ class PushQueue {
   // ===========================================================================
 
   #drain() {
-    this.#bufferedBytes = 0;
-    if (this.#slots.length === 1) {
-      return this.#slots.shift();
-    }
+    try {
+      if (this.#slots.length === 1) {
+        const result = validateBatchEntry(this.#slots.shift());
+        this.#bufferedBytes = 0;
+        return result;
+      }
 
-    const result = [];
-    for (let i = 0; i < this.#slots.length; i++) {
-      const slot = this.#slots.get(i);
-      for (let j = 0; j < slot.length; j++) {
-        ArrayPrototypePush(result, slot[j]);
+      const result = [];
+      for (let i = 0; i < this.#slots.length; i++) {
+        const batch = validateBatchEntry(this.#slots.get(i));
+        for (let j = 0; j < batch.length; j++) {
+          ArrayPrototypePush(result, batch[j]);
+        }
       }
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      return result;
+    } catch (error) {
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      this.fail(error);
+      throw error;
     }
-    this.#slots.clear();
-    return result;
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #terminateWriterFromConsumer(error) {
+    this.#slots.clear();
+    this.#bufferedBytes = 0;
+    if (this.#writerState === 'open' || this.#writerState === 'closing') {
+      this.#writerState = 'errored';
+      this.#error = error;
+    }
+    this.#cleanup();
+    this.#rejectPendingWrites(error);
+    if (this.#pendingEnd) {
+      this.#pendingEnd.reject(error);
+      this.#pendingEnd = null;
     }
-    return size;
   }
 
   #resolvePendingReads() {
     while (this.#pendingReads.length > 0) {
-      if (this.#slots.length > 0) {
+      if (this.#consumerState === 'returned') {
+        const pending = this.#pendingReads.shift();
+        pending.resolve({ __proto__: null, done: true, value: undefined });
+      } else if (this.#consumerState === 'thrown') {
         const pending = this.#pendingReads.shift();
-        const result = this.#drain();
-        this.#resolvePendingWrites();
-        pending.resolve({ __proto__: null, done: false, value: result });
-      } else if (this.#writerState === 'closing' && this.#slots.length === 0) {
+        pending.reject(this.#error);
+      } else if (this.#slots.length > 0) {
+        const pending = this.#pendingReads.shift();
+        try {
+          const result = this.#drain();
+          this.#resolvePendingWrites();
+          pending.resolve({ __proto__: null, done: false, value: result });
+        } catch (error) {
+          pending.reject(error);
+        }
+      } else if (this.#writerState === 'closing' &&
+                 this.#slots.length === 0 &&
+                 this.#pendingWrites.length === 0) {
         this.endDrained();
         const pending = this.#pendingReads.shift();
         pending.resolve({ __proto__: null, done: true, value: undefined });
@@ -533,9 +570,6 @@ class PushQueue {
       } else if (this.#writerState === 'errored') {
         const pending = this.#pendingReads.shift();
         pending.reject(this.#error);
-      } else if (this.#consumerState === 'returned') {
-        const pending = this.#pendingReads.shift();
-        pending.resolve({ __proto__: null, done: true, value: undefined });
       } else {
         break;
       }
@@ -546,11 +580,15 @@ class PushQueue {
     while (this.#pendingWrites.length > 0 &&
           this.#bufferedBytes < this.#budget) {
       const pending = this.#pendingWrites.shift();
-      const batchSize = this.#batchByteSize(pending.chunks);
-      this.#slots.push(pending.chunks);
-      this.#bufferedBytes += batchSize;
-      this.#bytesWritten += batchSize;
-      pending.resolve();
+      try {
+        validateBatchEntry(pending.batch);
+        this.#slots.push(pending.batch);
+        this.#bufferedBytes += pending.batch.byteLength;
+        this.#bytesWritten += pending.batch.byteLength;
+        pending.resolve();
+      } catch (error) {
+        pending.reject(error);
+      }
     }
 
     if (this.#bufferedBytes < this.#budget) {
@@ -617,35 +655,30 @@ class PushWriter {
   }
 
   write(chunk, options) {
+    const bytes = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     if (!signal && this.#queue.canWriteSync()) {
-      const bytes = toUint8Array(chunk);
       this.#queue.writeSync([bytes]);
       return kResolvedPromise;
     }
-    const bytes = toUint8Array(chunk);
     return this.#queue.writeAsync([bytes], signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const bytes = convertChunks(chunks);
     const signal = getWriterSignal(options);
-    if (!signal && this.#queue.canWriteSync()) {
-      const bytes = convertChunks(chunks);
-      this.#queue.writeSync(bytes);
+    if (!signal && this.#queue.writeSync(bytes)) {
       return kResolvedPromise;
     }
-    const bytes = convertChunks(chunks);
     return this.#queue.writeAsync(bytes, signal);
   }
 
   writeSync(chunk) {
-    const bytes = toUint8Array(chunk);
+    const bytes = toWriterUint8Array(chunk);
     return this.#queue.writeSync([bytes]);
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
     const bytes = convertChunks(chunks);
     return this.#queue.writeSync(bytes);
   }
@@ -660,15 +693,7 @@ class PushWriter {
       return PromiseReject(this.#queue.error);
     }
     if (result === -3) {
-      // Closing: buffer has data, create deferred promise that resolves
-      // when consumer drains past the end sentinel
-      const pendingEndPromise = this.#queue.pendingEndPromise;
-      if (pendingEndPromise !== null) {
-        return raceEndWithSignal(pendingEndPromise, signal);
-      }
-      const { promise, resolve, reject } = PromiseWithResolvers();
-      this.#queue.setPendingEnd({ __proto__: null, promise, resolve, reject });
-      return raceEndWithSignal(promise, signal);
+      return raceEndWithSignal(this.#queue.getPendingEndPromise(), signal);
     }
     // >= 0: byte count (immediate close or idempotent)
     return PromiseResolve(result);
@@ -688,8 +713,7 @@ class PushWriter {
   [SymbolAsyncDispose]() {
     const state = this.#queue.writerState;
     if (state === 'closing') {
-      // Wait for graceful drain
-      return this.#queue.pendingEndPromise ?? PromiseResolve();
+      return this.#queue.getPendingEndPromise();
     }
     if (state === 'open') {
       this.fail();
@@ -756,12 +780,8 @@ function push(...args) {
   // Apply transforms lazily if provided
   let readable;
   if (transforms.length > 0) {
-    if (options.signal) {
-      readable = pullWithTransforms(
-        rawReadable, ...transforms, { __proto__: null, signal: options.signal });
-    } else {
-      readable = pullWithTransforms(rawReadable, ...transforms);
-    }
+    readable = pullWithConsumerCleanup(
+      rawReadable, transforms, queue.signal);
   } else {
     readable = rawReadable;
   }
@@ -770,5 +790,6 @@ function push(...args) {
 }
 
 module.exports = {
+  isConsumerReturnError,
   push,
 };
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 711abeb21b9a..70179dffd3c1 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -10,11 +10,12 @@ const {
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
+  SafePromiseRace,
   SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   SymbolDispose,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -30,19 +31,23 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
   pullSync: pullSyncWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   kMultiConsumerDefaultBudget,
+  createBatchEntry,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
   wrapError,
   parsePullArgs,
-  validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -56,15 +61,16 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 // =============================================================================
 // Async Share Implementation
 // =============================================================================
 
+const kNoShareError = Symbol('kNoShareError');
+const kShareCancelled = Symbol('kShareCancelled');
+
 class ShareImpl {
   #source;
   #options;
@@ -77,6 +83,9 @@ class ShareImpl {
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
+  #cancelPromise;
+  #resolveCancel;
+  #cancelError = kNoShareError;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
   /** Cumulative byte size of buffered entries */
@@ -85,6 +94,9 @@ class ShareImpl {
   constructor(source, options) {
     this.#source = source;
     this.#options = options;
+    const { promise, resolve } = PromiseWithResolvers();
+    this.#cancelPromise = promise;
+    this.#resolveCancel = resolve;
   }
 
   get consumerCount() {
@@ -92,9 +104,13 @@ class ShareImpl {
   }
 
   pull(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -111,13 +127,7 @@ class ShareImpl {
     const rawConsumer = this.#createRawConsumer();
 
     if (transforms.length > 0 || signal) {
-      if (signal) {
-        return pullWithTransforms(
-          rawConsumer,
-          ...transforms,
-          { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...transforms);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -129,6 +139,7 @@ class ShareImpl {
       resolve: null,
       reject: null,
       detached: false,
+      error: kNoShareError,
       pendingNext: PromiseResolve(),
     };
 
@@ -147,32 +158,28 @@ class ShareImpl {
       __proto__: null,
       [SymbolAsyncIterator]() {
         const getNext = async () => {
-          if (self.#sourceError !== undefined) {
-            state.detached = true;
-            self.#consumers.delete(state);
-            throw self.#sourceError;
-          }
-
           // Loop until we get data, source is exhausted, or
           // consumer is detached. Multiple consumers may be woken
           // after a single pull - those that find no data at their
           // cursor must re-pull rather than terminating prematurely.
           for (;;) {
             if (state.detached) {
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             if (self.#cancelled) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             // Check if data is available in buffer
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -185,7 +192,10 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (self.#sourceError !== undefined) {
+                state.error = self.#sourceError;
+                throw state.error;
+              }
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -193,8 +203,9 @@ class ShareImpl {
             const shouldBuffer = await self.#waitForBufferSpace();
             if (shouldBuffer === null) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -246,14 +257,23 @@ class ShareImpl {
     this.#cancelled = true;
 
     if (reason !== undefined) {
-      this.#sourceError = reason;
+      this.#cancelError = reason;
     }
 
+    this.#resolveCancel(kShareCancelled);
+    this.#resolveCancel = null;
+
     if (this.#sourceIterator?.return) {
-      PromisePrototypeThen(this.#sourceIterator.return(), undefined, () => {});
+      try {
+        PromisePrototypeThen(
+          PromiseResolve(this.#sourceIterator.return()), undefined, () => {});
+      } catch {
+        // Cancellation has precedence over source cleanup errors.
+      }
     }
 
     for (const consumer of this.#consumers) {
+      consumer.error = this.#cancelError;
       if (consumer.resolve) {
         if (reason !== undefined) {
           consumer.reject?.(reason);
@@ -266,6 +286,8 @@ class ShareImpl {
       consumer.detached = true;
     }
     this.#consumers.clear();
+    this.#buffer.clear();
+    this.#bufferedBytes = 0;
 
     for (let i = 0; i < this.#pullWaiters.length; i++) {
       this.#pullWaiters[i]();
@@ -302,7 +324,7 @@ class ShareImpl {
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -369,13 +391,19 @@ class ShareImpl {
           }
         }
 
-        const result = await this.#sourceIterator.next();
+        const result = await SafePromiseRace([
+          this.#sourceIterator.next(),
+          this.#cancelPromise,
+        ]);
+
+        if (this.#cancelled || result === kShareCancelled) return;
 
         if (result.done) {
           this.#sourceExhausted = true;
         } else if (!discard) {
-          this.#buffer.push(result.value);
-          this.#bufferedBytes += this.#batchByteSize(result.value);
+          const entry = createBatchEntry(result.value);
+          this.#buffer.push(entry);
+          this.#bufferedBytes += entry.byteLength;
         }
       } catch (error) {
         this.#sourceError = wrapError(error);
@@ -398,7 +426,7 @@ class ShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -409,12 +437,15 @@ class ShareImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -517,7 +548,7 @@ class SyncShareImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -549,7 +580,7 @@ class SyncShareImpl {
                   while (self.#bufferedBytes >= self.#options.budget &&
                          self.#buffer.length > 0) {
                     const evicted = self.#buffer.shift();
-                    self.#bufferedBytes -= self.#batchByteSize(evicted);
+                    self.#bufferedBytes -= evicted.byteLength;
                     self.#bufferStart++;
                   }
                   for (const consumer of self.#consumers) {
@@ -577,7 +608,7 @@ class SyncShareImpl {
 
             const newBufferIndex = state.cursor - self.#bufferStart;
             if (newBufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(newBufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(newBufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -649,8 +680,9 @@ class SyncShareImpl {
       if (result.done) {
         this.#sourceExhausted = true;
       } else {
-        this.#buffer.push(result.value);
-        this.#bufferedBytes += this.#batchByteSize(result.value);
+        const entry = createBatchEntry(result.value);
+        this.#buffer.push(entry);
+        this.#bufferedBytes += entry.byteLength;
       }
     } catch (error) {
       this.#sourceError = wrapError(error);
@@ -666,19 +698,22 @@ class SyncShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -715,17 +750,16 @@ function onShareCancel(shareImpl, signal) {
 function share(source, options = { __proto__: null }) {
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = from(source);
-  validateObject(options, 'options');
+  options = converters.ShareOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -746,13 +780,15 @@ function share(source, options = { __proto__: null }) {
 function shareSync(source, options = { __proto__: null }) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  validateObject(options, 'options');
+  options = converters.ShareSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
 
   const opts = {
     __proto__: null,
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 9966f351b9d5..08337a5536f2 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -3,6 +3,7 @@
 const {
   Array,
   ArrayBufferPrototypeGetByteLength,
+  ArrayBufferPrototypeGetDetached,
   ArrayPrototypeSlice,
   PromiseResolve,
   PromiseWithResolvers,
@@ -25,6 +26,7 @@ const { TextEncoder } = require('internal/encoding');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
     ERR_OPERATION_FAILED,
   },
 } = require('internal/errors');
@@ -33,9 +35,11 @@ const { isError } = require('internal/util');
 const { isSharedArrayBuffer, isUint8Array } = require('internal/util/types');
 
 const {
-  validateAbortSignal,
   validateOneOf,
 } = require('internal/validators');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 // Cached resolved promise to avoid allocating a new one on every sync fast-path.
 const kResolvedPromise = PromiseResolve();
@@ -183,17 +187,69 @@ function toUint8Array(chunk) {
   return chunk;
 }
 
-/**
- * Check if all chunks in an array are already Uint8Array.
- * Short-circuits on the first non-Uint8Array chunk found.
- * @param {Array<Uint8Array|string>} chunks
- * @returns {boolean}
- */
-function allUint8Array(chunks) {
+function snapshotByteView(value) {
+  const buffer = TypedArrayPrototypeGetBuffer(value);
+  const sharedBufferView = isSharedArrayBuffer(buffer) ?
+    new Uint8Array(buffer) : undefined;
+  return {
+    __proto__: null,
+    value,
+    buffer,
+    bufferByteLength: sharedBufferView === undefined ?
+      ArrayBufferPrototypeGetByteLength(buffer) :
+      TypedArrayPrototypeGetByteLength(sharedBufferView),
+    byteLength: TypedArrayPrototypeGetByteLength(value),
+    byteOffset: TypedArrayPrototypeGetByteOffset(value),
+    detached: sharedBufferView === undefined &&
+      ArrayBufferPrototypeGetDetached(buffer),
+    sharedBufferView,
+  };
+}
+
+function validateByteView(snapshot) {
+  const {
+    value,
+    buffer,
+    bufferByteLength,
+    byteLength,
+    byteOffset,
+    detached,
+    sharedBufferView,
+  } = snapshot;
+  const currentBufferByteLength = sharedBufferView === undefined ?
+    ArrayBufferPrototypeGetByteLength(buffer) :
+    TypedArrayPrototypeGetByteLength(sharedBufferView);
+  const currentDetached = sharedBufferView === undefined &&
+    ArrayBufferPrototypeGetDetached(buffer);
+
+  if (TypedArrayPrototypeGetBuffer(value) !== buffer ||
+      currentBufferByteLength !== bufferByteLength ||
+      TypedArrayPrototypeGetByteLength(value) !== byteLength ||
+      TypedArrayPrototypeGetByteOffset(value) !== byteOffset ||
+      currentDetached !== detached) {
+    throw new ERR_INVALID_STATE.TypeError(
+      'Byte view was resized or detached after being accepted');
+  }
+  return value;
+}
+
+function createBatchEntry(chunks) {
+  const views = new Array(chunks.length);
+  let byteLength = 0;
   for (let i = 0; i < chunks.length; i++) {
-    if (!isUint8Array(chunks[i])) return false;
+    const view = snapshotByteView(chunks[i]);
+    views[i] = view;
+    byteLength += view.byteLength;
   }
-  return true;
+  return { __proto__: null, views, byteLength };
+}
+
+function validateBatchEntry(entry) {
+  const chunks = new Array(entry.views.length);
+  for (let i = 0; i < entry.views.length; i++) {
+    chunks[i] = validateByteView(entry.views[i]);
+  }
+  return chunks;
 }
 
 function copyBytes(chunk) {
@@ -250,9 +306,10 @@ function concatBytes(chunks) {
  * @returns {Uint8Array[]}
  */
 function convertChunks(chunks) {
-  if (allUint8Array(chunks)) {
-    return ArrayPrototypeSlice(chunks);
-  }
+  chunks = converters.WriterChunkSequence(chunks, {
+    __proto__: null,
+    context: 'chunks',
+  });
   const len = chunks.length;
   const result = new Array(len);
   for (let i = 0; i < len; i++) {
@@ -267,9 +324,17 @@ function convertChunks(chunks) {
  * @returns {AbortSignal|undefined}
  */
 function getWriterSignal(options) {
-  const signal = options?.signal;
-  validateAbortSignal(signal, 'options.signal');
-  return signal;
+  return converters.WriteOptions(options, {
+    __proto__: null,
+    context: 'options',
+  }).signal;
+}
+
+function toWriterUint8Array(chunk) {
+  return toUint8Array(converters.WriterChunk(chunk, {
+    __proto__: null,
+    context: 'chunk',
+  }));
 }
 
 /**
@@ -297,20 +362,6 @@ function hasProtocol(value, symbol) {
   );
 }
 
-/**
- * Check if a value is PullOptions (object without transform or write property).
- * @param {unknown} value
- * @returns {boolean}
- */
-function isPullOptions(value) {
-  return (
-    value !== null &&
-    typeof value === 'object' &&
-    !('transform' in value) &&
-    !('write' in value)
-  );
-}
-
 /**
  * Check if a value is a stateful transform object (has a transform method).
  * @param {unknown} value
@@ -333,7 +384,7 @@ function isTransform(value) {
  * Parse variadic arguments for pull/pullSync.
  * Returns { transforms, options }
  * @param {Array} args
- * @returns {{ transforms: Array, options: object|undefined }}
+ * @returns {{ transforms: Array, options: unknown }}
  */
 function parsePullArgs(args) {
   if (args.length === 0) {
@@ -343,7 +394,7 @@ function parsePullArgs(args) {
   let transforms;
   let options;
   const last = args[args.length - 1];
-  if (isPullOptions(last)) {
+  if (!isTransform(last)) {
     transforms = ArrayPrototypeSlice(args, 0, -1);
     options = last;
   } else {
@@ -379,19 +430,21 @@ module.exports = {
   kMultiConsumerDefaultBudget,
   kPushDefaultBudget,
   kResolvedPromise,
-  allUint8Array,
   concatBytes,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
-  isPullOptions,
   isTransform,
   isTransformObject,
   onSignalAbort,
   parsePullArgs,
   toUint8Array,
+  toWriterUint8Array,
   validateBackpressure,
+  validateBatchEntry,
+  validateByteView,
   wrapError,
   yieldAbortable,
 };
diff --git a/lib/internal/streams/iter/webidl.js b/lib/internal/streams/iter/webidl.js
new file mode 100644
index 000000000000..b971fa95071b
--- /dev/null
+++ b/lib/internal/streams/iter/webidl.js
@@ -0,0 +1,177 @@
+'use strict';
+
+const {
+  converters: baseConverters,
+  convertToInt,
+  createDictionaryConverter,
+  createEnumConverter,
+  createInterfaceConverter,
+  createSequenceConverter,
+} = require('internal/webidl');
+const { AbortSignal } = require('internal/abort_controller');
+const { isUint8Array } = require('internal/util/types');
+
+const converters = { __proto__: null };
+
+function unsignedLongLong(value, options) {
+  return convertToInt(value, 64, 'unsigned', options);
+}
+
+function enforceRangeUnsignedLongLong(value, options = { __proto__: null }) {
+  return convertToInt(value, 64, 'unsigned', {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    enforceRange: true,
+  });
+}
+
+function allowStreamBufferOptions(options) {
+  return {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    allowShared: true,
+    allowResizable: true,
+  };
+}
+
+converters.AbortSignal = createInterfaceConverter(
+  'AbortSignal', AbortSignal.prototype);
+converters.BackpressurePolicy = createEnumConverter('BackpressurePolicy', [
+  'strict',
+  'unbounded',
+  'drop-oldest',
+  'drop-newest',
+]);
+converters.unsignedLongLong = unsignedLongLong;
+converters.enforceRangeUnsignedLongLong = enforceRangeUnsignedLongLong;
+converters.WriterChunk = (value, options = { __proto__: null }) => {
+  if (isUint8Array(value)) {
+    return baseConverters.Uint8Array(
+      value, allowStreamBufferOptions(options));
+  }
+  return baseConverters.USVString(value, options);
+};
+converters.WriterChunkSequence = createSequenceConverter(
+  converters.WriterChunk);
+
+const signalMember = {
+  __proto__: null,
+  key: 'signal',
+  converter: converters.AbortSignal,
+};
+const budgetMember = {
+  __proto__: null,
+  key: 'budget',
+  converter: converters.unsignedLongLong,
+};
+const backpressureMember = {
+  __proto__: null,
+  key: 'backpressure',
+  converter: converters.BackpressurePolicy,
+  defaultValue: () => 'strict',
+};
+const limitMember = {
+  __proto__: null,
+  key: 'limit',
+  converter: converters.enforceRangeUnsignedLongLong,
+};
+
+converters.WriteOptions = createDictionaryConverter('WriteOptions', [
+  signalMember,
+]);
+converters.PushStreamOptions = createDictionaryConverter(
+  'PushStreamOptions', [budgetMember, backpressureMember, signalMember]);
+converters.PullOptions = createDictionaryConverter('PullOptions', [
+  signalMember,
+]);
+converters.PipeToOptions = createDictionaryConverter('PipeToOptions', [
+  {
+    __proto__: null,
+    key: 'preventClose',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  {
+    __proto__: null,
+    key: 'preventFail',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  signalMember,
+]);
+converters.PipeToSyncOptions = createDictionaryConverter(
+  'PipeToSyncOptions', [
+    {
+      __proto__: null,
+      key: 'preventClose',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+    {
+      __proto__: null,
+      key: 'preventFail',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+  ]);
+converters.ConsumeOptions = createDictionaryConverter('ConsumeOptions', [
+  limitMember,
+  signalMember,
+]);
+converters.ConsumeSyncOptions = createDictionaryConverter(
+  'ConsumeSyncOptions', [limitMember]);
+const encodingMember = {
+  __proto__: null,
+  key: 'encoding',
+  converter: baseConverters.DOMString,
+  defaultValue: () => 'utf-8',
+};
+converters.TextConsumeOptions = createDictionaryConverter(
+  'TextConsumeOptions', [
+    [limitMember, signalMember],
+    [encodingMember],
+  ]);
+converters.TextConsumeSyncOptions = createDictionaryConverter(
+  'TextConsumeSyncOptions', [
+    [limitMember],
+    [encodingMember],
+  ]);
+converters.MergeOptions = createDictionaryConverter('MergeOptions', [
+  signalMember,
+]);
+converters.BroadcastOptions = createDictionaryConverter(
+  'BroadcastOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareOptions = createDictionaryConverter(
+  'ShareOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareSyncOptions = createDictionaryConverter(
+  'ShareSyncOptions', [budgetMember, backpressureMember]);
+converters.DuplexDirectionOptions = createDictionaryConverter(
+  'DuplexDirectionOptions', [
+    budgetMember,
+    {
+      __proto__: null,
+      key: 'backpressure',
+      converter: converters.BackpressurePolicy,
+    },
+  ]);
+converters.DuplexOptions = createDictionaryConverter('DuplexOptions', [
+  {
+    __proto__: null,
+    key: 'a',
+    converter: converters.DuplexDirectionOptions,
+  },
+  {
+    __proto__: null,
+    key: 'b',
+    converter: converters.DuplexDirectionOptions,
+  },
+  budgetMember,
+  backpressureMember,
+  signalMember,
+]);
+
+module.exports = { converters };
diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 56b819abac4f..847b3837af4c 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -138,6 +138,7 @@ const kHasPaused = 1 << 25;
 const kPaused = 1 << 26;
 const kDataListening = 1 << 27;
 const kEndScheduled = 1 << 28;
+const kEofReadablePending = 1 << 29;
 
 // TODO(benjamingr) it is likely slower to do it this way than with free functions
 function makeBitMapDescriptor(bit) {
@@ -682,7 +683,7 @@ Readable.prototype.read = function(n) {
     state.highWaterMark = computeNewHighWaterMark(n);
 
   if (n !== 0)
-    state[kState] &= ~kEmittedReadable;
+    state[kState] &= ~(kEmittedReadable | kEofReadablePending);
 
   // If we're doing read(0) to trigger a readable event, but we
   // already have a bunch of data in the buffer, then just trigger
@@ -825,7 +826,16 @@ function onEofChunk(stream, state) {
     // If we are sync, wait until next tick to emit the data.
     // Otherwise we risk emitting data in the flow()
     // the readable code triggers during a read() call.
-    emitReadable(stream);
+    if ((state[kState] & (kFlowing | kNeedReadable)) !== 0 ||
+        stream.listenerCount('readable') > 0) {
+      emitReadable(stream);
+    } else {
+      // Nobody is observing the stream: do not schedule the 'readable'
+      // emission at all. A 'readable' listener attached later redeems it
+      // (see Readable.prototype.on), and read() and resume() reach the
+      // end of the stream on their own.
+      state[kState] |= kEofReadablePending;
+    }
   } else {
     // Emit 'readable' now to make sure it gets picked up.
     state[kState] &= ~kNeedReadable;
@@ -1178,8 +1188,17 @@ Readable.prototype.on = function(ev, fn) {
       debug('on readable');
       if (state.length) {
         emitReadable(this);
-      } else if ((state[kState] & kReading) === 0) {
-        process.nextTick(nReadingNextTick, this);
+      } else {
+        if ((state[kState] & kEofReadablePending) !== 0) {
+          // The end-of-stream 'readable' emission was skipped because
+          // nobody was listening when the stream ended (see onEofChunk):
+          // emit it now.
+          state[kState] &= ~kEofReadablePending;
+          emitReadable(this);
+        }
+        if ((state[kState] & kReading) === 0) {
+          process.nextTick(nReadingNextTick, this);
+        }
       }
     }
   }
diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
index 1c6e0577ce3d..37fa7845843f 100644
--- a/lib/internal/tls/wrap.js
+++ b/lib/internal/tls/wrap.js
@@ -1322,7 +1322,7 @@ function onServerSocketSecure() {
 
       if (this._rejectUnauthorized)
         this.destroy();
-    } else if (!this._handle.getPeerX509Certificate()) {
+    } else if (!this._handle.hasPeerCertificate()) {
       // Ncrypto reports X509_V_OK for TLS 1.3 resumption without a peer
       // certificate, as it uses PSKs. Require one to authorize the socket.
       this.authorizationError = 'UNABLE_TO_GET_ISSUER_CERT';
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 6b608a66733a..92594e8994fb 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -15,6 +15,7 @@ const {
   Date,
   DatePrototypeGetTime,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Function,
@@ -50,7 +51,6 @@ const {
   Uint8ClampedArray,
   WeakMap,
   WeakSet,
-  globalThis: { Float16Array },
 } = primordials;
 
 const { compare } = internalBinding('buffer');
@@ -70,6 +70,7 @@ const wellKnownConstructors = new SafeSet()
   .add(DataView)
   .add(Date)
   .add(Error)
+  .add(Float16Array)
   .add(Float32Array)
   .add(Float64Array)
   .add(Function)
@@ -91,10 +92,6 @@ const wellKnownConstructors = new SafeSet()
   .add(WeakMap)
   .add(WeakSet);
 
-if (Float16Array) { // TODO(BridgeAR): Remove when Flag got removed from V8
-  wellKnownConstructors.add(Float16Array);
-}
-
 const types = require('internal/util/types');
 const {
   isAnyArrayBuffer,
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 1a029c7cf761..2e6c564cd3c4 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -1029,20 +1029,15 @@ function getPrefix(constructor, tag, fallback, size = '') {
     return `[${fallback}${size}: null prototype] `;
   }
 
-  let result = `${constructor}${size} `;
   if (tag !== '') {
-    const position = constructor.indexOf(tag);
-    if (position === -1) {
-      result += `[${tag}] `;
-    } else {
-      const endPos = position + tag.length;
-      if (endPos !== constructor.length &&
-        constructor[endPos] === constructor[endPos].toLowerCase()) {
-        result += `[${tag}] `;
-      }
+    const dot = StringPrototypeLastIndexOf(tag, '.');
+    if (constructor === (dot >= 1 ? StringPrototypeSlice(tag, dot + 1) : tag)) {
+      return `${tag}${size} `;
     }
+    return `${constructor}${size} [${tag}] `;
   }
-  return result;
+
+  return `${constructor}${size} `;
 }
 
 // Look up the keys of the object.
diff --git a/lib/internal/vfs/file_system.js b/lib/internal/vfs/file_system.js
index e47ed4c61080..574c076c426d 100644
--- a/lib/internal/vfs/file_system.js
+++ b/lib/internal/vfs/file_system.js
@@ -3,6 +3,7 @@
 const {
   MathRandom,
   ObjectFreeze,
+  StringPrototypeStartsWith,
   Symbol,
   SymbolDispose,
 } = primordials;
@@ -15,10 +16,10 @@ const {
 const { validateBoolean } = require('internal/validators');
 const { MemoryProvider } = require('internal/vfs/providers/memory');
 const path = require('path');
-const { posix: pathPosix, isAbsolute, resolve: resolvePath } = path;
+const { posix: pathPosix, resolve: resolvePath, sep, toNamespacedPath } = path;
 const { join: joinPath } = pathPosix;
 const {
-  isUnderMountPoint,
+  getLayerRoot,
   getRelativePath,
 } = require('internal/vfs/router');
 const {
@@ -38,13 +39,30 @@ let debug = require('internal/util/debuglog').debuglog('vfs', (fn) => {
   debug = fn;
 });
 
-// Private symbols
 const kProvider = Symbol('kProvider');
 const kMountPoint = Symbol('kMountPoint');
+// Cached normalizeMountedPath(kMountPoint) so the hot dispatch path
+// does not recompute toNamespacedPath(resolve(...)) on every fs call.
+const kNormalizedMountPoint = Symbol('kNormalizedMountPoint');
 const kMounted = Symbol('kMounted');
 const kPromises = Symbol('kPromises');
+const kLayerId = Symbol('kLayerId');
+
+let nextLayerId = 0;
+
+/**
+ * Normalizes paths for mount-point comparisons. On Windows, `path.resolve('/x')`
+ * yields `C:\x`, while loader internals often pass namespaced paths like
+ * `\\?\C:\x`. Compare using a single canonical representation so POSIX-style
+ * rooted test paths, drive-absolute paths, and namespaced paths all route to the
+ * same VFS mount.
+ * @param {string} inputPath
+ * @returns {string}
+ */
+function normalizeMountedPath(inputPath) {
+  return toNamespacedPath(resolvePath(inputPath));
+}
 
-// Lazy-loaded VFS setup
 let registerVFS;
 let deregisterVFS;
 
@@ -68,15 +86,11 @@ class VirtualFileSystem {
    * @param {boolean} [options.emitExperimentalWarning] Emit the experimental warning (default: true)
    */
   constructor(providerOrOptions, options = kEmptyObject) {
-
-    // Handle case where first arg is options object (no provider)
     let provider = null;
     if (providerOrOptions !== undefined && providerOrOptions !== null) {
       if (typeof providerOrOptions.openSync === 'function') {
-        // It's a provider
         provider = providerOrOptions;
       } else if (typeof providerOrOptions === 'object') {
-        // It's options (no provider specified)
         options = providerOrOptions;
         provider = null;
       }
@@ -92,8 +106,10 @@ class VirtualFileSystem {
 
     this[kProvider] = provider ?? new MemoryProvider();
     this[kMountPoint] = null;
+    this[kNormalizedMountPoint] = null;
     this[kMounted] = false;
-    this[kPromises] = null; // Lazy-initialized
+    this[kPromises] = null;
+    this[kLayerId] = nextLayerId++;
   }
 
   /**
@@ -112,6 +128,17 @@ class VirtualFileSystem {
     return this[kMountPoint];
   }
 
+  /**
+   * Gets the mount point as a `file:` URL string, or null if not
+   * mounted.
+   * @returns {string|null}
+   */
+  get mountPointURL() {
+    if (this[kMountPoint] === null) return null;
+    const { pathToFileURL } = require('internal/url');
+    return pathToFileURL(this[kMountPoint]).href;
+  }
+
   /**
    * Returns true if VFS is mounted.
    * @returns {boolean}
@@ -128,23 +155,28 @@ class VirtualFileSystem {
     return this[kProvider].readonly;
   }
 
-  // ==================== Mount ====================
-
   /**
-   * Mounts the VFS at a specific path prefix.
-   * @param {string} prefix The mount point path
-   * @returns {VirtualFileSystem} The VFS instance for chaining
+   * Mounts the VFS at its reserved mount point and returns that
+   * mount point. The mount point is `${os.devNull}/vfs/<layerId>` -
+   * a location that cannot exist on the real file system (`os.devNull`
+   * is a character device on POSIX and a device-namespace path on
+   * Windows; neither can have child filesystem entries) - so virtual
+   * paths never conflate with real paths, and the owning layer of any
+   * path is decidable from the path alone.
+   * @returns {string} The absolute mount point
    */
-  mount(prefix) {
+  mount() {
     if (this[kMounted]) {
       throw new ERR_INVALID_STATE('VFS is already mounted');
     }
-    this[kMountPoint] = resolvePath(prefix);
+    const mountPoint = getLayerRoot(this[kLayerId]);
+    this[kMountPoint] = mountPoint;
+    this[kNormalizedMountPoint] = normalizeMountedPath(mountPoint);
     this[kMounted] = true;
-    debug('mount %s', this[kMountPoint]);
+    debug('mount %s', mountPoint);
     loadVfsSetup();
     registerVFS(this);
-    return this;
+    return mountPoint;
   }
 
   /**
@@ -155,6 +187,7 @@ class VirtualFileSystem {
     loadVfsSetup();
     deregisterVFS(this);
     this[kMountPoint] = null;
+    this[kNormalizedMountPoint] = null;
     this[kMounted] = false;
   }
 
@@ -169,20 +202,21 @@ class VirtualFileSystem {
   }
 
   /**
-   * Checks if a path should be handled by this VFS.
-   * @param {string} inputPath The path to check (must be absolute & normalized)
+   * Returns true when `normalizedInput` falls inside this VFS's
+   * reserved mount point. The caller must have already passed the
+   * input through `normalizeMountedPath`; the dispatch loop in
+   * `internal/vfs/setup.js` normalizes once and hands the same value
+   * to every candidate layer.
+   * @param {string} normalizedInput
    * @returns {boolean}
    */
-  shouldHandle(inputPath) {
-    if (!this[kMounted] || !this[kMountPoint]) {
-      return false;
-    }
-    const normalized = isAbsolute(inputPath) ? inputPath : resolvePath(inputPath);
-    return isUnderMountPoint(normalized, this[kMountPoint]);
+  shouldHandleNormalized(normalizedInput) {
+    const mountPoint = this[kNormalizedMountPoint];
+    if (mountPoint === null) return false;
+    if (normalizedInput === mountPoint) return true;
+    return StringPrototypeStartsWith(normalizedInput, mountPoint + sep);
   }
 
-  // ==================== Path Resolution ====================
-
   /**
    * Converts an absolute mounted path to a provider-relative POSIX path.
    * If not mounted, treats the path as already provider-relative.
@@ -190,12 +224,13 @@ class VirtualFileSystem {
    * @returns {string}
    */
   #toProviderPath(inputPath) {
-    if (this[kMounted] && this[kMountPoint]) {
-      const resolved = isAbsolute(inputPath) ? inputPath : resolvePath(inputPath);
-      if (!isUnderMountPoint(resolved, this[kMountPoint])) {
+    const mountPoint = this[kNormalizedMountPoint];
+    if (mountPoint !== null) {
+      const resolved = normalizeMountedPath(inputPath);
+      if (!this.shouldHandleNormalized(resolved)) {
         throw createENOENT('open', inputPath);
       }
-      return getRelativePath(resolved, this[kMountPoint]);
+      return getRelativePath(resolved, mountPoint);
     }
     return pathPosix.normalize(inputPath);
   }
@@ -213,8 +248,6 @@ class VirtualFileSystem {
     return providerPath;
   }
 
-  // ==================== FS Operations (Sync) ====================
-
   /**
    * Checks if a path exists synchronously.
    * @param {string} filePath The path to check
@@ -294,14 +327,13 @@ class VirtualFileSystem {
     const providerPath = this.#toProviderPath(dirPath);
     const result = this[kProvider].readdirSync(providerPath, options);
 
-    // Fix Dirent parentPath from provider-relative to actual VFS path
+    // Rewrite Dirent parentPath from provider-relative to VFS path.
     if (options?.withFileTypes === true) {
       const recursive = options?.recursive === true;
       for (let i = 0; i < result.length; i++) {
         const dirent = result[i];
         if (recursive) {
           // In recursive mode, name may contain slashes (e.g. 'a/b.txt').
-          // Fix to basename only and set correct parentPath.
           const slashIdx = dirent.name.lastIndexOf('/');
           if (slashIdx !== -1) {
             const subdir = dirent.name.slice(0, slashIdx);
@@ -454,8 +486,6 @@ class VirtualFileSystem {
     }
   }
 
-  // ==================== Additional Sync Operations ====================
-
   /**
    * Truncates a file synchronously.
    * @param {string} filePath The file path
@@ -528,7 +558,6 @@ class VirtualFileSystem {
    */
   mkdtempSync(prefix) {
     const providerPrefix = this.#toProviderPath(prefix);
-    // Generate random 6-character suffix like Node does
     const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
     let suffix = '';
     for (let i = 0; i < 6; i++) {
@@ -567,8 +596,6 @@ class VirtualFileSystem {
     return new Blob([content], { type });
   }
 
-  // ==================== File Descriptor Operations ====================
-
   /**
    * Opens a file synchronously and returns a file descriptor.
    * @param {string} filePath The path to open
@@ -643,8 +670,6 @@ class VirtualFileSystem {
     return vfd.entry.statSync(options);
   }
 
-  // ==================== FS Operations (Async with Callbacks) ====================
-
   /**
    * Reads a file asynchronously.
    * @param {string} filePath The path to read
@@ -991,8 +1016,6 @@ class VirtualFileSystem {
     }
   }
 
-  // ==================== Stream Operations ====================
-
   /**
    * Creates a readable stream for a virtual file.
    * @param {string} filePath The path to the file
@@ -1013,8 +1036,6 @@ class VirtualFileSystem {
     return new VirtualWriteStream(this, filePath, options);
   }
 
-  // ==================== Watch Operations ====================
-
   /**
    * Watches a file or directory for changes.
    * @param {string} filePath The path to watch
@@ -1065,8 +1086,6 @@ class VirtualFileSystem {
     this[kProvider].unwatchFile(providerPath, listener);
   }
 
-  // ==================== Promise API ====================
-
   /**
    * Gets the promises API for this VFS instance.
    * @returns {object} Promise-based fs methods
@@ -1085,7 +1104,7 @@ class VirtualFileSystem {
   #createPromisesAPI() {
     const provider = this[kProvider];
 
-    // Use arrow function to capture `this` for private method access
+    // Arrow functions capture `this` for private method access.
     const toProviderPath = (p) => this.#toProviderPath(p);
     const toMountedPath = (p) => this.#toMountedPath(p);
 
@@ -1273,4 +1292,6 @@ class VirtualFileSystem {
 
 module.exports = {
   VirtualFileSystem,
+  kLayerId,
+  normalizeMountedPath,
 };
diff --git a/lib/internal/vfs/providers/memory.js b/lib/internal/vfs/providers/memory.js
index acec5b4166b2..ce59a0611616 100644
--- a/lib/internal/vfs/providers/memory.js
+++ b/lib/internal/vfs/providers/memory.js
@@ -840,6 +840,10 @@ class MemoryProvider extends VirtualProvider {
 
     // Check if destination exists
     const existingDest = newParent.children.get(newName);
+    if (existingDest === entry) {
+      // Both names resolve to the same entry: rename does nothing
+      return;
+    }
     if (existingDest) {
       // Cannot overwrite a directory with a non-directory
       if (existingDest.isDirectory() && !entry.isDirectory()) {
@@ -849,6 +853,15 @@ class MemoryProvider extends VirtualProvider {
       if (!existingDest.isDirectory() && entry.isDirectory()) {
         throw createENOTDIR('rename', newPath);
       }
+      if (existingDest.isDirectory()) {
+        this.#ensurePopulated(existingDest, normalizedNew);
+        // Cannot overwrite a non-empty directory
+        if (existingDest.children.size > 0) {
+          throw createENOTEMPTY('rename', newPath);
+        }
+      } else {
+        existingDest.nlink--;
+      }
     }
 
     // Remove from old location (after destination validation)
diff --git a/lib/internal/vfs/providers/sea.js b/lib/internal/vfs/providers/sea.js
new file mode 100644
index 000000000000..4a03246c271b
--- /dev/null
+++ b/lib/internal/vfs/providers/sea.js
@@ -0,0 +1,349 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayPrototypeFilter,
+  ArrayPrototypePop,
+  ArrayPrototypePush,
+  Boolean,
+  ObjectKeys,
+  SafeMap,
+  SafeSet,
+  StringPrototypeReplaceAll,
+  StringPrototypeSplit,
+  StringPrototypeStartsWith,
+  Symbol,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+const { posix: pathPosix } = require('path');
+const { VirtualProvider } = require('internal/vfs/provider');
+const { MemoryFileHandle } = require('internal/vfs/file_handle');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const {
+  createENOENT,
+  createENOTDIR,
+  createEISDIR,
+  createEROFS,
+} = require('internal/vfs/errors');
+const {
+  createFileStats,
+  createDirectoryStats,
+} = require('internal/vfs/stats');
+const { Dirent } = require('internal/fs/utils');
+const { kEmptyObject } = require('internal/util');
+const {
+  fs: {
+    UV_DIRENT_FILE,
+    UV_DIRENT_DIR,
+  },
+} = internalBinding('constants');
+
+// Private symbols
+const kAssets = Symbol('kAssets');
+const kExtraFiles = Symbol('kExtraFiles');
+const kDirectories = Symbol('kDirectories');
+const kGetAsset = Symbol('kGetAsset');
+const kSizes = Symbol('kSizes');
+
+/* c8 ignore start -- the SEA provider requires an actual SEA binary to run */
+
+/**
+ * Read-only provider serving the assets bundled into a Single Executable
+ * Application. Asset content stays in the executable's SEA blob and is
+ * copied into JS memory only when a file is opened.
+ */
+class SEAProvider extends VirtualProvider {
+  /**
+   * @param {object} [options] Options
+   * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+   *   files to serve alongside the assets, keyed by path (used for the SEA
+   *   main script, whose source lives in the SEA blob but not in the assets)
+   */
+  constructor(options = kEmptyObject) {
+    super();
+
+    const { isSea, getAsset, getAssetKeys } = internalBinding('sea');
+
+    if (!isSea()) {
+      throw new ERR_INVALID_STATE(
+        'SEAProvider can only be used in a Single Executable Application');
+    }
+
+    this[kGetAsset] = getAsset;
+    // Map of normalized path -> asset key
+    this[kAssets] = new SafeMap();
+    // Map of normalized path -> Buffer content
+    this[kExtraFiles] = new SafeMap();
+    // Map of directory path -> SafeSet of child names
+    this[kDirectories] = new SafeMap();
+    // Cache of file sizes so stat does not have to copy asset content
+    this[kSizes] = new SafeMap();
+
+    // Root directory always exists
+    this[kDirectories].set('/', new SafeSet());
+
+    const keys = getAssetKeys() || [];
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      this[kAssets].set(this.#normalizePath(key), key);
+    }
+    const extraFiles = options.extraFiles;
+    if (extraFiles !== undefined) {
+      const paths = ObjectKeys(extraFiles);
+      for (let i = 0; i < paths.length; i++) {
+        const path = paths[i];
+        const content = extraFiles[path];
+        const buffer = typeof content === 'string' ?
+          Buffer.from(content) : content;
+        const normalized = this.#normalizePath(path);
+        this[kExtraFiles].set(normalized, buffer);
+        this[kSizes].set(normalized, buffer.length);
+      }
+    }
+
+    // Derive the directory tree from the file paths
+    for (const path of this.#filePaths()) {
+      const parts = ArrayPrototypeFilter(
+        StringPrototypeSplit(path, '/'), Boolean);
+      let currentPath = '/';
+      for (let i = 0; i < parts.length - 1; i++) {
+        const parentPath = currentPath;
+        currentPath = pathPosix.join(currentPath, parts[i]);
+        if (!this[kDirectories].has(currentPath)) {
+          this[kDirectories].set(currentPath, new SafeSet());
+        }
+        this[kDirectories].get(parentPath).add(parts[i]);
+      }
+      if (parts.length > 0) {
+        this[kDirectories].get(pathPosix.dirname(path)).add(
+          pathPosix.basename(path));
+      }
+    }
+  }
+
+  get readonly() {
+    return true;
+  }
+
+  get supportsSymlinks() {
+    return false;
+  }
+
+  /**
+   * Iterates over the normalized paths of all files.
+   * @yields {string} The normalized path of each file
+   */
+  * #filePaths() {
+    yield* this[kAssets].keys();
+    yield* this[kExtraFiles].keys();
+  }
+
+  /**
+   * Normalizes a path to an absolute posix-style path.
+   * @param {string} path The path
+   * @returns {string} Normalized path
+   */
+  #normalizePath(path) {
+    let normalized = StringPrototypeReplaceAll(path, '\\', '/');
+    if (!StringPrototypeStartsWith(normalized, '/')) {
+      normalized = '/' + normalized;
+    }
+    return pathPosix.normalize(normalized);
+  }
+
+  /**
+   * Checks if a normalized path is a file.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isFile(path) {
+    return this[kAssets].has(path) || this[kExtraFiles].has(path);
+  }
+
+  /**
+   * Checks if a normalized path is a directory.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isDirectory(path) {
+    return this[kDirectories].has(path);
+  }
+
+  /**
+   * Gets the file content as an independently mutable Buffer.
+   * @param {string} path Normalized path
+   * @returns {Buffer}
+   */
+  #getContent(path) {
+    const extra = this[kExtraFiles].get(path);
+    if (extra !== undefined) {
+      return Buffer.from(extra);
+    }
+    const key = this[kAssets].get(path);
+    if (key === undefined) {
+      throw createENOENT('open', path);
+    }
+    // getAsset returns a zero-copy ArrayBuffer over the (possibly read-only)
+    // SEA blob in the executable; copy it so the handle owns mutable memory.
+    const content = Buffer.from(new Uint8Array(this[kGetAsset](key)));
+    this[kSizes].set(path, content.length);
+    return content;
+  }
+
+  /**
+   * Gets the size of a file, loading the content only on first access.
+   * @param {string} path Normalized path
+   * @returns {number}
+   */
+  #getSize(path) {
+    let size = this[kSizes].get(path);
+    if (size === undefined) {
+      size = this.#getContent(path).length;
+    }
+    return size;
+  }
+
+  openSync(path, flags, mode) {
+    // Normalize numeric flags (O_RDONLY === 0) to a string
+    const normalizedFlags = typeof flags === 'number' ?
+      (flags === 0 ? 'r' : null) : flags;
+    if (normalizedFlags !== 'r') {
+      throw createEROFS('open', path);
+    }
+
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      throw createEISDIR('open', path);
+    }
+    if (!this.#isFile(normalized)) {
+      throw createENOENT('open', path);
+    }
+
+    const content = this.#getContent(normalized);
+    const getStats = () => createFileStats(content.length, { mode: 0o444 });
+    return new MemoryFileHandle(normalized, 'r', 0o444, content, null,
+                                getStats);
+  }
+
+  async open(path, flags, mode) {
+    return this.openSync(path, flags, mode);
+  }
+
+  statSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      return createDirectoryStats({ mode: 0o555, bigint: options?.bigint });
+    }
+    if (this.#isFile(normalized)) {
+      return createFileStats(this.#getSize(normalized),
+                             { mode: 0o444, bigint: options?.bigint });
+    }
+    throw createENOENT('stat', path);
+  }
+
+  async stat(path, options) {
+    return this.statSync(path, options);
+  }
+
+  readdirSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (!this.#isDirectory(normalized)) {
+      if (this.#isFile(normalized)) {
+        throw createENOTDIR('scandir', path);
+      }
+      throw createENOENT('scandir', path);
+    }
+
+    const withFileTypes = options?.withFileTypes === true;
+    const recursive = options?.recursive === true;
+
+    if (recursive) {
+      return this.#readdirRecursive(normalized, withFileTypes);
+    }
+
+    const names = ArrayFrom(this[kDirectories].get(normalized));
+    if (!withFileTypes) {
+      return names;
+    }
+
+    const dirents = [];
+    for (let i = 0; i < names.length; i++) {
+      const childPath = pathPosix.join(normalized, names[i]);
+      const type = this.#isDirectory(childPath) ?
+        UV_DIRENT_DIR : UV_DIRENT_FILE;
+      ArrayPrototypePush(dirents, new Dirent(names[i], type, normalized));
+    }
+    return dirents;
+  }
+
+  /**
+   * Recursively reads directory contents.
+   * @param {string} dirPath The normalized directory path
+   * @param {boolean} withFileTypes Whether to return Dirent objects
+   * @returns {string[]|Dirent[]}
+   */
+  #readdirRecursive(dirPath, withFileTypes) {
+    const results = [];
+
+    // Traverse depth-first in preorder with an explicit frame stack, so a
+    // deeply nested asset tree cannot exhaust the call stack.
+    const stack = [{
+      path: dirPath,
+      relative: '',
+      children: ArrayFrom(this[kDirectories].get(dirPath)),
+      index: 0,
+    }];
+
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1];
+      if (frame.index >= frame.children.length) {
+        ArrayPrototypePop(stack);
+        continue;
+      }
+
+      const name = frame.children[frame.index++];
+      const childPath = pathPosix.join(frame.path, name);
+      const childRelative = frame.relative ?
+        `${frame.relative}/${name}` : name;
+      const isDir = this.#isDirectory(childPath);
+
+      if (withFileTypes) {
+        const type = isDir ? UV_DIRENT_DIR : UV_DIRENT_FILE;
+        ArrayPrototypePush(results,
+                           new Dirent(childRelative, type, dirPath));
+      } else {
+        ArrayPrototypePush(results, childRelative);
+      }
+
+      if (isDir) {
+        ArrayPrototypePush(stack, {
+          path: childPath,
+          relative: childRelative,
+          children: ArrayFrom(this[kDirectories].get(childPath)),
+          index: 0,
+        });
+      }
+    }
+
+    return results;
+  }
+
+  async readdir(path, options) {
+    return this.readdirSync(path, options);
+  }
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  SEAProvider,
+};
diff --git a/lib/internal/vfs/providers/ziparchive.js b/lib/internal/vfs/providers/ziparchive.js
new file mode 100644
index 000000000000..f369cdd22f76
--- /dev/null
+++ b/lib/internal/vfs/providers/ziparchive.js
@@ -0,0 +1,580 @@
+'use strict';
+
+const {
+  ArrayPrototypeIndexOf,
+  ArrayPrototypePush,
+  MathMax,
+  MathMin,
+  StringPrototypeIndexOf,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+  SymbolAsyncDispose,
+  SymbolDispose,
+} = primordials;
+
+const { Buffer } = require('buffer');
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_METHOD_NOT_IMPLEMENTED,
+  },
+} = require('internal/errors');
+const { VirtualProvider } = require('internal/vfs/provider');
+const { VirtualFileHandle } = require('internal/vfs/file_handle');
+const {
+  createEEXIST,
+  createEISDIR,
+  createENOENT,
+  createENOTDIR,
+  createENOTEMPTY,
+  createEROFS,
+} = require('internal/vfs/errors');
+const { createFileStats, createDirectoryStats } = require('internal/vfs/stats');
+const { Dirent } = require('internal/fs/utils');
+const {
+  fs: {
+    O_APPEND,
+    O_CREAT,
+    O_EXCL,
+    O_RDWR,
+    O_TRUNC,
+    O_WRONLY,
+    UV_DIRENT_DIR,
+    UV_DIRENT_FILE,
+  },
+} = internalBinding('constants');
+const { ZipBuffer, ZipFile } = require('internal/zip');
+
+const EMPTY_BUFFER = Buffer.alloc(0);
+
+function normalize(vfsPath) {
+  return StringPrototypeStartsWith(vfsPath, '/') ? StringPrototypeSlice(vfsPath, 1) : vfsPath;
+}
+
+// Converts numeric open flags (e.g. `fs.constants.O_RDWR`) to the flag strings
+// the helpers below understand, so a caller passing `node:fs`-style numeric
+// flags through the VFS is handled the same way `fs` would. Strings pass
+// through unchanged; anything else falls back to 'r'.
+function normalizeFlags(flags) {
+  if (typeof flags === 'string') return flags;
+  if (typeof flags !== 'number') return 'r';
+  const rdwr = (flags & O_RDWR) !== 0;
+  const append = (flags & O_APPEND) !== 0;
+  const excl = (flags & O_EXCL) !== 0;
+  const write = (flags & O_WRONLY) !== 0 || (flags & O_CREAT) !== 0 || (flags & O_TRUNC) !== 0;
+  if (append) return 'a' + (excl ? 'x' : '') + (rdwr ? '+' : '');
+  if (write) return 'w' + (excl ? 'x' : '') + (rdwr ? '+' : '');
+  if (rdwr) return 'r+';
+  return 'r';
+}
+
+function isCurrentPosition(position) {
+  return position === null || position === undefined || position === -1;
+}
+
+function isWriteTruncate(flags) {
+  return flags === 'w' || flags === 'w+' || flags === 'wx' || flags === 'wx+';
+}
+
+function isAppend(flags) {
+  return flags === 'a' || flags === 'a+' || flags === 'ax' || flags === 'ax+';
+}
+
+function isReadableFlag(flags) {
+  return flags !== 'w' && flags !== 'a' && flags !== 'wx' && flags !== 'ax';
+}
+
+function isWritableFlag(flags) {
+  return flags !== 'r';
+}
+
+/**
+ * The `options.method` value that reproduces `method` (a `zipEntry.method`
+ * raw compression method number) on `add()`/`addSync()`, so `rename()`
+ * doesn't silently recompress an entry with a different method than the one
+ * it already had (e.g. turning a zstd-compressed entry into a stored one).
+ * @param {number} method
+ * @returns {'store' | 'zstd' | 'deflate'}
+ */
+function methodOption(method) {
+  if (method === 0) return 'store';
+  if (method === 93) return 'zstd';
+  return 'deflate';
+}
+
+/**
+ * A file handle over one ZIP entry. ZIP members can't be edited in place
+ * (they're a single compressed blob), so writes accumulate in memory and are
+ * only committed - as a brand-new entry - when the handle is closed. Since
+ * this is all in-memory buffer manipulation with no real I/O, every method
+ * and its `*Sync` counterpart share one private implementation.
+ */
+class ZipFileHandle extends VirtualFileHandle {
+  #source;
+  #name;
+  #buffer;
+  #size;
+  #dirty = false;
+
+  /**
+   * @param {string} path
+   * @param {string} flags
+   * @param {number} mode
+   * @param {ZipBuffer | ZipFile} source
+   * @param {string} name The archive-relative entry name
+   * @param {Buffer} initial The entry's current decompressed content, or an
+   *   empty buffer for a new/truncated file
+   */
+  constructor(path, flags, mode, source, name, initial) {
+    super(path, flags, mode);
+    this.#source = source;
+    this.#name = name;
+    this.#buffer = initial;
+    this.#size = initial.length;
+    if (isAppend(flags)) this.position = this.#size;
+  }
+
+  #checkReadable() {
+    if (!isReadableFlag(this.flags)) throw createEISDIR('read', this.path);
+  }
+  #checkWritable() {
+    if (!isWritableFlag(this.flags)) throw createEISDIR('write', this.path);
+  }
+  #ensureCapacity(size) {
+    if (size <= this.#buffer.length) return;
+    const capacity = MathMax(size, this.#buffer.length * 2);
+    const grown = Buffer.alloc(capacity);
+    this.#buffer.copy(grown, 0, 0, this.#size);
+    this.#buffer = grown;
+  }
+
+  #doRead(buffer, offset, length, position) {
+    this.#checkReadable();
+    const useCurrent = isCurrentPosition(position);
+    const pos = useCurrent ? this.position : position;
+    const available = MathMax(0, this.#size - pos);
+    const bytesRead = MathMin(length, available);
+    if (bytesRead > 0) this.#buffer.copy(buffer, offset, pos, pos + bytesRead);
+    if (useCurrent) this.position = pos + bytesRead;
+    return { __proto__: null, bytesRead, buffer };
+  }
+  async read(buffer, offset, length, position) {
+    return this.#doRead(buffer, offset, length, position);
+  }
+  readSync(buffer, offset, length, position) {
+    return this.#doRead(buffer, offset, length, position);
+  }
+
+  #doWrite(buffer, offset, length, position) {
+    this.#checkWritable();
+    const useCurrent = isCurrentPosition(position);
+    const pos = isAppend(this.flags) ? this.#size : (useCurrent ? this.position : position);
+    this.#ensureCapacity(pos + length);
+    buffer.copy(this.#buffer, pos, offset, offset + length);
+    if (pos + length > this.#size) this.#size = pos + length;
+    this.#dirty = true;
+    if (useCurrent) this.position = pos + length;
+    return { __proto__: null, bytesWritten: length, buffer };
+  }
+  async write(buffer, offset, length, position) {
+    return this.#doWrite(buffer, offset, length, position);
+  }
+  writeSync(buffer, offset, length, position) {
+    return this.#doWrite(buffer, offset, length, position);
+  }
+
+  #doReadFile(options) {
+    this.#checkReadable();
+    const encoding = typeof options === 'string' ? options : options?.encoding;
+    const content = this.#buffer.subarray(0, this.#size);
+    return encoding && encoding !== 'buffer' ? content.toString(encoding) : Buffer.from(content);
+  }
+  async readFile(options) {
+    return this.#doReadFile(options);
+  }
+  readFileSync(options) {
+    return this.#doReadFile(options);
+  }
+
+  // Replaces content, except in append mode ('a'/'a+'/'ax'/'ax+'), where it
+  // appends to the existing content instead - matching MemoryFileHandle and
+  // what makes `appendFile()`/`appendFileSync()` (built on this, by
+  // VirtualProvider's defaults) actually append.
+  #doWriteFile(data, options) {
+    this.#checkWritable();
+    const content = typeof data === 'string' ? Buffer.from(data, options?.encoding) : Buffer.from(data);
+    if (isAppend(this.flags)) {
+      this.#ensureCapacity(this.#size + content.length);
+      content.copy(this.#buffer, this.#size);
+      this.#size += content.length;
+    } else {
+      this.#buffer = content;
+      this.#size = content.length;
+    }
+    this.#dirty = true;
+  }
+  async writeFile(data, options) {
+    this.#doWriteFile(data, options);
+  }
+  writeFileSync(data, options) {
+    this.#doWriteFile(data, options);
+  }
+
+  #doStat() {
+    return createFileStats(this.#size, { mode: this.mode });
+  }
+  async stat(options) {
+    return this.#doStat();
+  }
+  statSync(options) {
+    return this.#doStat();
+  }
+
+  #doTruncate(len) {
+    this.#checkWritable();
+    this.#ensureCapacity(len);
+    this.#size = len;
+    this.#dirty = true;
+  }
+  async truncate(len = 0) {
+    this.#doTruncate(len);
+  }
+  truncateSync(len = 0) {
+    this.#doTruncate(len);
+  }
+
+  async close() {
+    if (this.#dirty && isWritableFlag(this.flags)) {
+      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+    }
+    await super.close();
+  }
+  closeSync() {
+    if (this.#dirty && isWritableFlag(this.flags)) {
+      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+    }
+    super.closeSync();
+  }
+}
+
+/**
+ * A `node:vfs` provider backed by a ZIP archive: either a [`ZipBuffer`][] (in
+ * memory) or a [`ZipFile`][] (on disk). Read-only unless the underlying
+ * archive is writable (a `ZipBuffer`, or a `ZipFile` opened with
+ * `{ writable: true }`). Every method has a synchronous counterpart, backed
+ * by the equally complete synchronous surface `ZipBuffer`/`ZipFile` expose;
+ * as with those, the synchronous methods here block the Node.js event loop
+ * and further JavaScript execution until the operation (including any
+ * deflate/inflate pass) completes.
+ */
+class ZipProvider extends VirtualProvider {
+  #source;
+
+  /**
+   * @param {ZipBuffer | ZipFile} source
+   */
+  constructor(source) {
+    super();
+    if (!(source instanceof ZipBuffer) && !(source instanceof ZipFile)) {
+      throw new ERR_INVALID_ARG_TYPE('source', ['ZipBuffer', 'ZipFile'], source);
+    }
+    this.#source = source;
+  }
+
+  get readonly() { return !this.#source.writable; }
+
+  /**
+   * @param {string} name
+   * @returns {Promise<import('internal/zip').ZipEntry | null>}
+   */
+  async #getEntry(name) {
+    return this.#source.has(name) ? this.#source.get(name) : null;
+  }
+  /**
+   * @param {string} name
+   * @returns {import('internal/zip').ZipEntry | null}
+   */
+  #getEntrySync(name) {
+    if (!this.#source.has(name)) return null;
+    // `ZipBuffer.prototype.get` is already synchronous (it has no `getSync`
+    // of its own); `ZipFile.prototype.get` is asynchronous, so its `getSync`
+    // is used instead when present.
+    return typeof this.#source.getSync === 'function' ?
+      this.#source.getSync(name) : this.#source.get(name);
+  }
+  /**
+   * @param {string} name
+   * @returns {boolean}
+   */
+  #deleteEntrySync(name) {
+    // Same reasoning as `#getEntrySync`: `ZipBuffer.prototype.delete` is
+    // already synchronous; `ZipFile.prototype.delete` is not, so its
+    // `deleteSync` is used instead when present.
+    return typeof this.#source.deleteSync === 'function' ?
+      this.#source.deleteSync(name) : this.#source.delete(name);
+  }
+
+  /**
+   * Whether `name` (no trailing slash) is a directory: either explicitly
+   * (a `"name/"` entry) or implicitly (some entry starts with `"name/"`).
+   * @param {string} name
+   * @returns {boolean}
+   */
+  #isDirectory(name) {
+    const prefix = `${name}/`;
+    if (this.#source.has(prefix)) return true;
+    for (const key of this.#source.keys()) {
+      if (StringPrototypeStartsWith(key, prefix)) return true;
+    }
+    return false;
+  }
+
+  async open(path, flags, mode) {
+    flags = normalizeFlags(flags);
+    const name = normalize(path);
+    const fileEntry = await this.#getEntry(name);
+    if (fileEntry === null && this.#isDirectory(name)) {
+      throw createEISDIR('open', path);
+    }
+    const exists = fileEntry !== null;
+    if (isWritableFlag(flags) && this.readonly) {
+      throw createEROFS('open', path);
+    }
+    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+      throw createEEXIST('open', path);
+    }
+    if (!exists && (flags === 'r' || flags === 'r+')) {
+      throw createENOENT('open', path);
+    }
+    let initial = EMPTY_BUFFER;
+    if (exists && !isWriteTruncate(flags)) {
+      initial = await fileEntry.content();
+    }
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+  }
+  openSync(path, flags, mode) {
+    flags = normalizeFlags(flags);
+    const name = normalize(path);
+    const fileEntry = this.#getEntrySync(name);
+    if (fileEntry === null && this.#isDirectory(name)) {
+      throw createEISDIR('open', path);
+    }
+    const exists = fileEntry !== null;
+    if (isWritableFlag(flags) && this.readonly) {
+      throw createEROFS('open', path);
+    }
+    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+      throw createEEXIST('open', path);
+    }
+    if (!exists && (flags === 'r' || flags === 'r+')) {
+      throw createENOENT('open', path);
+    }
+    let initial = EMPTY_BUFFER;
+    if (exists && !isWriteTruncate(flags)) {
+      initial = fileEntry.contentSync();
+    }
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+  }
+
+  async stat(path, options) {
+    const name = normalize(path);
+    if (name === '') return createDirectoryStats({ mode: 0o755 });
+    const entry = await this.#getEntry(name) ?? await this.#getEntry(`${name}/`);
+    if (entry !== null) {
+      return entry.isDirectory ?
+        createDirectoryStats({ mode: entry.mode || 0o755, mtimeMs: entry.modified.getTime() }) :
+        createFileStats(entry.size, { mode: entry.mode || 0o644, mtimeMs: entry.modified.getTime() });
+    }
+    if (this.#isDirectory(name)) return createDirectoryStats({ mode: 0o755 });
+    throw createENOENT('stat', path);
+  }
+  statSync(path, options) {
+    const name = normalize(path);
+    if (name === '') return createDirectoryStats({ mode: 0o755 });
+    const entry = this.#getEntrySync(name) ?? this.#getEntrySync(`${name}/`);
+    if (entry !== null) {
+      return entry.isDirectory ?
+        createDirectoryStats({ mode: entry.mode || 0o755, mtimeMs: entry.modified.getTime() }) :
+        createFileStats(entry.size, { mode: entry.mode || 0o644, mtimeMs: entry.modified.getTime() });
+    }
+    if (this.#isDirectory(name)) return createDirectoryStats({ mode: 0o755 });
+    throw createENOENT('stat', path);
+  }
+
+  #readdirEntries(path, name, options, stats) {
+    if (!stats.isDirectory()) throw createENOTDIR('scandir', path);
+    const prefix = name === '' ? '' : `${name}/`;
+    const withFileTypes = options?.withFileTypes === true;
+    const names = [];
+    const isDir = [];
+    for (const key of this.#source.keys()) {
+      if (!StringPrototypeStartsWith(key, prefix)) continue;
+      const rest = StringPrototypeSlice(key, prefix.length);
+      if (rest === '') continue; // The directory's own explicit entry
+      const slash = StringPrototypeIndexOf(rest, '/');
+      const childName = slash === -1 ? rest : StringPrototypeSlice(rest, 0, slash);
+      const childIsDir = slash !== -1;
+      const existingIndex = ArrayPrototypeIndexOf(names, childName);
+      if (existingIndex !== -1) {
+        if (childIsDir) isDir[existingIndex] = true;
+        continue;
+      }
+      ArrayPrototypePush(names, childName);
+      ArrayPrototypePush(isDir, childIsDir);
+    }
+    const result = [];
+    for (let i = 0; i < names.length; i++) {
+      if (withFileTypes) {
+        ArrayPrototypePush(result, new Dirent(names[i], isDir[i] ? UV_DIRENT_DIR : UV_DIRENT_FILE, name));
+      } else {
+        ArrayPrototypePush(result, names[i]);
+      }
+    }
+    return result;
+  }
+  async readdir(path, options) {
+    if (options?.recursive) {
+      throw new ERR_METHOD_NOT_IMPLEMENTED('readdir with { recursive: true } on a ZipProvider');
+    }
+    const name = normalize(path);
+    return this.#readdirEntries(path, name, options, await this.stat(path));
+  }
+  readdirSync(path, options) {
+    if (options?.recursive) {
+      throw new ERR_METHOD_NOT_IMPLEMENTED('readdirSync with { recursive: true } on a ZipProvider');
+    }
+    const name = normalize(path);
+    return this.#readdirEntries(path, name, options, this.statSync(path));
+  }
+
+  async mkdir(path, options) {
+    if (this.readonly) throw createEROFS('mkdir', path);
+    const name = normalize(path);
+    if (await this.exists(path)) {
+      // `{ recursive: true }` only tolerates an existing *directory*; an
+      // existing file (or any non-directory) still collides with EEXIST.
+      if (options?.recursive && this.#isDirectory(name)) return undefined;
+      throw createEEXIST('mkdir', path);
+    }
+    await this.#source.add(`${name}/`, EMPTY_BUFFER, { mode: options?.mode });
+    return undefined;
+  }
+  mkdirSync(path, options) {
+    if (this.readonly) throw createEROFS('mkdir', path);
+    const name = normalize(path);
+    if (this.existsSync(path)) {
+      // `{ recursive: true }` only tolerates an existing *directory*; an
+      // existing file (or any non-directory) still collides with EEXIST.
+      if (options?.recursive && this.#isDirectory(name)) return undefined;
+      throw createEEXIST('mkdir', path);
+    }
+    this.#source.addSync(`${name}/`, EMPTY_BUFFER, { mode: options?.mode });
+    return undefined;
+  }
+
+  async rmdir(path) {
+    if (this.readonly) throw createEROFS('rmdir', path);
+    const name = normalize(path);
+    const stats = await this.stat(path);
+    if (!stats.isDirectory()) throw createENOTDIR('rmdir', path);
+    const prefix = `${name}/`;
+    for (const key of this.#source.keys()) {
+      if (key !== prefix && StringPrototypeStartsWith(key, prefix)) {
+        throw createENOTEMPTY('rmdir', path);
+      }
+    }
+    if (!this.#source.has(prefix)) {
+      // An implicit-only directory can never be empty (something has to be
+      // under it for it to exist at all), so getting here means `path` is
+      // not a directory this provider can remove.
+      throw createENOENT('rmdir', path);
+    }
+    await this.#source.delete(prefix);
+  }
+  rmdirSync(path) {
+    if (this.readonly) throw createEROFS('rmdir', path);
+    const name = normalize(path);
+    const stats = this.statSync(path);
+    if (!stats.isDirectory()) throw createENOTDIR('rmdir', path);
+    const prefix = `${name}/`;
+    for (const key of this.#source.keys()) {
+      if (key !== prefix && StringPrototypeStartsWith(key, prefix)) {
+        throw createENOTEMPTY('rmdir', path);
+      }
+    }
+    if (!this.#source.has(prefix)) {
+      throw createENOENT('rmdir', path);
+    }
+    this.#deleteEntrySync(prefix);
+  }
+
+  async unlink(path) {
+    if (this.readonly) throw createEROFS('unlink', path);
+    const name = normalize(path);
+    if (!this.#source.has(name)) {
+      throw this.#isDirectory(name) ? createEISDIR('unlink', path) : createENOENT('unlink', path);
+    }
+    await this.#source.delete(name);
+  }
+  unlinkSync(path) {
+    if (this.readonly) throw createEROFS('unlink', path);
+    const name = normalize(path);
+    if (!this.#source.has(name)) {
+      throw this.#isDirectory(name) ? createEISDIR('unlink', path) : createENOENT('unlink', path);
+    }
+    this.#deleteEntrySync(name);
+  }
+
+  async rename(oldPath, newPath) {
+    if (this.readonly) throw createEROFS('rename', oldPath);
+    const oldName = normalize(oldPath);
+    const newName = normalize(newPath);
+    const entry = await this.#getEntry(oldName);
+    if (entry === null) throw createENOENT('rename', oldPath);
+    const content = await entry.content();
+    await this.#source.add(newName, content, {
+      mode: entry.mode || undefined,
+      modified: entry.modified,
+      method: methodOption(entry.method),
+    });
+    await this.#source.delete(oldName);
+  }
+  renameSync(oldPath, newPath) {
+    if (this.readonly) throw createEROFS('rename', oldPath);
+    const oldName = normalize(oldPath);
+    const newName = normalize(newPath);
+    const entry = this.#getEntrySync(oldName);
+    if (entry === null) throw createENOENT('rename', oldPath);
+    const content = entry.contentSync();
+    this.#source.addSync(newName, content, {
+      mode: entry.mode || undefined,
+      modified: entry.modified,
+      method: methodOption(entry.method),
+    });
+    this.#deleteEntrySync(oldName);
+  }
+
+  /**
+   * Closes the backing archive. A `ZipFile` releases its file descriptor; a
+   * `ZipBuffer` is purely in-memory and has nothing to close, so this is a
+   * no-op for it. Aliased as `Symbol.asyncDispose` so a provider can be used
+   * with `await using`.
+   */
+  async close() {
+    if (typeof this.#source.close === 'function') await this.#source.close();
+  }
+  /**
+   * Synchronous counterpart of `close()`, aliased as `Symbol.dispose` for
+   * `using`.
+   */
+  closeSync() {
+    if (typeof this.#source.closeSync === 'function') this.#source.closeSync();
+  }
+}
+
+ZipProvider.prototype[SymbolAsyncDispose] = ZipProvider.prototype.close;
+ZipProvider.prototype[SymbolDispose] = ZipProvider.prototype.closeSync;
+
+module.exports = {
+  ZipProvider,
+};
diff --git a/lib/internal/vfs/router.js b/lib/internal/vfs/router.js
index b610b271695a..53247cbc6706 100644
--- a/lib/internal/vfs/router.js
+++ b/lib/internal/vfs/router.js
@@ -2,45 +2,78 @@
 
 const {
   ArrayPrototypeJoin,
+  StringPrototypeCharCodeAt,
   StringPrototypeSplit,
-  StringPrototypeStartsWith,
 } = primordials;
 
-const { isAbsolute, relative, sep } = require('path');
+const { relative, resolve, sep, toNamespacedPath } = require('path');
 
-// `path.sep` is required here because on Windows `path.resolve('/virtual')`
-// produces 'C:\virtual' and all resolved paths use backslashes - a hardcoded
-// '/' check would never match. The trailing-separator guard handles root
-// mount points like 'C:\' so we don't end up with 'C:\\'.
-function isUnderMountPoint(normalizedPath, mountPoint) {
-  if (normalizedPath === mountPoint) {
-    return true;
-  }
-  if (mountPoint === '/') {
-    return StringPrototypeStartsWith(normalizedPath, '/');
+// All VFS mount points live under `${os.devNull}/vfs/<id>/`. os.devNull
+// is a character device on POSIX (`/dev/null`) and a device-namespace
+// path on Windows (`\\.\NUL`); neither can have children, so no real
+// file-system path can exist under this root and path ownership is
+// decidable from the path alone.
+let vfsRoot;
+let normalizedVfsRoot;
+
+function getVfsRoot() {
+  vfsRoot ??= require('os').devNull + sep + 'vfs';
+  return vfsRoot;
+}
+
+function getNormalizedVfsRoot() {
+  normalizedVfsRoot ??= toNamespacedPath(resolve(getVfsRoot()));
+  return normalizedVfsRoot;
+}
+
+/**
+ * Returns the reserved mount point for a VFS layer:
+ * `${os.devNull}/vfs/<id>`.
+ * @param {number} layerId
+ * @returns {string}
+ */
+function getLayerRoot(layerId) {
+  return getVfsRoot() + sep + layerId;
+}
+
+/**
+ * Extracts the layer id from a normalized path under the VFS root, or
+ * returns -1 when the path does not carry a well-formed `.../vfs/<id>`
+ * segment. The caller must have verified that `normalizedPath` starts
+ * with the normalized VFS root plus a separator.
+ * @param {string} normalizedPath
+ * @returns {number}
+ */
+function getLayerIdFromPath(normalizedPath) {
+  const start = getNormalizedVfsRoot().length + 1;
+  let id = 0;
+  let i = start;
+  const len = normalizedPath.length;
+  if (i >= len) return -1;
+  for (; i < len; i++) {
+    const c = StringPrototypeCharCodeAt(normalizedPath, i);
+    if (c === 47 || c === 92) break; // '/' or '\\'
+    if (c < 48 || c > 57) return -1; // not a digit
+    id = id * 10 + (c - 48);
   }
-  const prefix = mountPoint[mountPoint.length - 1] === sep ?
-    mountPoint : mountPoint + sep;
-  return StringPrototypeStartsWith(normalizedPath, prefix);
+  if (i === start) return -1;
+  return id;
 }
 
-// Returns a POSIX-style relative path the provider can consume. Uses
-// `path.relative()` so Windows backslash paths are handled correctly, then
-// re-joins with forward slashes for the provider's internal POSIX format.
+// POSIX-style relative path for the provider. `path.relative()` handles
+// Windows backslashes; we re-join with forward slashes.
 function getRelativePath(normalizedPath, mountPoint) {
   if (normalizedPath === mountPoint) {
     return '/';
   }
-  if (mountPoint === '/') {
-    return normalizedPath;
-  }
   const rel = relative(mountPoint, normalizedPath);
   const segments = StringPrototypeSplit(rel, sep);
   return '/' + ArrayPrototypeJoin(segments, '/');
 }
 
 module.exports = {
-  isUnderMountPoint,
+  getLayerIdFromPath,
+  getLayerRoot,
+  getNormalizedVfsRoot,
   getRelativePath,
-  isAbsolutePath: isAbsolute,
 };
diff --git a/lib/internal/vfs/sea.js b/lib/internal/vfs/sea.js
new file mode 100644
index 000000000000..f08bc71bd91b
--- /dev/null
+++ b/lib/internal/vfs/sea.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const { isSea, isVfsEnabled } = internalBinding('sea');
+const { kEmptyObject } = require('internal/util');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+
+let initialized = false;
+
+/* c8 ignore start -- SEA VFS initialization requires an actual SEA binary */
+
+/**
+ * Initializes the SEA virtual file system: a read-only VFS serving the
+ * assets bundled into the executable, mounted at its reserved mount point.
+ * Because a VFS never shadows the real file system, the assets live under
+ * the mount point returned by `vfs.mountPoint`, not at a fixed path; the
+ * SEA main script is placed at the mount point root so bundled code can
+ * reach the assets through `__dirname`-relative paths and relative
+ * `require()` calls.
+ * @param {object} [options] Configuration options
+ * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+ *   files to serve alongside the assets (used for the SEA main script)
+ * @returns {VirtualFileSystem|null} The mounted VFS, or null if not running
+ *   as a SEA or VFS is not enabled in the SEA configuration
+ * @throws {ERR_INVALID_STATE} If already initialized
+ */
+function initSeaVfs(options = kEmptyObject) {
+  if (initialized) {
+    throw new ERR_INVALID_STATE('SEA VFS is already initialized');
+  }
+  initialized = true;
+
+  if (!isSea() || !isVfsEnabled()) {
+    return null;
+  }
+
+  const { VirtualFileSystem } = require('internal/vfs/file_system');
+  const { SEAProvider } = require('internal/vfs/providers/sea');
+
+  const provider = new SEAProvider({ extraFiles: options.extraFiles });
+  // The SEA warning already covers the feature; don't emit the
+  // VirtualFileSystem experimental warning for the implicit SEA mount.
+  const vfs = new VirtualFileSystem(provider, {
+    emitExperimentalWarning: false,
+  });
+  vfs.mount();
+
+  return vfs;
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  initSeaVfs,
+};
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index b063c31a0a32..a45cd47a9bf4 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -1,30 +1,40 @@
 'use strict';
 
 const {
-  ArrayPrototypeIndexOf,
-  ArrayPrototypePush,
-  ArrayPrototypeSplice,
+  ArrayPrototypeForEach,
+  MapPrototypeForEach,
+  ObjectKeys,
   PromiseResolve,
+  SafeMap,
+  String,
+  StringPrototypeEndsWith,
   StringPrototypeStartsWith,
 } = primordials;
 
 const { Buffer } = require('buffer');
 const { isArrayBufferView } = require('internal/util/types');
-const { resolve, sep } = require('path');
-const { fileURLToPath, URL } = require('internal/url');
+const { dirname, join, sep } = require('path');
+const { fileURLToPath, pathToFileURL, URL } = require('internal/url');
 const { kEmptyObject } = require('internal/util');
 const { validateObject } = require('internal/validators');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_STATE,
+    ERR_MODULE_NOT_FOUND,
   },
 } = require('internal/errors');
 const { createENOENT, createEXDEV } = require('internal/vfs/errors');
+const { kLayerId, normalizeMountedPath } = require('internal/vfs/file_system');
+const {
+  getLayerIdFromPath,
+  getNormalizedVfsRoot,
+} = require('internal/vfs/router');
 const { getVirtualFd, closeVirtualFd } = require('internal/vfs/fd');
-const { assertEncoding, vfsState, setVfsHandlers } = require('internal/fs/utils');
+const { assertEncoding, setVfsHandlers } = require('internal/fs/utils');
 const permission = require('internal/process/permission');
 const { getOptionValue } = require('internal/options');
+const nativeModulesBinding = internalBinding('modules');
 let debug = require('internal/util/debuglog').debuglog('vfs', (fn) => {
   debug = fn;
 });
@@ -72,11 +82,12 @@ function writeFileSyncFd(fd, data, options) {
   return true;
 }
 
-// Registry of active VFS instances.
-const activeVFSList = [];
+const activeVFSLayers = new SafeMap();
 
 let hooksInstalled = false;
 let vfsHandlerObj;
+// Lazy: os.devNull may not be available at snapshot time.
+let normalizedVfsRootPrefix = null;
 
 function registerVFS(vfs) {
   if (permission.isEnabled() && !getOptionValue('--allow-fs-vfs')) {
@@ -85,82 +96,211 @@ function registerVFS(vfs) {
       'Use --allow-fs-vfs to allow it.',
     );
   }
-  if (ArrayPrototypeIndexOf(activeVFSList, vfs) !== -1) return;
-
-  const newMount = vfs.mountPoint;
-  if (newMount != null) {
-    for (let i = 0; i < activeVFSList.length; i++) {
-      const existingMount = activeVFSList[i].mountPoint;
-      if (existingMount == null) continue;
-      // Use path.sep so the trailing-separator guard works on Windows where
-      // mountPoint values are resolved to drive-letter / backslash paths.
-      const newPrefix = newMount === sep ? sep : newMount + sep;
-      const existingPrefix = existingMount === sep ? sep : existingMount + sep;
-      if (newMount === existingMount ||
-          StringPrototypeStartsWith(newMount, existingPrefix) ||
-          StringPrototypeStartsWith(existingMount, newPrefix)) {
-        throw new ERR_INVALID_STATE(
-          `VFS mount '${newMount}' overlaps with existing mount '${existingMount}'`,
-        );
-      }
-    }
-  }
-  ArrayPrototypePush(activeVFSList, vfs);
-  debug('register mount=%s active=%d', newMount, activeVFSList.length);
+  if (activeVFSLayers.has(vfs[kLayerId])) return;
+  activeVFSLayers.set(vfs[kLayerId], vfs);
+  debug('register layer=%d mount=%s active=%d',
+        vfs[kLayerId], vfs.mountPoint, activeVFSLayers.size);
   if (!hooksInstalled) {
-    vfsHandlerObj = createVfsHandlers();
-    setVfsHandlers(vfsHandlerObj);
-    hooksInstalled = true;
-  } else if (vfsState.handlers === null) {
-    setVfsHandlers(vfsHandlerObj);
+    installHooks();
   }
 }
 
 function deregisterVFS(vfs) {
-  const index = ArrayPrototypeIndexOf(activeVFSList, vfs);
-  if (index === -1) return;
-  ArrayPrototypeSplice(activeVFSList, index, 1);
-  debug('deregister active=%d', activeVFSList.length);
-  if (activeVFSList.length === 0) {
-    setVfsHandlers(null);
+  if (!activeVFSLayers.delete(vfs[kLayerId])) return;
+  debug('deregister layer=%d active=%d', vfs[kLayerId], activeVFSLayers.size);
+  purgeLoaderCachesForVFS(vfs);
+  if (activeVFSLayers.size === 0) {
+    uninstallHooks();
   }
 }
 
-function findVFSForExists(filename) {
-  const normalized = resolve(filename);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(normalized)) {
-      return { vfs, exists: vfs.existsSync(normalized) };
+/**
+ * Resolves a path string to the active VFS that owns it, or null.
+ * Ownership is decidable from the path alone: all mount points live
+ * under the reserved `${os.devNull}/vfs/<id>` namespace, so a single
+ * prefix comparison rejects every real-file-system path and a map
+ * lookup finds the owning layer. The normalized path is returned
+ * alongside the layer so downstream helpers can skip renormalization.
+ * @param {string} inputPath
+ * @returns {{ vfs: object, normalized: string }|null}
+ */
+function findVFS(inputPath) {
+  const normalized = normalizeMountedPath(inputPath);
+  if (!StringPrototypeStartsWith(normalized, normalizedVfsRootPrefix)) {
+    return null;
+  }
+  const layerId = getLayerIdFromPath(normalized);
+  if (layerId === -1) return null;
+  const vfs = activeVFSLayers.get(layerId);
+  if (vfs === undefined || !vfs.shouldHandleNormalized(normalized)) {
+    return null;
+  }
+  return { vfs, normalized };
+}
+
+/**
+ * Drop the cache entries under `vfs`'s mount point from the
+ * JS-reachable loader caches. Real-fs entries and other-VFS entries
+ * are left in place. Because mount points cannot collide with real
+ * paths - and symlink resolution inside a VFS always yields paths
+ * under the same mount point - a prefix scan is exact.
+ * @param {object} vfs The VFS being deregistered
+ */
+function purgeLoaderCachesForVFS(vfs) {
+  const mountPoint = vfs.mountPoint;
+
+  const cjsLoader = require('internal/modules/cjs/loader');
+  cjsLoader.purgeModuleCachesForPrefix(mountPoint);
+
+  const helpers = require('internal/modules/helpers');
+  helpers.purgeRealpathCacheForPrefix(mountPoint);
+
+  const pkgReader = require('internal/modules/package_json_reader');
+  pkgReader.purgePackageJSONCacheForPrefix(mountPoint);
+
+  const esmLoader = require('internal/modules/esm/loader');
+  if (esmLoader.isCascadedLoaderInitialized()) {
+    const loader = esmLoader.getOrInitializeCascadedLoader();
+    const loadCache = loader.loadCache;
+    const mountURL = pathToFileURL(mountPoint).href;
+    const mountURLPrefix = mountURL + '/';
+    // Iterate via MapPrototypeForEach (not for-of map.keys()) so a
+    // polluted Map iterator can't break the cleanup path.
+    if (loadCache && typeof loadCache.delete === 'function') {
+      MapPrototypeForEach(loadCache, (variants, url) => {
+        if (typeof url === 'string' &&
+            (url === mountURL ||
+             StringPrototypeStartsWith(url, mountURLPrefix)) &&
+            variants) {
+          ArrayPrototypeForEach(ObjectKeys(variants), (type) => {
+            loadCache.delete(url, type);
+          });
+        }
+      });
     }
   }
-  return null;
 }
 
-function findVFSForPath(filename) {
-  const normalized = resolve(filename);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(normalized)) {
-      return { vfs, normalized };
+/**
+ * Returns the stat result code for a VFS path.
+ * @param {object} vfs The VFS instance
+ * @param {string} filePath The path to check
+ * @returns {number} 0 for file, 1 for directory, -2 for not found
+ */
+function vfsStat(vfs, filePath) {
+  try {
+    const stats = vfs.statSync(filePath);
+    if (stats.isDirectory()) return 1;
+    return 0;
+  } catch (err) {
+    if (typeof err?.errno === 'number') return err.errno;
+    throw err;
+  }
+}
+
+/**
+ * Finds the VFS owning `filename` and stats it.
+ * @param {string} filename The absolute path to check
+ * @returns {{ vfs: object, result: number }|null}
+ */
+function findVFSForStat(filename) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  return { vfs: r.vfs, result: vfsStat(r.vfs, filename) };
+}
+
+/**
+ * Finds the VFS owning `filename` and reads it.
+ * @param {string} filename The absolute path to read
+ * @param {string|object} options Read options
+ * @returns {{ vfs: object, content: Buffer|string }|null}
+ */
+function findVFSForRead(filename, options) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  try {
+    return { vfs: r.vfs, content: r.vfs.readFileSync(filename, options) };
+  } catch (e) {
+    const code = e?.code;
+    if (code === 'ENOENT' || code === 'EISDIR') {
+      throw createENOENT('open', filename);
     }
+    throw e;
   }
-  return null;
 }
 
-// Sync read: check exists first, fall through to ENOENT for mounted VFS.
-function findVFSWith(filename, syscall, fn) {
-  const normalized = resolve(filename);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(normalized)) {
-      if (vfs.existsSync(normalized)) {
-        return fn(vfs, normalized);
+/**
+ * Walk up directories inside `vfs`'s mount looking for package.json.
+ * Always returns an object. When a package.json is found `.tuple` is
+ * populated with the C++ binding's serialized shape
+ * (`[name, main, type, imports, exports, filePath]`); otherwise
+ * `.sentinel` is the last candidate path checked - matches the "not
+ * found" marker the C++ binding returns for getPackageScopeConfig.
+ * Syntactically malformed package.json aborts the walk with
+ * ERR_INVALID_PACKAGE_CONFIG (thrown by the native parser), matching
+ * native GetPackageJSON.
+ * @param {object} vfs The VFS that owns startPath
+ * @param {string} startPath Absolute path to start from
+ * @param {string} normalizedStart Same as startPath but passed through
+ *   `normalizeMountedPath`. Used to walk the directory chain so the
+ *   containment check is a plain string prefix rather than a fresh
+ *   `toNamespacedPath(resolve(...))` on every iteration.
+ * @returns {{ vfs?: object, pjsonPath?: string, tuple?: Array, sentinel: string }}
+ */
+function findVFSPackageJSON(vfs, startPath, normalizedStart) {
+  let currentDir = dirname(startPath);
+  let currentNorm = dirname(normalizedStart);
+  let lastDir;
+  let sentinel = join(currentDir, 'package.json');
+  while (currentDir !== lastDir) {
+    if (StringPrototypeEndsWith(currentDir, '/node_modules') ||
+        StringPrototypeEndsWith(currentDir, '\\node_modules')) {
+      break;
+    }
+    if (!vfs.shouldHandleNormalized(currentNorm)) {
+      break;
+    }
+    const pjsonPath = join(currentDir, 'package.json');
+    sentinel = pjsonPath;
+    if (vfsStat(vfs, pjsonPath) === 0) {
+      let content;
+      try {
+        content = vfs.readFileSync(pjsonPath);
+      } catch {
+        content = null;
+      }
+      if (content !== null) {
+        const tuple = nativeModulesBinding.parsePackageJSON(
+          content, pjsonPath);
+        return { vfs, pjsonPath, tuple, sentinel: pjsonPath };
       }
-      throw createENOENT(syscall, filename);
     }
+    lastDir = currentDir;
+    currentDir = dirname(currentDir);
+    currentNorm = dirname(currentNorm);
   }
-  return undefined;
+  return { sentinel };
+}
+
+function findVFSForExists(filename) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  return { vfs: r.vfs, exists: r.vfs.existsSync(filename) };
+}
+
+function findVFSForPath(filename) {
+  const r = findVFS(filename);
+  if (r === null) return null;
+  return { vfs: r.vfs, path: filename };
+}
+
+function findVFSWith(filename, syscall, fn) {
+  const r = findVFS(filename);
+  if (r === null) return undefined;
+  if (r.vfs.existsSync(filename)) {
+    return fn(r.vfs, filename);
+  }
+  throw createENOENT(syscall, filename);
 }
 
 function vfsRead(path, syscall, fn) {
@@ -173,7 +313,7 @@ function vfsOp(path, fn) {
   const pathStr = toPathStr(path);
   if (pathStr !== null) {
     const r = findVFSForPath(pathStr);
-    if (r !== null) return fn(r.vfs, r.normalized);
+    if (r !== null) return fn(r.vfs, r.path);
   }
   return undefined;
 }
@@ -182,31 +322,21 @@ function vfsOpVoid(path, fn) {
   const pathStr = toPathStr(path);
   if (pathStr !== null) {
     const r = findVFSForPath(pathStr);
-    if (r !== null) { fn(r.vfs, r.normalized); return true; }
+    if (r !== null) { fn(r.vfs, r.path); return true; }
   }
   return undefined;
 }
 
 function checkSameVFS(srcPath, destPath, syscall, srcVfs) {
-  const destNormalized = resolve(destPath);
-  for (let i = 0; i < activeVFSList.length; i++) {
-    const vfs = activeVFSList[i];
-    if (vfs.shouldHandle(destNormalized)) {
-      if (vfs !== srcVfs) {
-        throw createEXDEV(syscall, srcPath);
-      }
-      return;
-    }
+  if (findVFS(destPath)?.vfs !== srcVfs) {
+    throw createEXDEV(syscall, srcPath);
   }
-  throw createEXDEV(syscall, srcPath);
 }
 
 function createVfsHandlers() {
   return {
     __proto__: null,
 
-    // ==================== Sync path-based read ops ====================
-
     existsSync(path) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
@@ -241,27 +371,12 @@ function createVfsHandlers() {
     lstatSync(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          try {
-            return vfs.lstatSync(normalized, options);
-          } catch (e) {
-            if (e?.code === 'ENOENT' && options?.throwIfNoEntry === false) return undefined;
-            throw e;
-          }
-        }
-      }
-      return undefined;
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      return r.vfs.lstatSync(pathStr, options);
     },
     statSync(path, options) {
-      try {
-        return vfsRead(path, 'stat', (vfs, n) => vfs.statSync(n, options));
-      } catch (err) {
-        if (err?.code === 'ENOENT' && options?.throwIfNoEntry === false) return undefined;
-        throw err;
-      }
+      return vfsRead(path, 'stat', (vfs, n) => vfs.statSync(n, options));
     },
     realpathSync(path, options) {
       const result = vfsRead(path, 'realpath', (vfs, n) => vfs.realpathSync(n));
@@ -278,7 +393,7 @@ function createVfsHandlers() {
           if (mode != null && typeof mode !== 'number') {
             throw new ERR_INVALID_ARG_TYPE('mode', 'integer', mode);
           }
-          r.vfs.accessSync(r.normalized, mode);
+          r.vfs.accessSync(r.path, mode);
           return true;
         }
       }
@@ -287,16 +402,11 @@ function createVfsHandlers() {
     readlinkSync(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          const result = vfs.readlinkSync(normalized, options);
-          if (options?.encoding === 'buffer') return Buffer.from(result);
-          return result;
-        }
-      }
-      return undefined;
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      const result = r.vfs.readlinkSync(pathStr, options);
+      if (options?.encoding === 'buffer') return Buffer.from(result);
+      return result;
     },
     statfsSync(path, options) {
       const pathStr = toPathStr(path);
@@ -312,8 +422,6 @@ function createVfsHandlers() {
       return undefined;
     },
 
-    // ==================== Sync path-based write ops ====================
-
     writeFileSync(path, data, options) {
       if (typeof path === 'number') return writeFileSyncFd(path, data, options);
       return vfsOpVoid(path, (vfs, n) => vfs.writeFileSync(n, data, options));
@@ -329,14 +437,16 @@ function createVfsHandlers() {
     unlinkSync: (path) => vfsOpVoid(path, (vfs, n) => vfs.unlinkSync(n)),
     renameSync(oldPath, newPath) {
       return vfsOpVoid(oldPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'rename', vfs);
-        vfs.renameSync(n, resolve(toPathStr(newPath)));
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'rename', vfs);
+        vfs.renameSync(n, destStr);
       });
     },
     copyFileSync(src, dest, mode) {
       return vfsOpVoid(src, (vfs, n) => {
-        checkSameVFS(n, toPathStr(dest), 'copyfile', vfs);
-        vfs.copyFileSync(n, resolve(toPathStr(dest)), mode);
+        const destStr = toPathStr(dest);
+        checkSameVFS(n, destStr, 'copyfile', vfs);
+        vfs.copyFileSync(n, destStr, mode);
       });
     },
     symlinkSync: (target, path, type) =>
@@ -351,8 +461,9 @@ function createVfsHandlers() {
     truncateSync: (path, len) => vfsOpVoid(path, (vfs, n) => vfs.truncateSync(n, len)),
     linkSync(existingPath, newPath) {
       return vfsOpVoid(existingPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'link', vfs);
-        vfs.linkSync(n, resolve(toPathStr(newPath)));
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'link', vfs);
+        vfs.linkSync(n, destStr);
       });
     },
     mkdtempSync(prefix, options) {
@@ -366,19 +477,14 @@ function createVfsHandlers() {
     openAsBlob(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr !== null) {
-        const normalized = resolve(pathStr);
-        for (let i = 0; i < activeVFSList.length; i++) {
-          const vfs = activeVFSList[i];
-          if (vfs.shouldHandle(normalized) && vfs.existsSync(normalized)) {
-            return vfs.openAsBlob(normalized, options);
-          }
+        const r = findVFS(pathStr);
+        if (r !== null && r.vfs.existsSync(pathStr)) {
+          return r.vfs.openAsBlob(pathStr, options);
         }
       }
       return undefined;
     },
 
-    // ==================== Sync FD-based ops ====================
-
     openSync: (path, flags, mode) => vfsOp(path, (vfs, n) => vfs.openSync(n, flags, mode)),
     closeSync(fd) {
       const vfd = getVirtualFd(fd);
@@ -437,8 +543,6 @@ function createVfsHandlers() {
       return totalWritten;
     },
 
-    // ==================== Async FD-based ops ====================
-
     close(fd) {
       const vfd = getVirtualFd(fd);
       if (!vfd) return undefined;
@@ -472,13 +576,11 @@ function createVfsHandlers() {
     fdatasync: noopFd,
     fsync: noopFd,
 
-    // ==================== Stream ops ====================
-
     createReadStream(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr !== null) {
         const r = findVFSForPath(pathStr);
-        if (r !== null) return r.vfs.createReadStream(r.normalized, options);
+        if (r !== null) return r.vfs.createReadStream(r.path, options);
       }
       return undefined;
     },
@@ -486,13 +588,11 @@ function createVfsHandlers() {
       const pathStr = toPathStr(path);
       if (pathStr !== null) {
         const r = findVFSForPath(pathStr);
-        if (r !== null) return r.vfs.createWriteStream(r.normalized, options);
+        if (r !== null) return r.vfs.createWriteStream(r.path, options);
       }
       return undefined;
     },
 
-    // ==================== Watch ops ====================
-
     watch(filename, options, listener) {
       if (typeof options === 'function') {
         listener = options;
@@ -510,8 +610,6 @@ function createVfsHandlers() {
       return undefined;
     },
 
-    // ==================== Async path-based ops ====================
-
     readdir(path, options) {
       const promise = vfsOp(path, (vfs, n) => vfs.promises.readdir(n, options));
       if (promise !== undefined && options?.encoding === 'buffer' && !options?.withFileTypes) {
@@ -527,14 +625,9 @@ function createVfsHandlers() {
     lstat(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          return vfs.promises.lstat(normalized, options);
-        }
-      }
-      return undefined;
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      return r.vfs.promises.lstat(pathStr, options);
     },
     stat(path, options) {
       const promise = vfsOp(path, (vfs, n) => vfs.promises.stat(n, options));
@@ -578,18 +671,13 @@ function createVfsHandlers() {
     readlink(path, options) {
       const pathStr = toPathStr(path);
       if (pathStr === null) return undefined;
-      const normalized = resolve(pathStr);
-      for (let i = 0; i < activeVFSList.length; i++) {
-        const vfs = activeVFSList[i];
-        if (vfs.shouldHandle(normalized)) {
-          const promise = vfs.promises.readlink(normalized, options);
-          if (options?.encoding === 'buffer') {
-            return promise.then((result) => Buffer.from(result));
-          }
-          return promise;
-        }
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      const promise = r.vfs.promises.readlink(pathStr, options);
+      if (options?.encoding === 'buffer') {
+        return promise.then((result) => Buffer.from(result));
       }
-      return undefined;
+      return promise;
     },
     chown: (path, uid, gid) =>
       vfsOp(path, (vfs, n) => vfs.promises.chown(n, uid, gid).then(() => true)),
@@ -630,14 +718,16 @@ function createVfsHandlers() {
     unlink: (path) => vfsOp(path, (vfs, n) => vfs.promises.unlink(n).then(() => true)),
     rename(oldPath, newPath) {
       return vfsOp(oldPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'rename', vfs);
-        return vfs.promises.rename(n, resolve(toPathStr(newPath))).then(() => true);
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'rename', vfs);
+        return vfs.promises.rename(n, destStr).then(() => true);
       });
     },
     copyFile(src, dest, mode) {
       return vfsOp(src, (vfs, n) => {
-        checkSameVFS(n, toPathStr(dest), 'copyfile', vfs);
-        return vfs.promises.copyFile(n, resolve(toPathStr(dest)), mode).then(() => true);
+        const destStr = toPathStr(dest);
+        checkSameVFS(n, destStr, 'copyfile', vfs);
+        return vfs.promises.copyFile(n, destStr, mode).then(() => true);
       });
     },
     symlink(target, path, type) {
@@ -647,8 +737,9 @@ function createVfsHandlers() {
       vfsOp(path, (vfs, n) => vfs.promises.truncate(n, len).then(() => true)),
     link(existingPath, newPath) {
       return vfsOp(existingPath, (vfs, n) => {
-        checkSameVFS(n, toPathStr(newPath), 'link', vfs);
-        return vfs.promises.link(n, resolve(toPathStr(newPath))).then(() => true);
+        const destStr = toPathStr(newPath);
+        checkSameVFS(n, destStr, 'link', vfs);
+        return vfs.promises.link(n, destStr).then(() => true);
       });
     },
     mkdtemp(prefix, options) {
@@ -663,9 +754,8 @@ function createVfsHandlers() {
     utimes: (path, atime, mtime) =>
       vfsOp(path, (vfs, n) => vfs.promises.utimes(n, atime, mtime).then(() => true)),
     open(path, flags, mode) {
-      // openSync is synchronous, so an error thrown by the provider would
-      // escape via fs.open's caller (instead of going through the callback).
-      // Catch it here and surface as a rejected promise.
+      // Wrap openSync in an async fn so provider throws become rejections
+      // instead of escaping past fs.open's callback.
       return vfsOp(path, async (vfs, n) => vfs.openSync(n, flags, mode));
     },
     promisesOpen(path, flags, mode) {
@@ -673,7 +763,7 @@ function createVfsHandlers() {
       if (pathStr !== null) {
         const r = findVFSForPath(pathStr);
         if (r !== null) {
-          const fd = r.vfs.openSync(r.normalized, flags, mode);
+          const fd = r.vfs.openSync(r.path, flags, mode);
           const vfd = getVirtualFd(fd);
           return PromiseResolve(vfd.entry);
         }
@@ -685,6 +775,195 @@ function createVfsHandlers() {
   };
 }
 
+/**
+ * Install toggleable loader overrides so that the module loader's
+ * internal fs operations (stat, readFile, realpath) are redirected
+ * to VFS when appropriate.
+ */
+function installModuleLoaderOverrides() {
+  const {
+    legacyMainResolveExtensions,
+    legacyMainResolveExtensionsIndexes,
+    kLoaderOverrideNoResult,
+    setLoaderOverrides,
+  } = require('internal/modules/helpers');
+  const { kResolvedByMainIndexNode } = legacyMainResolveExtensionsIndexes;
+  const { internal: internalConstants } = internalBinding('constants');
+
+  // Overrides return `undefined` for paths the VFS does not own;
+  // wrapLoaderMethod then falls through to the native binding.
+  setLoaderOverrides({
+    internalModuleStat(filename) {
+      const result = findVFSForStat(filename);
+      return result !== null ? result.result : undefined;
+    },
+    readFileSync(filename, options) {
+      const pathStr = typeof filename === 'string' ? filename :
+        (filename instanceof URL ? fileURLToPath(filename) : String(filename));
+      const result = findVFSForRead(pathStr, options);
+      return result !== null ? result.content : undefined;
+    },
+    realpathSync(filename) {
+      return findVFSWith(filename, 'realpath', (vfs, n) => vfs.realpathSync(n));
+    },
+    getResolutionRoot(pathStr) {
+      const r = findVFS(pathStr);
+      if (r === null) return undefined;
+      const mountPoint = r.vfs.mountPoint;
+      // The boundary is compared as a plain string prefix by the
+      // callers, so only report it when the input carries the mount
+      // point verbatim.
+      return StringPrototypeStartsWith(pathStr, mountPoint) ?
+        mountPoint : undefined;
+    },
+    legacyMainResolve(pkgPath, main, base) {
+      if (findVFS(pkgPath) === null) return undefined;
+
+      for (let i = 0; i < legacyMainResolveExtensions.length; i++) {
+        const byMain = i <= kResolvedByMainIndexNode;
+        if (byMain && !main) continue;
+        const prefix = byMain ? main : '';
+        const candidate = join(pkgPath, prefix + legacyMainResolveExtensions[i]);
+        if (findVFSForStat(candidate)?.result === 0) return i;
+      }
+
+      // Third arg `exactUrl` must be undefined (not a string) so the
+      // message uses the "package" word and err.url is not overwritten.
+      // ERR_MODULE_NOT_FOUND enforces strict arity in getMessage(), so
+      // the undefined has to be passed explicitly.
+      const initial = main ? join(pkgPath, main) : join(pkgPath, 'index.js');
+      throw new ERR_MODULE_NOT_FOUND(initial, base, undefined);
+    },
+    getFormatOfExtensionlessFile(filePath) {
+      let result;
+      try {
+        result = findVFSForRead(filePath, null);
+      } catch {
+        return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
+      }
+      if (result === null) return undefined;
+      const content = result.content;
+      // Wasm magic bytes: 0x00 0x61 0x73 0x6d
+      if (content && content.length >= 4 &&
+          content[0] === 0x00 && content[1] === 0x61 &&
+          content[2] === 0x73 && content[3] === 0x6d) {
+        return internalConstants.EXTENSIONLESS_FORMAT_WASM;
+      }
+      return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
+    },
+    readPackageJSON(jsonPath, isESM, base, specifier) {
+      const r = findVFS(jsonPath);
+      if (r === null) return undefined;
+      const { vfs } = r;
+      if (vfsStat(vfs, jsonPath) !== 0) return kLoaderOverrideNoResult;
+      let content;
+      try {
+        content = vfs.readFileSync(jsonPath);
+      } catch {
+        return kLoaderOverrideNoResult;
+      }
+      // Both CJS and ESM raise ERR_INVALID_PACKAGE_CONFIG since
+      // nodejs/node#48606.
+      return nativeModulesBinding.parsePackageJSON(
+        content, jsonPath, isESM, base, specifier);
+    },
+    getNearestParentPackageJSON(checkPath) {
+      const r = findVFS(checkPath);
+      if (r === null) return undefined;
+      const found = findVFSPackageJSON(r.vfs, checkPath, r.normalized);
+      return found.tuple ?? kLoaderOverrideNoResult;
+    },
+    getPackageScopeConfig(resolved) {
+      let filePath;
+      if (StringPrototypeStartsWith(resolved, 'file:')) {
+        try {
+          filePath = fileURLToPath(resolved);
+        } catch {
+          return undefined;
+        }
+      } else {
+        filePath = resolved;
+      }
+      const r = findVFS(filePath);
+      if (r === null) return undefined;
+      const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
+      if (found.tuple !== undefined) return found.tuple;
+      return found.sentinel;
+    },
+    getPackageType(url) {
+      let filePath;
+      if (StringPrototypeStartsWith(url, 'file:')) {
+        try {
+          filePath = fileURLToPath(url);
+        } catch {
+          return undefined;
+        }
+      } else {
+        filePath = url;
+      }
+      const r = findVFS(filePath);
+      if (r === null) return undefined;
+      const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
+      if (found.tuple !== undefined) {
+        // Tuple shape: [name, main, type, imports, exports, filePath].
+        const type = found.tuple[2];
+        if (type === 'module' || type === 'commonjs') return type;
+      }
+      return kLoaderOverrideNoResult;
+    },
+  });
+}
+
+let originalDlopen;
+
+function installAddonLoader() {
+  originalDlopen = process.dlopen;
+  process.dlopen = function(module, filename, flags) {
+    // dlopen(2) cannot open a native addon that lives in a VFS by path (it has
+    // no real inode). Read its bytes and hand them to the internal
+    // dlopenBinary(), which writes them to a private, self-cleaning temporary
+    // image - an in-memory memfd on Linux - and loads that. Only VFS paths take
+    // this route; everything else loads straight from disk through the
+    // unchanged process.dlopen().
+    if (StringPrototypeStartsWith(filename, normalizedVfsRootPrefix)) {
+      const { readFileSync } = require('fs');
+      const { dlopenBinary } = internalBinding('process_methods');
+      return dlopenBinary(module, filename, flags, readFileSync(filename));
+    }
+    return originalDlopen(module, filename, flags);
+  };
+}
+
+/**
+ * Install all VFS hooks: module loader overrides and fs handlers.
+ */
+function installHooks() {
+  if (hooksInstalled) return;
+  debug('install hooks');
+  normalizedVfsRootPrefix = getNormalizedVfsRoot() + sep;
+  installModuleLoaderOverrides();
+  installAddonLoader();
+  vfsHandlerObj = createVfsHandlers();
+  setVfsHandlers(vfsHandlerObj);
+  hooksInstalled = true;
+}
+
+/**
+ * Tear down all VFS hooks when the last instance is deregistered. The
+ * fast path in the loader wrappers is restored so subsequent require/
+ * import calls pay zero overhead until another VFS is mounted.
+ */
+function uninstallHooks() {
+  if (!hooksInstalled) return;
+  debug('uninstall hooks');
+  const { setLoaderOverrides } = require('internal/modules/helpers');
+  setLoaderOverrides();
+  setVfsHandlers(null);
+  vfsHandlerObj = undefined;
+  process.dlopen = originalDlopen;
+  hooksInstalled = false;
+}
+
 module.exports = {
   registerVFS,
   deregisterVFS,
diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 7f61bae8c21f..71513bbe86f4 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -25,6 +25,7 @@ const {
   SafeArrayIterator,
   SafeSet,
   String,
+  StringPrototypeToWellFormed,
   SymbolIterator,
   TypeError,
   TypedArrayPrototypeGetBuffer,
@@ -603,6 +604,17 @@ converters.DOMString = function DOMString(V, options = kEmptyObject) {
   return toString(V, options);
 };
 
+/**
+ * Converts a JavaScript value to the IDL USVString type.
+ * @see https://webidl.spec.whatwg.org/#es-USVString
+ * @param {any} V JavaScript value.
+ * @param {ConversionOptions} [options] Conversion options.
+ * @returns {string}
+ */
+converters.USVString = function USVString(V, options = kEmptyObject) {
+  return StringPrototypeToWellFormed(converters.DOMString(V, options));
+};
+
 /**
  * Throws when a Web IDL operation receives too few arguments.
  * @param {number} length Actual argument count.
@@ -1109,6 +1121,22 @@ converters['sequence<DOMString>'] =
 converters['sequence<object>'] =
   createSequenceConverter(converters.object);
 
+// https://html.spec.whatwg.org/multipage/web-messaging.html#structuredserializeoptions
+//
+// dictionary StructuredSerializeOptions {
+//   sequence<object> transfer = [];
+// };
+converters.StructuredSerializeOptions = createDictionaryConverter(
+  'StructuredSerializeOptions',
+  [
+    {
+      key: 'transfer',
+      converter: converters['sequence<object>'],
+      defaultValue: () => [],
+    },
+  ],
+);
+
 module.exports = {
   converters,
   convertToInt,
diff --git a/lib/internal/webstreams/adapters.js b/lib/internal/webstreams/adapters.js
index 42e1221bb307..c00cc38ceef8 100644
--- a/lib/internal/webstreams/adapters.js
+++ b/lib/internal/webstreams/adapters.js
@@ -23,11 +23,16 @@ const { TextEncoder } = require('internal/encoding');
 const {
   ReadableStream,
   isReadableStream,
+  readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
 } = require('internal/webstreams/readablestream');
 
 const {
   WritableStream,
   isWritableStream,
+  writableStreamDefaultWriterWriteWithRequest,
 } = require('internal/webstreams/writablestream');
 
 const {
@@ -53,6 +58,10 @@ const {
   Buffer,
 } = require('buffer');
 
+const {
+  kResolvedPromise,
+} = require('internal/webstreams/util');
+
 const {
   isAnyArrayBuffer,
 } = require('internal/util/types');
@@ -141,6 +150,96 @@ function handleKnownInternalErrors(cause) {
 
 const noop = () => {};
 
+// A single shared write request tracks every chunk written to the
+// destination WritableStream, replacing the per-write promise pair that
+// writer.ready + writer.write() would allocate. Only one write/writev
+// batch is in flight at a time, so one callback slot is enough.
+// `promise` is non-undefined so writable-stream queue entries are
+// discriminated from kNilRequest by `promise === undefined`;
+// `failed`/`failure` latch a write that could not proceed.
+function createWriteTracker(getDestination) {
+  return {
+    promise: null,
+    pending: 0,
+    failed: false,
+    failure: undefined,
+    callback: undefined,
+    error: undefined,
+    hasError: false,
+    dispatching: false,
+    resolve() {
+      this.pending--;
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    reject(error) {
+      this.pending--;
+      if (!this.hasError) {
+        this.hasError = true;
+        this.error = error;
+      }
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    settle() {
+      const callback = this.callback;
+      this.callback = undefined;
+      let error;
+      if (this.hasError) {
+        error = this.error;
+        this.hasError = false;
+        this.error = undefined;
+      } else if (this.failed) {
+        error = this.failure;
+      }
+      this.failed = false;
+      this.failure = undefined;
+      if (error !== undefined) {
+        // Deliver failures in a microtask: this can run while the
+        // writable-stream machinery is mid-transition (e.g. inside
+        // writableStreamFinishErroring), and the callback typically
+        // destroys the stream, which re-enters the machinery.
+        PromisePrototypeThen(kResolvedPromise, () => {
+          try {
+            callback(error);
+          } catch (err) {
+            process.nextTick(() => destroy(getDestination(), err));
+          }
+        });
+        return;
+      }
+      try {
+        callback(error);
+      } catch (err) {
+        // In a next tick because this can run within a promise context,
+        // and any error thrown must not become an unhandled rejection.
+        process.nextTick(() => destroy(getDestination(), err));
+      }
+    },
+  };
+}
+
+function dispatchWrite(writer, chunk, tracker) {
+  tracker.dispatching = true;
+  writableStreamDefaultWriterWriteWithRequest(writer, chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
+function dispatchWritev(writer, chunks, tracker) {
+  tracker.dispatching = true;
+  for (let i = 0; i < chunks.length; i++)
+    writableStreamDefaultWriterWriteWithRequest(writer, chunks[i].chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
 /**
  * @typedef {import('../../stream').Writable} Writable
  * @typedef {import('../../stream').Readable} Readable
@@ -313,6 +412,7 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
 
   const writer = writableStream.getWriter();
   let closed = false;
+  const writeTracker = createWriteTracker(() => writable);
 
   const writable = new Writable({
     highWaterMark,
@@ -321,27 +421,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(writable, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -360,18 +441,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(writable, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     destroy(error, callback) {
@@ -585,6 +656,14 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
 
   const reader = readableStream.getReader();
   let closed = false;
+  let readRequest;
+  let pendingChunk;
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    readable.push(chunk);
+  }
 
   const readable = new Readable({
     objectMode,
@@ -593,17 +672,25 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
     signal,
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            // Value should always be undefined here.
-            readable.push(null);
-          } else {
-            readable.push(chunk.value);
-          }
+      // At most one read is in flight (Readable does not call read()
+      // again before push()), so a single reused read request replaces
+      // the promise, read-result object, and reaction closures that
+      // reader.read() would allocate per chunk. The chunk is forwarded
+      // in a microtask to keep the old reaction position: a sync push
+      // could deliver a chunk that an error or destroy should beat.
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
+        },
+        [kClose]() {
+          readable.push(null);
         },
-        (error) => destroy(readable, error));
+        [kError](error) {
+          destroy(readable, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -769,6 +856,15 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
   const reader = readableStream.getReader();
   let writableClosed = false;
   let readableClosed = false;
+  let readRequest;
+  let pendingChunk;
+  const writeTracker = createWriteTracker(() => duplex);
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    duplex.push(chunk);
+  }
 
   const duplex = new Duplex({
     allowHalfOpen,
@@ -779,27 +875,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(duplex, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -818,18 +895,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(duplex, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     final(callback) {
@@ -855,16 +922,21 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     },
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            duplex.push(null);
-          } else {
-            duplex.push(chunk.value);
-          }
+      // Same single-in-flight reused read request as
+      // newStreamReadableFromReadableStream().
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
         },
-        (error) => destroy(duplex, error));
+        [kClose]() {
+          duplex.push(null);
+        },
+        [kError](error) {
+          destroy(duplex, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index 78313bd03c1a..5402bb487be5 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -3870,6 +3870,9 @@ module.exports = {
   readableStreamReaderGenericRelease,
   readableStreamBYOBReaderRead,
   readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
   setupReadableStreamBYOBReader,
   setupReadableStreamDefaultReader,
   readableStreamDefaultControllerClose,
diff --git a/lib/internal/webworker.js b/lib/internal/webworker.js
new file mode 100644
index 000000000000..e2a2086f9039
--- /dev/null
+++ b/lib/internal/webworker.js
@@ -0,0 +1,986 @@
+'use strict';
+
+// The Web IDL and specification prose quoted below is reproduced verbatim
+// from the specification, including its original (lowercase) casing.
+// Refs: https://html.spec.whatwg.org/multipage/workers.html
+/* eslint-disable capitalized-comments */
+
+const {
+  ArrayPrototypePush,
+  FunctionPrototypeBind,
+  ObjectDefineProperties,
+  ObjectDefineProperty,
+  ObjectGetPrototypeOf,
+  ObjectSetPrototypeOf,
+  ReflectDeleteProperty,
+  RegExpPrototypeExec,
+  SafeSet,
+  StringPrototypeSlice,
+  Symbol,
+  SymbolFor,
+  SymbolIterator,
+  SymbolToStringTag,
+  TypedArrayPrototypeGetLength,
+  Uint8Array,
+  globalThis,
+} = primordials;
+
+const {
+  ERR_ILLEGAL_CONSTRUCTOR,
+  ERR_INVALID_STATE,
+  ERR_NO_CRYPTO,
+} = require('internal/errors').codes;
+
+const {
+  EventTarget,
+  defineEventHandler,
+  initEventTarget,
+} = require('internal/event_target');
+
+const {
+  assignFunctionName,
+  defineOperation,
+  exposeInterface,
+  getCWDURL,
+  getLazy,
+  kEmptyObject,
+  kEnumerableProperty,
+  lazyDOMException,
+} = require('internal/util');
+
+const {
+  validateThisInternalField,
+} = require('internal/validators');
+
+const {
+  converters,
+  createDictionaryConverter,
+  createEnumConverter,
+  requiredArguments,
+} = require('internal/webidl');
+
+const {
+  Worker: NodeWorker,
+  kPublicPort,
+  kWebWorkerData,
+} = require('internal/worker');
+
+const {
+  lazyMessageEvent,
+} = require('internal/worker/io');
+
+const {
+  vm_dynamic_import_default_internal,
+} = internalBinding('symbols');
+
+const {
+  base64Slice,
+} = internalBinding('buffer');
+
+const {
+  hasOpenSSL,
+} = internalBinding('config');
+
+const {
+  Navigator,
+  kInitialize: kInitializeNavigator,
+} = require('internal/navigator');
+
+const {
+  URL,
+  URLParse,
+} = require('internal/url');
+
+const {
+  kType: kBlobType,
+  getBlobDataSync,
+  resolveObjectURL,
+} = require('internal/blob');
+
+const kCurrentlyReceivingPorts =
+  SymbolFor('nodejs.internal.kCurrentlyReceivingPorts');
+const kRef = SymbolFor('nodejs.ref');
+const kUnref = SymbolFor('nodejs.unref');
+
+const kCreate = Symbol('kCreate');
+const kInsidePort = Symbol('kInsidePort');
+const kLocation = Symbol('kLocation');
+const kName = Symbol('kName');
+const kNavigator = Symbol('kNavigator');
+const kNavigatorBrand = Symbol('kNavigatorBrand');
+const kType = Symbol('kType');
+const kURL = Symbol('kURL');
+const kWorker = Symbol('kWorker');
+
+let scopeBaseURL = null;
+
+const lazyErrorEvent =
+  getLazy(() => require('internal/deps/undici/undici').ErrorEvent);
+
+function createErrorEvent(init) {
+  const ErrorEvent = lazyErrorEvent();
+  return new ErrorEvent('error', init);
+}
+
+// "Fire an event named message at messageEventTarget, using MessageEvent,
+// with the data attribute initialized to messageClone and the ports
+// attribute initialized to newPorts."
+//
+// "If this throws an exception, catch it, fire an event named messageerror
+// at messageEventTarget, using MessageEvent, and then return."
+function forwardMessageEvents(port, target) {
+  port.on('message', (data) =>
+    target.dispatchEvent(lazyMessageEvent('message', {
+      data,
+      ports: port[kCurrentlyReceivingPorts],
+    })));
+  port.on('messageerror', (data) =>
+    target.dispatchEvent(lazyMessageEvent('messageerror', {
+      data,
+    })));
+}
+
+// Web IDL [Replaceable]: the setter replaces the accessor with an own
+// data property on the receiver.
+// Refs: https://webidl.spec.whatwg.org/#Replaceable
+function replaceAttribute(receiver, key, value) {
+  ObjectDefineProperty(receiver, key, {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    writable: true,
+    value,
+  });
+}
+
+// https://mimesniff.spec.whatwg.org/#javascript-mime-type
+const kJavaScriptMIMETypes = new SafeSet([
+  'application/ecmascript',
+  'application/javascript',
+  'application/x-ecmascript',
+  'application/x-javascript',
+  'text/ecmascript',
+  'text/javascript',
+  'text/javascript1.0',
+  'text/javascript1.1',
+  'text/javascript1.2',
+  'text/javascript1.3',
+  'text/javascript1.4',
+  'text/javascript1.5',
+  'text/jscript',
+  'text/livescript',
+  'text/x-ecmascript',
+  'text/x-javascript',
+]);
+
+function isJavaScriptMIMEType(essence) {
+  return kJavaScriptMIMETypes.has(essence);
+}
+
+// Extracts the essence ("type/subtype") of a raw MIME type string, or
+// returns undefined if the string is not a parsable MIME type.
+function mimeTypeEssence(type) {
+  const { MIMEType } = require('internal/mime');
+  try {
+    return new MIMEType(type).essence;
+  } catch {
+    return undefined;
+  }
+}
+
+function utf8Decode(bytes) {
+  return require('internal/encoding').getUtf8Decoder().decode(bytes);
+}
+
+// Reads and decodes the source text of a JavaScript data: URL, or returns
+// undefined if the URL fails to parse as a data: URL or its MIME type is
+// not a JavaScript MIME type.
+function readDataURLScript(url) {
+  const { dataURLProcessor } = require('internal/data_url');
+  const data = dataURLProcessor(url);
+  if (data === 'failure' || !isJavaScriptMIMEType(data.mimeType.essence)) {
+    return undefined;
+  }
+  return utf8Decode(data.body);
+}
+
+// Reads the data of a blob whose contents are to be run as a script, or
+// returns undefined if the blob's MIME type is not a JavaScript MIME type
+// or its data is not synchronously available.
+function getScriptBlobData(blob, allowEmptyType = false) {
+  if (blob === undefined ||
+      (!(allowEmptyType && blob[kBlobType] === '') &&
+       !isJavaScriptMIMEType(mimeTypeEssence(blob[kBlobType])))) {
+    return undefined;
+  }
+  return getBlobDataSync(blob);
+}
+
+/**
+ * Runs the source text of a classic script in the current global scope,
+ * emulating "run a classic script". Dynamic import() from the script is
+ * resolved by the ESM loader relative to the script's URL.
+ * @param {string} source The source text of the script.
+ * @param {string} url The URL of the script, used as its filename and as
+ *   the base URL for dynamic imports.
+ * @returns {any}
+ */
+function runClassicScriptSource(source, url) {
+  const {
+    makeContextifyScript,
+    runScriptInThisContext,
+  } = require('internal/vm');
+  const script = makeContextifyScript(
+    source,                             // code
+    url,                                // filename
+    0,                                  // lineOffset
+    0,                                  // columnOffset
+    undefined,                          // cachedData
+    false,                              // produceCachedData
+    undefined,                          // parsingContext
+    vm_dynamic_import_default_internal, // hostDefinedOptionId
+    vm_dynamic_import_default_internal, // importModuleDynamically
+  );
+  // "Run the classic script script, with rethrow errors set to true."
+  return runScriptInThisContext(script, true, false);
+}
+
+/**
+ * Runs the source text of a module script in the current global scope.
+ * @param {string} source The source text of the script.
+ * @param {string} url The URL of the script, used as its identifier and as
+ *   the base URL for imports.
+ * @returns {Promise}
+ */
+function runModuleScriptSource(source, url) {
+  // Necessary to reset RegExp statics before user code runs.
+  RegExpPrototypeExec(/^/, '');
+  return require('internal/modules/run_main').runEntryPointWithESMLoader(
+    (loader) => loader.eval(source, url, true),
+  );
+}
+
+/**
+ * Synchronously obtains the source text of a classic script, emulating
+ * "fetch a classic worker-imported script" for locally resolvable URLs.
+ * @param {URL} url The parsed URL of the script.
+ * @param {Blob|undefined} blob The blob URL entry captured when url was
+ *   parsed, for blob: URLs.
+ * @returns {string}
+ */
+function fetchClassicScriptSourceSync(url, blob) {
+  switch (url.protocol) {
+    case 'file:':
+      try {
+        return require('fs').readFileSync(url, 'utf8');
+      } catch {
+        break;
+      }
+    case 'data:': {
+      const source = readDataURLScript(url);
+      if (source !== undefined) {
+        return source;
+      }
+      break;
+    }
+    case 'blob:': {
+      const data = getScriptBlobData(blob);
+      if (data !== undefined) {
+        return utf8Decode(data);
+      }
+      break;
+    }
+  }
+  // "If response's ... or its Content-Type metadata is not a JavaScript
+  // MIME type, then throw a "NetworkError" DOMException."
+  throw lazyDOMException(`Failed to load script: ${url.href}`, 'NetworkError');
+}
+
+// Web IDL overload resolution for the postMessage(message, transfer) /
+// postMessage(message, options) overload pair: iterable objects select the
+// sequence<object> overload, everything else is converted as a
+// StructuredSerializeOptions dictionary.
+function normalizeTransfer(transferOrOptions, options) {
+  if (typeof transferOrOptions === 'object' && transferOrOptions !== null &&
+      transferOrOptions[SymbolIterator] !== undefined) {
+    return converters['sequence<object>'](transferOrOptions, options);
+  }
+  return converters.StructuredSerializeOptions(transferOrOptions, options)
+    .transfer;
+}
+
+const kScopePostMessageOptions = {
+  __proto__: null,
+  prefix: "Failed to execute 'postMessage' on 'DedicatedWorkerGlobalScope'",
+  context: 'Argument 2',
+};
+
+const kWorkerPostMessageOptions = {
+  __proto__: null,
+  prefix: "Failed to execute 'postMessage' on 'Worker'",
+  context: 'Argument 2',
+};
+
+// https://html.spec.whatwg.org/multipage/workers.html#the-workernavigator-interface
+//
+// [Exposed=Worker]
+// interface WorkerNavigator {};
+//
+// The NavigatorLanguage, NavigatorConcurrentHardware and NavigatorLocks
+// mixins, as well as userAgent and platform of NavigatorID, are inherited
+// from the Node.js Navigator implementation; the members below are the
+// remainder of the mixins WorkerNavigator includes.
+class WorkerNavigator extends Navigator {
+  constructor(guard = undefined) {
+    if (guard !== kCreate)
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    super(kInitializeNavigator);
+    this[kNavigatorBrand] = true;
+  }
+
+  // WorkerNavigator includes NavigatorID;
+  // Refs: https://html.spec.whatwg.org/multipage/system-state.html#navigatorid
+  //
+  // interface mixin NavigatorID {
+  // readonly attribute DOMString appVersion;
+  get appVersion() {
+    validateThisInternalField(this, kNavigatorBrand, 'WorkerNavigator');
+    return StringPrototypeSlice(process.version, 1);
+  }
+  // };
+
+  // WorkerNavigator includes NavigatorLocks;
+  get locks() {
+    return super.locks;
+  }
+}
+
+// Refs: https://html.spec.whatwg.org/multipage/system-state.html#navigatoronline
+//
+// interface mixin NavigatorOnLine {
+// readonly attribute boolean onLine;
+//   "Returns false if the user agent is definitely offline. Returns true
+//   if the user agent might be online."
+// };
+const kNavigatorConstants = [
+  ['appCodeName', 'Mozilla'],
+  ['appName', 'Netscape'],
+  ['product', 'Gecko'],
+  ['onLine', true],
+];
+for (let i = 0; i < kNavigatorConstants.length; i++) {
+  const { 0: key, 1: value } = kNavigatorConstants[i];
+  ObjectDefineProperty(WorkerNavigator.prototype, key, {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get: assignFunctionName(`get ${key}`, function() {
+      validateThisInternalField(this, kNavigatorBrand, 'WorkerNavigator');
+      return value;
+    }),
+  });
+}
+
+ObjectDefineProperties(WorkerNavigator.prototype, {
+  appVersion: kEnumerableProperty,
+  locks: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'WorkerNavigator',
+  },
+});
+
+// https://html.spec.whatwg.org/multipage/workers.html#worker-locations
+//
+// [Exposed=Worker]
+// interface WorkerLocation {
+class WorkerLocation {
+  constructor(guard = undefined, url = undefined) {
+    if (guard !== kCreate)
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    // "A WorkerLocation object has an associated WorkerGlobalScope object
+    // (a WorkerGlobalScope object)."
+    this[kURL] = url;
+  }
+
+  // "stringifier", for the href attribute defined below
+  toString() {
+    validateThisInternalField(this, kURL, 'WorkerLocation');
+    return this[kURL].href;
+  }
+}
+// };
+
+// stringifier readonly attribute USVString href;
+// readonly attribute USVString origin;
+// readonly attribute USVString protocol;
+// readonly attribute USVString host;
+// readonly attribute USVString hostname;
+// readonly attribute USVString port;
+// readonly attribute USVString pathname;
+// readonly attribute USVString search;
+// readonly attribute USVString hash;
+const kWorkerLocationAttributes = [
+  'href', 'origin', 'protocol', 'host', 'hostname', 'port', 'pathname',
+  'search', 'hash',
+];
+for (let i = 0; i < kWorkerLocationAttributes.length; i++) {
+  const key = kWorkerLocationAttributes[i];
+  ObjectDefineProperty(WorkerLocation.prototype, key, {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get: assignFunctionName(`get ${key}`, function() {
+      validateThisInternalField(this, kURL, 'WorkerLocation');
+      return this[kURL][key];
+    }),
+  });
+}
+
+ObjectDefineProperties(WorkerLocation.prototype, {
+  toString: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'WorkerLocation',
+  },
+});
+
+// https://html.spec.whatwg.org/multipage/workers.html#the-workerglobalscope-common-interface
+//
+// [Exposed=Worker]
+// interface WorkerGlobalScope : EventTarget {
+class WorkerGlobalScope extends EventTarget {
+  constructor(guard = undefined) {
+    if (guard !== kCreate)
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    super();
+  }
+
+  // readonly attribute WorkerGlobalScope self;
+  get self() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    // "The self attribute must return the WorkerGlobalScope object itself."
+    return this;
+  }
+
+  // readonly attribute WorkerLocation location;
+  get location() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    // "The location attribute must return the WorkerLocation object whose
+    // associated WorkerGlobalScope object is the WorkerGlobalScope object."
+    return this[kLocation];
+  }
+
+  // readonly attribute WorkerNavigator navigator;
+  get navigator() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    // "The navigator attribute of the WorkerGlobalScope interface must
+    // return an instance of the WorkerNavigator interface, which represents
+    // the identity and state of the user agent (the client)."
+    return this[kNavigator] ??= new WorkerNavigator(kCreate);
+  }
+
+  // undefined importScripts((TrustedScriptURL or USVString)... urls);
+  importScripts(...urls) {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    const prefix = "Failed to execute 'importScripts' on 'WorkerGlobalScope'";
+    // "To import scripts into worker global scope, given a
+    // WorkerGlobalScope object worker global scope, a list of scalar value
+    // strings urls, and an optional perform the fetch hook performFetch:"
+    //
+    // "If worker global scope's type is "module", throw a TypeError
+    // exception."
+    if (this[kType] === 'module') {
+      throw new ERR_INVALID_STATE.TypeError(
+        'importScripts() cannot be used in a module worker');
+    }
+    // "If urls is empty, return."
+    if (urls.length === 0)
+      return;
+
+    // "Let urlRecords be [an empty list]"
+    const urlRecords = [];
+    // "For each url of urls:"
+    for (let i = 0; i < urls.length; i++) {
+      const url = converters.USVString(
+        urls[i], { prefix, context: `Argument ${i + 1}` });
+      // "Let urlRecord be the result of encoding-parsing a URL given url,
+      // relative to settings object."
+      const urlRecord = URLParse(url, this[kLocation].href);
+
+      if (urlRecord === null) {
+        // "If urlRecord is failure, then throw a "SyntaxError"
+        // DOMException."
+        throw lazyDOMException(`Failed to parse URL: ${url}`, 'SyntaxError');
+      }
+      // Refs: https://url.spec.whatwg.org/#concept-url-parser
+      const blob = urlRecord.protocol === 'blob:' ?
+        resolveObjectURL(urlRecord.href) : undefined;
+      // "Append urlRecord to urlRecords."
+      ArrayPrototypePush(urlRecords, { url: urlRecord, blob });
+    }
+    // "For each urlRecord of urlRecords:"
+    for (let i = 0; i < urlRecords.length; i++) {
+      // "Fetch a classic worker-imported script given urlRecord and
+      // settings object, passing along performFetch if provided. If this
+      // succeeds, let script be the result. Otherwise, rethrow the
+      // exception."
+      const { url, blob } = urlRecords[i];
+      const script = fetchClassicScriptSourceSync(url, blob);
+      // "Run the classic script script, with rethrow errors set to true."
+      runClassicScriptSource(script, url.href);
+    }
+  }
+}
+
+ObjectDefineProperties(WorkerGlobalScope.prototype, {
+  self: kEnumerableProperty,
+  location: kEnumerableProperty,
+  navigator: kEnumerableProperty,
+  importScripts: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'WorkerGlobalScope',
+  },
+});
+
+// attribute OnErrorEventHandler onerror;
+defineEventHandler(WorkerGlobalScope.prototype, 'error');
+// attribute EventHandler onlanguagechange;
+defineEventHandler(WorkerGlobalScope.prototype, 'languagechange');
+// attribute EventHandler onoffline;
+defineEventHandler(WorkerGlobalScope.prototype, 'offline');
+// attribute EventHandler ononline;
+defineEventHandler(WorkerGlobalScope.prototype, 'online');
+// attribute EventHandler onrejectionhandled;
+defineEventHandler(WorkerGlobalScope.prototype, 'rejectionhandled');
+// attribute EventHandler onunhandledrejection;
+defineEventHandler(WorkerGlobalScope.prototype, 'unhandledrejection');
+// };
+
+// https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
+//
+// WorkerGlobalScope includes WindowOrWorkerGlobalScope;
+
+// https://w3c.github.io/webcrypto/#crypto-interface
+//
+// partial interface mixin WindowOrWorkerGlobalScope {
+//   [SameObject] readonly attribute Crypto crypto;
+// };
+const lazyCrypto = getLazy(() => require('internal/crypto/webcrypto').crypto);
+ObjectDefineProperty(WorkerGlobalScope.prototype, 'crypto', {
+  __proto__: null,
+  configurable: true,
+  enumerable: true,
+  get: assignFunctionName('get crypto', function() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    if (!hasOpenSSL)
+      throw new ERR_NO_CRYPTO();
+    return lazyCrypto();
+  }),
+});
+
+// https://w3c.github.io/hr-time/#the-performance-attribute
+//
+// partial interface mixin WindowOrWorkerGlobalScope {
+//   [Replaceable] readonly attribute Performance performance;
+// };
+const lazyPerformance = getLazy(() => require('perf_hooks').performance);
+ObjectDefineProperty(WorkerGlobalScope.prototype, 'performance', {
+  __proto__: null,
+  configurable: true,
+  enumerable: true,
+  get: assignFunctionName('get performance', function() {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    return lazyPerformance();
+  }),
+  set: assignFunctionName('set performance', function(value) {
+    validateThisInternalField(this, kLocation, 'WorkerGlobalScope');
+    replaceAttribute(this, 'performance', value);
+  }),
+});
+
+// Refs: https://html.spec.whatwg.org/multipage/web-messaging.html#messageeventtarget
+//
+// interface mixin MessageEventTarget {
+function includeMessageEventTarget(prototype) {
+  // attribute EventHandler onmessage;
+  defineEventHandler(prototype, 'message');
+  // attribute EventHandler onmessageerror;
+  defineEventHandler(prototype, 'messageerror');
+}
+// };
+
+// https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-dedicatedworkerglobalscope-interface
+//
+// [Global=(Worker,DedicatedWorker),Exposed=DedicatedWorker]
+// interface DedicatedWorkerGlobalScope : WorkerGlobalScope {
+class DedicatedWorkerGlobalScope extends WorkerGlobalScope {
+  // [Replaceable] readonly attribute DOMString name;
+  get name() {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    // "The name getter steps are to return this's name. Its value
+    // represents the name given to the worker using the Worker constructor,
+    // used primarily for debugging purposes."
+    return this[kName];
+  }
+
+  set name(value) {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    replaceAttribute(this, 'name', value);
+  }
+
+  // undefined postMessage(any message, sequence<object> transfer);
+  // undefined postMessage(any message, optional StructuredSerializeOptions options = {});
+  postMessage(message, transferOrOptions = kEmptyObject) {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    requiredArguments(arguments.length, 1, kScopePostMessageOptions);
+    // When the second argument was omitted there is nothing to convert.
+    const transfer = transferOrOptions === kEmptyObject ? undefined :
+      normalizeTransfer(transferOrOptions, kScopePostMessageOptions);
+    // "The postMessage(message, transfer) and postMessage(message, options)
+    // methods on DedicatedWorkerGlobalScope objects act as if, when
+    // invoked, it immediately invoked the respective postMessage(message,
+    // transfer) and postMessage(message, options) on the port, with the
+    // same arguments, and returned the same return value."
+    this[kInsidePort]?.postMessage(message, transfer);
+  }
+
+  // undefined close();
+  close() {
+    validateThisInternalField(this, kInsidePort, 'DedicatedWorkerGlobalScope');
+    // "The close() method steps are to close a worker given this."
+    //
+    // "To close a worker, given a workerGlobal, run these steps:
+    //  1. Discard any tasks that have been added to workerGlobal's relevant
+    //   agent's event loop's task queues.
+    //  2. Set workerGlobal's closing flag to true. (This prevents any
+    //   further tasks from being queued.)"
+    process.exit();
+  }
+}
+
+ObjectDefineProperties(DedicatedWorkerGlobalScope.prototype, {
+  name: kEnumerableProperty,
+  postMessage: kEnumerableProperty,
+  close: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'DedicatedWorkerGlobalScope',
+  },
+});
+// };
+
+// DedicatedWorkerGlobalScope includes MessageEventTarget;
+includeMessageEventTarget(DedicatedWorkerGlobalScope.prototype);
+
+// https://html.spec.whatwg.org/multipage/workers.html#abstractworker
+//
+// interface mixin AbstractWorker {
+function includeAbstractWorker(prototype) {
+  // attribute EventHandler onerror;
+  defineEventHandler(prototype, 'error');
+}
+// };
+
+// https://html.spec.whatwg.org/multipage/workers.html#worker-options
+//
+// enum WorkerType { "classic", "module" };
+const convertWorkerType = createEnumConverter('WorkerType', [
+  'classic',
+  'module',
+]);
+
+// RequestCredentials is defined by the Fetch Standard.
+// Refs: https://fetch.spec.whatwg.org/#requestcredentials
+//
+// enum RequestCredentials { "omit", "same-origin", "include" };
+const convertRequestCredentials = createEnumConverter('RequestCredentials', [
+  'omit',
+  'same-origin',
+  'include',
+]);
+
+// dictionary WorkerOptions {
+const convertWorkerOptions = createDictionaryConverter(
+  'WorkerOptions', [
+    {
+      // DOMString name = "";
+      key: 'name',
+      converter: converters.DOMString,
+      defaultValue: () => '',
+    },
+    {
+      // WorkerType type = "classic";
+      key: 'type',
+      converter: convertWorkerType,
+      defaultValue: () => 'classic',
+    },
+    {
+      // RequestCredentials credentials = "same-origin"; // credentials is only used if type is "module"
+      // (We don't actually use this, but parity with the spec is good, right?)
+      key: 'credentials',
+      converter: convertRequestCredentials,
+      defaultValue: () => 'same-origin',
+    },
+  ]);
+// };
+
+/**
+ * @param {URL} workerURL The parsed URL of the worker script.
+ * @param {'classic'|'module'} type The worker's type.
+ * @returns {{ value?: URL, source?: string }|null}
+ */
+function resolveWorkerEntry(workerURL, type) {
+  switch (workerURL.protocol) {
+    case 'file:':
+      return { value: workerURL };
+    case 'data:': {
+      const source = readDataURLScript(workerURL);
+      if (source === undefined) {
+        return null;
+      }
+      return { source };
+    }
+    case 'blob:': {
+      const blob = resolveObjectURL(workerURL.href);
+      // Blobs are commonly created without an explicit content type, so an
+      // empty type is accepted in addition to JavaScript MIME types.
+      const data = getScriptBlobData(blob, true);
+      if (data === undefined) {
+        return null;
+      }
+      if (type === 'module') {
+        // The blob's contents are re-wrapped as a data: URL so that the
+        // module loader evaluates them as a module script.
+        // TODO(@avivkeller): What if we update the ESM loader to accept blob:
+        // urls?
+        const bytes = new Uint8Array(data);
+        return {
+          value: new URL('data:text/javascript;base64,' + base64Slice(
+            bytes, 0, TypedArrayPrototypeGetLength(bytes))),
+        };
+      }
+      return { source: utf8Decode(data) };
+    }
+    default:
+      throw lazyDOMException(
+        `Worker scripts must be file:, data: or blob: URLs: ${workerURL.href}`,
+        'NotSupportedError');
+  }
+}
+
+// https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-worker-interface
+//
+// [Exposed=(Window,DedicatedWorker,SharedWorker)]
+// interface Worker : EventTarget {
+class Worker extends EventTarget {
+  // constructor((TrustedScriptURL or USVString) scriptURL, optional WorkerOptions options = {});
+  constructor(scriptURL, options = kEmptyObject) {
+    const prefix = "Failed to construct 'Worker'";
+    requiredArguments(arguments.length, 1, { prefix });
+    super();
+    scriptURL = converters.USVString(
+      scriptURL, { prefix, context: 'Argument 1' });
+    options = convertWorkerOptions(options, { prefix, context: 'Argument 2' });
+
+    // "Let workerURL be the result of encoding-parsing a URL given
+    // compliantScriptURL, relative to outsideSettings."
+    const workerURL = URLParse(scriptURL, scopeBaseURL ?? getCWDURL());
+
+    if (workerURL === null) {
+      // "If workerURL is failure, then throw a "SyntaxError" DOMException."
+      throw lazyDOMException(
+        `Failed to parse URL: ${scriptURL}`, 'SyntaxError');
+    }
+
+    this[kWorker] = null;
+    const entry = resolveWorkerEntry(workerURL, options.type);
+    if (entry === null) {
+      // "If the algorithm asynchronously completes with null or with a
+      // script whose error to rethrow is non-null, then: Queue a global
+      // task on the DOM manipulation task source given worker's relevant
+      // global object to fire an event named error at worker."
+      const { setImmediate } = require('timers');
+      setImmediate(() => {
+        this.dispatchEvent(createErrorEvent({
+          message: `Failed to fetch the worker script: ${workerURL.href}`,
+          cancelable: true,
+        }));
+      });
+      return;
+    }
+
+    // "Run this step in parallel:"
+    //
+    // "Run a worker given worker, workerURL, outsideSettings, outsidePort,
+    // and options."
+    this[kWorker] = new NodeWorker(entry.value ?? '', {
+      name: options.name,
+      eval: entry.source !== undefined,
+      [kWebWorkerData]: {
+        url: workerURL.href,
+        name: options.name,
+        type: options.type,
+        source: entry.source,
+      },
+    });
+
+    forwardMessageEvents(this[kWorker][kPublicPort], this);
+
+    // "Set notHandled to the result of firing an event named error at
+    // workerObject, using ErrorEvent, with the cancelable attribute
+    // initialized to true, and additional attributes initialized according
+    // to errorInfo."
+    this[kWorker].on('error', (error) =>
+      this.dispatchEvent(createErrorEvent({
+        message: `${error?.message ?? error}`,
+        error,
+        cancelable: true,
+      })));
+  }
+
+  // undefined terminate();
+  terminate() {
+    validateThisInternalField(this, kWorker, 'Worker');
+    // "The terminate() method steps are to terminate a worker given this's
+    // worker."
+    this[kWorker]?.terminate();
+  }
+
+  // undefined postMessage(any message, sequence<object> transfer);
+  // undefined postMessage(any message, optional StructuredSerializeOptions options = {});
+  postMessage(message, transferOrOptions = kEmptyObject) {
+    validateThisInternalField(this, kWorker, 'Worker');
+    requiredArguments(arguments.length, 1, kWorkerPostMessageOptions);
+    // When the second argument was omitted there is nothing to convert.
+    const transfer = transferOrOptions === kEmptyObject ? undefined :
+      normalizeTransfer(transferOrOptions, kWorkerPostMessageOptions);
+    // "The postMessage(message, transfer) and postMessage(message, options)
+    // methods on Worker objects act as if, when invoked, they immediately
+    // invoked the respective postMessage(message, transfer) and
+    // postMessage(message, options) on this's outside port, with the same
+    // arguments, and returned the same return value."
+    this[kWorker]?.postMessage(message, transfer);
+  }
+
+  // The following properties are non-standard, Node.js extensions
+  [kRef]() {
+    validateThisInternalField(this, kWorker, 'Worker');
+    this[kWorker]?.ref();
+  }
+
+  [kUnref]() {
+    validateThisInternalField(this, kWorker, 'Worker');
+    this[kWorker]?.unref();
+  }
+}
+
+ObjectDefineProperties(Worker.prototype, {
+  terminate: kEnumerableProperty,
+  postMessage: kEnumerableProperty,
+  [SymbolToStringTag]: {
+    __proto__: null,
+    configurable: true,
+    value: 'Worker',
+  },
+});
+// };
+
+// Worker includes AbstractWorker;
+includeAbstractWorker(Worker.prototype);
+// Worker includes MessageEventTarget;
+includeMessageEventTarget(Worker.prototype);
+
+// Operations of the worker global scope that are additionally exposed as
+// own properties of the global object
+const kScopeOperations = [
+  // EventTarget
+  'addEventListener', 'dispatchEvent', 'removeEventListener',
+  // WorkerGlobalScope
+  'importScripts',
+  // DedicatedWorkerGlobalScope
+  'postMessage', 'close',
+];
+
+/**
+ * @param {URL | string} url The worker's script URL.
+ * @param {{ name?: string, type?: string, port?: MessagePort }} [options]
+ * @returns {DedicatedWorkerGlobalScope} globalThis
+ */
+function installDedicatedWorkerGlobalScope(url, {
+  name = '',
+  type = 'classic',
+  port = require('worker_threads').parentPort,
+} = kEmptyObject) {
+  const locationURL = new URL(url);
+
+  if (type === 'classic' && locationURL.protocol === 'file:') {
+    const { Module } = require('internal/modules/cjs/loader');
+    ObjectDefineProperty(globalThis, 'require', {
+      __proto__: null,
+      configurable: true,
+      writable: true,
+      value: Module.createRequire(locationURL),
+    });
+  }
+
+  const globalProto = ObjectGetPrototypeOf(globalThis);
+  ObjectSetPrototypeOf(globalProto, DedicatedWorkerGlobalScope.prototype);
+  ObjectDefineProperty(globalProto, 'constructor', {
+    __proto__: null,
+    configurable: true,
+    writable: true,
+    value: DedicatedWorkerGlobalScope,
+  });
+
+  initEventTarget(globalThis);
+
+  // "Create a new WorkerLocation object and associate it with worker global
+  // scope."
+  globalThis[kLocation] = new WorkerLocation(kCreate, locationURL);
+  globalThis[kName] = `${name}`;
+  globalThis[kType] = type;
+  // "DedicatedWorkerGlobalScope objects have an associated inside port (a
+  // MessagePort)."
+  // "Set worker global scope's inside port to inside port."
+  globalThis[kInsidePort] = port;
+  scopeBaseURL = locationURL;
+
+  if (port !== null) {
+    // "Set inside port's message event target to worker global scope."
+    forwardMessageEvents(port, globalThis);
+  }
+
+  // We install our own navigator, crypto and performance, see
+  // WorkerGlobalScope
+  ReflectDeleteProperty(globalThis, 'navigator');
+  ReflectDeleteProperty(globalThis, 'Navigator');
+  ReflectDeleteProperty(globalThis, 'crypto');
+  ReflectDeleteProperty(globalThis, 'performance');
+
+  for (let i = 0; i < kScopeOperations.length; i++) {
+    const key = kScopeOperations[i];
+    defineOperation(globalThis, key, assignFunctionName(
+      key, FunctionPrototypeBind(globalThis[key], globalThis)));
+  }
+
+  // [Exposed=Worker] and [Exposed=DedicatedWorker]
+  exposeInterface(globalThis, 'WorkerGlobalScope', WorkerGlobalScope);
+  exposeInterface(
+    globalThis, 'DedicatedWorkerGlobalScope', DedicatedWorkerGlobalScope);
+  exposeInterface(globalThis, 'WorkerNavigator', WorkerNavigator);
+  exposeInterface(globalThis, 'WorkerLocation', WorkerLocation);
+  return globalThis;
+}
+
+module.exports = {
+  Worker,
+  installDedicatedWorkerGlobalScope,
+  runClassicScriptSource,
+  runModuleScriptSource,
+};
diff --git a/lib/internal/worker.js b/lib/internal/worker.js
index 39eb59ef8f67..f3f3c23a5abe 100644
--- a/lib/internal/worker.js
+++ b/lib/internal/worker.js
@@ -96,6 +96,7 @@ const kParentSideStdio = Symbol('kParentSideStdio');
 const kLoopStartTime = Symbol('kLoopStartTime');
 const kIsInternal = Symbol('kIsInternal');
 const kIsOnline = Symbol('kIsOnline');
+const kWebWorkerData = Symbol('kWebWorkerData');
 
 const SHARE_ENV = SymbolFor('nodejs.worker_threads.SHARE_ENV');
 let debug = require('internal/util/debuglog').debuglog('worker', (fn) => {
@@ -363,6 +364,7 @@ class Worker extends EventEmitter {
       isInternal,
       cwdCounter: cwdCounter || workerIo.sharedCwdCounter,
       workerData: options.workerData,
+      webWorkerData: options[kWebWorkerData],
       environmentData,
       hasStdin: !!options.stdin,
       publicPort: publicPortToWorker,
@@ -732,4 +734,6 @@ module.exports = {
   threadName,
   InternalWorker,
   Worker,
+  kPublicPort,
+  kWebWorkerData,
 };
diff --git a/lib/internal/worker/io.js b/lib/internal/worker/io.js
index b73256734079..011c00b0149c 100644
--- a/lib/internal/worker/io.js
+++ b/lib/internal/worker/io.js
@@ -478,6 +478,7 @@ function markAsUncloneable(obj) {
 
 module.exports = {
   drainMessagePort,
+  lazyMessageEvent,
   messageTypes,
   kPort,
   kIncrementsPortRef,
diff --git a/lib/internal/worker/js_transferable.js b/lib/internal/worker/js_transferable.js
index 0ae80d9a7287..bdd0d648996d 100644
--- a/lib/internal/worker/js_transferable.js
+++ b/lib/internal/worker/js_transferable.js
@@ -98,18 +98,6 @@ function markTransferMode(obj, cloneable = false, transferable = false) {
 }
 
 
-webidl.converters.StructuredSerializeOptions = webidl
-  .createDictionaryConverter(
-    'StructuredSerializeOptions',
-    [
-      {
-        key: 'transfer',
-        converter: webidl.converters['sequence<object>'],
-        defaultValue: () => [],
-      },
-    ],
-  );
-
 function structuredClone(value, options) {
   if (arguments.length === 0) {
     throw new ERR_MISSING_ARGS('The value argument must be specified');
diff --git a/lib/internal/zip/entry.js b/lib/internal/zip/entry.js
index 566f5ba58a51..cfe54903a126 100644
--- a/lib/internal/zip/entry.js
+++ b/lib/internal/zip/entry.js
@@ -501,15 +501,14 @@ class ZipEntry {
   // The entry's raw compressed bytes as a bounded-memory chunk stream, read
   // straight from disk (file-backed entries only). Nothing is retained.
   async *#rawChunks() {
-    // Count the whole stream as one in-flight read so a concurrent close()
-    // waits for it (the finally runs when the consumer stops iterating); a
-    // stream begun after close() was requested is rejected up front.
+    // Count active reads, but not time paused at a yield.
     const handle = this.#fd;
     if (handle.closing) {
       throw new ERR_INVALID_STATE(
         'cannot read a ZipEntry after its backing ZipFile has been closed');
     }
     handle.reads++;
+    let reading = true;
     try {
       this.#liveDescriptor();
       let pos = await this.#resolveContentOffset();
@@ -521,10 +520,18 @@ class ZipEntry {
         await readFdFully(this.#liveDescriptor(), chunk, pos);
         pos += take;
         remaining -= take;
+        reading = false;
+        endHandleRead(handle);
         yield chunk;
+        if (handle.closing) {
+          throw new ERR_INVALID_STATE(
+            'cannot read a ZipEntry after its backing ZipFile has been closed');
+        }
+        handle.reads++;
+        reading = true;
       }
     } finally {
-      endHandleRead(handle);
+      if (reading) endHandleRead(handle);
     }
   }
   // Sync counterpart of #rawChunks().
diff --git a/lib/perf_hooks.js b/lib/perf_hooks.js
index 18e979630e0e..cc158e5c7625 100644
--- a/lib/perf_hooks.js
+++ b/lib/perf_hooks.js
@@ -25,6 +25,7 @@ const {
 
 const {
   createHistogram,
+  importHistogram,
 } = require('internal/histogram');
 
 const monitorEventLoopDelay = require('internal/perf/event_loop_delay');
@@ -43,6 +44,7 @@ module.exports = {
   eventLoopUtilization,
   timerify,
   createHistogram,
+  importHistogram,
   performance,
 };
 
diff --git a/lib/v8.js b/lib/v8.js
index bb174f8d5243..ea3366bb9617 100644
--- a/lib/v8.js
+++ b/lib/v8.js
@@ -20,6 +20,7 @@ const {
   BigUint64Array,
   DataView,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Int16Array,
@@ -32,9 +33,6 @@ const {
   Uint32Array,
   Uint8Array,
   Uint8ClampedArray,
-  globalThis: {
-    Float16Array,
-  },
 } = primordials;
 
 const { Buffer } = require('buffer');
@@ -128,6 +126,7 @@ const {
   updateHeapSpaceStatisticsBuffer,
   updateHeapCodeStatisticsBuffer,
   setHeapSnapshotNearHeapLimit: _setHeapSnapshotNearHeapLimit,
+  setHeapProfileNearHeapLimit: _setHeapProfileNearHeapLimit,
 
   // Properties for heap statistics buffer extraction.
   kTotalHeapSizeIndex,
@@ -360,6 +359,16 @@ function setHeapSnapshotNearHeapLimit(limit) {
   _setHeapSnapshotNearHeapLimit(limit);
 }
 
+let heapProfileNearHeapLimitAdded = false;
+function setHeapProfileNearHeapLimit(limit) {
+  validateUint32(limit, 'limit', true);
+  if (heapProfileNearHeapLimitAdded) {
+    return;
+  }
+  _setHeapProfileNearHeapLimit(limit);
+  heapProfileNearHeapLimitAdded = true;
+}
+
 const detailLevelDict = {
   __proto__: null,
   detailed: detailLevel.DETAILED,
@@ -563,6 +572,7 @@ module.exports = {
   queryObjects,
   startupSnapshot,
   setHeapSnapshotNearHeapLimit,
+  setHeapProfileNearHeapLimit,
   GCProfiler,
   isStringOneByteRepresentation,
   startCpuProfile,
diff --git a/lib/vfs.js b/lib/vfs.js
index 0d12229aca72..e6ff5e06dcc7 100644
--- a/lib/vfs.js
+++ b/lib/vfs.js
@@ -8,6 +8,7 @@ const { VirtualFileSystem } = require('internal/vfs/file_system');
 const { VirtualProvider } = require('internal/vfs/provider');
 const { MemoryProvider } = require('internal/vfs/providers/memory');
 const { RealFSProvider } = require('internal/vfs/providers/real');
+const { ZipProvider } = require('internal/vfs/providers/ziparchive');
 
 /**
  * Creates a new VirtualFileSystem instance.
@@ -34,4 +35,5 @@ module.exports = {
   VirtualProvider,
   MemoryProvider,
   RealFSProvider,
+  ZipProvider,
 };
diff --git a/node.gni b/node.gni
index 21c8de1b2afb..fa4668a543e2 100644
--- a/node.gni
+++ b/node.gni
@@ -82,5 +82,19 @@ declare_args() {
   node_use_amaro = true
 }
 
+# Link against shared copies of the bundled dependencies instead of building
+# them, like configure's --shared-* options. The libraries are looked up with
+# pkg-config, so these are meant for Linux distribution builds.
+declare_args() {
+  node_shared_brotli = false
+  node_shared_cares = false
+  node_shared_hdr_histogram = false
+  node_shared_http_parser = false
+  node_shared_libuv = false
+  node_shared_nghttp2 = false
+  node_shared_sqlite = false
+  node_shared_zstd = false
+}
+
 assert(!node_enable_inspector || node_use_openssl,
        "node_enable_inspector requires node_use_openssl")
diff --git a/node.gyp b/node.gyp
index 66196b411062..52f421f3181c 100644
--- a/node.gyp
+++ b/node.gyp
@@ -15,10 +15,12 @@
     'node_lib_target_name%': 'libnode',
     'node_module_version%': '',
     'node_no_browser_globals%': 'false',
+    'node_shared_abseil%': 'false',
     'node_shared_brotli%': 'false',
     'node_shared_cares%': 'false',
     'node_shared_gtest%': 'false',
     'node_shared_hdr_histogram%': 'false',
+    'node_shared_highway%': 'false',
     'node_shared_http_parser%': 'false',
     'node_shared_libuv%': 'false',
     'node_shared_lief%': 'false',
@@ -26,6 +28,7 @@
     'node_shared_nbytes%': 'false',
     'node_shared_nghttp2%': 'false',
     'node_shared_openssl%': 'false',
+    'node_shared_perfetto%': 'false',
     'node_shared_sqlite%': 'false',
     'node_shared_ffi%': 'false',
     'node_shared_temporal_capi%': 'false',
@@ -40,6 +43,7 @@
     'node_use_node_snapshot%': 'false',
     'node_use_openssl%': 'true',
     'node_use_quic%': 'false',
+    'node_use_dtls%': 'false',
     'node_use_sqlite%': 'true',
     'node_use_ffi%': 'false',
     'node_use_v8_platform%': 'true',
@@ -234,8 +238,6 @@
       'src/histogram-inl.h',
       'src/js_stream.h',
       'src/json_utils.h',
-      'src/large_pages/node_large_page.cc',
-      'src/large_pages/node_large_page.h',
       'src/memory_tracker.h',
       'src/memory_tracker-inl.h',
       'src/module_wrap.h',
@@ -370,6 +372,16 @@
       'src/quic/tlscontext.h',
       'src/quic/guard.h',
     ],
+    'node_dtls_sources': [
+      'src/dtls/dtls.cc',
+      'src/dtls/dtls_context.cc',
+      'src/dtls/dtls_endpoint.cc',
+      'src/dtls/dtls_session.cc',
+      'src/dtls/dtls.h',
+      'src/dtls/dtls_context.h',
+      'src/dtls/dtls_endpoint.h',
+      'src/dtls/dtls_session.h',
+    ],
     'node_crypto_sources': [
       'src/crypto/crypto_aes.cc',
       'src/crypto/crypto_argon2.cc',
@@ -382,12 +394,15 @@
       'src/crypto/crypto_sig.cc',
       'src/crypto/crypto_timing.cc',
       'src/crypto/crypto_cipher.cc',
+      'src/crypto/crypto_client_hello.cc',
       'src/crypto/crypto_context.cc',
+      'src/crypto/crypto_tls_certificates.cc',
       'src/crypto/crypto_ec.cc',
       'src/crypto/crypto_pqc.cc',
       'src/crypto/crypto_kem.cc',
       'src/crypto/crypto_hmac.cc',
       'src/crypto/crypto_kmac.cc',
+      'src/crypto/crypto_mac.cc',
       'src/crypto/crypto_turboshake.cc',
       'src/crypto/crypto_random.cc',
       'src/crypto/crypto_rsa.cc',
@@ -405,11 +420,13 @@
       'src/crypto/crypto_dh.h',
       'src/crypto/crypto_hmac.h',
       'src/crypto/crypto_kmac.h',
+      'src/crypto/crypto_mac.h',
       'src/crypto/crypto_turboshake.h',
       'src/crypto/crypto_rsa.h',
       'src/crypto/crypto_spkac.h',
       'src/crypto/crypto_util.h',
       'src/crypto/crypto_cipher.h',
+      'src/crypto/crypto_client_hello.h',
       'src/crypto/crypto_common.h',
       'src/crypto/crypto_dsa.h',
       'src/crypto/crypto_hash.h',
@@ -418,6 +435,7 @@
       'src/crypto/crypto_scrypt.h',
       'src/crypto/crypto_tls.h',
       'src/crypto/crypto_context.h',
+      'src/crypto/crypto_tls_certificates.h',
       'src/crypto/crypto_ec.h',
       'src/crypto/crypto_pqc.h',
       'src/crypto/crypto_hkdf.h',
@@ -490,11 +508,6 @@
     'node_mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)node_mksnapshot<(EXECUTABLE_SUFFIX)',
     'node_js2c_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)node_js2c<(EXECUTABLE_SUFFIX)',
     'conditions': [
-      ['GENERATOR == "ninja"', {
-        'node_text_start_object_path': 'src/large_pages/node_text_start.node_text_start.o'
-      }, {
-        'node_text_start_object_path': 'node_text_start/src/large_pages/node_text_start.o'
-      }],
       [ 'node_shared=="true"', {
         'node_target_type%': 'shared_library',
         'node_lib_type': 'shared_library',
@@ -572,19 +585,6 @@
   },
 
   'targets': [
-    {
-      'target_name': 'node_text_start',
-      'type': 'none',
-      'conditions': [
-        [ 'OS in "linux freebsd solaris openharmony" and '
-          'target_arch=="x64"', {
-          'type': 'static_library',
-          'sources': [
-            'src/large_pages/node_text_start.S'
-          ]
-        }],
-      ]
-    },
     {
       'target_name': '<(node_core_target_name)',
       'type': 'executable',
@@ -756,14 +756,6 @@
             },
           },
         }],
-        [ 'OS in "linux freebsd openharmony" and '
-          'target_arch=="x64"', {
-          'dependencies': [ 'node_text_start' ],
-          'ldflags+': [
-            '<(obj_dir)/<(node_text_start_object_path)'
-          ]
-        }],
-
         ['node_fipsinstall=="true"', {
           'variables': {
             'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',
@@ -912,7 +904,7 @@
         [ 'node_builtin_modules_path!=""', {
           'defines': [ 'NODE_BUILTIN_MODULES_PATH="<(node_builtin_modules_path)"' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_gtest=="false"', {
@@ -951,8 +943,12 @@
           'sources': [
             '<@(node_tracing_perfetto_sources)',
           ],
-          'dependencies': [
-            'deps/perfetto/perfetto.gyp:perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                'deps/perfetto/perfetto.gyp:perfetto_sdk',
+              ],
+            }],
           ],
         }, {
           'sources': [
@@ -992,10 +988,13 @@
             '<@(node_quic_sources)',
           ],
         }],
-        [ 'OS in "linux freebsd mac solaris openharmony" and '
-          'target_arch=="x64" and '
-          'node_target_type=="executable"', {
-          'defines': [ 'NODE_ENABLE_LARGE_CODE_PAGES=1' ],
+        [ 'node_use_dtls=="true"', {
+          'sources': [
+            '<@(node_dtls_sources)',
+          ],
+          'defines': [
+            'HAVE_DTLS=1',
+          ],
         }],
         [ 'use_openssl_def==1', {
           # TODO(bnoordhuis) Make all platforms export the same list of symbols.
@@ -1377,7 +1376,7 @@
         [ 'node_shared_gtest=="true"', {
           'libraries': [ '-lgtest_main' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_hdr_histogram=="false"', {
@@ -1407,7 +1406,7 @@
         }, {
           'sources!': [ '<@(node_cctest_quic_sources)' ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
@@ -1737,7 +1736,7 @@
             'NODE_USE_NODE_CODE_CACHE=1',
           ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
diff --git a/node.gypi b/node.gypi
index 104e884e6614..bfe2d00ad929 100644
--- a/node.gypi
+++ b/node.gypi
@@ -99,6 +99,9 @@
     [ 'node_enable_v8windbg=="true"', {
       'dependencies': [ 'tools/v8_gypfiles/v8windbg.gyp:build_v8windbg' ],
     }],
+    [ 'node_enable_v8debughelper=="true"', {
+      'dependencies': [ 'tools/v8_gypfiles/v8_debug_helper.gyp:build_v8_debug_helper' ],
+    }],
     [ 'node_use_bundled_v8=="true"', {
       'dependencies': [
         'tools/v8_gypfiles/v8.gyp:v8_snapshot',
diff --git a/shell.nix b/shell.nix
index 96fcccbc1914..1829c1efd21b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -29,6 +29,7 @@
         withSQLite
         withFFI
         withSSL
+        withPerfetto
         withTemporal
         ;
     }
@@ -52,6 +53,7 @@ let
   useSharedAda = builtins.hasAttr "ada" sharedLibDeps;
   useSharedOpenSSL = builtins.hasAttr "openssl" sharedLibDeps;
 
+  useSharedPerfetto = builtins.hasAttr "perfetto" sharedLibDeps;
   useSharedTemporal = builtins.hasAttr "temporal_capi" sharedLibDeps;
   needsRustCompiler = withTemporal && !useSharedTemporal;
 
@@ -63,6 +65,9 @@ let
     ];
   buildInputs =
     pkgs.lib.optional useSharedICU icu
+    ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) sharedLibDeps.abseil
+    ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) sharedLibDeps.highway
+    ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) sharedLibDeps.perfetto
     ++ pkgs.lib.optional (withTemporal && useSharedTemporal) sharedLibDeps.temporal_capi;
 
   # Put here only the configure flags that affect the V8 build
@@ -75,6 +80,9 @@ let
     )
     "--v8-${if withTemporal then "enable" else "disable"}-temporal-support"
   ]
+  ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) "--shared-abseil"
+  ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) "--shared-highway"
+  ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) "--shared-perfetto"
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
@@ -132,6 +140,8 @@ pkgs.mkShell {
             builtins.attrNames (
               if (useSeparateDerivationForV8 != false) then
                 builtins.removeAttrs sharedLibDeps [
+                  "abseil"
+                  "highway"
                   "simdutf"
                   "temporal_capi"
                 ]
@@ -141,6 +151,22 @@ pkgs.mkShell {
           )
     );
   }
+  // (
+    let
+      ruff = pkgs.lib.lists.findFirst (p: p.meta.mainProgram == "ruff") null devTools;
+    in
+    pkgs.lib.optionalAttrs (ruff != null) {
+      RUFF = pkgs.lib.getExe ruff;
+    }
+  )
+  // (
+    let
+      yamllint = pkgs.lib.lists.findFirst (p: p.meta.mainProgram == "yamllint") null devTools;
+    in
+    pkgs.lib.optionalAttrs (yamllint != null) {
+      YAMLLINT = pkgs.lib.getExe yamllint;
+    }
+  )
   // pkgs.lib.optionalAttrs (!withSQLite) {
     NOSQLITE = "1";
   }
diff --git a/src/api/environment.cc b/src/api/environment.cc
index c3fd1e583735..67a92f1cdc05 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -225,7 +225,8 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
 #endif
 }
 
-void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s) {
+static void SetIsolateErrorHandlers(v8::Isolate* isolate,
+                                    const IsolateSettings& s) {
   if (s.flags & MESSAGE_LISTENER_WITH_ERROR_LEVEL)
     isolate->AddMessageListenerWithErrorLevel(
             errors::PerIsolateMessageListener,
@@ -350,16 +351,7 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
 
   SetIsolateCreateParamsForNode(params);
   Isolate::Initialize(isolate, *params);
-
-  Isolate::Scope isolate_scope(isolate);
-
-  if (snapshot_data == nullptr) {
-    // If in deserialize mode, delay until after the deserialization is
-    // complete.
-    SetIsolateUpForNode(isolate, settings);
-  } else {
-    SetIsolateMiscHandlers(isolate, settings);
-  }
+  SetIsolateUpForNode(isolate, settings);
 
   return isolate;
 }
@@ -451,6 +443,11 @@ Environment* CreateEnvironment(
 
   const bool use_snapshot = context.IsEmpty();
   const EnvSerializeInfo* env_snapshot_info = nullptr;
+  // A worker thread (its IsolateData knows its Worker) deserializes the same
+  // bootstrapped principal context the main thread uses and then has the
+  // worker-side bootstrap switches applied on top of it (they are written as
+  // overrides of the main-thread setup).
+  const bool for_worker = isolate_data->worker_context() != nullptr;
   if (use_snapshot) {
     CHECK_NOT_NULL(isolate_data->snapshot_data());
     env_snapshot_info = &isolate_data->snapshot_data()->env_info;
@@ -487,12 +484,30 @@ Environment* CreateEnvironment(
       FreeEnvironment(env);
       return nullptr;
     }
-    SetIsolateErrorHandlers(isolate, {});
   }
 
   Context::Scope context_scope(context);
   env->InitializeMainContext(context, env_snapshot_info);
 
+  if (use_snapshot && for_worker) {
+    // The deserialized context went through is_main_thread /
+    // does_own_process_state when the snapshot was built; the worker-side
+    // switches redefine exactly those pieces (stdio getters, signal wiring,
+    // process.abort/chdir/umask/..., debug helpers).
+    if (env->principal_realm()
+            ->ExecuteBootstrapper(
+                "internal/bootstrap/switches/is_not_main_thread")
+            .IsEmpty() ||
+        (!env->owns_process_state() &&
+         env->principal_realm()
+             ->ExecuteBootstrapper(
+                 "internal/bootstrap/switches/does_not_own_process_state")
+             .IsEmpty())) {
+      FreeEnvironment(env);
+      return nullptr;
+    }
+  }
+
 #if HAVE_INSPECTOR
   if (env->should_create_inspector()) {
     if (inspector_parent_handle) {
diff --git a/src/api/exceptions.cc b/src/api/exceptions.cc
index 871fe78de951..4396dc19d842 100644
--- a/src/api/exceptions.cc
+++ b/src/api/exceptions.cc
@@ -8,6 +8,8 @@
 #include "v8.h"
 
 #include <cstring>
+#include <string>
+#include <string_view>
 
 namespace node {
 
@@ -20,6 +22,40 @@ using v8::Object;
 using v8::String;
 using v8::Value;
 
+static Local<String> StringFromPath(Isolate* isolate, std::string_view path) {
+#ifdef _WIN32
+  constexpr std::string_view kUncPrefix = "\\\\?\\UNC\\";
+  constexpr std::string_view kLongPrefix = "\\\\?\\";
+
+  if (path.starts_with(kUncPrefix)) {
+    std::string s;
+    s.reserve(2 + (path.size() - kUncPrefix.size()));
+    s.append("\\\\");
+    s.append(path.substr(kUncPrefix.size()));
+    return String::NewFromUtf8(isolate,
+                               s.data(),
+                               v8::NewStringType::kNormal,
+                               static_cast<int>(s.size()))
+        .ToLocalChecked();
+  }
+
+  if (path.starts_with(kLongPrefix)) {
+    auto rest = path.substr(kLongPrefix.size());
+    return String::NewFromUtf8(isolate,
+                               rest.data(),
+                               v8::NewStringType::kNormal,
+                               static_cast<int>(rest.size()))
+        .ToLocalChecked();
+  }
+#endif
+
+  return String::NewFromUtf8(isolate,
+                             path.data(),
+                             v8::NewStringType::kNormal,
+                             static_cast<int>(path.size()))
+      .ToLocalChecked();
+}
+
 Local<Value> ErrnoException(Isolate* isolate,
                             int errorno,
                             const char* syscall,
@@ -42,7 +78,7 @@ Local<Value> ErrnoException(Isolate* isolate,
   Local<String> path_string;
   if (path != nullptr) {
     // FIXME(bnoordhuis) It's questionable to interpret the file path as UTF-8.
-    path_string = String::NewFromUtf8(isolate, path).ToLocalChecked();
+    path_string = StringFromPath(isolate, std::string_view(path));
   }
 
   if (path_string.IsEmpty() == false) {
@@ -72,22 +108,6 @@ Local<Value> ErrnoException(Isolate* isolate,
   return e;
 }
 
-static Local<String> StringFromPath(Isolate* isolate, const char* path) {
-#ifdef _WIN32
-  if (strncmp(path, "\\\\?\\UNC\\", 8) == 0) {
-    return String::Concat(
-        isolate,
-        FIXED_ONE_BYTE_STRING(isolate, "\\\\"),
-        String::NewFromUtf8(isolate, path + 8).ToLocalChecked());
-  } else if (strncmp(path, "\\\\?\\", 4) == 0) {
-    return String::NewFromUtf8(isolate, path + 4).ToLocalChecked();
-  }
-#endif
-
-  return String::NewFromUtf8(isolate, path).ToLocalChecked();
-}
-
-
 Local<Value> UVException(Isolate* isolate,
                          int errorno,
                          const char* syscall,
@@ -114,7 +134,7 @@ Local<Value> UVException(Isolate* isolate,
   js_msg = String::Concat(isolate, js_msg, js_syscall);
 
   if (path != nullptr) {
-    js_path = StringFromPath(isolate, path);
+    js_path = StringFromPath(isolate, std::string_view(path));
 
     js_msg =
         String::Concat(isolate, js_msg, FIXED_ONE_BYTE_STRING(isolate, " '"));
@@ -124,7 +144,7 @@ Local<Value> UVException(Isolate* isolate,
   }
 
   if (dest != nullptr) {
-    js_dest = StringFromPath(isolate, dest);
+    js_dest = StringFromPath(isolate, std::string_view(dest));
 
     js_msg = String::Concat(
         isolate, js_msg, FIXED_ONE_BYTE_STRING(isolate, " -> '"));
diff --git a/src/api/hooks.cc b/src/api/hooks.cc
index 09a79fb9da81..b46073b6b7cf 100644
--- a/src/api/hooks.cc
+++ b/src/api/hooks.cc
@@ -145,8 +145,15 @@ static ExclusiveAccess<CleanupHookRegistry> cleanup_hook_registry;
 
 static void CleanupHookThunkRun(void* arg) {
   const CleanupHookThunk* thunk = static_cast<CleanupHookThunk*>(arg);
-  thunk->fun(thunk->arg);
-  RemoveEnvironmentCleanupHook(thunk->isolate, thunk->fun, thunk->arg);
+  // `thunk->fun` may itself remove and free this CleanupHookThunk (e.g. via
+  // ~ObjectWrap(), which calls RemoveEnvironmentCleanupHook()), so cache the
+  // fields we still need before invoking it rather than reading them from
+  // `thunk` afterwards.
+  Isolate* isolate = thunk->isolate;
+  CleanupHook fun = thunk->fun;
+  void* fun_arg = thunk->arg;
+  fun(fun_arg);
+  RemoveEnvironmentCleanupHook(isolate, fun, fun_arg);
 }
 
 void AddEnvironmentCleanupHook(Isolate* isolate,
diff --git a/src/async_wrap.h b/src/async_wrap.h
index bf9267545477..8c8f1e59de36 100644
--- a/src/async_wrap.h
+++ b/src/async_wrap.h
@@ -52,6 +52,8 @@ namespace node {
   V(HTTPINCOMINGMESSAGE)                                                       \
   V(HTTPCLIENTREQUEST)                                                         \
   V(LOCKS)                                                                     \
+  V(DTLS_ENDPOINT)                                                             \
+  V(DTLS_SESSION)                                                              \
   V(JSSTREAM)                                                                  \
   V(JSUDPWRAP)                                                                 \
   V(MESSAGEPORT)                                                               \
diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index f1382b040362..801ada532c70 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -888,7 +888,7 @@ void NodeAresTask::MemoryInfo(MemoryTracker* tracker) const {
 
 /* Allocates and returns a new NodeAresTask */
 NodeAresTask* NodeAresTask::Create(ChannelWrap* channel, ares_socket_t sock) {
-  auto task = new NodeAresTask();
+  auto task = std::make_unique<NodeAresTask>();
 
   task->channel = channel;
   task->sock = sock;
@@ -896,11 +896,10 @@ NodeAresTask* NodeAresTask::Create(ChannelWrap* channel, ares_socket_t sock) {
   if (uv_poll_init_socket(channel->env()->event_loop(),
                           &task->poll_watcher, sock) < 0) {
     /* This should never happen. */
-    delete task;
     return nullptr;
   }
 
-  return task;
+  return task.release();
 }
 
 void ChannelWrap::Setup() {
diff --git a/src/compile_cache.cc b/src/compile_cache.cc
index 8efd7b68856c..6e891619f42b 100644
--- a/src/compile_cache.cc
+++ b/src/compile_cache.cc
@@ -177,7 +177,7 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
   size_t offset = headers_buf.len;
   size_t capacity = 4096;  // Initial buffer capacity
   size_t total_read = 0;
-  uint8_t* buffer = new uint8_t[capacity];
+  auto buffer = std::make_unique<uint8_t[]>(capacity);
 
   while (true) {
     // If there is not enough space to read more data, do a simple
@@ -185,20 +185,19 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
     // the underlying buffer to be delete[]-able).
     if (total_read == capacity) {
       size_t new_capacity = capacity * 2;
-      auto* new_buffer = new uint8_t[new_capacity];
-      memcpy(new_buffer, buffer, capacity);
-      delete[] buffer;
-      buffer = new_buffer;
+      auto new_buffer = std::make_unique<uint8_t[]>(new_capacity);
+      memcpy(new_buffer.get(), buffer.get(), capacity);
+      buffer = std::move(new_buffer);
       capacity = new_capacity;
     }
 
-    uv_buf_t iov = uv_buf_init(reinterpret_cast<char*>(buffer + total_read),
-                               capacity - total_read);
+    uv_buf_t iov =
+        uv_buf_init(reinterpret_cast<char*>(buffer.get() + total_read),
+                    capacity - total_read);
     int bytes_read =
         uv_fs_read(nullptr, &req, file, &iov, 1, offset + total_read, nullptr);
     if (req.result < 0) {  // Error.
       // req will be cleaned up by scope leave.
-      delete[] buffer;
       Debug(" %s\n", uv_strerror(req.result));
       return;
     }
@@ -216,7 +215,8 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
           total_read);
     return;
   }
-  uint32_t cache_hash = GetHash(reinterpret_cast<char*>(buffer), total_read);
+  uint32_t cache_hash =
+      GetHash(reinterpret_cast<char*>(buffer.get()), total_read);
   if (headers[kCacheHashOffset] != cache_hash) {
     Debug("cache hash mismatch: expected %d, actual %d\n",
           headers[kCacheHashOffset],
@@ -225,7 +225,7 @@ void CompileCacheHandler::ReadCacheFile(CompileCacheEntry* entry) {
   }
 
   entry->cache.reset(new ScriptCompiler::CachedData(
-      buffer, total_read, ScriptCompiler::CachedData::BufferOwned));
+      buffer.release(), total_read, ScriptCompiler::CachedData::BufferOwned));
   Debug(" success, size=%d\n", total_read);
 }
 
diff --git a/src/crypto/README.md b/src/crypto/README.md
index ad06cf989276..d3c1016e94a5 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -43,6 +43,7 @@ following table:
 | `crypto_hkdf`     | HKDF (Key derivation) implementation.                                |
 | `crypto_hmac`     | HMAC implementations.                                                |
 | `crypto_keys`     | Utilities for using and generating secret, private, and public keys. |
+| `crypto_mac`      | Provider-generic MAC implementations.                                |
 | `crypto_pbkdf2`   | PBKDF2 key / bit generation implementation.                          |
 | `crypto_rsa`      | RSA Key Generation functions.                                        |
 | `crypto_scrypt`   | Scrypt key / bit generation implementation.                          |
@@ -50,6 +51,7 @@ following table:
 | `crypto_spkac`    | Netscape SPKAC certificate utilities.                                |
 | `crypto_ssl`      | Implementation of the `SSLWrap` object.                              |
 | `crypto_timing`   | Implementation of the TimingSafeEqual.                               |
+| `crypto_x509`     | X.509 certificate parsing and validation.                            |
 
 When new crypto protocols are added, they will be added into their own
 `crypto_` `*.h` and `*.cc` files.
@@ -171,11 +173,12 @@ JavaScript needs access to those operations and is kept out of user-visible
 
 A `KeyObject` is the public Node.js-specific API for keys. It extends a
 native `NativeKeyObject`, which stores `KeyObjectData` for structured
-cloning. The JavaScript API surface reads its key type and a
-`KeyObjectHandle` through a hidden native-backed slot tuple, caching that
-tuple in a private field outside user-visible own properties. Derived
-metadata, such as symmetric key size and asymmetric key details, is read
-from the cached handle and appended lazily to the same private-field cache.
+cloning. The JavaScript constructor caches the known key type in a private
+field outside user-visible own properties. When a `KeyObjectHandle` is first
+needed, JavaScript replaces that value with a hidden native-backed slot tuple.
+Derived metadata, such as symmetric key size and asymmetric key details, is
+read from the cached handle and appended lazily to the same private-field
+cache.
 
 #### `CryptoKey`
 
@@ -183,7 +186,18 @@ A `CryptoKey` is the Web Crypto API key type. In the Node.js implementation,
 public `CryptoKey` instances are backed by a native `NativeCryptoKey`, not by
 a `KeyObject`. `NativeCryptoKey` stores the same `KeyObjectData`
 representation as `KeyObject`, plus the Web Crypto internal slots
-(`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`).
+(`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`). Normal construction
+primes a private JavaScript slot cache from the constructor arguments.
+Partially initialized transferred keys populate that cache from the native
+slots on first access.
+
+### X.509 certificates
+
+The public `X509Certificate` is backed directly by the native
+`X509Certificate` object. JavaScript caches derived certificate properties in
+a private array whose final entry is a bitmask of populated slots. Certificates
+from another realm use the same cache layout through a private `WeakMap` after
+passing the native brand check.
 
 ### `CryptoJob`
 
diff --git a/src/crypto/crypto_aes.h b/src/crypto/crypto_aes.h
index 76359f14e7df..6b18b1e29e24 100644
--- a/src/crypto/crypto_aes.h
+++ b/src/crypto/crypto_aes.h
@@ -13,15 +13,15 @@ namespace node::crypto {
 constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
 
 #define VARIANTS_COMMON(V)                                                     \
-  V(CTR_128, AES_CTR_Cipher, ncrypto::Cipher::AES_128_CTR)                     \
-  V(CTR_192, AES_CTR_Cipher, ncrypto::Cipher::AES_192_CTR)                     \
-  V(CTR_256, AES_CTR_Cipher, ncrypto::Cipher::AES_256_CTR)                     \
-  V(CBC_128, AES_Cipher, ncrypto::Cipher::AES_128_CBC)                         \
-  V(CBC_192, AES_Cipher, ncrypto::Cipher::AES_192_CBC)                         \
-  V(CBC_256, AES_Cipher, ncrypto::Cipher::AES_256_CBC)                         \
-  V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM)                         \
-  V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM)                         \
-  V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM)                         \
+  V(CTR_128, AES_CTR_Cipher, ncrypto::Cipher::AES_128_CTR())                   \
+  V(CTR_192, AES_CTR_Cipher, ncrypto::Cipher::AES_192_CTR())                   \
+  V(CTR_256, AES_CTR_Cipher, ncrypto::Cipher::AES_256_CTR())                   \
+  V(CBC_128, AES_Cipher, ncrypto::Cipher::AES_128_CBC())                       \
+  V(CBC_192, AES_Cipher, ncrypto::Cipher::AES_192_CBC())                       \
+  V(CBC_256, AES_Cipher, ncrypto::Cipher::AES_256_CBC())                       \
+  V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM())                       \
+  V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM())                       \
+  V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM())                       \
   VARIANTS_KW(V)
 
 #ifdef OPENSSL_IS_BORINGSSL
@@ -33,16 +33,16 @@ constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
   V(KW_256, AES_KW_Cipher, static_cast<const EVP_CIPHER*>(nullptr))
 #else
 #define VARIANTS_KW(V)                                                         \
-  V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW)                           \
-  V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW)                           \
-  V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW)
+  V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW())                         \
+  V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW())                         \
+  V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW())
 #endif
 
 #if OPENSSL_WITH_AES_OCB
 #define VARIANTS_OCB(V)                                                        \
-  V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB)                         \
-  V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB)                         \
-  V(OCB_256, AES_Cipher, ncrypto::Cipher::AES_256_OCB)
+  V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB())                       \
+  V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB())                       \
+  V(OCB_256, AES_Cipher, ncrypto::Cipher::AES_256_OCB())
 #else
 #define VARIANTS_OCB(V)
 #endif
diff --git a/src/crypto/crypto_bio.cc b/src/crypto/crypto_bio.cc
index cdf87c322afd..9d2bd8e06e06 100644
--- a/src/crypto/crypto_bio.cc
+++ b/src/crypto/crypto_bio.cc
@@ -99,7 +99,7 @@ int NodeBIO::Read(BIO* bio, char* out, int len) {
 
 char* NodeBIO::Peek(size_t* size) {
   *size = read_head_->write_pos_ - read_head_->read_pos_;
-  return read_head_->data_ + read_head_->read_pos_;
+  return read_head_->data_.get() + read_head_->read_pos_;
 }
 
 
@@ -112,7 +112,7 @@ size_t NodeBIO::PeekMultiple(char** out, size_t* size, size_t* count) {
   for (i = 0; i < max; i++) {
     size[i] = pos->write_pos_ - pos->read_pos_;
     total += size[i];
-    out[i] = pos->data_ + pos->read_pos_;
+    out[i] = pos->data_.get() + pos->read_pos_;
 
     /* Don't get past write head */
     if (pos == write_head_)
@@ -274,7 +274,8 @@ size_t NodeBIO::Read(char* out, size_t size) {
 
     // Copy data
     if (out != nullptr)
-      memcpy(out + offset, read_head_->data_ + read_head_->read_pos_, avail);
+      memcpy(
+          out + offset, read_head_->data_.get() + read_head_->read_pos_, avail);
     read_head_->read_pos_ += avail;
 
     // Move pointers
@@ -330,7 +331,7 @@ size_t NodeBIO::IndexOf(char delim, size_t limit) {
       avail = left;
 
     // Walk through data
-    char* tmp = current->data_ + current->read_pos_;
+    char* tmp = current->data_.get() + current->read_pos_;
     size_t off = 0;
     while (off < avail && *tmp != delim) {
       off++;
@@ -373,7 +374,7 @@ void NodeBIO::Write(const char* data, size_t size) {
       to_write = avail;
 
     // Copy data
-    memcpy(write_head_->data_ + write_head_->write_pos_,
+    memcpy(write_head_->data_.get() + write_head_->write_pos_,
            data + offset,
            to_write);
 
@@ -406,7 +407,7 @@ char* NodeBIO::PeekWritable(size_t* size) {
   if (*size == 0 || available <= *size)
     *size = available;
 
-  return write_head_->data_ + write_head_->write_pos_;
+  return write_head_->data_.get() + write_head_->write_pos_;
 }
 
 
diff --git a/src/crypto/crypto_bio.h b/src/crypto/crypto_bio.h
index 616fc1eed7e0..01aa11c2207e 100644
--- a/src/crypto/crypto_bio.h
+++ b/src/crypto/crypto_bio.h
@@ -150,19 +150,19 @@ class NodeBIO : public MemoryRetainer {
 
   class Buffer {
    public:
-    Buffer(Environment* env, size_t len) : env_(env),
-                                           read_pos_(0),
-                                           write_pos_(0),
-                                           len_(len),
-                                           next_(nullptr) {
-      data_ = new char[len];
+    Buffer(Environment* env, size_t len)
+        : env_(env),
+          read_pos_(0),
+          write_pos_(0),
+          len_(len),
+          next_(nullptr),
+          data_(new char[len]) {
       if (env_ != nullptr) {
         env_->external_memory_accounter()->Increase(env_->isolate(), len);
       }
     }
 
     ~Buffer() {
-      delete[] data_;
       if (env_ != nullptr) {
         env_->external_memory_accounter()->Decrease(env_->isolate(), len_);
       }
@@ -173,7 +173,7 @@ class NodeBIO : public MemoryRetainer {
     size_t write_pos_;
     size_t len_;
     Buffer* next_;
-    char* data_;
+    std::unique_ptr<char[]> data_;
   };
 
   Environment* env_ = nullptr;
diff --git a/src/crypto/crypto_chacha20_poly1305.cc b/src/crypto/crypto_chacha20_poly1305.cc
index 1cdb933c65d4..56ba78be7ccd 100644
--- a/src/crypto/crypto_chacha20_poly1305.cc
+++ b/src/crypto/crypto_chacha20_poly1305.cc
@@ -105,7 +105,7 @@ Maybe<void> ChaCha20Poly1305CipherTraits::AdditionalConfig(
     ChaCha20Poly1305CipherConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
-  params->cipher = ncrypto::Cipher::CHACHA20_POLY1305;
+  params->cipher = ncrypto::Cipher::CHACHA20_POLY1305();
 
 #ifndef OPENSSL_IS_BORINGSSL
   // On BoringSSL, ChaCha20-Poly1305 is not exposed via the EVP_CIPHER registry
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index 720eb656b89d..348d96e60435 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -75,10 +75,10 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
   const auto cipher = ([&] {
     if (args[0]->IsString()) {
       Utf8Value name(env->isolate(), args[0]);
-      return Cipher::FromName(*name);
+      return Cipher::FromName(*name, env->provider_cipher_cache.get());
     } else {
       int nid = args[0].As<Int32>()->Value();
-      return Cipher::FromNid(nid);
+      return Cipher::FromNid(nid, env->provider_cipher_cache.get());
     }
   })();
 
@@ -227,7 +227,7 @@ CipherBase::CipherBase(Environment* env, Local<Object> wrap, CipherKind kind)
       auth_tag_state_(kAuthTagUnknown),
       auth_tag_len_(kNoAuthTagLength),
       pending_auth_failed_(false),
-      has_siv_update_(false),
+      has_one_shot_update_(false),
       siv_aad_components_(0) {
   MakeWeak();
 }
@@ -311,7 +311,7 @@ void CipherBase::RegisterExternalReferences(
 void CipherBase::New(const FunctionCallbackInfo<Value>& args) {
   CHECK(args.IsConstructCall());
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 5);
+  CHECK(args.Length() == 5 || args.Length() == 7);
 
   CipherBase* cipher =
       new CipherBase(env, args.This(), args[0]->IsTrue() ? kCipher : kDecipher);
@@ -343,7 +343,25 @@ void CipherBase::New(const FunctionCallbackInfo<Value>& args) {
     auth_tag_len = kNoAuthTagLength;
   }
 
-  cipher->InitIv(*cipher_type, key_buf, iv_buf, auth_tag_len);
+  if (args.Length() == 5) {
+    cipher->InitIv(
+        *cipher_type, key_buf, iv_buf, auth_tag_len, nullptr, nullptr);
+    return;
+  }
+
+  CHECK(args[5]->IsString() || args[5]->IsUndefined());
+  CHECK(args[6]->IsString() || args[6]->IsUndefined());
+  const Utf8Value cts_mode(env->isolate(),
+                           args[5]->IsString() ? args[5] : Local<Value>());
+  const Utf8Value xts_standard(env->isolate(),
+                               args[6]->IsString() ? args[6] : Local<Value>());
+
+  cipher->InitIv(*cipher_type,
+                 key_buf,
+                 iv_buf,
+                 auth_tag_len,
+                 args[5]->IsString() ? *cts_mode : nullptr,
+                 args[6]->IsString() ? *xts_standard : nullptr);
 }
 
 void CipherBase::CommonInit(const char* cipher_type,
@@ -352,7 +370,9 @@ void CipherBase::CommonInit(const char* cipher_type,
                             int key_len,
                             const unsigned char* iv,
                             int iv_len,
-                            unsigned int auth_tag_len) {
+                            unsigned int auth_tag_len,
+                            const char* cts_mode,
+                            const char* xts_standard) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
   CHECK(!ctx_);
   ctx_ = CipherCtxPointer::New();
@@ -372,6 +392,18 @@ void CipherBase::CommonInit(const char* cipher_type,
                             "Failed to initialize cipher");
   }
 
+  if (cts_mode != nullptr && !ctx_.setCtsMode(cts_mode)) {
+    ctx_.reset();
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env(), "%s does not support the ctsMode option", cipher_type);
+  }
+
+  if (xts_standard != nullptr && !ctx_.setXtsStandard(xts_standard)) {
+    ctx_.reset();
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env(), "%s does not support the xtsStandard option", cipher_type);
+  }
+
   if (cipher.isSupportedAuthenticatedMode()) {
     CHECK_GE(iv_len, 0);
     if (!InitAuthenticated(cipher_type, iv_len, auth_tag_len)) {
@@ -394,11 +426,14 @@ void CipherBase::CommonInit(const char* cipher_type,
 void CipherBase::InitIv(const char* cipher_type,
                         const ByteSource& key_buf,
                         const ArrayBufferOrViewContents<unsigned char>& iv_buf,
-                        unsigned int auth_tag_len) {
+                        unsigned int auth_tag_len,
+                        const char* cts_mode,
+                        const char* xts_standard) {
   HandleScope scope(env()->isolate());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  auto cipher = Cipher::FromName(cipher_type);
+  auto cipher =
+      Cipher::FromName(cipher_type, env()->provider_cipher_cache.get());
   if (!cipher) return THROW_ERR_CRYPTO_UNKNOWN_CIPHER(env());
 
   const int expected_iv_len = cipher.getIvLength();
@@ -436,14 +471,15 @@ void CipherBase::InitIv(const char* cipher_type,
     return THROW_ERR_CRYPTO_INVALID_IV(env());
   }
 
-  CommonInit(
-      cipher_type,
-      cipher,
-      key_buf.data<unsigned char>(),
-      key_buf.size(),
-      iv_buf.data(),
-      iv_buf.size(),
-      auth_tag_len);
+  CommonInit(cipher_type,
+             cipher,
+             key_buf.data<unsigned char>(),
+             key_buf.size(),
+             iv_buf.data(),
+             iv_buf.size(),
+             auth_tag_len,
+             cts_mode,
+             xts_standard);
 }
 
 bool CipherBase::InitAuthenticated(const char* cipher_type,
@@ -463,7 +499,7 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
     // TODO(tniessen) Support CCM decryption in FIPS mode
     if (kind_ == kDecipher && ncrypto::isFipsEnabled()) {
       THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
-          env(), "CCM encryption not supported in FIPS mode");
+          env(), "CCM decryption not supported in FIPS mode");
       return false;
     }
 
@@ -563,7 +599,7 @@ void CipherBase::SetAuthTag(const FunctionCallbackInfo<Value>& args) {
   }
 
   if ((cipher->ctx_.isSivMode() || cipher->ctx_.isGcmSivMode()) &&
-      cipher->has_siv_update_) {
+      cipher->has_one_shot_update_) {
     return args.GetReturnValue().Set(false);
   }
 
@@ -598,7 +634,7 @@ bool CipherBase::SetAAD(
   if (!ctx_ || !IsAuthenticatedMode())
     return false;
   const bool is_siv = ctx_.isSivMode();
-  if ((is_siv || ctx_.isGcmSivMode()) && has_siv_update_) return false;
+  if ((is_siv || ctx_.isGcmSivMode()) && has_one_shot_update_) return false;
   if (is_siv && siv_aad_components_ >= kMaxSivAADComponents) return false;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
@@ -659,12 +695,20 @@ CipherBase::UpdateResult CipherBase::Update(
   if (!ctx_ || len > INT_MAX) return kErrorState;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  if (ctx_.isCcmMode() && !CheckCCMMessageLength(len)) {
+  const bool is_ccm_mode = ctx_.isCcmMode();
+  const bool is_ccm_decipher = kind_ == kDecipher && is_ccm_mode;
+
+  if (is_ccm_mode && !CheckCCMMessageLength(len)) {
     return kErrorMessageSize;
   }
 
   const bool is_siv = ctx_.isSivMode() || ctx_.isGcmSivMode();
-  if (is_siv && has_siv_update_) {
+  const bool is_cts = ctx_.isCtsMode();
+  const bool is_xts = ctx_.isXtsMode();
+  const bool is_wrap = ctx_.isWrapMode();
+  const bool is_one_shot =
+      is_ccm_decipher || is_siv || is_cts || is_xts || is_wrap;
+  if (is_one_shot && has_one_shot_update_) {
     return kErrorState;
   }
 
@@ -694,8 +738,8 @@ CipherBase::UpdateResult CipherBase::Update(
 
   bool r = ctx_.update(
       buffer, static_cast<unsigned char*>((*out)->Data()), &buf_len);
-  if (is_siv) {
-    has_siv_update_ = true;
+  if (is_ccm_decipher || is_siv || ((is_cts || is_xts || is_wrap) && r)) {
+    has_one_shot_update_ = true;
   }
 
   // When in CCM mode, EVP_CipherUpdate will fail if the authentication tag is
@@ -773,7 +817,10 @@ void CipherBase::SetAutoPadding(const FunctionCallbackInfo<Value>& args) {
 
 bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   if (!ctx_) return false;
-  if ((ctx_.isSivMode() || ctx_.isGcmSivMode()) && !has_siv_update_) {
+  const bool is_one_shot = ctx_.isSivMode() || ctx_.isGcmSivMode() ||
+                           ctx_.isCtsMode() || ctx_.isXtsMode() ||
+                           ctx_.isWrapMode();
+  if (is_one_shot && !has_one_shot_update_) {
     ctx_.reset();
     return false;
   }
@@ -796,7 +843,8 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   // EVP_CipherFinal_ex must not be called and will fail.
   bool ok;
   if (kind_ == kDecipher && ctx_.isCcmMode()) {
-    ok = !pending_auth_failed_;
+    ok = auth_tag_state_ == kAuthTagSetByUser && has_one_shot_update_ &&
+         !pending_auth_failed_;
     *out = ArrayBuffer::NewBackingStore(env()->isolate(), 0);
   } else {
     int out_len = (*out)->ByteLength();
diff --git a/src/crypto/crypto_cipher.h b/src/crypto/crypto_cipher.h
index b751173d5591..f6deb774ea36 100644
--- a/src/crypto/crypto_cipher.h
+++ b/src/crypto/crypto_cipher.h
@@ -51,11 +51,15 @@ class CipherBase : public BaseObject {
                   int key_len,
                   const unsigned char* iv,
                   int iv_len,
-                  unsigned int auth_tag_len);
+                  unsigned int auth_tag_len,
+                  const char* cts_mode,
+                  const char* xts_standard);
   void InitIv(const char* cipher_type,
               const ByteSource& key_buf,
               const ArrayBufferOrViewContents<unsigned char>& iv_buf,
-              unsigned int auth_tag_len);
+              unsigned int auth_tag_len,
+              const char* cts_mode,
+              const char* xts_standard);
   bool InitAuthenticated(const char* cipher_type,
                          int iv_len,
                          unsigned int auth_tag_len);
@@ -87,7 +91,7 @@ class CipherBase : public BaseObject {
   unsigned int auth_tag_len_;
   char auth_tag_[ncrypto::Cipher::MAX_AUTH_TAG_LENGTH];
   bool pending_auth_failed_;
-  bool has_siv_update_;
+  bool has_one_shot_update_;
   unsigned int siv_aad_components_;
   int max_message_size_;
 };
diff --git a/src/crypto/crypto_client_hello.cc b/src/crypto/crypto_client_hello.cc
new file mode 100644
index 000000000000..75ecc3cc8748
--- /dev/null
+++ b/src/crypto/crypto_client_hello.cc
@@ -0,0 +1,142 @@
+#include "crypto/crypto_client_hello.h"
+
+#include <algorithm>
+
+namespace node::crypto {
+
+SSL* ClientHelloContext::ssl() const {
+#ifdef OPENSSL_IS_BORINGSSL
+  return handle_->ssl;
+#else
+  return handle_;
+#endif
+}
+
+std::span<const uint8_t> ClientHelloContext::session_id() const {
+#ifdef OPENSSL_IS_BORINGSSL
+  return {handle_->session_id, handle_->session_id_len};
+#else
+  const uint8_t* id = nullptr;
+  size_t len = SSL_client_hello_get0_session_id(handle_, &id);
+  if (id == nullptr) return {};
+  return {id, len};
+#endif
+}
+
+bool ClientHelloContext::has_session_ticket() const {
+  auto ext = extension(TLSEXT_TYPE_session_ticket);
+  return ext.has_value() && !ext->empty();
+}
+
+std::optional<std::string_view> ClientHelloContext::servername() const {
+  auto ext = extension(TLSEXT_TYPE_server_name);
+  if (!ext.has_value()) return std::string_view();
+  // RFC 6066: a 16-bit list length, then one entry of an 8-bit name type,
+  // a 16-bit name length and that many name bytes. The constraints applied
+  // here are the ones the TLS stack's own parser applies: exactly one
+  // entry, of type host_name, of a sane length and free of NULs.
+  auto list = ReadVector16(*ext);
+  if (!list.has_value() || list->size() < 3) return std::nullopt;
+  if ((*list)[0] != TLSEXT_NAMETYPE_host_name) return std::nullopt;
+  auto name = ReadVector16(list->subspan(1));
+  if (!name.has_value()) return std::nullopt;
+  if (name->size() + 3 != list->size()) return std::nullopt;
+  if (name->empty() || name->size() > TLSEXT_MAXLEN_host_name) {
+    return std::nullopt;
+  }
+  if (std::find(name->begin(), name->end(), 0) != name->end()) {
+    return std::nullopt;
+  }
+  return std::string_view(reinterpret_cast<const char*>(name->data()),
+                          name->size());
+}
+
+std::span<const uint8_t> ClientHelloContext::alpn_protocols() const {
+  auto ext = extension(TLSEXT_TYPE_application_layer_protocol_negotiation);
+  if (!ext.has_value()) return {};
+  // RFC 7301: a 16-bit list length, then the protocol names.
+  return ReadVector16(*ext).value_or(std::span<const uint8_t>());
+}
+
+std::optional<std::span<const uint8_t>> ClientHelloContext::extension(
+    unsigned int type) const {
+  const uint8_t* data = nullptr;
+  size_t len = 0;
+#ifdef OPENSSL_IS_BORINGSSL
+  if (!SSL_early_callback_ctx_extension_get(handle_, type, &data, &len)) {
+    return std::nullopt;
+  }
+#else
+  if (SSL_client_hello_get0_ext(handle_, type, &data, &len) != 1) {
+    return std::nullopt;
+  }
+#endif
+  return std::span<const uint8_t>(data, len);
+}
+
+void ClientHelloContext::set_alert(int alert) const {
+  if (alert_ != nullptr) *alert_ = alert;
+}
+
+ClientHelloContext::Result ClientHelloContext::Encode(
+    ClientHelloResult result) {
+  switch (result) {
+    case ClientHelloResult::kContinue:
+      return kContinueResult;
+    case ClientHelloResult::kRetry:
+      return kRetryResult;
+    case ClientHelloResult::kFail:
+      break;
+  }
+  return kFailResult;
+}
+
+std::optional<std::span<const uint8_t>> ClientHelloContext::ReadVector16(
+    std::span<const uint8_t> data) {
+  if (data.size() < 2) return std::nullopt;
+  const size_t len = (static_cast<size_t>(data[0]) << 8) | data[1];
+  if (data.size() < 2 + len) return std::nullopt;
+  return data.subspan(2, len);
+}
+
+bool AlpnListContains(std::span<const uint8_t> protocols,
+                      std::string_view protocol) {
+  for (size_t n = 0; n < protocols.size();) {
+    const size_t len = protocols[n];
+    if (len == 0 || n + 1 + len > protocols.size()) return false;
+    if (std::string_view(
+            reinterpret_cast<const char*>(protocols.data() + n + 1), len) ==
+        protocol) {
+      return true;
+    }
+    n += 1 + len;
+  }
+  return false;
+}
+
+void SetSelectedProtocol(const unsigned char** out,
+                         unsigned char* outlen,
+                         std::string_view protocol) {
+  *out = reinterpret_cast<const unsigned char*>(protocol.data());
+  *outlen = static_cast<unsigned char>(protocol.size());
+}
+
+std::optional<std::string_view> SelectNextProtocol(
+    std::span<const uint8_t> supported, std::span<const uint8_t> offered) {
+  if (supported.empty() || offered.empty()) return std::nullopt;
+  uint8_t* selected = nullptr;
+  uint8_t selected_len = 0;
+  if (SSL_select_next_proto(&selected,
+                            &selected_len,
+                            supported.data(),
+                            static_cast<unsigned int>(supported.size()),
+                            offered.data(),
+                            static_cast<unsigned int>(offered.size())) !=
+      OPENSSL_NPN_NEGOTIATED) {
+    return std::nullopt;
+  }
+  return std::string_view(reinterpret_cast<const char*>(selected),
+                          selected_len);
+}
+
+}  // namespace node::crypto
diff --git a/src/crypto/crypto_client_hello.h b/src/crypto/crypto_client_hello.h
new file mode 100644
index 000000000000..37b8124e8cc7
--- /dev/null
+++ b/src/crypto/crypto_client_hello.h
@@ -0,0 +1,125 @@
+#ifndef SRC_CRYPTO_CRYPTO_CLIENT_HELLO_H_
+#define SRC_CRYPTO_CRYPTO_CLIENT_HELLO_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <openssl/ssl.h>
+#include <openssl/tls1.h>
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <string_view>
+
+namespace node::crypto {
+
+// Support for the early ClientHello callback, which the TLS library invokes
+// once a complete ClientHello has been received but before version
+// negotiation and before any session or ticket resumption.
+
+enum class ClientHelloResult {
+  kContinue,
+  // Unwind out of the TLS library, leaving the handshake suspended. The
+  // callback runs again from the start when the handshake is resumed.
+  kRetry,
+  // Abort the handshake.
+  kFail,
+};
+
+// The ClientHello being processed, and the inputs from it that are usable
+// this early. Instances are only valid for the duration of the callback.
+class ClientHelloContext final {
+ public:
+#ifdef OPENSSL_IS_BORINGSSL
+  using Handle = const SSL_CLIENT_HELLO*;
+  using Result = ssl_select_cert_result_t;
+  static constexpr Result kContinueResult = ssl_select_cert_success;
+  static constexpr Result kRetryResult = ssl_select_cert_retry;
+  static constexpr Result kFailResult = ssl_select_cert_error;
+#else
+  using Handle = SSL*;
+  using Result = int;
+  static constexpr Result kContinueResult = SSL_CLIENT_HELLO_SUCCESS;
+  static constexpr Result kRetryResult = SSL_CLIENT_HELLO_RETRY;
+  static constexpr Result kFailResult = SSL_CLIENT_HELLO_ERROR;
+#endif
+
+  explicit ClientHelloContext(Handle handle, int* alert = nullptr)
+      : handle_(handle), alert_(alert) {}
+
+  SSL* ssl() const;
+
+  // The legacy_session_id. Note that a TLS 1.3 ClientHello carries a fake
+  // one for middlebox compatibility, so a non-empty value here does not
+  // mean the client is attempting session-id resumption.
+  std::span<const uint8_t> session_id() const;
+
+  bool has_session_ticket() const;
+
+  // The host name to select an identity for, empty if the client sent no
+  // server_name. Nothing at all if it sent one that cannot be used, in which
+  // case the handshake should fail. SSL_get_servername() does not work this
+  // early as the servername callback has not run yet.
+  std::optional<std::string_view> servername() const;
+
+  // ALPN protocols in wire format: each entry is a length byte followed by
+  // that many name bytes.
+  std::span<const uint8_t> alpn_protocols() const;
+
+  std::optional<std::span<const uint8_t>> extension(unsigned int type) const;
+
+  // Ignored by TLS libraries that choose the alert themselves.
+  void set_alert(int alert) const;
+
+  static Result Encode(ClientHelloResult result);
+
+ private:
+  // Reads a 16-bit length prefixed vector from the front of data. Returns
+  // nothing if the length does not fit within data.
+  static std::optional<std::span<const uint8_t>> ReadVector16(
+      std::span<const uint8_t> data);
+
+  Handle handle_;
+  int* alert_;
+};
+
+// Adapts a portable callback into the one the linked TLS library expects.
+template <ClientHelloResult (*Fn)(const ClientHelloContext&)>
+struct ClientHelloCallback final {
+#ifdef OPENSSL_IS_BORINGSSL
+  static ssl_select_cert_result_t Invoke(const SSL_CLIENT_HELLO* hello) {
+    return ClientHelloContext::Encode(Fn(ClientHelloContext(hello)));
+  }
+#else
+  static int Invoke(SSL* ssl, int* alert, void* arg) {
+    return ClientHelloContext::Encode(Fn(ClientHelloContext(ssl, alert)));
+  }
+#endif
+};
+
+// Registers Fn as the early ClientHello callback on ctx.
+template <ClientHelloResult (*Fn)(const ClientHelloContext&)>
+inline void SetClientHelloCallback(SSL_CTX* ctx) {
+#ifdef OPENSSL_IS_BORINGSSL
+  SSL_CTX_set_select_certificate_cb(ctx, ClientHelloCallback<Fn>::Invoke);
+#else
+  SSL_CTX_set_client_hello_cb(ctx, ClientHelloCallback<Fn>::Invoke, nullptr);
+#endif
+}
+
+bool AlpnListContains(std::span<const uint8_t> protocols,
+                      std::string_view protocol);
+
+void SetSelectedProtocol(const unsigned char** out,
+                         unsigned char* outlen,
+                         std::string_view protocol);
+
+// Selects the protocol to use from the offered and supported lists, both in
+// ALPN wire format. Returns nothing when the two lists do not overlap.
+std::optional<std::string_view> SelectNextProtocol(
+    std::span<const uint8_t> supported, std::span<const uint8_t> offered);
+
+}  // namespace node::crypto
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_CLIENT_HELLO_H_
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 0f61767cdbbe..9dc68f4d9d2d 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -2,6 +2,7 @@
 #include "base_object-inl.h"
 #include "crypto/crypto_bio.h"
 #include "crypto/crypto_common.h"
+#include "crypto/crypto_tls_certificates.h"
 #include "crypto/crypto_util.h"
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
@@ -86,14 +87,15 @@ static std::atomic<bool> has_cached_extra_root_certs{false};
 
 // Used for sets of X509.
 struct X509Less {
-  bool operator()(const X509* lhs, const X509* rhs) const noexcept {
-    return X509_cmp(const_cast<X509*>(lhs), const_cast<X509*>(rhs)) < 0;
+  bool operator()(const ncrypto::X509Pointer& lhs,
+                  const ncrypto::X509Pointer& rhs) const noexcept {
+    return X509_cmp(lhs.get(), rhs.get()) < 0;
   }
 };
-using X509Set = std::set<X509*, X509Less>;
+using X509Set = std::set<ncrypto::X509Pointer, X509Less>;
 
 // Per-thread root cert store. See NewRootCertStore() on what it contains.
-static thread_local X509_STORE* root_cert_store = nullptr;
+static thread_local DeleteFnPtr<X509_STORE, X509_STORE_free> root_cert_store;
 // If the user calls tls.setDefaultCACertificates() this will be used
 // to hold the user-provided certificates, the root_cert_store and any new
 // copy generated by NewRootCertStore() will then contain the certificates
@@ -102,18 +104,8 @@ static thread_local std::unique_ptr<X509Set> root_certs_from_users;
 static thread_local bool has_cleanup_hook = false;
 
 static void CleanupRootCertStore(void*) {
-  if (root_cert_store != nullptr) {
-    X509_STORE_free(root_cert_store);
-    root_cert_store = nullptr;
-  }
-
-  if (root_certs_from_users != nullptr) {
-    for (X509* cert : *root_certs_from_users) {
-      X509_free(cert);
-    }
-    root_certs_from_users.reset();
-  }
-
+  root_cert_store.reset();
+  root_certs_from_users.reset();
   has_cleanup_hook = false;
 }
 
@@ -129,10 +121,10 @@ static void EnsureRootCertStoreCleanupHook(Environment* env) {
 X509_STORE* GetOrCreateRootCertStore(Environment* env) {
   EnsureRootCertStoreCleanupHook(env);
   if (root_cert_store != nullptr) {
-    return root_cert_store;
+    return root_cert_store.get();
   }
-  root_cert_store = NewRootCertStore(env);
-  return root_cert_store;
+  root_cert_store.reset(NewRootCertStore(env));
+  return root_cert_store.get();
 }
 
 // Takes a string or buffer and loads it into a BIO.
@@ -274,13 +266,13 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
 }
 
 static unsigned long LoadCertsFromBIO(  // NOLINT(runtime/int)
-    std::vector<X509*>* certs,
+    std::vector<ncrypto::X509Pointer>* certs,
     BIOPointer bio) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
   while (X509* x509 = PEM_read_bio_X509(
              bio.get(), nullptr, NoPasswordCallback, nullptr)) {
-    certs->push_back(x509);
+    certs->emplace_back(x509);
   }
 
   unsigned long err = ERR_peek_last_error();  // NOLINT(runtime/int)
@@ -294,7 +286,7 @@ static unsigned long LoadCertsFromBIO(  // NOLINT(runtime/int)
 }
 
 static unsigned long LoadCertsFromFile(  // NOLINT(runtime/int)
-    std::vector<X509*>* certs,
+    std::vector<ncrypto::X509Pointer>* certs,
     const char* file) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
@@ -554,7 +546,7 @@ static bool IsCertificateExpired(X509* cert) {
 }
 
 void ReadMacOSKeychainCertificates(
-    std::vector<X509*>* system_root_certificates_X509) {
+    std::vector<ncrypto::X509Pointer>* system_root_certificates_X509) {
   CFTypeRef search_keys[] = {kSecClass, kSecMatchLimit, kSecReturnRef};
   CFTypeRef search_values[] = {
       kSecClassCertificate, kSecMatchLimitAll, kCFBooleanTrue};
@@ -581,8 +573,11 @@ void ReadMacOSKeychainCertificates(
   CFIndex count = CFArrayGetCount(curr_anchors);
 
   // Track seen certificates to detect duplicates (same cert in multiple
-  // keychains).
-  std::set<X509*, X509Less> seen_certs;
+  // keychains). Non-owning set -- the vector owns the certs.
+  auto x509_raw_less = [](const X509* a, const X509* b) {
+    return X509_cmp(const_cast<X509*>(a), const_cast<X509*>(b)) < 0;
+  };
+  std::set<X509*, decltype(x509_raw_less)> seen_certs(x509_raw_less);
 
   for (int i = 0; i < count; ++i) {
     SecCertificateRef cert_ref = reinterpret_cast<SecCertificateRef>(
@@ -597,40 +592,37 @@ void ReadMacOSKeychainCertificates(
     }
     auto data_buffer_pointer = CFDataGetBytePtr(der_data);
 
-    X509* cert =
-        d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data));
+    ncrypto::X509Pointer cert(
+        d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data)));
     CFRelease(der_data);
 
-    if (cert == nullptr) {
+    if (!cert) {
       per_process::Debug(DebugCategory::CRYPTO,
                          "Skipping read of a system certificate "
                          "because decoding failed\n");
       continue;
     }
 
-    bool is_valid = IsCertificateTrustedForPolicy(cert, cert_ref);
+    bool is_valid = IsCertificateTrustedForPolicy(cert.get(), cert_ref);
     if (!is_valid) {
-      X509_free(cert);
       continue;
     }
 
     // Skip duplicate certificates.
-    auto [it, inserted] = seen_certs.insert(cert);
+    auto [it, inserted] = seen_certs.insert(cert.get());
     if (!inserted) {
-      X509_free(cert);
       continue;
     }
 
     // Skip expired certificates.
-    if (IsCertificateExpired(cert)) {
+    if (IsCertificateExpired(cert.get())) {
       per_process::Debug(DebugCategory::CRYPTO,
                          "Skipping expired system certificate\n");
       seen_certs.erase(it);
-      X509_free(cert);
       continue;
     }
 
-    system_root_certificates_X509->emplace_back(cert);
+    system_root_certificates_X509->emplace_back(std::move(cert));
   }
   CFRelease(curr_anchors);
 }
@@ -701,7 +693,7 @@ bool IsCertTrustedForServerAuth(PCCERT_CONTEXT cert) {
   return false;
 }
 
-void GatherCertsForLocation(std::vector<X509*>* vector,
+void GatherCertsForLocation(std::vector<ncrypto::X509Pointer>* vector,
                             DWORD location,
                             LPCWSTR store_name) {
   if (!(location == CERT_SYSTEM_STORE_LOCAL_MACHINE ||
@@ -739,19 +731,19 @@ void GatherCertsForLocation(std::vector<X509*>* vector,
         reinterpret_cast<const unsigned char*>(cert_from_store->pbCertEncoded);
     const size_t cert_size = cert_from_store->cbCertEncoded;
 
-    X509* x509 = d2i_X509(nullptr, &cert_data, cert_size);
-    if (x509 == nullptr) {
+    ncrypto::X509Pointer x509(d2i_X509(nullptr, &cert_data, cert_size));
+    if (!x509) {
       per_process::Debug(DebugCategory::CRYPTO,
                          "Skipping read of a system certificate "
                          "because decoding failed\n");
     } else {
-      vector->emplace_back(x509);
+      vector->emplace_back(std::move(x509));
     }
   }
 }
 
 void ReadWindowsCertificates(
-    std::vector<X509*>* system_root_certificates_X509) {
+    std::vector<ncrypto::X509Pointer>* system_root_certificates_X509) {
   // TODO(joyeecheung): match Chromium's policy, collect more certificates
   // from user-added CAs and support disallowed (revoked) certificates.
 
@@ -800,7 +792,7 @@ void ReadWindowsCertificates(
 }
 #endif
 
-static void LoadCertsFromDir(std::vector<X509*>* certs,
+static void LoadCertsFromDir(std::vector<ncrypto::X509Pointer>* certs,
                              std::string_view cert_dir) {
   uv_fs_t dir_req;
   auto cleanup = OnScopeLeave([&dir_req]() { uv_fs_req_cleanup(&dir_req); });
@@ -841,7 +833,8 @@ static void LoadCertsFromDir(std::vector<X509*>* certs,
 
 // Loads CA certificates from the default certificate paths respected by
 // OpenSSL.
-void GetOpenSSLSystemCertificates(std::vector<X509*>* system_store_certs) {
+void GetOpenSSLSystemCertificates(
+    std::vector<ncrypto::X509Pointer>* system_store_certs) {
   std::string cert_file;
   // While configurable when OpenSSL is built, this is usually SSL_CERT_FILE.
   if (!credentials::SafeGetenv(X509_get_default_cert_file_env(), &cert_file)) {
@@ -867,23 +860,23 @@ void GetOpenSSLSystemCertificates(std::vector<X509*>* system_store_certs) {
   }
 }
 
-static std::vector<X509*> InitializeBundledRootCertificates() {
+static std::vector<ncrypto::X509Pointer> InitializeBundledRootCertificates() {
   // Read the bundled certificates in node_root_certs.h into
   // bundled_root_certs_vector.
-  std::vector<X509*> bundled_root_certs;
+  std::vector<ncrypto::X509Pointer> bundled_root_certs;
   size_t bundled_root_cert_count = arraysize(root_certs);
   bundled_root_certs.reserve(bundled_root_cert_count);
   for (size_t i = 0; i < bundled_root_cert_count; i++) {
-    X509* x509 = PEM_read_bio_X509(
+    ncrypto::X509Pointer x509(PEM_read_bio_X509(
         NodeBIO::NewFixed(root_certs[i], strlen(root_certs[i])).get(),
         nullptr,  // no re-use of X509 structure
         NoPasswordCallback,
-        nullptr);  // no callback data
+        nullptr));  // no callback data
 
     // Parse errors from the built-in roots are fatal.
-    CHECK_NOT_NULL(x509);
+    CHECK(x509);
 
-    bundled_root_certs.push_back(x509);
+    bundled_root_certs.emplace_back(std::move(x509));
   }
   return bundled_root_certs;
 }
@@ -892,16 +885,16 @@ static std::vector<X509*> InitializeBundledRootCertificates() {
 // dance when we could've just pass everything around in binary. Change the
 // root_certs to be embedded as DER so that we can save the serialization
 // and deserialization.
-static std::vector<X509*>& GetBundledRootCertificates() {
+static std::vector<ncrypto::X509Pointer>& GetBundledRootCertificates() {
   // Use function-local static to guarantee thread safety.
-  static std::vector<X509*> bundled_root_certs =
+  static std::vector<ncrypto::X509Pointer> bundled_root_certs =
       InitializeBundledRootCertificates();
   has_cached_bundled_root_certs.store(true);
   return bundled_root_certs;
 }
 
-static std::vector<X509*> InitializeSystemStoreCertificates() {
-  std::vector<X509*> system_store_certs;
+static std::vector<ncrypto::X509Pointer> InitializeSystemStoreCertificates() {
+  std::vector<ncrypto::X509Pointer> system_store_certs;
 #ifdef __APPLE__
   ReadMacOSKeychainCertificates(&system_store_certs);
 #endif
@@ -914,16 +907,16 @@ static std::vector<X509*> InitializeSystemStoreCertificates() {
   return system_store_certs;
 }
 
-static std::vector<X509*>& GetSystemStoreCACertificates() {
+static std::vector<ncrypto::X509Pointer>& GetSystemStoreCACertificates() {
   // Use function-local static to guarantee thread safety.
-  static std::vector<X509*> system_store_certs =
+  static std::vector<ncrypto::X509Pointer> system_store_certs =
       InitializeSystemStoreCertificates();
   has_cached_system_root_certs.store(true);
   return system_store_certs;
 }
 
-static std::vector<X509*> InitializeExtraCACertificates() {
-  std::vector<X509*> extra_certs;
+static std::vector<ncrypto::X509Pointer> InitializeExtraCACertificates() {
+  std::vector<ncrypto::X509Pointer> extra_certs;
   unsigned long err = LoadCertsFromFile(  // NOLINT(runtime/int)
       &extra_certs,
       extra_root_certs_file.c_str());
@@ -938,9 +931,10 @@ static std::vector<X509*> InitializeExtraCACertificates() {
   return extra_certs;
 }
 
-static std::vector<X509*>& GetExtraCACertificates() {
+static std::vector<ncrypto::X509Pointer>& GetExtraCACertificates() {
   // Use function-local static to guarantee thread safety.
-  static std::vector<X509*> extra_certs = InitializeExtraCACertificates();
+  static std::vector<ncrypto::X509Pointer> extra_certs =
+      InitializeExtraCACertificates();
   has_cached_extra_root_certs.store(true);
   return extra_certs;
 }
@@ -1068,8 +1062,8 @@ X509_STORE* NewRootCertStore(Environment* env) {
   // tls.setDefaultCACertificates(), just create a copy from the
   // user-provided certificates.
   if (root_certs_from_users != nullptr) {
-    for (X509* cert : *root_certs_from_users) {
-      CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+    for (const auto& cert : *root_certs_from_users) {
+      CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
     }
     return store;
   }
@@ -1098,19 +1092,19 @@ X509_STORE* NewRootCertStore(Environment* env) {
   if (ssl_openssl_cert_store) {
     CHECK_EQ(1, X509_STORE_set_default_paths(store));
   } else {
-    for (X509* cert : GetBundledRootCertificates()) {
-      CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+    for (const auto& cert : GetBundledRootCertificates()) {
+      CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
     }
     if (use_system_ca) {
-      for (X509* cert : GetSystemStoreCACertificates()) {
-        CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+      for (const auto& cert : GetSystemStoreCACertificates()) {
+        CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
       }
     }
   }
 
   if (!extra_root_certs_file.empty()) {
-    for (X509* cert : GetExtraCACertificates()) {
-      CHECK_EQ(1, X509_STORE_add_cert(store, cert));
+    for (const auto& cert : GetExtraCACertificates()) {
+      CHECK_EQ(1, X509_STORE_add_cert(store, cert.get()));
     }
   }
 
@@ -1135,20 +1129,13 @@ void CleanupCachedRootCertificates() {
   }
 
   if (has_cached_bundled_root_certs.load()) {
-    for (X509* cert : GetBundledRootCertificates()) {
-      X509_free(cert);
-    }
+    GetBundledRootCertificates().clear();
   }
   if (has_cached_system_root_certs.load()) {
-    for (X509* cert : GetSystemStoreCACertificates()) {
-      X509_free(cert);
-    }
+    GetSystemStoreCACertificates().clear();
   }
-
   if (has_cached_extra_root_certs.load()) {
-    for (X509* cert : GetExtraCACertificates()) {
-      X509_free(cert);
-    }
+    GetExtraCACertificates().clear();
   }
 }
 
@@ -1171,7 +1158,7 @@ void GetBundledRootCertificates(const FunctionCallbackInfo<Value>& args) {
 
 bool ArrayOfStringsToX509s(Local<Context> context,
                            Local<Array> cert_array,
-                           std::vector<X509*>* certs) {
+                           std::vector<ncrypto::X509Pointer>* certs) {
   ClearErrorOnReturn clear_error_on_return;
   Isolate* isolate = Isolate::GetCurrent();
   Environment* env = Environment::GetCurrent(context);
@@ -1195,11 +1182,7 @@ bool ArrayOfStringsToX509s(Local<Context> context,
     size_t start = certs->size();
     auto err = LoadCertsFromBIO(certs, std::move(bio));
     if (err != 0) {
-      size_t end = certs->size();
-      // Clean up any certificates we've already parsed upon failure.
-      for (size_t j = start; j < end; ++j) {
-        X509_free((*certs)[j]);
-      }
+      certs->erase(certs->begin() + start, certs->end());
       ThrowCryptoError(env, err, "Failed to parse certificate");
       return false;
     }
@@ -1219,7 +1202,7 @@ MaybeLocal<Array> X509sToArrayOfStrings(Environment* env,
   LocalVector<Value> result(env->isolate(), size);
   size_t i = 0;
   for (It cur = first; cur != last; ++cur, ++i) {
-    X509View view(*cur);
+    X509View view(cur->get());
     auto pem_bio = view.toPEM();
     if (!pem_bio) {
       ThrowCryptoError(env, ERR_get_error(), "X509 to PEM conversion");
@@ -1266,24 +1249,13 @@ void ResetRootCertStore(const FunctionCallbackInfo<Value>& args) {
 
   if (cert_array->Length() == 0) {
     // If the array is empty, just clear the user certs and reset the store.
-    if (root_cert_store != nullptr) {
-      X509_STORE_free(root_cert_store);
-      root_cert_store = nullptr;
-    }
-
-    // Free any existing certificates in the old set.
-    if (root_certs_from_users != nullptr) {
-      for (X509* cert : *root_certs_from_users) {
-        X509_free(cert);
-      }
-    }
+    root_cert_store.reset();
     root_certs_from_users = std::make_unique<X509Set>();
     return;
   }
 
   // Parse certificates from the array
-  std::unique_ptr<std::vector<X509*>> certs =
-      std::make_unique<std::vector<X509*>>();
+  auto certs = std::make_unique<std::vector<ncrypto::X509Pointer>>();
   if (!ArrayOfStringsToX509s(context, cert_array, certs.get())) {
     // Error already thrown by ArrayOfStringsToX509s
     return;
@@ -1296,34 +1268,23 @@ void ResetRootCertStore(const FunctionCallbackInfo<Value>& args) {
   }
 
   auto new_set = std::make_unique<X509Set>();
-  for (X509* cert : *certs) {
-    auto [it, inserted] = new_set->insert(cert);
-    if (!inserted) {  // Free duplicate certificates from the vector.
-      X509_free(cert);
-    }
-  }
-
-  // Free any existing certificates in the old set.
-  if (root_certs_from_users != nullptr) {
-    for (X509* cert : *root_certs_from_users) {
-      X509_free(cert);
-    }
+  for (auto& cert : *certs) {
+    new_set->insert(std::move(cert));
+    // Duplicates are freed automatically when the moved-from pointer
+    // is not consumed by insert (element already exists).
   }
-  std::swap(root_certs_from_users, new_set);
 
-  // Reset the global root cert store and create a new one with the
-  // certificates.
-  if (root_cert_store != nullptr) {
-    X509_STORE_free(root_cert_store);
-  }
+  root_certs_from_users = std::move(new_set);
 
-  root_cert_store = nullptr;
+  // Reset the global root cert store so it will be recreated with the
+  // new certificates.
+  root_cert_store.reset();
 }
 
 void GetSystemCACertificates(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Local<Array> results;
-  std::vector<X509*>& certs = GetSystemStoreCACertificates();
+  auto& certs = GetSystemStoreCACertificates();
   if (X509sToArrayOfStrings(env, certs.begin(), certs.end(), certs.size())
           .ToLocal(&results)) {
     args.GetReturnValue().Set(results);
@@ -1336,7 +1297,7 @@ void GetExtraCACertificates(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().Set(Array::New(env->isolate()));
   }
   Local<Array> results;
-  std::vector<X509*>& certs = GetExtraCACertificates();
+  auto& certs = GetExtraCACertificates();
   if (X509sToArrayOfStrings(env, certs.begin(), certs.end(), certs.size())
           .ToLocal(&results)) {
     args.GetReturnValue().Set(results);
@@ -1689,14 +1650,6 @@ void SecureContext::SetNewSessionCallback(NewSessionCb cb) {
   SSL_CTX_sess_set_new_cb(ctx_.get(), cb);
 }
 
-void SecureContext::SetClientHelloCallback(ClientHelloCb cb) {
-#ifdef OPENSSL_IS_BORINGSSL
-  SSL_CTX_set_select_certificate_cb(ctx_.get(), cb);
-#else
-  SSL_CTX_set_client_hello_cb(ctx_.get(), cb, nullptr);
-#endif
-}
-
 void SecureContext::SetGetSessionCallback(GetSessionCb cb) {
   SSL_CTX_sess_set_get_cb(ctx_.get(), cb);
 }
@@ -1739,22 +1692,14 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
   ByteSource passphrase;
   if (args[1]->IsString())
     passphrase = ByteSource::FromString(env, args[1].As<String>());
-  // This redirection is necessary because the PasswordCallback expects a
-  // pointer to a pointer to the passphrase ByteSource to allow passing in
-  // const ByteSources.
-  const ByteSource* pass_ptr = &passphrase;
-
-  EVPKeyPointer key(
-      PEM_read_bio_PrivateKey(bio.get(),
-                              nullptr,
-                              PasswordCallback,
-                              &pass_ptr));
-
-  if (!key)
-    return ThrowCryptoError(env, ERR_get_error(), "PEM_read_bio_PrivateKey");
-
-  if (!SSL_CTX_use_PrivateKey(sc->ctx_.get(), key.get()))
-    return ThrowCryptoError(env, ERR_get_error(), "SSL_CTX_use_PrivateKey");
+  switch (UsePrivateKey(sc->ctx_.get(), bio, &passphrase)) {
+    case PrivateKeyResult::kSuccess:
+      break;
+    case PrivateKeyResult::kParseError:
+      return ThrowCryptoError(env, ERR_get_error(), "PEM_read_bio_PrivateKey");
+    case PrivateKeyResult::kApplyError:
+      return ThrowCryptoError(env, ERR_get_error(), "SSL_CTX_use_PrivateKey");
+  }
 }
 
 void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
@@ -1857,16 +1802,7 @@ void SecureContext::SetX509StoreFlag(unsigned long flags) {
 }
 
 X509_STORE* SecureContext::GetCertStoreOwnedByThisSecureContext() {
-  Environment* env = this->env();
-  if (own_cert_store_cache_ != nullptr) return own_cert_store_cache_;
-
-  X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx_.get());
-  if (cert_store == GetOrCreateRootCertStore(env)) {
-    cert_store = NewRootCertStore(env);
-    SSL_CTX_set_cert_store(ctx_.get(), cert_store);
-  }
-
-  return own_cert_store_cache_ = cert_store;
+  return GetOrCreateOwnedCertStore(env(), ctx_.get(), &own_cert_store_cache_);
 }
 
 void SecureContext::SetAllowPartialTrustChain(
@@ -1878,13 +1814,7 @@ void SecureContext::SetAllowPartialTrustChain(
 
 void SecureContext::SetCACert(const BIOPointer& bio) {
   ClearErrorOnReturn clear_error_on_return;
-  if (!bio) return;
-  while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX(
-             bio.get(), nullptr, NoPasswordCallback, nullptr))) {
-    CHECK_EQ(1,
-             X509_STORE_add_cert(GetCertStoreOwnedByThisSecureContext(), x509));
-    CHECK_EQ(1, SSL_CTX_add_client_CA(ctx_.get(), x509));
-  }
+  AddCACertificates(env(), ctx_.get(), bio, &own_cert_store_cache_);
 }
 
 void SecureContext::AddCACert(const FunctionCallbackInfo<Value>& args) {
@@ -1904,20 +1834,11 @@ Maybe<void> SecureContext::SetCRL(Environment* env, const BIOPointer& bio) {
   // TODO(tniessen): this should be checked by the caller and not treated as ok
   if (!bio) return JustVoid();
 
-  DeleteFnPtr<X509_CRL, X509_CRL_free> crl(
-      PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));
-
-  if (!crl) {
+  if (!crypto::AddCRL(env, ctx_.get(), bio, &own_cert_store_cache_)) {
     THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to parse CRL");
     return Nothing<void>();
   }
 
-  X509_STORE* cert_store = GetCertStoreOwnedByThisSecureContext();
-
-  CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
-  CHECK_EQ(1,
-           X509_STORE_set_flags(
-               cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
   return JustVoid();
 }
 
@@ -1935,12 +1856,7 @@ void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {
 
 void SecureContext::SetRootCerts() {
   ClearErrorOnReturn clear_error_on_return;
-  Environment* env = this->env();
-  auto store = GetOrCreateRootCertStore(env);
-
-  // Increment reference count so global store is not deleted along with CTX.
-  X509_STORE_up_ref(store);
-  SSL_CTX_set_cert_store(ctx_.get(), store);
+  UseDefaultRootCertStore(env(), ctx_.get());
 }
 
 void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
@@ -2583,9 +2499,11 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
 
   ArrayBufferViewContents<unsigned char> aes_key(aes.As<ArrayBufferView>());
   if (enc) {
-    EVP_EncryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv);
+    EVP_EncryptInit_ex(
+        ectx, Cipher::AES_128_CBC(), nullptr, aes_key.data(), iv);
   } else {
-    EVP_DecryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv);
+    EVP_DecryptInit_ex(
+        ectx, Cipher::AES_128_CBC(), nullptr, aes_key.data(), iv);
   }
 
   return r;
@@ -2608,7 +2526,8 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
     memcpy(name, sc->ticket_key_name_, sizeof(sc->ticket_key_name_));
     if (!ncrypto::CSPRNG(iv, 16) ||
         EVP_EncryptInit_ex(
-            ectx, Cipher::AES_128_CBC, nullptr, sc->ticket_key_aes_, iv) <= 0 ||
+            ectx, Cipher::AES_128_CBC(), nullptr, sc->ticket_key_aes_, iv) <=
+            0 ||
         !InitTicketHmac(
             hctx, sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_))) {
       return -1;
@@ -2622,7 +2541,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
   }
 
   if (EVP_DecryptInit_ex(
-          ectx, Cipher::AES_128_CBC, nullptr, sc->ticket_key_aes_, iv) <= 0 ||
+          ectx, Cipher::AES_128_CBC(), nullptr, sc->ticket_key_aes_, iv) <= 0 ||
       !InitTicketHmac(
           hctx, sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_))) {
     return -1;
diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h
index c65f553e40fd..73aff5b628a1 100644
--- a/src/crypto/crypto_context.h
+++ b/src/crypto/crypto_context.h
@@ -35,11 +35,6 @@ class SecureContext final : public BaseObject {
   using KeylogCb = void (*)(const SSL*, const char*);
   using NewSessionCb = int (*)(SSL*, SSL_SESSION*);
   using SelectSNIContextCb = int (*)(SSL*, int*, void*);
-#ifdef OPENSSL_IS_BORINGSSL
-  using ClientHelloCb = ssl_select_cert_result_t (*)(const SSL_CLIENT_HELLO*);
-#else
-  using ClientHelloCb = int (*)(SSL*, int*, void*);
-#endif
 
   ~SecureContext() override;
 
@@ -79,7 +74,6 @@ class SecureContext final : public BaseObject {
 
   ncrypto::SSLPointer CreateSSL();
 
-  void SetClientHelloCallback(ClientHelloCb cb);
   void SetGetSessionCallback(GetSessionCb cb);
   void SetKeylogCallback(KeylogCb cb);
   void SetNewSessionCallback(NewSessionCb cb);
@@ -207,11 +201,6 @@ class SecureContext final : public BaseObject {
 #endif
 };
 
-int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
-                                  ncrypto::BIOPointer&& in,
-                                  ncrypto::X509Pointer* cert,
-                                  ncrypto::X509Pointer* issuer);
-
 }  // namespace crypto
 }  // namespace node
 
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index b08d4b7a9106..d6920c8b30e2 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -134,9 +134,12 @@ void ECDH::GenerateKeys(const FunctionCallbackInfo<Value>& args) {
   ECDH* ecdh;
   ASSIGN_OR_RETURN_UNWRAP(&ecdh, args.This());
 
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.generate()) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to generate key");
   }
+  ecdh->MaybeCacheValidKeyPair(generation);
 }
 
 ECPointPointer ECDH::BufferToPoint(Environment* env,
@@ -307,6 +310,7 @@ void ECDH::SetPrivateKey(const FunctionCallbackInfo<Value>& args) {
 
   ecdh->key_ = std::move(new_key);
   ecdh->group_ = ecdh->key_.getGroup();
+  ecdh->has_valid_key_pair_ = false;
 }
 
 void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
@@ -325,6 +329,7 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
         "Failed to convert Buffer to EC_POINT");
   }
 
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.setPublicKey(pub)) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
         "Failed to set EC_POINT as the public key");
@@ -345,9 +350,22 @@ bool ECDH::IsKeyValidForCurve(const BignumPointer& private_key) {
          private_key < order;
 }
 
+void ECDH::MaybeCacheValidKeyPair(uint64_t generation) {
+  has_valid_key_pair_ = generation == ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_) valid_key_pair_generation_ = generation;
+}
+
 bool ECDH::IsKeyPairValid() {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_ && valid_key_pair_generation_ == generation) {
+    return true;
+  }
+  has_valid_key_pair_ = false;
+
   MarkPopErrorOnReturn mark_pop_error_on_return;
-  return key_.checkKey();
+  const bool is_valid = key_.checkKey();
+  if (is_valid) MaybeCacheValidKeyPair(generation);
+  return is_valid;
 }
 
 // Convert the input public key to compressed, uncompressed, or hybrid formats.
diff --git a/src/crypto/crypto_ec.h b/src/crypto/crypto_ec.h
index 9bc817f3d7f5..3e83d541d7ae 100644
--- a/src/crypto/crypto_ec.h
+++ b/src/crypto/crypto_ec.h
@@ -48,11 +48,14 @@ class ECDH final : public BaseObject {
   static void GetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  void MaybeCacheValidKeyPair(uint64_t generation);
   bool IsKeyPairValid();
   bool IsKeyValidForCurve(const ncrypto::BignumPointer& private_key);
 
   ncrypto::ECKeyPointer key_;
   const EC_GROUP* group_;
+  bool has_valid_key_pair_ = false;
+  uint64_t valid_key_pair_generation_ = 0;
 };
 
 struct EcKeyPairParams final : public MemoryRetainer {
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index a932b0755a0a..185c354db711 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -79,59 +79,100 @@ constexpr BoringSSLDigest kBoringSSLDigests[] = {
 };
 #endif
 
-#if OPENSSL_VERSION_MAJOR >= 3
-void PushAliases(const char* name, void* data) {
-  static_cast<std::vector<std::string>*>(data)->push_back(name);
+void ResetHashCache(Environment* env,
+                    uint64_t generation,
+                    Local<Object> algorithm_cache = Local<Object>()) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  ncrypto::DigestCache* cache = env->provider_digest_cache.get();
+  CHECK_NOT_NULL(cache);
+  if (!algorithm_cache.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    Local<Context> context = isolate->GetCurrentContext();
+    for (const auto& entry : cache->aliases()) {
+      if (algorithm_cache
+              ->Set(context,
+                    OneByteString(isolate, entry.first),
+                    Int32::New(isolate, -1))
+              .IsNothing()) {
+        return;
+      }
+    }
+  }
+  cache->reset(generation);
+#endif
+  env->supported_hash_algorithms.clear();
+  env->hash_cache_generation = generation;
 }
 
-EVP_MD* GetCachedMDByID(Environment* env, size_t id) {
-  CHECK_LT(id, env->evp_md_cache.size());
-  EVP_MD* result = env->evp_md_cache[id].get();
-  CHECK_NOT_NULL(result);
-  return result;
+bool SynchronizeHashCache(Environment* env,
+                          Local<Object> algorithm_cache = Local<Object>()) {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (env->hash_cache_generation == generation) return false;
+
+  ResetHashCache(env, generation, algorithm_cache);
+  return true;
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+const EVP_MD* GetCachedMDByID(Environment* env,
+                              int32_t id,
+                              Local<Object> algorithm_cache = Local<Object>()) {
+  if (SynchronizeHashCache(env, algorithm_cache) ||
+      env->provider_digest_cache == nullptr) {
+    return nullptr;
+  }
+  return env->provider_digest_cache->lookup(id, env->hash_cache_generation)
+      .digest;
 }
 
 struct MaybeCachedMD {
-  EVP_MD* explicit_md = nullptr;
-  const EVP_MD* implicit_md = nullptr;
+  const EVP_MD* cached_md = nullptr;
+  ncrypto::Digest digest;
   int32_t cache_id = -1;
 };
 
-MaybeCachedMD FetchAndMaybeCacheMD(Environment* env, const char* search_name) {
-  const EVP_MD* implicit_md = ncrypto::getDigestByName(search_name);
-  if (!implicit_md) return {nullptr, nullptr, -1};
-
-  const char* real_name = EVP_MD_get0_name(implicit_md);
-  if (!real_name) return {nullptr, implicit_md, -1};
-
-  auto it = env->alias_to_md_id_map.find(real_name);
-  if (it != env->alias_to_md_id_map.end()) {
-    size_t id = it->second;
-    return {GetCachedMDByID(env, id), implicit_md, static_cast<int32_t>(id)};
+MaybeCachedMD FetchAndMaybeCacheMD(
+    Environment* env,
+    const char* search_name,
+    Local<Object> algorithm_cache = Local<Object>(),
+    const char* fetch_name = nullptr) {
+  SynchronizeHashCache(env, algorithm_cache);
+  if (env->isolate()->HasPendingException()) return {};
+  ncrypto::DigestCache* cache = env->provider_digest_cache.get();
+  CHECK_NOT_NULL(cache);
+  const uint64_t generation = env->hash_cache_generation;
+  const EVP_MD* legacy = nullptr;
+
+  if (auto cached = cache->lookup(search_name, generation);
+      cached.digest != nullptr) {
+    return {cached.digest, cached.digest, cached.id};
   }
 
-  // EVP_*_fetch() does not support alias names, so we need to pass it the
-  // real/original algorithm name.
-  // We use EVP_*_fetch() as a filter here because it will only return an
-  // instance if the algorithm is supported by the public OpenSSL APIs (some
-  // algorithms are used internally by OpenSSL and are also passed to this
-  // callback).
-  EVP_MD* explicit_md = EVP_MD_fetch(nullptr, real_name, nullptr);
-  if (!explicit_md) return {nullptr, implicit_md, -1};
+  if (fetch_name == nullptr) {
+    legacy = ncrypto::getDigestByName(search_name);
+    if (legacy != nullptr) {
+      if (legacy == EVP_md_null()) return {};
+      fetch_name = EVP_MD_get0_name(legacy);
+      if (fetch_name == nullptr) return {nullptr, legacy, -1};
+    } else {
+      fetch_name = search_name;
+    }
+  }
 
-  // Cache the EVP_MD* fetched.
-  env->evp_md_cache.emplace_back(explicit_md);
-  size_t id = env->evp_md_cache.size() - 1;
+  const ncrypto::Digest digest = ncrypto::Digest::Fetch(fetch_name);
+  if (!digest) {
+    return legacy == nullptr ? MaybeCachedMD{}
+                             : MaybeCachedMD{nullptr, legacy, -1};
+  }
 
-  // Add all the aliases to the map to speed up next lookup.
-  std::vector<std::string> aliases;
-  EVP_MD_names_do_all(explicit_md, PushAliases, &aliases);
-  for (const auto& alias : aliases) {
-    env->alias_to_md_id_map.emplace(alias, id);
+  if (generation == ncrypto::getFipsStateGeneration()) {
+    auto cached = cache->insert(search_name, digest.get(), generation);
+    if (cached.digest != nullptr) {
+      return {cached.digest, cached.digest, cached.id};
+    }
   }
-  env->alias_to_md_id_map.emplace(search_name, id);
 
-  return {explicit_md, implicit_md, static_cast<int32_t>(id)};
+  return {nullptr, digest, -1};
 }
 
 void SaveSupportedHashAlgorithmsAndCacheMD(const EVP_MD* md,
@@ -140,12 +181,57 @@ void SaveSupportedHashAlgorithmsAndCacheMD(const EVP_MD* md,
                                            void* arg) {
   if (!from) return;
   Environment* env = static_cast<Environment*>(arg);
-  auto result = FetchAndMaybeCacheMD(env, from);
-  if (result.explicit_md) {
+  const ncrypto::Digest legacy = ncrypto::Digest::FromName(from);
+  const char* canonical_name = legacy ? EVP_MD_get0_name(legacy) : nullptr;
+  if (canonical_name == nullptr) return;
+
+  auto result = FetchAndMaybeCacheMD(env, from, {}, canonical_name);
+  if (result.cached_md || result.digest) {
     env->supported_hash_algorithms.push_back(from);
   }
 }
 
+struct ProviderHashNameContext {
+  Environment* env;
+};
+
+void SaveSupportedProviderHashName(const char* name, void* arg) {
+  if (name == nullptr) return;
+
+  const std::string_view name_view(name);
+  const bool is_dotted_decimal =
+      name_view.find('.') != std::string_view::npos &&
+      std::all_of(name_view.begin(), name_view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized_name(name_view);
+  std::transform(normalized_name.begin(),
+                 normalized_name.end(),
+                 normalized_name.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+
+  auto* context = static_cast<ProviderHashNameContext*>(arg);
+  auto result = FetchAndMaybeCacheMD(
+      context->env, normalized_name.c_str(), {}, normalized_name.c_str());
+  if (result.cached_md || result.digest) {
+    context->env->supported_hash_algorithms.push_back(normalized_name);
+  }
+}
+
+void SaveSupportedProviderHashAlgorithms(EVP_MD* md, void* arg) {
+  ProviderHashNameContext context = {
+      .env = static_cast<Environment*>(arg),
+  };
+  EVP_MD_names_do_all(md, SaveSupportedProviderHashName, &context);
+}
+
 #else
 void SaveSupportedHashAlgorithms(const EVP_MD* md,
                                  const char* from,
@@ -155,25 +241,34 @@ void SaveSupportedHashAlgorithms(const EVP_MD* md,
   Environment* env = static_cast<Environment*>(arg);
   env->supported_hash_algorithms.push_back(from);
 }
-#endif  // OPENSSL_VERSION_MAJOR >= 3
+#endif  // NCRYPTO_USE_OPENSSL3_PROVIDER
 
 const std::vector<std::string>& GetSupportedHashAlgorithms(Environment* env) {
-  if (env->supported_hash_algorithms.empty()) {
-    MarkPopErrorOnReturn mark_pop_error_on_return;
+  while (true) {
+    SynchronizeHashCache(env);
+    const uint64_t generation = env->hash_cache_generation;
+    if (env->supported_hash_algorithms.empty()) {
+      MarkPopErrorOnReturn mark_pop_error_on_return;
 #if NCRYPTO_USE_BORINGSSL_EVP_DO_ALL_FALLBACK
-    for (const auto& digest : kBoringSSLDigests) {
-      static_cast<void>(digest.get);
-      env->supported_hash_algorithms.emplace_back(digest.name);
-    }
-#elif OPENSSL_VERSION_MAJOR >= 3
-    // Since we'll fetch the EVP_MD*, cache them along the way to speed up
-    // later lookups instead of throwing them away immediately.
-    EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
+      for (const auto& digest : kBoringSSLDigests) {
+        static_cast<void>(digest.get);
+        env->supported_hash_algorithms.emplace_back(digest.name);
+      }
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+      // Since we'll fetch the EVP_MD*, cache them along the way to speed up
+      // later lookups instead of throwing them away immediately.
+      EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
+      EVP_MD_do_all_provided(nullptr, SaveSupportedProviderHashAlgorithms, env);
 #else
-    EVP_MD_do_all_sorted(SaveSupportedHashAlgorithms, env);
+      EVP_MD_do_all_sorted(SaveSupportedHashAlgorithms, env);
 #endif
+    }
+    const uint64_t current_generation = ncrypto::getFipsStateGeneration();
+    if (generation == current_generation) {
+      return env->supported_hash_algorithms;
+    }
+    ResetHashCache(env, current_generation);
   }
-  return env->supported_hash_algorithms;
 }
 
 void Hash::GetHashes(const FunctionCallbackInfo<Value>& args) {
@@ -191,18 +286,19 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   Local<Context> context = args.GetIsolate()->GetCurrentContext();
   Environment* env = Environment::GetCurrent(context);
-  size_t size = env->alias_to_md_id_map.size();
+  SynchronizeHashCache(env);
+  size_t size = 0;
   LocalVector<Name> names(isolate);
   LocalVector<Value> values(isolate);
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const auto& aliases = env->provider_digest_cache->aliases();
+  size = aliases.size();
   names.reserve(size);
   values.reserve(size);
-  for (auto& [alias, id] : env->alias_to_md_id_map) {
+  for (const auto& [alias, id] : aliases) {
     names.push_back(OneByteString(isolate, alias));
-    values.push_back(Uint32::New(isolate, id));
+    values.push_back(Int32::New(isolate, id));
   }
-#else
-  CHECK(env->alias_to_md_id_map.empty());
 #endif
   Local<Value> prototype = Null(isolate);
   Local<Object> result =
@@ -210,18 +306,24 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(result);
 }
 
-const EVP_MD* GetDigestImplementation(Environment* env,
-                                      Local<Value> algorithm,
-                                      Local<Value> cache_id_val,
-                                      Local<Value> algorithm_cache) {
+const EVP_MD* GetDigestImplementation(
+    Environment* env,
+    Local<Value> algorithm,
+    Local<Value> cache_id_val,
+    Local<Value> algorithm_cache,
+    std::optional<ncrypto::Digest>& digest_owner) {
   CHECK(algorithm->IsString());
   CHECK(cache_id_val->IsInt32());
   CHECK(algorithm_cache->IsObject());
+  DCHECK(!digest_owner.has_value());
 
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  Local<Object> cache = algorithm_cache.As<Object>();
   int32_t cache_id = cache_id_val.As<Int32>()->Value();
-  if (cache_id != -1) {  // Alias already cached, return the cached EVP_MD*.
-    return GetCachedMDByID(env, cache_id);
+  if (cache_id != -1) {
+    // Alias already cached, return the cached EVP_MD*.
+    if (const EVP_MD* md = GetCachedMDByID(env, cache_id, cache)) return md;
+    if (env->isolate()->HasPendingException()) return nullptr;
   }
 
   // Only decode the algorithm when we don't have it cached to avoid
@@ -229,11 +331,11 @@ const EVP_MD* GetDigestImplementation(Environment* env,
   Isolate* isolate = env->isolate();
   Utf8Value utf8(isolate, algorithm);
 
-  auto result = FetchAndMaybeCacheMD(env, *utf8);
+  auto result = FetchAndMaybeCacheMD(env, *utf8, cache);
+  if (env->isolate()->HasPendingException()) return nullptr;
   if (result.cache_id != -1) {
-    // Add the alias to both C++ side and JS side to speedup the lookup
-    // next time.
-    env->alias_to_md_id_map.emplace(*utf8, result.cache_id);
+    // Add the alias to the JavaScript side to speed up the next lookup. The
+    // native cache added it while inserting the implementation.
     if (algorithm_cache.As<Object>()
             ->Set(isolate->GetCurrentContext(),
                   algorithm,
@@ -243,7 +345,12 @@ const EVP_MD* GetDigestImplementation(Environment* env,
     }
   }
 
-  return result.explicit_md ? result.explicit_md : result.implicit_md;
+  if (result.cached_md != nullptr) return result.cached_md;
+  if (result.digest) {
+    digest_owner.emplace(result.digest);
+    return digest_owner->get();
+  }
+  return nullptr;
 #else
   Utf8Value utf8(env->isolate(), algorithm);
   return ncrypto::getDigestByName(*utf8);
@@ -257,21 +364,12 @@ void MarkInvalidXofLength() {
   EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
 #endif
 }
-// crypto.digest(algorithm, algorithmId, algorithmCache,
-//               input, outputEncoding, outputEncodingId, outputLength)
-void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-  CHECK_EQ(args.Length(), 7);
-  CHECK(args[0]->IsString());                                  // algorithm
-  CHECK(args[1]->IsInt32());                                   // algorithmId
-  CHECK(args[2]->IsObject());                                  // algorithmCache
-  CHECK(args[3]->IsString() || args[3]->IsArrayBufferView());  // input
-  CHECK(args[4]->IsString());                                  // outputEncoding
-  CHECK(args[5]->IsUint32() || args[5]->IsUndefined());  // outputEncodingId
-  CHECK(args[6]->IsUint32() || args[6]->IsUndefined());  // outputLength
 
-  const EVP_MD* md = GetDigestImplementation(env, args[0], args[1], args[2]);
+void OneShotDigestWithMD(Environment* env,
+                         const FunctionCallbackInfo<Value>& args,
+                         const EVP_MD* md,
+                         const CShakeOptions* options) {
+  Isolate* isolate = env->isolate();
   if (md == nullptr) [[unlikely]] {
     Utf8Value method(isolate, args[0]);
     std::string message =
@@ -313,7 +411,7 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  if (output_length == 0) {
+  auto return_empty_output = [&]() {
     if (output_enc == BUFFER) {
       Local<Uint8Array> u8;
       if (Buffer::New(isolate, ArrayBuffer::New(isolate, 0), 0, 0)
@@ -323,28 +421,72 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
     } else {
       args.GetReturnValue().Set(String::Empty(isolate));
     }
+  };
+
+  const bool has_digest_options = options != nullptr && !options->empty();
+  if (output_length == 0 && !has_digest_options) {
+    return return_empty_output();
+  }
+
+  if (!has_digest_options) {
+    DataPointer output = ([&]() -> DataPointer {
+      if (args[3]->IsString()) {
+        Utf8Value utf8(isolate, args[3]);
+        ncrypto::Buffer<const unsigned char> input = {
+            .data = reinterpret_cast<const unsigned char*>(utf8.out()),
+            .len = static_cast<size_t>(utf8.length()),
+        };
+        return is_xof ? ncrypto::xofHashDigest(input, md, output_length)
+                      : ncrypto::hashDigest(input, md);
+      }
+
+      ArrayBufferViewContents<unsigned char> input(args[3]);
+      ncrypto::Buffer<const unsigned char> buffer = {
+          .data = input.data(),
+          .len = input.length(),
+      };
+      return is_xof ? ncrypto::xofHashDigest(buffer, md, output_length)
+                    : ncrypto::hashDigest(buffer, md);
+    })();
+    if (!output) [[unlikely]] {
+      return ThrowCryptoError(env, ERR_get_error());
+    }
+
+    Local<Value> ret;
+    if (StringBytes::Encode(env->isolate(),
+                            static_cast<const char*>(output.get()),
+                            output.size(),
+                            output_enc)
+            .ToLocal(&ret)) {
+      args.GetReturnValue().Set(ret);
+    }
     return;
   }
 
-  DataPointer output = ([&]() -> DataPointer {
+  EVPMDCtxPointer ctx = EVPMDCtxPointer::New();
+  if (!options->Initialize(&ctx, md)) {
+    return ThrowCryptoError(
+        env, ERR_get_error(), "Digest options are not supported");
+  }
+
+  const bool updated = [&]() {
     if (args[3]->IsString()) {
-      Utf8Value utf8(isolate, args[3]);
-      ncrypto::Buffer<const unsigned char> buf = {
-          .data = reinterpret_cast<const unsigned char*>(utf8.out()),
-          .len = utf8.length(),
-      };
-      return is_xof ? ncrypto::xofHashDigest(buf, md, output_length)
-                    : ncrypto::hashDigest(buf, md);
+      Utf8Value input(isolate, args[3]);
+      return ctx.digestUpdate(ncrypto::Buffer<const void>{
+          .data = input.out(),
+          .len = static_cast<size_t>(input.length()),
+      });
     }
 
     ArrayBufferViewContents<unsigned char> input(args[3]);
-    ncrypto::Buffer<const unsigned char> buf = {
-        .data = reinterpret_cast<const unsigned char*>(input.data()),
+    return ctx.digestUpdate(ncrypto::Buffer<const void>{
+        .data = input.data(),
         .len = input.length(),
-    };
-    return is_xof ? ncrypto::xofHashDigest(buf, md, output_length)
-                  : ncrypto::hashDigest(buf, md);
-  })();
+    });
+  }();
+  if (!updated) return ThrowCryptoError(env, ERR_get_error());
+  if (output_length == 0) return return_empty_output();
+  DataPointer output = ctx.digestFinal(output_length);
 
   if (!output) [[unlikely]] {
     return ThrowCryptoError(env, ERR_get_error());
@@ -360,6 +502,54 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// crypto.digest(algorithm, algorithmId, algorithmCache, input, outputEncoding,
+//               outputEncodingId, outputLength[, functionName, customization])
+void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.Length() == 7 || args.Length() == 9);
+  CHECK(args[0]->IsString());                                  // algorithm
+  CHECK(args[1]->IsInt32());                                   // algorithmId
+  CHECK(args[2]->IsObject());                                  // algorithmCache
+  CHECK(args[3]->IsString() || args[3]->IsArrayBufferView());  // input
+  CHECK(args[4]->IsString());                                  // outputEncoding
+  CHECK(args[5]->IsUint32() || args[5]->IsUndefined());  // outputEncodingId
+  CHECK(args[6]->IsUint32() || args[6]->IsUndefined());  // outputLength
+
+  if (args.Length() == 7) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    const int32_t cache_id = args[1].As<Int32>()->Value();
+    if (cache_id != -1) {
+      if (const EVP_MD* md =
+              GetCachedMDByID(env, cache_id, args[2].As<Object>())) {
+        return OneShotDigestWithMD(env, args, md, nullptr);
+      }
+      if (env->isolate()->HasPendingException()) return;
+    }
+#else
+    Utf8Value utf8(env->isolate(), args[0]);
+    return OneShotDigestWithMD(
+        env, args, ncrypto::getDigestByName(*utf8), nullptr);
+#endif
+  }
+
+  if (args.Length() == 9) {
+    CShakeOptions options;
+    if (GetCShakeOptions(args, 7, &options).IsNothing()) return;
+
+    std::optional<ncrypto::Digest> digest_owner;
+    const EVP_MD* md =
+        GetDigestImplementation(env, args[0], args[1], args[2], digest_owner);
+    if (env->isolate()->HasPendingException()) return;
+    return OneShotDigestWithMD(env, args, md, &options);
+  }
+
+  std::optional<ncrypto::Digest> digest_owner;
+  const EVP_MD* md =
+      GetDigestImplementation(env, args[0], args[1], args[2], digest_owner);
+  if (env->isolate()->HasPendingException()) return;
+  OneShotDigestWithMD(env, args, md, nullptr);
+}
+
 void Hash::Initialize(Environment* env, Local<Object> target) {
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
@@ -396,30 +586,64 @@ void Hash::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #endif
 }
 
-// new Hash(algorithm, algorithmId, xofLen, algorithmCache)
+// new Hash(algorithm, xofLen, algorithmId, algorithmCache[, functionName,
+//          customization])
 void Hash::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+  CHECK(args.Length() == 4 || args.Length() == 6);
+
+  Maybe<unsigned int> xof_md_len = Nothing<unsigned int>();
+  if (!args[1]->IsUndefined()) {
+    CHECK(args[1]->IsUint32());
+    xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // This is the common path after the first lookup. Avoid constructing a
+  // digest owner when the Environment already owns the cached implementation.
+  if (args.Length() == 4 && args[0]->IsString()) {
+    CHECK(args[2]->IsInt32());
+    const int32_t cache_id = args[2].As<Int32>()->Value();
+    if (cache_id != -1) {
+      if (const EVP_MD* md =
+              GetCachedMDByID(env, cache_id, args[3].As<Object>())) {
+        Hash* hash = new Hash(env, args.This());
+        if (!hash->HashInit(md, xof_md_len)) {
+          return ThrowCryptoError(
+              env, ERR_get_error(), "Digest method not supported");
+        }
+        return;
+      }
+      if (env->isolate()->HasPendingException()) return;
+    }
+  }
+#endif
 
   const Hash* orig = nullptr;
+  std::optional<ncrypto::Digest> digest_owner;
   const EVP_MD* md = nullptr;
   if (args[0]->IsObject()) {
     ASSIGN_OR_RETURN_UNWRAP(&orig, args[0].As<Object>());
     CHECK_NOT_NULL(orig);
     md = orig->mdctx_.getDigest();
   } else {
-    md = GetDigestImplementation(env, args[0], args[2], args[3]);
-  }
-
-  Maybe<unsigned int> xof_md_len = Nothing<unsigned int>();
-  if (!args[1]->IsUndefined()) {
-    CHECK(args[1]->IsUint32());
-    xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
+    md = GetDigestImplementation(env, args[0], args[2], args[3], digest_owner);
+    if (env->isolate()->HasPendingException()) return;
   }
 
   Hash* hash = new Hash(env, args.This());
-  if (md == nullptr || !hash->HashInit(md, xof_md_len)) {
-    return ThrowCryptoError(env, ERR_get_error(),
-                            "Digest method not supported");
+  if (args.Length() == 4) {
+    if (md == nullptr || !hash->HashInit(md, xof_md_len)) {
+      return ThrowCryptoError(
+          env, ERR_get_error(), "Digest method not supported");
+    }
+  } else {
+    CShakeOptions options;
+    if (GetCShakeOptions(args, 4, &options).IsNothing()) return;
+    if (md == nullptr || !hash->HashInit(md, options, xof_md_len)) {
+      return ThrowCryptoError(
+          env, ERR_get_error(), "Digest method not supported");
+    }
   }
 
   if (orig != nullptr && !orig->mdctx_.copyTo(hash->mdctx_)) {
@@ -427,9 +651,9 @@ void Hash::New(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
+bool Hash::HashInit(const EVP_MD* digest, Maybe<unsigned int> xof_md_len) {
   mdctx_ = EVPMDCtxPointer::New();
-  if (!mdctx_.digestInit(md)) [[unlikely]] {
+  if (!mdctx_.digestInit(digest)) [[unlikely]] {
     mdctx_.reset();
     return false;
   }
@@ -440,7 +664,7 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   // default lengths
   // TODO(@panva): remove this behaviour when DEP0198 is End-Of-Life
   if (mdctx_.hasXofFlag() && !xof_md_len.IsJust() && md_len_ == 0) {
-    const char* name = OBJ_nid2sn(EVP_MD_type(md));
+    const char* name = OBJ_nid2sn(EVP_MD_type(digest));
     if (name != nullptr) {
       if (strcmp(name, "SHAKE128") == 0) {
         md_len_ = 16;
@@ -464,6 +688,30 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   return true;
 }
 
+bool Hash::HashInit(const EVP_MD* digest,
+                    const CShakeOptions& options,
+                    Maybe<unsigned int> xof_md_len) {
+  mdctx_ = EVPMDCtxPointer::New();
+  if (!options.Initialize(&mdctx_, digest)) [[unlikely]] {
+    mdctx_.reset();
+    return false;
+  }
+
+  md_len_ = mdctx_.getDigestSize();
+  if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
+    // This is a little hack to cause createHash to fail when an incorrect
+    // hashSize option was passed for a non-XOF hash function.
+    if (!mdctx_.hasXofFlag()) [[unlikely]] {
+      MarkInvalidXofLength();
+      mdctx_.reset();
+      return false;
+    }
+    md_len_ = xof_md_len.FromJust();
+  }
+
+  return true;
+}
+
 bool Hash::HashUpdate(const char* data, size_t len) {
   if (!mdctx_) return false;
   return mdctx_.digestUpdate(ncrypto::Buffer<const void>{
@@ -528,7 +776,10 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
 }
 
 HashConfig::HashConfig(HashConfig&& other) noexcept
-    : in(std::move(other.in)), digest(other.digest), length(other.length) {}
+    : in(std::move(other.in)),
+      digest(other.digest),
+      options(std::move(other.options)),
+      length(other.length) {}
 
 HashConfig& HashConfig::operator=(HashConfig&& other) noexcept {
   if (&other == this) return *this;
@@ -538,6 +789,9 @@ HashConfig& HashConfig::operator=(HashConfig&& other) noexcept {
 
 void HashConfig::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TraitTrackInline(in, "in");
+  if (options.has_value()) {
+    tracker->TrackField("options", *options);
+  }
 }
 
 MaybeLocal<Value> HashTraits::EncodeOutput(Environment* env,
@@ -555,8 +809,8 @@ Maybe<void> HashTraits::AdditionalConfig(
 
   CHECK(args[offset]->IsString());  // Hash algorithm
   Utf8Value digest(env->isolate(), args[offset]);
-  params->digest = ncrypto::getDigestByName(*digest);
-  if (params->digest == nullptr) [[unlikely]] {
+  params->digest = ncrypto::Digest::FromName(*digest);
+  if (!params->digest) [[unlikely]] {
     THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Invalid digest: %s", digest);
     return Nothing<void>();
   }
@@ -568,7 +822,14 @@ Maybe<void> HashTraits::AdditionalConfig(
   }
   params->in = IsCryptoJobAsync(mode) ? data.ToCopy() : data.ToByteSource();
 
-  unsigned int expected = EVP_MD_size(params->digest);
+  if (static_cast<unsigned int>(args.Length()) > offset + 3) {
+    params->options.emplace();
+    if (GetCShakeOptions(args, offset + 3, &*params->options).IsNothing()) {
+      return Nothing<void>();
+    }
+  }
+
+  unsigned int expected = EVP_MD_size(params->digest.get());
   params->length = expected;
   if (args[offset + 2]->IsUint32()) [[unlikely]] {
     // length is expressed in terms of bits
@@ -576,7 +837,8 @@ Maybe<void> HashTraits::AdditionalConfig(
         static_cast<uint32_t>(args[offset + 2].As<Uint32>()->Value()) /
         CHAR_BIT;
     if (params->length != expected) {
-      if ((EVP_MD_flags(params->digest) & EVP_MD_FLAG_XOF) == 0) [[unlikely]] {
+      if ((EVP_MD_flags(params->digest.get()) & EVP_MD_FLAG_XOF) == 0)
+          [[unlikely]] {
         THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Digest method not supported");
         return Nothing<void>();
       }
@@ -593,8 +855,11 @@ bool HashTraits::DeriveBits(Environment* env,
                             CryptoErrorStore* errors) {
   auto ctx = EVPMDCtxPointer::New();
 
-  if (!ctx.digestInit(params.digest) || !ctx.digestUpdate(params.in))
-      [[unlikely]] {
+  const bool initialized =
+      params.options.has_value()
+          ? params.options->Initialize(&ctx, params.digest.get())
+          : ctx.digestInit(params.digest.get());
+  if (!initialized || !ctx.digestUpdate(params.in)) [[unlikely]] {
     return false;
   }
 
diff --git a/src/crypto/crypto_hash.h b/src/crypto/crypto_hash.h
index 3ae6a16c2579..146e9cf55b52 100644
--- a/src/crypto/crypto_hash.h
+++ b/src/crypto/crypto_hash.h
@@ -21,7 +21,10 @@ class Hash final : public BaseObject {
   SET_MEMORY_INFO_NAME(Hash)
   SET_SELF_SIZE(Hash)
 
-  bool HashInit(const EVP_MD* md, v8::Maybe<unsigned int> xof_md_len);
+  bool HashInit(const EVP_MD* digest, v8::Maybe<unsigned int> xof_md_len);
+  bool HashInit(const EVP_MD* digest,
+                const CShakeOptions& options,
+                v8::Maybe<unsigned int> xof_md_len);
   bool HashUpdate(const char* data, size_t len);
 
   static void GetHashes(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -43,7 +46,8 @@ class Hash final : public BaseObject {
 
 struct HashConfig final : public MemoryRetainer {
   ByteSource in;
-  const EVP_MD* digest;
+  ncrypto::Digest digest;
+  std::optional<CShakeOptions> options;
   unsigned int length;
 
   HashConfig() = default;
diff --git a/src/crypto/crypto_hmac.cc b/src/crypto/crypto_hmac.cc
index 7b5fa8605f9b..541dfe7e7811 100644
--- a/src/crypto/crypto_hmac.cc
+++ b/src/crypto/crypto_hmac.cc
@@ -141,6 +141,9 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
       return ThrowCryptoError(env, ERR_get_error(), "Failed to finalize HMAC");
     }
     hmac->ctx_.reset();
+  } else {
+    // The context has already been finalized; never emit unwritten bytes.
+    buf.len = 0;
   }
 
   Local<Value> ret;
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index b4e3aa72292f..2d80caf76661 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -1695,12 +1695,15 @@ void NativeKeyObject::Initialize(Environment* env, Local<Object> target) {
             NativeKeyObject::CreateNativeKeyObjectClass);
   SetMethod(
       env->context(), target, "getKeyObjectSlots", NativeKeyObject::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isKeyObject", NativeKeyObject::IsKeyObject);
 }
 
 void NativeKeyObject::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeKeyObject::CreateNativeKeyObjectClass);
   registry->Register(NativeKeyObject::GetSlots);
+  registry->Register(NativeKeyObject::IsKeyObject);
   registry->Register(NativeKeyObject::New);
 }
 
@@ -1709,6 +1712,12 @@ bool NativeKeyObject::HasInstance(Environment* env, Local<Value> value) {
   return !t.IsEmpty() && t->HasInstance(value);
 }
 
+void NativeKeyObject::IsKeyObject(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 void NativeKeyObject::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -1839,12 +1848,15 @@ void NativeCryptoKey::Initialize(Environment* env, Local<Object> target) {
             NativeCryptoKey::CreateCryptoKeyClass);
   SetMethod(
       env->context(), target, "getCryptoKeySlots", NativeCryptoKey::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isCryptoKey", NativeCryptoKey::IsCryptoKey);
 }
 
 void NativeCryptoKey::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeCryptoKey::CreateCryptoKeyClass);
   registry->Register(NativeCryptoKey::GetSlots);
+  registry->Register(NativeCryptoKey::IsCryptoKey);
   registry->Register(NativeCryptoKey::New);
 }
 
@@ -1861,6 +1873,12 @@ bool NativeCryptoKey::HasInstance(Environment* env, Local<Value> value) {
   return IsNativeCryptoKey(env, value);
 }
 
+void NativeCryptoKey::IsCryptoKey(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
                                           const KeyObjectData& data,
                                           Local<Value> algorithm,
diff --git a/src/crypto/crypto_keys.h b/src/crypto/crypto_keys.h
index b09756f719cf..8fffbec60467 100644
--- a/src/crypto/crypto_keys.h
+++ b/src/crypto/crypto_keys.h
@@ -209,6 +209,7 @@ class NativeKeyObject : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateNativeKeyObjectClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsKeyObject(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   // True if `value` is a real NativeKeyObject instance. Uses the
   // FunctionTemplate stored on the Environment as a brand check.
@@ -277,6 +278,7 @@ class NativeCryptoKey : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateCryptoKeyClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsCryptoKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Value> Create(Environment* env,
                                           const KeyObjectData& data,
diff --git a/src/crypto/crypto_mac.cc b/src/crypto/crypto_mac.cc
new file mode 100644
index 000000000000..7f43e760ccf7
--- /dev/null
+++ b/src/crypto/crypto_mac.cc
@@ -0,0 +1,656 @@
+#include "crypto/crypto_mac.h"
+#include "base_object-inl.h"
+#include "env-inl.h"
+#include "memory_tracker-inl.h"
+#include "node_buffer.h"
+#include "node_errors.h"
+#include "string_bytes.h"
+#include "v8.h"
+
+#if OPENSSL_WITH_EVP_MAC
+#include <openssl/core_names.h>
+#include <openssl/evp.h>
+#include <openssl/params.h>
+
+#include <algorithm>
+#include <array>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+#endif
+
+namespace node {
+
+using v8::Array;
+using v8::Context;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::Int32;
+using v8::Isolate;
+using v8::Local;
+using v8::LocalVector;
+using v8::Name;
+using v8::Null;
+using v8::Object;
+using v8::Uint32;
+using v8::Value;
+
+namespace crypto {
+
+#if OPENSSL_WITH_EVP_MAC
+namespace {
+
+struct InitializedMac final {
+  ncrypto::EVPMacCtxPointer context;
+  size_t output_size = 0;
+  bool has_output_length = false;
+};
+
+struct MaybeCachedMac final {
+  EVP_MAC* cached_mac = nullptr;
+  ncrypto::EVPMacPointer mac;
+  int32_t cache_id = -1;
+  ncrypto::MacKind kind = ncrypto::MacKind::kOther;
+};
+
+bool MaybeThrowCryptoError(Environment* env, const char* message) {
+  const unsigned long error = ERR_get_error();  // NOLINT(runtime/int)
+  if (error == 0) return false;
+  ThrowCryptoError(env, error, message);
+  return true;
+}
+
+void ThrowMacError(Environment* env, const char* message) {
+  if (!MaybeThrowCryptoError(env, message)) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, message);
+  }
+}
+
+void ResetMacCache(Environment* env,
+                   uint64_t generation,
+                   Local<Object> algorithm_cache = Local<Object>()) {
+  ncrypto::MacCache* cache = env->provider_mac_cache.get();
+  CHECK_NOT_NULL(cache);
+  if (!algorithm_cache.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    Local<Context> context = env->context();
+    for (const auto& entry : cache->aliases()) {
+      if (algorithm_cache
+              ->Set(context,
+                    OneByteString(isolate, entry.first),
+                    Int32::New(isolate, -1))
+              .IsNothing()) {
+        return;
+      }
+    }
+  }
+  cache->reset(generation);
+  env->supported_mac_algorithms.clear();
+  env->supported_mac_algorithms_initialized = false;
+  env->mac_cache_generation = generation;
+}
+
+bool SynchronizeMacCache(Environment* env,
+                         Local<Object> algorithm_cache = Local<Object>()) {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (env->mac_cache_generation == generation) return false;
+  ResetMacCache(env, generation, algorithm_cache);
+  return true;
+}
+
+ncrypto::MacCache::Result GetCachedMacByID(
+    Environment* env,
+    int32_t id,
+    Local<Object> algorithm_cache = Local<Object>()) {
+  if (SynchronizeMacCache(env, algorithm_cache) ||
+      env->provider_mac_cache == nullptr) {
+    return {};
+  }
+  return env->provider_mac_cache->lookup(id, env->mac_cache_generation);
+}
+
+MaybeCachedMac FetchAndMaybeCacheMac(
+    Environment* env,
+    const char* name,
+    Local<Object> algorithm_cache = Local<Object>()) {
+  SynchronizeMacCache(env, algorithm_cache);
+  if (env->isolate()->HasPendingException()) return {};
+  ncrypto::MacCache* cache = env->provider_mac_cache.get();
+  CHECK_NOT_NULL(cache);
+  const uint64_t generation = env->mac_cache_generation;
+
+  if (auto cached = cache->lookup(name, generation); cached.mac != nullptr) {
+    return {cached.mac, {}, cached.id, cached.kind};
+  }
+
+  ncrypto::EVPMacPointer mac;
+  {
+    ncrypto::MarkPopErrorOnReturn mark_pop_error_on_return;
+    mac = ncrypto::EVPMacPointer::Fetch(name);
+  }
+  if (!mac) return {};
+
+  if (generation == ncrypto::getFipsStateGeneration()) {
+    auto cached = cache->insert(name, std::move(mac), generation);
+    if (cached.mac != nullptr) {
+      return {cached.mac, {}, cached.id, cached.kind};
+    }
+  }
+
+  const ncrypto::MacKind kind = ncrypto::MacCache::GetKind(mac.get());
+  return {nullptr, std::move(mac), -1, kind};
+}
+
+EVP_MAC* GetMacImplementation(Environment* env,
+                              Local<Value> algorithm,
+                              Local<Value> cache_id_value,
+                              Local<Value> algorithm_cache,
+                              ncrypto::EVPMacPointer* mac_owner,
+                              ncrypto::MacKind* kind) {
+  CHECK(algorithm->IsString());
+  CHECK(cache_id_value->IsInt32());
+  CHECK(algorithm_cache->IsObject());
+  CHECK_NOT_NULL(mac_owner);
+  CHECK_NOT_NULL(kind);
+
+  Local<Object> cache = algorithm_cache.As<Object>();
+  const int32_t cache_id = cache_id_value.As<Int32>()->Value();
+  if (cache_id != -1) {
+    auto cached = GetCachedMacByID(env, cache_id, cache);
+    if (cached.mac != nullptr) {
+      *kind = cached.kind;
+      return cached.mac;
+    }
+    if (env->isolate()->HasPendingException()) return nullptr;
+  }
+
+  Isolate* isolate = env->isolate();
+  Utf8Value utf8(isolate, algorithm);
+  MaybeCachedMac result = FetchAndMaybeCacheMac(env, *utf8, cache);
+  if (env->isolate()->HasPendingException()) return nullptr;
+  if (result.cache_id != -1) {
+    if (cache
+            ->Set(
+                env->context(), algorithm, Int32::New(isolate, result.cache_id))
+            .IsNothing()) {
+      return nullptr;
+    }
+  }
+
+  if (result.cached_mac != nullptr) {
+    *kind = result.kind;
+    return result.cached_mac;
+  }
+  if (result.mac) {
+    *mac_owner = std::move(result.mac);
+    *kind = result.kind;
+    return mac_owner->get();
+  }
+  return nullptr;
+}
+
+bool IsSettableParameter(const ncrypto::EVPMacCtxPointer& context,
+                         const char* name,
+                         unsigned int type) {
+  const OSSL_PARAM* settable = context.getSettableParams();
+  const OSSL_PARAM* descriptor =
+      settable == nullptr ? nullptr : OSSL_PARAM_locate_const(settable, name);
+  return descriptor != nullptr && descriptor->data_type == type;
+}
+
+bool RequireSettableParameter(Environment* env,
+                              const ncrypto::EVPMacCtxPointer& context,
+                              Local<Value> algorithm,
+                              const char* option,
+                              const char* parameter,
+                              unsigned int type) {
+  if (IsSettableParameter(context, parameter, type)) return true;
+  Utf8Value name(env->isolate(), algorithm);
+  THROW_ERR_INVALID_ARG_VALUE(
+      env,
+      "The property 'options.%s' is not supported by MAC %s",
+      option,
+      *name);
+  return false;
+}
+
+bool InitializeMacContext(Environment* env,
+                          const FunctionCallbackInfo<Value>& args,
+                          InitializedMac* output) {
+  CHECK(args.Length() == 5 || args.Length() == 10);
+  CHECK(args[0]->IsString());
+  CHECK(args[1]->IsInt32());
+  CHECK(args[2]->IsObject());
+
+  Isolate* isolate = env->isolate();
+  ByteSource key = ByteSource::FromSecretKeyBytes(env, args[3]);
+
+  std::optional<Utf8Value> digest;
+  if (!args[4]->IsUndefined()) {
+    CHECK(args[4]->IsString());
+    digest.emplace(isolate, args[4]);
+  }
+  std::optional<Utf8Value> cipher;
+  if (!args[5]->IsUndefined()) {
+    CHECK(args[5]->IsString());
+    cipher.emplace(isolate, args[5]);
+  }
+
+  const bool has_iv = !args[6]->IsUndefined();
+  ByteSource iv;
+  if (has_iv) iv = ByteSource::FromBuffer(args[6]);
+  const bool has_customization = !args[7]->IsUndefined();
+  ByteSource customization;
+  if (has_customization) customization = ByteSource::FromBuffer(args[7]);
+  const bool has_salt = !args[8]->IsUndefined();
+  ByteSource salt;
+  if (has_salt) salt = ByteSource::FromBuffer(args[8]);
+
+  const bool has_output_length = !args[9]->IsUndefined();
+  size_t output_length = 0;
+  if (has_output_length) {
+    CHECK(args[9]->IsUint32());
+    output_length = args[9].As<Uint32>()->Value();
+  }
+
+  ncrypto::EVPMacPointer mac_owner;
+  ncrypto::MacKind kind = ncrypto::MacKind::kOther;
+  EVP_MAC* mac =
+      GetMacImplementation(env, args[0], args[1], args[2], &mac_owner, &kind);
+  if (mac == nullptr) {
+    if (env->isolate()->IsExecutionTerminating() ||
+        env->isolate()->HasPendingException()) {
+      return false;
+    }
+    Utf8Value name(env->isolate(), args[0]);
+    THROW_ERR_CRYPTO_INVALID_MAC(env, "Invalid MAC: %s", *name);
+    return false;
+  }
+
+  if (kind == ncrypto::MacKind::kHmac && !digest.has_value()) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The property 'options.digest' is required for HMAC");
+    return false;
+  }
+  if (kind == ncrypto::MacKind::kCmac && !cipher.has_value()) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The property 'options.cipher' is required for CMAC");
+    return false;
+  }
+  if (kind == ncrypto::MacKind::kGmac) {
+    if (!cipher.has_value()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "The property 'options.cipher' is required for GMAC");
+      return false;
+    }
+    if (!has_iv || iv.empty()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "The property 'options.iv' must be non-empty for GMAC");
+      return false;
+    }
+  }
+
+  ncrypto::EVPMacCtxPointer context = ncrypto::EVPMacCtxPointer::New(mac);
+  if (!context) {
+    ThrowMacError(env, "Failed to create MAC context");
+    return false;
+  }
+
+  std::array<OSSL_PARAM, 7> params;
+  size_t count = 0;
+  if (digest.has_value()) {
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "digest",
+                                  OSSL_MAC_PARAM_DIGEST,
+                                  OSSL_PARAM_UTF8_STRING)) {
+      return false;
+    }
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_MAC_PARAM_DIGEST, const_cast<char*>(digest->out()), 0);
+  }
+  if (cipher.has_value()) {
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "cipher",
+                                  OSSL_MAC_PARAM_CIPHER,
+                                  OSSL_PARAM_UTF8_STRING)) {
+      return false;
+    }
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_MAC_PARAM_CIPHER, const_cast<char*>(cipher->out()), 0);
+  }
+
+  unsigned char empty_parameter = 0;
+  auto add_bytes = [&](bool present,
+                       const ByteSource& value,
+                       const char* option,
+                       const char* parameter) {
+    if (!present) return true;
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  option,
+                                  parameter,
+                                  OSSL_PARAM_OCTET_STRING)) {
+      return false;
+    }
+    void* data = value.empty() ? static_cast<void*>(&empty_parameter)
+                               : const_cast<void*>(value.data());
+    params[count++] =
+        OSSL_PARAM_construct_octet_string(parameter, data, value.size());
+    return true;
+  };
+
+  if (!add_bytes(has_iv, iv, "iv", OSSL_MAC_PARAM_IV) ||
+      !add_bytes(has_customization,
+                 customization,
+                 "customization",
+                 OSSL_MAC_PARAM_CUSTOM) ||
+      !add_bytes(has_salt, salt, "salt", OSSL_MAC_PARAM_SALT)) {
+    return false;
+  }
+
+  if (has_output_length) {
+    if (output_length > Buffer::kMaxLength) {
+      env->isolate()->ThrowException(ERR_BUFFER_TOO_LARGE(env->isolate()));
+      return false;
+    }
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "outputLength",
+                                  OSSL_MAC_PARAM_SIZE,
+                                  OSSL_PARAM_UNSIGNED_INTEGER)) {
+      return false;
+    }
+    params[count++] =
+        OSSL_PARAM_construct_size_t(OSSL_MAC_PARAM_SIZE, &output_length);
+  }
+  params[count] = OSSL_PARAM_construct_end();
+
+  if (!context.init(key, params.data())) {
+    ThrowMacError(env, "Failed to initialize MAC");
+    return false;
+  }
+
+  const size_t output_size = context.getSize();
+  if (output_size > Buffer::kMaxLength) {
+    ERR_clear_error();
+    env->isolate()->ThrowException(ERR_BUFFER_TOO_LARGE(env->isolate()));
+    return false;
+  }
+  if (has_output_length && output_size != output_length) {
+    ERR_clear_error();
+    Utf8Value name(env->isolate(), args[0]);
+    THROW_ERR_INVALID_ARG_VALUE(
+        env,
+        "The property 'options.outputLength' was not honored by MAC %s",
+        *name);
+    return false;
+  }
+  if (!has_output_length && output_size == 0) {
+    ERR_clear_error();
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "MAC did not report an output size");
+    return false;
+  }
+
+  output->context = std::move(context);
+  output->output_size = output_size;
+  output->has_output_length = has_output_length;
+  return true;
+}
+
+v8::MaybeLocal<Value> FinalizeMac(Environment* env,
+                                  ncrypto::EVPMacCtxPointer* context,
+                                  size_t output_size,
+                                  bool has_output_length,
+                                  enum encoding encoding) {
+  ncrypto::DataPointer result = context->final(output_size);
+  if (!result) {
+    ThrowMacError(env, "Failed to finalize MAC");
+    context->reset();
+    return {};
+  }
+  context->reset();
+  if (has_output_length && result.size() != output_size) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "MAC returned an unexpected output length");
+    return {};
+  }
+  if (encoding != BUFFER) {
+    return StringBytes::Encode(env->isolate(),
+                               static_cast<const char*>(result.get()),
+                               result.size(),
+                               encoding);
+  }
+  if (result.size() == 0) return Buffer::New(env, 0);
+
+  ByteSource bytes = ByteSource::Allocated(result.release());
+  return bytes.ToBuffer(env);
+}
+
+void SaveMacName(const char* name, void* arg) {
+  if (name == nullptr) return;
+  const std::string_view view(name);
+  const bool is_dotted_decimal =
+      view.find('.') != std::string_view::npos &&
+      std::all_of(view.begin(), view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized(view);
+  std::transform(normalized.begin(),
+                 normalized.end(),
+                 normalized.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+  static_cast<Environment*>(arg)->supported_mac_algorithms.push_back(
+      std::move(normalized));
+}
+
+void SaveSupportedProviderMac(EVP_MAC* enumerated, void* arg) {
+  Environment* env = static_cast<Environment*>(arg);
+  const char* name = EVP_MAC_get0_name(enumerated);
+  if (name == nullptr) return;
+
+  MaybeCachedMac result = FetchAndMaybeCacheMac(env, name);
+  EVP_MAC* fetched =
+      result.cached_mac != nullptr ? result.cached_mac : result.mac.get();
+  if (fetched == nullptr) return;
+  EVP_MAC_names_do_all(fetched, SaveMacName, env);
+}
+
+const std::vector<std::string>& GetSupportedMacAlgorithms(Environment* env) {
+  while (true) {
+    SynchronizeMacCache(env);
+    const uint64_t generation = env->mac_cache_generation;
+    if (!env->supported_mac_algorithms_initialized) {
+      ncrypto::MarkPopErrorOnReturn mark_pop_error_on_return;
+      EVP_MAC_do_all_provided(nullptr, SaveSupportedProviderMac, env);
+      std::sort(env->supported_mac_algorithms.begin(),
+                env->supported_mac_algorithms.end());
+      env->supported_mac_algorithms.erase(
+          std::unique(env->supported_mac_algorithms.begin(),
+                      env->supported_mac_algorithms.end()),
+          env->supported_mac_algorithms.end());
+      env->supported_mac_algorithms_initialized = true;
+    }
+
+    const uint64_t current_generation = ncrypto::getFipsStateGeneration();
+    if (generation == current_generation) {
+      return env->supported_mac_algorithms;
+    }
+    ResetMacCache(env, current_generation);
+  }
+}
+
+}  // namespace
+#endif  // OPENSSL_WITH_EVP_MAC
+
+#if OPENSSL_WITH_EVP_MAC
+bool Mac::MacUpdate(const char* data, size_t length) {
+  if (!context_) return false;
+  if (length == 0) return true;
+  if (EVP_MAC_update(context_.get(),
+                     reinterpret_cast<const unsigned char*>(data),
+                     length) == 1) {
+    return true;
+  }
+  MaybeThrowCryptoError(env(), "Failed to update MAC");
+  context_.reset();
+  return false;
+}
+
+Mac::Mac(Environment* env,
+         Local<Object> wrap,
+         ncrypto::EVPMacCtxPointer&& context,
+         size_t output_size,
+         bool has_output_length)
+    : BaseObject(env, wrap),
+      context_(std::move(context)),
+      output_size_(output_size),
+      has_output_length_(has_output_length) {
+  MakeWeak();
+}
+#else
+Mac::Mac(Environment* env, Local<Object> wrap) : BaseObject(env, wrap) {
+  MakeWeak();
+}
+#endif
+
+void Mac::MemoryInfo(MemoryTracker* tracker) const {
+#if OPENSSL_WITH_EVP_MAC
+  tracker->TrackFieldWithSize("context", context_ ? kSizeOf_EVP_MAC_CTX : 0);
+#else
+  static_cast<void>(tracker);
+#endif
+}
+
+void Mac::Initialize(Environment* env, Local<Object> target) {
+  Isolate* isolate = env->isolate();
+  Local<Context> context = env->context();
+  Local<FunctionTemplate> t = NewFunctionTemplate(isolate, New);
+  t->InstanceTemplate()->SetInternalFieldCount(Mac::kInternalFieldCount);
+  SetProtoMethod(isolate, t, "update", MacUpdate);
+  SetProtoMethod(isolate, t, "final", MacFinal);
+  SetConstructorFunction(context, target, "Mac", t);
+
+  SetMethodNoSideEffect(context, target, "getMacs", GetMacs);
+  SetMethodNoSideEffect(
+      context, target, "getCachedMacAliases", GetCachedAliases);
+}
+
+void Mac::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(MacUpdate);
+  registry->Register(MacFinal);
+  registry->Register(GetMacs);
+  registry->Register(GetCachedAliases);
+}
+
+void Mac::New(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args.IsConstructCall());
+#if OPENSSL_WITH_EVP_MAC
+  CHECK(args.Length() == 5 || args.Length() == 10);
+  Environment* env = Environment::GetCurrent(args);
+  InitializedMac initialized;
+  if (!InitializeMacContext(env, args, &initialized)) return;
+  new Mac(env,
+          args.This(),
+          std::move(initialized.context),
+          initialized.output_size,
+          initialized.has_output_length);
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::MacUpdate(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Decode<Mac>(args,
+              [](Mac* mac,
+                 const FunctionCallbackInfo<Value>& args,
+                 const char* data,
+                 size_t length) {
+                args.GetReturnValue().Set(mac->MacUpdate(data, length));
+              });
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::MacFinal(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Mac* mac;
+  ASSIGN_OR_RETURN_UNWRAP(&mac, args.This());
+  Environment* env = mac->env();
+  if (!mac->context_) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "MAC context is not initialized");
+    return;
+  }
+  enum encoding encoding = BUFFER;
+  if (args.Length() >= 1) {
+    encoding = ParseEncoding(env->isolate(), args[0], BUFFER);
+  }
+  Local<Value> result;
+  if (FinalizeMac(env,
+                  &mac->context_,
+                  mac->output_size_,
+                  mac->has_output_length_,
+                  encoding)
+          .ToLocal(&result)) {
+    args.GetReturnValue().Set(result);
+  }
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::GetMacs(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Local<Context> context = args.GetIsolate()->GetCurrentContext();
+  Environment* env = Environment::GetCurrent(context);
+  Local<Value> result;
+  if (ToV8Value(context, GetSupportedMacAlgorithms(env)).ToLocal(&result)) {
+    args.GetReturnValue().Set(result);
+  }
+#else
+  args.GetReturnValue().Set(Array::New(args.GetIsolate(), 0));
+#endif
+}
+
+void Mac::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  LocalVector<Name> names(isolate);
+  LocalVector<Value> values(isolate);
+#if OPENSSL_WITH_EVP_MAC
+  Environment* env = Environment::GetCurrent(args);
+  SynchronizeMacCache(env);
+  const auto& aliases = env->provider_mac_cache->aliases();
+  names.reserve(aliases.size());
+  values.reserve(aliases.size());
+  for (const auto& [alias, id] : aliases) {
+    names.push_back(OneByteString(isolate, alias));
+    values.push_back(Int32::New(isolate, id));
+  }
+#endif
+  Local<Object> result = Object::New(
+      isolate, Null(isolate), names.data(), values.data(), names.size());
+  args.GetReturnValue().Set(result);
+}
+
+}  // namespace crypto
+}  // namespace node
diff --git a/src/crypto/crypto_mac.h b/src/crypto/crypto_mac.h
new file mode 100644
index 000000000000..3223b1487107
--- /dev/null
+++ b/src/crypto/crypto_mac.h
@@ -0,0 +1,51 @@
+#ifndef SRC_CRYPTO_CRYPTO_MAC_H_
+#define SRC_CRYPTO_CRYPTO_MAC_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "base_object.h"
+#include "crypto/crypto_util.h"
+#include "env.h"
+#include "memory_tracker.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+
+class Mac final : public BaseObject {
+ public:
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(Mac)
+  SET_SELF_SIZE(Mac)
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void MacUpdate(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void MacFinal(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMacs(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCachedAliases(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+#if OPENSSL_WITH_EVP_MAC
+  Mac(Environment* env,
+      v8::Local<v8::Object> wrap,
+      ncrypto::EVPMacCtxPointer&& context,
+      size_t output_size,
+      bool has_output_length);
+  bool MacUpdate(const char* data, size_t length);
+
+  ncrypto::EVPMacCtxPointer context_;
+  size_t output_size_ = 0;
+  bool has_output_length_ = false;
+#else
+  Mac(Environment* env, v8::Local<v8::Object> wrap);
+#endif
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_MAC_H_
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index 15479284933d..f6919221a4f2 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -22,6 +22,7 @@ using ncrypto::EVPKeyPointer;
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 using ncrypto::RSAPointer;
 #endif
+using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
 using v8::FunctionCallbackInfo;
@@ -38,6 +39,23 @@ using v8::Uint32;
 using v8::Value;
 
 namespace crypto {
+namespace {
+constexpr uint32_t kMaxRsaOtherPrimeInfos = 8;
+
+bool IsRsaPssDigestEncodable(const Digest& digest) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const int nid = EVP_MD_type(digest.get());
+  if (nid == NID_undef) return false;
+
+  const ASN1_OBJECT* object = OBJ_nid2obj(nid);
+  return object != nullptr && OBJ_length(object) > 0;
+#else
+  static_cast<void>(digest);
+  return true;
+#endif
+}
+}  // namespace
+
 EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
   auto ctx = EVPKeyCtxPointer::NewFromID(
       params->params.variant == kKeyVariantRSA_PSS ? EVP_PKEY_RSA_PSS
@@ -58,7 +76,8 @@ EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
   }
 
   if (params->params.variant == kKeyVariantRSA_PSS) {
-    if (params->params.md && !ctx.setRsaPssKeygenMd(params->params.md)) {
+    if (params->params.md && (!IsRsaPssDigestEncodable(params->params.md) ||
+                              !ctx.setRsaPssKeygenMd(params->params.md))) {
       return {};
     }
 
@@ -71,7 +90,8 @@ EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
       mgf1_md = params->params.md;
     }
 
-    if (mgf1_md && !ctx.setRsaPssKeygenMgf1Md(mgf1_md)) {
+    if (mgf1_md && (!IsRsaPssDigestEncodable(mgf1_md) ||
+                    !ctx.setRsaPssKeygenMgf1Md(mgf1_md))) {
       return {};
     }
 
@@ -322,6 +342,29 @@ bool ExportJWKRsaKey(Environment* env,
             .IsNothing()) {
       return false;
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (!other_prime_infos.empty()) {
+      const uint32_t count = static_cast<uint32_t>(other_prime_infos.size());
+      Local<Array> oth = Array::New(env->isolate(), count);
+      for (uint32_t i = 0; i < count; i++) {
+        const auto& info = other_prime_infos[i];
+        Local<Object> item = Object::New(env->isolate());
+        if (SetEncodedValue(env, item, env->jwk_r_string(), info.r)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_d_string(), info.d)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_t_string(), info.t)
+                .IsNothing() ||
+            !oth->Set(env->context(), i, item).FromMaybe(false)) {
+          return false;
+        }
+      }
+      if (!target->DefineOwnProperty(env->context(), env->jwk_oth_string(), oth)
+               .FromMaybe(false)) {
+        return false;
+      }
+    }
   }
 
   return true;
@@ -331,12 +374,13 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   Local<Value> n_value;
   Local<Value> e_value;
   Local<Value> d_value;
+  Local<Value> oth_value;
 
   if (!jwk->Get(env->context(), env->jwk_n_string()).ToLocal(&n_value) ||
       !jwk->Get(env->context(), env->jwk_e_string()).ToLocal(&e_value) ||
       !jwk->Get(env->context(), env->jwk_d_string()).ToLocal(&d_value) ||
-      !n_value->IsString() ||
-      !e_value->IsString()) {
+      !jwk->Get(env->context(), env->jwk_oth_string()).ToLocal(&oth_value) ||
+      !n_value->IsString() || !e_value->IsString()) {
     THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
     return {};
   }
@@ -347,6 +391,10 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   }
 
   KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
+  if (type == kKeyTypePublic && !oth_value->IsUndefined()) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+    return {};
+  }
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   ncrypto::Rsa rsa_view;
@@ -400,19 +448,79 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
     ByteSource dq = ByteSource::FromEncodedString(env, dq_value.As<String>());
     ByteSource qi = ByteSource::FromEncodedString(env, qi_value.As<String>());
 
-    if (!rsa_view.setPrivateKey(
-            d.ToBN(), q.ToBN(), p.ToBN(), dp.ToBN(), dq.ToBN(), qi.ToBN())) {
+    ncrypto::Rsa::OtherPrimeInfoPointers other_prime_infos;
+    if (!oth_value->IsUndefined()) {
+      if (!oth_value->IsArray()) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+
+      Local<Array> oth = oth_value.As<Array>();
+      const uint32_t length = oth->Length();
+      if (length == 0 || length > kMaxRsaOtherPrimeInfos) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+      other_prime_infos.reserve(length);
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> item_value;
+        Local<Value> r_value;
+        Local<Value> other_d_value;
+        Local<Value> t_value;
+        if (!oth->Get(env->context(), i).ToLocal(&item_value) ||
+            !item_value->IsObject()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        Local<Object> item = item_value.As<Object>();
+        if (!item->Get(env->context(), env->jwk_r_string()).ToLocal(&r_value) ||
+            !item->Get(env->context(), env->jwk_d_string())
+                 .ToLocal(&other_d_value) ||
+            !item->Get(env->context(), env->jwk_t_string()).ToLocal(&t_value) ||
+            !r_value->IsString() || !other_d_value->IsString() ||
+            !t_value->IsString()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        other_prime_infos.push_back({
+            ByteSource::FromEncodedString(env, r_value.As<String>()).ToBN(),
+            ByteSource::FromEncodedString(env, other_d_value.As<String>())
+                .ToBN(),
+            ByteSource::FromEncodedString(env, t_value.As<String>()).ToBN(),
+        });
+      }
+    }
+
+    if (!rsa_view.setPrivateKey(d.ToBN(),
+                                q.ToBN(),
+                                p.ToBN(),
+                                dp.ToBN(),
+                                dq.ToBN(),
+                                qi.ToBN(),
+                                std::move(other_prime_infos))) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
       return {};
     }
 
-    // Verify that n == p * q.
+    // Verify that n is the product of all prime factors.
     const auto& pub = rsa_view.getPublicKey();
     const auto& priv = rsa_view.getPrivateKey();
-    auto pq = BignumPointer::New();
+    auto product = BignumPointer::New();
     BN_CTX* ctx = BN_CTX_new();
-    bool n_valid = ctx && pq && BN_mul(pq.get(), priv.p, priv.q, ctx) == 1 &&
-                   BN_cmp(pq.get(), pub.n) == 0;
+    bool n_valid =
+        ctx && product && BN_mul(product.get(), priv.p, priv.q, ctx) == 1;
+    for (const auto& info : rsa_view.getOtherPrimeInfos()) {
+      auto next = BignumPointer::New();
+      if (!n_valid || !next ||
+          BN_mul(next.get(), product.get(), info.r, ctx) != 1) {
+        n_valid = false;
+        break;
+      }
+      product = std::move(next);
+    }
+    n_valid = n_valid && BN_cmp(product.get(), pub.n) == 0;
     BN_CTX_free(ctx);
     if (!n_valid) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 5a531209e232..14cf5cc8c85d 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -23,6 +23,7 @@
 #include <cstdio>
 #include "async_wrap-inl.h"
 #include "crypto/crypto_bio.h"
+#include "crypto/crypto_client_hello.h"
 #include "crypto/crypto_common.h"
 #include "crypto/crypto_context.h"
 #include "crypto/crypto_util.h"
@@ -104,40 +105,18 @@ SSL_SESSION* GetSessionCallback(
 // The TLS library invokes this before version negotiation and before session
 // or ticket resumption, which makes async session lookup possible. If required
 // the handshake is suspended here and resumed once JS has answered.
-#ifdef OPENSSL_IS_BORINGSSL
-ssl_select_cert_result_t EarlyClientHelloCallback(const SSL_CLIENT_HELLO* ch) {
-  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(ch->ssl));
-  if (!w->should_suspend_for_client_hello()) return ssl_select_cert_success;
-
-  const uint8_t* ext;
-  size_t ext_len;
-  bool has_ticket = SSL_early_callback_ctx_extension_get(
-                        ch, TLSEXT_TYPE_session_ticket, &ext, &ext_len) &&
-                    ext_len > 0;
+ClientHelloResult EarlyClientHelloCallback(const ClientHelloContext& hello) {
+  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(hello.ssl()));
+  if (!w->should_suspend_for_client_hello()) {
+    return ClientHelloResult::kContinue;
+  }
 
-  return w->OnEarlyClientHello(ch->session_id, ch->session_id_len, has_ticket)
-             ? ssl_select_cert_success
-             : ssl_select_cert_retry;
+  auto session_id = hello.session_id();
+  return w->OnEarlyClientHello(
+             session_id.data(), session_id.size(), hello.has_session_ticket())
+             ? ClientHelloResult::kContinue
+             : ClientHelloResult::kRetry;
 }
-#else
-int EarlyClientHelloCallback(SSL* s, int* al, void* arg) {
-  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
-  if (!w->should_suspend_for_client_hello()) return SSL_CLIENT_HELLO_SUCCESS;
-
-  const unsigned char* session_id;
-  size_t session_id_len = SSL_client_hello_get0_session_id(s, &session_id);
-
-  const unsigned char* ext;
-  size_t ext_len;
-  bool has_ticket = SSL_client_hello_get0_ext(
-                        s, TLSEXT_TYPE_session_ticket, &ext, &ext_len) == 1 &&
-                    ext_len > 0;
-
-  return w->OnEarlyClientHello(session_id, session_id_len, has_ticket)
-             ? SSL_CLIENT_HELLO_SUCCESS
-             : SSL_CLIENT_HELLO_RETRY;
-}
-#endif
 
 void KeylogCallback(const SSL* s, const char* line) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
@@ -265,11 +244,13 @@ int SelectALPNCallback(
 
     unsigned int result_int = callback_result.As<Number>()->Value();
 
-    // The callback returns an offset into the given buffer, for the selected
-    // protocol that should be returned. We then set outlen & out to point
-    // to the selected input length & value directly:
-    *outlen = *(in + result_int);
-    *out = (in + result_int + 1);
+    // The callback returns an offset into the given buffer, at which the
+    // selected protocol sits in ALPN wire format: a length byte followed by
+    // that many name bytes.
+    SetSelectedProtocol(
+        out,
+        outlen,
+        {reinterpret_cast<const char*>(in + result_int + 1), in[result_int]});
 
     return SSL_TLSEXT_ERR_OK;
   }
@@ -278,20 +259,20 @@ int SelectALPNCallback(
 
   if (alpn_protos.empty()) return SSL_TLSEXT_ERR_NOACK;
 
-  int status = SSL_select_next_proto(const_cast<unsigned char**>(out),
-                                     outlen,
-                                     alpn_protos.data(),
-                                     alpn_protos.size(),
-                                     in,
-                                     inlen);
+  const std::span<const uint8_t> supported{alpn_protos.data(),
+                                           alpn_protos.size()};
+  const std::span<const uint8_t> offered{in, inlen};
+  auto selected = SelectNextProtocol(supported, offered);
 
   // Previous versions of Node.js returned SSL_TLSEXT_ERR_NOACK if no protocol
   // match was found. This would neither cause a fatal alert nor would it result
   // in a useful ALPN response as part of the Server Hello message.
   // We now return SSL_TLSEXT_ERR_ALERT_FATAL in that case as per Section 3.2
   // of RFC 7301, which causes a fatal no_application_protocol alert.
-  return status == OPENSSL_NPN_NEGOTIATED ? SSL_TLSEXT_ERR_OK
-                                          : SSL_TLSEXT_ERR_ALERT_FATAL;
+  if (!selected.has_value()) return SSL_TLSEXT_ERR_ALERT_FATAL;
+
+  SetSelectedProtocol(out, outlen, *selected);
+  return SSL_TLSEXT_ERR_OK;
 }
 
 MaybeLocal<Value> GetSSLOCSPResponse(Environment* env, SSL* ssl) {
@@ -410,7 +391,7 @@ TLSWrap::TLSWrap(Environment* env,
   ssl_ = sc_->CreateSSL();
   CHECK(ssl_);
 
-  sc_->SetClientHelloCallback(EarlyClientHelloCallback);
+  SetClientHelloCallback<EarlyClientHelloCallback>(sc_->ctx().get());
   sc_->SetGetSessionCallback(GetSessionCallback);
   sc_->SetNewSessionCallback(NewSessionCallback);
 
@@ -1765,6 +1746,13 @@ void TLSWrap::GetPeerX509Certificate(const FunctionCallbackInfo<Value>& args) {
     args.GetReturnValue().Set(ret);
 }
 
+void TLSWrap::HasPeerCertificate(const FunctionCallbackInfo<Value>& args) {
+  TLSWrap* w;
+  ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
+  bool has_peer_cert = static_cast<bool>(X509Pointer::PeerFrom(w->ssl_));
+  args.GetReturnValue().Set(has_peer_cert);
+}
+
 void TLSWrap::GetCertificate(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
@@ -2288,6 +2276,8 @@ void TLSWrap::Initialize(
       isolate, t, "getPeerCertificate", GetPeerCertificate);
   SetProtoMethodNoSideEffect(
       isolate, t, "getPeerX509Certificate", GetPeerX509Certificate);
+  SetProtoMethodNoSideEffect(
+      isolate, t, "hasPeerCertificate", HasPeerCertificate);
   SetProtoMethodNoSideEffect(isolate, t, "getPeerFinished", GetPeerFinished);
   SetProtoMethodNoSideEffect(isolate, t, "getProtocol", GetProtocol);
   SetProtoMethodNoSideEffect(isolate, t, "getSession", GetSession);
@@ -2347,6 +2337,7 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetFinished);
   registry->Register(GetPeerCertificate);
   registry->Register(GetPeerX509Certificate);
+  registry->Register(HasPeerCertificate);
   registry->Register(GetPeerFinished);
   registry->Register(GetProtocol);
   registry->Register(GetSession);
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 9a5f59ed472e..2d3ccef24fac 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -229,6 +229,8 @@ class TLSWrap : public AsyncWrap,
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerX509Certificate(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void HasPeerCertificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerFinished(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/src/crypto/crypto_tls_certificates.cc b/src/crypto/crypto_tls_certificates.cc
new file mode 100644
index 000000000000..ace1d41aefec
--- /dev/null
+++ b/src/crypto/crypto_tls_certificates.cc
@@ -0,0 +1,96 @@
+#include "crypto/crypto_tls_certificates.h"
+
+#include "crypto/crypto_context.h"
+#include "crypto/crypto_keys.h"
+#include "crypto/crypto_util.h"
+
+namespace node::crypto {
+
+using ncrypto::DeleteFnPtr;
+using ncrypto::EVPKeyPointer;
+using ncrypto::X509Pointer;
+
+X509_STORE* GetOrCreateOwnedCertStore(Environment* env,
+                                      SSL_CTX* ctx,
+                                      X509_STORE** cache) {
+  if (cache != nullptr && *cache != nullptr) return *cache;
+
+  X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx);
+  if (cert_store == GetOrCreateRootCertStore(env)) {
+    cert_store = NewRootCertStore(env);
+    SSL_CTX_set_cert_store(ctx, cert_store);
+  }
+
+  if (cache != nullptr) *cache = cert_store;
+  return cert_store;
+}
+
+void UseDefaultRootCertStore(Environment* env, SSL_CTX* ctx) {
+  X509_STORE* store = GetOrCreateRootCertStore(env);
+
+  // Increment reference count so global store is not deleted along with CTX.
+  X509_STORE_up_ref(store);
+  SSL_CTX_set_cert_store(ctx, store);
+}
+
+size_t AddCACertificates(Environment* env,
+                         SSL_CTX* ctx,
+                         const ncrypto::BIOPointer& bio,
+                         X509_STORE** cache) {
+  if (!bio) return 0;
+
+  size_t count = 0;
+  while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX(
+             bio.get(), nullptr, NoPasswordCallback, nullptr))) {
+    CHECK_EQ(1,
+             X509_STORE_add_cert(GetOrCreateOwnedCertStore(env, ctx, cache),
+                                 x509.get()));
+    CHECK_EQ(1, SSL_CTX_add_client_CA(ctx, x509.get()));
+    count++;
+  }
+  return count;
+}
+
+bool AddCRL(Environment* env,
+            SSL_CTX* ctx,
+            const ncrypto::BIOPointer& bio,
+            X509_STORE** cache) {
+  if (!bio) return false;
+
+  DeleteFnPtr<X509_CRL, X509_CRL_free> crl(
+      PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));
+  if (!crl) return false;
+
+  X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache);
+  CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
+  CHECK_EQ(1,
+           X509_STORE_set_flags(
+               cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
+  return true;
+}
+
+PrivateKeyResult UsePrivateKey(SSL_CTX* ctx,
+                               const ncrypto::BIOPointer& bio,
+                               const ByteSource* passphrase) {
+  if (!bio) return PrivateKeyResult::kParseError;
+
+  ByteSource empty_passphrase;
+  if (passphrase == nullptr) passphrase = &empty_passphrase;
+  // This redirection is necessary because the PasswordCallback expects a
+  // pointer to a pointer to the passphrase ByteSource to allow passing in
+  // const ByteSources.
+  const ByteSource* pass_ptr = passphrase;
+  EVPKeyPointer key(
+      PEM_read_bio_PrivateKey(bio.get(), nullptr, PasswordCallback, &pass_ptr));
+  if (!key) return PrivateKeyResult::kParseError;
+  if (!SSL_CTX_use_PrivateKey(ctx, key.get()))
+    return PrivateKeyResult::kApplyError;
+  return PrivateKeyResult::kSuccess;
+}
+
+bool UsePrivateKey(SSL_CTX* ctx, const KeyObjectData& key) {
+  if (key.GetKeyType() != KeyType::kKeyTypePrivate) return false;
+  return SSL_CTX_use_PrivateKey(ctx, key.GetAsymmetricKey().get());
+}
+
+}  // namespace node::crypto
diff --git a/src/crypto/crypto_tls_certificates.h b/src/crypto/crypto_tls_certificates.h
new file mode 100644
index 000000000000..e36a583e6d4b
--- /dev/null
+++ b/src/crypto/crypto_tls_certificates.h
@@ -0,0 +1,60 @@
+#ifndef SRC_CRYPTO_CRYPTO_TLS_CERTIFICATES_H_
+#define SRC_CRYPTO_CRYPTO_TLS_CERTIFICATES_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "ncrypto.h"
+
+namespace node {
+
+class Environment;
+
+namespace crypto {
+
+class ByteSource;
+class KeyObjectData;
+
+// Return a store that may be modified by this SSL_CTX. If the context uses
+// Node's shared root store, replace it with a private copy first.
+X509_STORE* GetOrCreateOwnedCertStore(Environment* env,
+                                      SSL_CTX* ctx,
+                                      X509_STORE** cache = nullptr);
+
+// Attach Node's process-wide default root store to the SSL_CTX.
+void UseDefaultRootCertStore(Environment* env, SSL_CTX* ctx);
+
+// Add every PEM certificate in |bio| to the context's certificate store and
+// acceptable-client-CA list. Returns the number of certificates read.
+size_t AddCACertificates(Environment* env,
+                         SSL_CTX* ctx,
+                         const ncrypto::BIOPointer& bio,
+                         X509_STORE** cache = nullptr);
+
+// Add one PEM CRL and enable CRL checking.
+bool AddCRL(Environment* env,
+            SSL_CTX* ctx,
+            const ncrypto::BIOPointer& bio,
+            X509_STORE** cache = nullptr);
+
+enum class PrivateKeyResult {
+  kSuccess,
+  kParseError,
+  kApplyError,
+};
+
+PrivateKeyResult UsePrivateKey(SSL_CTX* ctx,
+                               const ncrypto::BIOPointer& bio,
+                               const ByteSource* passphrase = nullptr);
+
+bool UsePrivateKey(SSL_CTX* ctx, const KeyObjectData& key);
+
+int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
+                                  ncrypto::BIOPointer&& in,
+                                  ncrypto::X509Pointer* cert,
+                                  ncrypto::X509Pointer* issuer);
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_TLS_CERTIFICATES_H_
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 133a5c7f7f1d..942e00accba9 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -6,18 +6,32 @@
 #include "memory_tracker-inl.h"
 #include "ncrypto.h"
 #include "node_buffer.h"
+#include "node_diagnostics_channel.h"
 #include "node_options-inl.h"
+#include "node_realm-inl.h"
 #include "string_bytes.h"
 #include "threadpoolwork-inl.h"
 #include "util-inl.h"
 #include "v8.h"
 
+#include <atomic>
+#include <deque>
+#include <mutex>
 #include "math.h"
 
 #if OPENSSL_VERSION_MAJOR >= 3
 #include "openssl/provider.h"
 #endif
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+#include <openssl/indicator.h>
+#endif
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+#include <openssl/core_names.h>
+#include <openssl/params.h>
+#endif
+
 namespace node {
 
 using ncrypto::BignumPointer;
@@ -36,6 +50,7 @@ using v8::BackingStoreInitializationMode;
 using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
 using v8::Context;
+using v8::DictionaryTemplate;
 using v8::EscapableHandleScope;
 using v8::Exception;
 using v8::Function;
@@ -76,6 +91,108 @@ size_t MemoryRetainerTraits<crypto::ByteSource>::SelfSize(
 
 namespace crypto {
 
+CShakeOptions::CShakeOptions(CShakeOptions&& other) noexcept
+    : function_name(std::move(other.function_name)),
+      customization(std::move(other.customization)),
+      flags(other.flags) {}
+
+CShakeOptions& CShakeOptions::operator=(CShakeOptions&& other) noexcept {
+  if (&other == this) return *this;
+  this->~CShakeOptions();
+  return *new (this) CShakeOptions(std::move(other));
+}
+
+void CShakeOptions::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("function_name", function_name.size());
+  tracker->TrackFieldWithSize("customization", customization.size());
+}
+
+bool CShakeOptions::Initialize(ncrypto::EVPMDCtxPointer* ctx,
+                               const EVP_MD* digest) const {
+  if (!ctx || !*ctx || digest == nullptr) return false;
+  if (empty()) return ctx->digestInit(digest);
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+  const bool is_cshake =
+      EVP_MD_is_a(digest, "CSHAKE-128") || EVP_MD_is_a(digest, "CSHAKE-256");
+  if (!is_cshake) return false;
+
+  OSSL_PARAM params[3];
+  size_t count = 0;
+  if (has(kFunctionName)) {
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_FUNCTION_NAME,
+        const_cast<char*>(function_name.c_str()),
+        function_name.size());
+  }
+  if (has(kCustomization)) {
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_CUSTOMIZATION,
+        const_cast<char*>(customization.c_str()),
+        customization.size());
+  }
+  params[count] = OSSL_PARAM_construct_end();
+  return ctx->digestInit(digest, params);
+#else
+  return false;
+#endif
+}
+
+namespace {
+bool ContainsNullByte(std::string_view value) {
+  return value.find('\0') != std::string_view::npos;
+}
+
+v8::Maybe<void> GetDigestStringOption(
+    Environment* env,
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions::Flag flag,
+    std::string* target,
+    CShakeOptions* options) {
+  if (args[offset]->IsUndefined()) return v8::JustVoid();
+  CHECK(IsAnyBufferSource(args[offset]));
+  ArrayBufferOrViewContents<char> value(args[offset]);
+  if (!value.CheckSizeInt32()) {
+    THROW_ERR_OUT_OF_RANGE(env, "digest option is too big");
+    return v8::Nothing<void>();
+  }
+  target->assign(value.data(), value.size());
+  if (ContainsNullByte(*target)) {
+    THROW_ERR_INVALID_ARG_VALUE(env,
+                                "Digest options must not contain null bytes");
+    return v8::Nothing<void>();
+  }
+  options->flags |= flag;
+  return v8::JustVoid();
+}
+}  // namespace
+
+v8::Maybe<void> GetCShakeOptions(
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions* options) {
+  Environment* env = Environment::GetCurrent(args);
+  if (GetDigestStringOption(env,
+                            args,
+                            offset,
+                            CShakeOptions::kFunctionName,
+                            &options->function_name,
+                            options)
+          .IsNothing() ||
+      GetDigestStringOption(env,
+                            args,
+                            offset + 1,
+                            CShakeOptions::kCustomization,
+                            &options->customization,
+                            options)
+          .IsNothing()) {
+    return v8::Nothing<void>();
+  }
+
+  return v8::JustVoid();
+}
+
 int PasswordCallback(char* buf, int size, int rwflag, void* u) {
   const ByteSource* passphrase = *static_cast<const ByteSource**>(u);
   if (passphrase != nullptr) {
@@ -99,6 +216,238 @@ int NoPasswordCallback(char* buf, int size, int rwflag, void* u) {
   return 0;
 }
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+namespace {
+
+constexpr size_t kMaxPendingFipsIndicatorEvents = 256;
+constexpr std::string_view kFipsIndicatorChannel = "crypto.fips.indicator";
+
+struct FipsIndicatorEvent {
+  std::string operation;
+  std::string reason;
+  bool blocked;
+  uint32_t count = 1;
+  uint32_t dropped = 0;
+};
+
+Local<DictionaryTemplate> GetFipsIndicatorEventTemplate(Environment* env) {
+  auto tmpl = env->fips_indicator_event_template();
+  if (tmpl.IsEmpty()) {
+    static constexpr std::string_view names[] = {
+        "operation",
+        "reason",
+        "blocked",
+        "count",
+        "dropped",
+    };
+    tmpl = DictionaryTemplate::New(env->isolate(), names);
+    env->set_fips_indicator_event_template(tmpl);
+  }
+  return tmpl;
+}
+
+class FipsIndicatorState final {
+ public:
+  static FipsIndicatorState& Get() {
+    static FipsIndicatorState state;
+    return state;
+  }
+
+  void Install() {
+    reject_unapproved_.store(
+        per_process::cli_options->force_fips_crypto &&
+            per_process::cli_options->force_fips_crypto_policy == "strict",
+        std::memory_order_release);
+    std::call_once(install_once_, [this]() {
+      OSSL_INDICATOR_get_callback(nullptr, &previous_callback_);
+      OSSL_INDICATOR_set_callback(nullptr, OnOpenSSLIndicator);
+    });
+  }
+
+  void Setup(Environment* env) {
+    CHECK(env->owns_process_state());
+    auto channel =
+        diagnostics_channel::Channel::Get(env, kFipsIndicatorChannel);
+    if (!channel) return;
+
+    Realm* realm = env->principal_realm();
+    auto* binding = realm->GetBindingData<diagnostics_channel::BindingData>();
+    CHECK_NOT_NULL(binding);
+    const uint32_t index =
+        binding->GetOrCreateChannelIndex(std::string(kFipsIndicatorChannel));
+
+    {
+      Mutex::ScopedLock lock(mutex_);
+      CHECK_NULL(env_);
+      env_ = env;
+      channel_ = channel;
+    }
+    env->AddCleanupHook(Cleanup, this);
+    binding->SetChannelStatusCallback(
+        index, [this](bool active) { SetActive(active); });
+    SetActive(channel->HasSubscribers());
+  }
+
+ private:
+  void SetActive(bool active) {
+    subscription_generation_++;
+    active_.store(active, std::memory_order_release);
+    if (active) return;
+
+    {
+      Mutex::ScopedLock lock(mutex_);
+      events_.clear();
+      dropped_events_ = 0;
+    }
+  }
+
+  static int OnOpenSSLIndicator(const char* operation,
+                                const char* reason,
+                                const OSSL_PARAM* params) {
+    return Get().OnIndicator(operation, reason, params);
+  }
+
+  static void Cleanup(void* data) {
+    static_cast<FipsIndicatorState*>(data)->CleanupEnvironment();
+  }
+
+  int OnIndicator(const char* operation,
+                  const char* reason,
+                  const OSSL_PARAM* params) {
+    const int previous_result =
+        previous_callback_ == nullptr
+            ? 1
+            : previous_callback_(operation, reason, params);
+    const int result = reject_unapproved_.load(std::memory_order_acquire)
+                           ? 0
+                           : previous_result;
+    if (!active_.load(std::memory_order_acquire)) return result;
+
+    const bool blocked = result == 0;
+    {
+      Mutex::ScopedLock lock(mutex_);
+      if (env_ != nullptr && active_.load(std::memory_order_relaxed)) {
+        const std::string operation_string =
+            operation == nullptr ? "" : operation;
+        const std::string reason_string = reason == nullptr ? "" : reason;
+        const auto existing = std::find_if(
+            events_.begin(),
+            events_.end(),
+            [&](const FipsIndicatorEvent& event) {
+              return event.operation == operation_string &&
+                     event.reason == reason_string && event.blocked == blocked;
+            });
+        if (existing == events_.end()) {
+          if (events_.size() < kMaxPendingFipsIndicatorEvents) {
+            events_.push_back({operation_string, reason_string, blocked});
+          } else if (dropped_events_ != UINT32_MAX) {
+            dropped_events_++;
+          }
+        } else if (existing->count != UINT32_MAX) {
+          existing->count++;
+        } else if (dropped_events_ != UINT32_MAX) {
+          dropped_events_++;
+        }
+        if (!dispatch_scheduled_) {
+          dispatch_scheduled_ = true;
+          env_->SetImmediateThreadsafe(
+              [](Environment* env) { Get().Drain(env); },
+              CallbackFlags::kUnrefed);
+        }
+      }
+    }
+    return result;
+  }
+
+  void Drain(Environment* env) {
+    CHECK(env->owns_process_state());
+    std::deque<FipsIndicatorEvent> events;
+    {
+      Mutex::ScopedLock lock(mutex_);
+      if (env_ != env) return;
+      events.swap(events_);
+      if (!events.empty()) events.front().dropped = dropped_events_;
+      dropped_events_ = 0;
+      dispatch_scheduled_ = false;
+    }
+    if (events.empty() || !channel_ || !channel_->HasSubscribers()) return;
+
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Local<Context> context = env->context();
+    const uint64_t subscription_generation = subscription_generation_;
+    for (const auto& event : events) {
+      if (subscription_generation_ != subscription_generation) return;
+      MaybeLocal<Value> values[] = {
+          OneByteString(isolate, event.operation),
+          OneByteString(isolate, event.reason),
+          v8::Boolean::New(isolate, event.blocked),
+          Uint32::New(isolate, event.count),
+          Uint32::New(isolate, event.dropped),
+      };
+      Local<Object> value;
+      if (!NewDictionaryInstance(
+               context, GetFipsIndicatorEventTemplate(env), values)
+               .ToLocal(&value)) {
+        return;
+      }
+      channel_->Publish(env, value);
+      if (subscription_generation_ != subscription_generation) return;
+    }
+  }
+
+  void CleanupEnvironment() {
+    subscription_generation_++;
+    active_.store(false, std::memory_order_release);
+    {
+      Mutex::ScopedLock lock(mutex_);
+      env_ = nullptr;
+      channel_.reset();
+      events_.clear();
+      dropped_events_ = 0;
+      dispatch_scheduled_ = false;
+    }
+  }
+
+  std::once_flag install_once_;
+  std::atomic<bool> active_{false};
+  std::atomic<bool> reject_unapproved_{false};
+  OSSL_INDICATOR_CALLBACK* previous_callback_ = nullptr;
+  Mutex mutex_;
+  Environment* env_ = nullptr;
+  BaseObjectPtr<diagnostics_channel::Channel> channel_;
+  std::deque<FipsIndicatorEvent> events_;
+  uint32_t dropped_events_ = 0;
+  bool dispatch_scheduled_ = false;
+  uint64_t subscription_generation_ = 0;
+};
+
+}  // namespace
+#endif
+
+void InstallFipsIndicatorCallback() {
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+  const auto& options = per_process::cli_options;
+  const bool strict = options->force_fips_crypto &&
+                      options->force_fips_crypto_policy == "strict";
+  if (options->enable_fips_indicator_events || strict) {
+    FipsIndicatorState::Get().Install();
+  }
+#endif
+}
+
+void SetupFipsIndicatorChannel(const FunctionCallbackInfo<Value>& args) {
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+  Environment* env = Environment::GetCurrent(args);
+  if (env->owns_process_state() &&
+      per_process::cli_options->enable_fips_indicator_events) {
+    FipsIndicatorState::Get().Setup(env);
+  }
+#else
+  USE(args);
+#endif
+}
+
 std::optional<std::string> ProcessFipsOptions() {
   const bool enable_fips = per_process::cli_options->enable_fips_crypto;
   const bool force_fips = per_process::cli_options->force_fips_crypto;
@@ -156,6 +505,7 @@ void InitCryptoOnce() {
   Mutex::ScopedLock fips_lock(fips_mutex);
 #ifndef OPENSSL_IS_BORINGSSL
   OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+  CHECK_NOT_NULL(settings);
 
 #if OPENSSL_VERSION_MAJOR < 3
   // --openssl-config=...
@@ -176,6 +526,7 @@ void InitCryptoOnce() {
 #endif
 
   OPENSSL_init_ssl(0, settings);
+  InstallFipsIndicatorCallback();
 
 #if OPENSSL_WITH_OPENSSL_PQC
   // Configure all loaded providers to prefer seed-only format for ML-KEM and
@@ -231,6 +582,11 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(IsFipsEnabled() ? 1 : 0);
 }
 
+void GetFipsCryptoGeneration(const FunctionCallbackInfo<Value>& args) {
+  args.GetReturnValue().Set(BigInt::NewFromUnsigned(
+      args.GetIsolate(), ncrypto::getFipsStateGeneration()));
+}
+
 void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
   Mutex::ScopedLock fips_lock(fips_mutex);
@@ -891,6 +1247,10 @@ void Initialize(Environment* env, Local<Object> target) {
 #endif  // !OPENSSL_NO_ENGINE
 
   SetMethodNoSideEffect(context, target, "getFipsCrypto", GetFipsCrypto);
+  SetMethodNoSideEffect(
+      context, target, "getFipsCryptoGeneration", GetFipsCryptoGeneration);
+  SetMethod(
+      context, target, "setupFipsIndicatorChannel", SetupFipsIndicatorChannel);
   SetMethod(context, target, "setFipsCrypto", SetFipsCrypto);
   SetMethodNoSideEffect(context, target, "testFipsCrypto", TestFipsCrypto);
 
@@ -910,6 +1270,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #endif  // !OPENSSL_NO_ENGINE
 
   registry->Register(GetFipsCrypto);
+  registry->Register(GetFipsCryptoGeneration);
+  registry->Register(SetupFipsIndicatorChannel);
   registry->Register(SetFipsCrypto);
   registry->Register(TestFipsCrypto);
   registry->Register(SecureBuffer);
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index c74a6e7fd507..aafdd3bf273b 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -50,6 +50,7 @@ namespace node::crypto {
 constexpr size_t kSizeOf_DH = 144;
 constexpr size_t kSizeOf_EC_KEY = 80;
 constexpr size_t kSizeOf_EVP_CIPHER_CTX = 168;
+constexpr size_t kSizeOf_EVP_MAC_CTX = 16;
 constexpr size_t kSizeOf_EVP_MD_CTX = 48;
 constexpr size_t kSizeOf_EVP_PKEY = 72;
 constexpr size_t kSizeOf_EVP_PKEY_CTX = 80;
@@ -67,6 +68,7 @@ constexpr T NumBitsToBytes(T bits) {
 // options were applied successfully.
 std::optional<std::string> ProcessFipsOptions();
 bool IsFipsEnabled();
+void InstallFipsIndicatorCallback();
 
 bool InitCryptoOnce(v8::Isolate* isolate);
 void InitCryptoOnce();
@@ -286,6 +288,35 @@ enum CryptoJobMode { kCryptoJobAsync, kCryptoJobSync, kCryptoJobWebCrypto };
 CryptoJobMode GetCryptoJobMode(v8::Local<v8::Value> args);
 bool IsCryptoJobAsync(CryptoJobMode mode);
 
+struct CShakeOptions final : public MemoryRetainer {
+  enum Flag : uint8_t {
+    kFunctionName = 1 << 0,
+    kCustomization = 1 << 1,
+  };
+
+  std::string function_name;
+  std::string customization;
+  uint8_t flags = 0;
+
+  CShakeOptions() = default;
+  CShakeOptions(CShakeOptions&& other) noexcept;
+  CShakeOptions& operator=(CShakeOptions&& other) noexcept;
+
+  bool empty() const { return flags == 0; }
+  bool has(Flag flag) const { return (flags & flag) != 0; }
+
+  bool Initialize(ncrypto::EVPMDCtxPointer* ctx, const EVP_MD* digest) const;
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(CShakeOptions)
+  SET_SELF_SIZE(CShakeOptions)
+};
+
+v8::Maybe<void> GetCShakeOptions(
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions* options);
+
 v8::MaybeLocal<v8::Value> CreateWebCryptoJobError(Environment* env,
                                                   v8::Local<v8::Value> cause);
 
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index 6ed7d7d25db0..b81141e1a915 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -807,7 +807,7 @@ Local<FunctionTemplate> X509Certificate::GetConstructorTemplate(
   Local<FunctionTemplate> tmpl = env->x509_constructor_template();
   if (tmpl.IsEmpty()) {
     Isolate* isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, nullptr);
+    tmpl = NewFunctionTemplate(isolate, NewFromHandle);
     tmpl->InstanceTemplate()->SetInternalFieldCount(
         X509Certificate::kInternalFieldCount);
     tmpl->SetClassName(
@@ -850,43 +850,118 @@ Local<FunctionTemplate> X509Certificate::GetConstructorTemplate(
   return tmpl;
 }
 
-bool X509Certificate::HasInstance(Environment* env, Local<Object> object) {
-  return GetConstructorTemplate(env)->HasInstance(object);
+bool X509Certificate::HasInstance(Environment* env, Local<Value> value) {
+  return GetConstructorTemplate(env)->HasInstance(value);
+}
+
+void X509Certificate::NewFromHandle(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (args.Length() == 1 && args[0]->IsArrayBufferView()) {
+    ArrayBufferViewContents<unsigned char> buf(args[0].As<ArrayBufferView>());
+    auto result = X509Pointer::Parse(ncrypto::Buffer<const unsigned char>{
+        .data = buf.data(),
+        .len = buf.length(),
+    });
+    if (!result.value) [[unlikely]] {
+      return ThrowCryptoError(env, result.error.value_or(0));
+    }
+    new X509Certificate(env,
+                        args.This(),
+                        std::make_shared<ManagedX509>(std::move(result.value)));
+    return;
+  }
+
+  if (args.Length() != 1 || !HasInstance(env, args[0])) {
+    THROW_ERR_INVALID_ARG_TYPE(
+        env, "value must be an X509CertificateHandle or BufferSource");
+    return;
+  }
+
+  X509Certificate* handle = Unwrap<X509Certificate>(args[0].As<Object>());
+  CHECK_NOT_NULL(handle);
+  Local<Object> issuer;
+  if (handle->issuer_cert_) issuer = handle->issuer_cert_->object();
+  new X509Certificate(env, args.This(), handle->cert_, issuer);
+}
+
+void X509Certificate::CreateX509CertificateClass(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  CHECK(args[0]->IsFunction());
+
+  Local<Value> ctor;
+  if (!GetConstructorTemplate(env)->GetFunction(env->context()).ToLocal(&ctor))
+    return;
+
+  Local<Value> ret;
+  if (!args[0]
+           .As<Function>()
+           ->Call(env->context(), Undefined(env->isolate()), 1, &ctor)
+           .ToLocal(&ret)) {
+    return;
+  }
+
+  Local<Array> constructors = ret.As<Array>();
+  Local<Value> internal_ctor;
+  if (!constructors->Get(env->context(), 1).ToLocal(&internal_ctor)) return;
+  CHECK(env->crypto_internal_x509_certificate_constructor().IsEmpty());
+  env->set_crypto_internal_x509_certificate_constructor(
+      internal_ctor.As<Function>());
+  args.GetReturnValue().Set(constructors);
+}
+
+void X509Certificate::IsX509Certificate(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
 }
 
 MaybeLocal<Object> X509Certificate::New(Environment* env,
                                         X509Pointer cert,
-                                        STACK_OF(X509) * issuer_chain) {
+                                        const STACK_OF(X509) * issuer_chain) {
   std::shared_ptr<ManagedX509> mcert(new ManagedX509(std::move(cert)));
   return New(env, std::move(mcert), issuer_chain);
 }
 
 MaybeLocal<Object> X509Certificate::New(Environment* env,
                                         std::shared_ptr<ManagedX509> cert,
-                                        STACK_OF(X509) * issuer_chain) {
-  EscapableHandleScope scope(env->isolate());
-  Local<Function> ctor;
-  if (!GetConstructorTemplate(env)->GetFunction(env->context()).ToLocal(&ctor))
-    return MaybeLocal<Object>();
+                                        const STACK_OF(X509) * issuer_chain) {
+  return NewWithIssuers(env, std::move(cert), issuer_chain, 0);
+}
 
+MaybeLocal<Object> X509Certificate::NewWithIssuers(
+    Environment* env,
+    std::shared_ptr<ManagedX509> cert,
+    const STACK_OF(X509) * issuer_chain,
+    int start) {
+  EscapableHandleScope scope(env->isolate());
   Local<Object> obj;
-  if (!ctor->NewInstance(env->context()).ToLocal(&obj))
+  if (!GetConstructorTemplate(env)
+           ->InstanceTemplate()
+           ->NewInstance(env->context())
+           .ToLocal(&obj)) {
     return MaybeLocal<Object>();
+  }
 
-  Local<Object> issuer_chain_obj;
-  if (issuer_chain != nullptr && sk_X509_num(issuer_chain)) {
-    X509Pointer cert(X509_dup(sk_X509_value(issuer_chain, 0)));
-    sk_X509_delete(issuer_chain, 0);
-    auto maybeObj =
-        sk_X509_num(issuer_chain)
-            ? X509Certificate::New(env, std::move(cert), issuer_chain)
-            : X509Certificate::New(env, std::move(cert));
-    if (!maybeObj.ToLocal(&issuer_chain_obj)) [[unlikely]] {
+  Local<Object> issuer;
+  if (issuer_chain != nullptr && start < sk_X509_num(issuer_chain)) {
+    X509Pointer issuer_cert =
+        X509View(sk_X509_value(issuer_chain, start)).clone();
+    if (!issuer_cert) [[unlikely]] {
+      return MaybeLocal<Object>();
+    }
+    if (!NewWithIssuers(env,
+                        std::make_shared<ManagedX509>(std::move(issuer_cert)),
+                        issuer_chain,
+                        start + 1)
+             .ToLocal(&issuer)) [[unlikely]] {
       return MaybeLocal<Object>();
     }
   }
 
-  new X509Certificate(env, obj, std::move(cert), issuer_chain_obj);
+  new X509Certificate(env, obj, std::move(cert), issuer);
   return scope.Escape(obj);
 }
 
@@ -903,23 +978,29 @@ MaybeLocal<Object> X509Certificate::GetPeerCert(Environment* env,
                                                 GetPeerCertificateFlag flag) {
   ClearErrorOnReturn clear_error_on_return;
 
+  // The peer chain is owned by the SSL session and must not be modified. Its
+  // first entry is the peer certificate on the client but not on the server.
+  const STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(ssl.get());
+  int issuers_start = 0;
+
   X509Pointer cert;
   if ((flag & GetPeerCertificateFlag::SERVER) ==
       GetPeerCertificateFlag::SERVER) {
     cert = X509Pointer::PeerFrom(ssl);
   }
-
-  STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(ssl.get());
-  if (!cert && (ssl_certs == nullptr || sk_X509_num(ssl_certs) == 0))
-    return MaybeLocal<Object>();
-
-  if (!cert) [[unlikely]] {
-    cert.reset(sk_X509_value(ssl_certs, 0));
-    sk_X509_delete(ssl_certs, 0);
+  if (!cert) {
+    if (ssl_certs == nullptr || sk_X509_num(ssl_certs) == 0)
+      return MaybeLocal<Object>();
+    cert = X509View(sk_X509_value(ssl_certs, 0)).clone();
+    if (!cert) [[unlikely]]
+      return MaybeLocal<Object>();
+    issuers_start = 1;
   }
 
-  return sk_X509_num(ssl_certs) ? New(env, std::move(cert), ssl_certs)
-                                : New(env, std::move(cert));
+  return NewWithIssuers(env,
+                        std::make_shared<ManagedX509>(std::move(cert)),
+                        ssl_certs,
+                        issuers_start);
 }
 
 v8::MaybeLocal<v8::Value> X509Certificate::toObject(Environment* env) {
@@ -963,11 +1044,31 @@ X509Certificate::X509CertificateTransferData::Deserialize(
   if (!X509Certificate::New(env, data_).ToLocal(&handle))
     return {};
 
-  return BaseObjectPtr<BaseObject>(
-      Unwrap<X509Certificate>(handle.As<Object>()));
+  Local<Value> module =
+      FIXED_ONE_BYTE_STRING(env->isolate(), "internal/crypto/x509");
+  if (env->builtin_module_require()
+          ->Call(context, Null(env->isolate()), 1, &module)
+          .IsEmpty()) {
+    return {};
+  }
+
+  Local<Function> ctor = env->crypto_internal_x509_certificate_constructor();
+  CHECK(!ctor.IsEmpty());
+  Local<Value> cert;
+  if (!ctor->NewInstance(context, 1, &handle).ToLocal(&cert)) return {};
+
+  return BaseObjectPtr<BaseObject>(Unwrap<X509Certificate>(cert.As<Object>()));
 }
 
 BaseObject::TransferMode X509Certificate::GetTransferMode() const {
+  Local<Value> transfer_mode =
+      object()
+          ->GetPrivate(env()->context(), env()->transfer_mode_private_symbol())
+          .ToLocalChecked();
+  if (transfer_mode->IsUint32() &&
+      (transfer_mode.As<Uint32>()->Value() & TransferMode::kCloneable) == 0) {
+    return BaseObject::TransferMode::kDisallowCloneAndTransfer;
+  }
   return BaseObject::TransferMode::kCloneable;
 }
 
@@ -977,6 +1078,12 @@ std::unique_ptr<worker::TransferData> X509Certificate::CloneForMessaging()
 }
 
 void X509Certificate::Initialize(Environment* env, Local<Object> target) {
+  SetMethod(env->context(),
+            target,
+            "createX509CertificateClass",
+            CreateX509CertificateClass);
+  SetMethodNoSideEffect(
+      env->context(), target, "isX509Certificate", IsX509Certificate);
   SetMethod(env->context(), target, "parseX509", Parse);
 
   NODE_DEFINE_CONSTANT(target, X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT);
@@ -989,6 +1096,9 @@ void X509Certificate::Initialize(Environment* env, Local<Object> target) {
 
 void X509Certificate::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
+  registry->Register(CreateX509CertificateClass);
+  registry->Register(IsX509Certificate);
+  registry->Register(NewFromHandle);
   registry->Register(Parse);
   registry->Register(Subject);
   registry->Register(SubjectAltName);
diff --git a/src/crypto/crypto_x509.h b/src/crypto/crypto_x509.h
index c94e832a2845..a6f64d4f2d4f 100644
--- a/src/crypto/crypto_x509.h
+++ b/src/crypto/crypto_x509.h
@@ -49,17 +49,23 @@ class X509Certificate final : public BaseObject {
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
   static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
       Environment* env);
-  static bool HasInstance(Environment* env, v8::Local<v8::Object> object);
+  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
+
+  static void CreateX509CertificateClass(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsX509Certificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void NewFromHandle(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Object> New(
       Environment* env,
       ncrypto::X509Pointer cert,
-      STACK_OF(X509) * issuer_chain = nullptr);
+      const STACK_OF(X509) * issuer_chain = nullptr);
 
   static v8::MaybeLocal<v8::Object> New(
       Environment* env,
       std::shared_ptr<ManagedX509> cert,
-      STACK_OF(X509)* issuer_chain = nullptr);
+      const STACK_OF(X509) * issuer_chain = nullptr);
 
   static v8::MaybeLocal<v8::Object> GetCert(Environment* env,
                                             const ncrypto::SSLPointer& ssl);
@@ -115,6 +121,13 @@ class X509Certificate final : public BaseObject {
                   std::shared_ptr<ManagedX509> cert,
                   v8::Local<v8::Object> issuer_chain = v8::Local<v8::Object>());
 
+  // Like New(), but reads the issuer chain from issuer_chain[start] upward.
+  static v8::MaybeLocal<v8::Object> NewWithIssuers(
+      Environment* env,
+      std::shared_ptr<ManagedX509> cert,
+      const STACK_OF(X509) * issuer_chain,
+      int start);
+
   std::shared_ptr<ManagedX509> cert_;
   BaseObjectPtr<X509Certificate> issuer_cert_;
 };
diff --git a/src/dataqueue/queue.cc b/src/dataqueue/queue.cc
index 8516362b7a87..cef5f4456b3a 100644
--- a/src/dataqueue/queue.cc
+++ b/src/dataqueue/queue.cc
@@ -174,14 +174,35 @@ class DataQueueImpl final : public DataQueue,
     backpressure_listeners_.erase(listener);
   }
 
+  // Both notifications below can re-enter this DataQueue: a listener may end
+  // up calling into JavaScript, which can destroy the owner of a listener and
+  // so mutate backpressure_listeners_ (or drop the last reference to this
+  // queue) while we are iterating. Hold a reference, iterate a snapshot, and
+  // re-check membership so a listener removed mid-notification is not called.
   void NotifyBackpressure(size_t amount) {
     if (idempotent_) return;
-    for (auto& listener : backpressure_listeners_) listener->EntryRead(amount);
+    if (backpressure_listeners_.empty()) return;
+    auto self = shared_from_this();
+    std::vector<BackpressureListener*> listeners(
+        backpressure_listeners_.begin(), backpressure_listeners_.end());
+    for (auto* listener : listeners) {
+      if (backpressure_listeners_.contains(listener)) {
+        listener->EntryRead(amount);
+      }
+    }
   }
 
   void NotifyBeforePull() {
     if (idempotent_) return;
-    for (auto& listener : backpressure_listeners_) listener->BeforePull();
+    if (backpressure_listeners_.empty()) return;
+    auto self = shared_from_this();
+    std::vector<BackpressureListener*> listeners(
+        backpressure_listeners_.begin(), backpressure_listeners_.end());
+    for (auto* listener : listeners) {
+      if (backpressure_listeners_.contains(listener)) {
+        listener->BeforePull();
+      }
+    }
   }
 
   bool HasBackpressureListeners() const noexcept {
@@ -847,13 +868,19 @@ class FdEntry final : public EntryImpl {
   // the race
   //   condition described in the comment above.
  public:
-  static std::unique_ptr<FdEntry> Create(Environment* env, Local<Value> path) {
+  static std::unique_ptr<FdEntry> Create(Environment* env,
+                                         Local<Value> path,
+                                         int* status) {
     // We're only going to create the FdEntry if the file exists.
     uv_fs_t req = uv_fs_t();
     auto cleanup = OnScopeLeave([&] { uv_fs_req_cleanup(&req); });
 
     auto buf = std::make_shared<BufferValue>(env->isolate(), path);
-    if (uv_fs_stat(nullptr, &req, buf->out(), nullptr) < 0) return nullptr;
+    int err = uv_fs_stat(nullptr, &req, buf->out(), nullptr);
+    if (err < 0) {
+      if (status != nullptr) *status = err;
+      return nullptr;
+    }
 
     return std::make_unique<FdEntry>(
         env, std::move(buf), req.statbuf, 0, req.statbuf.st_size);
@@ -1162,8 +1189,9 @@ std::unique_ptr<DataQueue::Entry> DataQueue::CreateDataQueueEntry(
 }
 
 std::unique_ptr<DataQueue::Entry> DataQueue::CreateFdEntry(Environment* env,
-                                                           Local<Value> path) {
-  return FdEntry::Create(env, path);
+                                                           Local<Value> path,
+                                                           int* status) {
+  return FdEntry::Create(env, path, status);
 }
 
 void DataQueue::Initialize(Environment* env, v8::Local<v8::Object> target) {
diff --git a/src/dataqueue/queue.h b/src/dataqueue/queue.h
index 190c54111b3e..64c7404e8b41 100644
--- a/src/dataqueue/queue.h
+++ b/src/dataqueue/queue.h
@@ -226,8 +226,11 @@ class DataQueue : public MemoryRetainer {
   static std::unique_ptr<Entry> CreateDataQueueEntry(
       std::shared_ptr<DataQueue> data_queue);
 
+  // Returns nullptr if the file cannot be stat'd. When `status` is given, it
+  // is set to the libuv error code so callers can report why.
   static std::unique_ptr<Entry> CreateFdEntry(Environment* env,
-                                              v8::Local<v8::Value> path);
+                                              v8::Local<v8::Value> path,
+                                              int* status = nullptr);
 
   // Creates a Reader for the given queue. If the queue is idempotent,
   // any number of readers can be created, all of which are guaranteed
diff --git a/src/debug_utils.h b/src/debug_utils.h
index 616f6c03e49a..f381e48547c1 100644
--- a/src/debug_utils.h
+++ b/src/debug_utils.h
@@ -49,7 +49,6 @@ void NODE_EXTERN_PRIVATE FWrite(FILE* file, const std::string& str);
   V(COMPILE_CACHE)                                                             \
   V(CONTEXTIFY)                                                                \
   V(DIAGNOSTICS)                                                               \
-  V(HUGEPAGES)                                                                 \
   V(INSPECTOR_SERVER)                                                          \
   V(INSPECTOR_CLIENT)                                                          \
   V(INSPECTOR_PROFILER)                                                        \
diff --git a/src/dtls/dtls.cc b/src/dtls/dtls.cc
new file mode 100644
index 000000000000..288d317dfa14
--- /dev/null
+++ b/src/dtls/dtls.cc
@@ -0,0 +1,98 @@
+#include "dtls.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include "dtls_context.h"
+#include "dtls_endpoint.h"
+#include "dtls_session.h"
+
+#include <env-inl.h>
+#include <node_external_reference.h>
+#include <node_sockaddr-inl.h>
+#include <util-inl.h>
+#include <v8.h>
+
+namespace node {
+
+using v8::Context;
+using v8::Local;
+using v8::Object;
+using v8::ObjectTemplate;
+using v8::Value;
+
+namespace dtls {
+
+void CreatePerContextProperties(Local<Object> target,
+                                Local<Value> unused,
+                                Local<Context> context,
+                                void* priv) {
+  Environment* env = Environment::GetCurrent(context);
+
+  // Register constructors.
+  DTLSContext::InitPerContext(target, context, env);
+  DTLSEndpoint::InitPerContext(target, context, env);
+  DTLSSession::InitPerContext(target, context, env);
+
+  // Endpoint state indices
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_BOUND);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_LISTENING);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_CLOSING);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_DESTROYED);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_SESSION_COUNT);
+  NODE_DEFINE_CONSTANT(target, IDX_ENDPOINT_STATE_BUSY);
+
+  // Session state indices
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_HANDSHAKING);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_OPEN);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_CLOSING);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_DESTROYED);
+  NODE_DEFINE_CONSTANT(target, IDX_SESSION_STATE_HAS_MESSAGE_LISTENER);
+
+  // Endpoint stats indices (for BigUint64Array access from JS)
+#define V(name, _) IDX_STATS_ENDPOINT_##name,
+  enum IDX_STATS_ENDPOINT { DTLS_ENDPOINT_STATS(V) IDX_STATS_ENDPOINT_COUNT };
+#undef V
+#define V(name, _) NODE_DEFINE_CONSTANT(target, IDX_STATS_ENDPOINT_##name);
+  DTLS_ENDPOINT_STATS(V);
+#undef V
+  NODE_DEFINE_CONSTANT(target, IDX_STATS_ENDPOINT_COUNT);
+
+  // Session stats indices
+#define V(name, _) IDX_STATS_SESSION_##name,
+  enum IDX_STATS_SESSION { DTLS_SESSION_STATS(V) IDX_STATS_SESSION_COUNT };
+#undef V
+#define V(name, _) NODE_DEFINE_CONSTANT(target, IDX_STATS_SESSION_##name);
+  DTLS_SESSION_STATS(V);
+#undef V
+  NODE_DEFINE_CONSTANT(target, IDX_STATS_SESSION_COUNT);
+
+  // SSL verify mode constants
+  constexpr auto SSL_VERIFY_NONE_VALUE = SSL_VERIFY_NONE;
+  constexpr auto SSL_VERIFY_PEER_VALUE = SSL_VERIFY_PEER;
+  constexpr auto SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE =
+      SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
+  NODE_DEFINE_CONSTANT(target, SSL_VERIFY_NONE_VALUE);
+  NODE_DEFINE_CONSTANT(target, SSL_VERIFY_PEER_VALUE);
+  NODE_DEFINE_CONSTANT(target, SSL_VERIFY_FAIL_IF_NO_PEER_CERT_VALUE);
+}
+
+void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                Local<ObjectTemplate> target) {
+  // Per-isolate initialization (currently none needed).
+}
+
+void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+  DTLSContext::RegisterExternalReferences(registry);
+  DTLSEndpoint::RegisterExternalReferences(registry);
+  DTLSSession::RegisterExternalReferences(registry);
+}
+
+}  // namespace dtls
+}  // namespace node
+
+NODE_BINDING_CONTEXT_AWARE_INTERNAL(dtls,
+                                    node::dtls::CreatePerContextProperties)
+NODE_BINDING_PER_ISOLATE_INIT(dtls, node::dtls::CreatePerIsolateProperties)
+NODE_BINDING_EXTERNAL_REFERENCE(dtls, node::dtls::RegisterExternalReferences)
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls.h b/src/dtls/dtls.h
new file mode 100644
index 000000000000..1faed3910e21
--- /dev/null
+++ b/src/dtls/dtls.h
@@ -0,0 +1,109 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <env.h>
+#include <node_errors.h>
+#include <uv.h>
+#include <v8.h>
+
+#include <cstdint>
+
+namespace node::dtls {
+
+// Utilities for updating stats maintained in an AliasedStruct.
+template <typename Stats, uint64_t Stats::*member>
+void IncrementStat(Stats* stats, uint64_t amt = 1) {
+  stats->*member += amt;
+}
+
+template <typename Stats, uint64_t Stats::*member>
+void RecordTimestampStat(Stats* stats) {
+  stats->*member = uv_hrtime();
+}
+
+#define DTLS_STAT_INCREMENT(Type, name)                                        \
+  IncrementStat<Type, &Type::name>(stats_.Data())
+#define DTLS_STAT_INCREMENT_N(Type, name, amt)                                 \
+  IncrementStat<Type, &Type::name>(stats_.Data(), amt)
+#define DTLS_STAT_RECORD_TIMESTAMP(Type, name)                                 \
+  RecordTimestampStat<Type, &Type::name>(stats_.Data())
+
+#define DTLS_STAT_FIELD(_, name) uint64_t name;
+
+// ============================================================================
+// Stats X-macros: V(ENUM_NAME, field_name)
+
+#define DTLS_ENDPOINT_STATS(V)                                                 \
+  V(CREATED_AT, created_at)                                                    \
+  V(DESTROYED_AT, destroyed_at)                                                \
+  V(BYTES_RECEIVED, bytes_received)                                            \
+  V(BYTES_SENT, bytes_sent)                                                    \
+  V(PACKETS_RECEIVED, packets_received)                                        \
+  V(PACKETS_SENT, packets_sent)                                                \
+  V(SERVER_SESSIONS, server_sessions)                                          \
+  V(CLIENT_SESSIONS, client_sessions)                                          \
+  V(SERVER_BUSY_COUNT, server_busy_count)
+
+#define DTLS_SESSION_STATS(V)                                                  \
+  V(CREATED_AT, created_at)                                                    \
+  V(DESTROYED_AT, destroyed_at)                                                \
+  V(CLOSING_AT, closing_at)                                                    \
+  V(HANDSHAKE_COMPLETED_AT, handshake_completed_at)                            \
+  V(BYTES_RECEIVED, bytes_received)                                            \
+  V(BYTES_SENT, bytes_sent)                                                    \
+  V(MESSAGES_RECEIVED, messages_received)                                      \
+  V(MESSAGES_SENT, messages_sent)                                              \
+  V(RETRANSMIT_COUNT, retransmit_count)
+
+// State "indices" shared between C++ and JS via AliasedStruct/DataView. These
+// are BYTE OFFSETS into the state struct, not sequential indices: session_count
+// is a uint32, so `busy`, which follows it, sits at byte offset 8. The
+// static_asserts in dtls_endpoint.cc pin these to the actual struct layout.
+// Keep in sync with lib/internal/dtls/state.js.
+enum DTLSEndpointStateIndex {
+  IDX_ENDPOINT_STATE_BOUND = 0,
+  IDX_ENDPOINT_STATE_LISTENING = 1,
+  IDX_ENDPOINT_STATE_CLOSING = 2,
+  IDX_ENDPOINT_STATE_DESTROYED = 3,
+  IDX_ENDPOINT_STATE_SESSION_COUNT = 4,
+  IDX_ENDPOINT_STATE_BUSY = 8,
+};
+
+enum DTLSSessionStateIndex {
+  IDX_SESSION_STATE_HANDSHAKING = 0,
+  IDX_SESSION_STATE_OPEN,
+  IDX_SESSION_STATE_CLOSING,
+  IDX_SESSION_STATE_DESTROYED,
+  IDX_SESSION_STATE_HAS_MESSAGE_LISTENER,
+  IDX_SESSION_STATE_COUNT
+};
+
+// Callback indices for JS dispatch
+enum DTLSCallbackIndex {
+  DTLS_CB_ENDPOINT_CLOSE = 0,
+  DTLS_CB_ENDPOINT_ERROR,
+  DTLS_CB_SESSION_NEW,
+  DTLS_CB_SESSION_CLOSE,
+  DTLS_CB_SESSION_ERROR,
+  DTLS_CB_SESSION_HANDSHAKE,
+  DTLS_CB_SESSION_MESSAGE,
+  DTLS_CB_SESSION_KEYLOG,
+  DTLS_CB_SESSION_TICKET,
+  DTLS_CB_COUNT
+};
+
+void CreatePerContextProperties(v8::Local<v8::Object> target,
+                                v8::Local<v8::Value> unused,
+                                v8::Local<v8::Context> context,
+                                void* priv);
+void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                v8::Local<v8::ObjectTemplate> target);
+void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/dtls/dtls_context.cc b/src/dtls/dtls_context.cc
new file mode 100644
index 000000000000..b5ee22fb6475
--- /dev/null
+++ b/src/dtls/dtls_context.cc
@@ -0,0 +1,448 @@
+#include "dtls_context.h"
+#include "dtls_session.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <base_object-inl.h>
+#include <crypto/crypto_bio.h>
+#include <crypto/crypto_client_hello.h>
+#include <crypto/crypto_tls_certificates.h>
+#include <crypto/crypto_util.h>
+#include <env-inl.h>
+#include <memory_tracker-inl.h>
+#include <node_errors.h>
+#include <node_sockaddr-inl.h>
+#include <util-inl.h>
+#include <uv.h>
+
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/rand.h>
+#include <openssl/srtp.h>
+#include <openssl/ssl.h>
+
+#include <cstring>
+
+namespace node {
+
+using v8::Context;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::Value;
+
+namespace dtls {
+
+namespace {
+// The cookie secret is 32 bytes (256 bits).
+constexpr size_t kCookieSecretLen = 32;
+// Cookies are bound to a coarse time window so they expire. A cookie is
+// accepted for the window it was minted in and the immediately preceding one,
+// giving ~30-60s of validity -- ample for the cookie exchange while bounding
+// how long a captured cookie can be replayed.
+constexpr uint64_t kCookieWindowNs = 30ull * 1000 * 1000 * 1000;
+}  // namespace
+
+DTLSContext::DTLSContext(Environment* env,
+                         Local<Object> wrap,
+                         ncrypto::SSLCtxPointer ctx,
+                         bool is_server)
+    : BaseObject(env, wrap),
+      ctx_(std::move(ctx)),
+      is_server_(is_server),
+      cookie_secret_(kCookieSecretLen) {
+  MakeWeak();
+
+  // Generate random cookie secret for HMAC-based cookie generation.
+  CHECK_EQ(RAND_bytes(cookie_secret_.data(), kCookieSecretLen), 1);
+
+  // Cookie generate/verify callbacks are registered on the SSL_CTX so they
+  // are inherited by all SSL objects created from it. However, we do NOT set
+  // SSL_OP_COOKIE_EXCHANGE on the context -- DTLSv1_listen() sets this option
+  // automatically on the per-SSL object when it runs (see d1_lib.c:804 in
+  // OpenSSL). This is important: if SSL_OP_COOKIE_EXCHANGE were set on the
+  // context, any SSL created from it would attempt a fresh cookie exchange,
+  // which is wrong for session SSLs that have already completed cookie
+  // verification via DTLSv1_listen().
+  SSL_CTX_set_cookie_generate_cb(ctx_.get(), CookieGenerateCallback);
+  SSL_CTX_set_cookie_verify_cb(ctx_.get(), CookieVerifyCallback);
+
+  // Store pointer to this context in the SSL_CTX app data for callbacks.
+  SSL_CTX_set_app_data(ctx_.get(), this);
+}
+
+void DTLSContext::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("cookie_secret", cookie_secret_.size());
+  tracker->TrackFieldWithSize("alpn_protos", alpn_protos_.size());
+}
+
+Local<FunctionTemplate> DTLSContext::GetConstructorTemplate(Environment* env) {
+  auto tmpl = env->dtls_context_constructor_template();
+  if (tmpl.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    tmpl = NewFunctionTemplate(isolate, New);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "DTLSContext"));
+    tmpl->InstanceTemplate()->SetInternalFieldCount(
+        BaseObject::kInternalFieldCount);
+
+    SetProtoMethod(isolate, tmpl, "setCert", SetCert);
+    SetProtoMethod(isolate, tmpl, "setKey", SetKey);
+    SetProtoMethod(isolate, tmpl, "addCACert", AddCACert);
+    SetProtoMethod(isolate, tmpl, "setCiphers", SetCiphers);
+    SetProtoMethod(isolate, tmpl, "setALPN", SetALPN);
+    SetProtoMethod(isolate, tmpl, "setSRTP", SetSRTP);
+    SetProtoMethod(isolate, tmpl, "setVerifyMode", SetVerifyMode);
+    SetProtoMethod(isolate, tmpl, "loadDefaultCAs", LoadDefaultCAs);
+    SetProtoMethod(isolate, tmpl, "setECDHCurve", SetECDHCurve);
+
+    env->set_dtls_context_constructor_template(tmpl);
+  }
+  return tmpl;
+}
+
+void DTLSContext::InitPerContext(Local<Object> target,
+                                 Local<Context> context,
+                                 Environment* env) {
+  SetConstructorFunction(
+      context, target, "DTLSContext", GetConstructorTemplate(env));
+}
+
+void DTLSContext::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(SetCert);
+  registry->Register(SetKey);
+  registry->Register(AddCACert);
+  registry->Register(SetCiphers);
+  registry->Register(SetALPN);
+  registry->Register(SetSRTP);
+  registry->Register(SetVerifyMode);
+  registry->Register(LoadDefaultCAs);
+  registry->Register(SetECDHCurve);
+}
+
+// new DTLSContext(isServer)
+void DTLSContext::New(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.IsConstructCall());
+
+  bool is_server = args[0]->IsTrue();
+
+  const SSL_METHOD* method;
+  if (is_server) {
+    method = DTLS_server_method();
+  } else {
+    method = DTLS_client_method();
+  }
+
+  ncrypto::SSLCtxPointer ctx(SSL_CTX_new(method));
+  if (!ctx) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                             "Failed to create DTLS SSL_CTX");
+  }
+
+  // Default to DTLS 1.2 only. DTLS 1.0 (based on TLS 1.1) is deprecated
+  // by RFC 8996 and lacks AEAD cipher suites.
+  SSL_CTX_set_min_proto_version(ctx.get(), DTLS1_2_VERSION);
+  SSL_CTX_set_max_proto_version(ctx.get(), DTLS1_2_VERSION);
+
+  // Disable OpenSSL's MTU querying (we manage MTU manually).
+  SSL_CTX_set_options(ctx.get(), SSL_OP_NO_QUERY_MTU);
+
+  // Enable all workarounds for maximum compatibility.
+  SSL_CTX_set_options(ctx.get(), SSL_OP_ALL);
+
+  if (is_server) {
+    // NOTE: SSL_OP_COOKIE_EXCHANGE must NOT be set on the context.
+    // DTLSv1_listen() sets it per-SSL automatically (see d1_lib.c:804).
+    // Setting it here would cause session SSLs created via CreateFromSSL()
+    // to attempt a redundant cookie exchange, hanging the handshake.
+
+    // Enable session caching for session resumption.
+    SSL_CTX_set_session_cache_mode(
+        ctx.get(), SSL_SESS_CACHE_SERVER | SSL_SESS_CACHE_NO_AUTO_CLEAR);
+  } else {
+    // Client session caching for resumption.
+    SSL_CTX_set_session_cache_mode(
+        ctx.get(), SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);
+  }
+
+  // NOTE: We do NOT call SSL_CTX_set_default_verify_paths() here.
+  // CA loading is handled in JS: if the user provides custom CAs, only
+  // those are loaded (via addCACert). Otherwise, system default CAs are
+  // loaded via loadDefaultCAs(). This matches Node.js TLS behavior.
+
+  new DTLSContext(env, args.This(), std::move(ctx), is_server);
+}
+
+void DTLSContext::SetCert(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "cert must be a string (PEM)");
+  }
+
+  Utf8Value cert_pem(env->isolate(), args[0]);
+
+  auto bio = crypto::NodeBIO::NewFixed(*cert_pem, cert_pem.length());
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to create BIO");
+  }
+
+  ncrypto::X509Pointer cert;
+  ncrypto::X509Pointer issuer;
+  if (crypto::SSL_CTX_use_certificate_chain(
+          ctx->ctx_.get(), std::move(bio), &cert, &issuer) != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "PEM_read_bio_X509 failed");
+  }
+}
+
+void DTLSContext::SetKey(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "key must be a string (PEM)");
+  }
+
+  Utf8Value key_pem(env->isolate(), args[0]);
+
+  auto bio = crypto::NodeBIO::NewFixed(*key_pem, key_pem.length());
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to create BIO");
+  }
+
+  switch (crypto::UsePrivateKey(ctx->ctx_.get(), bio)) {
+    case crypto::PrivateKeyResult::kSuccess:
+      break;
+    case crypto::PrivateKeyResult::kParseError:
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(
+          env, "PEM_read_bio_PrivateKey failed");
+    case crypto::PrivateKeyResult::kApplyError:
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                               "SSL_CTX_use_PrivateKey failed");
+  }
+
+  // Verify that the private key matches the certificate.
+  if (SSL_CTX_check_private_key(ctx->ctx_.get()) != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "Private key does not match certificate");
+  }
+}
+
+void DTLSContext::AddCACert(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "ca must be a string (PEM)");
+  }
+
+  Utf8Value ca_pem(env->isolate(), args[0]);
+
+  auto bio = crypto::NodeBIO::NewFixed(*ca_pem, ca_pem.length());
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to create BIO");
+  }
+
+  ncrypto::ClearErrorOnReturn clear_error_on_return;
+  if (crypto::AddCACertificates(env, ctx->ctx_.get(), bio) == 0) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "No CA certificates found in PEM data");
+  }
+}
+
+void DTLSContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "ciphers must be a string");
+  }
+
+  Utf8Value ciphers(env->isolate(), args[0]);
+  if (SSL_CTX_set_cipher_list(ctx->ctx_.get(), *ciphers) != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                             "SSL_CTX_set_cipher_list failed");
+  }
+}
+
+void DTLSContext::SetALPN(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!Buffer::HasInstance(args[0])) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "alpnProtocols must be a Buffer");
+  }
+
+  const uint8_t* data = reinterpret_cast<const uint8_t*>(Buffer::Data(args[0]));
+  size_t len = Buffer::Length(args[0]);
+
+  if (ctx->is_server_) {
+    // Server: store protocols for the selection callback.
+    ctx->alpn_protos_.assign(data, data + len);
+    SSL_CTX_set_alpn_select_cb(ctx->ctx_.get(), ALPNSelectCallback, ctx);
+  } else {
+    // Client: advertise protocols to the server. Returns 0 on success.
+    if (SSL_CTX_set_alpn_protos(ctx->ctx_.get(), data, len) != 0) {
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(
+          env, "SSL_CTX_set_alpn_protos failed");
+    }
+  }
+}
+
+void DTLSContext::SetSRTP(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  if (!args[0]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(env, "srtpProfiles must be a string");
+  }
+
+  Utf8Value profiles(env->isolate(), args[0]);
+  if (SSL_CTX_set_tlsext_use_srtp(ctx->ctx_.get(), *profiles) != 0) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "SSL_CTX_set_tlsext_use_srtp failed");
+  }
+}
+
+void DTLSContext::SetVerifyMode(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+
+  int mode = args[0]->Int32Value(ctx->env()->context()).FromJust();
+  SSL_CTX_set_verify(ctx->ctx_.get(), mode, nullptr);
+}
+
+void DTLSContext::LoadDefaultCAs(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  crypto::UseDefaultRootCertStore(ctx->env(), ctx->ctx_.get());
+}
+
+void DTLSContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
+  DTLSContext* ctx;
+  ASSIGN_OR_RETURN_UNWRAP(&ctx, args.This());
+  Environment* env = ctx->env();
+
+  CHECK(args[0]->IsString());
+  Utf8Value curve(env->isolate(), args[0]);
+
+  // "auto" means use OpenSSL's default curve selection.
+  if (strcmp(*curve, "auto") != 0) {
+    if (!SSL_CTX_set1_curves_list(ctx->ctx_.get(), *curve)) {
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to set ECDH curve");
+    }
+  }
+}
+
+// HMAC-SHA256 cookie derived from the peer's address and a coarse time window
+// so cookies expire (see kCookieWindowNs). During DTLSv1_listen() the peer
+// address comes from DTLSContext::current_cookie_peer_ (set synchronously
+// before the call); during the session handshake it comes from the
+// DTLSSession stored in SSL app_data.
+bool DTLSContext::ComputeCookie(SSL* ssl,
+                                uint64_t window,
+                                unsigned char* out,
+                                unsigned int* out_len) {
+  SSL_CTX* ctx = SSL_get_SSL_CTX(ssl);
+  DTLSContext* dtls_ctx = static_cast<DTLSContext*>(SSL_CTX_get_app_data(ctx));
+  CHECK_NOT_NULL(dtls_ctx);
+
+  // Message = peer address bytes followed by the 8-byte window counter.
+  unsigned char msg[sizeof(struct sockaddr_storage) + sizeof(uint64_t)];
+  size_t addr_len = 0;
+
+  void* app_data = SSL_get_app_data(ssl);
+  if (app_data != nullptr) {
+    // Session handshake path.
+    const sockaddr* sa =
+        static_cast<DTLSSession*>(app_data)->remote_address().data();
+    addr_len = SocketAddress::GetLength(sa);
+    memcpy(msg, sa, addr_len);
+  } else {
+    // DTLSv1_listen path -- use the peer address stored on the context.
+    const sockaddr* sa = dtls_ctx->current_cookie_peer_.data();
+    addr_len = SocketAddress::GetLength(sa);
+    memcpy(msg, sa, addr_len);
+  }
+
+  // Append the window counter in a fixed byte order.
+  for (size_t i = 0; i < sizeof(uint64_t); i++) {
+    msg[addr_len + i] = static_cast<unsigned char>((window >> (8 * i)) & 0xff);
+  }
+
+  unsigned char* result = HMAC(EVP_sha256(),
+                               dtls_ctx->cookie_secret_.data(),
+                               dtls_ctx->cookie_secret_.size(),
+                               msg,
+                               addr_len + sizeof(uint64_t),
+                               out,
+                               out_len);
+  return result != nullptr;
+}
+
+int DTLSContext::CookieGenerateCallback(SSL* ssl,
+                                        unsigned char* cookie,
+                                        unsigned int* cookie_len) {
+  const uint64_t window = uv_hrtime() / kCookieWindowNs;
+  return ComputeCookie(ssl, window, cookie, cookie_len) ? 1 : 0;
+}
+
+int DTLSContext::CookieVerifyCallback(SSL* ssl,
+                                      const unsigned char* cookie,
+                                      unsigned int cookie_len) {
+  const uint64_t window = uv_hrtime() / kCookieWindowNs;
+
+  // Accept a cookie minted in the current window or the immediately preceding
+  // one, so a handshake that straddles a window boundary still succeeds.
+  unsigned char expected[EVP_MAX_MD_SIZE];
+  unsigned int expected_len = 0;
+  for (int i = 0; i < 2; i++) {
+    if (i == 1 && window == 0) break;
+    if (ComputeCookie(ssl, window - i, expected, &expected_len) &&
+        cookie_len == expected_len &&
+        CRYPTO_memcmp(cookie, expected, expected_len) == 0) {
+      return 1;
+    }
+  }
+  return 0;
+}
+
+int DTLSContext::ALPNSelectCallback(SSL* ssl,
+                                    const unsigned char** out,
+                                    unsigned char* outlen,
+                                    const unsigned char* in,
+                                    unsigned int inlen,
+                                    void* arg) {
+  DTLSContext* ctx = static_cast<DTLSContext*>(arg);
+
+  if (ctx->alpn_protos_.empty()) {
+    return SSL_TLSEXT_ERR_NOACK;
+  }
+
+  auto selected = crypto::SelectNextProtocol(
+      {ctx->alpn_protos_.data(), ctx->alpn_protos_.size()}, {in, inlen});
+
+  if (!selected.has_value()) {
+    return SSL_TLSEXT_ERR_NOACK;
+  }
+
+  crypto::SetSelectedProtocol(out, outlen, *selected);
+  return SSL_TLSEXT_ERR_OK;
+}
+
+}  // namespace dtls
+}  // namespace node
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls_context.h b/src/dtls/dtls_context.h
new file mode 100644
index 000000000000..cb0b13092463
--- /dev/null
+++ b/src/dtls/dtls_context.h
@@ -0,0 +1,102 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <base_object.h>
+#include <env.h>
+#include <ncrypto.h>
+#include <node_sockaddr.h>
+#include <v8.h>
+
+#include <openssl/dtls1.h>
+#include <openssl/ssl.h>
+
+#include <vector>
+
+namespace node::dtls {
+
+// DTLSContext wraps an SSL_CTX configured for DTLS.
+// It manages certificate/key configuration, cipher selection,
+// ALPN, and automatic cookie generation/verification for servers.
+class DTLSContext final : public BaseObject {
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void InitPerContext(v8::Local<v8::Object> target,
+                             v8::Local<v8::Context> context,
+                             Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  DTLSContext(Environment* env,
+              v8::Local<v8::Object> wrap,
+              ncrypto::SSLCtxPointer ctx,
+              bool is_server);
+
+  SSL_CTX* ssl_ctx() const { return ctx_.get(); }
+
+  // Set the peer address for cookie generation during DTLSv1_listen().
+  void set_cookie_peer(const SocketAddress& addr) {
+    current_cookie_peer_ = addr;
+  }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(DTLSContext)
+  SET_SELF_SIZE(DTLSContext)
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetCert(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetKey(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AddCACert(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetALPN(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetSRTP(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetVerifyMode(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void LoadDefaultCAs(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetECDHCurve(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  // Compute the address-and-time-window-bound cookie for |window| into |out|
+  // (which must have room for EVP_MAX_MD_SIZE bytes). Shared by the cookie
+  // generate/verify callbacks.
+  static bool ComputeCookie(SSL* ssl,
+                            uint64_t window,
+                            unsigned char* out,
+                            unsigned int* out_len);
+
+  // Automatic DTLS cookie callbacks
+  static int CookieGenerateCallback(SSL* ssl,
+                                    unsigned char* cookie,
+                                    unsigned int* cookie_len);
+  static int CookieVerifyCallback(SSL* ssl,
+                                  const unsigned char* cookie,
+                                  unsigned int cookie_len);
+
+  // ALPN selection callback (server-side)
+  static int ALPNSelectCallback(SSL* ssl,
+                                const unsigned char** out,
+                                unsigned char* outlen,
+                                const unsigned char* in,
+                                unsigned int inlen,
+                                void* arg);
+
+  ncrypto::SSLCtxPointer ctx_;
+  bool is_server_;
+
+  // Secret key for HMAC-based cookie generation
+  std::vector<uint8_t> cookie_secret_;
+
+  // Peer address for current DTLSv1_listen cookie exchange.
+  // Set synchronously before DTLSv1_listen() and consumed by the
+  // cookie generate/verify callbacks during that call.
+  SocketAddress current_cookie_peer_;
+
+  // ALPN protocols (server-side selection list)
+  std::vector<uint8_t> alpn_protos_;
+};
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/dtls/dtls_endpoint.cc b/src/dtls/dtls_endpoint.cc
new file mode 100644
index 000000000000..44279399e478
--- /dev/null
+++ b/src/dtls/dtls_endpoint.cc
@@ -0,0 +1,704 @@
+#include "dtls_endpoint.h"
+#include "dtls.h"
+#include "dtls_context.h"
+#include "dtls_session.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct-inl.h>
+#include <base_object-inl.h>
+#include <env-inl.h>
+#include <handle_wrap.h>
+#include <memory_tracker-inl.h>
+#include <node_buffer.h>
+#include <node_errors.h>
+#include <node_sockaddr-inl.h>
+#include <permission/permission.h>
+#include <util-inl.h>
+
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+#include <cstddef>
+#include <cstring>
+
+namespace node {
+
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::HandleScope;
+using v8::Int32;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::String;
+using v8::Value;
+
+namespace dtls {
+
+namespace {
+struct SendReq {
+  uv_udp_send_t req;
+  uv_buf_t buf;
+  std::vector<uint8_t> data;
+};
+}  // namespace
+
+// The endpoint state "indices" are byte offsets into DTLSEndpointStateData,
+// accessed from JS via a DataView. Pin them to the actual struct layout so a
+// mismatch (as once existed for `busy`, which follows a uint32) can't recur.
+static_assert(IDX_ENDPOINT_STATE_BOUND ==
+              offsetof(DTLSEndpointStateData, bound));
+static_assert(IDX_ENDPOINT_STATE_LISTENING ==
+              offsetof(DTLSEndpointStateData, listening));
+static_assert(IDX_ENDPOINT_STATE_CLOSING ==
+              offsetof(DTLSEndpointStateData, closing));
+static_assert(IDX_ENDPOINT_STATE_DESTROYED ==
+              offsetof(DTLSEndpointStateData, destroyed));
+static_assert(IDX_ENDPOINT_STATE_SESSION_COUNT ==
+              offsetof(DTLSEndpointStateData, session_count));
+static_assert(IDX_ENDPOINT_STATE_BUSY == offsetof(DTLSEndpointStateData, busy));
+
+DTLSEndpoint::DTLSEndpoint(Environment* env, Local<Object> wrap)
+    : HandleWrap(env,
+                 wrap,
+                 reinterpret_cast<uv_handle_t*>(&handle_),
+                 PROVIDER_DTLS_ENDPOINT),
+      state_(env->isolate()),
+      stats_(env->isolate()) {
+  CHECK_EQ(uv_udp_init(env->event_loop(), &handle_), 0);
+  handle_.data = this;
+  MakeWeak();
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSEndpointStats, created_at);
+}
+
+Local<FunctionTemplate> DTLSEndpoint::GetConstructorTemplate(Environment* env) {
+  auto tmpl = env->dtls_endpoint_constructor_template();
+  if (tmpl.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    tmpl = NewFunctionTemplate(isolate, New);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "DTLSEndpoint"));
+    tmpl->InstanceTemplate()->SetInternalFieldCount(
+        HandleWrap::kInternalFieldCount);
+
+    SetProtoMethod(isolate, tmpl, "bind", DoBind);
+    SetProtoMethod(isolate, tmpl, "listen", DoListen);
+    SetProtoMethod(isolate, tmpl, "connect", DoConnect);
+    SetProtoMethod(isolate, tmpl, "close", DoClose);
+    SetProtoMethod(isolate, tmpl, "destroy", DoDestroy);
+    SetProtoMethod(isolate, tmpl, "getState", GetState);
+    SetProtoMethod(isolate, tmpl, "getStats", GetStats);
+    SetProtoMethod(isolate, tmpl, "getAddress", GetAddress);
+    SetProtoMethod(isolate, tmpl, "setMTU", SetMTU);
+    SetProtoMethod(isolate, tmpl, "setCallbacks", DoSetCallbacks);
+
+    env->set_dtls_endpoint_constructor_template(tmpl);
+  }
+  return tmpl;
+}
+
+void DTLSEndpoint::InitPerContext(Local<Object> target,
+                                  Local<Context> context,
+                                  Environment* env) {
+  SetConstructorFunction(
+      context, target, "DTLSEndpoint", GetConstructorTemplate(env));
+}
+
+void DTLSEndpoint::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(DoBind);
+  registry->Register(DoListen);
+  registry->Register(DoConnect);
+  registry->Register(DoClose);
+  registry->Register(DoDestroy);
+  registry->Register(GetState);
+  registry->Register(GetStats);
+  registry->Register(GetAddress);
+  registry->Register(SetMTU);
+  registry->Register(DoSetCallbacks);
+}
+
+void DTLSEndpoint::New(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.IsConstructCall());
+  new DTLSEndpoint(env, args.This());
+}
+
+int DTLSEndpoint::Bind(const SocketAddress& address) {
+  if (IsHandleClosing()) return UV_EINVAL;
+  if (state_->bound) return UV_EALREADY;
+
+  unsigned int flags = 0;
+  if (address.family() == AF_INET6) {
+    flags |= UV_UDP_IPV6ONLY;
+  }
+
+  int err = uv_udp_bind(&handle_, address.data(), flags);
+  if (err != 0) return err;
+
+  state_->bound = 1;
+
+  // Don't keep the event loop alive unless we're listening or have sessions.
+  uv_unref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  return 0;
+}
+
+int DTLSEndpoint::Listen(DTLSContext* context) {
+  if (IsHandleClosing()) return UV_EINVAL;
+  if (listening_) return UV_EALREADY;
+
+  server_context_.reset(context);
+  listening_ = true;
+  state_->listening = 1;
+
+  // Start receiving UDP datagrams.
+  int err = uv_udp_recv_start(&handle_, OnAlloc, OnRecv);
+  if (err != 0) {
+    listening_ = false;
+    state_->listening = 0;
+    server_context_.reset();
+    return err;
+  }
+
+  // Ref the handle while listening.
+  uv_ref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  return 0;
+}
+
+BaseObjectPtr<DTLSSession> DTLSEndpoint::Connect(DTLSContext* context,
+                                                 const SocketAddress& remote,
+                                                 const char* servername,
+                                                 const char* verify_host,
+                                                 bool verify_is_ip) {
+  if (IsHandleClosing()) {
+    THROW_ERR_INVALID_STATE(env(), "Endpoint is closing");
+    return {};
+  }
+
+  // Check if we already have a session for this address.
+  auto it = sessions_.find(remote);
+  if (it != sessions_.end()) {
+    THROW_ERR_INVALID_STATE(env(), "Session already exists for this address");
+    return {};
+  }
+
+  auto session = DTLSSession::Create(env(),
+                                     this,
+                                     context->ssl_ctx(),
+                                     remote,
+                                     false /* is_server */,
+                                     servername,
+                                     verify_host,
+                                     verify_is_ip);
+
+  if (!session) return {};
+
+  sessions_[remote] = session;
+  state_->session_count = sessions_.size();
+  DTLS_STAT_INCREMENT(DTLSEndpointStats, client_sessions);
+
+  // Ref the handle while we have sessions.
+  uv_ref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  // Start receiving if not already.
+  if (!listening_) {
+    uv_udp_recv_start(&handle_, OnAlloc, OnRecv);
+  }
+
+  // Initiate the DTLS handshake by running Cycle.
+  session->Cycle();
+
+  return session;
+}
+
+int DTLSEndpoint::SendTo(const SocketAddress& dest,
+                         const uint8_t* data,
+                         size_t len) {
+  if (IsHandleClosing()) return UV_EINVAL;
+
+  // Try synchronous send first.
+  uv_buf_t buf =
+      uv_buf_init(const_cast<char*>(reinterpret_cast<const char*>(data)), len);
+  int err = uv_udp_try_send(&handle_, &buf, 1, dest.data());
+
+  if (err == static_cast<int>(len)) {
+    DTLS_STAT_INCREMENT_N(DTLSEndpointStats, bytes_sent, len);
+    DTLS_STAT_INCREMENT(DTLSEndpointStats, packets_sent);
+    return 0;  // Sent successfully.
+  }
+
+  if (err != UV_EAGAIN && err < 0) {
+    return err;  // Real error.
+  }
+
+  // Async send: copy the data since it won't outlive this call.
+  auto* req = new SendReq();
+  req->data.assign(data, data + len);
+  req->buf = uv_buf_init(reinterpret_cast<char*>(req->data.data()), len);
+
+  err = uv_udp_send(&req->req, &handle_, &req->buf, 1, dest.data(), OnSend);
+  if (err != 0) {
+    delete req;
+    return err;
+  }
+
+  DTLS_STAT_INCREMENT_N(DTLSEndpointStats, bytes_sent, len);
+  DTLS_STAT_INCREMENT(DTLSEndpointStats, packets_sent);
+  return 0;
+}
+
+void DTLSEndpoint::RemoveSession(const SocketAddress& addr) {
+  sessions_.erase(addr);
+  state_->session_count = sessions_.size();
+
+  // Unref if no more sessions and not listening.
+  if (sessions_.empty() && !listening_ && !IsHandleClosing()) {
+    uv_unref(reinterpret_cast<uv_handle_t*>(&handle_));
+  }
+}
+
+void DTLSEndpoint::CloseGracefully() {
+  if (IsHandleClosing()) return;
+
+  state_->closing = 1;
+
+  // Close all sessions gracefully (this may send close_notify).
+  auto sessions_copy = sessions_;
+  sessions_.clear();
+  state_->session_count = 0;
+  for (auto& [addr, session] : sessions_copy) {
+    session->Close();
+  }
+
+  // Stop listening.
+  if (listening_) {
+    uv_udp_recv_stop(&handle_);
+    listening_ = false;
+    state_->listening = 0;
+  }
+
+  server_context_.reset();
+
+  // Keep ourselves alive until OnClose() runs, so a garbage collection while
+  // uv_close() is in flight cannot collect the wrapper before the close is
+  // reported. Released in OnClose().
+  self_ref_ = BaseObjectPtr<DTLSEndpoint>(this);
+
+  // HandleWrap::Close() calls uv_close and manages the lifecycle.
+  HandleWrap::Close();
+}
+
+void DTLSEndpoint::Destroy() {
+  if (IsHandleClosing()) return;
+
+  state_->destroyed = 1;
+
+  // Copy session list to avoid iterator invalidation.
+  auto sessions_copy = sessions_;
+  sessions_.clear();
+  state_->session_count = 0;
+  for (auto& [addr, session] : sessions_copy) {
+    session->Destroy();
+  }
+
+  server_context_.reset();
+
+  if (listening_) {
+    uv_udp_recv_stop(&handle_);
+    listening_ = false;
+    state_->listening = 0;
+  }
+
+  // Keep ourselves alive until OnClose() (see CloseGracefully()).
+  self_ref_ = BaseObjectPtr<DTLSEndpoint>(this);
+
+  HandleWrap::Close();
+}
+
+Local<Function> DTLSEndpoint::GetCallback(int index) const {
+  if (index < 0 || index >= DTLS_CB_COUNT) return Local<Function>();
+  Local<Function> cb = callbacks_[index].Get(env()->isolate());
+  return cb;
+}
+
+void DTLSEndpoint::SetCallbacks(Local<Object> callbacks) {
+  Isolate* isolate = env()->isolate();
+  Local<Context> context = env()->context();
+
+  const char* names[] = {
+      "onEndpointClose",
+      "onEndpointError",
+      "onSessionNew",
+      "onSessionClose",
+      "onSessionError",
+      "onSessionHandshake",
+      "onSessionMessage",
+      "onSessionKeylog",
+      "onSessionTicket",
+  };
+
+  for (int i = 0; i < DTLS_CB_COUNT; i++) {
+    Local<String> name;
+    if (!String::NewFromUtf8(isolate, names[i]).ToLocal(&name)) {
+      THROW_ERR_OPERATION_FAILED(isolate,
+                                 "Failed to create callback name string");
+      return;
+    }
+    Local<Value> val;
+    if (!callbacks->Get(context, name).ToLocal(&val) || !val->IsFunction()) {
+      THROW_ERR_MISSING_ARGS(
+          isolate, ("Missing DTLS callback: " + std::string(names[i])).c_str());
+      return;
+    }
+    callbacks_[i].Reset(isolate, val.As<Function>());
+  }
+}
+
+// --- libuv callbacks ---
+
+void DTLSEndpoint::OnAlloc(uv_handle_t* handle,
+                           size_t suggested_size,
+                           uv_buf_t* buf) {
+  DTLSEndpoint* endpoint = static_cast<DTLSEndpoint*>(handle->data);
+  // Reuse a single receive buffer. libuv delivers datagrams one at a time on
+  // this thread, and OnRecv fully consumes each datagram (copying it into the
+  // session's BIO) before the next OnAlloc, so a per-endpoint buffer suffices
+  // and avoids a heap allocation on every packet.
+  if (endpoint->recv_buf_.empty()) {
+    endpoint->recv_buf_.resize(65536);
+  }
+  buf->base = endpoint->recv_buf_.data();
+  buf->len = endpoint->recv_buf_.size();
+}
+
+void DTLSEndpoint::OnRecv(uv_udp_t* handle,
+                          ssize_t nread,
+                          const uv_buf_t* buf,
+                          const struct sockaddr* addr,
+                          unsigned int flags) {
+  DTLSEndpoint* endpoint = static_cast<DTLSEndpoint*>(handle->data);
+
+  // buf->base is the endpoint's reusable recv_buf_; it is not freed here.
+  if (nread == 0 && addr == nullptr) {
+    return;
+  }
+
+  if (nread < 0) {
+    HandleScope handle_scope(endpoint->env()->isolate());
+    Context::Scope context_scope(endpoint->env()->context());
+    Local<Value> argv[] = {
+        String::NewFromUtf8(endpoint->env()->isolate(), uv_strerror(nread))
+            .ToLocalChecked(),
+    };
+    Local<Function> cb = endpoint->GetCallback(DTLS_CB_ENDPOINT_ERROR);
+    if (!cb.IsEmpty()) {
+      endpoint->MakeCallback(cb, 1, argv);
+    }
+    return;
+  }
+
+  if (addr == nullptr) {
+    return;
+  }
+
+  IncrementStat<DTLSEndpointStats, &DTLSEndpointStats::bytes_received>(
+      endpoint->stats_.Data(), nread);
+  IncrementStat<DTLSEndpointStats, &DTLSEndpointStats::packets_received>(
+      endpoint->stats_.Data());
+
+  SocketAddress remote(addr);
+  endpoint->ProcessDatagram(
+      reinterpret_cast<const uint8_t*>(buf->base), nread, remote);
+}
+
+void DTLSEndpoint::OnSend(uv_udp_send_t* req, int status) {
+  SendReq* send_req = reinterpret_cast<SendReq*>(req);
+  delete send_req;
+}
+
+void DTLSEndpoint::OnClose() {
+  state_->closing = 0;
+  state_->destroyed = 1;
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSEndpointStats, destroyed_at);
+
+  // Release the strong self-reference taken when the close was initiated.
+  // HandleWrap::OnClose still holds its own reference for the duration of this
+  // call, so this does not free us here.
+  self_ref_.reset();
+
+  // A close initiated outside CloseGracefully()/Destroy() (e.g. an endpoint
+  // abandoned mid-construction and closed at environment teardown) takes no
+  // self-reference, so its wrapper may already be collected. There is no JS
+  // side to notify in that case; skip it rather than touch a freed wrapper.
+  if (persistent().IsEmpty()) return;
+
+  Local<Function> cb = GetCallback(DTLS_CB_ENDPOINT_CLOSE);
+  if (!cb.IsEmpty()) {
+    Local<Value> argv[] = {};
+    MakeCallback(cb, 0, argv);
+  }
+}
+
+void DTLSEndpoint::ProcessDatagram(const uint8_t* data,
+                                   size_t len,
+                                   const SocketAddress& remote) {
+  if (IsHandleClosing()) return;
+
+  // Look up existing session by remote address.
+  auto it = sessions_.find(remote);
+  if (it != sessions_.end()) {
+    it->second->Receive(data, len);
+    return;
+  }
+
+  // No existing session. If we're in server mode, try to accept.
+  if (listening_ && server_context_) {
+    AcceptConnection(data, len, remote);
+  }
+}
+
+void DTLSEndpoint::AcceptConnection(const uint8_t* data,
+                                    size_t len,
+                                    const SocketAddress& remote) {
+  if (state_->busy) {
+    DTLS_STAT_INCREMENT(DTLSEndpointStats, server_busy_count);
+    return;
+  }
+
+  HandleScope handle_scope(env()->isolate());
+  Context::Scope context_scope(env()->context());
+
+  // Stateless cookie exchange via DTLSv1_listen() for DoS protection.
+  //
+  // The standard OpenSSL DTLS server flow (see s_server.c) is:
+  //   1. Create SSL with BIO_s_datagram() wrapping the UDP socket
+  //   2. DTLSv1_listen(ssl, &peer) -- stateless cookie exchange
+  //   3. Connect the socket to the verified peer
+  //   4. SSL_accept(ssl) -- continue the handshake on the SAME SSL
+  //
+  // We diverge in one key way: we use memory BIOs instead of datagram
+  // BIOs because Node.js manages UDP I/O through libuv (uv_udp_t),
+  // not through raw socket FDs. This means DTLSv1_listen()'s internal
+  // BIO_dgram_get_peer()/set_peer() calls are no-ops -- we provide the
+  // peer address to the cookie callbacks via DTLSContext::current_cookie_peer_
+  // instead. After DTLSv1_listen() returns 1, we hand the SSL (with its
+  // memory BIOs) to a DTLSSession via CreateFromSSL(). The SSL's internal
+  // state machine has been prepared by DTLSv1_listen() to continue the
+  // handshake from TLS_ST_SR_CLNT_HELLO, so Cycle() -> SSL_do_handshake()
+  // immediately produces the ServerHello flight.
+  ncrypto::SSLPointer ssl(SSL_new(server_context_->ssl_ctx()));
+  if (!ssl) return;
+
+  auto in = ncrypto::BIOPointer::NewMem();
+  auto out = ncrypto::BIOPointer::NewMem();
+  if (!in || !out) return;
+
+  BIO_set_mem_eof_return(in.get(), -1);
+  BIO_set_mem_eof_return(out.get(), -1);
+  // SSL_set_bio takes ownership of both BIOs.
+  BIO* in_raw = in.release();
+  BIO* out_raw = out.release();
+  SSL_set_bio(ssl.get(), in_raw, out_raw);
+  SSL_set_accept_state(ssl.get());
+  SSL_set_options(ssl.get(), SSL_OP_NO_QUERY_MTU | SSL_OP_COOKIE_EXCHANGE);
+  SSL_set_mtu(ssl.get(), mtu_);
+
+  // Set peer address on context for the cookie callbacks.
+  server_context_->set_cookie_peer(remote);
+
+  BIO_write(in_raw, data, len);
+
+  DeleteFnPtr<BIO_ADDR, BIO_ADDR_free> peer(BIO_ADDR_new());
+  int ret = DTLSv1_listen(ssl.get(), peer.get());
+
+  if (ret == 0) {
+    // Send HelloVerifyRequest.
+    uint8_t resp_buf[65536];
+    int resp_len;
+    while ((resp_len = BIO_read(out_raw, resp_buf, sizeof(resp_buf))) > 0) {
+      SendTo(remote, resp_buf, resp_len);
+    }
+    return;
+  }
+
+  if (ret < 0) {
+    return;  // Error — drop packet.
+  }
+
+  // Cookie verified. Hand the SSL (which has already completed cookie
+  // exchange and consumed the ClientHello) to a DTLSSession. Calling
+  // Cycle() will drive SSL_do_handshake to produce the ServerHello.
+  auto session = DTLSSession::CreateFromSSL(
+      env(), this, std::move(ssl), in_raw, out_raw, remote);
+
+  if (!session) return;
+
+  sessions_[remote] = session;
+  state_->session_count = sessions_.size();
+  DTLS_STAT_INCREMENT(DTLSEndpointStats, server_sessions);
+
+  uv_ref(reinterpret_cast<uv_handle_t*>(&handle_));
+
+  // Drive the handshake forward — produces ServerHello etc.
+  session->Cycle();
+
+  // Emit the new session to JS.
+  Local<Value> argv[] = {session->object()};
+  Local<Function> cb = GetCallback(DTLS_CB_SESSION_NEW);
+  if (!cb.IsEmpty()) {
+    MakeCallback(cb, 1, argv);
+  }
+}
+
+// --- JS binding methods ---
+
+void DTLSEndpoint::DoBind(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  Environment* env = endpoint->env();
+
+  CHECK(args[0]->IsString());  // host
+  CHECK(args[1]->IsInt32());   // port
+
+  Utf8Value host(env->isolate(), args[0]);
+  int port = args[1].As<Int32>()->Value();
+
+  SocketAddress addr;
+  if (!SocketAddress::New(*host, port, &addr)) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid address");
+  }
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, addr.ToString());
+
+  int err = endpoint->Bind(addr);
+  if (err != 0) {
+    return THROW_ERR_INVALID_STATE(env, uv_strerror(err));
+  }
+}
+
+void DTLSEndpoint::DoListen(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  Environment* env = endpoint->env();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(env, permission::PermissionScope::kNet, "");
+
+  DTLSContext* context;
+  ASSIGN_OR_RETURN_UNWRAP(&context, args[0].As<Object>());
+
+  int err = endpoint->Listen(context);
+  if (err != 0) {
+    return THROW_ERR_INVALID_STATE(env, uv_strerror(err));
+  }
+}
+
+void DTLSEndpoint::DoConnect(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  Environment* env = endpoint->env();
+
+  DTLSContext* context;
+  ASSIGN_OR_RETURN_UNWRAP(&context, args[0].As<Object>());
+
+  CHECK(args[1]->IsString());  // host
+  CHECK(args[2]->IsInt32());   // port
+
+  Utf8Value host(env->isolate(), args[1]);
+  int port = args[2].As<Int32>()->Value();
+
+  SocketAddress remote;
+  if (!SocketAddress::New(*host, port, &remote)) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid remote address");
+  }
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, remote.ToString());
+
+  // Optional: servername (SNI), verifyHost (expected peer identity), and
+  // whether verifyHost is an IP literal. These are resolved in JS and applied
+  // to the client SSL before the handshake starts.
+  Utf8Value servername(env->isolate(), args[3]);
+  Utf8Value verify_host(env->isolate(), args[4]);
+  const char* servername_ptr = args[3]->IsString() ? *servername : nullptr;
+  const char* verify_host_ptr = args[4]->IsString() ? *verify_host : nullptr;
+  bool verify_is_ip = args[5]->IsTrue();
+
+  auto session = endpoint->Connect(
+      context, remote, servername_ptr, verify_host_ptr, verify_is_ip);
+  if (session) {
+    args.GetReturnValue().Set(session->object());
+  }
+}
+
+void DTLSEndpoint::DoClose(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  endpoint->CloseGracefully();
+}
+
+void DTLSEndpoint::DoDestroy(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  endpoint->Destroy();
+}
+
+void DTLSEndpoint::GetState(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  args.GetReturnValue().Set(endpoint->state_.GetArrayBuffer());
+}
+
+void DTLSEndpoint::GetStats(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  args.GetReturnValue().Set(endpoint->stats_.GetArrayBuffer());
+}
+
+void DTLSEndpoint::GetAddress(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+
+  if (endpoint->IsHandleClosing()) return;
+
+  SocketAddress addr = SocketAddress::FromSockName(endpoint->handle_);
+  Local<Object> obj;
+  if (addr.ToJS(endpoint->env()).ToLocal(&obj)) {
+    args.GetReturnValue().Set(obj);
+  }
+}
+
+void DTLSEndpoint::SetMTU(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+
+  CHECK(args[0]->IsInt32());
+  int mtu = args[0].As<Int32>()->Value();
+  if (mtu < 256 || mtu > 65535) {
+    return THROW_ERR_OUT_OF_RANGE(endpoint->env(),
+                                  "MTU must be between 256 and 65535");
+  }
+  endpoint->mtu_ = mtu;
+}
+
+void DTLSEndpoint::DoSetCallbacks(const FunctionCallbackInfo<Value>& args) {
+  DTLSEndpoint* endpoint;
+  ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
+  CHECK(args[0]->IsObject());
+  endpoint->SetCallbacks(args[0].As<Object>());
+}
+
+void DTLSEndpoint::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("sessions", sessions_.size());
+  tracker->TrackFieldWithSize("recv_buf", recv_buf_.size());
+}
+
+}  // namespace dtls
+}  // namespace node
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls_endpoint.h b/src/dtls/dtls_endpoint.h
new file mode 100644
index 000000000000..bed49a7db0e0
--- /dev/null
+++ b/src/dtls/dtls_endpoint.h
@@ -0,0 +1,171 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct.h>
+#include <env.h>
+#include <handle_wrap.h>
+#include <node_sockaddr.h>
+#include <uv.h>
+#include <v8.h>
+
+#include <openssl/ssl.h>
+
+#include <unordered_map>
+#include <vector>
+
+#include "dtls.h"
+#include "dtls_context.h"
+#include "dtls_session.h"
+
+namespace node::dtls {
+
+// Shared C++ <-> JS state for a DTLS endpoint.
+struct DTLSEndpointStateData {
+  uint8_t bound = 0;
+  uint8_t listening = 0;
+  uint8_t closing = 0;
+  uint8_t destroyed = 0;
+  uint32_t session_count = 0;
+  uint8_t busy = 0;
+};
+
+// Stats collected for a DTLS endpoint, backed by a BigUint64Array.
+struct DTLSEndpointStats {
+  DTLS_ENDPOINT_STATS(DTLS_STAT_FIELD)
+};
+
+// DTLSEndpoint manages a single UDP socket and dispatches incoming
+// datagrams to the appropriate DTLSSession based on the remote address.
+// For server mode, it handles stateless cookie exchange via DTLSv1_listen()
+// before creating new sessions.
+class DTLSEndpoint final : public HandleWrap {
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void InitPerContext(v8::Local<v8::Object> target,
+                             v8::Local<v8::Context> context,
+                             Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  DTLSEndpoint(Environment* env, v8::Local<v8::Object> wrap);
+
+  // Bind the UDP socket to the given address.
+  int Bind(const SocketAddress& address);
+
+  // Start listening for incoming DTLS connections (server mode).
+  // |context| provides the SSL_CTX for creating new sessions.
+  int Listen(DTLSContext* context);
+
+  // Initiate a client connection to the given address.
+  // |servername|/|verify_host|/|verify_is_ip| configure SNI and peer identity
+  // verification on the client SSL before the handshake begins; see
+  // DTLSSession::Create.
+  // Returns the created DTLSSession.
+  BaseObjectPtr<DTLSSession> Connect(DTLSContext* context,
+                                     const SocketAddress& remote,
+                                     const char* servername = nullptr,
+                                     const char* verify_host = nullptr,
+                                     bool verify_is_ip = false);
+
+  // Send a raw UDP datagram to the given address.
+  // Called by DTLSSession to send encrypted packets.
+  int SendTo(const SocketAddress& dest, const uint8_t* data, size_t len);
+
+  // Remove a session from the endpoint (called on session close/destroy).
+  void RemoveSession(const SocketAddress& addr);
+
+  // Close the endpoint gracefully (close all sessions first).
+  void CloseGracefully();
+
+  // Immediately destroy the endpoint.
+  void Destroy();
+
+  // Get the JS callback function for a given callback index.
+  v8::Local<v8::Function> GetCallback(int index) const;
+
+  // Set the JS callbacks.
+  void SetCallbacks(v8::Local<v8::Object> callbacks);
+
+  bool is_listening() const { return listening_; }
+  uint32_t mtu() const { return mtu_; }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(DTLSEndpoint)
+  SET_SELF_SIZE(DTLSEndpoint)
+
+ private:
+  // JS binding methods
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoBind(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoListen(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoConnect(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoClose(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoDestroy(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetState(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetStats(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetMTU(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoSetCallbacks(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  // libuv callbacks
+  static void OnAlloc(uv_handle_t* handle,
+                      size_t suggested_size,
+                      uv_buf_t* buf);
+  static void OnRecv(uv_udp_t* handle,
+                     ssize_t nread,
+                     const uv_buf_t* buf,
+                     const struct sockaddr* addr,
+                     unsigned int flags);
+  static void OnSend(uv_udp_send_t* req, int status);
+
+  // Called by HandleWrap after uv_close completes.
+  void OnClose() override;
+
+  // Process an incoming datagram.
+  void ProcessDatagram(const uint8_t* data,
+                       size_t len,
+                       const SocketAddress& remote);
+
+  // Handle a new client connection (server mode).
+  void AcceptConnection(const uint8_t* data,
+                        size_t len,
+                        const SocketAddress& remote);
+
+  uv_udp_t handle_;
+
+  // Reusable receive buffer for uv_udp_recv (see OnAlloc). libuv delivers one
+  // datagram at a time and OnRecv consumes each before the next OnAlloc, so a
+  // single buffer per endpoint avoids a heap allocation on every packet.
+  std::vector<char> recv_buf_;
+
+  // Session table: maps remote address -> session.
+  std::unordered_map<SocketAddress,
+                     BaseObjectPtr<DTLSSession>,
+                     SocketAddress::Hash>
+      sessions_;
+
+  // Server context (set when listening).
+  BaseObjectPtr<DTLSContext> server_context_;
+
+  // JS callbacks
+  v8::Global<v8::Function> callbacks_[DTLS_CB_COUNT];
+
+  AliasedStruct<DTLSEndpointStateData> state_;
+  AliasedStruct<DTLSEndpointStats> stats_;
+
+  // Strong self-reference held while a graceful close/destroy is in flight, so
+  // the wrapper is not garbage-collected before OnClose() runs and reports the
+  // close. Cleared in OnClose().
+  BaseObjectPtr<DTLSEndpoint> self_ref_;
+
+  bool listening_ = false;
+  uint32_t mtu_ = 1200;  // Conservative default MTU for data payload
+};
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/dtls/dtls_session.cc b/src/dtls/dtls_session.cc
new file mode 100644
index 000000000000..ed63daaa4b31
--- /dev/null
+++ b/src/dtls/dtls_session.cc
@@ -0,0 +1,768 @@
+#include "dtls_session.h"
+#include "dtls.h"
+#include "dtls_endpoint.h"
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct-inl.h>
+#include <async_wrap-inl.h>
+#include <base_object-inl.h>
+#include <env-inl.h>
+#include <memory_tracker-inl.h>
+#include <node_buffer.h>
+#include <node_errors.h>
+#include <node_sockaddr-inl.h>
+#include <timer_wrap-inl.h>
+#include <util-inl.h>
+
+#include <openssl/err.h>
+#include <openssl/srtp.h>
+#include <openssl/ssl.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
+
+#include <cstring>
+
+namespace node {
+
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::HandleScope;
+using v8::Isolate;
+using v8::Local;
+using v8::MaybeLocal;
+using v8::Object;
+using v8::String;
+using v8::Value;
+
+namespace dtls {
+
+DTLSSession::DTLSSession(Environment* env,
+                         Local<Object> wrap,
+                         DTLSEndpoint* endpoint,
+                         ncrypto::SSLPointer ssl,
+                         BIO* enc_in,
+                         BIO* enc_out,
+                         const SocketAddress& remote,
+                         bool is_server)
+    : AsyncWrap(env, wrap, PROVIDER_DTLS_SESSION),
+      endpoint_(endpoint),
+      ssl_(std::move(ssl)),
+      enc_in_(enc_in),
+      enc_out_(enc_out),
+      retransmit_timer_(env,
+                        [this] {
+                          if (destroyed_) return;
+                          // Keep ourselves alive across the callback: emitting
+                          // an error or running Cycle() below can synchronously
+                          // destroy this session, and this timer lives on it.
+                          BaseObjectPtr<DTLSSession> strong_ref{this};
+                          DTLS_STAT_INCREMENT(DTLSSessionStats,
+                                              retransmit_count);
+                          int ret = DTLSv1_handle_timeout(ssl_.get());
+                          if (ret < 0) {
+                            // Handshake timeout expired.
+                            HandleScope hs(this->env()->isolate());
+                            Context::Scope cs(this->env()->context());
+                            Local<Value> argv[] = {
+                                String::NewFromUtf8(this->env()->isolate(),
+                                                    "DTLS handshake timeout")
+                                    .ToLocalChecked(),
+                            };
+                            EmitCallback(DTLS_CB_SESSION_ERROR, 1, argv);
+                            return;
+                          }
+                          Cycle();
+                        }),
+      remote_address_(remote),
+      is_server_(is_server),
+      state_(env->isolate()),
+      stats_(env->isolate()) {
+  MakeWeak();
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, created_at);
+  retransmit_timer_.Unref();
+
+  // Update shared state.
+  state_->handshaking = 1;
+  state_->open = 0;
+
+  // Store this session in SSL app data for callbacks.
+  SSL_set_app_data(ssl_.get(), this);
+
+  // Enable keylog for TLS key export (useful for Wireshark debugging).
+  SSL_CTX_set_keylog_callback(SSL_get_SSL_CTX(ssl_.get()), SSLKeylogCallback);
+
+  // Set the MTU on the SSL object.
+  SSL_set_mtu(ssl_.get(), endpoint->mtu());
+}
+
+DTLSSession::~DTLSSession() = default;
+
+Local<FunctionTemplate> DTLSSession::GetConstructorTemplate(Environment* env) {
+  auto tmpl = env->dtls_session_constructor_template();
+  if (tmpl.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    tmpl = NewFunctionTemplate(isolate, New);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "DTLSSession"));
+    tmpl->InstanceTemplate()->SetInternalFieldCount(
+        AsyncWrap::kInternalFieldCount);
+
+    SetProtoMethod(isolate, tmpl, "send", DoSend);
+    SetProtoMethod(isolate, tmpl, "close", DoClose);
+    SetProtoMethod(isolate, tmpl, "destroy", DoDestroy);
+    SetProtoMethod(isolate, tmpl, "getState", GetState);
+    SetProtoMethod(isolate, tmpl, "getStats", GetStats);
+    SetProtoMethod(isolate, tmpl, "getRemoteAddress", GetRemoteAddress);
+    SetProtoMethod(isolate, tmpl, "getProtocol", GetProtocol);
+    SetProtoMethod(isolate, tmpl, "getCipher", GetCipher);
+    SetProtoMethod(isolate, tmpl, "getPeerCertificate", GetPeerCertificate);
+    SetProtoMethod(isolate, tmpl, "getALPNProtocol", GetALPNProtocol);
+    SetProtoMethod(isolate, tmpl, "exportKeyingMaterial", ExportKeyingMaterial);
+    SetProtoMethod(isolate, tmpl, "getSRTPProfile", GetSRTPProfile);
+    SetProtoMethod(isolate, tmpl, "getServername", GetServername);
+
+    env->set_dtls_session_constructor_template(tmpl);
+  }
+  return tmpl;
+}
+
+void DTLSSession::InitPerContext(Local<Object> target,
+                                 Local<Context> context,
+                                 Environment* env) {
+  SetConstructorFunction(
+      context, target, "DTLSSession", GetConstructorTemplate(env));
+}
+
+void DTLSSession::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(DoSend);
+  registry->Register(DoClose);
+  registry->Register(DoDestroy);
+  registry->Register(GetState);
+  registry->Register(GetStats);
+  registry->Register(GetRemoteAddress);
+  registry->Register(GetProtocol);
+  registry->Register(GetCipher);
+  registry->Register(GetPeerCertificate);
+  registry->Register(GetALPNProtocol);
+  registry->Register(ExportKeyingMaterial);
+  registry->Register(GetSRTPProfile);
+  registry->Register(GetServername);
+}
+
+BaseObjectPtr<DTLSSession> DTLSSession::Create(Environment* env,
+                                               DTLSEndpoint* endpoint,
+                                               SSL_CTX* ssl_ctx,
+                                               const SocketAddress& remote,
+                                               bool is_server,
+                                               const char* servername,
+                                               const char* verify_host,
+                                               bool verify_is_ip) {
+  // Create the SSL object.
+  SSL* ssl_raw = SSL_new(ssl_ctx);
+  if (ssl_raw == nullptr) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "SSL_new failed");
+    return {};
+  }
+
+  ncrypto::SSLPointer ssl(ssl_raw);
+
+  // Create memory BIOs for encrypted data I/O.
+  auto enc_in = ncrypto::BIOPointer::NewMem();
+  auto enc_out = ncrypto::BIOPointer::NewMem();
+  if (!enc_in || !enc_out) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "BIO_new failed");
+    return {};
+  }
+
+  // Make the BIOs non-blocking.
+  BIO_set_mem_eof_return(enc_in.get(), -1);
+  BIO_set_mem_eof_return(enc_out.get(), -1);
+
+  // Associate BIOs with the SSL object. SSL_set_bio takes ownership.
+  BIO* enc_in_raw = enc_in.release();
+  BIO* enc_out_raw = enc_out.release();
+  SSL_set_bio(ssl.get(), enc_in_raw, enc_out_raw);
+
+  // Set the MTU (since we use SSL_OP_NO_QUERY_MTU).
+  SSL_set_mtu(ssl.get(), endpoint->mtu());
+
+  // Set the handshake direction.
+  if (is_server) {
+    SSL_set_accept_state(ssl.get());
+  } else {
+    SSL_set_connect_state(ssl.get());
+
+    // Configure SNI and peer identity verification BEFORE the handshake
+    // starts. The caller (DTLSEndpoint::Connect) runs Cycle() immediately
+    // after Create() returns, which emits the ClientHello, so anything that
+    // must appear in that flight (SNI) has to be set here rather than via a
+    // post-construction setter.
+    if (servername != nullptr && servername[0] != '\0') {
+      if (!SSL_set_tlsext_host_name(ssl.get(), servername)) {
+        THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                          "Failed to set servername (SNI)");
+        return {};
+      }
+    }
+
+    // When identity verification is requested, bind the expected peer name
+    // (or IP) into the verification parameters. Combined with the context's
+    // SSL_VERIFY_PEER mode this makes a name mismatch fail the handshake,
+    // rather than accepting any certificate that merely chains to a trusted
+    // CA. A failure to configure it is fatal: proceeding would silently skip
+    // the identity check.
+    if (verify_host != nullptr && verify_host[0] != '\0') {
+      if (verify_is_ip) {
+        if (!X509_VERIFY_PARAM_set1_ip_asc(SSL_get0_param(ssl.get()),
+                                           verify_host)) {
+          THROW_ERR_CRYPTO_OPERATION_FAILED(
+              env, "Failed to set peer IP address for verification");
+          return {};
+        }
+      } else {
+        SSL_set_hostflags(ssl.get(), X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+        if (!SSL_set1_host(ssl.get(), verify_host)) {
+          THROW_ERR_CRYPTO_OPERATION_FAILED(
+              env, "Failed to set peer hostname for verification");
+          return {};
+        }
+      }
+    }
+  }
+
+  // Create the JS wrapper object.
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(env);
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj)) {
+    return {};
+  }
+
+  auto session = MakeBaseObject<DTLSSession>(env,
+                                             obj,
+                                             endpoint,
+                                             std::move(ssl),
+                                             enc_in_raw,
+                                             enc_out_raw,
+                                             remote,
+                                             is_server);
+
+  return session;
+}
+
+BaseObjectPtr<DTLSSession> DTLSSession::CreateFromSSL(
+    Environment* env,
+    DTLSEndpoint* endpoint,
+    ncrypto::SSLPointer ssl,
+    BIO* enc_in,
+    BIO* enc_out,
+    const SocketAddress& remote) {
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(env);
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj)) {
+    return {};
+  }
+
+  return MakeBaseObject<DTLSSession>(env,
+                                     obj,
+                                     endpoint,
+                                     std::move(ssl),
+                                     enc_in,
+                                     enc_out,
+                                     remote,
+                                     true /* is_server */);
+}
+
+void DTLSSession::New(const FunctionCallbackInfo<Value>& args) {
+  // Sessions are created internally via DTLSSession::Create,
+  // not directly from JS.
+  CHECK(args.IsConstructCall());
+}
+
+void DTLSSession::Receive(const uint8_t* data, size_t len) {
+  if (destroyed_ || closed_) return;
+
+  // Write the encrypted datagram into enc_in_ BIO.
+  int written = BIO_write(enc_in_, data, len);
+  if (written <= 0) return;
+
+  // Run the state machine.
+  Cycle();
+}
+
+void DTLSSession::Cycle() {
+  if (destroyed_) return;
+
+  // Pin a strong reference to ourselves for the duration of the pump. A JS
+  // callback dispatched below (message/handshake/error) can synchronously
+  // destroy this session, which removes the endpoint's only strong reference
+  // and would otherwise free `this` while we are still using ssl_/state_.
+  BaseObjectPtr<DTLSSession> strong_ref{this};
+
+  // Prevent infinite recursion.
+  if (++cycle_depth_ > 1) {
+    cycle_depth_--;
+    return;
+  }
+
+  HandleScope handle_scope(env()->isolate());
+  Context::Scope context_scope(env()->context());
+
+  // If handshake is not yet complete, drive it forward.
+  if (!handshake_complete_) {
+    int ret = SSL_do_handshake(ssl_.get());
+    if (ret <= 0) {
+      int err = SSL_get_error(ssl_.get(), ret);
+      if (err == SSL_ERROR_SSL) {
+        unsigned long ossl_err = ERR_get_error();  // NOLINT(runtime/int)
+        char err_buf[256];
+        ERR_error_string_n(ossl_err, err_buf, sizeof(err_buf));
+        // Flush any fatal alert OpenSSL queued for the peer before emitting the
+        // error, which tears the session down and detaches the endpoint.
+        EncOut();
+        Local<Value> argv[] = {
+            String::NewFromUtf8(env()->isolate(), err_buf).ToLocalChecked(),
+        };
+        EmitCallback(DTLS_CB_SESSION_ERROR, 1, argv);
+        cycle_depth_--;
+        return;
+      }
+      // SSL_ERROR_WANT_READ/WRITE is normal during handshake.
+    }
+    // Flush any handshake data produced.
+    EncOut();
+
+    // Check if handshake just completed.
+    if (SSL_is_init_finished(ssl_.get()) && !handshake_complete_) {
+      handshake_complete_ = true;
+      state_->handshaking = 0;
+      state_->open = 1;
+      DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, handshake_completed_at);
+
+      Local<Value> argv[] = {
+          String::NewFromUtf8(env()->isolate(), SSL_get_version(ssl_.get()))
+              .ToLocalChecked(),
+      };
+      EmitCallback(DTLS_CB_SESSION_HANDSHAKE, 1, argv);
+    }
+  }
+
+  // Read any decrypted application data.
+  ClearOut();
+  // Flush any pending encrypted output.
+  EncOut();
+
+  UpdateTimer();
+  cycle_depth_--;
+}
+
+void DTLSSession::ClearOut() {
+  if (destroyed_) return;
+
+  // Try to read decrypted application data from OpenSSL. A DTLS record's
+  // plaintext is at most 2^14 bytes, so one SSL_read yields at most that much.
+  uint8_t buf[16384];
+  int read;
+
+  while ((read = SSL_read(ssl_.get(), buf, sizeof(buf))) > 0) {
+    DTLS_STAT_INCREMENT_N(DTLSSessionStats, bytes_received, read);
+    DTLS_STAT_INCREMENT(DTLSSessionStats, messages_received);
+    // Emit the data to JS via callback.
+    Local<Value> argv[] = {
+        Buffer::Copy(env(), reinterpret_cast<const char*>(buf), read)
+            .ToLocalChecked(),
+    };
+    EmitCallback(DTLS_CB_SESSION_MESSAGE, 1, argv);
+    // The message handler may have destroyed the session synchronously; stop
+    // reading if so (Cycle()'s strong reference keeps `this` itself alive).
+    if (destroyed_) return;
+  }
+
+  int err = SSL_get_error(ssl_.get(), read);
+  switch (err) {
+    case SSL_ERROR_WANT_READ:
+    case SSL_ERROR_WANT_WRITE:
+      // Normal - need more data or need to flush.
+      break;
+
+    case SSL_ERROR_ZERO_RETURN:
+      // Peer sent close_notify.
+      if (!closed_) {
+        closed_ = true;
+        state_->closing = 1;
+        state_->open = 0;
+        // Send our close_notify back.
+        SSL_shutdown(ssl_.get());
+        EncOut();
+        // Detach from the endpoint's session table before notifying JS so an
+        // observer of the close sees a consistent session count. Cycle() holds
+        // a strong reference for the duration of the pump.
+        if (auto ep = endpoint_.get()) ep->RemoveSession(remote_address_);
+        Local<Value> argv[] = {};
+        EmitCallback(DTLS_CB_SESSION_CLOSE, 0, argv);
+        Destroy();
+      }
+      break;
+
+    case SSL_ERROR_SSL: {
+      // SSL error during handshake or data exchange.
+      unsigned long ossl_err = ERR_get_error();  // NOLINT(runtime/int)
+      char err_buf[256];
+      ERR_error_string_n(ossl_err, err_buf, sizeof(err_buf));
+      // Flush any fatal alert OpenSSL queued for the peer before emitting the
+      // error, which tears the session down and detaches the endpoint.
+      EncOut();
+      Local<Value> argv[] = {
+          String::NewFromUtf8(env()->isolate(), err_buf).ToLocalChecked(),
+      };
+      EmitCallback(DTLS_CB_SESSION_ERROR, 1, argv);
+      break;
+    }
+
+    default:
+      break;
+  }
+}
+
+void DTLSSession::EncOut() {
+  if (destroyed_) return;
+  auto ep = endpoint_.get();
+  if (ep == nullptr) return;
+
+  // Read encrypted data from enc_out_ BIO and send via UDP.
+  // Read in a loop since there may be multiple DTLS records.
+  uint8_t buf[65536];
+  int read;
+  while ((read = BIO_read(enc_out_, buf, sizeof(buf))) > 0) {
+    ep->SendTo(remote_address_, buf, read);
+  }
+}
+
+void DTLSSession::UpdateTimer() {
+  if (destroyed_) return;
+
+  struct timeval tv;
+  if (DTLSv1_get_timeout(ssl_.get(), &tv)) {
+    uint64_t timeout_ms = tv.tv_sec * 1000 + tv.tv_usec / 1000;
+    if (timeout_ms == 0) timeout_ms = 1;  // Minimum 1ms.
+    retransmit_timer_.Update(timeout_ms);
+  } else {
+    // No timeout needed (handshake complete or not started).
+    retransmit_timer_.Stop();
+  }
+}
+
+int DTLSSession::Send(const uint8_t* data, size_t len) {
+  if (destroyed_ || closed_) return -1;
+
+  if (!handshake_complete_) {
+    // Can't send application data before handshake.
+    return -1;
+  }
+
+  int written = SSL_write(ssl_.get(), data, len);
+  if (written > 0) {
+    DTLS_STAT_INCREMENT_N(DTLSSessionStats, bytes_sent, written);
+    DTLS_STAT_INCREMENT(DTLSSessionStats, messages_sent);
+    EncOut();
+  }
+  return written;
+}
+
+void DTLSSession::Close() {
+  if (destroyed_ || closed_) return;
+
+  // Emitting the close below can synchronously free this session (a client
+  // session that owns its endpoint tears the endpoint -- and thus itself --
+  // down from the close callback), and we call Destroy() afterwards. Pin a
+  // strong reference so `this` survives until we return.
+  BaseObjectPtr<DTLSSession> strong_ref{this};
+
+  closed_ = true;
+  state_->closing = 1;
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, closing_at);
+
+  // Send close_notify.
+  int ret = SSL_shutdown(ssl_.get());
+  if (ret == 0) {
+    // Need to call again for bidirectional shutdown.
+    SSL_shutdown(ssl_.get());
+  }
+  EncOut();
+
+  retransmit_timer_.Stop();
+
+  state_->open = 0;
+
+  // Detach from the endpoint's session table before notifying JS, so an
+  // observer of the close (e.g. one awaiting `closed`) sees a consistent
+  // session count. We stay alive via strong_ref, and endpoint_ remains valid
+  // for the callback below; the Destroy() that follows clears it.
+  if (auto ep = endpoint_.get()) ep->RemoveSession(remote_address_);
+
+  // Notify JS.
+  HandleScope handle_scope(env()->isolate());
+  Context::Scope context_scope(env()->context());
+  Local<Value> argv[] = {};
+  EmitCallback(DTLS_CB_SESSION_CLOSE, 0, argv);
+
+  // Release the remaining resources. RemoveSession above already detached us,
+  // so the one inside Destroy() is a no-op.
+  Destroy();
+}
+
+void DTLSSession::Destroy() {
+  if (destroyed_) return;
+  destroyed_ = true;
+  closed_ = true;
+
+  state_->destroyed = 1;
+  DTLS_STAT_RECORD_TIMESTAMP(DTLSSessionStats, destroyed_at);
+  state_->open = 0;
+  state_->handshaking = 0;
+
+  retransmit_timer_.Close();
+
+  // Promote to strong ref to keep endpoint alive during removal,
+  // then release our weak pointer.
+  BaseObjectPtr<DTLSEndpoint> ep = endpoint_;
+  endpoint_.reset();
+  if (ep) ep->RemoveSession(remote_address_);
+}
+
+void DTLSSession::SSLKeylogCallback(const SSL* ssl, const char* line) {
+  DTLSSession* session = static_cast<DTLSSession*>(SSL_get_app_data(ssl));
+  if (session == nullptr || session->destroyed_) return;
+
+  HandleScope handle_scope(session->env()->isolate());
+  Context::Scope context_scope(session->env()->context());
+
+  Local<Value> argv[] = {
+      String::NewFromUtf8(session->env()->isolate(), line).ToLocalChecked(),
+  };
+  session->EmitCallback(DTLS_CB_SESSION_KEYLOG, 1, argv);
+}
+
+MaybeLocal<Value> DTLSSession::EmitCallback(int cb_index,
+                                            int argc,
+                                            Local<Value>* argv) {
+  auto ep = endpoint_.get();
+  if (ep == nullptr) return MaybeLocal<Value>();
+  Local<Function> cb = ep->GetCallback(cb_index);
+  if (cb.IsEmpty()) return MaybeLocal<Value>();
+
+  return MakeCallback(cb, argc, argv);
+}
+
+// --- JS binding methods ---
+
+void DTLSSession::DoSend(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  if (!Buffer::HasInstance(args[0])) {
+    return THROW_ERR_INVALID_ARG_TYPE(session->env(), "data must be a Buffer");
+  }
+
+  const uint8_t* data = reinterpret_cast<const uint8_t*>(Buffer::Data(args[0]));
+  size_t len = Buffer::Length(args[0]);
+
+  int written = session->Send(data, len);
+  args.GetReturnValue().Set(written);
+}
+
+void DTLSSession::DoClose(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  session->Close();
+}
+
+void DTLSSession::DoDestroy(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  session->Destroy();
+}
+
+void DTLSSession::GetState(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  args.GetReturnValue().Set(session->state_.GetArrayBuffer());
+}
+
+void DTLSSession::GetStats(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  args.GetReturnValue().Set(session->stats_.GetArrayBuffer());
+}
+
+void DTLSSession::GetRemoteAddress(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  Local<Object> obj;
+  if (session->remote_address_.ToJS(env).ToLocal(&obj)) {
+    args.GetReturnValue().Set(obj);
+  }
+}
+
+void DTLSSession::GetProtocol(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const char* version = SSL_get_version(session->ssl_.get());
+  args.GetReturnValue().Set(
+      String::NewFromUtf8(session->env()->isolate(), version).ToLocalChecked());
+}
+
+void DTLSSession::GetCipher(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  const SSL_CIPHER* cipher = SSL_get_current_cipher(session->ssl_.get());
+  if (cipher == nullptr) return;
+
+  Local<Object> info = Object::New(env->isolate());
+  info->Set(env->context(),
+            FIXED_ONE_BYTE_STRING(env->isolate(), "name"),
+            String::NewFromUtf8(env->isolate(), SSL_CIPHER_get_name(cipher))
+                .ToLocalChecked())
+      .Check();
+  info->Set(
+          env->context(),
+          FIXED_ONE_BYTE_STRING(env->isolate(), "standardName"),
+          String::NewFromUtf8(env->isolate(), SSL_CIPHER_standard_name(cipher))
+              .ToLocalChecked())
+      .Check();
+  info->Set(env->context(),
+            FIXED_ONE_BYTE_STRING(env->isolate(), "version"),
+            String::NewFromUtf8(env->isolate(), SSL_CIPHER_get_version(cipher))
+                .ToLocalChecked())
+      .Check();
+
+  args.GetReturnValue().Set(info);
+}
+
+void DTLSSession::GetPeerCertificate(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  X509* peer_cert = SSL_get0_peer_certificate(session->ssl_.get());
+  if (peer_cert == nullptr) return;
+
+  // Return the PEM-encoded certificate.
+  auto bio = ncrypto::BIOPointer::NewMem();
+  if (PEM_write_bio_X509(bio.get(), peer_cert)) {
+    char* data;
+    long len = BIO_get_mem_data(bio.get(), &data);  // NOLINT(runtime/int)
+    if (len > 0) {
+      args.GetReturnValue().Set(
+          String::NewFromUtf8(
+              env->isolate(), data, v8::NewStringType::kNormal, len)
+              .ToLocalChecked());
+    }
+  }
+}
+
+void DTLSSession::GetALPNProtocol(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const unsigned char* alpn = nullptr;
+  unsigned int alpn_len = 0;
+  SSL_get0_alpn_selected(session->ssl_.get(), &alpn, &alpn_len);
+
+  if (alpn != nullptr && alpn_len > 0) {
+    args.GetReturnValue().Set(
+        String::NewFromUtf8(session->env()->isolate(),
+                            reinterpret_cast<const char*>(alpn),
+                            v8::NewStringType::kNormal,
+                            alpn_len)
+            .ToLocalChecked());
+  }
+}
+
+void DTLSSession::ExportKeyingMaterial(
+    const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = session->env();
+
+  if (!args[0]->IsNumber() || !args[1]->IsString()) {
+    return THROW_ERR_INVALID_ARG_TYPE(
+        env, "Expected (length: number, label: string[, context: Buffer])");
+  }
+
+  int length = args[0]->Int32Value(env->context()).FromJust();
+  Utf8Value label(env->isolate(), args[1]);
+
+  const uint8_t* context_value = nullptr;
+  size_t context_len = 0;
+  bool use_context = false;
+
+  if (args.Length() > 2 && Buffer::HasInstance(args[2])) {
+    context_value = reinterpret_cast<const uint8_t*>(Buffer::Data(args[2]));
+    context_len = Buffer::Length(args[2]);
+    use_context = true;
+  }
+
+  std::vector<uint8_t> out(length);
+  int ret = SSL_export_keying_material(session->ssl_.get(),
+                                       out.data(),
+                                       length,
+                                       *label,
+                                       label.length(),
+                                       context_value,
+                                       context_len,
+                                       use_context ? 1 : 0);
+
+  if (ret != 1) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "SSL_export_keying_material failed");
+  }
+
+  args.GetReturnValue().Set(
+      Buffer::Copy(env, reinterpret_cast<const char*>(out.data()), length)
+          .ToLocalChecked());
+}
+
+void DTLSSession::GetSRTPProfile(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const SRTP_PROTECTION_PROFILE* profile =
+      SSL_get_selected_srtp_profile(session->ssl_.get());
+
+  if (profile != nullptr) {
+    args.GetReturnValue().Set(
+        String::NewFromUtf8(session->env()->isolate(), profile->name)
+            .ToLocalChecked());
+  }
+}
+
+void DTLSSession::GetServername(const FunctionCallbackInfo<Value>& args) {
+  DTLSSession* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+
+  const char* servername =
+      SSL_get_servername(session->ssl_.get(), TLSEXT_NAMETYPE_host_name);
+  if (servername != nullptr) {
+    args.GetReturnValue().Set(
+        String::NewFromUtf8(session->env()->isolate(), servername)
+            .ToLocalChecked());
+  }
+}
+
+void DTLSSession::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("remote_address", remote_address_);
+}
+
+}  // namespace dtls
+}  // namespace node
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
diff --git a/src/dtls/dtls_session.h b/src/dtls/dtls_session.h
new file mode 100644
index 000000000000..162752b6eb4c
--- /dev/null
+++ b/src/dtls/dtls_session.h
@@ -0,0 +1,183 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#if HAVE_OPENSSL && HAVE_DTLS
+
+#include <aliased_struct.h>
+#include <async_wrap.h>
+#include <base_object.h>
+#include <env.h>
+#include <ncrypto.h>
+#include <node_sockaddr.h>
+#include <timer_wrap.h>
+#include <uv.h>
+#include <v8.h>
+
+#include <openssl/bio.h>
+#include <openssl/ssl.h>
+
+#include "dtls.h"
+
+namespace node::dtls {
+
+class DTLSEndpoint;
+
+// Shared C++ <-> JS state for a DTLS session.
+struct DTLSSessionStateData {
+  uint8_t handshaking = 0;
+  uint8_t open = 0;
+  uint8_t closing = 0;
+  uint8_t destroyed = 0;
+  uint8_t has_message_listener = 0;
+};
+
+// Stats collected for a DTLS session, backed by a BigUint64Array.
+struct DTLSSessionStats {
+  DTLS_SESSION_STATS(DTLS_STAT_FIELD)
+};
+
+// DTLSSession represents a single DTLS association with a remote peer.
+// It wraps an OpenSSL SSL* object configured for DTLS, using memory BIOs
+// to interface with the endpoint's UDP socket.
+class DTLSSession final : public AsyncWrap {
+ public:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+  static void InitPerContext(v8::Local<v8::Object> target,
+                             v8::Local<v8::Context> context,
+                             Environment* env);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  // Create a new DTLS session.
+  // |endpoint| - the owning endpoint (for sending packets)
+  // |ssl_ctx| - the SSL_CTX to create the SSL* from
+  // |remote| - the peer address
+  // |is_server| - true if this is a server-side session
+  // |servername|   - SNI to advertise (client only); nullptr to omit.
+  // |verify_host|  - expected peer identity to verify (client only);
+  //                  nullptr disables identity checking.
+  // |verify_is_ip| - true if |verify_host| is an IP literal (verified
+  //                  against iPAddress SANs) rather than a DNS name.
+  static BaseObjectPtr<DTLSSession> Create(Environment* env,
+                                           DTLSEndpoint* endpoint,
+                                           SSL_CTX* ssl_ctx,
+                                           const SocketAddress& remote,
+                                           bool is_server,
+                                           const char* servername = nullptr,
+                                           const char* verify_host = nullptr,
+                                           bool verify_is_ip = false);
+
+  // Create a session from an already-initialized SSL object.
+  // Used by the server after DTLSv1_listen() returns 1 — the SSL
+  // has already verified the cookie and is ready to continue.
+  static BaseObjectPtr<DTLSSession> CreateFromSSL(Environment* env,
+                                                  DTLSEndpoint* endpoint,
+                                                  ncrypto::SSLPointer ssl,
+                                                  BIO* enc_in,
+                                                  BIO* enc_out,
+                                                  const SocketAddress& remote);
+
+  ~DTLSSession() override;
+
+  // Called by the endpoint when a datagram arrives from this session's peer.
+  void Receive(const uint8_t* data, size_t len);
+
+  // Send application data to the peer.
+  int Send(const uint8_t* data, size_t len);
+
+  // Initiate a graceful shutdown (sends close_notify).
+  void Close();
+
+  // Immediately destroy the session without sending close_notify.
+  void Destroy();
+
+  const SocketAddress& remote_address() const { return remote_address_; }
+  bool is_server() const { return is_server_; }
+  bool is_handshake_complete() const { return handshake_complete_; }
+  bool is_closed() const { return closed_; }
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(DTLSSession)
+  SET_SELF_SIZE(DTLSSession)
+
+  // Public constructor required by MakeBaseObject<>.
+  DTLSSession(Environment* env,
+              v8::Local<v8::Object> wrap,
+              DTLSEndpoint* endpoint,
+              ncrypto::SSLPointer ssl,
+              BIO* enc_in,
+              BIO* enc_out,
+              const SocketAddress& remote,
+              bool is_server);
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoSend(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoClose(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoDestroy(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetState(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetStats(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetRemoteAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCipher(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetPeerCertificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetALPNProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void ExportKeyingMaterial(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetSRTPProfile(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+ public:
+  // The core state machine pump. Processes pending OpenSSL I/O:
+  //   1. ClearOut() - SSL_read() -> emit decrypted data to JS
+  //   2. ClearIn()  - SSL_write() pending cleartext
+  //   3. EncOut()   - read enc_out_ BIO -> send via endpoint UDP
+  //   4. UpdateTimer() - schedule retransmit timer if needed
+  void Cycle();
+
+ private:
+  // Read decrypted application data from OpenSSL and emit to JS.
+  void ClearOut();
+
+  // Flush encrypted data from enc_out_ BIO and send via the endpoint.
+  void EncOut();
+
+  // Update the DTLS retransmission timer based on OpenSSL's timeout.
+  void UpdateTimer();
+
+  // OpenSSL keylog callback.
+  static void SSLKeylogCallback(const SSL* ssl, const char* line);
+
+  // Emit a callback to JS via the endpoint's callback dispatch.
+  v8::MaybeLocal<v8::Value> EmitCallback(int cb_index,
+                                         int argc,
+                                         v8::Local<v8::Value>* argv);
+
+  BaseObjectWeakPtr<DTLSEndpoint> endpoint_;
+  ncrypto::SSLPointer ssl_;
+
+  // Memory BIOs: encrypted data flows through these.
+  // enc_in_: network datagrams written here -> SSL_read() extracts cleartext
+  // enc_out_: SSL_write() puts ciphertext here -> we read and send via UDP
+  BIO* enc_in_ = nullptr;
+  BIO* enc_out_ = nullptr;
+
+  TimerWrapHandle retransmit_timer_;
+
+  SocketAddress remote_address_;
+  bool is_server_;
+  bool handshake_complete_ = false;
+  bool closed_ = false;
+  bool destroyed_ = false;
+  int cycle_depth_ = 0;
+
+  AliasedStruct<DTLSSessionStateData> state_;
+  AliasedStruct<DTLSSessionStats> stats_;
+};
+
+}  // namespace node::dtls
+
+#endif  // HAVE_OPENSSL && HAVE_DTLS
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/env-inl.h b/src/env-inl.h
index efabadbcc0bc..e41afd25ffc3 100644
--- a/src/env-inl.h
+++ b/src/env-inl.h
@@ -221,7 +221,7 @@ inline cppgc::AllocationHandle& Environment::cppgc_allocation_handle() const {
 
 inline v8::ExternalMemoryAccounter* Environment::external_memory_accounter()
     const {
-  return external_memory_accounter_;
+  return external_memory_accounter_.get();
 }
 
 inline Environment* Environment::from_timer_handle(uv_timer_t* handle) {
@@ -923,26 +923,60 @@ inline void Environment::set_heap_snapshot_near_heap_limit(uint32_t limit) {
   heap_snapshot_near_heap_limit_ = limit;
 }
 
+inline void Environment::set_heap_profile_near_heap_limit(uint32_t limit) {
+  heap_profile_near_heap_limit_ = limit;
+}
+
 inline bool Environment::is_in_heapsnapshot_heap_limit_callback() const {
   return is_in_heapsnapshot_heap_limit_callback_;
 }
 
+inline bool Environment::is_in_heap_profile_near_heap_limit_callback() const {
+  return is_in_heap_profile_near_heap_limit_callback_;
+}
+
 inline bool Environment::report_exclude_env() const {
   return options_->report_exclude_env;
 }
 
 inline void Environment::AddHeapSnapshotNearHeapLimitCallback() {
   DCHECK(!heapsnapshot_near_heap_limit_callback_added_);
+  const bool was_registered = heap_profile_near_heap_limit_callback_added_;
   heapsnapshot_near_heap_limit_callback_added_ = true;
-  isolate_->AddNearHeapLimitCallback(Environment::NearHeapLimitCallback, this);
+  if (!was_registered) {
+    isolate_->AddNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                       this);
+  }
 }
 
 inline void Environment::RemoveHeapSnapshotNearHeapLimitCallback(
     size_t heap_limit) {
   DCHECK(heapsnapshot_near_heap_limit_callback_added_);
   heapsnapshot_near_heap_limit_callback_added_ = false;
-  isolate_->RemoveNearHeapLimitCallback(Environment::NearHeapLimitCallback,
-                                        heap_limit);
+  if (!heap_profile_near_heap_limit_callback_added_) {
+    isolate_->RemoveNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                          heap_limit);
+  }
+}
+
+inline void Environment::AddHeapProfileNearHeapLimitCallback() {
+  DCHECK(!heap_profile_near_heap_limit_callback_added_);
+  const bool was_registered = heapsnapshot_near_heap_limit_callback_added_;
+  heap_profile_near_heap_limit_callback_added_ = true;
+  if (!was_registered) {
+    isolate_->AddNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                       this);
+  }
+}
+
+inline void Environment::RemoveHeapProfileNearHeapLimitCallback(
+    size_t heap_limit) {
+  DCHECK(heap_profile_near_heap_limit_callback_added_);
+  heap_profile_near_heap_limit_callback_added_ = false;
+  if (!heapsnapshot_near_heap_limit_callback_added_) {
+    isolate_->RemoveNearHeapLimitCallback(Environment::NearHeapLimitCallback,
+                                          heap_limit);
+  }
 }
 
 }  // namespace node
diff --git a/src/env.cc b/src/env.cc
index b381cc341734..5626b2a7e10e 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -9,13 +9,18 @@
 #include "node_context_data.h"
 #include "node_contextify.h"
 #include "node_errors.h"
+#include "node_file_utils.h"
 #include "node_internals.h"
 #include "node_options-inl.h"
 #include "node_process-inl.h"
+#include "node_profiling.h"
 #include "node_shadow_realm.h"
 #include "node_snapshotable.h"
 #include "node_v8_platform-inl.h"
 #include "node_worker.h"
+#if HAVE_OPENSSL
+#include "ncrypto.h"
+#endif
 #include "req_wrap-inl.h"
 #include "stream_base.h"
 #include "tracing/agent.h"
@@ -33,6 +38,7 @@
 #include <limits>
 #include <memory>
 #include <optional>
+#include <sstream>
 #include <unordered_map>
 
 namespace node {
@@ -851,7 +857,7 @@ Environment::Environment(IsolateData* isolate_data,
                          ThreadId thread_id,
                          std::string_view thread_name)
     : isolate_(isolate),
-      external_memory_accounter_(new ExternalMemoryAccounter()),
+      external_memory_accounter_(std::make_unique<ExternalMemoryAccounter>()),
       isolate_data_(isolate_data),
       async_hooks_(isolate, MAYBE_FIELD_PTR(env_info, async_hooks)),
       immediate_info_(isolate, MAYBE_FIELD_PTR(env_info, immediate_info)),
@@ -878,6 +884,14 @@ Environment::Environment(IsolateData* isolate_data,
                      ? AllocateEnvironmentThreadId().id
                      : thread_id.id),
       thread_name_(thread_name) {
+#if HAVE_OPENSSL && NCRYPTO_USE_OPENSSL3_PROVIDER
+  provider_digest_cache = std::make_unique<ncrypto::DigestCache>();
+  provider_cipher_cache = std::make_unique<ncrypto::CipherCache>();
+#if OPENSSL_WITH_EVP_MAC
+  provider_mac_cache = std::make_unique<ncrypto::MacCache>();
+#endif
+#endif
+
   if (!is_main_thread()) {
     // If this is a Worker thread, we can always safely use the parent's
     // Isolate's code cache because of the shared read-only heap.
@@ -895,6 +909,9 @@ Environment::Environment(IsolateData* isolate_data,
           isolate_data->snapshot_data()->code_cache);
     }
   }
+  if (is_main_thread() && !isolate_data->builtin_code_cache().empty()) {
+    builtin_loader()->RefreshCodeCache(isolate_data->builtin_code_cache());
+  }
 
   // Compile builtins eagerly when building the snapshot so that inner functions
   // of essential builtins that are loaded in the snapshot can have faster first
@@ -975,7 +992,12 @@ Environment::Environment(IsolateData* isolate_data,
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
-      options_->allow_native_addons = false;
+      // In audit mode addon loading must stay enabled: the denial is
+      // published through the diagnostics channel by the permission
+      // check in DLOpen() instead of being rejected upfront.
+      if (!options_->permission_audit) {
+        options_->allow_native_addons = false;
+      }
       permission()->Apply(this, args, permission::PermissionScope::kAddon);
     }
     if (!options_->allow_inspector) {
@@ -1101,6 +1123,9 @@ Environment::~Environment() {
   if (heapsnapshot_near_heap_limit_callback_added_) {
     RemoveHeapSnapshotNearHeapLimitCallback(0);
   }
+  if (heap_profile_near_heap_limit_callback_added_) {
+    RemoveHeapProfileNearHeapLimitCallback(0);
+  }
 
   isolate()->GetHeapProfiler()->RemoveBuildEmbedderGraphCallback(
       BuildEmbedderGraph, this);
@@ -1129,13 +1154,21 @@ Environment::~Environment() {
   // Also, since the main thread usually stops just before the process exits,
   // this is far less relevant here.
   if (!is_main_thread()) {
+#if HAVE_OPENSSL
+    // Provider methods can contain callbacks into native addons. Release the
+    // environment-owned methods before unloading any addon DSOs.
+    provider_digest_cache.reset();
+    provider_cipher_cache.reset();
+#if OPENSSL_WITH_EVP_MAC
+    provider_mac_cache.reset();
+#endif
+#endif
     // Dereference all addons that were loaded into this environment.
     for (binding::DLib& addon : loaded_addons_) {
       addon.Close();
     }
   }
 
-  delete external_memory_accounter_;
   if (cpu_profiler_) {
     for (auto& it : pending_profiles_) {
       cpu_profiler_->Stop(it);
@@ -2160,14 +2193,49 @@ void Environment::TracePromises(PromiseHookType type,
   PrintCurrentStackTrace(isolate);
 }
 
+// V8 only invokes the most recently registered near-heap-limit callback.
+// To allow the snapshot and profile handlers to coexist on the same
+// isolate, both register through this single V8-facing entry point. It fans
+// out to whichever sub-handlers are active and returns the largest requested
+// heap limit.
 size_t Environment::NearHeapLimitCallback(void* data,
                                           size_t current_heap_limit,
                                           size_t initial_heap_limit) {
   auto* env = static_cast<Environment*>(data);
 
+  // Profile and snapshot generation can allocate and invoke this callback
+  // recursively. Only extend the heap for the operation already in progress;
+  // do not start the other diagnostic from the nested invocation.
+  if (env->is_in_heapsnapshot_heap_limit_callback_) {
+    return HeapSnapshotNearHeapLimitCallback(
+        data, current_heap_limit, initial_heap_limit);
+  }
+  if (env->is_in_heap_profile_near_heap_limit_callback_) {
+    return HeapProfileNearHeapLimitCallback(
+        data, current_heap_limit, initial_heap_limit);
+  }
+
+  size_t new_limit = current_heap_limit;
+  if (env->heapsnapshot_near_heap_limit_callback_added_) {
+    new_limit = std::max(new_limit,
+                         HeapSnapshotNearHeapLimitCallback(
+                             data, current_heap_limit, initial_heap_limit));
+  }
+  if (env->heap_profile_near_heap_limit_callback_added_) {
+    new_limit = std::max(new_limit,
+                         HeapProfileNearHeapLimitCallback(
+                             data, current_heap_limit, initial_heap_limit));
+  }
+  return new_limit;
+}
+
+size_t Environment::HeapSnapshotNearHeapLimitCallback(
+    void* data, size_t current_heap_limit, size_t initial_heap_limit) {
+  auto* env = static_cast<Environment*>(data);
+
   Debug(env,
         DebugCategory::DIAGNOSTICS,
-        "Invoked NearHeapLimitCallback, processing=%d, "
+        "Invoked HeapSnapshotNearHeapLimitCallback, processing=%d, "
         "current_limit=%" PRIu64 ", "
         "initial_limit=%" PRIu64 "\n",
         env->is_in_heapsnapshot_heap_limit_callback_,
@@ -2289,6 +2357,85 @@ size_t Environment::NearHeapLimitCallback(void* data,
   return new_limit;
 }
 
+size_t Environment::HeapProfileNearHeapLimitCallback(
+    void* data, size_t current_heap_limit, size_t initial_heap_limit) {
+  auto* env = static_cast<Environment*>(data);
+
+  Debug(env,
+        DebugCategory::DIAGNOSTICS,
+        "Invoked HeapProfileNearHeapLimitCallback, processing=%d, "
+        "current_limit=%" PRIu64 ", "
+        "initial_limit=%" PRIu64 "\n",
+        env->is_in_heap_profile_near_heap_limit_callback_,
+        static_cast<uint64_t>(current_heap_limit),
+        static_cast<uint64_t>(initial_heap_limit));
+
+  const size_t max_young_gen_size = env->isolate_data()->max_young_gen_size;
+  const size_t new_limit = current_heap_limit + max_young_gen_size;
+
+  if (env->is_in_heap_profile_near_heap_limit_callback_) {
+    return new_limit;
+  }
+
+  env->is_in_heap_profile_near_heap_limit_callback_ = true;
+  auto reset_in_callback = OnScopeLeave(
+      [env]() { env->is_in_heap_profile_near_heap_limit_callback_ = false; });
+  auto restore_initial_limit = OnScopeLeave(
+      [env]() { env->isolate()->AutomaticallyRestoreInitialHeapLimit(0.95); });
+  auto uninstall_callback = [env]() {
+    env->RemoveHeapProfileNearHeapLimitCallback(0);
+  };
+
+  std::string dir = env->options()->diagnostic_dir;
+  if (dir.empty()) {
+    dir = Environment::GetCwd(env->exec_path_);
+  }
+  DiagnosticFilename name(env, "Heap", "heapprofile");
+  std::string filename = dir + kPathSeparator + (*name);
+
+  Debug(env, DebugCategory::DIAGNOSTICS, "Writing %s...\n", *name);
+
+  std::ostringstream out;
+  if (!node::SerializeHeapProfile(env->isolate(), out)) {
+    Debug(env,
+          DebugCategory::DIAGNOSTICS,
+          "No sampling heap profile active; uninstalling callback.\n");
+    uninstall_callback();
+    return new_limit;
+  }
+
+  std::string profile = std::move(out).str();
+  uv_buf_t buffer = uv_buf_init(profile.data(), profile.size());
+  const int err = WriteFileSync(filename.c_str(), buffer);
+  if (err != 0) {
+    FPrintF(stderr,
+            "Failed to write heap profile %s: %s\n",
+            filename,
+            uv_strerror(err));
+    uninstall_callback();
+    return new_limit;
+  }
+
+  env->heap_limit_profile_taken_ += 1;
+  FPrintF(stderr, "Wrote heap profile to %s\n", filename);
+
+  Debug(env,
+        DebugCategory::DIAGNOSTICS,
+        "%" PRIu32 "/%" PRIu32 " heap profiles written.\n",
+        env->heap_limit_profile_taken_,
+        env->heap_profile_near_heap_limit_);
+
+  if (env->heap_limit_profile_taken_ == env->heap_profile_near_heap_limit_) {
+    Debug(env,
+          DebugCategory::DIAGNOSTICS,
+          "Removing the near heap limit callback");
+    uninstall_callback();
+  }
+
+  // Returning a larger value is required by V8 even after the final write.
+  return new_limit;
+}
+
 inline size_t Environment::SelfSize() const {
   size_t size = sizeof(*this);
   // Remove non pointer fields that will be tracked in MemoryInfo()
diff --git a/src/env.h b/src/env.h
index 84fad81e7b34..4410ccb3e101 100644
--- a/src/env.h
+++ b/src/env.h
@@ -53,10 +53,6 @@
 #include "v8-profiler.h"
 #include "v8.h"
 
-#if HAVE_OPENSSL
-#include <openssl/evp.h>
-#endif
-
 #include <array>
 #include <atomic>
 #include <cstdint>
@@ -72,6 +68,12 @@
 #include <variant>
 #include <vector>
 
+namespace ncrypto {
+class CipherCache;
+class DigestCache;
+class MacCache;
+}  // namespace ncrypto
+
 namespace node {
 
 namespace shadow_realm {
@@ -166,6 +168,13 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   inline uv_loop_t* event_loop() const;
   inline MultiIsolatePlatform* platform() const;
   inline const SnapshotData* snapshot_data() const;
+  // See node::SetBuiltinCodeCache().
+  const std::vector<builtins::CodeCacheInfo>& builtin_code_cache() const {
+    return builtin_code_cache_;
+  }
+  void set_builtin_code_cache(std::vector<builtins::CodeCacheInfo> entries) {
+    builtin_code_cache_ = std::move(entries);
+  }
   inline std::shared_ptr<PerIsolateOptions> options();
 
   inline NodeArrayBufferAllocator* node_allocator() const;
@@ -255,6 +264,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   MultiIsolatePlatform* platform_;
 
   const SnapshotData* snapshot_data_;
+  std::vector<builtins::CodeCacheInfo> builtin_code_cache_;
   std::optional<SnapshotConfig> snapshot_config_;
 
   std::shared_ptr<PerIsolateOptions> options_;
@@ -997,6 +1007,12 @@ class Environment final : public MemoryRetainer {
   static size_t NearHeapLimitCallback(void* data,
                                       size_t current_heap_limit,
                                       size_t initial_heap_limit);
+  static size_t HeapSnapshotNearHeapLimitCallback(void* data,
+                                                  size_t current_heap_limit,
+                                                  size_t initial_heap_limit);
+  static size_t HeapProfileNearHeapLimitCallback(void* data,
+                                                 size_t current_heap_limit,
+                                                 size_t initial_heap_limit);
   static void BuildEmbedderGraph(v8::Isolate* isolate,
                                  v8::EmbedderGraph* graph,
                                  void* data);
@@ -1074,13 +1090,17 @@ class Environment final : public MemoryRetainer {
 
   inline void set_heap_snapshot_near_heap_limit(uint32_t limit);
   inline bool is_in_heapsnapshot_heap_limit_callback() const;
+  inline void set_heap_profile_near_heap_limit(uint32_t limit);
+  inline bool is_in_heap_profile_near_heap_limit_callback() const;
 
   inline bool report_exclude_env() const;
 
   inline void AddHeapSnapshotNearHeapLimitCallback();
-
   inline void RemoveHeapSnapshotNearHeapLimitCallback(size_t heap_limit);
 
+  inline void AddHeapProfileNearHeapLimitCallback();
+  inline void RemoveHeapProfileNearHeapLimitCallback(size_t heap_limit);
+
   v8::CpuProfilingResult StartCpuProfile(const CpuProfileOptions& options);
   v8::CpuProfile* StopCpuProfile(v8::ProfilerId profile_id);
 
@@ -1093,13 +1113,14 @@ class Environment final : public MemoryRetainer {
   };
 
 #if HAVE_OPENSSL
-#if OPENSSL_VERSION_MAJOR >= 3
-  // We declare another alias here to avoid having to include crypto_util.h
-  using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
-  std::vector<EVPMDPointer> evp_md_cache;
-#endif  // OPENSSL_VERSION_MAJOR >= 3
-  std::unordered_map<std::string, size_t> alias_to_md_id_map;
+  uint64_t hash_cache_generation = 0;
+  std::unique_ptr<ncrypto::DigestCache> provider_digest_cache;
+  std::unique_ptr<ncrypto::CipherCache> provider_cipher_cache;
   std::vector<std::string> supported_hash_algorithms;
+  uint64_t mac_cache_generation = 0;
+  std::unique_ptr<ncrypto::MacCache> provider_mac_cache;
+  std::vector<std::string> supported_mac_algorithms;
+  bool supported_mac_algorithms_initialized = false;
 #endif  // HAVE_OPENSSL
 
   v8::Global<v8::Module> temporary_required_module_facade_original;
@@ -1114,7 +1135,7 @@ class Environment final : public MemoryRetainer {
 
   std::list<binding::DLib> loaded_addons_;
   v8::Isolate* const isolate_;
-  v8::ExternalMemoryAccounter* const external_memory_accounter_;
+  const std::unique_ptr<v8::ExternalMemoryAccounter> external_memory_accounter_;
   IsolateData* const isolate_data_;
 
   bool env_handle_initialized_ = false;
@@ -1179,6 +1200,11 @@ class Environment final : public MemoryRetainer {
   uint32_t heap_snapshot_near_heap_limit_ = 0;
   bool heapsnapshot_near_heap_limit_callback_added_ = false;
 
+  bool is_in_heap_profile_near_heap_limit_callback_ = false;
+  uint32_t heap_limit_profile_taken_ = 0;
+  uint32_t heap_profile_near_heap_limit_ = 0;
+  bool heap_profile_near_heap_limit_callback_added_ = false;
+
   uint32_t module_id_counter_ = 0;
   uint32_t script_id_counter_ = 0;
   uint32_t function_id_counter_ = 0;
diff --git a/src/env_properties.h b/src/env_properties.h
index 4f0d55225d70..fc1772f926e5 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -240,12 +240,15 @@
   V(jwk_n_string, "n")                                                         \
   V(jwk_oct_string, "oct")                                                     \
   V(jwk_okp_string, "OKP")                                                     \
+  V(jwk_oth_string, "oth")                                                     \
   V(jwk_p_string, "p")                                                         \
   V(jwk_priv_string, "priv")                                                   \
   V(jwk_pub_string, "pub")                                                     \
   V(jwk_q_string, "q")                                                         \
   V(jwk_qi_string, "qi")                                                       \
+  V(jwk_r_string, "r")                                                         \
   V(jwk_rsa_string, "RSA")                                                     \
+  V(jwk_t_string, "t")                                                         \
   V(jwk_x_string, "x")                                                         \
   V(jwk_y_string, "y")                                                         \
   V(kill_signal_string, "killSignal")                                          \
@@ -433,11 +436,15 @@
   V(ephemeral_key_template, v8::DictionaryTemplate)                            \
   V(dir_instance_template, v8::ObjectTemplate)                                 \
   V(dns_ns_record_template, v8::DictionaryTemplate)                            \
+  V(dtls_context_constructor_template, v8::FunctionTemplate)                   \
+  V(dtls_endpoint_constructor_template, v8::FunctionTemplate)                  \
+  V(dtls_session_constructor_template, v8::FunctionTemplate)                   \
   V(fd_constructor_template, v8::ObjectTemplate)                               \
   V(fdclose_constructor_template, v8::ObjectTemplate)                          \
   V(ffi_dynamic_library_constructor_template, v8::FunctionTemplate)            \
   V(ffi_function_constructor_template, v8::FunctionTemplate)                   \
   V(filehandlereadwrap_template, v8::ObjectTemplate)                           \
+  V(fips_indicator_event_template, v8::DictionaryTemplate)                     \
   V(free_list_statistics_template, v8::DictionaryTemplate)                     \
   V(fsreqpromise_constructor_template, v8::ObjectTemplate)                     \
   V(handle_wrap_ctor_template, v8::FunctionTemplate)                           \
@@ -504,6 +511,7 @@
   V(async_hooks_promise_resolve_function, v8::Function)                        \
   V(buffer_prototype_object, v8::Object)                                       \
   V(crypto_internal_cryptokey_constructor, v8::Function)                       \
+  V(crypto_internal_x509_certificate_constructor, v8::Function)                \
   V(crypto_key_object_private_constructor, v8::Function)                       \
   V(crypto_key_object_public_constructor, v8::Function)                        \
   V(crypto_key_object_secret_constructor, v8::Function)                        \
diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 308bde60cae2..bc287ddd13f9 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -163,8 +163,7 @@ Maybe<void> ValidateStringLength(Environment* env, size_t len) {
 Maybe<std::pair<uint8_t*, size_t>> GetValidatedPointerAndOffset(
     Environment* env, const FunctionCallbackInfo<Value>& args) {
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -204,8 +203,7 @@ Maybe<PointerOffsetAndValue> GetValidatedPointerOffsetAndValue(
   size_t offset;
   Local<Value> value;
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -556,7 +554,7 @@ void ToBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -618,7 +616,7 @@ void ToArrayBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -671,7 +669,8 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() < 1) {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
@@ -689,18 +688,18 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   } else {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
   uintptr_t ptr;
-  if (args.Length() < 2 ||
-      !GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
+  if (!GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
     return;
   }
 
   size_t len;
-  if (args.Length() < 3 || !GetValidatedSize(env, args[2], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[2], "length").To(&len)) {
     return;
   }
 
diff --git a/src/histogram.cc b/src/histogram.cc
index 0997d3cb481c..f2b93d3b8be4 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -46,14 +46,8 @@ void StopHandleHistogram(Local<Value> receiver) {
   histogram->OnStop();
 }
 
-Histogram::Histogram(const Options& options) {
-  hdr_histogram* histogram;
-  CHECK_EQ(0, hdr_init(options.lowest,
-                       options.highest,
-                       options.figures,
-                       &histogram));
-  histogram_.reset(histogram);
-
+Histogram::Histogram(HistogramPointer histogram, const Options& options)
+    : histogram_(std::move(histogram)) {
   // alpha = 1 - 2^(-1/halfLife). With halfLife <= 0, EWMA is disabled.
   if (options.half_life > 0) {
     ewma_alpha_ = 1.0 - std::exp(-std::log(2.0) / options.half_life);
@@ -61,6 +55,15 @@ Histogram::Histogram(const Options& options) {
   threshold_ = options.threshold;
 }
 
+std::shared_ptr<Histogram> Histogram::Create(const Options& options) {
+  hdr_histogram* histogram;
+  if (hdr_init(options.lowest, options.highest, options.figures, &histogram) !=
+      0) {
+    return {};
+  }
+  return std::make_shared<Histogram>(HistogramPointer(histogram), options);
+}
+
 void Histogram::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackFieldWithSize("histogram", GetMemorySize());
 }
@@ -295,28 +298,29 @@ static double NormalCdf(double x) {
 
 // Student's t-distribution CDF: P(T <= t) for df degrees of freedom.
 static double StudentTCdf(double t, double df) {
-  double x = df / (df + t * t);
-  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
-  if (t >= 0.0) {
-    return 1.0 - 0.5 * ibeta;
+  double squared = t * t;
+  double denominator = df + squared;
+  if (squared < df) {
+    double x = squared / denominator;
+    double ibeta = RegularizedIncompleteBeta(0.5, df / 2.0, x);
+    return t >= 0.0 ? 0.5 + 0.5 * ibeta : 0.5 - 0.5 * ibeta;
   }
-  return 0.5 * ibeta;
+
+  double x = df / denominator;
+  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
+  return t >= 0.0 ? 1.0 - 0.5 * ibeta : 0.5 * ibeta;
 }
 
-// Student's t-distribution quantile (inverse CDF) using bisection.
-// Returns the value t such that P(T <= t) = p.
-static double StudentTQuantile(double p, double df) {
-  if (p <= 0.0) return -std::numeric_limits<double>::infinity();
-  if (p >= 1.0) return std::numeric_limits<double>::infinity();
-  if (p == 0.5) return 0.0;
+// Positive Student's t-distribution quantile for an upper-tail probability.
+// Using the lower tail avoids loss of precision for probabilities near 1.
+static double StudentTUpperQuantile(double p, double df) {
+  double lo = 0.0;
+  double hi = 1.0;
+  while (StudentTCdf(-hi, df) > p) hi *= 2.0;
 
-  // Bisection search. The range [-1e6, 1e6] is sufficient for any
-  // practical confidence level and degrees of freedom.
-  double lo = -1e6;
-  double hi = 1e6;
   for (int i = 0; i < 100; i++) {
     double mid = (lo + hi) / 2.0;
-    if (StudentTCdf(mid, df) < p) {
+    if (StudentTCdf(-mid, df) > p) {
       lo = mid;
     } else {
       hi = mid;
@@ -333,8 +337,176 @@ static double BinomialCdf(int64_t k, int64_t n, double p) {
   return RegularizedIncompleteBeta(
       static_cast<double>(n - k), static_cast<double>(k + 1), 1.0 - p);
 }
+
+// -----------------------------------------------------------------------
+// Minimal CBOR encoder/decoder (RFC 8949) -- just enough types for
+// histogram export/import: unsigned int, float64, array, and map.
+// -----------------------------------------------------------------------
+
+// CBOR major types (upper 3 bits of the initial byte).
+constexpr uint8_t kCborUint = 0 << 5;   // Major 0: unsigned integer
+constexpr uint8_t kCborArray = 4 << 5;  // Major 4: array
+constexpr uint8_t kCborMap = 5 << 5;    // Major 5: map
+constexpr uint8_t kCborFloat64 = 0xfb;  // Major 7, additional 27
+
+static void CborWriteUint(std::vector<uint8_t>& out,
+                          uint8_t major,
+                          uint64_t val) {
+  if (val <= 23) {
+    out.push_back(major | static_cast<uint8_t>(val));
+  } else if (val <= 0xff) {
+    out.push_back(major | 24);
+    out.push_back(static_cast<uint8_t>(val));
+  } else if (val <= 0xffff) {
+    out.push_back(major | 25);
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  } else if (val <= 0xffffffff) {
+    out.push_back(major | 26);
+    out.push_back(static_cast<uint8_t>(val >> 24));
+    out.push_back(static_cast<uint8_t>(val >> 16));
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  } else {
+    out.push_back(major | 27);
+    out.push_back(static_cast<uint8_t>(val >> 56));
+    out.push_back(static_cast<uint8_t>(val >> 48));
+    out.push_back(static_cast<uint8_t>(val >> 40));
+    out.push_back(static_cast<uint8_t>(val >> 32));
+    out.push_back(static_cast<uint8_t>(val >> 24));
+    out.push_back(static_cast<uint8_t>(val >> 16));
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  }
+}
+
+static void CborWriteFloat64(std::vector<uint8_t>& out, double val) {
+  out.push_back(kCborFloat64);
+  uint64_t bits;
+  memcpy(&bits, &val, sizeof(bits));
+  // Network byte order (big-endian).
+  out.push_back(static_cast<uint8_t>(bits >> 56));
+  out.push_back(static_cast<uint8_t>(bits >> 48));
+  out.push_back(static_cast<uint8_t>(bits >> 40));
+  out.push_back(static_cast<uint8_t>(bits >> 32));
+  out.push_back(static_cast<uint8_t>(bits >> 24));
+  out.push_back(static_cast<uint8_t>(bits >> 16));
+  out.push_back(static_cast<uint8_t>(bits >> 8));
+  out.push_back(static_cast<uint8_t>(bits));
+}
+
+static bool CborReadUint(const uint8_t*& p, const uint8_t* end, uint64_t* val) {
+  if (p >= end) return false;
+  uint8_t info = *p++ & 0x1f;
+  if (info <= 23) {
+    *val = info;
+  } else if (info == 24) {
+    if (p + 1 > end) return false;
+    *val = p[0];
+    p += 1;
+  } else if (info == 25) {
+    if (p + 2 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 8) | p[1];
+    p += 2;
+  } else if (info == 26) {
+    if (p + 4 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 24) |
+           (static_cast<uint64_t>(p[1]) << 16) |
+           (static_cast<uint64_t>(p[2]) << 8) | p[3];
+    p += 4;
+  } else if (info == 27) {
+    if (p + 8 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 56) |
+           (static_cast<uint64_t>(p[1]) << 48) |
+           (static_cast<uint64_t>(p[2]) << 40) |
+           (static_cast<uint64_t>(p[3]) << 32) |
+           (static_cast<uint64_t>(p[4]) << 24) |
+           (static_cast<uint64_t>(p[5]) << 16) |
+           (static_cast<uint64_t>(p[6]) << 8) | p[7];
+    p += 8;
+  } else {
+    return false;  // Indefinite length or reserved -- not supported.
+  }
+  return true;
+}
+
+static bool CborReadFloat64(const uint8_t*& p,
+                            const uint8_t* end,
+                            double* val) {
+  if (p >= end || *p != kCborFloat64) return false;
+  p++;
+  if (p + 8 > end) return false;
+  uint64_t bits = (static_cast<uint64_t>(p[0]) << 56) |
+                  (static_cast<uint64_t>(p[1]) << 48) |
+                  (static_cast<uint64_t>(p[2]) << 40) |
+                  (static_cast<uint64_t>(p[3]) << 32) |
+                  (static_cast<uint64_t>(p[4]) << 24) |
+                  (static_cast<uint64_t>(p[5]) << 16) |
+                  (static_cast<uint64_t>(p[6]) << 8) | p[7];
+  p += 8;
+  memcpy(val, &bits, sizeof(*val));
+  return true;
+}
+
+// Read a value that may be either a uint or float64.
+static bool CborReadNumber(const uint8_t*& p, const uint8_t* end, double* val) {
+  if (p >= end) return false;
+  if (*p == kCborFloat64) return CborReadFloat64(p, end, val);
+  uint64_t u;
+  if (!CborReadUint(p, end, &u)) return false;
+  *val = static_cast<double>(u);
+  return true;
+}
+
+// Histogram export format version.
+constexpr uint64_t kExportVersion = 1;
+
+// Integer keys for the top-level CBOR map.
+constexpr uint64_t kKeyVersion = 0;
+constexpr uint64_t kKeyLowest = 1;
+constexpr uint64_t kKeyHighest = 2;
+constexpr uint64_t kKeyFigures = 3;
+constexpr uint64_t kKeyTotalCount = 4;
+constexpr uint64_t kKeyMin = 5;
+constexpr uint64_t kKeyMax = 6;
+constexpr uint64_t kKeyNormOffset = 7;
+constexpr uint64_t kKeyConvRatio = 8;
+constexpr uint64_t kKeyCountsLen = 9;
+constexpr uint64_t kKeyCounts = 10;
+constexpr uint64_t kKeyEwma = 11;
+
+// Integer keys for the EWMA sub-map.
+constexpr uint64_t kEwmaAlpha = 0;
+constexpr uint64_t kEwmaMean = 1;
+constexpr uint64_t kEwmaVariance = 2;
+constexpr uint64_t kEwmaErrorRate = 3;
+constexpr uint64_t kEwmaThreshold = 4;
 }  // namespace
 
+Histogram::MeanCIResult Histogram::MeanCI(double confidence) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t count = histogram_->total_count;
+  double mean = hdr_mean(histogram_.get());
+  if (count < 2) {
+    double nan = std::numeric_limits<double>::quiet_NaN();
+    return {mean, nan, nan};
+  }
+
+  double stddev = hdr_stddev(histogram_.get());
+  if (stddev == 0.0) return {mean, mean, mean};
+
+  // HdrHistogram computes population stddev (divides by N). The confidence
+  // interval requires sample variance (divides by N-1).
+  double variance = stddev * stddev * static_cast<double>(count) /
+                    static_cast<double>(count - 1);
+  double standard_error = std::sqrt(variance / static_cast<double>(count));
+  double alpha = 1.0 - confidence;
+  double t_crit =
+      StudentTUpperQuantile(alpha / 2.0, static_cast<double>(count - 1));
+  double margin = t_crit * standard_error;
+  return {mean, mean - margin, mean + margin};
+}
+
 Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
                                                 double confidence) const {
   auto do_welch = [&]() -> WelchTestResult {
@@ -370,7 +542,7 @@ Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
 
     // Confidence interval on the difference of means.
     double alpha = 1.0 - confidence;
-    double t_crit = StudentTQuantile(1.0 - alpha / 2.0, df);
+    double t_crit = StudentTUpperQuantile(alpha / 2.0, df);
     double margin = t_crit * std::sqrt(se_sum);
     double diff = mean1 - mean2;
 
@@ -590,8 +762,319 @@ Histogram::PercentileCIResult Histogram::PercentileCI(double percentile,
   return {value, lower_val, upper_val};
 }
 
+// Serialize the histogram to a CBOR (RFC 8949) byte sequence. There is no
+// standard for serializing histograms, so this format is specific to this
+// implementation. But, it has been designed to be compact, extensible, and
+// portable across languages and platforms. Should be easily parseable in
+// other languages with or without a CBOR library.
+//
+// The delta-encoded sparse counts is a space-saving optimization in the
+// common case.
+//
+// Layout: a CBOR map with integer keys:
+//   0  -> uint    format version (currently 1)
+//   1  -> uint    lowest discernible value
+//   2  -> uint    highest trackable value
+//   3  -> uint    significant figures
+//   4  -> uint    total count
+//   5  -> uint    min value
+//   6  -> uint    max value
+//   7  -> uint    normalizing index offset
+//   8  -> float64 conversion ratio
+//   9  -> uint    counts array length
+//   10 -> array   delta-encoded sparse counts as flat [delta, count, ...]
+//                 (first delta is the absolute index)
+//   11 -> map     EWMA state (omitted when alpha = 0):
+//        0 -> float64 alpha
+//        1 -> float64 mean
+//        2 -> float64 variance
+//        3 -> float64 error rate
+//        4 -> uint    threshold
+std::vector<uint8_t> Histogram::Export() const {
+  RwLock::ScopedReadLock lock(mutex_);
+
+  // Count non-zero buckets for the sparse encoding.
+  int32_t non_zero = 0;
+  for (int32_t i = 0; i < histogram_->counts_len; i++) {
+    if (histogram_->counts[i] != 0) non_zero++;
+  }
+
+  bool has_ewma = ewma_alpha_ > 0;
+  uint64_t map_size = has_ewma ? 12 : 11;
+
+  std::vector<uint8_t> out;
+  out.reserve(64 + non_zero * 10);
+
+  // Top-level map.
+  CborWriteUint(out, kCborMap, map_size);
+
+  // 0: version
+  CborWriteUint(out, kCborUint, kKeyVersion);
+  CborWriteUint(out, kCborUint, kExportVersion);
+  // 1: lowest
+  CborWriteUint(out, kCborUint, kKeyLowest);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->lowest_discernible_value));
+  // 2: highest
+  CborWriteUint(out, kCborUint, kKeyHighest);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->highest_trackable_value));
+  // 3: figures
+  CborWriteUint(out, kCborUint, kKeyFigures);
+  CborWriteUint(
+      out, kCborUint, static_cast<uint64_t>(histogram_->significant_figures));
+  // 4: total_count
+  CborWriteUint(out, kCborUint, kKeyTotalCount);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->total_count));
+  // 5: min
+  CborWriteUint(out, kCborUint, kKeyMin);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->min_value));
+  // 6: max
+  CborWriteUint(out, kCborUint, kKeyMax);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->max_value));
+  // 7: normalizing_index_offset
+  CborWriteUint(out, kCborUint, kKeyNormOffset);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->normalizing_index_offset));
+  // 8: conversion_ratio
+  CborWriteUint(out, kCborUint, kKeyConvRatio);
+  CborWriteFloat64(out, histogram_->conversion_ratio);
+  // 9: counts_len
+  CborWriteUint(out, kCborUint, kKeyCountsLen);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->counts_len));
+  // 10: sparse counts -- array of [delta, count, ...] pairs.
+  // Indices are delta-encoded: the first value is the absolute index,
+  // each subsequent value is the difference from the previous index.
+  CborWriteUint(out, kCborUint, kKeyCounts);
+  CborWriteUint(out, kCborArray, static_cast<uint64_t>(non_zero) * 2);
+  int32_t prev_idx = 0;
+  for (int32_t i = 0; i < histogram_->counts_len; i++) {
+    if (histogram_->counts[i] != 0) {
+      CborWriteUint(out, kCborUint, static_cast<uint64_t>(i - prev_idx));
+      CborWriteUint(
+          out, kCborUint, static_cast<uint64_t>(histogram_->counts[i]));
+      prev_idx = i;
+    }
+  }
+
+  // 11: EWMA state (optional)
+  if (has_ewma) {
+    CborWriteUint(out, kCborUint, kKeyEwma);
+    CborWriteUint(out, kCborMap, 5);
+    CborWriteUint(out, kCborUint, kEwmaAlpha);
+    CborWriteFloat64(out, ewma_alpha_);
+    CborWriteUint(out, kCborUint, kEwmaMean);
+    CborWriteFloat64(out, ewma_mean_);
+    CborWriteUint(out, kCborUint, kEwmaVariance);
+    CborWriteFloat64(out, ewma_variance_);
+    CborWriteUint(out, kCborUint, kEwmaErrorRate);
+    CborWriteFloat64(out, ewma_error_rate_);
+    CborWriteUint(out, kCborUint, kEwmaThreshold);
+    CborWriteUint(out, kCborUint, static_cast<uint64_t>(threshold_));
+  }
+
+  return out;
+}
+
+std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
+  const uint8_t* p = data;
+  const uint8_t* end = data + len;
+
+  // Read top-level map header.
+  if (p >= end || (*p >> 5) != 5) return nullptr;  // Must be a map.
+  uint64_t map_size;
+  if (!CborReadUint(p, end, &map_size)) return nullptr;
+
+  int64_t lowest = 1;
+  int64_t highest = std::numeric_limits<int64_t>::max();
+  int figures = 3;
+  int64_t total_count = 0;
+  int64_t min_value = std::numeric_limits<int64_t>::max();
+  int64_t max_value = 0;
+  int32_t norm_offset = 0;
+  double conv_ratio = 1.0;
+  int32_t counts_len = 0;
+  uint64_t version = 0;
+
+  // Sparse counts storage.
+  std::vector<std::pair<int32_t, int64_t>> sparse_counts;
+
+  // EWMA state.
+  double ewma_alpha = 0;
+  double ewma_mean = 0;
+  double ewma_variance = 0;
+  double ewma_error_rate = 0;
+  int64_t threshold = 0;
+
+  for (uint64_t i = 0; i < map_size; i++) {
+    // Read key (unsigned int).
+    uint64_t key;
+    if (!CborReadUint(p, end, &key)) return nullptr;
+
+    switch (key) {
+      case kKeyVersion:
+        if (!CborReadUint(p, end, &version)) return nullptr;
+        if (version != kExportVersion) return nullptr;
+        break;
+      case kKeyLowest: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        lowest = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyHighest: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        highest = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyFigures: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        figures = static_cast<int>(v);
+        break;
+      }
+      case kKeyTotalCount: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        total_count = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyMin: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        min_value = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyMax: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        max_value = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyNormOffset: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        norm_offset = static_cast<int32_t>(v);
+        break;
+      }
+      case kKeyConvRatio:
+        if (!CborReadNumber(p, end, &conv_ratio)) return nullptr;
+        break;
+      case kKeyCountsLen: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        counts_len = static_cast<int32_t>(v);
+        break;
+      }
+      case kKeyCounts: {
+        // Array of flat [delta, count, ...] pairs. Indices are
+        // delta-encoded: accumulate to recover absolute indices.
+        if (p >= end || (*p >> 5) != 4) return nullptr;
+        uint64_t arr_len;
+        if (!CborReadUint(p, end, &arr_len)) return nullptr;
+        if (arr_len % 2 != 0) return nullptr;
+        // Each element needs at least 1 byte of CBOR encoding, so
+        // arr_len can't exceed the remaining buffer. Without this
+        // check, a crafted buffer claiming arr_len=2^60 would cause
+        // reserve() to OOM-crash before the loop catches the error.
+        if (arr_len > static_cast<uint64_t>(end - p)) return nullptr;
+        sparse_counts.reserve(static_cast<size_t>(arr_len / 2));
+        int32_t acc_idx = 0;
+        for (uint64_t j = 0; j < arr_len; j += 2) {
+          uint64_t delta, cnt;
+          if (!CborReadUint(p, end, &delta)) return nullptr;
+          if (!CborReadUint(p, end, &cnt)) return nullptr;
+          acc_idx += static_cast<int32_t>(delta);
+          sparse_counts.emplace_back(acc_idx, static_cast<int64_t>(cnt));
+        }
+        break;
+      }
+      case kKeyEwma: {
+        // Sub-map for EWMA state.
+        if (p >= end || (*p >> 5) != 5) return nullptr;
+        uint64_t sub_size;
+        if (!CborReadUint(p, end, &sub_size)) return nullptr;
+        for (uint64_t j = 0; j < sub_size; j++) {
+          uint64_t sub_key;
+          if (!CborReadUint(p, end, &sub_key)) return nullptr;
+          switch (sub_key) {
+            case kEwmaAlpha:
+              if (!CborReadNumber(p, end, &ewma_alpha)) return nullptr;
+              break;
+            case kEwmaMean:
+              if (!CborReadNumber(p, end, &ewma_mean)) return nullptr;
+              break;
+            case kEwmaVariance:
+              if (!CborReadNumber(p, end, &ewma_variance)) return nullptr;
+              break;
+            case kEwmaErrorRate:
+              if (!CborReadNumber(p, end, &ewma_error_rate)) return nullptr;
+              break;
+            case kEwmaThreshold: {
+              uint64_t v;
+              if (!CborReadUint(p, end, &v)) return nullptr;
+              threshold = static_cast<int64_t>(v);
+              break;
+            }
+            default:
+              return nullptr;  // Unknown EWMA key.
+          }
+        }
+        break;
+      }
+      default:
+        return nullptr;  // Unknown key.
+    }
+  }
+
+  // Reconstruct the histogram.
+  Options opts;
+  opts.lowest = lowest;
+  opts.highest = highest;
+  opts.figures = figures;
+  // Compute half_life from alpha: alpha = 1 - 2^(-1/halfLife)
+  // => halfLife = -1 / log2(1 - alpha)
+  if (ewma_alpha > 0 && ewma_alpha < 1) {
+    opts.half_life = -1.0 / std::log2(1.0 - ewma_alpha);
+  }
+  opts.threshold = threshold;
+
+  auto histogram = Histogram::Create(opts);
+  if (!histogram) return nullptr;
+
+  // Validate counts_len matches what the options produce.
+  if (histogram->histogram_->counts_len != counts_len) return nullptr;
+
+  // Restore counts directly.
+  for (const auto& [idx, cnt] : sparse_counts) {
+    if (idx < 0 || idx >= counts_len) return nullptr;
+    histogram->histogram_->counts[idx] = cnt;
+  }
+  histogram->histogram_->total_count = total_count;
+  histogram->histogram_->min_value = min_value;
+  histogram->histogram_->max_value = max_value;
+  histogram->histogram_->normalizing_index_offset = norm_offset;
+  histogram->histogram_->conversion_ratio = conv_ratio;
+
+  // Restore EWMA state.
+  if (ewma_alpha > 0) {
+    histogram->ewma_mean_ = ewma_mean;
+    histogram->ewma_variance_ = ewma_variance;
+    histogram->ewma_error_rate_ = ewma_error_rate;
+    histogram->ewma_initialized_ = true;
+  }
+
+  return histogram;
+}
+
 HistogramImpl::HistogramImpl(const Histogram::Options& options)
-    : histogram_(new Histogram(options)) {}
+    : histogram_(Histogram::Create(options)) {
+  CHECK(histogram_);
+}
 
 HistogramImpl::HistogramImpl(std::shared_ptr<Histogram> histogram)
     : histogram_(std::move(histogram)) {}
@@ -675,6 +1158,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
   SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
   SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "meanCI", GetMeanCI);
   SetProtoMethodNoSideEffect(isolate, tmpl, "welchTest", GetWelchTest);
   SetProtoMethodNoSideEffect(
       isolate, tmpl, "mannWhitneyTest", GetMannWhitneyTest);
@@ -690,6 +1174,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
                             "ewmaErrorRate",
                             GetEwmaErrorRate,
                             &fast_get_ewma_error_rate_);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "export", DoExport);
   SetFastMethod(isolate, instance, "reset", DoReset, &fast_reset_);
 }
 
@@ -728,6 +1213,7 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetPercentilesAt);
   registry->Register(GetLinearBuckets);
   registry->Register(GetLogBuckets);
+  registry->Register(GetMeanCI);
   registry->Register(GetWelchTest);
   registry->Register(GetMannWhitneyTest);
   registry->Register(GetCohensD);
@@ -736,6 +1222,7 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetEwmaMean);
   registry->Register(GetEwmaStddev);
   registry->Register(GetEwmaErrorRate);
+  registry->Register(DoExport);
   registry->Register(fast_get_ewma_mean_);
   registry->Register(fast_get_ewma_stddev_);
   registry->Register(fast_get_ewma_error_rate_);
@@ -922,10 +1409,12 @@ void HistogramBase::New(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() > 4 && args[4]->IsNumber()) {
     threshold = static_cast<int64_t>(args[4].As<Number>()->Value());
   }
-  new HistogramBase(
-      env,
-      args.This(),
+  auto histogram = Histogram::Create(
       Histogram::Options{lowest, highest, figures, half_life, threshold});
+  if (!histogram) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram options");
+  }
+  new HistogramBase(env, args.This(), std::move(histogram));
 }
 
 Local<FunctionTemplate> HistogramBase::GetConstructorTemplate(
@@ -960,16 +1449,17 @@ void HistogramBase::RegisterExternalReferences(
   registry->Register(RecordCorrected);
   registry->Register(fast_record_);
   registry->Register(fast_record_delta_);
+  registry->Register(HistogramImpl::DoImport);
   HistogramImpl::RegisterExternalReferences(registry);
 }
 
 void HistogramBase::Initialize(IsolateData* isolate_data,
                                Local<ObjectTemplate> target) {
-  SetConstructorFunction(isolate_data->isolate(),
-                         target,
-                         "Histogram",
-                         GetConstructorTemplate(isolate_data),
-                         SetConstructorFunctionFlag::NONE);
+  Isolate* isolate = isolate_data->isolate();
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(isolate_data);
+  SetMethodNoSideEffect(isolate, tmpl, "import", HistogramImpl::DoImport);
+  SetConstructorFunction(
+      isolate, target, "Histogram", tmpl, SetConstructorFunctionFlag::NONE);
 }
 
 BaseObjectPtr<BaseObject> HistogramBase::HistogramTransferData::Deserialize(
@@ -1432,6 +1922,21 @@ void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
 }
 
+void HistogramImpl::GetMeanCI(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  double confidence = args[0].As<Number>()->Value();
+
+  auto result = (*histogram)->MeanCI(confidence);
+
+  Local<Value> values[] = {Number::New(isolate, result.mean),
+                           Number::New(isolate, result.lower),
+                           Number::New(isolate, result.upper)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
 void HistogramImpl::GetWelchTest(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
@@ -1528,6 +2033,46 @@ double HistogramImpl::FastGetEwmaErrorRate(Local<Value> receiver) {
   return (*histogram)->EwmaErrorRate();
 }
 
+void HistogramImpl::DoExport(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  std::vector<uint8_t> data = (*histogram)->Export();
+
+  auto store = v8::ArrayBuffer::NewBackingStore(env->isolate(), data.size());
+  memcpy(store->Data(), data.data(), data.size());
+  auto buf = v8::ArrayBuffer::New(env->isolate(), std::move(store));
+  auto arr = v8::Uint8Array::New(buf, 0, data.size());
+  args.GetReturnValue().Set(arr);
+}
+
+void HistogramImpl::DoImport(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (!args[0]->IsUint8Array()) {
+    THROW_ERR_INVALID_ARG_TYPE(env, "data must be a Uint8Array");
+    return;
+  }
+  Local<v8::Uint8Array> input = args[0].As<v8::Uint8Array>();
+  auto backing = input->Buffer()->GetBackingStore();
+  const uint8_t* data =
+      static_cast<const uint8_t*>(backing->Data()) + input->ByteOffset();
+  size_t len = input->ByteLength();
+
+  auto histogram = Histogram::Import(data, len);
+  if (!histogram) {
+    THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram export data");
+    return;
+  }
+
+  // Create a new HistogramBase wrapping the imported histogram.
+  Local<FunctionTemplate> tmpl =
+      HistogramBase::GetConstructorTemplate(env->isolate_data());
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj))
+    return;
+  new HistogramBase(env, obj, std::move(histogram));
+  args.GetReturnValue().Set(obj);
+}
+
 void HistogramImpl::GetPercentilesAt(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
diff --git a/src/histogram.h b/src/histogram.h
index 31a2e9833d3e..2af0e4a4f82e 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -12,6 +12,7 @@
 #include "v8.h"
 
 #include <limits>
+#include <vector>
 
 namespace node {
 
@@ -36,7 +37,12 @@ class Histogram : public MemoryRetainer {
                             // exceeding this threshold.
   };
 
-  explicit Histogram(const Options& options);
+  using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
+
+  // Factory method that returns nullptr on hdr_init failure.
+  static std::shared_ptr<Histogram> Create(const Options& options);
+
+  Histogram(HistogramPointer histogram, const Options& options);
   virtual ~Histogram() = default;
 
   inline bool Record(int64_t value);
@@ -74,7 +80,13 @@ class Histogram : public MemoryRetainer {
                      int64_t* values,
                      size_t length) const;
 
-  // Statistical hypothesis testing
+  // Statistical analysis
+  struct MeanCIResult {
+    double mean;
+    double lower;
+    double upper;
+  };
+
   struct WelchTestResult {
     double t_statistic;
     double degrees_of_freedom;
@@ -95,6 +107,7 @@ class Histogram : public MemoryRetainer {
     int64_t upper;
   };
 
+  MeanCIResult MeanCI(double confidence = 0.95) const;
   WelchTestResult WelchTest(const Histogram& other,
                             double confidence = 0.95) const;
   MannWhitneyResult MannWhitneyTest(const Histogram& other) const;
@@ -103,6 +116,10 @@ class Histogram : public MemoryRetainer {
   PercentileCIResult PercentileCI(double percentile,
                                   double confidence = 0.95) const;
 
+  // CBOR-encoded export/import for histogram exchange.
+  std::vector<uint8_t> Export() const;
+  static std::shared_ptr<Histogram> Import(const uint8_t* data, size_t len);
+
   inline bool RecordCorrected(int64_t value, int64_t expected_interval);
 
   template <typename Iterator>
@@ -120,7 +137,6 @@ class Histogram : public MemoryRetainer {
  private:
   inline void UpdateEwma(double value);
 
-  using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
   HistogramPointer histogram_;
   uint64_t prev_ = 0;
   size_t exceeds_ = 0;
@@ -180,6 +196,7 @@ class HistogramImpl {
   static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMeanCI(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetWelchTest(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetMannWhitneyTest(
       const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -189,6 +206,8 @@ class HistogramImpl {
   static void GetEwmaMean(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaStddev(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaErrorRate(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoExport(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoImport(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void FastReset(v8::Local<v8::Value> receiver);
   static double FastGetCount(v8::Local<v8::Value> receiver);
diff --git a/src/js_native_api.h b/src/js_native_api.h
index d2375ecd3248..2a36c4e3ddf3 100644
--- a/src/js_native_api.h
+++ b/src/js_native_api.h
@@ -55,8 +55,8 @@ NAPI_EXTERN napi_status NAPI_CDECL napi_create_object(napi_env env,
 NAPI_EXTERN napi_status NAPI_CDECL
 node_api_create_object_with_properties(napi_env env,
                                        napi_value prototype_or_null,
-                                       napi_value* property_names,
-                                       napi_value* property_values,
+                                       const napi_value* property_names,
+                                       const napi_value* property_values,
                                        size_t property_count,
                                        napi_value* result);
 #endif  // NAPI_EXPERIMENTAL
diff --git a/src/js_native_api_v8.cc b/src/js_native_api_v8.cc
index 5e533d2a6822..6ae976df2971 100644
--- a/src/js_native_api_v8.cc
+++ b/src/js_native_api_v8.cc
@@ -1621,8 +1621,8 @@ napi_status NAPI_CDECL napi_create_object(napi_env env, napi_value* result) {
 napi_status NAPI_CDECL
 node_api_create_object_with_properties(napi_env env,
                                        napi_value prototype_or_null,
-                                       napi_value* property_names,
-                                       napi_value* property_values,
+                                       const napi_value* property_names,
+                                       const napi_value* property_values,
                                        size_t property_count,
                                        napi_value* result) {
   CHECK_ENV_NOT_IN_GC(env);
diff --git a/src/large_pages/node_large_page.cc b/src/large_pages/node_large_page.cc
deleted file mode 100644
index 43ebb7641a62..000000000000
--- a/src/large_pages/node_large_page.cc
+++ /dev/null
@@ -1,464 +0,0 @@
-// Copyright (C) 2018 Intel Corporation
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"),
-// to deal in the Software without restriction, including without limitation
-// the rights to use, copy, modify, merge, publish, distribute, sublicense,
-// and/or sell copies of the Software, and to permit persons to whom
-// the Software is furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
-// THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
-// OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-// ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-// OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// SPDX-License-Identifier: MIT
-
-// The functions in this file map the .text section of Node.js into 2MB pages.
-// They perform the following steps:
-//
-// 1: Find the Node.js binary's `.text` section in memory. This is done below in
-//    `FindNodeTextRegion`. It is accomplished in a platform-specific way. On
-//    Linux and FreeBSD, `dl_iterate_phdr(3)` is used. When the region is found,
-//    it is "trimmed" as follows:
-//    * Modify the start to point to the very beginning of the Node.js `.text`
-//      section (from symbol `__node_text_start` declared in node_text_start.S).
-//    * Possibly modify the end to account for the `lpstub` section which
-//      contains `MoveTextRegionToLargePages`, the function we do not wish to
-//      move (see below).
-//    * Align the address of the start to its nearest higher large page
-//      boundary.
-//    * Align the address of the end to its nearest lower large page boundary.
-//
-// 2: Move the text region to large pages. This is done below in
-//    `MoveTextRegionToLargePages`. We need to be very careful:
-//    a) `MoveTextRegionToLargePages` itself should not be moved.
-//       We use gcc attributes
-//       (__section__) to put it outside the `.text` section,
-//       (__aligned__) to align it at the 2M boundary, and
-//       (__noline__) to not inline this function.
-//    b) `MoveTextRegionToLargePages` should not call any function(s) that might
-//       be moved.
-//    To move the .text section, perform the following steps:
-//      * Map a new, temporary area and copy the original code there.
-//      * Use mmap using the start address with MAP_FIXED so we get exactly the
-//        same virtual address (except on macOS). On platforms other than Linux,
-//        use mmap flags to request hugepages.
-//      * On Linux use madvise with MADV_HUGEPAGE to use anonymous 2MB pages.
-//      * If successful copy the code to the newly mapped area and protect it to
-//        be readable and executable.
-//      * Unmap the temporary area.
-
-#include "node_large_page.h"
-
-#include <cerrno>   // NOLINT(build/include)
-
-// Besides returning ENOTSUP at runtime we do nothing if this define is missing.
-#if defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-#include "debug_utils-inl.h"
-
-#if defined(__linux__) || defined(__FreeBSD__)
-#if defined(__linux__)
-#ifndef _GNU_SOURCE
-#define _GNU_SOURCE
-#endif  // ifndef _GNU_SOURCE
-#include <sys/prctl.h>
-#if !defined(PR_SET_VMA)
-#define PR_SET_VMA 0x53564d41
-#define PR_SET_VMA_ANON_NAME 0
-#endif
-#elif defined(__FreeBSD__)
-#include "uv.h"  // uv_exepath
-#endif  // defined(__linux__)
-#include <link.h>
-#endif  // defined(__linux__) || defined(__FreeBSD__)
-
-#include <sys/types.h>
-#include <sys/mman.h>
-#if defined(__FreeBSD__)
-#include <sys/sysctl.h>
-#elif defined(__APPLE__)
-#include <mach/vm_map.h>
-#endif
-
-#include <climits>  // PATH_MAX
-#include <cstdlib>
-#include <cstdint>
-#include <cstring>
-#include <string>
-#include <fstream>
-
-#if defined(__linux__) || defined(__FreeBSD__)
-extern "C" {
-// This symbol must be declared weak because this file becomes part of all
-// Node.js targets (like node_mksnapshot, node_mkcodecache, and cctest) and
-// those files do not supply the symbol.
-extern char __attribute__((weak)) __node_text_start;
-extern char __start_lpstub;
-}  // extern "C"
-#endif  // defined(__linux__) || defined(__FreeBSD__)
-
-#endif  // defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-namespace node {
-#if defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-
-namespace {
-
-struct text_region {
-  char* from = nullptr;
-  char* to = nullptr;
-  bool found_text_region = false;
-};
-
-static const size_t hps = 2L * 1024 * 1024;
-
-template <typename... Args>
-inline void Debug(std::string fmt, Args&&... args) {
-  node::Debug(&per_process::enabled_debug_list,
-              DebugCategory::HUGEPAGES,
-              (std::string("Hugepages info: ") + fmt).c_str(),
-              std::forward<Args>(args)...);
-}
-
-inline void PrintWarning(const char* warn) {
-  fprintf(stderr, "Hugepages WARNING: %s\n", warn);
-}
-
-inline void PrintSystemError(int error) {
-  PrintWarning(strerror(error));
-}
-
-inline uintptr_t hugepage_align_up(uintptr_t addr) {
-  return (((addr) + (hps) - 1) & ~((hps) - 1));
-}
-
-inline uintptr_t hugepage_align_down(uintptr_t addr) {
-  return ((addr) & ~((hps) - 1));
-}
-
-#if defined(__linux__) || defined(__FreeBSD__)
-#if defined(__FreeBSD__)
-#ifndef ElfW
-#define ElfW(name) Elf_##name
-#endif  // ifndef ElfW
-#endif  // defined(__FreeBSD__)
-
-struct dl_iterate_params {
-  uintptr_t start = 0;
-  uintptr_t end = 0;
-  uintptr_t reference_sym = reinterpret_cast<uintptr_t>(&__node_text_start);
-  std::string exename;
-};
-
-int FindMapping(struct dl_phdr_info* info, size_t, void* data) {
-  auto dl_params = static_cast<dl_iterate_params*>(data);
-  if (dl_params->exename == std::string(info->dlpi_name)) {
-    for (int idx = 0; idx < info->dlpi_phnum; idx++) {
-      const ElfW(Phdr)* phdr = &info->dlpi_phdr[idx];
-      if (phdr->p_type == PT_LOAD && (phdr->p_flags & PF_X)) {
-        uintptr_t start = info->dlpi_addr + phdr->p_vaddr;
-        uintptr_t end = start + phdr->p_memsz;
-
-        if (dl_params->reference_sym >= start &&
-            dl_params->reference_sym <= end) {
-          dl_params->start = start;
-          dl_params->end = end;
-          return 1;
-        }
-      }
-    }
-  }
-  return 0;
-}
-#endif  // defined(__linux__) || defined(__FreeBSD__)
-
-struct text_region FindNodeTextRegion() {
-  struct text_region nregion;
-#if defined(__linux__) || defined(__FreeBSD__)
-  dl_iterate_params dl_params;
-  uintptr_t lpstub_start = reinterpret_cast<uintptr_t>(&__start_lpstub);
-
-#if defined(__FreeBSD__)
-  // On FreeBSD we need the name of the binary, because `dl_iterate_phdr` does
-  // not pass in an empty string as the `dlpi_name` of the binary but rather its
-  // absolute path.
-  {
-    char selfexe[PATH_MAX];
-    size_t count = sizeof(selfexe);
-    if (uv_exepath(selfexe, &count))
-      return nregion;
-    dl_params.exename = std::string(selfexe, count);
-  }
-#endif  // defined(__FreeBSD__)
-
-  if (dl_iterate_phdr(FindMapping, &dl_params) == 1) {
-    Debug("start: %p - sym: %p - end: %p\n",
-          reinterpret_cast<void*>(dl_params.start),
-          reinterpret_cast<void*>(dl_params.reference_sym),
-          reinterpret_cast<void*>(dl_params.end));
-
-    dl_params.start = dl_params.reference_sym;
-    if (lpstub_start > dl_params.start && lpstub_start <= dl_params.end) {
-      Debug("Trimming end for lpstub: %p\n",
-            reinterpret_cast<void*>(lpstub_start));
-      dl_params.end = lpstub_start;
-    }
-
-    if (dl_params.start < dl_params.end) {
-      char* from = reinterpret_cast<char*>(hugepage_align_up(dl_params.start));
-      char* to = reinterpret_cast<char*>(hugepage_align_down(dl_params.end));
-      Debug("Aligned range is %p - %p\n", from, to);
-      if (from < to) {
-        size_t pagecount = (to - from) / hps;
-        if (pagecount > 0) {
-          nregion.found_text_region = true;
-          nregion.from = from;
-          nregion.to = to;
-        }
-      }
-    }
-  }
-#elif defined(__APPLE__)
-  struct vm_region_submap_info_64 map;
-  mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
-  vm_address_t addr = 0UL;
-  vm_size_t size = 0;
-  natural_t depth = 1;
-
-  while (true) {
-    if (vm_region_recurse_64(mach_task_self(), &addr, &size, &depth,
-                             reinterpret_cast<vm_region_info_64_t>(&map),
-                             &count) != KERN_SUCCESS) {
-      break;
-    }
-
-    if (map.is_submap) {
-      depth++;
-    } else {
-      char* start = reinterpret_cast<char*>(hugepage_align_up(addr));
-      char* end = reinterpret_cast<char*>(hugepage_align_down(addr+size));
-
-      if (end > start && (map.protection & VM_PROT_READ) != 0 &&
-          (map.protection & VM_PROT_EXECUTE) != 0) {
-        nregion.found_text_region = true;
-        nregion.from = start;
-        nregion.to = end;
-        break;
-      }
-
-      addr += size;
-      size = 0;
-    }
-  }
-#endif
-  Debug("Found %d huge pages\n", (nregion.to - nregion.from) / hps);
-  return nregion;
-}
-
-#if defined(__linux__)
-bool IsTransparentHugePagesEnabled() {
-  // File format reference:
-  // https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/huge_memory.c?id=13391c60da3308ed9980de0168f74cce6c62ac1d#n163
-  const char* filename = "/sys/kernel/mm/transparent_hugepage/enabled";
-  std::ifstream config_stream(filename, std::ios::in);
-  if (!config_stream.good()) {
-    PrintWarning("could not open /sys/kernel/mm/transparent_hugepage/enabled");
-    return false;
-  }
-
-  std::string token;
-  config_stream >> token;
-  if ("[always]" == token) return true;
-  config_stream >> token;
-  if ("[madvise]" == token) return true;
-  return false;
-}
-#elif defined(__FreeBSD__)
-bool IsSuperPagesEnabled() {
-  // It is enabled by default on amd64.
-  unsigned int super_pages = 0;
-  size_t super_pages_length = sizeof(super_pages);
-  return sysctlbyname("vm.pmap.pg_ps_enabled",
-                      &super_pages,
-                      &super_pages_length,
-                      nullptr,
-                      0) != -1 &&
-         super_pages >= 1;
-}
-#endif
-
-// Functions in this class must always be inlined because they must end up in
-// the `lpstub` section rather than the `.text` section.
-class MemoryMapPointer {
- public:
-  FORCE_INLINE explicit MemoryMapPointer() {}
-  FORCE_INLINE bool operator==(void* rhs) const { return mem_ == rhs; }
-  FORCE_INLINE void* mem() const { return mem_; }
-  MemoryMapPointer(const MemoryMapPointer&) = delete;
-  MemoryMapPointer(MemoryMapPointer&&) = delete;
-  void operator= (const MemoryMapPointer&) = delete;
-  void operator= (const MemoryMapPointer&&) = delete;
-  FORCE_INLINE void Reset(void* start,
-                          size_t size,
-                          int prot,
-                          int flags,
-                          int fd = -1,
-                          size_t offset = 0) {
-    mem_ = mmap(start, size, prot, flags, fd, offset);
-    size_ = size;
-  }
-  FORCE_INLINE void Reset() {
-    mem_ = nullptr;
-    size_ = 0;
-  }
-  static void SetName(void* mem, size_t size, const char* name) {
-#if defined(__linux__)
-    // Available since the 5.17 kernel release and if the
-    // CONFIG_ANON_VMA_NAME option, we can set an identifier
-    // to an anonymous mapped region. However if the kernel
-    // option is not present or it s an older kernel, it is a no-op.
-    if (mem != MAP_FAILED && mem != nullptr)
-        prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME,
-            reinterpret_cast<uintptr_t>(mem),
-            size,
-            reinterpret_cast<uintptr_t>(name));
-#else
-    (void)name;
-#endif
-  }
-  FORCE_INLINE ~MemoryMapPointer() {
-    if (mem_ == nullptr) return;
-    if (mem_ == MAP_FAILED) return;
-    if (munmap(mem_, size_) == 0) return;
-    PrintSystemError(errno);
-  }
-
- private:
-  size_t size_ = 0;
-  void* mem_ = nullptr;
-};
-
-}  // End of anonymous namespace
-
-int
-#if !defined(__APPLE__)
-__attribute__((__section__("lpstub")))
-#else
-__attribute__((__section__("__TEXT,__lpstub")))
-#endif
-__attribute__((__aligned__(hps)))
-__attribute__((__noinline__))
-MoveTextRegionToLargePages(const text_region& r) {
-  MemoryMapPointer nmem;
-  MemoryMapPointer tmem;
-  void* start = r.from;
-  size_t size = r.to - r.from;
-
-  // Allocate a temporary region and back up the code we will re-map.
-  nmem.Reset(nullptr, size,
-             PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS);
-  if (nmem.mem() == MAP_FAILED) goto fail;
-  memcpy(nmem.mem(), r.from, size);
-
-#if defined(__linux__)
-// We already know the original page is r-xp
-// (PROT_READ, PROT_EXEC, MAP_PRIVATE)
-// We want PROT_WRITE because we are writing into it.
-// We want it at the fixed address and we use MAP_FIXED.
-  tmem.Reset(start, size,
-             PROT_READ | PROT_WRITE | PROT_EXEC,
-             MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED);
-  if (tmem.mem() == MAP_FAILED) goto fail;
-  if (madvise(tmem.mem(), size, 14 /* MADV_HUGEPAGE */) == -1) goto fail;
-  memcpy(start, nmem.mem(), size);
-#elif defined(__FreeBSD__)
-  tmem.Reset(start, size,
-             PROT_READ | PROT_WRITE | PROT_EXEC,
-             MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED |
-             MAP_ALIGNED_SUPER);
-  if (tmem.mem() == MAP_FAILED) goto fail;
-  memcpy(start, nmem.mem(), size);
-#elif defined(__APPLE__)
-  // There is not enough room to reserve the mapping close
-  // to the region address so we content to give a hint
-  // without forcing the new address being closed to.
-  // We explicitally gives all permission since we plan
-  // to write into it.
-  tmem.Reset(start, size,
-             PROT_READ | PROT_WRITE | PROT_EXEC,
-             MAP_PRIVATE | MAP_ANONYMOUS,
-             VM_FLAGS_SUPERPAGE_SIZE_2MB);
-  if (tmem.mem() == MAP_FAILED) goto fail;
-  memcpy(tmem.mem(), nmem.mem(), size);
-  if (mprotect(start, size, PROT_READ | PROT_WRITE | PROT_EXEC) == -1)
-    goto fail;
-  memcpy(start, tmem.mem(), size);
-#endif
-
-  if (mprotect(start, size, PROT_READ | PROT_EXEC) == -1) goto fail;
-  MemoryMapPointer::SetName(start, size, "nodejs Large Page");
-
-  // We need not `munmap(tmem, size)` on success.
-  tmem.Reset();
-  return 0;
-fail:
-  PrintSystemError(errno);
-  return -1;
-}
-#endif  // defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-
-// This is the primary API called from main.
-int MapStaticCodeToLargePages() {
-#if defined(NODE_ENABLE_LARGE_CODE_PAGES) && NODE_ENABLE_LARGE_CODE_PAGES
-  bool have_thp = false;
-#if defined(__linux__)
-  have_thp = IsTransparentHugePagesEnabled();
-#elif defined(__FreeBSD__)
-  have_thp = IsSuperPagesEnabled();
-#elif defined(__APPLE__)
-  // pse-36 flag is present in recent mac x64 products.
-  have_thp = true;
-#endif
-  if (!have_thp)
-    return EACCES;
-
-  struct text_region r = FindNodeTextRegion();
-  if (r.found_text_region == false)
-    return ENOENT;
-
-  return MoveTextRegionToLargePages(r);
-#else
-  return ENOTSUP;
-#endif
-}
-
-const char* LargePagesError(int status) {
-  switch (status) {
-    case ENOTSUP:
-      return "Mapping to large pages is not supported.";
-
-    case EACCES:
-      return "Large pages are not enabled.";
-
-    case ENOENT:
-      return "failed to find text region";
-
-    case -1:
-      return "Mapping code to large pages failed. Reverting to default page "
-          "size.";
-
-    case 0:
-      return "OK";
-
-    default:
-      return "Unknown error";
-  }
-}
-
-}  // namespace node
diff --git a/src/large_pages/node_large_page.h b/src/large_pages/node_large_page.h
deleted file mode 100644
index 622cf09ede4e..000000000000
--- a/src/large_pages/node_large_page.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright (C) 2018 Intel Corporation
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"),
-// to deal in the Software without restriction, including without limitation
-// the rights to use, copy, modify, merge, publish, distribute, sublicense,
-// and/or sell copies of the Software, and to permit persons to whom
-// the Software is furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
-// THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
-// OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-// ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-// OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// SPDX-License-Identifier: MIT
-
-#ifndef SRC_LARGE_PAGES_NODE_LARGE_PAGE_H_
-#define SRC_LARGE_PAGES_NODE_LARGE_PAGE_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-namespace node {
-int MapStaticCodeToLargePages();
-const char* LargePagesError(int status);
-}  // namespace node
-
-#endif  // NODE_WANT_INTERNALS
-#endif  // SRC_LARGE_PAGES_NODE_LARGE_PAGE_H_
diff --git a/src/large_pages/node_text_start.S b/src/large_pages/node_text_start.S
deleted file mode 100644
index 2a643457b572..000000000000
--- a/src/large_pages/node_text_start.S
+++ /dev/null
@@ -1,29 +0,0 @@
-#if defined(__ELF__)
-.section .note.GNU-stack,"",%progbits
-#endif
-// Add .note.gnu.property note for x86_64 to enable Intel CET
-// Based on: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
-// Refs: https://github.com/nodejs/node/issues/59084
-#if defined(__x86_64__) || defined(_M_X64)
-.section	.note.gnu.property,"a"
-.align 8
-.long	 1f - 0f
-.long	 4f - 1f
-.long	 5
-0:
-.string	 "GNU"
-1:
-.align 8
-.long	 0xc0000002
-.long	 3f - 2f
-2:
-.long	 0x3
-3:
-.align 8
-4:
-#endif
-.text
-.align 0x2000
-.global __node_text_start
-.hidden __node_text_start
-__node_text_start:
diff --git a/src/node.cc b/src/node.cc
index 00282634419d..176b7b77b278 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -81,8 +81,6 @@
 #include "../deps/v8/third_party/vtune/v8-vtune.h"
 #endif
 
-#include "large_pages/node_large_page.h"
-
 #if defined(__APPLE__) || defined(__linux__) || defined(_WIN32)
 #define NODE_USE_V8_WASM_TRAP_HANDLER 1
 #else
@@ -386,6 +384,10 @@ MaybeLocal<Value> StartExecution(Environment* env,
     return StartExecution(env, "internal/main/check_syntax");
   }
 
+  if (env->options()->bench_runner) {
+    return StartExecution(env, "internal/main/bench_runner");
+  }
+
   if (env->options()->test_runner) {
     return StartExecution(env, "internal/main/test_runner");
   }
@@ -786,6 +788,20 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
     v8_args.emplace_back("--js-source-phase-imports");
   }
 
+  // V8 aborts the process when external memory grows by more than
+  // --external-memory-max-reasonable-size gigabytes in a single step. That
+  // limit is a Chromium-oriented sanity check; allocating a buffer larger
+  // than it is a legitimate thing to do in Node, and should raise a
+  // RangeError rather than crash. Disable the check unless the user asked
+  // for a specific limit.
+  // Refs: https://github.com/nodejs/node/issues/65534
+  if (std::ranges::none_of(v8_args, [](const std::string& arg) {
+        return arg.starts_with("--external-memory-max-reasonable-size") ||
+               arg.starts_with("--external_memory_max_reasonable_size");
+      })) {
+    v8_args.emplace_back("--external-memory-max-reasonable-size=0");
+  }
+
 #ifdef __POSIX__
   // Block SIGPROF signals when sleeping in epoll_wait/kevent/etc.  Avoids the
   // performance penalty of frequent EINTR wakeups when the profiler is running.
@@ -1125,15 +1141,12 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
   }
 
   if (!(flags & ProcessInitializationFlags::kNoUseLargePages) &&
-      (per_process::cli_options->use_largepages == "on" ||
-       per_process::cli_options->use_largepages == "silent")) {
-    int lp_result = node::MapStaticCodeToLargePages();
-    if (per_process::cli_options->use_largepages == "on" && lp_result != 0) {
-      result->errors_.emplace_back(node::LargePagesError(lp_result));
-    }
+      (per_process::cli_options->use_largepages == "on")) {
+    result->errors_.emplace_back("--use-largepages is no longer supported.");
   }
 
-  if (!per_process::cli_options->run.empty()) {
+  // A bare `--run` (empty value) lists the available scripts; a value runs it.
+  if (per_process::cli_options->has_run) {
     auto positional_args = task_runner::GetPositionalArgs(args);
     result->early_return_ = true;
     task_runner::RunTask(
@@ -1221,6 +1234,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     }
 
     OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+    CHECK_NOT_NULL(settings);
     OPENSSL_INIT_set_config_filename(settings, conf_file);
     OPENSSL_INIT_set_config_appname(settings, conf_section_name);
     OPENSSL_INIT_set_config_file_flags(settings,
@@ -1250,6 +1264,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
       result->errors_.emplace_back(std::move(*fips_error));
       return result;
     }
+    crypto::InstallFipsIndicatorCallback();
 
     // Ensure CSPRNG is properly seeded.
     CHECK(ncrypto::CSPRNG(nullptr, 0));
@@ -1286,6 +1301,10 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     cppgc::InitializeProcess(allocator);
   }
 
+  if (flags & ProcessInitializationFlags::kNoHarvestBuiltinCodeCache) {
+    builtins::BuiltinLoader::SetHarvestCodeCache(false);
+  }
+
   if (!(flags & ProcessInitializationFlags::kNoInitializeV8)) {
     V8::Initialize();
 
diff --git a/src/node.h b/src/node.h
index 1c0726a82415..5e54a60fcf53 100644
--- a/src/node.h
+++ b/src/node.h
@@ -223,7 +223,8 @@ enum Flags : uint32_t {
   kNoParseGlobalDebugVariables = 1 << 9,
   // Do not adjust OS resource limits for this process.
   kNoAdjustResourceLimits = 1 << 10,
-  // Do not map code segments into large pages for this process.
+  // Legacy flag for not mapping code segments into large pages for this
+  // process. The feature is no longer supported so this is just a no-op.
   kNoUseLargePages = 1 << 11,
   // Skip printing output for --help, --version, --v8-options.
   kNoPrintHelpOrVersionOutput = 1 << 12,
@@ -233,6 +234,11 @@ enum Flags : uint32_t {
   kNoInitializeCppgc = 1 << 13,
   // Initialize the process for predictable snapshot generation.
   kGeneratePredictableSnapshot = 1 << 14,
+  // Do not serialize a code cache for builtins that had to be compiled without
+  // one. By default such caches are kept so that worker threads created later
+  // start faster; an embedder that supplies an EmbedderBuiltinCodeCache or
+  // never creates workers only pays for the serialization.
+  kNoHarvestBuiltinCodeCache = 1 << 15,
 
   // Emulate the behavior of InitializeNodeWithArgs() when passing
   // a flags argument to the InitializeOncePerProcess() replacement
@@ -678,6 +684,43 @@ struct InspectorParentHandle {
   virtual ~InspectorParentHandle() = default;
 };
 
+// Code cache for the built-in JavaScript of Environments that are bootstrapped
+// rather than deserialized from a snapshot; see SetBuiltinCodeCache().
+class NODE_EXTERN EmbedderBuiltinCodeCache {
+ public:
+  struct Entry {
+    std::string id;  // e.g. "internal/bootstrap/node"
+    std::unique_ptr<v8::ScriptCompiler::CachedData> data;
+  };
+  explicit EmbedderBuiltinCodeCache(std::vector<Entry> entries);
+  ~EmbedderBuiltinCodeCache();
+
+  // Compiles every built-in module in `context`, which must come from
+  // NewContext(), and returns their code caches; empty on failure.
+  static std::vector<Entry> Generate(v8::Local<v8::Context> context);
+
+  v8::ScriptCompiler::CachedData::CompatibilityCheckResult CompatibilityCheck(
+      v8::Isolate* isolate) const;
+
+  EmbedderBuiltinCodeCache(const EmbedderBuiltinCodeCache&) = delete;
+  EmbedderBuiltinCodeCache& operator=(const EmbedderBuiltinCodeCache&) = delete;
+
+  struct Impl;
+
+ private:
+  std::unique_ptr<Impl> impl_;
+  friend NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+  SetBuiltinCodeCache(IsolateData*, const EmbedderBuiltinCodeCache*);
+};
+
+// Environments created from `isolate_data` afterwards start with `cache`'s
+// entries (they share its buffers; `cache` itself may be freed after the call);
+// nullptr clears it. Returns the result of `cache->CompatibilityCheck()` and
+// leaves `isolate_data` unchanged unless that is kSuccess.
+NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+SetBuiltinCodeCache(IsolateData* isolate_data,
+                    const EmbedderBuiltinCodeCache* cache);
+
 // TODO(addaleax): Maybe move per-Environment options parsing here.
 // Returns nullptr when the Environment cannot be created e.g. there are
 // pending JavaScript exceptions.
diff --git a/src/node_api.cc b/src/node_api.cc
index d80569d9e92e..e0e7cca2a4ba 100644
--- a/src/node_api.cc
+++ b/src/node_api.cc
@@ -451,6 +451,7 @@ class ThreadSafeFunction {
 
     if (popped_value) {
       v8::HandleScope scope(env->isolate);
+      v8::Context::Scope context_scope(env->context());
       AsyncResource::CallbackScope cb_scope(&*async_resource);
       napi_value js_callback = nullptr;
       if (!ref.IsEmpty()) {
@@ -469,6 +470,7 @@ class ThreadSafeFunction {
     v8::HandleScope scope(env->isolate);
     EmptyQueue();
     if (finalize_cb) {
+      v8::Context::Scope context_scope(env->context());
       AsyncResource::CallbackScope cb_scope(&*async_resource);
       env->CallFinalizer<false>(finalize_cb, finalize_data, context);
     }
@@ -1236,6 +1238,7 @@ class Work : public node::AsyncResource, public node::ThreadPoolWork {
     // Establish a handle scope here so that every callback doesn't have to.
     // Also it is needed for the exception-handling below.
     v8::HandleScope scope(_env->isolate);
+    v8::Context::Scope context_scope(_env->context());
 
     CallbackScope callback_scope(this);
 
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 2dde536dc229..0437f59ca60e 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -9,6 +9,20 @@
 #include "util.h"
 
 #include <string>
+#include <vector>
+
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <unistd.h>
+#include <cerrno>
+#include <cstdlib>
+#if defined(__linux__)
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#endif
+#endif
 
 #if HAVE_OPENSSL
 #define NODE_BUILTIN_OPENSSL_BINDINGS(V) V(crypto) V(tls_wrap)
@@ -108,6 +122,7 @@
   NODE_BUILTIN_ICU_BINDINGS(V)                                                 \
   NODE_BUILTIN_PROFILER_BINDINGS(V)                                            \
   NODE_BUILTIN_DEBUG_BINDINGS(V)                                               \
+  NODE_BUILTIN_DTLS_BINDINGS(V)                                                \
   NODE_BUILTIN_QUIC_BINDINGS(V)                                                \
   NODE_BUILTIN_SQLITE_BINDINGS(V)                                              \
   NODE_BUILTIN_FFI_BINDINGS(V)
@@ -437,13 +452,295 @@ inline node_api_addon_get_api_version_func GetNapiAddonGetApiVersionCallback(
       dlib->GetSymbolAddress(STRINGIFY(NODE_API_MODULE_GET_API_VERSION)));
 }
 
-// DLOpen is process.dlopen(module, filename, flags).
-// Used to load 'module.node' dynamically shared objects.
+namespace {
+
+#ifndef _WIN32
+// Write the whole buffer to `fd`, retrying partial writes and EINTR.
+bool WriteAllToFd(int fd, const char* data, size_t len) {
+  size_t off = 0;
+  while (off < len) {
+    ssize_t n = write(fd, data + off, len - off);
+    if (n < 0) {
+      if (errno == EINTR) continue;
+      return false;
+    }
+    off += static_cast<size_t>(n);
+  }
+  return true;
+}
+
+#if defined(__linux__)
+int NodeMemfdCreate(const char* name, unsigned int flags) {
+  return static_cast<int>(syscall(SYS_memfd_create, name, flags));
+}
+#endif  // __linux__
+#endif  // !_WIN32
+
+// Materializes native-addon bytes into a form dlopen()/LoadLibrary() can load,
+// with the smallest, most private on-disk footprint each platform allows:
+//   Linux:        an anonymous in-memory memfd, loaded via /proc/self/fd/N -
+//                 the bytes never touch the filesystem.
+//   other POSIX:  a 0700 mkdtemp() directory plus an O_EXCL|O_NOFOLLOW file,
+//                 unlink()ed right after the load (the mapping keeps it alive).
+//   Windows:      a temp file opened FILE_FLAG_DELETE_ON_CLOSE; its handle is
+//                 retained for the process lifetime so the file is removed
+//                 automatically once the process (and the loaded DLL) exit.
+// Used for an addon that lives somewhere dlopen() cannot open by path, such as
+// a virtual file system.
+class AddonImage {
+ public:
+  AddonImage() = default;
+  ~AddonImage();
+  AddonImage(const AddonImage&) = delete;
+  AddonImage& operator=(const AddonImage&) = delete;
+
+  // The directory a temporary image would be written to, with a trailing
+  // separator; empty when it cannot be determined. Names the resource for the
+  // file-system permission check.
+  static std::string TempDir();
+
+  // On success sets path() to a real, loadable path for `data`.
+  bool Materialize(const char* data, size_t len);
+  const std::string& path() const { return path_; }
+  const std::string& errmsg() const { return errmsg_; }
+
+  // Call exactly once, right after DLib::Open(); `opened` says whether the load
+  // succeeded. Releases the transient resources that are no longer needed (a
+  // successful load holds its own mapping): on POSIX closes the memfd or
+  // unlinks the temp file; on Windows retains the delete-on-close handle for
+  // the process lifetime when opened, or closes it (deleting the file) on
+  // failure.
+  void AfterOpen(bool opened);
+
+ private:
+  std::string path_;
+  std::string errmsg_;
+  bool consumed_ = false;
+#ifdef _WIN32
+  HANDLE handle_ = INVALID_HANDLE_VALUE;
+#else
+  bool MaterializeTempFile(const char* data, size_t len);
+  int fd_ = -1;
+  std::string temp_dir_;  // non-empty only for the temp-file (non-memfd) path
+#endif
+};
+
+#ifdef _WIN32
+
+// Delete-on-close handles kept alive until process exit so their temp files
+// outlive the loaded DLLs and are removed once the process ends.
+Mutex g_retained_addon_handles_mutex;
+std::vector<HANDLE>* g_retained_addon_handles = nullptr;
+
+// static
+std::string AddonImage::TempDir() {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) return std::string();
+  int size = WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, nullptr, 0, nullptr, nullptr);
+  if (size <= 0) return std::string();
+  std::string out(size, '\0');
+  WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, out.data(), size, nullptr, nullptr);
+  return out;
+}
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) {
+    errmsg_ = "could not locate the temporary directory";
+    return false;
+  }
+  wchar_t file[MAX_PATH + 1];
+  if (GetTempFileNameW(dir, L"nod", 0, file) == 0) {
+    errmsg_ = "could not create a temporary file name";
+    return false;
+  }
+  // Reopen the just-created file delete-on-close, sharing delete so the loader
+  // can map it while it is delete-pending; the file is removed when this handle
+  // and the loader's section are both released (i.e. at process exit).
+  handle_ = CreateFileW(file,
+                        GENERIC_READ | GENERIC_WRITE,
+                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                        nullptr,
+                        CREATE_ALWAYS,
+                        FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE,
+                        nullptr);
+  if (handle_ == INVALID_HANDLE_VALUE) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    return false;
+  }
+  size_t off = 0;
+  while (off < len) {
+    DWORD chunk =
+        len - off > MAXDWORD ? MAXDWORD : static_cast<DWORD>(len - off);
+    DWORD written = 0;
+    if (!WriteFile(handle_, data + off, chunk, &written, nullptr)) {
+      errmsg_ = "could not write the native addon to a temporary file";
+      CloseHandle(handle_);
+      handle_ = INVALID_HANDLE_VALUE;
+      return false;
+    }
+    off += written;
+  }
+  int utf8_len =
+      WideCharToMultiByte(CP_UTF8, 0, file, -1, nullptr, 0, nullptr, nullptr);
+  if (utf8_len <= 0) {
+    errmsg_ = "could not encode the temporary file path";
+    CloseHandle(handle_);
+    handle_ = INVALID_HANDLE_VALUE;
+    return false;
+  }
+  path_.resize(utf8_len - 1);
+  WideCharToMultiByte(
+      CP_UTF8, 0, file, -1, path_.data(), utf8_len, nullptr, nullptr);
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  if (handle_ == INVALID_HANDLE_VALUE) return;
+  if (!opened) {
+    CloseHandle(handle_);  // delete-on-close removes the file
+    handle_ = INVALID_HANDLE_VALUE;
+    return;
+  }
+  Mutex::ScopedLock lock(g_retained_addon_handles_mutex);
+  if (g_retained_addon_handles == nullptr) {
+    g_retained_addon_handles = new std::vector<HANDLE>();
+  }
+  g_retained_addon_handles->push_back(handle_);
+  handle_ = INVALID_HANDLE_VALUE;
+}
+
+AddonImage::~AddonImage() {
+  // Materialized but Open() was never reached (e.g. an exception in between):
+  // closing the delete-on-close handle removes the file.
+  if (!consumed_ && handle_ != INVALID_HANDLE_VALUE) CloseHandle(handle_);
+}
+
+#else  // !_WIN32
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+#if defined(__linux__)
+  // Prefer an anonymous in-memory fd, loaded through /proc/self/fd: nothing
+  // reaches the filesystem, so there is no temp file to secure, unlink, or
+  // leak, and no noexec-mount problem. Request an executable memfd (MFD_EXEC,
+  // Linux 6.3+); retry without it on older kernels that reject the flag, then
+  // fall back to a temp file if memfd is unavailable entirely.
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
+#endif
+#ifndef MFD_EXEC
+#define MFD_EXEC 0x0010U
+#endif
+  fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC | MFD_EXEC);
+  if (fd_ == -1 && errno == EINVAL) {
+    fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC);
+  }
+  if (fd_ != -1) {
+    if (!WriteAllToFd(fd_, data, len)) {
+      errmsg_ = "could not write the native addon to an in-memory file";
+      close(fd_);
+      fd_ = -1;
+      return false;
+    }
+    path_ = "/proc/self/fd/" + std::to_string(fd_);
+    return true;
+  }
+#endif  // __linux__
+  return MaterializeTempFile(data, len);
+}
+
+// static
+std::string AddonImage::TempDir() {
+  const char* env_tmp = getenv("TMPDIR");
+  std::string tmpdir =
+      (env_tmp != nullptr && *env_tmp != '\0') ? env_tmp : "/tmp";
+  if (tmpdir.back() != '/') tmpdir.push_back('/');
+  return tmpdir;
+}
+
+bool AddonImage::MaterializeTempFile(const char* data, size_t len) {
+  // A private 0700 directory (mkdtemp) so no other user can pre-create the path
+  // as a symlink or swap the file between the write and the load; O_EXCL and
+  // O_NOFOLLOW harden the create against a race inside it.
+  std::string tmpl = TempDir() + "node-addon-XXXXXX";
+  std::vector<char> buf(tmpl.begin(), tmpl.end());
+  buf.push_back('\0');
+  if (mkdtemp(buf.data()) == nullptr) {
+    errmsg_ = "could not create a temporary directory for the native addon";
+    return false;
+  }
+  temp_dir_ = buf.data();
+  std::string file = temp_dir_ + "/addon.node";
+  fd_ = open(
+      file.c_str(), O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0600);
+  if (fd_ == -1) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  if (!WriteAllToFd(fd_, data, len)) {
+    errmsg_ = "could not write the native addon to a temporary file";
+    close(fd_);
+    fd_ = -1;
+    unlink(file.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  // dlopen() reopens by path; the post-open mapping keeps the inode alive.
+  close(fd_);
+  fd_ = -1;
+  path_ = file;
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  // The right cleanup is the same whether or not the load worked.
+  (void)opened;
+  // memfd: the load's mapping (or nothing, on failure) owns it from here.
+  if (fd_ != -1) {
+    close(fd_);
+    fd_ = -1;
+    return;
+  }
+  if (!temp_dir_.empty()) {
+    // On success the mapping keeps the inode alive, so unlinking now leaves no
+    // on-disk trace; on failure this just cleans up.
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+  }
+}
+
+AddonImage::~AddonImage() {
+  if (consumed_) return;
+  if (fd_ != -1) close(fd_);
+  if (!temp_dir_.empty()) {
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+  }
+}
+
+#endif  // _WIN32
+
+}  // namespace
+
+// Shared by process.dlopen() and the internal dlopenBinary(). `allow_binary`
+// says whether args[3] may carry the addon's bytes; it is false for
+// process.dlopen(), whose signature stays (module, filename[, flags]).
 //
 // FIXME(bnoordhuis) Not multi-context ready. TBD how to resolve the conflict
 // when two contexts try to load the same shared object. Maybe have a shadow
 // cache that's a plain C list or hash table that's shared across contexts?
-void DLOpen(const FunctionCallbackInfo<Value>& args) {
+static void DLOpenImpl(const FunctionCallbackInfo<Value>& args,
+                       bool allow_binary) {
   Environment* env = Environment::GetCurrent(args);
 
   if (env->no_native_addons()) {
@@ -463,7 +760,11 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   }
 
   int32_t flags = DLib::kDefaultFlags;
-  if (args.Length() > 2 && !args[2]->Int32Value(context).To(&flags)) {
+  // On the internal path an undefined flags argument keeps the default, so a
+  // caller can pass the bytes without choosing flags. process.dlopen() keeps
+  // its original behaviour of rejecting any non-integer that is present.
+  if (args.Length() > 2 && !(allow_binary && args[2]->IsUndefined()) &&
+      !args[2]->Int32Value(context).To(&flags)) {
     return THROW_ERR_INVALID_ARG_TYPE(env, "flag argument must be an integer.");
   }
 
@@ -476,12 +777,44 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
     return;  // Exception pending.
   }
 
-  node::Utf8Value filename(env->isolate(), args[1]);  // Cast
-  env->TryLoadAddon(*filename, flags, [&](DLib* dlib) {
+  node::Utf8Value filename(env->isolate(), args[1]);  // The addon's path,
+                                                      // used for diagnostics.
+
+  // On the internal path args[3] carries the addon's bytes, for an addon that
+  // lives somewhere dlopen() cannot open by path (e.g. a virtual file system).
+  // Materialize them into a private, self-cleaning image and load that, while
+  // still reporting `filename` in any error.
+  AddonImage image;
+  const char* load_path = *filename;
+  if (allow_binary && args.Length() > 3 && !args[3]->IsUndefined()) {
+    if (!args[3]->IsArrayBufferView()) {
+      return THROW_ERR_INVALID_ARG_TYPE(
+          env, "binary must be a Buffer, TypedArray, or DataView");
+    }
+    // Loading from bytes materializes them into an image in the temporary
+    // directory, so this needs write access there on top of the addon
+    // permission checked above. The check does not depend on whether the image
+    // actually reaches the file system on this platform (Linux uses an
+    // anonymous memfd): what a program must be granted should not vary by
+    // platform.
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        env,
+        permission::PermissionScope::kFileSystemWrite,
+        AddonImage::TempDir());
+    ArrayBufferViewContents<char> binary(args[3]);
+    if (!image.Materialize(binary.data(), binary.length())) {
+      return THROW_ERR_DLOPEN_FAILED(
+          env, "%s: %s", image.errmsg().c_str(), *filename);
+    }
+    load_path = image.path().c_str();
+  }
+
+  env->TryLoadAddon(load_path, flags, [&](DLib* dlib) {
     static Mutex dlib_load_mutex;
     Mutex::ScopedLock lock(dlib_load_mutex);
 
     const bool is_opened = dlib->Open();
+    image.AfterOpen(is_opened);
 
     // Objects containing v14 or later modules will have registered themselves
     // on the pending list.  Activate all of them now.  At present, only one
@@ -581,6 +914,20 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   // coverity[leaked_storage]
 }
 
+// process.dlopen(module, filename[, flags]). Used to load 'module.node'
+// dynamically shared objects.
+void DLOpen(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, false);
+}
+
+// Internal only, reached through the process_methods binding rather than the
+// process object: dlopenBinary(module, filename, flags, binary) loads an addon
+// from bytes already in memory. Used for addons served by a virtual file
+// system, which the dynamic loader cannot open by path.
+void DLOpenBinary(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, true);
+}
+
 inline struct node_module* FindModule(struct node_module* list,
                                       const char* name,
                                       int flag) {
diff --git a/src/node_binding.h b/src/node_binding.h
index d785ccc2238c..c200cc0d0c8a 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -36,6 +36,12 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
 #define NODE_BUILTIN_QUIC_BINDINGS(V)
 #endif
 
+#if HAVE_OPENSSL && HAVE_DTLS
+#define NODE_BUILTIN_DTLS_BINDINGS(V) V(dtls)
+#else
+#define NODE_BUILTIN_DTLS_BINDINGS(V)
+#endif
+
 #if HAVE_SQLITE
 #define NODE_BUILTIN_SQLITE_BINDINGS(V)                                        \
   V(sqlite)                                                                    \
@@ -71,7 +77,8 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
   V(url)                                                                       \
   V(worker)                                                                    \
   NODE_BUILTIN_ICU_BINDINGS(V)                                                 \
-  NODE_BUILTIN_QUIC_BINDINGS(V)
+  NODE_BUILTIN_QUIC_BINDINGS(V)                                                \
+  NODE_BUILTIN_DTLS_BINDINGS(V)
 
 #define NODE_BINDING_CONTEXT_AWARE_CPP(modname, regfunc, priv, flags)          \
   static node::node_module _module = {                                         \
@@ -161,6 +168,7 @@ void CreateInternalBindingTemplates(IsolateData* isolate_data);
 void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
+void DLOpenBinary(const v8::FunctionCallbackInfo<v8::Value>& args);
 
 }  // namespace binding
 
diff --git a/src/node_blob.cc b/src/node_blob.cc
index 57d35358fbfd..a04bc2be0ef5 100644
--- a/src/node_blob.cc
+++ b/src/node_blob.cc
@@ -110,9 +110,12 @@ void BlobFromFilePath(const FunctionCallbackInfo<Value>& args) {
   ToNamespacedPath(env, &path);
   THROW_IF_INSUFFICIENT_PERMISSIONS(
       env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
-  auto entry = DataQueue::CreateFdEntry(env, args[0]);
+  int status = 0;
+  auto entry = DataQueue::CreateFdEntry(env, args[0], &status);
   if (entry == nullptr) {
-    return THROW_ERR_INVALID_ARG_VALUE(env, "Unable to open file as blob");
+    // The file could not be stat'd. Report the libuv error so callers can tell
+    // ENOENT apart from any other reason the path could not be used.
+    return env->ThrowUVException(status, "stat", nullptr, *path);
   }
 
   std::vector<std::unique_ptr<DataQueue::Entry>> entries;
@@ -420,20 +423,16 @@ void Blob::Reader::SetWakeup(const FunctionCallbackInfo<Value>& args) {
   reader->wakeup_.Reset(args.GetIsolate(), args[0].As<Function>());
 }
 
-void Blob::Reader::NotifyPull(bool fin) {
+void Blob::Reader::NotifyPull() {
   if (wakeup_.IsEmpty() || !env()->can_call_into_js()) return;
-  // FIN notifications always fire — they must not be suppressed by
-  // pull_pending_ because there will be no further notifications to
-  // wake the iterator. Regular data notifications respect pull_pending_
-  // to coalesce multiple deliveries within a single packet.
-  if (!fin && pull_pending_) return;
+  // Coalesce notifications: if a wakeup is already pending and the reader
+  // has not yet pulled, skip re-notifying to avoid redundant wakeups
+  // within a single packet.
+  if (pull_pending_) return;
   pull_pending_ = true;
   HandleScope handle_scope(env()->isolate());
   Local<Function> fn = wakeup_.Get(env()->isolate());
-  // Pass fin as the first argument so the JS iterator knows EOS is
-  // imminent and should pull again without waiting for another wakeup.
-  Local<Value> argv[] = {v8::Boolean::New(env()->isolate(), fin)};
-  MakeCallback(fn, 1, argv);
+  MakeCallback(fn, 0, nullptr);
 }
 
 BaseObjectPtr<BaseObject> Blob::BlobTransferData::Deserialize(
diff --git a/src/node_blob.h b/src/node_blob.h
index e782b96594b5..06d3a151cfa5 100644
--- a/src/node_blob.h
+++ b/src/node_blob.h
@@ -82,7 +82,7 @@ class Blob : public BaseObject {
                                         BaseObjectPtr<Blob> blob);
     static void Pull(const v8::FunctionCallbackInfo<v8::Value>& args);
     static void SetWakeup(const v8::FunctionCallbackInfo<v8::Value>& args);
-    void NotifyPull(bool fin = false);
+    void NotifyPull();
 
     explicit Reader(Environment* env,
                     v8::Local<v8::Object> obj,
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index a0453800d84a..1093b73e6838 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -1661,9 +1661,9 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
 // Returns the offset of the first byte of `arrayBuffer` that is located at a
 // memory address which is a multiple of `alignment`. V8 does not let us choose
 // the address of a backing store, so an aligned view is obtained by
-// over-allocating `alignment - 1` bytes and skipping to that offset. The
-// backing store of a non-resizable ArrayBuffer never moves, so the offset stays
-// aligned for the lifetime of the ArrayBuffer.
+// over-allocating and skipping to that offset. The backing store of a
+// non-resizable ArrayBuffer never moves, so the offset stays aligned for the
+// lifetime of the ArrayBuffer.
 void ArrayBufferAlignedOffset(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 2);
diff --git a/src/node_builtins.cc b/src/node_builtins.cc
index 0b447d649fd9..02cda0a9bb54 100644
--- a/src/node_builtins.cc
+++ b/src/node_builtins.cc
@@ -1,4 +1,6 @@
 #include "node_builtins.h"
+#include <atomic>
+#include <cstring>
 #include "debug_utils-inl.h"
 #include "env-inl.h"
 #include "module_wrap.h"
@@ -12,7 +14,6 @@
 #include "v8-value.h"
 
 namespace node {
-namespace builtins {
 
 using loader::HostDefinedOptions;
 using v8::Boolean;
@@ -44,6 +45,16 @@ using v8::TryCatch;
 using v8::Undefined;
 using v8::Value;
 
+namespace builtins {
+
+namespace {
+std::atomic<bool> harvest_code_cache{true};
+}  // namespace
+
+void BuiltinLoader::SetHarvestCodeCache(bool on) {
+  harvest_code_cache = on;
+}
+
 BuiltinLoader::BuiltinLoader()
     : config_(GetConfig()), code_cache_(std::make_shared<BuiltinCodeCache>()) {
   LoadJavaScriptSource();
@@ -140,9 +151,14 @@ BuiltinLoader::BuiltinCategories BuiltinLoader::GetBuiltinCategories() const {
         "internal/quic/quic", "internal/quic/symbols", "internal/quic/stats",
         "internal/quic/state",
 #endif  // !OPENSSL_NO_QUIC
+#if HAVE_DTLS
+        "internal/dtls/dtls", "internal/dtls/symbols", "internal/dtls/stats",
+        "internal/dtls/state",
+#endif  // HAVE_DTLS
 #if !HAVE_FFI
         "internal/ffi-shared-buffer", "internal/ffi/fast-api",
 #endif                  // !HAVE_FFI
+        "dtls",         // Experimental.
         "ffi",          // Experimental.
         "quic",         // Experimental.
         "sqlite",       // Experimental.
@@ -417,6 +433,7 @@ MaybeLocal<Data> BuiltinLoader::LookupAndCompile(
   }
 
   if (result == Result::kWithoutCache && optional_realm != nullptr &&
+      harvest_code_cache &&
       !optional_realm->env()->isolate_data()->is_building_snapshot()) {
     // We failed to accept this cache, maybe because it was rejected, maybe
     // because it wasn't present. Either way, we'll attempt to replace this
@@ -588,12 +605,13 @@ bool BuiltinLoader::CompileAllBuiltinsAndCopyCodeCache(
 
 void BuiltinLoader::RefreshCodeCache(const std::vector<CodeCacheInfo>& in) {
   RwLock::ScopedLock lock(code_cache_->mutex);
-  code_cache_->map.reserve(in.size());
-  DCHECK(code_cache_->map.empty());
+  // May be called more than once, e.g. first with the code cache carried by
+  // the snapshot and then by an embedder with caches it built for additional
+  // (or the same) builtin ids against this isolate: merge, and let the entry
+  // supplied last win for an id present in both.
+  code_cache_->map.reserve(code_cache_->map.size() + in.size());
   for (auto const& [id, data] : in) {
-    auto result = code_cache_->map.emplace(id, data);
-    USE(result.second);
-    DCHECK(result.second);
+    code_cache_->map.insert_or_assign(id, data);
   }
   code_cache_->has_code_cache = true;
 }
@@ -913,6 +931,76 @@ void BuiltinLoader::RegisterExternalReferences(
 }
 
 }  // namespace builtins
+
+struct EmbedderBuiltinCodeCache::Impl {
+  std::vector<builtins::CodeCacheInfo> entries;
+};
+
+EmbedderBuiltinCodeCache::EmbedderBuiltinCodeCache(std::vector<Entry> entries)
+    : impl_(std::make_unique<Impl>()) {
+  impl_->entries.reserve(entries.size());
+  for (Entry& e : entries) {
+    impl_->entries.push_back(
+        {std::move(e.id),
+         builtins::BuiltinCodeCacheData(
+             std::shared_ptr<ScriptCompiler::CachedData>(std::move(e.data)))});
+  }
+}
+
+EmbedderBuiltinCodeCache::~EmbedderBuiltinCodeCache() = default;
+
+ScriptCompiler::CachedData::CompatibilityCheckResult
+EmbedderBuiltinCodeCache::CompatibilityCheck(Isolate* isolate) const {
+  for (const builtins::CodeCacheInfo& info : impl_->entries) {
+    ScriptCompiler::CachedData probe(
+        info.data.data,
+        static_cast<int>(info.data.length),
+        ScriptCompiler::CachedData::BufferNotOwned);
+    auto result = probe.CompatibilityCheck(isolate);
+    if (result != ScriptCompiler::CachedData::kSuccess) return result;
+  }
+  return ScriptCompiler::CachedData::kSuccess;
+}
+
+std::vector<EmbedderBuiltinCodeCache::Entry> EmbedderBuiltinCodeCache::Generate(
+    Local<Context> context) {
+  std::vector<Entry> out;
+  builtins::BuiltinLoader loader;
+  loader.SetEagerCompile();
+  std::vector<builtins::CodeCacheInfo> infos;
+  if (!loader.CompileAllBuiltinsAndCopyCodeCache(context, {}, &infos)) {
+    return out;
+  }
+  out.reserve(infos.size());
+  for (const builtins::CodeCacheInfo& info : infos) {
+    uint8_t* copy = new uint8_t[info.data.length];
+    memcpy(copy, info.data.data, info.data.length);
+    out.push_back({info.id,
+                   std::make_unique<ScriptCompiler::CachedData>(
+                       copy,
+                       static_cast<int>(info.data.length),
+                       ScriptCompiler::CachedData::BufferOwned)});
+  }
+  return out;
+}
+
+ScriptCompiler::CachedData::CompatibilityCheckResult SetBuiltinCodeCache(
+    IsolateData* isolate_data, const EmbedderBuiltinCodeCache* cache) {
+  if (cache == nullptr) {
+    isolate_data->set_builtin_code_cache({});
+    return ScriptCompiler::CachedData::kSuccess;
+  }
+  auto check = cache->CompatibilityCheck(isolate_data->isolate());
+  if (check == ScriptCompiler::CachedData::kSuccess) {
+    isolate_data->set_builtin_code_cache(cache->impl_->entries);
+  } else {
+    per_process::Debug(DebugCategory::CODE_CACHE,
+                       "EmbedderBuiltinCodeCache rejected: %d\n",
+                       static_cast<int>(check));
+  }
+  return check;
+}
+
 }  // namespace node
 
 NODE_BINDING_PER_ISOLATE_INIT(
diff --git a/src/node_builtins.h b/src/node_builtins.h
index b51b85ff6f23..89fe7f5c1aa7 100644
--- a/src/node_builtins.h
+++ b/src/node_builtins.h
@@ -125,8 +125,16 @@ class NODE_EXTERN_PRIVATE BuiltinLoader {
       v8::Local<v8::Context> context,
       const std::vector<std::string>& lazy_builtins,
       std::vector<CodeCacheInfo>* out);
+  // Adds the given code cache entries, replacing existing entries with the
+  // same id. Can be called more than once (e.g. with the snapshot's code cache
+  // and then with caches an embedder built for further builtin ids).
   void RefreshCodeCache(const std::vector<CodeCacheInfo>& in);
 
+  // Whether builtins compiled without a cache serialize one for later
+  // consumers (worker threads copy it). See
+  // ProcessInitializationFlags::kNoHarvestBuiltinCodeCache.
+  static void SetHarvestCodeCache(bool on);
+
   void CopySourceAndCodeCacheReferenceFrom(const BuiltinLoader* other);
 
   [[nodiscard]] std::ranges::keys_view<
diff --git a/src/node_config_file.cc b/src/node_config_file.cc
index 68c13ad881fc..73d2342d81f1 100644
--- a/src/node_config_file.cc
+++ b/src/node_config_file.cc
@@ -451,7 +451,7 @@ ParseResult ConfigReader::ParseConfigObject(
     }
   }
 
-  // Add implicit flags for namespaces (--test, --permission, --watch)
+  // Add implicit flags for namespaces (--bench, --test, --permission, --watch)
   // These flags are automatically enabled when their namespace is present
   for (const auto& ns : namespaces_with_implicit_flags) {
     std::string flag = "--" + ns;
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 7d52d835ca4c..e82167b1fb4e 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -48,6 +48,7 @@ namespace crypto {
   V(Hmac)                                                                      \
   V(Keygen)                                                                    \
   V(Keys)                                                                      \
+  V(Mac)                                                                       \
   V(NativeCryptoKey)                                                           \
   V(NativeKeyObject)                                                           \
   V(PBKDF2Job)                                                                 \
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 3bb95cb340d2..f3e006e5fee8 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -48,6 +48,7 @@
 #endif
 #include "crypto/crypto_keygen.h"
 #include "crypto/crypto_keys.h"
+#include "crypto/crypto_mac.h"
 #include "crypto/crypto_pbkdf2.h"
 #include "crypto/crypto_pqc.h"
 #include "crypto/crypto_random.h"
diff --git a/src/node_errors.cc b/src/node_errors.cc
index 2c464bb895e5..cf000047d38d 100644
--- a/src/node_errors.cc
+++ b/src/node_errors.cc
@@ -191,6 +191,9 @@ static std::string GetErrorSource(Isolate* isolate,
 
 static std::atomic<bool> is_in_oom{false};
 static thread_local std::atomic<bool> is_retrieving_js_stacktrace{false};
+// This is thread-local because it only guards re-entrancy within the current
+// thread's uncaught-exception path; no cross-thread synchronization is needed.
+static thread_local bool is_in_uncaught_exception = false;
 MaybeLocal<StackTrace> GetCurrentStackTrace(Isolate* isolate, int frame_count) {
   if (isolate == nullptr) {
     return MaybeLocal<StackTrace>();
@@ -1302,6 +1305,26 @@ void TriggerUncaughtException(Isolate* isolate,
   CHECK(isolate->InContext());
   Local<Context> context = isolate->GetCurrentContext();
   Environment* env = Environment::GetCurrent(context);
+  // Re-entrancy guard: prevent infinite recursion when the JS-level
+  // exception handler (process._fatalException) itself triggers another
+  // exception through the inspector protocol, causing V8's pending message
+  // reporting to call TriggerUncaughtException reentrantly.
+  if (is_in_uncaught_exception) {
+    PrintToStderrAndFlush(
+        "FATAL ERROR: Re-entrant uncaught exception detected.\n"
+        "The exception handler threw an error while processing a\n"
+        "previous uncaught exception, likely due to an inspector\n"
+        "protocol issue. Aborting to prevent infinite recursion.\n" +
+        FormatCaughtException(isolate, context, error, message));
+    ABORT();
+  }
+  // RAII guard to ensure the flag is cleared when TriggerUncaughtException
+  // returns normally. Note: ABORT() and env->Exit() do not run this
+  // destructor, which is intentional — the process is terminating.
+  struct UncaughtExceptionGuard {
+    UncaughtExceptionGuard() { is_in_uncaught_exception = true; }
+    ~UncaughtExceptionGuard() { is_in_uncaught_exception = false; }
+  } uncaught_exception_guard;
   if (env == nullptr) {
     // This means that the exception happens before Environment is assigned
     // to the context e.g. when there is a SyntaxError in a per-context
diff --git a/src/node_errors.h b/src/node_errors.h
index 62cfba88f00d..cab1dc76dcc7 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -62,12 +62,15 @@ void OOMErrorHandler(const char* location, const v8::OOMDetails& details);
   V(ERR_CRYPTO_INVALID_KEYLEN, RangeError)                                     \
   V(ERR_CRYPTO_INVALID_KEYPAIR, RangeError)                                    \
   V(ERR_CRYPTO_INVALID_KEYTYPE, RangeError)                                    \
+  V(ERR_CRYPTO_INVALID_MAC, TypeError)                                         \
   V(ERR_CRYPTO_INVALID_MESSAGELEN, RangeError)                                 \
   V(ERR_CRYPTO_INVALID_SCRYPT_PARAMS, RangeError)                              \
   V(ERR_CRYPTO_INVALID_STATE, Error)                                           \
   V(ERR_CRYPTO_INVALID_TAG_LENGTH, RangeError)                                 \
   V(ERR_CRYPTO_JWK_UNSUPPORTED_CURVE, Error)                                   \
   V(ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE, Error)                                \
+  V(ERR_CRYPTO_MAC_NOT_SUPPORTED, Error)                                       \
+  V(ERR_CRYPTO_MAC_UPDATE_FAILED, Error)                                       \
   V(ERR_CRYPTO_OPERATION_FAILED, Error)                                        \
   V(ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH, RangeError)                           \
   V(ERR_CRYPTO_UNKNOWN_CIPHER, Error)                                          \
diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index 7e3da95b958f..88327f1f1c47 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -35,6 +35,7 @@ using v8::MaybeLocal;
 using v8::Object;
 using v8::PropertyAttribute;
 using v8::ReadOnly;
+using v8::Signature;
 using v8::String;
 using v8::TryCatch;
 using v8::Value;
@@ -1238,16 +1239,19 @@ Local<FunctionTemplate> DynamicLibrary::GetConstructorTemplate(
     tmpl = NewFunctionTemplate(isolate, DynamicLibrary::New);
     tmpl->InstanceTemplate()->SetInternalFieldCount(
         DynamicLibrary::kInternalFieldCount);
+    Local<Signature> signature = Signature::New(isolate, tmpl);
 
     tmpl->InstanceTemplate()->SetAccessorProperty(
         env->path_string(),
-        FunctionTemplate::New(env->isolate(), DynamicLibrary::GetPath),
+        FunctionTemplate::New(
+            isolate, DynamicLibrary::GetPath, Local<Value>(), signature),
         Local<FunctionTemplate>(),
         attributes);
 
     tmpl->InstanceTemplate()->SetAccessorProperty(
         FIXED_ONE_BYTE_STRING(isolate, "symbols"),
-        FunctionTemplate::New(env->isolate(), DynamicLibrary::GetSymbols),
+        FunctionTemplate::New(
+            isolate, DynamicLibrary::GetSymbols, Local<Value>(), signature),
         Local<FunctionTemplate>(),
         attributes);
 
@@ -1257,7 +1261,8 @@ Local<FunctionTemplate> DynamicLibrary::GetConstructorTemplate(
     // reason.
     tmpl->PrototypeTemplate()->SetAccessorProperty(
         FIXED_ONE_BYTE_STRING(isolate, "functions"),
-        FunctionTemplate::New(env->isolate(), DynamicLibrary::GetFunctions),
+        FunctionTemplate::New(
+            isolate, DynamicLibrary::GetFunctions, Local<Value>(), signature),
         Local<FunctionTemplate>(),
         static_cast<PropertyAttribute>(ReadOnly));
 
diff --git a/src/node_file.cc b/src/node_file.cc
index b2e765346cf1..b047c5a8e6a7 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -64,6 +64,8 @@ namespace node {
 namespace fs {
 
 using v8::Array;
+using v8::ArrayBuffer;
+using v8::ArrayBufferView;
 using v8::BigInt;
 using v8::Context;
 using v8::EscapableHandleScope;
@@ -86,6 +88,8 @@ using v8::ObjectTemplate;
 using v8::Promise;
 using v8::String;
 using v8::TryCatch;
+using v8::Uint32Array;
+using v8::Uint8Array;
 using v8::Undefined;
 using v8::Value;
 
@@ -758,6 +762,12 @@ void NewFSReqCallback(const FunctionCallbackInfo<Value>& args) {
   new FSReqCallback(binding_data, args.This(), args[0]->IsTrue());
 }
 
+void CancelFSReq(const FunctionCallbackInfo<Value>& args) {
+  FSReqBase* req_wrap;
+  ASSIGN_OR_RETURN_UNWRAP(&req_wrap, args.This());
+  req_wrap->Cancel();
+}
+
 FSReqAfterScope::FSReqAfterScope(FSReqBase* wrap, uv_fs_t* req)
     : wrap_(wrap),
       req_(req),
@@ -1828,7 +1838,7 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
   }
 
   // On Windows path::c_str() returns wide char, convert to std::string first.
-  std::string file_path_str = file_path.string();
+  std::string file_path_str = ConvertPathToUTF8(file_path);
   const char* path_c_str = file_path_str.c_str();
 #ifdef _WIN32
   int permission_denied_error = EPERM;
@@ -1837,14 +1847,14 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 #endif  // !_WIN32
 
   if (error == std::errc::operation_not_permitted) {
-    std::string message = "Operation not permitted: " + file_path_str;
+    std::string message = "Operation not permitted:";
     return env->ThrowErrnoException(EPERM, "rm", message.c_str(), path_c_str);
   } else if (error == std::errc::directory_not_empty) {
-    std::string message = "Directory not empty: " + file_path_str;
+    std::string message = "Directory not empty:";
     return env->ThrowErrnoException(
         ENOTEMPTY, "rm", message.c_str(), path_c_str);
   } else if (error == std::errc::not_a_directory) {
-    std::string message = "Not a directory: " + file_path_str;
+    std::string message = "Not a directory:";
     return env->ThrowErrnoException(ENOTDIR, "rm", message.c_str(), path_c_str);
 #ifdef _AIX
   } else if (error == std::errc::permission_denied ||
@@ -1855,7 +1865,7 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 #else
   } else if (error == std::errc::permission_denied) {
 #endif
-    std::string message = "Permission denied: " + file_path_str;
+    std::string message = "Permission denied:";
     return env->ThrowErrnoException(
         permission_denied_error, "rm", message.c_str(), path_c_str);
   }
@@ -2252,6 +2262,486 @@ static void ReadDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+namespace {
+
+// Recursive readdir.
+//
+// The result is breadth-first: every entry of the root, then every entry of
+// the first subdirectory, and so on, each directory's entries in the order
+// uv_fs_scandir() reports them. Symbolic links to directories are followed,
+// see https://github.com/nodejs/node/issues/52663.
+//
+// The tree is walked by one or more threads that share a queue of
+// directories, and the breadth-first order is derived from the tree
+// afterwards, so it does not depend on which thread scanned what. The walk
+// does not touch the Environment; lib does not use it when the permission
+// model is enabled, as every directory would need a check on the main thread.
+
+// Maps an st_mode to the uv_dirent_type_t that uv_fs_scandir would report.
+uv_dirent_type_t DirentTypeFromMode(uint64_t mode) {
+  switch (mode & S_IFMT) {
+    case S_IFREG:
+      return UV_DIRENT_FILE;
+    case S_IFDIR:
+      return UV_DIRENT_DIR;
+    case S_IFLNK:
+      return UV_DIRENT_LINK;
+    case S_IFCHR:
+      return UV_DIRENT_CHAR;
+#ifdef S_IFIFO
+    case S_IFIFO:
+      return UV_DIRENT_FIFO;
+#endif
+#ifdef S_IFSOCK
+    case S_IFSOCK:
+      return UV_DIRENT_SOCKET;
+#endif
+#ifdef S_IFBLK
+    case S_IFBLK:
+      return UV_DIRENT_BLOCK;
+#endif
+    default:
+      return UV_DIRENT_UNKNOWN;
+  }
+}
+
+// Appends `name` to `path`, with a separator unless `path` already ends in
+// one (so that a root of "dir/" does not turn into "dir//name").
+void AppendPathComponent(std::string* path, std::string_view name) {
+  if (name.empty()) return;
+  if (!path->empty()) {
+#ifdef _WIN32
+    const bool has_separator = path->back() == '\\' || path->back() == '/';
+    if (!has_separator) *path += '\\';
+#else
+    const bool has_separator = path->back() == '/';
+    if (!has_separator) *path += '/';
+#endif
+  }
+  path->append(name);
+}
+
+struct ReadDirEntry {
+  // Offset and length of the name within ScannedDirectory::names.
+  uint32_t name_offset;
+  uint32_t name_length;
+  uint8_t type;  // A uv_dirent_type_t.
+  // Whether the walk descends into this entry (a directory, or a symbolic
+  // link to one).
+  bool is_dir = false;
+};
+
+// One directory of the tree.
+struct ScannedDirectory {
+  explicit ScannedDirectory(std::string relative)
+      : relative(std::move(relative)) {}
+
+  std::string_view name(const ReadDirEntry& entry) const {
+    return std::string_view(names).substr(entry.name_offset, entry.name_length);
+  }
+
+  // Path relative to the root; empty for the root itself.
+  const std::string relative;
+  // The entry names, concatenated.
+  std::string names;
+  std::vector<ReadDirEntry> entries;
+  // Indices (into RecursiveReadDir::dirs()) of the subdirectories, in entry
+  // order.
+  std::vector<uint32_t> subdirs;
+};
+
+class RecursiveReadDir {
+ public:
+  explicit RecursiveReadDir(std::string root) : root_(std::move(root)) {
+    dirs_.push_back(std::make_unique<ScannedDirectory>(""));
+  }
+
+  // Scans directories until none are left or an error occurred. May be
+  // called from several threads at once, which then share the work.
+  void Run();
+  void RunWithHelpers(int max_helpers);
+
+  // The following are only valid once every Run() has returned.
+
+  // 0 or a uv error code; error_path() is then the directory that failed.
+  int error() const { return error_; }
+  const std::string& error_path() const { return error_path_; }
+
+  const std::vector<std::unique_ptr<ScannedDirectory>>& dirs() const {
+    return dirs_;
+  }
+
+  // The indices of dirs() in breadth-first order.
+  std::vector<uint32_t> BreadthFirstOrder() const {
+    std::vector<uint32_t> order;
+    order.reserve(dirs_.size());
+    order.push_back(0);
+    for (size_t i = 0; i < order.size(); i++) {
+      for (uint32_t subdir : dirs_[order[i]]->subdirs) order.push_back(subdir);
+    }
+    return order;
+  }
+
+ private:
+  // Reads the directory at `path` into `dir`, resolving the type of entries
+  // where needed, and creates the ScannedDirectory of each subdirectory.
+  static int Scan(const std::string& path,
+                  ScannedDirectory* dir,
+                  std::vector<std::unique_ptr<ScannedDirectory>>* subdirs);
+
+  // Called with the lock held.
+  void MaybeStartHelper();
+
+  // The number of entries a walk has to have seen, with directories still
+  // to scan, before RunWithHelpers() starts a helper thread.
+  static constexpr size_t kHelperThreshold = 1024;
+
+  const std::string root_;
+
+  Mutex mutex_;
+  ConditionVariable cv_;
+  // Directories in the order they were found; the first next_ have been or
+  // are being scanned by one of the active_ threads.
+  std::vector<std::unique_ptr<ScannedDirectory>> dirs_;
+  size_t next_ = 0;
+  size_t active_ = 0;
+  size_t entries_seen_ = 0;
+  int error_ = 0;
+  std::string error_path_;
+  size_t max_helpers_ = 0;
+  std::vector<uv_thread_t> helpers_;
+};
+
+void RecursiveReadDir::RunWithHelpers(int max_helpers) {
+  max_helpers_ = max_helpers;
+  Run();
+  for (uv_thread_t& helper : helpers_) CHECK_EQ(uv_thread_join(&helper), 0);
+}
+
+void RecursiveReadDir::Run() {
+  std::vector<std::unique_ptr<ScannedDirectory>> subdirs;
+  std::string path;
+  Mutex::ScopedLock lock(mutex_);
+  for (;;) {
+    while (next_ == dirs_.size() && active_ > 0 && error_ == 0) {
+      cv_.Wait(lock);
+    }
+    if (next_ == dirs_.size() || error_ != 0) return;
+
+    ScannedDirectory* dir = dirs_[next_++].get();
+    active_++;
+    int r;
+    {
+      Mutex::ScopedUnlock unlock(lock);
+      path = root_;
+      AppendPathComponent(&path, dir->relative);
+      r = Scan(path, dir, &subdirs);
+    }
+    active_--;
+
+    if (r != 0) {
+      if (error_ == 0) {
+        error_ = r;
+        error_path_ = std::move(path);
+      }
+    } else {
+      for (std::unique_ptr<ScannedDirectory>& subdir : subdirs) {
+        dir->subdirs.push_back(static_cast<uint32_t>(dirs_.size()));
+        dirs_.push_back(std::move(subdir));
+      }
+      entries_seen_ += dir->entries.size();
+    }
+    // Wake the others if there is new work, or nothing left to wait for.
+    if (!subdirs.empty() || active_ == 0 || error_ != 0) cv_.Broadcast(lock);
+    subdirs.clear();
+    MaybeStartHelper();
+  }
+}
+
+void RecursiveReadDir::MaybeStartHelper() {
+  if (helpers_.size() >= max_helpers_ || entries_seen_ < kHelperThreshold ||
+      dirs_.size() - next_ < 2) {
+    return;
+  }
+  uv_thread_t helper;
+  int r = uv_thread_create(
+      &helper,
+      [](void* arg) { static_cast<RecursiveReadDir*>(arg)->Run(); },
+      this);
+  if (r == 0) {
+    helpers_.push_back(helper);
+  } else {
+    max_helpers_ = 0;  // Carry on alone.
+  }
+}
+
+int RecursiveReadDir::Scan(
+    const std::string& path,
+    ScannedDirectory* dir,
+    std::vector<std::unique_ptr<ScannedDirectory>>* subdirs) {
+  uv_fs_t req;
+  int r = uv_fs_scandir(nullptr, &req, path.c_str(), 0, nullptr);
+  if (r >= 0) {
+    dir->entries.reserve(r);
+    uv_dirent_t ent;
+    while ((r = uv_fs_scandir_next(&req, &ent)) == 0) {
+      const size_t length = strlen(ent.name);
+      dir->entries.push_back({static_cast<uint32_t>(dir->names.size()),
+                              static_cast<uint32_t>(length),
+                              static_cast<uint8_t>(ent.type)});
+      dir->names.append(ent.name, length);
+    }
+    if (r == UV_EOF) r = 0;
+  }
+  uv_fs_req_cleanup(&req);
+  if (r != 0) return r;
+
+  std::string child;
+  for (ReadDirEntry& entry : dir->entries) {
+    const std::string_view name = dir->name(entry);
+    if (entry.type == UV_DIRENT_UNKNOWN || entry.type == UV_DIRENT_LINK) {
+      // The file system did not report a type, or the entry is a symbolic
+      // link that may point at a directory.
+      child = path;
+      AppendPathComponent(&child, name);
+      if (entry.type == UV_DIRENT_UNKNOWN) {
+        if (uv_fs_lstat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.type = DirentTypeFromMode(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+      if (entry.type == UV_DIRENT_LINK) {
+        if (uv_fs_stat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.is_dir = S_ISDIR(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+    }
+    if (entry.type == UV_DIRENT_DIR) entry.is_dir = true;
+
+    if (entry.is_dir) {
+      std::string relative = dir->relative;
+      AppendPathComponent(&relative, name);
+      subdirs->push_back(
+          std::make_unique<ScannedDirectory>(std::move(relative)));
+    }
+  }
+  return 0;
+}
+
+// Without file types the result is an array of paths relative to the root.
+// With file types it is [names, types, counts, dirs]: `types` is a
+// Uint8Array with the uv_dirent_type_t of every entry, `dirs` the relative
+// path of every directory in the order their entries appear, and `counts` a
+// Uint32Array with the number of entries in each of those directories. See
+// getRecursiveDirents() in lib/internal/fs/utils.js.
+MaybeLocal<Value> MarshalRecursiveReadDir(Isolate* isolate,
+                                          const RecursiveReadDir& walk,
+                                          enum encoding encoding,
+                                          bool with_types) {
+  EscapableHandleScope scope(isolate);
+  const std::vector<uint32_t> order = walk.BreadthFirstOrder();
+
+  LocalVector<Value> names(isolate);
+  LocalVector<Value> dirs(isolate);
+  std::vector<uint8_t> types;
+  std::vector<uint32_t> counts;
+  std::string path;
+  for (uint32_t index : order) {
+    const ScannedDirectory& dir = *walk.dirs()[index];
+    for (const ReadDirEntry& entry : dir.entries) {
+      std::string_view data = dir.name(entry);
+      if (!with_types) {
+        path = dir.relative;
+        AppendPathComponent(&path, data);
+        data = path;
+      }
+      Local<Value> name;
+      if (!StringBytes::Encode(isolate, data.data(), data.size(), encoding)
+               .ToLocal(&name)) {
+        return MaybeLocal<Value>();
+      }
+      names.push_back(name);
+      types.push_back(entry.type);
+    }
+    if (!with_types) continue;
+    counts.push_back(static_cast<uint32_t>(dir.entries.size()));
+    Local<Value> relative;
+    if (!StringBytes::Encode(
+             isolate, dir.relative.data(), dir.relative.size(), encoding)
+             .ToLocal(&relative)) {
+      return MaybeLocal<Value>();
+    }
+    dirs.push_back(relative);
+  }
+
+  if (!with_types) {
+    return scope.Escape(Array::New(isolate, names.data(), names.size()));
+  }
+
+  // One ArrayBuffer holding the types, then (4-byte aligned) the counts.
+  const size_t counts_offset = (types.size() + 3) & ~static_cast<size_t>(3);
+  Local<ArrayBuffer> ab = ArrayBuffer::New(
+      isolate, counts_offset + counts.size() * sizeof(uint32_t));
+  char* bytes = static_cast<char*>(ab->Data());
+  memcpy(bytes, types.data(), types.size());
+  memcpy(
+      bytes + counts_offset, counts.data(), counts.size() * sizeof(uint32_t));
+
+  Local<Value> parts[] = {
+      Array::New(isolate, names.data(), names.size()),
+      Uint8Array::New(ab, 0, types.size()),
+      Uint32Array::New(ab, counts_offset, counts.size()),
+      Array::New(isolate, dirs.data(), dirs.size()),
+  };
+  return scope.Escape(Array::New(isolate, parts, arraysize(parts)));
+}
+
+// The number of thread pool work items that share an asynchronous walk, and
+// the number of helper threads a synchronous walk may start.
+constexpr int kReadDirRecursiveWorkers = 4;
+constexpr int kReadDirRecursiveSyncHelpers = kReadDirRecursiveWorkers - 1;
+
+// An asynchronous recursive readdir: the walk, and the request it settles
+// once every worker has finished.
+class ReadDirRecursiveRequest {
+ public:
+  ReadDirRecursiveRequest(Environment* env,
+                          FSReqBase* req_wrap,
+                          std::string path,
+                          enum encoding encoding,
+                          bool with_types,
+                          int workers)
+      : env_(env),
+        req_wrap_(req_wrap),
+        walk_(std::move(path)),
+        encoding_(encoding),
+        with_types_(with_types),
+        pending_(workers) {}
+
+  RecursiveReadDir* walk() { return &walk_; }
+
+  // Called on the main thread when a worker is done.
+  void OnWorkerDone(int status) {
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED) cancelled_ = true;
+    if (--pending_ > 0) return;
+
+    Isolate* isolate = env_->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env_->context());
+
+    // Release the request even if the environment is shutting down.
+    BaseObjectPtr<FSReqBase> req_wrap = std::move(req_wrap_);
+    req_wrap->Detach();
+
+    FS_ASYNC_TRACE_END1(UV_FS_SCANDIR, req_wrap.get(), "result", walk_.error())
+    if (cancelled_ || !env_->can_call_into_js()) return;
+
+    if (walk_.error() != 0) {
+      return req_wrap->Reject(UVException(isolate,
+                                          walk_.error(),
+                                          "scandir",
+                                          nullptr,
+                                          walk_.error_path().c_str()));
+    }
+
+    Local<Value> value;
+    TryCatch try_catch(isolate);
+    if (!MarshalRecursiveReadDir(isolate, walk_, encoding_, with_types_)
+             .ToLocal(&value)) {
+      CHECK(try_catch.CanContinue());
+      return req_wrap->Reject(try_catch.Exception());
+    }
+    req_wrap->Resolve(value);
+  }
+
+ private:
+  Environment* const env_;
+  BaseObjectPtr<FSReqBase> req_wrap_;
+  RecursiveReadDir walk_;
+  const enum encoding encoding_;
+  const bool with_types_;
+  int pending_;
+  bool cancelled_ = false;
+};
+
+class ReadDirRecursiveWork final : public ThreadPoolWork {
+ public:
+  ReadDirRecursiveWork(Environment* env,
+                       std::shared_ptr<ReadDirRecursiveRequest> request)
+      : ThreadPoolWork(env, "readdir_recursive"),
+        request_(std::move(request)) {}
+
+  void DoThreadPoolWork() override { request_->walk()->Run(); }
+
+  void AfterThreadPoolWork(int status) override {
+    std::unique_ptr<ReadDirRecursiveWork> self(this);
+    request_->OnWorkerDone(status);
+  }
+
+ private:
+  std::shared_ptr<ReadDirRecursiveRequest> request_;
+};
+
+}  // namespace
+
+// readdirRecursive(path, encoding, withTypes[, req])
+static void ReadDirRecursive(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  const int argc = args.Length();
+  CHECK_GE(argc, 3);
+
+  BufferValue path(isolate, args[0]);
+  CHECK_NOT_NULL(*path);
+  ToNamespacedPath(env, &path);
+
+  const enum encoding encoding = ParseEncoding(isolate, args[1], UTF8);
+
+  bool with_types = args[2]->IsTrue();
+
+  // Every directory would need a permission check, and only the main thread
+  // can do those: lib walks the tree in JS when the permission model is on.
+  CHECK(!env->permission()->enabled());
+
+  if (argc > 3) {  // readdirRecursive(path, encoding, withTypes, req)
+    FSReqBase* req_wrap_async = GetReqWrap(args, 3);
+    CHECK_NOT_NULL(req_wrap_async);
+    req_wrap_async->Init("scandir", nullptr, 0, encoding);
+    FS_ASYNC_TRACE_BEGIN1(
+        UV_FS_SCANDIR, req_wrap_async, "path", TRACE_STR_COPY(*path))
+    auto request =
+        std::make_shared<ReadDirRecursiveRequest>(env,
+                                                  req_wrap_async,
+                                                  path.ToString(),
+                                                  encoding,
+                                                  with_types,
+                                                  kReadDirRecursiveWorkers);
+    for (int i = 0; i < kReadDirRecursiveWorkers; i++) {
+      (new ReadDirRecursiveWork(env, request))->ScheduleWork();
+    }
+  } else {  // readdirRecursive(path, encoding, withTypes)
+    env->PrintSyncTrace();
+    FS_SYNC_TRACE_BEGIN(readdir);
+    RecursiveReadDir walk(path.ToString());
+    walk.RunWithHelpers(kReadDirRecursiveSyncHelpers);
+    FS_SYNC_TRACE_END(readdir);
+
+    if (walk.error() != 0) {
+      return env->ThrowUVException(
+          walk.error(), "scandir", nullptr, walk.error_path().c_str());
+    }
+
+    Local<Value> value;
+    if (MarshalRecursiveReadDir(isolate, walk, encoding, with_types)
+            .ToLocal(&value)) {
+      args.GetReturnValue().Set(value);
+    }
+  }
+}
+
 static inline Maybe<void> AsyncCheckOpenPermissions(Environment* env,
                                                     FSReqBase* req_wrap,
                                                     const BufferValue& path,
@@ -3214,6 +3704,7 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   SET_SELF_SIZE(ReadFileJob)
 
  private:
+  friend class WriteFileJob;
   static constexpr size_t kUnknownSizeChunk = 64 * 1024;
   static constexpr size_t kMaxReadChunk = 256 * 1024 * 1024;
 
@@ -3297,6 +3788,162 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   int fd_ = -1;
 };
 
+// Writes a whole buffer to a file in ONE thread pool round trip -- open +
+// write (until everything is written) + close -- for fs.writeFile() and
+// fs.promises.writeFile() with a path, which otherwise pay one round trip per
+// step.
+//
+// JS: const job = new WriteFileJob(path, flags, mode, buffer);
+//     job.ondone = (err) => {...}; job.run(path);
+// `err` carries the syscall that failed ('open', 'write' or 'close'); the file
+// descriptor opened here is always closed.
+class WriteFileJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_GE(args.Length(), 4);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    CHECK(args[1]->IsInt32());
+    CHECK(args[2]->IsInt32());
+    CHECK(args[3]->IsArrayBufferView());
+    new WriteFileJob(env,
+                     args.This(),
+                     path.ToString(),
+                     args[1].As<Int32>()->Value(),
+                     args[2].As<Int32>()->Value(),
+                     args[3].As<ArrayBufferView>());
+  }
+
+  // Returns undefined when the job was scheduled, or the ERR_ACCESS_DENIED
+  // error the asynchronous open() would have delivered (nothing is scheduled).
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    WriteFileJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    Environment* env = job->AsyncWrap::env();
+    CHECK(!job->scheduled_);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    Local<Value> access_error;
+    if (ReadFileJob::OpenPermissionError(env, path, job->flags_)
+            .ToLocal(&access_error)) {
+      args.GetReturnValue().Set(access_error);
+      return;
+    }
+    job->scheduled_ = true;
+    job->ClearWeak();
+    FS_ASYNC_TRACE_BEGIN0(UV_FS_WRITE, job)
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    uv_fs_t req;
+    int fd = uv_fs_open(nullptr, &req, path_.c_str(), flags_, mode_, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (fd < 0) return Fail("open", fd);
+
+    size_t written = 0;
+    while (written < length_) {
+      uv_buf_t buf = uv_buf_init(data_ + written,
+                                 static_cast<unsigned int>(std::min<size_t>(
+                                     length_ - written, kMaxWriteChunk)));
+      int r = uv_fs_write(nullptr, &req, fd, &buf, 1, -1, nullptr);
+      uv_fs_req_cleanup(&req);
+      if (r < 0) {
+        Fail("write", r);
+        break;
+      }
+      written += static_cast<size_t>(r);
+    }
+
+    int rc = uv_fs_close(nullptr, &req, fd, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (rc < 0 && error_ == 0) Fail("close", rc);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<WriteFileJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    FS_ASYNC_TRACE_END0(UV_FS_WRITE, this)
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    HandleScope handle_scope(env->isolate());
+    Context::Scope context_scope(env->context());
+    Isolate* isolate = env->isolate();
+    Local<Value> argv[1] = {Null(isolate)};
+    if (error_ != 0) {
+      argv[0] = UVException(isolate,
+                            error_,
+                            syscall_,
+                            nullptr,
+                            syscall_ == kOpen ? path_.c_str() : nullptr);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    tracker->TrackField("buffer", buffer_);
+    if (copy_) tracker->TrackFieldWithSize("copy", length_);
+  }
+  SET_MEMORY_INFO_NAME(WriteFileJob)
+  SET_SELF_SIZE(WriteFileJob)
+
+ private:
+  static constexpr size_t kMaxWriteChunk = 256 * 1024 * 1024;
+  static constexpr const char* kOpen = "open";
+
+  WriteFileJob(Environment* env,
+               Local<Object> object,
+               std::string&& path,
+               int flags,
+               int mode,
+               Local<ArrayBufferView> view)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.writefile"),
+        path_(std::move(path)),
+        flags_(flags),
+        mode_(mode) {
+    // Holding the backing store keeps the memory valid even if the buffer is
+    // detached or collected meanwhile; a resizable buffer can still have its
+    // pages decommitted by a shrink, so its contents are copied instead.
+    length_ = view->ByteLength();
+    backing_store_ = view->Buffer()->GetBackingStore();
+    if (backing_store_->IsResizableByUserJavaScript()) {
+      copy_.reset(new char[length_]);
+      memcpy(copy_.get(),
+             static_cast<char*>(backing_store_->Data()) + view->ByteOffset(),
+             length_);
+      data_ = copy_.get();
+      backing_store_.reset();
+    } else {
+      buffer_.Reset(env->isolate(), view);
+      data_ = static_cast<char*>(backing_store_->Data()) + view->ByteOffset();
+    }
+    MakeWeak();
+  }
+
+  void Fail(const char* syscall, int error) {
+    syscall_ = syscall;
+    error_ = error;
+  }
+
+  const std::string path_;
+  v8::Global<v8::ArrayBufferView> buffer_;
+  std::shared_ptr<v8::BackingStore> backing_store_;
+  std::unique_ptr<char[]> copy_;
+  char* data_ = nullptr;
+  size_t length_ = 0;
+  const int flags_;
+  const int mode_;
+  bool scheduled_ = false;
+  int error_ = 0;
+  const char* syscall_ = nullptr;
+};
+
 // Wrapper for readv(2).
 //
 // bytesRead = fs.readv(fd, buffers[, position], callback)
@@ -3942,217 +4589,266 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-static bool CopyUtimes(const std::filesystem::path& src,
-                       const std::filesystem::path& dest,
-                       Environment* env) {
-  uv_fs_t req;
-  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-
-  auto src_path_str = ConvertPathToUTF8(src);
-  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
-  if (is_uv_error(result)) {
-    env->ThrowUVException(result, "stat", nullptr, src_path_str.c_str());
-    return false;
+std::vector<std::string> normalizePathToArray(
+    const std::filesystem::path& path) {
+  std::vector<std::string> parts;
+  std::error_code error;
+  std::filesystem::path absPath = std::filesystem::absolute(path, error);
+  if (error) absPath = path;
+#ifdef _WIN32
+  auto wstr = absPath.wstring();
+  if (wstr.starts_with(L"\\\\?\\")) {
+    absPath = std::filesystem::path(wstr.substr(4));
   }
+#endif
+  for (const auto& part : absPath) {
+    if (!part.empty()) parts.push_back(part.string());
+  }
+  return parts;
+}
 
-  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
-  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
-  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
-
-  auto dest_file_path_str = ConvertPathToUTF8(dest);
-  int utime_result = uv_fs_utime(nullptr,
-                                 &req,
-                                 dest_file_path_str.c_str(),
-                                 source_atime,
-                                 source_mtime,
-                                 nullptr);
-  if (is_uv_error(utime_result)) {
-    env->ThrowUVException(
-        utime_result, "utime", nullptr, dest_file_path_str.c_str());
-    return false;
-  }
-  return true;
+bool isInsideDir(const std::filesystem::path& src,
+                 const std::filesystem::path& dest) {
+  auto srcArr = normalizePathToArray(src);
+  auto destArr = normalizePathToArray(dest);
+  if (srcArr.size() > destArr.size()) return false;
+  return std::equal(srcArr.begin(), srcArr.end(), destArr.begin());
 }
 
-static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-
-  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
-
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
+namespace {
 
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
+// An fs.cp error recorded on whatever thread performed the copy; Throw() /
+// ToException() turn it into the error the JavaScript caller sees.
+struct CpError {
+  enum Kind {
+    kNone,
+    kErrno,
+    kUv,
+    kEinval,
+    kSymlinkToSubdirectory,
+    kEexist,
+    kSocket,
+    kFifo,
+    kUnknown
+  };
+  Kind kind = kNone;
+  int code = 0;
+  const char* syscall = "cp";
+  std::string message;
+  std::string path;
 
-  int mode;
-  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
-    return;
+  static CpError Std(const std::error_code& error, const std::string& path) {
+    return {kErrno, error.value(), "cp", error.message(), path};
+  }
+  static CpError Uv(int code, const char* syscall, const std::string& path) {
+    return {kUv, code, syscall, {}, path};
   }
 
-  bool preserve_timestamps = args[3]->IsTrue();
-
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
+  Local<Value> ToException(Environment* env) const {
+    Isolate* isolate = env->isolate();
+    switch (kind) {
+      case kErrno:
+        return ErrnoException(
+            isolate, code, syscall, message.c_str(), path.c_str());
+      case kUv:
+        return UVException(isolate, code, syscall, nullptr, path.c_str());
+      case kEinval:
+        return ERR_FS_CP_EINVAL(isolate, "%s", message);
+      case kSymlinkToSubdirectory:
+        return ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(isolate, "%s", message);
+      case kEexist:
+        return ERR_FS_CP_EEXIST(isolate, "%s", message);
+      // Sockets, FIFOs and unknown entries are reported to JS by kind and
+      // path (see CpDirJob), cpSync skips them; neither builds an error here.
+      case kSocket:
+      case kFifo:
+      case kUnknown:
+      case kNone:
+        break;
+    }
+    UNREACHABLE();
+  }
 
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
+  void Throw(Environment* env) const {
+    env->isolate()->ThrowException(ToException(env));
+  }
+};
 
-  std::error_code error;
+CpError CopyUtimes(const std::filesystem::path& src,
+                   const std::filesystem::path& dest) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
 
-  if (!std::filesystem::remove(dest_path, error)) {
-    return env->ThrowStdErrException(error, "unlink", *dest);
+  auto src_path_str = ConvertPathToUTF8(src);
+  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
+  if (is_uv_error(result)) {
+    return CpError::Uv(result, "stat", src_path_str);
   }
 
-  if (mode == 0) {
-    // if no mode is specified use the faster std::filesystem API
-    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
-      return env->ThrowStdErrException(error, "cp", *dest);
-    }
-  } else {
-    uv_fs_t req;
-    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
-    if (is_uv_error(result)) {
-      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
-    }
-  }
+  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
+  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
+  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
 
-  if (preserve_timestamps) {
-    CopyUtimes(src_path, dest_path, env);
+  auto dest_file_path_str = ConvertPathToUTF8(dest);
+  int utime_result = uv_fs_utime(nullptr,
+                                 &req,
+                                 dest_file_path_str.c_str(),
+                                 source_atime,
+                                 source_mtime,
+                                 nullptr);
+  if (is_uv_error(utime_result)) {
+    return CpError::Uv(utime_result, "utime", dest_file_path_str);
   }
+  return {};
 }
 
-std::vector<std::string> normalizePathToArray(
-    const std::filesystem::path& path) {
-  std::vector<std::string> parts;
-  std::filesystem::path absPath = std::filesystem::absolute(path);
-#ifdef _WIN32
-  auto wstr = absPath.wstring();
-  if (wstr.starts_with(L"\\\\?\\")) {
-    absPath = std::filesystem::path(wstr.substr(4));
-  }
-#endif
-  for (const auto& part : absPath) {
-    if (!part.empty()) parts.push_back(part.string());
+struct CpDirOptions {
+  bool force;
+  bool dereference;
+  bool error_on_exist;
+  bool verbatim_symlinks;
+  bool preserve_timestamps;
+  // Set for fs.cp(), which only takes this path for a destination that did
+  // not exist: nothing already present is ever opened for writing or
+  // followed. Directories are created with mkdir() and files with an
+  // exclusive uv_fs_copyfile(), so anything that appears in their place
+  // (a symbolic link included) is EEXIST; sockets, FIFOs and unknown
+  // entries are rejected as the JavaScript walk does; relative link targets
+  // are resolved lexically, as path.resolve() would. fs.cpSync() merges
+  // into existing directories, skips those entries and canonicalizes link
+  // targets.
+  bool fresh_destination;
+  // fs.copyFile() mode flags (COPYFILE_FICLONE etc.) for fresh_destination.
+  int copyfile_flags;
+};
+
+CpError CopyFileFresh(const std::filesystem::path& src,
+                      const std::filesystem::path& dest,
+                      int flags) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto src_str = ConvertPathToUTF8(src);
+  auto dest_str = ConvertPathToUTF8(dest);
+  int rc = uv_fs_copyfile(nullptr,
+                          &req,
+                          src_str.c_str(),
+                          dest_str.c_str(),
+                          flags | UV_FS_COPYFILE_EXCL,
+                          nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "copyfile", dest_str);
   }
-  return parts;
+  return {};
 }
 
-bool isInsideDir(const std::filesystem::path& src,
-                 const std::filesystem::path& dest) {
-  auto srcArr = normalizePathToArray(src);
-  auto destArr = normalizePathToArray(dest);
-  if (srcArr.size() > destArr.size()) return false;
-  return std::equal(srcArr.begin(), srcArr.end(), destArr.begin());
+// mkdir() that does not follow or accept anything already at `path`.
+CpError MakeFreshDirectory(const std::filesystem::path& path) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto path_str = ConvertPathToUTF8(path);
+  int rc = uv_fs_mkdir(nullptr, &req, path_str.c_str(), 0777, nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "mkdir", path_str);
+  }
+  return {};
 }
 
-static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
-  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
-                               // verbatimSymlinks, preserveTimestamps
-
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
-
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
-
-  bool force = args[2]->IsTrue();
-  bool dereference = args[3]->IsTrue();
-  bool error_on_exist = args[4]->IsTrue();
-  bool verbatim_symlinks = args[5]->IsTrue();
-  bool preserve_timestamps = args[6]->IsTrue();
-
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
-
+// The recursive directory copy behind fs.cpSync() and, on the thread pool,
+// fs.cp()/fsPromises.cp() when no filter function is involved. Runs on any
+// thread; touches no JS.
+CpError CopyDirRecursive(const std::filesystem::path& src_path,
+                         const std::filesystem::path& dest_path,
+                         const std::string& dest_display,
+                         const CpDirOptions& options) {
   std::error_code error;
-  std::filesystem::create_directories(dest_path, error);
-  if (error) {
-    return env->ThrowStdErrException(error, "cp", *dest);
+  bool dest_existed = false;
+  if (options.fresh_destination) {
+    CpError made = MakeFreshDirectory(dest_path);
+    if (made.kind != CpError::kNone) return made;
+  } else {
+    dest_existed = std::filesystem::exists(dest_path, error);
+    std::filesystem::create_directories(dest_path, error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
   }
 
   auto file_copy_opts = std::filesystem::copy_options::recursive;
-  if (force) {
+  if (options.force) {
     file_copy_opts |= std::filesystem::copy_options::overwrite_existing;
-  } else if (error_on_exist) {
+  } else if (options.error_on_exist) {
     file_copy_opts |= std::filesystem::copy_options::none;
   } else {
     file_copy_opts |= std::filesystem::copy_options::skip_existing;
   }
 
-  std::function<bool(std::filesystem::path, std::filesystem::path)>
+  std::function<CpError(std::filesystem::path, std::filesystem::path)>
       copy_dir_contents;
-  copy_dir_contents = [verbatim_symlinks,
-                       &copy_dir_contents,
-                       &env,
-                       file_copy_opts,
-                       preserve_timestamps,
-                       force,
-                       error_on_exist,
-                       dereference,
-                       &isolate](std::filesystem::path src,
-                                 std::filesystem::path dest) {
+  copy_dir_contents = [&options, &copy_dir_contents, file_copy_opts](
+                          std::filesystem::path src,
+                          std::filesystem::path dest) -> CpError {
     std::error_code error;
-    for (auto dir_entry : std::filesystem::directory_iterator(src)) {
+    // Only the error_code overloads are used from here on: this runs on a
+    // thread pool thread and exceptions are disabled.
+    auto it = std::filesystem::directory_iterator(src, error);
+    if (error) {
+      return CpError::Std(error, ConvertPathToUTF8(src));
+    }
+    for (const auto end = std::filesystem::directory_iterator(); it != end;
+         it.increment(error)) {
+      if (error) {
+        return CpError::Std(error, ConvertPathToUTF8(src));
+      }
+      const auto& dir_entry = *it;
       auto dest_file_path = dest / dir_entry.path().filename();
       auto dest_str = ConvertPathToUTF8(dest);
 
-      if (dir_entry.is_symlink()) {
-        if (verbatim_symlinks) {
+      if (dir_entry.is_symlink(error)) {
+        if (options.verbatim_symlinks) {
           std::filesystem::copy_symlink(
               dir_entry.path(), dest_file_path, error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         } else {
           auto symlink_target =
               std::filesystem::read_symlink(dir_entry.path().c_str(), error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
 
-          if (std::filesystem::exists(dest_file_path)) {
-            if (std::filesystem::is_symlink((dest_file_path.c_str()))) {
+          if (std::filesystem::exists(dest_file_path, error)) {
+            if (std::filesystem::is_symlink(dest_file_path, error)) {
               auto current_dest_symlink_target =
                   std::filesystem::read_symlink(dest_file_path.c_str(), error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
 
-              if (!dereference &&
-                  std::filesystem::is_directory(symlink_target) &&
+              if (!options.dereference &&
+                  std::filesystem::is_directory(symlink_target, error) &&
                   isInsideDir(symlink_target, current_dest_symlink_target)) {
-                static constexpr const char* message =
-                    "Cannot copy %s to a subdirectory of self %s";
-                THROW_ERR_FS_CP_EINVAL(
-                    env, message, symlink_target, current_dest_symlink_target);
-                return false;
+                return {CpError::kEinval,
+                        0,
+                        "cp",
+                        SPrintF("Cannot copy %s to a subdirectory of self %s",
+                                symlink_target,
+                                current_dest_symlink_target),
+                        {}};
               }
 
               // Prevent copy if src is a subdir of dest since unlinking
               // dest in this case would result in removing src contents
               // and therefore a broken symlink would be created.
-              if (std::filesystem::is_directory(dest_file_path) &&
+              if (std::filesystem::is_directory(dest_file_path, error) &&
                   isInsideDir(current_dest_symlink_target, symlink_target)) {
-                static constexpr const char* message =
-                    "cannot overwrite %s with %s";
-                THROW_ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(
-                    env, message, current_dest_symlink_target, symlink_target);
-                return false;
+                return {CpError::kSymlinkToSubdirectory,
+                        0,
+                        "cp",
+                        SPrintF("cannot overwrite %s with %s",
+                                current_dest_symlink_target,
+                                symlink_target),
+                        {}};
               }
 
               // symlinks get overridden by cp even if force: false, this is
@@ -4160,29 +4856,40 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
               // correct? or is it a bug?
               std::filesystem::remove(dest_file_path, error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
-            } else if (std::filesystem::is_regular_file(dest_file_path)) {
-              if (!dereference || (!force && error_on_exist)) {
-                auto dest_file_path_str = ConvertPathToUTF8(dest_file_path);
-                env->ThrowStdErrException(
+            } else if (std::filesystem::is_regular_file(dest_file_path,
+                                                        error)) {
+              if (!options.dereference ||
+                  (!options.force && options.error_on_exist)) {
+                return CpError::Std(
                     std::make_error_code(std::errc::file_exists),
-                    "cp",
-                    dest_file_path_str.c_str());
-                return false;
+                    ConvertPathToUTF8(dest_file_path));
               }
             }
           }
-          auto symlink_target_absolute = std::filesystem::weakly_canonical(
-              std::filesystem::absolute(src / symlink_target));
+          std::filesystem::path symlink_target_absolute;
+          if (options.fresh_destination) {
+            // As path.resolve() does: lexical only, absolute targets verbatim.
+            symlink_target_absolute =
+                symlink_target.is_absolute()
+                    ? symlink_target
+                    : std::filesystem::absolute(src / symlink_target, error)
+                          .lexically_normal();
+          } else {
+            symlink_target_absolute = std::filesystem::weakly_canonical(
+                std::filesystem::absolute(src / symlink_target, error), error);
+          }
+          if (error) {
+            return CpError::Std(error, dest_str);
+          }
 #ifdef _WIN32
           auto wstr = symlink_target_absolute.wstring();
           if (wstr.starts_with(L"\\\\?\\")) {
             symlink_target_absolute = std::filesystem::path(wstr.substr(4));
           }
 #endif
-          if (dir_entry.is_directory()) {
+          if (dir_entry.is_directory(error)) {
             std::filesystem::create_directory_symlink(
                 symlink_target_absolute, dest_file_path, error);
           } else {
@@ -4190,44 +4897,297 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
                 symlink_target_absolute, dest_file_path, error);
           }
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         }
-      } else if (dir_entry.is_directory()) {
+      } else if (dir_entry.is_directory(error)) {
         auto entry_dir_path = src / dir_entry.path().filename();
-        std::filesystem::create_directory(dest_file_path);
-        auto success = copy_dir_contents(entry_dir_path, dest_file_path);
-        if (!success) {
-          return false;
+        bool created = true;
+        if (options.fresh_destination) {
+          CpError made = MakeFreshDirectory(dest_file_path);
+          if (made.kind != CpError::kNone) return made;
+        } else {
+          created = std::filesystem::create_directory(dest_file_path, error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+        CpError inner = copy_dir_contents(entry_dir_path, dest_file_path);
+        if (inner.kind != CpError::kNone) {
+          return inner;
+        }
+        // A directory created by the copy gets the mode of its source once
+        // its contents are in (the source may be read-only).
+        if (created) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+        if (options.preserve_timestamps) {
+          CpError stamped = CopyUtimes(entry_dir_path, dest_file_path);
+          if (stamped.kind != CpError::kNone) return stamped;
+        }
+      } else if (dir_entry.is_regular_file(error)) {
+        bool copied = true;
+        if (options.fresh_destination) {
+          CpError fresh = CopyFileFresh(
+              dir_entry.path(), dest_file_path, options.copyfile_flags);
+          if (fresh.kind != CpError::kNone) return fresh;
+        } else {
+          copied = std::filesystem::copy_file(
+              dir_entry.path(), dest_file_path, file_copy_opts, error);
         }
-      } else if (dir_entry.is_regular_file()) {
-        std::filesystem::copy_file(
-            dir_entry.path(), dest_file_path, file_copy_opts, error);
         if (error) {
           if (error == std::errc::file_exists) {
-            THROW_ERR_FS_CP_EEXIST(isolate,
-                                   "[ERR_FS_CP_EEXIST]: Target already exists: "
-                                   "cp returned EEXIST (%s already exists)",
-                                   dest_file_path);
-            return false;
+            return {CpError::kEexist,
+                    0,
+                    "cp",
+                    SPrintF("[ERR_FS_CP_EEXIST]: Target already exists: "
+                            "cp returned EEXIST (%s already exists)",
+                            dest_file_path),
+                    {}};
           }
-          env->ThrowStdErrException(error, "cp", dest_str.c_str());
-          return false;
+          return CpError::Std(error, dest_str);
         }
 
-        if (preserve_timestamps &&
-            !CopyUtimes(dir_entry.path(), dest_file_path, env)) {
-          return false;
+        if (options.preserve_timestamps) {
+          CpError utimes = CopyUtimes(dir_entry.path(), dest_file_path);
+          if (utimes.kind != CpError::kNone) {
+            return utimes;
+          }
+        }
+        // Both copies set the mode before writing the data, which clears
+        // setuid/setgid; put the source mode back once the data is in.
+        if (copied) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
         }
+      } else if (options.fresh_destination) {
+        CpError::Kind kind = dir_entry.is_socket(error) ? CpError::kSocket
+                             : dir_entry.is_fifo(error) ? CpError::kFifo
+                                                        : CpError::kUnknown;
+        return {kind, UV_EINVAL, "cp", {}, ConvertPathToUTF8(dest_file_path)};
       }
     }
-    return true;
+    return {};
   };
 
-  copy_dir_contents(src_path, dest_path);
+  CpError result = copy_dir_contents(src_path, dest_path);
+  if (result.kind != CpError::kNone) return result;
+  if (!dest_existed) {
+    std::filesystem::permissions(
+        dest_path,
+        std::filesystem::status(src_path, error).permissions(),
+        error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
+  }
+  if (options.preserve_timestamps) return CopyUtimes(src_path, dest_path);
+  return {};
 }
 
+}  // namespace
+
+static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  int mode;
+  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
+    return;
+  }
+
+  bool preserve_timestamps = args[3]->IsTrue();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  std::error_code error;
+
+  if (!std::filesystem::remove(dest_path, error)) {
+    return env->ThrowStdErrException(error, "unlink", *dest);
+  }
+
+  if (mode == 0) {
+    // if no mode is specified use the faster std::filesystem API
+    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
+      return env->ThrowStdErrException(error, "cp", *dest);
+    }
+  } else {
+    uv_fs_t req;
+    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
+    if (is_uv_error(result)) {
+      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
+    }
+  }
+
+  if (preserve_timestamps) {
+    CpError error = CopyUtimes(src_path, dest_path);
+    if (error.kind != CpError::kNone) {
+      error.Throw(env);
+    }
+  }
+}
+
+static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
+                               // verbatimSymlinks, preserveTimestamps
+
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  bool force = args[2]->IsTrue();
+  bool dereference = args[3]->IsTrue();
+  bool error_on_exist = args[4]->IsTrue();
+  bool verbatim_symlinks = args[5]->IsTrue();
+  bool preserve_timestamps = args[6]->IsTrue();
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  CpError error = CopyDirRecursive(src_path,
+                                   dest_path,
+                                   dest.ToString(),
+                                   {force,
+                                    dereference,
+                                    error_on_exist,
+                                    verbatim_symlinks,
+                                    preserve_timestamps,
+                                    false,
+                                    0});
+  if (error.kind != CpError::kNone) {
+    error.Throw(env);
+  }
+}
+
+// JS: const job = new CpDirJob(src, dest, force, dereference, errorOnExist,
+//                              verbatimSymlinks, preserveTimestamps);
+//     job.ondone = (err) => {...}; job.run();
+// Runs CopyDirRecursive() on the thread pool for fs.cp()/fsPromises.cp().
+class CpDirJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_EQ(args.Length(), 8);
+    CHECK(args[7]->IsInt32());
+    BufferValue src(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*src);
+    ToNamespacedPath(env, &src);
+    BufferValue dest(env->isolate(), args[1]);
+    CHECK_NOT_NULL(*dest);
+    ToNamespacedPath(env, &dest);
+    new CpDirJob(env,
+                 args.This(),
+                 src.ToPath(),
+                 dest.ToPath(),
+                 dest.ToString(),
+                 {args[2]->IsTrue(),
+                  args[3]->IsTrue(),
+                  args[4]->IsTrue(),
+                  args[5]->IsTrue(),
+                  args[6]->IsTrue(),
+                  true,
+                  args[7].As<Int32>()->Value()});
+  }
+
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    CpDirJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    CHECK(!job->scheduled_);
+    job->scheduled_ = true;
+    job->ClearWeak();
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    error_ = CopyDirRecursive(src_, dest_, dest_display_, options_);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<CpDirJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env->context());
+    Local<Value> argv[] = {
+        Null(isolate), Undefined(isolate), Undefined(isolate)};
+    const char* special = error_.kind == CpError::kSocket    ? "socket"
+                          : error_.kind == CpError::kFifo    ? "fifo"
+                          : error_.kind == CpError::kUnknown ? "unknown"
+                                                             : nullptr;
+    if (special != nullptr) {
+      Local<Value> path;
+      if (!ToV8Value(env->context(), error_.path).ToLocal(&path)) return;
+      argv[1] = OneByteString(isolate, special);
+      argv[2] = path;
+    } else if (error_.kind != CpError::kNone) {
+      argv[0] = error_.ToException(env);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(CpDirJob)
+  SET_SELF_SIZE(CpDirJob)
+
+ private:
+  CpDirJob(Environment* env,
+           Local<Object> object,
+           std::filesystem::path&& src,
+           std::filesystem::path&& dest,
+           std::string&& dest_display,
+           CpDirOptions options)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.cp"),
+        src_(std::move(src)),
+        dest_(std::move(dest)),
+        dest_display_(std::move(dest_display)),
+        options_(options) {
+    MakeWeak();
+  }
+
+  const std::filesystem::path src_;
+  const std::filesystem::path dest_;
+  const std::string dest_display_;
+  const CpDirOptions options_;
+  CpError error_;
+  bool scheduled_ = false;
+};
+
 BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
     Environment* env, const std::string& file_path) {
   THROW_IF_INSUFFICIENT_PERMISSIONS(
@@ -4560,6 +5520,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "rmSync", RmSync);
   SetMethod(isolate, target, "mkdir", MKDir);
   SetMethod(isolate, target, "readdir", ReadDir);
+  SetMethod(isolate, target, "readdirRecursive", ReadDirRecursive);
   SetMethod(isolate, target, "internalModuleStat", InternalModuleStat);
   SetMethod(isolate, target, "stat", Stat);
   SetMethod(isolate, target, "lstat", LStat);
@@ -4597,6 +5558,12 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "cpSyncOverrideFile", CpSyncOverrideFile);
   SetMethod(isolate, target, "cpSyncCopyDir", CpSyncCopyDir);
 
+  Local<FunctionTemplate> cpj = NewFunctionTemplate(isolate, CpDirJob::New);
+  cpj->InstanceTemplate()->SetInternalFieldCount(CpDirJob::kInternalFieldCount);
+  cpj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, cpj, "run", CpDirJob::Run);
+  SetConstructorFunction(isolate, target, "CpDirJob", cpj);
+
   StatWatcher::CreatePerIsolateProperties(isolate_data, target);
   BindingData::CreatePerIsolateProperties(isolate_data, target);
 
@@ -4613,11 +5580,19 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetProtoMethod(isolate, rfj, "run", ReadFileJob::Run);
   SetConstructorFunction(isolate, target, "ReadFileJob", rfj);
 
+  Local<FunctionTemplate> wfj = NewFunctionTemplate(isolate, WriteFileJob::New);
+  wfj->InstanceTemplate()->SetInternalFieldCount(
+      WriteFileJob::kInternalFieldCount);
+  wfj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, wfj, "run", WriteFileJob::Run);
+  SetConstructorFunction(isolate, target, "WriteFileJob", wfj);
+
   // Create FunctionTemplate for FSReqCallback
   Local<FunctionTemplate> fst = NewFunctionTemplate(isolate, NewFSReqCallback);
   fst->InstanceTemplate()->SetInternalFieldCount(
       FSReqBase::kInternalFieldCount);
   fst->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, fst, "cancel", CancelFSReq);
   SetConstructorFunction(isolate, target, "FSReqCallback", fst);
 
   // Create FunctionTemplate for FileHandleReadWrap. There’s no need
@@ -4686,6 +5661,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Open);
   registry->Register(ReadFileJob::New);
   registry->Register(ReadFileJob::Run);
+  registry->Register(WriteFileJob::New);
+  registry->Register(WriteFileJob::Run);
   registry->Register(OpenFileHandle);
   registry->Register(Read);
   registry->Register(ReadFileUtf8);
@@ -4698,6 +5675,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(RmSync);
   registry->Register(MKDir);
   registry->Register(ReadDir);
+  registry->Register(ReadDirRecursive);
   registry->Register(InternalModuleStat);
   registry->Register(Stat);
   registry->Register(LStat);
@@ -4717,6 +5695,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(CpSyncCheckPaths);
   registry->Register(CpSyncOverrideFile);
   registry->Register(CpSyncCopyDir);
+  registry->Register(CpDirJob::New);
+  registry->Register(CpDirJob::Run);
 
   registry->Register(Chmod);
   registry->Register(FChmod);
@@ -4734,6 +5714,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(HandleToFd);
 #endif
   registry->Register(NewFSReqCallback);
+  registry->Register(CancelFSReq);
 
   registry->Register(FileHandle::New);
   registry->Register(FileHandle::Close);
diff --git a/src/node_http2.cc b/src/node_http2.cc
index bbb088943b01..a5efb4ce6d1b 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -970,45 +970,24 @@ ssize_t Http2Session::OnMaxFrameSizePadding(size_t frameLen,
 // quite expensive. This is a potential performance optimization target later.
 void Http2Session::ConsumeHTTP2Data() {
   CHECK_NOT_NULL(stream_buf_.base);
-  CHECK_LE(stream_buf_offset_, stream_buf_.len);
-  size_t read_len = stream_buf_.len - stream_buf_offset_;
 
   // multiple side effects.
-  Debug(this, "receiving %d bytes [wants data? %d]",
-        read_len,
+  Debug(this,
+        "receiving %d bytes [wants data? %d]",
+        stream_buf_.len,
         nghttp2_session_want_read(session_.get()));
-  set_receive_paused(false);
   custom_recv_error_code_ = nullptr;
   set_receiving();
   ssize_t ret =
-    nghttp2_session_mem_recv(session_.get(),
-                             reinterpret_cast<uint8_t*>(stream_buf_.base) +
-                                 stream_buf_offset_,
-                             read_len);
+      nghttp2_session_mem_recv(session_.get(),
+                               reinterpret_cast<uint8_t*>(stream_buf_.base),
+                               stream_buf_.len);
   set_receiving(false);
   CHECK_NE(ret, NGHTTP2_ERR_NOMEM);
   CHECK_IMPLIES(custom_recv_error_code_ != nullptr, ret < 0);
 
-  if (is_receive_paused()) {
-    CHECK(is_reading_stopped());
-
-    CHECK_GT(ret, 0);
-    CHECK_LE(static_cast<size_t>(ret), read_len);
-
-    // Mark the remainder of the data as available for later consumption.
-    // Even if all bytes were received, a paused stream may delay the
-    // nghttp2_on_frame_recv_callback which may have an END_STREAM flag.
-    stream_buf_offset_ += ret;
-    // Still complete a Close() deferred during mem_recv; do not fall through
-    // to SendPendingData() here (paused receives historically skip that flush
-    // because a write may already be in progress).
-    MaybeFinishPendingClose();
-    goto done;
-  }
-
   // We are done processing the current input chunk.
   DecrementCurrentSessionMemory(stream_buf_.len);
-  stream_buf_offset_ = 0;
   stream_buf_ab_.Reset();
   stream_buf_allocation_.reset();
   stream_buf_ = uv_buf_init(nullptr, 0);
@@ -1017,14 +996,6 @@ void Http2Session::ConsumeHTTP2Data() {
   // not written after pending RST_STREAM frames.
   MaybeFinishPendingClose();
 
-done:
-  // Finish a Close() deferred above before flushing, so GOAWAY is not written
-  // after pending RST_STREAM frames.
-  if (is_close_pending() && !is_destroyed()) {
-    set_close_pending(false);
-    FinishClose(pending_close_code_, pending_close_socket_closed_);
-  }
-
   // Send any data that was queued up while processing the received data.
   if (ret >= 0 && !is_destroyed()) {
     SendPendingData();
@@ -1461,15 +1432,6 @@ int Http2Session::OnDataChunkReceived(nghttp2_session* handle,
     }
   } while (len != 0);
 
-  // If we are currently waiting for a write operation to finish, we should
-  // tell nghttp2 that we want to wait before we process more input data.
-  if (session->is_write_in_progress()) {
-    CHECK(session->is_reading_stopped());
-    session->set_receive_paused();
-    Debug(session, "receive paused");
-    return NGHTTP2_ERR_PAUSE;
-  }
-
   return 0;
 }
 
@@ -1552,7 +1514,6 @@ void Http2StreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
   size_t offset = buf.base - session->stream_buf_.base;
 
   // Verify that the data offset is inside the current read buffer.
-  CHECK_GE(offset, session->stream_buf_offset_);
   CHECK_LE(offset, session->stream_buf_.len);
   CHECK_LE(offset + buf.len, session->stream_buf_.len);
 
@@ -1867,11 +1828,6 @@ void Http2Session::OnStreamAfterWrite(WriteWrap* w, int status) {
     return;
   }
 
-  // If there is more incoming data queued up, consume it.
-  if (stream_buf_offset_ > 0) {
-    ConsumeHTTP2Data();
-  }
-
   if (!is_write_scheduled() && !is_destroyed()) {
     // Schedule a new write if nghttp2 wants to send data.
     MaybeScheduleWrite();
@@ -1918,7 +1874,7 @@ void Http2Session::MaybeStopReading() {
   if (is_reading_stopped() || is_closing()) return;
   int want_read = nghttp2_session_want_read(session_.get());
   Debug(this, "wants read? %d", want_read);
-  if (want_read == 0 || is_write_in_progress()) {
+  if (want_read == 0) {
     set_reading_stopped();
     stream_->ReadStop();
   }
@@ -2178,7 +2134,7 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   Context::Scope context_scope(env()->context());
   Http2Scope h2scope(this);
   CHECK_NOT_NULL(stream_);
-  Debug(this, "receiving %d bytes, offset %d", nread, stream_buf_offset_);
+  Debug(this, "receiving %d bytes", nread);
   std::unique_ptr<BackingStore> bs = env()->release_managed_buffer(buf_);
 
   // Only pass data on if nread > 0
@@ -2193,8 +2149,11 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
 
   statistics_.data_received += nread;
 
-  if (stream_buf_offset_ == 0 && static_cast<size_t>(nread) != bs->ByteLength())
-      [[likely]] {
+  // ConsumeHTTP2Data() always consumes the whole chunk, so there is never a
+  // partially processed buffer left over from a previous read.
+  DCHECK_NULL(stream_buf_.base);
+
+  if (static_cast<size_t>(nread) != bs->ByteLength()) [[likely]] {
     // Shrink to the actual amount of used data.
     std::unique_ptr<BackingStore> old_bs = std::move(bs);
     bs = ArrayBuffer::NewBackingStore(
@@ -2202,31 +2161,6 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
         nread,
         BackingStoreInitializationMode::kUninitialized);
     memcpy(bs->Data(), old_bs->Data(), nread);
-  } else {
-    // This is a very unlikely case, and should only happen if the ReadStart()
-    // call in OnStreamAfterWrite() immediately provides data. If that does
-    // happen, we concatenate the data we received with the already-stored
-    // pending input data, slicing off the already processed part.
-    size_t pending_len = stream_buf_.len - stream_buf_offset_;
-    std::unique_ptr<BackingStore> new_bs = ArrayBuffer::NewBackingStore(
-        env()->isolate(),
-        pending_len + nread,
-        BackingStoreInitializationMode::kUninitialized);
-    memcpy(static_cast<char*>(new_bs->Data()),
-           stream_buf_.base + stream_buf_offset_,
-           pending_len);
-    memcpy(static_cast<char*>(new_bs->Data()) + pending_len,
-           bs->Data(),
-           nread);
-
-    bs = std::move(new_bs);
-    nread = bs->ByteLength();
-    stream_buf_offset_ = 0;
-    stream_buf_ab_.Reset();
-
-    // We have now fully processed the stream_buf_ input chunk (by moving the
-    // remaining part into buf, which will be accounted for below).
-    DecrementCurrentSessionMemory(stream_buf_.len);
   }
 
   IncrementCurrentSessionMemory(nread);
diff --git a/src/node_http2.h b/src/node_http2.h
index f321bf0c1601..c1b147afec10 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -75,9 +75,8 @@ constexpr int kSessionStateClosing = 0x8;
 constexpr int kSessionStateSending = 0x10;
 constexpr int kSessionStateWriteInProgress = 0x20;
 constexpr int kSessionStateReadingStopped = 0x40;
-constexpr int kSessionStateReceivePaused = 0x80;
-constexpr int kSessionStateReceiving = 0x100;
-constexpr int kSessionStateClosePending = 0x200;
+constexpr int kSessionStateReceiving = 0x80;
+constexpr int kSessionStateClosePending = 0x100;
 
 // The Padding Strategy determines the method by which extra padding is
 // selected for HEADERS and DATA frames. These are configurable via the
@@ -664,7 +663,6 @@ class Http2Session : public AsyncWrap,
   IS_FLAG(sending, kSessionStateSending)
   IS_FLAG(write_in_progress, kSessionStateWriteInProgress)
   IS_FLAG(reading_stopped, kSessionStateReadingStopped)
-  IS_FLAG(receive_paused, kSessionStateReceivePaused)
   IS_FLAG(receiving, kSessionStateReceiving)
   IS_FLAG(close_pending, kSessionStateClosePending)
 
@@ -945,7 +943,6 @@ class Http2Session : public AsyncWrap,
   // will be set. stream_buf_ab_ is lazily created from stream_buf_allocation_.
   v8::Global<v8::ArrayBuffer> stream_buf_ab_;
   std::unique_ptr<v8::BackingStore> stream_buf_allocation_;
-  size_t stream_buf_offset_ = 0;
   // Custom error code for errors that originated inside one of the callbacks
   // called by nghttp2_session_mem_recv.
   const char* custom_recv_error_code_ = nullptr;
diff --git a/src/node_http_common.h b/src/node_http_common.h
index 5afb6b97becc..de2fdb2aa810 100644
--- a/src/node_http_common.h
+++ b/src/node_http_common.h
@@ -6,6 +6,7 @@
 #include "v8.h"
 #include "node_mem.h"
 
+#include <memory>
 #include <string>
 
 namespace node {
@@ -439,11 +440,10 @@ class NgRcBufPointer : public MemoryRetainer {
       }
 
       allocator->StopTrackingMemory(ptr.get());
-      External* h_str = new External(std::move(ptr));
+      auto h_str = std::make_unique<External>(std::move(ptr));
       v8::MaybeLocal<v8::String> str =
-          v8::String::NewExternalOneByte(env->isolate(), h_str);
-      if (str.IsEmpty())
-        delete h_str;
+          v8::String::NewExternalOneByte(env->isolate(), h_str.get());
+      if (!str.IsEmpty()) h_str.release();
 
       return str;
     }
diff --git a/src/node_internals.h b/src/node_internals.h
index 631a8d7ccdd9..17e23ce61d64 100644
--- a/src/node_internals.h
+++ b/src/node_internals.h
@@ -380,7 +380,6 @@ class InitializationResultImpl final : public InitializationResult {
   MultiIsolatePlatform* platform_ = nullptr;
 };
 
-void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s);
 void SetIsolateMiscHandlers(v8::Isolate* isolate, const IsolateSettings& s);
 void SetIsolateCreateParamsForNode(v8::Isolate::CreateParams* params);
 
diff --git a/src/node_locks.cc b/src/node_locks.cc
index 26fac6b62c4c..4fca3a7df94e 100644
--- a/src/node_locks.cc
+++ b/src/node_locks.cc
@@ -2,6 +2,7 @@
 
 #include "base_object-inl.h"
 #include "env-inl.h"
+#include "node_debug.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_internals.h"
@@ -237,8 +238,8 @@ void LockManager::ProcessQueue(Environment* env) {
      * 1- Build first_seen_for_resource: the oldest pending request
      *   for every resource name we encounter
      * 2- Decide what to do with each entry:
-     *     – If it belongs to another Environment, remember that env so we
-     *       can wake it later
+     *     – If it belongs to another Environment, remember that env only if
+     *       the request can make progress
      *     – For our Environment, pick one of:
      *         * grantable_request  – can be granted now
      *         * if_available_request – user asked for ifAvailable and the
@@ -255,11 +256,6 @@ void LockManager::ProcessQueue(Environment* env) {
            ++queue_iter) {
         LockRequest* request = queue_iter->get();
 
-        // Collect unique environments to wake up later
-        if (request->env() != env) {
-          other_envs_to_wake.insert(request->env());
-        }
-
         // During a single pass, the first time we see a resource name is the
         // earliest pending request
         auto& first_for_resource = first_seen_for_resource[request->name()];
@@ -283,12 +279,21 @@ void LockManager::ProcessQueue(Environment* env) {
           // If both are shared, they're compatible and can proceed
         }
 
-        // Only process requests from the current environment
+        bool is_grantable =
+            !should_wait_for_earlier_requests && IsGrantable(request);
+
+        // Requests must be processed on their Environment's event loop. Wake
+        // another Environment only when it has a request that can make
+        // progress; otherwise blocked Environments would continuously wake
+        // each other.
         if (request->env() != env) {
+          if (is_grantable || request->if_available()) {
+            other_envs_to_wake.insert(request->env());
+          }
           continue;
         }
 
-        if (should_wait_for_earlier_requests || !IsGrantable(request)) {
+        if (!is_grantable) {
           if (request->if_available()) {
             // ifAvailable request when resource not available: grant with null
             if_available_request = std::move(*queue_iter);
@@ -754,6 +759,8 @@ void LockManager::ReleaseLock(Lock* lock) {
 void LockManager::WakeEnvironment(Environment* target_env) {
   if (target_env == nullptr || target_env->is_stopping()) return;
 
+  COUNT_GENERIC_USAGE("LockManager.WakeEnvironment");
+
   // Schedule ProcessQueue in the target Environment on its event loop.
   target_env->SetImmediateThreadsafe([](Environment* env_to_wake) {
     if (env_to_wake != nullptr && !env_to_wake->is_stopping()) {
diff --git a/src/node_modules.cc b/src/node_modules.cc
index 3a786158afea..ec4f6bdd79a8 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -91,53 +91,16 @@ Local<Array> BindingData::PackageConfig::Serialize(Realm* realm) const {
   return Array::New(isolate, values, 6);
 }
 
-const BindingData::PackageConfig* BindingData::GetPackageJSON(
-    Realm* realm, std::string_view path, ErrorContext* error_context) {
+bool BindingData::ParsePackageJSON(Realm* realm,
+                                   PackageConfig* package_config,
+                                   ErrorContext* error_context) {
   auto binding_data = realm->GetBindingData<BindingData>();
-
-  auto cache_entry = binding_data->package_configs_.find(path.data());
-  if (cache_entry != binding_data->package_configs_.end()) {
-    auto& cache_value = cache_entry->second;
-    if (cache_value) {
-      return &*cache_value;
-    }
-
-    // If we have a cache entry without a value, we've already
-    // attempted to open and read this path and couldn't (it most
-    // likely doesn't exist)
-    return nullptr;
-  }
-
-  PackageConfig package_config{};
-  package_config.file_path = path;
-  // No need to exclude BOM since simdjson will skip it.
-  int read_error = ReadFileSync(&package_config.raw_json, path.data());
-  if (read_error < 0) {
-    // No file at this path, a path component that is not a directory, or a
-    // "package.json" that is itself a directory all mean there is no package
-    // config here. Any other failure means a package.json is present but
-    // could not be read. Treating that as absent silently drops fields such
-    // as "exports" and "type", which can resolve a specifier to a different
-    // file, so surface the read error instead of continuing.
-    if (read_error != UV_ENOENT && read_error != UV_ENOTDIR &&
-        read_error != UV_EISDIR) {
-      THROW_ERR_INVALID_PACKAGE_CONFIG(realm->isolate(),
-                                       "Cannot read package config %s: %s.",
-                                       path.data(),
-                                       uv_strerror(read_error));
-      return nullptr;
-    }
-
-    // Add `nullopt` to the package config cache so that we don't
-    // need to open and attempt to read this path again
-    binding_data->package_configs_.insert({std::string(path), std::nullopt});
-    return nullptr;
-  }
+  const std::string_view path = package_config->file_path;
 
   simdjson::ondemand::document document;
   simdjson::ondemand::object main_object;
   simdjson::error_code error =
-      binding_data->json_parser.iterate(simdjson::pad(package_config.raw_json))
+      binding_data->json_parser.iterate(simdjson::pad(package_config->raw_json))
           .get(document);
 
   const auto throw_invalid_package_config = [error_context, path, realm]() {
@@ -160,7 +123,7 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           realm->isolate(), "Invalid package config %s.", path.data());
     }
 
-    return nullptr;
+    return false;
   };
 
   if (error || document.get_object().get(main_object)) {
@@ -185,12 +148,12 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
     if (key == "name") {
       // Though there is a key "name" with a corresponding value,
       // the value may not be a string or could be an invalid JSON string
-      if (value.get_string(package_config.name)) {
+      if (value.get_string(package_config->name)) {
         return throw_invalid_package_config();
       }
     } else if (key == "main") {
       // Omit all non-string values
-      USE(value.get_string(package_config.main));
+      USE(value.get_string(package_config->main));
     } else if (key == "exports") {
       if (value.type().get(field_type)) {
         return throw_invalid_package_config();
@@ -201,11 +164,11 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           if (value.raw_json().get(field_value)) {
             return throw_invalid_package_config();
           }
-          package_config.exports = field_value;
+          package_config->exports = field_value;
           break;
         }
         case simdjson::ondemand::json_type::string: {
-          if (value.get_string(package_config.exports)) {
+          if (value.get_string(package_config->exports)) {
             return throw_invalid_package_config();
           }
           break;
@@ -223,11 +186,11 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           if (value.raw_json().get(field_value)) {
             return throw_invalid_package_config();
           }
-          package_config.imports = field_value;
+          package_config->imports = field_value;
           break;
         }
         case simdjson::ondemand::json_type::string: {
-          if (value.get_string(package_config.imports)) {
+          if (value.get_string(package_config->imports)) {
             return throw_invalid_package_config();
           }
           break;
@@ -242,7 +205,7 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
       // Only update type if it is "commonjs" or "module"
       // The default value is "none" for backward compatibility.
       if (field_value == "commonjs" || field_value == "module") {
-        package_config.type = field_value;
+        package_config->type = field_value;
       }
     } else if (key == "scripts") {
       if (value.type().get(field_type)) {
@@ -253,7 +216,7 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
           if (value.raw_json().get(field_value)) {
             return throw_invalid_package_config();
           }
-          package_config.scripts = field_value;
+          package_config->scripts = field_value;
           break;
         }
         default:
@@ -261,6 +224,56 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(
       }
     }
   }
+  return true;
+}
+
+const BindingData::PackageConfig* BindingData::GetPackageJSON(
+    Realm* realm, std::string_view path, ErrorContext* error_context) {
+  auto binding_data = realm->GetBindingData<BindingData>();
+
+  auto cache_entry = binding_data->package_configs_.find(path.data());
+  if (cache_entry != binding_data->package_configs_.end()) {
+    auto& cache_value = cache_entry->second;
+    if (cache_value) {
+      return &*cache_value;
+    }
+
+    // If we have a cache entry without a value, we've already
+    // attempted to open and read this path and couldn't (it most
+    // likely doesn't exist)
+    return nullptr;
+  }
+
+  PackageConfig package_config{};
+  package_config.file_path = path;
+  // No need to exclude BOM since simdjson will skip it.
+  int read_error = ReadFileSync(&package_config.raw_json, path.data());
+  if (read_error < 0) {
+    // No file at this path, a path component that is not a directory, or a
+    // "package.json" that is itself a directory all mean there is no package
+    // config here. Any other failure means a package.json is present but
+    // could not be read. Treating that as absent silently drops fields such
+    // as "exports" and "type", which can resolve a specifier to a different
+    // file, so surface the read error instead of continuing.
+    if (read_error != UV_ENOENT && read_error != UV_ENOTDIR &&
+        read_error != UV_EISDIR) {
+      THROW_ERR_INVALID_PACKAGE_CONFIG(realm->isolate(),
+                                       "Cannot read package config %s: %s.",
+                                       path.data(),
+                                       uv_strerror(read_error));
+      return nullptr;
+    }
+
+    // Add `nullopt` to the package config cache so that we don't
+    // need to open and attempt to read this path again
+    binding_data->package_configs_.insert({std::string(path), std::nullopt});
+    return nullptr;
+  }
+
+  if (!ParsePackageJSON(realm, &package_config, error_context)) {
+    return nullptr;
+  }
+
   // package_config could be quite large, so we should move it instead of
   // copying it.
   auto cached = binding_data->package_configs_.insert(
@@ -307,6 +320,49 @@ void BindingData::ReadPackageJSON(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(package_json->Serialize(realm));
 }
 
+void BindingData::ParsePackageJSONBinding(
+    const FunctionCallbackInfo<Value>& args) {
+  // parsePackageJSON(source, jsonPath, isESM, base, specifier)
+  CHECK_GE(args.Length(), 2);
+  CHECK(args[0]->IsString() || args[0]->IsArrayBufferView());  // source
+  CHECK(args[1]->IsString());                                  // jsonPath
+
+  Realm* realm = Realm::GetCurrent(args);
+  auto isolate = realm->isolate();
+
+  BufferValue json_path(isolate, args[1]);
+  bool is_esm = args.Length() >= 3 && args[2]->IsTrue();
+  auto error_context = ErrorContext();
+  if (is_esm) {
+    CHECK(args[3]->IsUndefined() || args[3]->IsString());  // base
+    CHECK(args[4]->IsString());                            // specifier
+
+    if (args[3]->IsString()) {
+      Utf8Value base_value(isolate, args[3]);
+      error_context.base = base_value.ToString();
+    }
+    Utf8Value specifier(isolate, args[4]);
+    error_context.specifier = specifier.ToString();
+  }
+
+  PackageConfig package_config{};
+  package_config.file_path = json_path.ToStringView();
+  if (args[0]->IsString()) {
+    Utf8Value source(isolate, args[0]);
+    package_config.raw_json = source.ToString();
+  } else {
+    ArrayBufferViewContents<char> view(args[0]);
+    package_config.raw_json = std::string(view.data(), view.length());
+  }
+
+  if (!ParsePackageJSON(
+          realm, &package_config, is_esm ? &error_context : nullptr)) {
+    return;  // ParsePackageJSON already threw
+  }
+
+  args.GetReturnValue().Set(package_config.Serialize(realm));
+}
+
 const BindingData::PackageConfig* BindingData::TraverseParent(
     Realm* realm, const std::filesystem::path& check_path) {
   std::filesystem::path current_path = check_path;
@@ -631,6 +687,7 @@ void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
                                              Local<ObjectTemplate> target) {
   Isolate* isolate = isolate_data->isolate();
   SetMethod(isolate, target, "readPackageJSON", ReadPackageJSON);
+  SetMethod(isolate, target, "parsePackageJSON", ParsePackageJSONBinding);
   SetMethod(isolate,
             target,
             "getNearestParentPackageJSONType",
@@ -709,6 +766,7 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
 void BindingData::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(ReadPackageJSON);
+  registry->Register(ParsePackageJSONBinding);
   registry->Register(GetNearestParentPackageJSONType);
   registry->Register(GetNearestParentPackageJSON);
   registry->Register(GetPackageScopeConfig<false>);
diff --git a/src/node_modules.h b/src/node_modules.h
index d610306a3a31..544177312652 100644
--- a/src/node_modules.h
+++ b/src/node_modules.h
@@ -55,6 +55,11 @@ class BindingData : public SnapshotableObject {
   SET_MEMORY_INFO_NAME(BindingData)
 
   static void ReadPackageJSON(const v8::FunctionCallbackInfo<v8::Value>& args);
+  // Like ReadPackageJSON but the caller supplies the raw JSON body.
+  // Does not populate the C++ `package_configs_` cache.
+  // Signature: parsePackageJSON(source, jsonPath, isESM, base, specifier)
+  static void ParsePackageJSONBinding(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetNearestParentPackageJSON(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetNearestParentPackageJSONType(
@@ -90,6 +95,12 @@ class BindingData : public SnapshotableObject {
       Realm* realm,
       std::string_view path,
       ErrorContext* error_context = nullptr);
+  // Parses `package_config->raw_json` into `package_config`; caller
+  // must set raw_json and file_path first. Returns false and throws
+  // ERR_INVALID_PACKAGE_CONFIG on a syntactic error.
+  static bool ParsePackageJSON(Realm* realm,
+                               PackageConfig* package_config,
+                               ErrorContext* error_context);
   static const PackageConfig* TraverseParent(
       Realm* realm, const std::filesystem::path& check_path);
 };
diff --git a/src/node_options-inl.h b/src/node_options-inl.h
index 877e8ce4ded9..dac206791c35 100644
--- a/src/node_options-inl.h
+++ b/src/node_options-inl.h
@@ -4,8 +4,10 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <algorithm>
+#include <charconv>
 #include <cstdlib>
 #include <ranges>
+#include <type_traits>
 #include "node_options.h"
 #include "util.h"
 
@@ -31,17 +33,19 @@ namespace options_parser {
 template <typename Options>
 void OptionsParser<Options>::AddOption(const char* name,
                                        const char* help_text,
-                                       bool Options::*field,
+                                       bool (*getter)(Options*),
+                                       void (*setter)(Options*, bool),
                                        OptionEnvvarSettings env_setting,
                                        bool default_is_true,
                                        OptionNamespaces namespace_id) {
-  options_.emplace(name,
-                   OptionInfo{kBoolean,
-                              std::make_shared<SimpleOptionField<bool>>(field),
-                              env_setting,
-                              help_text,
-                              default_is_true,
-                              NamespaceEnumToString(namespace_id)});
+  options_.emplace(
+      name,
+      OptionInfo{kBoolean,
+                 std::make_shared<BitFieldOptionField>(getter, setter),
+                 env_setting,
+                 help_text,
+                 default_is_true,
+                 NamespaceEnumToString(namespace_id)});
 }
 
 template <typename Options>
@@ -49,7 +53,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                                        const char* help_text,
                                        uint64_t Options::*field,
                                        OptionEnvvarSettings env_setting,
-                                       OptionNamespaces namespace_id) {
+                                       OptionNamespaces namespace_id,
+                                       bool strict) {
   options_.emplace(
       name,
       OptionInfo{kUInteger,
@@ -57,7 +62,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                  env_setting,
                  help_text,
                  false,
-                 NamespaceEnumToString(namespace_id)});
+                 NamespaceEnumToString(namespace_id),
+                 strict});
 }
 
 template <typename Options>
@@ -207,6 +213,13 @@ auto OptionsParser<Options>::Convert(
       return original->LookupImpl((options->*get_child)());
     }
 
+    bool GetBool(Options* options) const override {
+      return original->GetBool((options->*get_child)());
+    }
+    void SetBool(Options* options, bool value) override {
+      original->SetBool((options->*get_child)(), value);
+    }
+
     AdaptedField(
         std::shared_ptr<OriginalField> original,
         ChildOptions* (Options::* get_child)())
@@ -229,7 +242,8 @@ auto OptionsParser<Options>::Convert(
                     original.env_setting,
                     original.help_text,
                     original.default_is_true,
-                    original.namespace_id};
+                    original.namespace_id,
+                    original.strict};
 }
 
 template <typename Options>
@@ -432,8 +446,8 @@ void OptionsParser<Options>::Parse(
                               if (value.type == kV8Option) {
                                 v8_args->push_back(value.name);
                               } else {
-                                *value.target_field->template Lookup<bool>(
-                                    options) = value.target_value;
+                                value.target_field->SetBool(options,
+                                                            value.target_value);
                               }
                             });
     }
@@ -453,18 +467,21 @@ void OptionsParser<Options>::Parse(
 
     std::string value;
     if (info.type != kBoolean && info.type != kNoOp && info.type != kV8Option) {
+      // `--run` may be passed without a script name to list available scripts,
+      // so an omitted value is not an error and must not swallow a later flag.
+      const bool optional_value = name == "--run";
       if (equals_index != std::string::npos) {
         value = arg.substr(equals_index + 1);
-        if (value.empty()) {
+        if (value.empty() && !optional_value) {
           missing_argument();
           break;
         }
-      } else {
-        if (args.empty()) {
+      } else if (args.empty() || (optional_value && args.first()[0] == '-')) {
+        if (!optional_value) {
           missing_argument();
           break;
         }
-
+      } else {
         value = args.pop_first();
 
         if (!value.empty() && value[0] == '-') {
@@ -479,7 +496,7 @@ void OptionsParser<Options>::Parse(
 
     switch (info.type) {
       case kBoolean:
-        *Lookup<bool>(info.field, options) = !is_negation;
+        info.field->SetBool(options, !is_negation);
         break;
       case kInteger: {
         // Special case to pass --stack-trace-limit down to V8.
@@ -489,10 +506,22 @@ void OptionsParser<Options>::Parse(
         *Lookup<int64_t>(info.field, options) = std::atoll(value.c_str());
         break;
       }
-      case kUInteger:
-        *Lookup<uint64_t>(info.field, options) =
-            std::strtoull(value.c_str(), nullptr, 10);
+      case kUInteger: {
+        if (!info.strict) {
+          *Lookup<uint64_t>(info.field, options) =
+              std::strtoull(value.c_str(), nullptr, 10);
+          break;
+        }
+        uint64_t parsed;
+        const char* end = value.data() + value.size();
+        const auto result = std::from_chars(value.data(), end, parsed);
+        if (result.ec != std::errc() || result.ptr != end) {
+          errors->push_back("invalid value for " + name);
+          break;
+        }
+        *Lookup<uint64_t>(info.field, options) = parsed;
         break;
+      }
       case kString:
         *Lookup<std::string>(info.field, options) = value;
         break;
@@ -512,6 +541,12 @@ void OptionsParser<Options>::Parse(
       default:
         UNREACHABLE();
     }
+
+    // Record that `--run` was seen so an empty value can be distinguished from
+    // the option being absent. Guarded so it only compiles for the owning type.
+    if constexpr (std::is_same_v<Options, PerProcessOptions>) {
+      if (name == "--run") options->has_run = true;
+    }
   }
   options->CheckOptions(errors, orig_args);
 }
diff --git a/src/node_options.cc b/src/node_options.cc
index 1a9302220db2..333990a3c62f 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -9,7 +9,7 @@
 #include "node_sea.h"
 #include "uv.h"
 #if HAVE_OPENSSL
-#include "openssl/opensslv.h"
+#include "ncrypto.h"  // Defines OPENSSL_VERSION_PREREQ for BoringSSL.
 #include "quic/guard.h"
 #endif
 
@@ -39,6 +39,8 @@ using v8::Undefined;
 using v8::Value;
 namespace node {
 
+constexpr bool kStrictOptionParsing = true;
+
 namespace per_process {
 Mutex cli_options_mutex;
 std::shared_ptr<PerProcessOptions> cli_options{new PerProcessOptions()};
@@ -84,6 +86,23 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,
                       "used, not both");
   }
 
+  if (force_fips_crypto_policy != "provider" &&
+      force_fips_crypto_policy != "strict") {
+    errors->push_back(
+        "invalid value for --force-fips; expected 'provider' or 'strict'");
+  }
+
+#if defined(OPENSSL_IS_BORINGSSL) || !OPENSSL_VERSION_PREREQ(3, 4)
+  if (enable_fips_indicator_events) {
+    errors->push_back(
+        "--enable-fips-indicator-events requires OpenSSL 3.4 or later");
+  }
+
+  if (force_fips_crypto && force_fips_crypto_policy == "strict") {
+    errors->push_back("--force-fips=strict requires OpenSSL 3.4 or later");
+  }
+#endif
+
   // Any value less than 2 disables use of the secure heap.
 #ifndef V8_ENABLE_SANDBOX
   // The secure heap is not supported when V8_ENABLE_SANDBOX is enabled.
@@ -224,6 +243,38 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors,
     errors->push_back("invalid value for --trace-require-module");
   }
 
+  if (bench_runner && test_runner) {
+    errors->push_back("either --bench or --test can be used, not both");
+  }
+
+  if (bench_runner) {
+    if (bench_isolation == "none") {
+      debug_options_.allow_attaching_debugger = true;
+    } else {
+      if (bench_isolation != "process") {
+        errors->push_back("invalid value for --bench-isolation");
+      }
+
+      debug_options_.allow_attaching_debugger = false;
+    }
+    if (has_bench_samples && bench_samples == 0) {
+      errors->push_back("--bench-samples must be greater than 0");
+    }
+    if (syntax_check_only) {
+      errors->push_back("either --bench or --check can be used, not both");
+    }
+    if (has_eval_string) {
+      errors->push_back("either --bench or --eval can be used, not both");
+    }
+    if (force_repl) {
+      errors->push_back(
+          "either --bench or --interactive can be used, not both");
+    }
+    if (watch_mode || !watch_mode_paths.empty()) {
+      errors->push_back("either --bench or --watch can be used, not both");
+    }
+  }
+
   if (test_runner) {
     if (test_isolation == "none") {
       debug_options_.allow_attaching_debugger = true;
@@ -474,30 +525,30 @@ DebugOptionsParser::DebugOptionsParser() {
 
   AddOption("--inspect",
             "activate inspector on host:port (default: 127.0.0.1:9229)",
-            &DebugOptions::inspector_enabled,
+            BOOL_FIELD(inspector_enabled),
             kAllowedInEnvvar);
   AddAlias("--inspect=", { "--inspect-port", "--inspect" });
 
-  AddOption("--debug", "", &DebugOptions::deprecated_debug);
+  AddOption("--debug", "", BOOL_FIELD(deprecated_debug));
   AddAlias("--debug=", "--debug");
-  AddOption("--debug-brk", "", &DebugOptions::deprecated_debug);
+  AddOption("--debug-brk", "", BOOL_FIELD(deprecated_debug));
   AddAlias("--debug-brk=", "--debug-brk");
 
   AddOption("--inspect-brk",
             "activate inspector on host:port and break at start of user script",
-            &DebugOptions::break_first_line,
+            BOOL_FIELD(break_first_line),
             kAllowedInEnvvar);
   Implies("--inspect-brk", "--inspect");
   AddAlias("--inspect-brk=", { "--inspect-port", "--inspect-brk" });
 
-  AddOption("--inspect-brk-node", "", &DebugOptions::break_node_first_line);
+  AddOption("--inspect-brk-node", "", BOOL_FIELD(break_node_first_line));
   Implies("--inspect-brk-node", "--inspect");
   AddAlias("--inspect-brk-node=", { "--inspect-port", "--inspect-brk-node" });
 
   AddOption(
       "--inspect-wait",
       "activate inspector on host:port and wait for debugger to be attached",
-      &DebugOptions::inspect_wait,
+      BOOL_FIELD(inspect_wait),
       kAllowedInEnvvar);
   Implies("--inspect-wait", "--inspect");
   AddAlias("--inspect-wait=", {"--inspect-port", "--inspect-wait"});
@@ -518,7 +569,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--experimental-detect-module",
             "when ambiguous modules fail to evaluate because they contain "
             "ES module syntax, try again to evaluate them as ES modules",
-            &EnvironmentOptions::detect_module,
+            BOOL_FIELD(detect_module),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-print-required-tla",
@@ -526,16 +577,16 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "is true, evaluate asynchronous graphs loaded by `require()` but "
             "do not run the microtasks, in order to find and print "
             "top-level await in the graph",
-            &EnvironmentOptions::print_required_tla,
+            BOOL_FIELD(print_required_tla),
             kAllowedInEnvvar);
   AddOption("--require-module",
             "Allow loading synchronous ES Modules in require().",
-            &EnvironmentOptions::require_module,
+            BOOL_FIELD(require_module),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-require-module",
             "Legacy alias for --require-module",
-            &EnvironmentOptions::require_module,
+            BOOL_FIELD(require_module),
             kAllowedInEnvvar,
             true);
   Implies("--experimental-require-module", "--require-module");
@@ -546,7 +597,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--disable-sigusr1",
             "Disable inspector thread to be listening for SIGUSR1 signal",
-            &EnvironmentOptions::disable_sigusr1,
+            BOOL_FIELD(disable_sigusr1),
             kAllowedInEnvvar,
             false);
   AddOption("--dns-result-order",
@@ -559,7 +610,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--network-family-autoselection",
             "Disable network address family autodetection algorithm",
-            &EnvironmentOptions::network_family_autoselection,
+            BOOL_FIELD(network_family_autoselection),
             kAllowedInEnvvar,
             true);
   AddOption("--network-family-autoselection-attempt-timeout",
@@ -571,53 +622,67 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
            "--network-family-autoselection");
   AddOption("--enable-source-maps",
             "Source Map V3 support for stack traces",
-            &EnvironmentOptions::enable_source_maps,
+            BOOL_FIELD(enable_source_maps),
             kAllowedInEnvvar);
   AddOption("--entry-url",
             "Treat the entrypoint as a URL",
-            &EnvironmentOptions::entry_is_url,
+            BOOL_FIELD(entry_is_url),
             kAllowedInEnvvar);
   AddOption("--experimental-addon-modules",
             "experimental import support for addons",
-            &EnvironmentOptions::experimental_addon_modules,
+            BOOL_FIELD(experimental_addon_modules),
             kAllowedInEnvvar);
   AddOption("--experimental-abortcontroller", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-eventsource",
             "experimental EventSource API",
-            &EnvironmentOptions::experimental_eventsource,
+            BOOL_FIELD(experimental_eventsource),
             kAllowedInEnvvar,
             false);
   AddOption("--experimental-fetch", "", NoOp{}, kAllowedInEnvvar);
 #if HAVE_FFI
   AddOption("--experimental-ffi",
             "experimental node:ffi module",
-            &EnvironmentOptions::experimental_ffi,
+            BOOL_FIELD(experimental_ffi),
             kAllowedInEnvvar,
-            false);
+            HAVE_FFI);
 #endif  // HAVE_FFI
+  AddOption("--experimental-web-worker",
+            "experimental Web Worker API",
+            BOOL_FIELD(experimental_web_worker),
+            kAllowedInEnvvar,
+            false);
   AddOption("--experimental-websocket",
             "experimental WebSocket API",
-            &EnvironmentOptions::experimental_websocket,
+            BOOL_FIELD(experimental_websocket),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-global-customevent", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-sqlite",
             "experimental node:sqlite module",
-            &EnvironmentOptions::experimental_sqlite,
+            BOOL_FIELD(experimental_sqlite),
             kAllowedInEnvvar,
             HAVE_SQLITE);
   AddOption("--experimental-stream-iter",
             "experimental iterable streams API (node:stream/iter)",
-            &EnvironmentOptions::experimental_stream_iter,
+            BOOL_FIELD(experimental_stream_iter),
+            kAllowedInEnvvar);
+  AddOption("--experimental-dtls",
+#if HAVE_DTLS
+            "experimental DTLS support",
+            BOOL_FIELD(experimental_dtls),
+#else
+            "" /* undocumented when no-op */,
+            NoOp{},
+#endif
             kAllowedInEnvvar);
   AddOption("--experimental-vfs",
             "experimental node:vfs module",
-            &EnvironmentOptions::experimental_vfs,
+            BOOL_FIELD(experimental_vfs),
             kAllowedInEnvvar);
   AddOption("--experimental-quic",
 #ifndef OPENSSL_NO_QUIC
             "experimental QUIC support",
-            &EnvironmentOptions::experimental_quic,
+            BOOL_FIELD(experimental_quic),
 #else
             "" /* undocumented when no-op */,
             NoOp{},
@@ -625,7 +690,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--experimental-webstorage",
             "experimental Web Storage API",
-            &EnvironmentOptions::webstorage,
+            BOOL_FIELD(webstorage),
             kAllowedInEnvvar,
             HAVE_SQLITE);
   AddAlias("--webstorage", "--experimental-webstorage");
@@ -635,7 +700,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--experimental-global-navigator",
             "expose experimental Navigator API on the global scope",
-            &EnvironmentOptions::experimental_global_navigator,
+            BOOL_FIELD(experimental_global_navigator),
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-global-webcrypto", "", NoOp{}, kAllowedInEnvvar);
@@ -650,21 +715,21 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--experimental-import-text",
             "experimental support for importing source as text with import "
             "attributes",
-            &EnvironmentOptions::experimental_import_text,
+            BOOL_FIELD(experimental_import_text),
             kAllowedInEnvvar);
   AddOption("--experimental-import-meta-resolve",
             "experimental ES Module import.meta.resolve() parentURL support",
-            &EnvironmentOptions::experimental_import_meta_resolve,
+            BOOL_FIELD(experimental_import_meta_resolve),
             kAllowedInEnvvar);
   AddOption("--permission",
             "enable the permission system",
-            &EnvironmentOptions::permission,
+            BOOL_FIELD(permission),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--permission-audit",
             "enable audit only for the permission system",
-            &EnvironmentOptions::permission_audit,
+            BOOL_FIELD(permission_audit),
             kAllowedInEnvvar,
             false);
   AddOption("--allow-fs-read",
@@ -677,64 +742,70 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::allow_fs_write,
             kAllowedInEnvvar,
             OptionNamespaces::kPermissionNamespace);
+  AddOption("--allow-fs-vfs",
+            "allow mounting a virtual file system when any permissions are set",
+            BOOL_FIELD(allow_fs_vfs),
+            kAllowedInEnvvar,
+            false,
+            OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-addons",
             "allow use of addons when any permissions are set",
-            &EnvironmentOptions::allow_addons,
+            BOOL_FIELD(allow_addons),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-child-process",
             "allow use of child process when any permissions are set",
-            &EnvironmentOptions::allow_child_process,
+            BOOL_FIELD(allow_child_process),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
 #if HAVE_FFI
   AddOption("--allow-ffi",
             "allow use of FFI when any permissions are set",
-            &EnvironmentOptions::allow_ffi,
+            BOOL_FIELD(allow_ffi),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
 #endif  // HAVE_FFI
   AddOption("--allow-inspector",
             "allow use of inspector when any permissions are set",
-            &EnvironmentOptions::allow_inspector,
+            BOOL_FIELD(allow_inspector),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-net",
             "allow use of network when any permissions are set",
-            &EnvironmentOptions::allow_net,
+            BOOL_FIELD(allow_net),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-wasi",
             "allow wasi when any permissions are set",
-            &EnvironmentOptions::allow_wasi,
+            BOOL_FIELD(allow_wasi),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-worker",
             "allow worker threads when any permissions are set",
-            &EnvironmentOptions::allow_worker_threads,
+            BOOL_FIELD(allow_worker_threads),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--experimental-repl-await",
             "experimental await keyword support in REPL",
-            &EnvironmentOptions::experimental_repl_await,
+            BOOL_FIELD(experimental_repl_await),
             kAllowedInEnvvar,
             true);
   AddOption("--allow-openssl-store",
             "allow use of OpenSSL STORE loaders when any permissions are set",
-            &EnvironmentOptions::allow_openssl_store,
+            BOOL_FIELD(allow_openssl_store),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
   AddOption("--experimental-vm-modules",
             "experimental ES Module support in vm module",
-            &EnvironmentOptions::experimental_vm_modules,
+            BOOL_FIELD(experimental_vm_modules),
             kAllowedInEnvvar);
   AddOption("--experimental-worker", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--experimental-report", "", NoOp{}, kAllowedInEnvvar);
@@ -743,13 +814,13 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--expose-gc", "expose gc extension", V8Option{}, kAllowedInEnvvar);
   AddOption("--async-context-frame",
             "Improve AsyncLocalStorage performance with AsyncContextFrame",
-            &EnvironmentOptions::async_context_frame,
+            BOOL_FIELD(async_context_frame),
             kAllowedInEnvvar,
             true);
-  AddOption("--expose-internals", "", &EnvironmentOptions::expose_internals);
+  AddOption("--expose-internals", "", BOOL_FIELD(expose_internals));
   AddOption("--frozen-intrinsics",
             "experimental frozen intrinsics support",
-            &EnvironmentOptions::frozen_intrinsics,
+            BOOL_FIELD(frozen_intrinsics),
             kAllowedInEnvvar);
   AddOption("--heapsnapshot-signal",
             "Generate heap snapshot on specified signal",
@@ -764,7 +835,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--http-parser", "", NoOp{}, kAllowedInEnvvar);
   AddOption("--insecure-http-parser",
             "use an insecure HTTP parser that accepts invalid HTTP headers",
-            &EnvironmentOptions::insecure_http_parser,
+            BOOL_FIELD(insecure_http_parser),
             kAllowedInEnvvar);
   AddOption("--input-type",
             "set module type for string input",
@@ -776,33 +847,33 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
            "--experimental-specifier-resolution");
   AddOption("--deprecation",
             "silence deprecation warnings",
-            &EnvironmentOptions::deprecation,
+            BOOL_FIELD(deprecation),
             kAllowedInEnvvar,
             true);
   AddOption("--force-async-hooks-checks",
             "disable checks for async_hooks",
-            &EnvironmentOptions::force_async_hooks_checks,
+            BOOL_FIELD(force_async_hooks_checks),
             kAllowedInEnvvar,
             true);
   AddOption(
       "--force-node-api-uncaught-exceptions-policy",
       "enforces 'uncaughtException' event on Node API asynchronous callbacks",
-      &EnvironmentOptions::force_node_api_uncaught_exceptions_policy,
+      BOOL_FIELD(force_node_api_uncaught_exceptions_policy),
       kAllowedInEnvvar,
       false);
   AddOption("--addons",
             "disable loading native addons",
-            &EnvironmentOptions::allow_native_addons,
+            BOOL_FIELD(allow_native_addons),
             kAllowedInEnvvar,
             true);
   AddOption("--global-search-paths",
             "disable global module search paths",
-            &EnvironmentOptions::global_search_paths,
+            BOOL_FIELD(global_search_paths),
             kAllowedInEnvvar,
             true);
   AddOption("--warnings",
             "silence all process warnings",
-            &EnvironmentOptions::warnings,
+            BOOL_FIELD(warnings),
             kAllowedInEnvvar,
             true);
   AddOption("--disable-warning",
@@ -811,32 +882,32 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--force-context-aware",
             "disable loading non-context-aware addons",
-            &EnvironmentOptions::force_context_aware,
+            BOOL_FIELD(force_context_aware),
             kAllowedInEnvvar);
   AddOption("--pending-deprecation",
             "emit pending deprecation warnings",
-            &EnvironmentOptions::pending_deprecation,
+            BOOL_FIELD(pending_deprecation),
             kAllowedInEnvvar);
   AddOption("--use-env-proxy",
             "parse proxy settings from HTTP_PROXY/HTTPS_PROXY/NO_PROXY"
             "environment variables and apply the setting in global HTTP/HTTPS "
             "clients",
-            &EnvironmentOptions::use_env_proxy,
+            BOOL_FIELD(use_env_proxy),
             kAllowedInEnvvar);
   AddOption("--preserve-symlinks",
             "preserve symbolic links when resolving",
-            &EnvironmentOptions::preserve_symlinks,
+            BOOL_FIELD(preserve_symlinks),
             kAllowedInEnvvar);
   AddOption("--preserve-symlinks-main",
             "preserve symbolic links when resolving the main module",
-            &EnvironmentOptions::preserve_symlinks_main,
+            BOOL_FIELD(preserve_symlinks_main),
             kAllowedInEnvvar);
   AddOption("--prof",
             "Generate V8 profiler output.",
             V8Option{});
   AddOption("--prof-process",
             "process V8 profiler output generated using --prof",
-            &EnvironmentOptions::prof_process);
+            BOOL_FIELD(prof_process));
   // Options after --prof-process are passed through to the prof processor.
   AddAlias("--prof-process", {"--prof-process", "--"});
 #if HAVE_INSPECTOR
@@ -844,7 +915,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "Start the V8 CPU profiler on start up, and write the CPU profile "
             "to disk before exit. If --cpu-prof-dir is not specified, write "
             "the profile to the current working directory.",
-            &EnvironmentOptions::cpu_prof,
+            BOOL_FIELD(cpu_prof),
             kAllowedInEnvvar);
   AddOption("--cpu-prof-name",
             "specified file name of the V8 CPU profile generated with "
@@ -863,22 +934,22 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--experimental-network-inspection",
             "experimental network inspection support",
-            &EnvironmentOptions::experimental_network_inspection);
+            BOOL_FIELD(experimental_network_inspection));
   AddOption("--experimental-storage-inspection",
             "experimental storage inspection support",
-            &EnvironmentOptions::experimental_storage_inspection);
+            BOOL_FIELD(experimental_storage_inspection));
   AddOption("--experimental-worker-inspection",
             "experimental worker inspection support",
-            &EnvironmentOptions::experimental_worker_inspection);
+            BOOL_FIELD(experimental_worker_inspection));
   AddOption("--experimental-inspector-network-resource",
             "experimental load network resources via the inspector",
-            &EnvironmentOptions::experimental_inspector_network_resource);
+            BOOL_FIELD(experimental_inspector_network_resource));
   AddOption(
       "--heap-prof",
       "Start the V8 heap profiler on start up, and write the heap profile "
       "to disk before exit. If --heap-prof-dir is not specified, write "
       "the profile to the current working directory.",
-      &EnvironmentOptions::heap_prof,
+      BOOL_FIELD(heap_prof),
       kAllowedInEnvvar);
   AddOption("--heap-prof-name",
             "specified file name of the V8 heap profile generated with "
@@ -904,8 +975,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "write warnings to file instead of stderr",
             &EnvironmentOptions::redirect_warnings,
             kAllowedInEnvvar);
-  AddOption(
-      "[has_env_file_string]", "", &EnvironmentOptions::has_env_file_string);
+  AddOption("[has_env_file_string]", "", BOOL_FIELD(has_env_file_string));
   AddOption("--env-file",
             "set environment variables from supplied file",
             &EnvironmentOptions::env_file);
@@ -923,9 +993,52 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "use the specified file for package map resolution",
             &EnvironmentOptions::experimental_package_map_path,
             kAllowedInEnvvar);
+  AddOption("--bench",
+            "launch benchmark runner on startup",
+            BOOL_FIELD(bench_runner),
+            kDisallowedInEnvvar,
+            false,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-isolation",
+            "configures the type of benchmark isolation used in the benchmark "
+            "runner",
+            &EnvironmentOptions::bench_isolation,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-name-pattern",
+            "run benchmarks whose name matches this regular expression",
+            &EnvironmentOptions::bench_name_pattern,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-reporter",
+            "report benchmark output using the given reporter",
+            &EnvironmentOptions::bench_reporter,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-reporter-destination",
+            "report the given benchmark reporter to the given destination",
+            &EnvironmentOptions::bench_reporter_destination,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("[has_bench_samples]", "", BOOL_FIELD(has_bench_samples));
+  AddOption("--bench-samples",
+            "specify the number of measured benchmark samples",
+            &EnvironmentOptions::bench_samples,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-samples", "[has_bench_samples]");
+  AddOption("[has_bench_warmup]", "", BOOL_FIELD(has_bench_warmup));
+  AddOption("--bench-warmup",
+            "specify the number of unreported benchmark warmup samples",
+            &EnvironmentOptions::bench_warmup,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-warmup", "[has_bench_warmup]");
   AddOption("--test",
             "launch test runner on startup",
-            &EnvironmentOptions::test_runner,
+            BOOL_FIELD(test_runner),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -936,7 +1049,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-force-exit",
             "force test runner to exit upon completion",
-            &EnvironmentOptions::test_runner_force_exit,
+            BOOL_FIELD(test_runner_force_exit),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -947,13 +1060,13 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-update-snapshots",
             "regenerate test snapshots",
-            &EnvironmentOptions::test_runner_update_snapshots,
+            BOOL_FIELD(test_runner_update_snapshots),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--experimental-test-coverage",
             "enable code coverage in the test runner",
-            &EnvironmentOptions::test_runner_coverage,
+            BOOL_FIELD(test_runner_coverage),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -981,7 +1094,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddAlias("--experimental-test-isolation", "--test-isolation");
   AddOption("--experimental-test-module-mocks",
             "enable module mocking in the test runner",
-            &EnvironmentOptions::test_runner_module_mocks,
+            BOOL_FIELD(test_runner_module_mocks),
             kDisallowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -1007,7 +1120,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-only",
             "run tests with 'only' option set",
-            &EnvironmentOptions::test_only,
+            BOOL_FIELD(test_only),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -1034,7 +1147,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   AddOption("--test-coverage-include-all",
             "include source files that were never loaded in the coverage "
             "report",
-            &EnvironmentOptions::coverage_include_all,
+            BOOL_FIELD(coverage_include_all),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
@@ -1050,12 +1163,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-randomize",
             "run tests in a random order",
-            &EnvironmentOptions::test_randomize,
+            BOOL_FIELD(test_randomize),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kTestRunnerNamespace);
-  AddOption(
-      "[has_test_random_seed]", "", &EnvironmentOptions::has_test_random_seed);
+  AddOption("[has_test_random_seed]", "", BOOL_FIELD(has_test_random_seed));
   AddOption("--test-random-seed",
             "seed used to randomize test execution order",
             &EnvironmentOptions::test_random_seed,
@@ -1069,63 +1181,63 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kTestRunnerNamespace);
   AddOption("--test-udp-no-try-send",
             "",  // For testing only.
-            &EnvironmentOptions::test_udp_no_try_send,
+            BOOL_FIELD(test_udp_no_try_send),
             kDisallowedInEnvvar);
   AddOption("--throw-deprecation",
             "throw an exception on deprecations",
-            &EnvironmentOptions::throw_deprecation,
+            BOOL_FIELD(throw_deprecation),
             kAllowedInEnvvar);
   AddOption("--trace-deprecation",
             "show stack traces on deprecations",
-            &EnvironmentOptions::trace_deprecation,
+            BOOL_FIELD(trace_deprecation),
             kAllowedInEnvvar);
   AddOption("--trace-exit",
             "show stack trace when an environment exits",
-            &EnvironmentOptions::trace_exit,
+            BOOL_FIELD(trace_exit),
             kAllowedInEnvvar);
   AddOption("--trace-sync-io",
             "show stack trace when use of sync IO is detected after the "
             "first tick",
-            &EnvironmentOptions::trace_sync_io,
+            BOOL_FIELD(trace_sync_io),
             kAllowedInEnvvar);
   AddOption("--trace-tls",
             "prints TLS packet trace information to stderr",
-            &EnvironmentOptions::trace_tls,
+            BOOL_FIELD(trace_tls),
             kAllowedInEnvvar);
   AddOption("--trace-uncaught",
             "show stack traces for the `throw` behind uncaught exceptions",
-            &EnvironmentOptions::trace_uncaught,
+            BOOL_FIELD(trace_uncaught),
             kAllowedInEnvvar);
   AddOption("--trace-warnings",
             "show stack traces on process warnings",
-            &EnvironmentOptions::trace_warnings,
+            BOOL_FIELD(trace_warnings),
             kAllowedInEnvvar);
   AddOption("--trace-promises",
             "show stack traces on promise initialization and resolution",
-            &EnvironmentOptions::trace_promises,
+            BOOL_FIELD(trace_promises),
             kAllowedInEnvvar);
 
   AddOption("--trace-env",
             "Print accesses to the environment variables",
-            &EnvironmentOptions::trace_env,
+            BOOL_FIELD(trace_env),
             kAllowedInEnvvar);
   Implies("--trace-env-js-stack", "--trace-env");
   Implies("--trace-env-native-stack", "--trace-env");
   AddOption("--trace-env-js-stack",
             "Print accesses to the environment variables and the JavaScript "
             "stack trace",
-            &EnvironmentOptions::trace_env_js_stack,
+            BOOL_FIELD(trace_env_js_stack),
             kAllowedInEnvvar);
   AddOption(
       "--trace-env-native-stack",
       "Print accesses to the environment variables and the native stack trace",
-      &EnvironmentOptions::trace_env_native_stack,
+      BOOL_FIELD(trace_env_native_stack),
       kAllowedInEnvvar);
 
 #if HAVE_OPENSSL
   AddOption("--use-system-ca",
             "use system's CA store",
-            &EnvironmentOptions::use_system_ca,
+            BOOL_FIELD(use_system_ca),
             kAllowedInEnvvar);
 #endif  // HAVE_OPENSSL
 
@@ -1138,7 +1250,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
   AddOption("--extra-info-on-fatal-exception",
             "hide extra information on fatal exception that causes exit",
-            &EnvironmentOptions::extra_info_on_fatal_exception,
+            BOOL_FIELD(extra_info_on_fatal_exception),
             kAllowedInEnvvar,
             true);
   AddOption("--unhandled-rejections",
@@ -1152,11 +1264,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--verify-base-objects",
             "", /* undocumented, only for debugging */
-            &EnvironmentOptions::verify_base_objects,
+            BOOL_FIELD(verify_base_objects),
             kAllowedInEnvvar);
   AddOption("--watch",
             "run in watch mode",
-            &EnvironmentOptions::watch_mode,
+            BOOL_FIELD(watch_mode),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kWatchNamespace);
@@ -1173,14 +1285,14 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             OptionNamespaces::kWatchNamespace);
   AddOption("--watch-preserve-output",
             "preserve outputs on watch mode restart",
-            &EnvironmentOptions::watch_mode_preserve_output,
+            BOOL_FIELD(watch_mode_preserve_output),
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kWatchNamespace);
   Implies("--watch-path", "--watch");
   AddOption("--check",
             "syntax check script without executing",
-            &EnvironmentOptions::syntax_check_only);
+            BOOL_FIELD(syntax_check_only));
   AddAlias("-c", "--check");
   // This option is only so that we can tell --eval with an empty string from
   // no eval at all. Having it not start with a dash makes it inaccessible
@@ -1188,12 +1300,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   // TODO(addaleax): When moving --help over to something generated from the
   // programmatic descriptions, this will need some special care.
   // (See also [ssl_openssl_cert_store] below.)
-  AddOption("[has_eval_string]", "", &EnvironmentOptions::has_eval_string);
+  AddOption("[has_eval_string]", "", BOOL_FIELD(has_eval_string));
   AddOption("--eval", "evaluate script", &EnvironmentOptions::eval_string);
   Implies("--eval", "[has_eval_string]");
-  AddOption("--print",
-            "evaluate script and print result",
-            &EnvironmentOptions::print_eval);
+  AddOption(
+      "--print", "evaluate script and print result", BOOL_FIELD(print_eval));
   AddAlias("-e", "--eval");
   AddAlias("--print <arg>", "-pe");
   AddAlias("-pe", { "--print", "--eval" });
@@ -1209,14 +1320,14 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar);
   AddOption("--strip-types",
             "Type-stripping for TypeScript files.",
-            &EnvironmentOptions::strip_types,
+            BOOL_FIELD(strip_types),
             kAllowedInEnvvar,
             HAVE_AMARO);
   AddAlias("--experimental-strip-types", "--strip-types");
   AddOption("--interactive",
             "always enter the REPL even if stdin does not appear "
             "to be a terminal",
-            &EnvironmentOptions::force_repl);
+            BOOL_FIELD(force_repl));
   AddAlias("-i", "--interactive");
 
   AddOption("--napi-modules", "", NoOp{}, kAllowedInEnvvar);
@@ -1228,23 +1339,23 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
   AddOption("--tls-min-v1.0",
             "set default TLS minimum to TLSv1.0 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_0,
+            BOOL_FIELD(tls_min_v1_0),
             kAllowedInEnvvar);
   AddOption("--tls-min-v1.1",
             "set default TLS minimum to TLSv1.1 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_1,
+            BOOL_FIELD(tls_min_v1_1),
             kAllowedInEnvvar);
   AddOption("--tls-min-v1.2",
             "set default TLS minimum to TLSv1.2 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_2,
+            BOOL_FIELD(tls_min_v1_2),
             kAllowedInEnvvar);
   AddOption("--tls-min-v1.3",
             "set default TLS minimum to TLSv1.3 (default: TLSv1.2)",
-            &EnvironmentOptions::tls_min_v1_3,
+            BOOL_FIELD(tls_min_v1_3),
             kAllowedInEnvvar);
   AddOption("--tls-max-v1.2",
             "set default TLS maximum to TLSv1.2 (default: TLSv1.3)",
-            &EnvironmentOptions::tls_max_v1_2,
+            BOOL_FIELD(tls_max_v1_2),
             kAllowedInEnvvar);
   // Current plan is:
   // - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3
@@ -1252,26 +1363,32 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
   // In either case, support both options they are uniformly available.
   AddOption("--tls-max-v1.3",
             "set default TLS maximum to TLSv1.3 (default: TLSv1.3)",
-            &EnvironmentOptions::tls_max_v1_3,
+            BOOL_FIELD(tls_max_v1_3),
             kAllowedInEnvvar);
 
   AddOption("--report-exclude-env",
             "Exclude environment variables when generating report"
             " (default: false)",
-            &EnvironmentOptions::report_exclude_env,
+            BOOL_FIELD(report_exclude_env),
             kAllowedInEnvvar);
   AddOption("--report-exclude-network",
             "exclude network interface diagnostics."
             " (default: false)",
-            &EnvironmentOptions::report_exclude_network,
+            BOOL_FIELD(report_exclude_network),
             kAllowedInEnvvar);
 }
 
 PerIsolateOptionsParser::PerIsolateOptionsParser(
   const EnvironmentOptionsParser& eop) {
+  AddOption("--worker-snapshot",
+            "start worker threads from the bootstrapped context in the "
+            "built-in startup snapshot",
+            BOOL_FIELD(worker_snapshot),
+            kAllowedInEnvvar,
+            true);
   AddOption("--track-heap-objects",
             "track heap object allocations for heap snapshots",
-            &PerIsolateOptions::track_heap_objects,
+            BOOL_FIELD(track_heap_objects),
             kAllowedInEnvvar);
 
   // Explicitly add some V8 flags to mark them as allowed in NODE_OPTIONS.
@@ -1311,11 +1428,11 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
             kAllowedInEnvvar);
   AddOption("--report-uncaught-exception",
             "generate diagnostic report on uncaught exceptions",
-            &PerIsolateOptions::report_uncaught_exception,
+            BOOL_FIELD(report_uncaught_exception),
             kAllowedInEnvvar);
   AddOption("--report-on-signal",
             "generate diagnostic report upon receiving signals",
-            &PerIsolateOptions::report_on_signal,
+            BOOL_FIELD(report_on_signal),
             kAllowedInEnvvar);
   AddOption("--report-signal",
             "causes diagnostic report to be produced on provided signal,"
@@ -1332,7 +1449,7 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
 
   AddOption("--experimental-shadow-realm",
             "",
-            &PerIsolateOptions::experimental_shadow_realm,
+            BOOL_FIELD(experimental_shadow_realm),
             kAllowedInEnvvar);
   AddOption("--harmony-shadow-realm", "", V8Option{});
   Implies("--experimental-shadow-realm", "--harmony-shadow-realm");
@@ -1340,7 +1457,7 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
   ImpliesNot("--no-harmony-shadow-realm", "--experimental-shadow-realm");
   AddOption("--build-snapshot",
             "Generate a snapshot blob when the process exits.",
-            &PerIsolateOptions::build_snapshot,
+            BOOL_FIELD(build_snapshot),
             kDisallowedInEnvvar);
   AddOption("--build-snapshot-config",
             "Generate a snapshot blob when the process exits using a"
@@ -1375,11 +1492,11 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   AddOption("--zero-fill-buffers",
             "automatically zero-fill all newly allocated Buffer instances",
-            &PerProcessOptions::zero_fill_all_buffers,
+            BOOL_FIELD(zero_fill_all_buffers),
             kAllowedInEnvvar);
   AddOption("--debug-arraybuffer-allocations",
             "", /* undocumented, only for debugging */
-            &PerProcessOptions::debug_arraybuffer_allocations,
+            BOOL_FIELD(debug_arraybuffer_allocations),
             kAllowedInEnvvar);
   AddOption("--disable-proto",
             "disable Object.prototype.__proto__",
@@ -1387,7 +1504,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   AddOption("--node-snapshot",
             "",  // It's a debug-only option.
-            &PerProcessOptions::node_snapshot,
+            BOOL_FIELD(node_snapshot),
             kAllowedInEnvvar);
   AddOption("--snapshot-blob",
             "Path to the snapshot blob that's either the result of snapshot"
@@ -1403,20 +1520,18 @@ PerProcessOptionsParser::PerProcessOptionsParser(
   AddAlias("--security-reverts", "--security-revert");
   AddOption("--completion-bash",
             "print source-able bash completion script",
-            &PerProcessOptions::print_bash_completion);
-  AddOption("--help",
-            "print node command line options",
-            &PerProcessOptions::print_help);
-  AddAlias("-h", "--help");
+            BOOL_FIELD(print_bash_completion));
   AddOption(
-      "--version", "print Node.js version", &PerProcessOptions::print_version);
+      "--help", "print node command line options", BOOL_FIELD(print_help));
+  AddAlias("-h", "--help");
+  AddOption("--version", "print Node.js version", BOOL_FIELD(print_version));
   AddAlias("-v", "--version");
   AddOption("--v8-options",
             "print V8 command line options",
-            &PerProcessOptions::print_v8_help);
+            BOOL_FIELD(print_v8_help));
   AddOption("--report-compact",
             "output compact single-line JSON",
-            &PerProcessOptions::report_compact,
+            BOOL_FIELD(report_compact),
             kAllowedInEnvvar);
   AddOption("--report-dir",
             "define custom report pathname."
@@ -1431,7 +1546,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   AddOption("--report-on-fatalerror",
             "generate diagnostic report on fatal (internal) errors",
-            &PerProcessOptions::report_on_fatalerror,
+            BOOL_FIELD(report_on_fatalerror),
             kAllowedInEnvvar);
 
 #ifdef NODE_HAVE_I18N_SUPPORT
@@ -1461,7 +1576,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             " (default)"
 #endif
             ,
-            &PerProcessOptions::use_openssl_ca,
+            BOOL_FIELD(use_openssl_ca),
             kAllowedInEnvvar);
   AddOption("--use-bundled-ca",
             "use bundled CA store"
@@ -1469,24 +1584,32 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             " (default)"
 #endif
             ,
-            &PerProcessOptions::use_bundled_ca,
+            BOOL_FIELD(use_bundled_ca),
             kAllowedInEnvvar);
   // Similar to [has_eval_string] above, except that the separation between
   // this and use_openssl_ca only exists for option validation after parsing.
   // This is not ideal.
-  AddOption("[ssl_openssl_cert_store]",
-            "",
-            &PerProcessOptions::ssl_openssl_cert_store);
+  AddOption("[ssl_openssl_cert_store]", "", BOOL_FIELD(ssl_openssl_cert_store));
   Implies("--use-openssl-ca", "[ssl_openssl_cert_store]");
   ImpliesNot("--use-bundled-ca", "[ssl_openssl_cert_store]");
   AddOption("--enable-fips",
             "enable FIPS crypto at startup",
-            &PerProcessOptions::enable_fips_crypto,
+            BOOL_FIELD(enable_fips_crypto),
+            kAllowedInEnvvar);
+  AddOption("--enable-fips-indicator-events",
+            "publish FIPS indicator results to the "
+            "crypto.fips.indicator diagnostics channel",
+            BOOL_FIELD(enable_fips_indicator_events),
             kAllowedInEnvvar);
   AddOption("--force-fips",
-            "force FIPS crypto (cannot be disabled)",
-            &PerProcessOptions::force_fips_crypto,
+            "force FIPS crypto (optional mode: provider or strict)",
+            BOOL_FIELD(force_fips_crypto),
+            kAllowedInEnvvar);
+  AddOption("[force_fips_crypto_policy]",
+            "",
+            &PerProcessOptions::force_fips_crypto_policy,
             kAllowedInEnvvar);
+  AddAlias("--force-fips=", {"[force_fips_crypto_policy]", "--force-fips"});
 #ifndef V8_ENABLE_SANDBOX
   AddOption("--secure-heap",
             "total size of the OpenSSL secure heap",
@@ -1501,25 +1624,24 @@ PerProcessOptionsParser::PerProcessOptionsParser(
 #if OPENSSL_VERSION_MAJOR >= 3
   AddOption("--openssl-legacy-provider",
             "enable OpenSSL 3.0 legacy provider",
-            &PerProcessOptions::openssl_legacy_provider,
+            BOOL_FIELD(openssl_legacy_provider),
             kAllowedInEnvvar);
   AddOption("--openssl-shared-config",
             "enable OpenSSL shared configuration",
-            &PerProcessOptions::openssl_shared_config,
+            BOOL_FIELD(openssl_shared_config),
             kAllowedInEnvvar);
 
 #endif  // OPENSSL_VERSION_MAJOR
   AddOption("--use-largepages",
-            "Map the Node.js static code to large pages. Options are "
-            "'off' (the default value, meaning do not map), "
-            "'on' (map and ignore failure, reporting it to stderr), "
-            "or 'silent' (map and silently ignore failure)",
+            "This option is no longer supported and a no-op. It still accepts"
+            " these values for compatibility: 'off' (default), 'on' (report a "
+            "warning to stderr), or 'silent' (same as 'off').",
             &PerProcessOptions::use_largepages,
             kAllowedInEnvvar);
 
   AddOption("--trace-sigint",
             "enable printing JavaScript stacktrace on SIGINT",
-            &PerProcessOptions::trace_sigint,
+            BOOL_FIELD(trace_sigint),
             kAllowedInEnvvar);
 
   Insert(iop, &PerProcessOptions::get_per_isolate_options);
@@ -1544,7 +1666,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
       "Disable trap-handler-based WebAssembly bound checks. V8 will insert "
       "inline bound checks when compiling WebAssembly which may slow down "
       "performance.",
-      &PerProcessOptions::disable_wasm_trap_handler,
+      BOOL_FIELD(disable_wasm_trap_handler),
       kAllowedInEnvvar);
 
   AddOption("--build-sea",
@@ -1769,7 +1891,7 @@ void GetCLIOptionsValues(const FunctionCallbackInfo<Value>& args) {
         }
         break;
       case kBoolean: {
-        bool original_value = *_ppop_instance.Lookup<bool>(field, opts);
+        bool original_value = field->GetBool(opts);
         value = Boolean::New(isolate, original_value);
 
         // Add --no-* entries.
@@ -2086,7 +2208,13 @@ void GetOptionsAsFlags(const FunctionCallbackInfo<Value>& args) {
 
     switch (option_info.type) {
       case kBoolean: {
-        bool current_value = *_ppop_instance.Lookup<bool>(field, opts);
+        bool current_value = field->GetBool(opts);
+#if HAVE_OPENSSL
+        if (option_name == "--force-fips" && current_value) {
+          flags.push_back(option_name + "=" + opts->force_fips_crypto_policy);
+          break;
+        }
+#endif
         // For boolean options with default_is_true, we want the opposite logic
         if (option_info.default_is_true) {
           if (!current_value) {
diff --git a/src/node_options.h b/src/node_options.h
index 24df9254cd49..1de2bc65f74f 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -18,6 +18,9 @@
 
 namespace node {
 
+// Helper macro for defining a 1-bit boolean field in a struct.
+#define DEFINE_BOOL_FIELD(field) bool field : 1
+
 class HostPort {
  public:
   HostPort(const std::string& host_name, int port)
@@ -53,8 +56,8 @@ class Options {
 };
 
 struct InspectPublishUid {
-  bool console;
-  bool http;
+  DEFINE_BOOL_FIELD(console);
+  DEFINE_BOOL_FIELD(http);
 };
 
 // These options are currently essentially per-Environment, but it can be nice
@@ -69,19 +72,20 @@ class DebugOptions : public Options {
   DebugOptions(DebugOptions&&) = default;
   DebugOptions& operator=(DebugOptions&&) = default;
 
-  bool allow_attaching_debugger = true;
+  // --inspect-publish-uid
+  std::string inspect_publish_uid_string = "stderr,http";
+
+  DEFINE_BOOL_FIELD(allow_attaching_debugger) = true;
   // --inspect
-  bool inspector_enabled = false;
+  DEFINE_BOOL_FIELD(inspector_enabled) = false;
   // --inspect-wait
-  bool inspect_wait = false;
+  DEFINE_BOOL_FIELD(inspect_wait) = false;
   // --debug
-  bool deprecated_debug = false;
+  DEFINE_BOOL_FIELD(deprecated_debug) = false;
   // --inspect-brk
-  bool break_first_line = false;
+  DEFINE_BOOL_FIELD(break_first_line) = false;
   // --inspect-brk-node
-  bool break_node_first_line = false;
-  // --inspect-publish-uid
-  std::string inspect_publish_uid_string = "stderr,http";
+  DEFINE_BOOL_FIELD(break_node_first_line) = false;
 
   InspectPublishUid inspect_publish_uid;
 
@@ -118,170 +122,192 @@ class DebugOptions : public Options {
 
 class EnvironmentOptions : public Options {
  public:
-  bool abort_on_uncaught_exception = false;
-  std::vector<std::string> conditions;
-  bool detect_module = true;
-  bool disable_sigusr1 = false;
-  bool print_required_tla = false;
-  bool require_module = true;
+#if HAVE_INSPECTOR
+  static constexpr uint64_t kDefaultCpuProfInterval = 1000;
+  static constexpr uint64_t kDefaultHeapProfInterval = 512 * 1024;
+#endif
+  static constexpr bool IS_DEBUG =
+#ifdef DEBUG
+      true;
+#else
+      false;
+#endif  // DEBUG
+
   std::string dns_result_order;
-  bool enable_source_maps = false;
-  bool experimental_addon_modules = true;
-  bool experimental_eventsource = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_ffi = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_websocket = true;
-  bool experimental_sqlite = HAVE_SQLITE;
-  bool experimental_stream_iter = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_vfs = EXPERIMENTALS_DEFAULT_VALUE;
-  bool webstorage = HAVE_SQLITE;
-  bool experimental_quic = EXPERIMENTALS_DEFAULT_VALUE;
   std::string localstorage_file;
-  bool experimental_global_navigator = true;
-  bool experimental_global_web_crypto = true;
-  bool experimental_import_text = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_import_meta_resolve = EXPERIMENTALS_DEFAULT_VALUE;
   std::string input_type;  // Value of --input-type
-  bool entry_is_url = false;
-  bool permission = false;
-  bool permission_audit = false;
-  std::vector<std::string> allow_fs_read;
-  std::vector<std::string> allow_fs_write;
-  bool allow_addons = false;
-  bool allow_inspector = false;
-  bool allow_child_process = false;
-  bool allow_net = false;
-  bool allow_wasi = false;
-  bool allow_ffi = false;
-  bool allow_openssl_store = false;
-  bool allow_worker_threads = false;
-  bool experimental_repl_await = true;
-  bool experimental_vm_modules = EXPERIMENTALS_DEFAULT_VALUE;
-  bool async_context_frame = true;
-  bool expose_internals = false;
-  bool force_node_api_uncaught_exceptions_policy = false;
-  bool frozen_intrinsics = false;
-  int64_t heap_snapshot_near_heap_limit = 0;
   std::string heap_snapshot_signal;
-  bool network_family_autoselection = true;
-  uint64_t network_family_autoselection_attempt_timeout = 500;
-  uint64_t max_http_header_size = 16 * 1024;
-  bool deprecation = true;
-  bool force_async_hooks_checks = true;
-  bool allow_native_addons = true;
-  bool global_search_paths = true;
-  bool warnings = true;
-  std::vector<std::string> disable_warnings;
-  bool force_context_aware = false;
-  bool pending_deprecation = false;
-  bool preserve_symlinks = false;
-  bool preserve_symlinks_main = false;
-  bool prof_process = false;
+  std::string redirect_warnings;
+  std::string diagnostic_dir;
+  std::string bench_isolation = "process";
+  std::string bench_name_pattern;
+  std::string test_rerun_failures_path;
+  std::string test_global_setup_path;
+  std::string test_isolation = "process";
+  std::string test_shard;
+  std::string trace_require_module;
+  std::string unhandled_rejections;
+  std::string watch_mode_kill_signal = "SIGTERM";
+  std::string eval_string;
+  std::string tls_keylog;
+  std::string experimental_config_file_path;
+  std::string experimental_package_map_path;
 #if HAVE_INSPECTOR
   std::string cpu_prof_dir;
-  static const uint64_t kDefaultCpuProfInterval = 1000;
-  uint64_t cpu_prof_interval = kDefaultCpuProfInterval;
   std::string cpu_prof_name;
-  bool cpu_prof = false;
-  bool experimental_network_inspection = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_worker_inspection = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_storage_inspection = EXPERIMENTALS_DEFAULT_VALUE;
-  bool experimental_inspector_network_resource = EXPERIMENTALS_DEFAULT_VALUE;
   std::string heap_prof_dir;
   std::string heap_prof_name;
-  static const uint64_t kDefaultHeapProfInterval = 512 * 1024;
-  uint64_t heap_prof_interval = kDefaultHeapProfInterval;
-  bool heap_prof = false;
 #endif  // HAVE_INSPECTOR
-  std::string redirect_warnings;
-  std::string diagnostic_dir;
+
+  std::vector<std::string> conditions;
+  std::vector<std::string> allow_fs_read;
+  std::vector<std::string> allow_fs_write;
+  std::vector<std::string> disable_warnings;
+  std::vector<std::string> bench_reporter;
+  std::vector<std::string> bench_reporter_destination;
   std::vector<std::string> env_file;
   std::vector<std::string> optional_env_file;
-  bool has_env_file_string = false;
-  bool test_runner = false;
-  uint64_t test_runner_concurrency = 0;
-  uint64_t test_runner_timeout = 0;
-  bool test_runner_coverage = false;
-  bool test_runner_force_exit = false;
-  uint64_t test_coverage_branches = 0;
-  uint64_t test_coverage_functions = 0;
-  uint64_t test_coverage_lines = 0;
-  bool test_runner_module_mocks = false;
-  bool test_runner_update_snapshots = false;
   std::vector<std::string> test_name_pattern;
   std::vector<std::string> test_reporter;
-  std::string test_rerun_failures_path;
   std::vector<std::string> test_reporter_destination;
-  std::string test_global_setup_path;
-  bool test_randomize = false;
-  bool has_test_random_seed = false;
-  uint64_t test_random_seed = 0;
-  bool test_only = false;
-  bool test_udp_no_try_send = false;
-  std::string test_isolation = "process";
-  std::string test_shard;
   std::vector<std::string> test_skip_pattern;
   std::vector<std::string> experimental_test_tag_filter;
   std::vector<std::string> coverage_include_pattern;
-  bool coverage_include_all = false;
   std::vector<std::string> coverage_exclude_pattern;
-  bool throw_deprecation = false;
-  bool trace_deprecation = false;
-  bool trace_exit = false;
-  bool trace_sync_io = false;
-  bool trace_tls = false;
-  bool trace_uncaught = false;
-  bool trace_warnings = false;
-  bool trace_promises = false;
-  bool trace_env = false;
-  bool trace_env_js_stack = false;
-  bool trace_env_native_stack = false;
-  bool use_system_ca = false;
-  std::string trace_require_module;
-  bool extra_info_on_fatal_exception = true;
-  std::string unhandled_rejections;
   std::vector<std::string> userland_loaders;
-  bool verify_base_objects =
-#ifdef DEBUG
-      true;
-#else
-      false;
-#endif  // DEBUG
-
-  bool watch_mode = false;
-  bool watch_mode_report_to_parent = false;
-  bool watch_mode_preserve_output = false;
-  std::string watch_mode_kill_signal = "SIGTERM";
   std::vector<std::string> watch_mode_paths;
-
-  bool syntax_check_only = false;
-  bool has_eval_string = false;
-  std::string eval_string;
-  bool print_eval = false;
-  bool force_repl = false;
-
-  bool insecure_http_parser = false;
-  bool use_env_proxy = false;
-
-  bool tls_min_v1_0 = false;
-  bool tls_min_v1_1 = false;
-  bool tls_min_v1_2 = false;
-  bool tls_min_v1_3 = false;
-  bool tls_max_v1_2 = false;
-  bool tls_max_v1_3 = false;
-  std::string tls_keylog;
-
   std::vector<std::string> preload_cjs_modules;
-
   std::vector<std::string> preload_esm_modules;
-
-  bool strip_types = HAVE_AMARO;
-
   std::vector<std::string> user_argv;
 
-  bool report_exclude_env = false;
-  bool report_exclude_network = false;
-  std::string experimental_config_file_path;
-  std::string experimental_package_map_path;
+  int64_t heap_snapshot_near_heap_limit = 0;
+  uint64_t network_family_autoselection_attempt_timeout = 500;
+  uint64_t max_http_header_size = 16 * 1024;
+  uint64_t bench_samples = 0;
+  uint64_t bench_warmup = 0;
+  uint64_t test_runner_concurrency = 0;
+  uint64_t test_runner_timeout = 0;
+  uint64_t test_coverage_branches = 0;
+  uint64_t test_coverage_functions = 0;
+  uint64_t test_coverage_lines = 0;
+  uint64_t test_random_seed = 0;
+#if HAVE_INSPECTOR
+  uint64_t cpu_prof_interval = kDefaultCpuProfInterval;
+  uint64_t heap_prof_interval = kDefaultHeapProfInterval;
+#endif  // HAVE_INSPECTOR
+
+  // These are intentionally not bools. They are 1 bit packed flags in
+  // order to reduce the overall size of the struct.
+
+  DEFINE_BOOL_FIELD(abort_on_uncaught_exception) = false;
+  DEFINE_BOOL_FIELD(detect_module) = true;
+  DEFINE_BOOL_FIELD(disable_sigusr1) = false;
+  DEFINE_BOOL_FIELD(print_required_tla) = false;
+  DEFINE_BOOL_FIELD(require_module) = true;
+  DEFINE_BOOL_FIELD(enable_source_maps) = false;
+  DEFINE_BOOL_FIELD(experimental_addon_modules) = true;
+  DEFINE_BOOL_FIELD(experimental_eventsource) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_ffi) = HAVE_FFI;
+  DEFINE_BOOL_FIELD(experimental_web_worker) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_websocket) = true;
+  DEFINE_BOOL_FIELD(experimental_sqlite) = HAVE_SQLITE;
+  DEFINE_BOOL_FIELD(experimental_stream_iter) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_vfs) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(webstorage) = HAVE_SQLITE;
+  DEFINE_BOOL_FIELD(experimental_dtls) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_quic) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_global_navigator) = true;
+  DEFINE_BOOL_FIELD(experimental_global_web_crypto) = true;
+  DEFINE_BOOL_FIELD(experimental_import_text) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_import_meta_resolve) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(entry_is_url) = false;
+  DEFINE_BOOL_FIELD(permission) = false;
+  DEFINE_BOOL_FIELD(permission_audit) = false;
+  DEFINE_BOOL_FIELD(allow_addons) = false;
+  DEFINE_BOOL_FIELD(allow_fs_vfs) = false;
+  DEFINE_BOOL_FIELD(allow_inspector) = false;
+  DEFINE_BOOL_FIELD(allow_child_process) = false;
+  DEFINE_BOOL_FIELD(allow_net) = false;
+  DEFINE_BOOL_FIELD(allow_wasi) = false;
+  DEFINE_BOOL_FIELD(allow_ffi) = false;
+  DEFINE_BOOL_FIELD(allow_openssl_store) = false;
+  DEFINE_BOOL_FIELD(allow_worker_threads) = false;
+  DEFINE_BOOL_FIELD(experimental_repl_await) = true;
+  DEFINE_BOOL_FIELD(experimental_vm_modules) = EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(async_context_frame) = true;
+  DEFINE_BOOL_FIELD(expose_internals) = false;
+  DEFINE_BOOL_FIELD(force_node_api_uncaught_exceptions_policy) = false;
+  DEFINE_BOOL_FIELD(frozen_intrinsics) = false;
+  DEFINE_BOOL_FIELD(network_family_autoselection) = true;
+  DEFINE_BOOL_FIELD(deprecation) = true;
+  DEFINE_BOOL_FIELD(force_async_hooks_checks) = true;
+  DEFINE_BOOL_FIELD(allow_native_addons) = true;
+  DEFINE_BOOL_FIELD(global_search_paths) = true;
+  DEFINE_BOOL_FIELD(warnings) = true;
+  DEFINE_BOOL_FIELD(force_context_aware) = false;
+  DEFINE_BOOL_FIELD(pending_deprecation) = false;
+  DEFINE_BOOL_FIELD(preserve_symlinks) = false;
+  DEFINE_BOOL_FIELD(preserve_symlinks_main) = false;
+  DEFINE_BOOL_FIELD(prof_process) = false;
+  DEFINE_BOOL_FIELD(has_env_file_string) = false;
+  DEFINE_BOOL_FIELD(bench_runner) = false;
+  DEFINE_BOOL_FIELD(has_bench_samples) = false;
+  DEFINE_BOOL_FIELD(has_bench_warmup) = false;
+  DEFINE_BOOL_FIELD(test_runner) = false;
+  DEFINE_BOOL_FIELD(test_runner_coverage) = false;
+  DEFINE_BOOL_FIELD(test_runner_force_exit) = false;
+  DEFINE_BOOL_FIELD(test_runner_module_mocks) = false;
+  DEFINE_BOOL_FIELD(test_runner_update_snapshots) = false;
+  DEFINE_BOOL_FIELD(test_randomize) = false;
+  DEFINE_BOOL_FIELD(has_test_random_seed) = false;
+  DEFINE_BOOL_FIELD(test_only) = false;
+  DEFINE_BOOL_FIELD(test_udp_no_try_send) = false;
+  DEFINE_BOOL_FIELD(coverage_include_all) = false;
+  DEFINE_BOOL_FIELD(throw_deprecation) = false;
+  DEFINE_BOOL_FIELD(trace_deprecation) = false;
+  DEFINE_BOOL_FIELD(trace_exit) = false;
+  DEFINE_BOOL_FIELD(trace_sync_io) = false;
+  DEFINE_BOOL_FIELD(trace_tls) = false;
+  DEFINE_BOOL_FIELD(trace_uncaught) = false;
+  DEFINE_BOOL_FIELD(trace_warnings) = false;
+  DEFINE_BOOL_FIELD(trace_promises) = false;
+  DEFINE_BOOL_FIELD(trace_env) = false;
+  DEFINE_BOOL_FIELD(trace_env_js_stack) = false;
+  DEFINE_BOOL_FIELD(trace_env_native_stack) = false;
+  DEFINE_BOOL_FIELD(use_system_ca) = false;
+  DEFINE_BOOL_FIELD(extra_info_on_fatal_exception) = true;
+  DEFINE_BOOL_FIELD(verify_base_objects) = IS_DEBUG;
+  DEFINE_BOOL_FIELD(watch_mode) = false;
+  DEFINE_BOOL_FIELD(watch_mode_report_to_parent) = false;
+  DEFINE_BOOL_FIELD(watch_mode_preserve_output) = false;
+  DEFINE_BOOL_FIELD(syntax_check_only) = false;
+  DEFINE_BOOL_FIELD(has_eval_string) = false;
+  DEFINE_BOOL_FIELD(print_eval) = false;
+  DEFINE_BOOL_FIELD(force_repl) = false;
+  DEFINE_BOOL_FIELD(insecure_http_parser) = false;
+  DEFINE_BOOL_FIELD(use_env_proxy) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_0) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_1) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_2) = false;
+  DEFINE_BOOL_FIELD(tls_min_v1_3) = false;
+  DEFINE_BOOL_FIELD(tls_max_v1_2) = false;
+  DEFINE_BOOL_FIELD(tls_max_v1_3) = false;
+  DEFINE_BOOL_FIELD(strip_types) = HAVE_AMARO;
+  DEFINE_BOOL_FIELD(report_exclude_env) = false;
+  DEFINE_BOOL_FIELD(report_exclude_network) = false;
+#if HAVE_INSPECTOR
+  DEFINE_BOOL_FIELD(cpu_prof) = false;
+  DEFINE_BOOL_FIELD(experimental_network_inspection) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_worker_inspection) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_storage_inspection) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(experimental_inspector_network_resource) =
+      EXPERIMENTALS_DEFAULT_VALUE;
+  DEFINE_BOOL_FIELD(heap_prof) = false;
+#endif  // HAVE_INSPECTOR
 
   inline DebugOptions* get_debug_options() { return &debug_options_; }
   inline const DebugOptions& debug_options() const { return debug_options_; }
@@ -295,20 +321,25 @@ class EnvironmentOptions : public Options {
 
 class PerIsolateOptions : public Options {
  public:
+  bool worker_snapshot = true;  // --[no-]worker-snapshot
   PerIsolateOptions() = default;
   PerIsolateOptions(PerIsolateOptions&&) = default;
 
   std::shared_ptr<EnvironmentOptions> per_env{new EnvironmentOptions()};
-  bool track_heap_objects = false;
-  bool report_uncaught_exception = false;
-  bool report_on_signal = false;
-  bool experimental_shadow_realm = false;
+
   std::string max_old_space_size_percentage;
   std::string max_old_space_size;
-  int64_t stack_trace_limit = 10;
   std::string report_signal = "SIGUSR2";
-  bool build_snapshot = false;
   std::string build_snapshot_config;
+
+  int64_t stack_trace_limit = 10;
+
+  DEFINE_BOOL_FIELD(track_heap_objects) = false;
+  DEFINE_BOOL_FIELD(report_uncaught_exception) = false;
+  DEFINE_BOOL_FIELD(report_on_signal) = false;
+  DEFINE_BOOL_FIELD(experimental_shadow_realm) = false;
+  DEFINE_BOOL_FIELD(build_snapshot) = false;
+
   inline EnvironmentOptions* get_per_env_options();
   void CheckOptions(std::vector<std::string>* errors,
                     std::vector<std::string>* argv) override;
@@ -340,63 +371,72 @@ class PerProcessOptions : public Options {
 #else
   std::string trace_event_file_pattern = "node_trace.${rotation}.log";
 #endif
-  int64_t v8_thread_pool_size = 4;
-  bool zero_fill_all_buffers = false;
-  bool debug_arraybuffer_allocations = false;
   std::string disable_proto;
-  // We enable the shared read-only heap which currently requires that the
-  // snapshot used in different isolates in the same process to be the same.
-  // Therefore --node-snapshot is a per-process option.
-  bool node_snapshot = true;
   std::string snapshot_blob;
-
-  std::vector<std::string> security_reverts;
-  bool print_bash_completion = false;
-  bool print_help = false;
-  bool print_v8_help = false;
-  bool print_version = false;
   std::string experimental_sea_config;
   std::string run;
-
   std::string build_sea;
 #ifdef NODE_HAVE_I18N_SUPPORT
   std::string icu_data_dir;
 #endif
-
-  // Per-process because they affect singleton OpenSSL shared library state,
-  // or are used once during process initialization.
+// Per-process because they affect singleton OpenSSL shared library state,
+// or are used once during process initialization.
 #if HAVE_OPENSSL
   std::string openssl_config;
   std::string tls_cipher_list = DEFAULT_CIPHER_LIST_CORE;
+#endif  // HAVE_OPENSSL
+  std::string report_directory;
+  std::string report_filename;
+  // TODO(addaleax): Some of these could probably be per-Environment.
+  std::string use_largepages = "off";
+
+  std::vector<std::string> security_reverts;
+  std::vector<std::string> cmdline;
+
+  int64_t v8_thread_pool_size = 4;
+#if HAVE_OPENSSL
   int64_t secure_heap = 0;
   int64_t secure_heap_min = 2;
+#endif  // HAVE_OPENSSL
+
+  DEFINE_BOOL_FIELD(zero_fill_all_buffers) = false;
+  DEFINE_BOOL_FIELD(debug_arraybuffer_allocations) = false;
+
+  // We enable the shared read-only heap which currently requires that the
+  // snapshot used in different isolates in the same process to be the same.
+  // Therefore --node-snapshot is a per-process option.
+  DEFINE_BOOL_FIELD(node_snapshot) = true;
+
+  DEFINE_BOOL_FIELD(print_bash_completion) = false;
+  DEFINE_BOOL_FIELD(print_help) = false;
+  DEFINE_BOOL_FIELD(print_v8_help) = false;
+  DEFINE_BOOL_FIELD(print_version) = false;
+
+#if HAVE_OPENSSL
 #ifdef NODE_OPENSSL_CERT_STORE
-  bool ssl_openssl_cert_store = true;
+  DEFINE_BOOL_FIELD(ssl_openssl_cert_store) = true;
 #else
-  bool ssl_openssl_cert_store = false;
-#endif
-  bool use_openssl_ca = false;
-  bool use_bundled_ca = false;
-  bool enable_fips_crypto = false;
-  bool force_fips_crypto = false;
-#endif
+  DEFINE_BOOL_FIELD(ssl_openssl_cert_store) = false;
+#endif  // NODE_OPENSSL_CERT_STORE
+  DEFINE_BOOL_FIELD(use_openssl_ca) = false;
+  DEFINE_BOOL_FIELD(use_bundled_ca) = false;
+  DEFINE_BOOL_FIELD(enable_fips_crypto) = false;
+  DEFINE_BOOL_FIELD(enable_fips_indicator_events) = false;
+  DEFINE_BOOL_FIELD(force_fips_crypto) = false;
+  std::string force_fips_crypto_policy = "provider";
+#endif  // HAVE_OPENSSL
 #if OPENSSL_VERSION_MAJOR >= 3
-  bool openssl_legacy_provider = false;
-  bool openssl_shared_config = false;
+  DEFINE_BOOL_FIELD(openssl_legacy_provider) = false;
+  DEFINE_BOOL_FIELD(openssl_shared_config) = false;
 #endif
 
-  bool disable_wasm_trap_handler = false;
-
-  // Per-process because reports can be triggered outside a known V8 context.
-  bool report_on_fatalerror = false;
-  bool report_compact = false;
-  std::string report_directory;
-  std::string report_filename;
-
-  // TODO(addaleax): Some of these could probably be per-Environment.
-  std::string use_largepages = "off";
-  bool trace_sigint = false;
-  std::vector<std::string> cmdline;
+  DEFINE_BOOL_FIELD(disable_wasm_trap_handler) = false;
+  DEFINE_BOOL_FIELD(report_on_fatalerror) = false;
+  DEFINE_BOOL_FIELD(report_compact) = false;
+  DEFINE_BOOL_FIELD(trace_sigint) = false;
+  // Tracks whether `--run` was passed, since an empty `run` is ambiguous
+  // between "not passed" and "passed without a script name" (lists scripts).
+  DEFINE_BOOL_FIELD(has_run) = false;
 
   inline PerIsolateOptions* get_per_isolate_options();
   void CheckOptions(std::vector<std::string>* errors,
@@ -439,6 +479,7 @@ std::vector<std::string> MapAvailableNamespaces();
 // Define all namespace entries
 #define OPTION_NAMESPACE_LIST(V)                                               \
   V(kNoNamespace, "")                                                          \
+  V(kBenchRunnerNamespace, "bench")                                            \
   V(kTestRunnerNamespace, "test")                                              \
   V(kWatchNamespace, "watch")                                                  \
   V(kPermissionNamespace, "permission")
@@ -489,16 +530,17 @@ class OptionsParser {
   void AddOption(
       const char* name,
       const char* help_text,
-      bool Options::*field,
+      bool (*getter)(Options*),
+      void (*setter)(Options*, bool),
       OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
       bool default_is_true = false,
       OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
-  void AddOption(
-      const char* name,
-      const char* help_text,
-      uint64_t Options::*field,
-      OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
-      OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
+  void AddOption(const char* name,
+                 const char* help_text,
+                 uint64_t Options::*field,
+                 OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
+                 OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace,
+                 bool strict = false);
   void AddOption(
       const char* name,
       const char* help_text,
@@ -593,6 +635,16 @@ class OptionsParser {
     virtual ~BaseOptionField() = default;
     virtual void* LookupImpl(Options* options) const = 0;
 
+    // For boolean bit-field options, we can't return a pointer so we
+    // use virtual getter/setter methods instead. The default
+    // implementations go through LookupImpl for non-bit-field types.
+    virtual bool GetBool(Options* options) const {
+      return *static_cast<bool*>(LookupImpl(options));
+    }
+    virtual void SetBool(Options* options, bool value) {
+      *static_cast<bool*>(LookupImpl(options)) = value;
+    }
+
     template <typename T>
     inline T* Lookup(Options* options) const {
       return static_cast<T*>(LookupImpl(options));
@@ -613,6 +665,28 @@ class OptionsParser {
     T Options::* field_;
   };
 
+  // Represents a boolean bit-field within `Options`. Bit-fields cannot
+  // have their address taken, so we use getter/setter function pointers
+  // instead of a pointer-to-member.
+  class BitFieldOptionField : public BaseOptionField {
+   public:
+    using Getter = bool (*)(Options*);
+    using Setter = void (*)(Options*, bool);
+
+    BitFieldOptionField(Getter get, Setter set) : get_(get), set_(set) {}
+
+    void* LookupImpl(Options* options) const override { UNREACHABLE(); }
+
+    bool GetBool(Options* options) const override { return get_(options); }
+    void SetBool(Options* options, bool value) override {
+      set_(options, value);
+    }
+
+   private:
+    Getter get_;
+    Setter set_;
+  };
+
   template <typename T>
   inline T* Lookup(std::shared_ptr<BaseOptionField> field,
                    Options* options) const {
@@ -632,6 +706,7 @@ class OptionsParser {
     std::string help_text;
     bool default_is_true = false;
     std::string namespace_id;
+    bool strict = false;
   };
 
   // An implied option is composed of the information on where to store a
@@ -690,6 +765,14 @@ void Parse(StringVector* const args,
 
 }  // namespace options_parser
 
+// Helper macro for passing bit-field members to AddOption(). Expands to a
+// getter and setter function pointer pair that can read/write the named
+// bit-field without requiring a pointer-to-member (which is illegal for
+// bit-fields).
+#define BOOL_FIELD(field)                                                      \
+  +[](TargetType* opts) -> bool { return opts->field; },                       \
+      +[](TargetType* opts, bool v) { opts->field = v; }
+
 namespace per_process {
 
 extern Mutex cli_options_mutex;
@@ -703,6 +786,8 @@ void HandleEnvOptions(std::shared_ptr<EnvironmentOptions> env_options,
 
 std::vector<std::string> ParseNodeOptionsEnvVar(
     const std::string& node_options, std::vector<std::string>* errors);
+
+#undef DEFINE_BOOL_FIELD
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/node_platform.cc b/src/node_platform.cc
index 71a4e3d5ee83..2deccdcdf686 100644
--- a/src/node_platform.cc
+++ b/src/node_platform.cc
@@ -254,18 +254,19 @@ WorkerThreadsTaskRunner::WorkerThreadsTaskRunner(
   threads_.push_back(delayed_task_scheduler_->Start());
 
   for (int i = 0; i < thread_pool_size; i++) {
-    PlatformWorkerData* worker_data =
-        new PlatformWorkerData{&pending_worker_tasks_,
-                               &platform_workers_mutex,
-                               &platform_workers_ready,
-                               &pending_platform_workers,
-                               i,
-                               debug_log_level_};
+    auto worker_data = std::make_unique<PlatformWorkerData>(
+        PlatformWorkerData{&pending_worker_tasks_,
+                           &platform_workers_mutex,
+                           &platform_workers_ready,
+                           &pending_platform_workers,
+                           i,
+                           debug_log_level_});
     std::unique_ptr<uv_thread_t> t { new uv_thread_t() };
-    if (uv_thread_create(t.get(), PlatformWorkerThread,
-                         worker_data) != 0) {
+    if (uv_thread_create(t.get(), PlatformWorkerThread, worker_data.get()) !=
+        0) {
       break;
     }
+    worker_data.release();
     threads_.push_back(std::move(t));
   }
 
diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index 8f800be35431..6a35e5c5e4c4 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -807,6 +807,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
 
   SetMethodNoSideEffect(isolate, target, "cwd", Cwd);
   SetMethod(isolate, target, "dlopen", binding::DLOpen);
+  SetMethod(isolate, target, "dlopenBinary", binding::DLOpenBinary);
   SetMethod(isolate, target, "reallyExit", ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
@@ -854,6 +855,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 
   registry->Register(Cwd);
   registry->Register(binding::DLOpen);
+  registry->Register(binding::DLOpenBinary);
   registry->Register(ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
diff --git a/src/node_profiling.cc b/src/node_profiling.cc
index b6c42b286908..c4725d16e816 100644
--- a/src/node_profiling.cc
+++ b/src/node_profiling.cc
@@ -48,7 +48,6 @@ bool SerializeHeapProfile(Isolate* isolate, std::ostringstream& out_stream) {
   if (!profile) {
     return false;
   }
-  profiler->StopSamplingHeapProfiler();
   JSONWriter writer(out_stream, true);
   writer.json_start();
 
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 03d487f1dba7..d17ed779399c 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -263,6 +263,15 @@ void IsSea(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(IsSingleExecutable());
 }
 
+void IsVfsEnabled(const FunctionCallbackInfo<Value>& args) {
+  bool enabled = false;
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    enabled = static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs);
+  }
+  args.GetReturnValue().Set(enabled);
+}
+
 void IsExperimentalSeaWarningNeeded(const FunctionCallbackInfo<Value>& args) {
   bool is_building_sea =
       !per_process::cli_options->experimental_sea_config.empty();
@@ -447,6 +456,16 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
       if (use_code_cache_value) {
         result.flags |= SeaFlags::kUseCodeCache;
       }
+    } else if (key == "useVfs") {
+      bool use_vfs;
+      if (field.value().get_bool().get(use_vfs)) {
+        FPrintF(
+            stderr, "\"useVfs\" field of %s is not a Boolean\n", config_path);
+        return std::nullopt;
+      }
+      if (use_vfs) {
+        result.flags |= SeaFlags::kEnableVfs;
+      }
     } else if (key == "assets") {
       simdjson::ondemand::object assets_object;
       if (field.value().get_object().get(assets_object)) {
@@ -565,6 +584,19 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
     return std::nullopt;
   }
 
+  if (static_cast<bool>(result.flags & SeaFlags::kEnableVfs)) {
+    if (static_cast<bool>(result.flags & SeaFlags::kUseSnapshot)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useSnapshot\" is true\n");
+      return std::nullopt;
+    }
+    if (static_cast<bool>(result.flags & SeaFlags::kUseCodeCache)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useCodeCache\" is true\n");
+      return std::nullopt;
+    }
+  }
+
   if (result.main_path.empty()) {
     FPrintF(stderr,
             "\"main\" field of %s is not a non-empty string\n",
@@ -924,7 +956,31 @@ void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
                 void* priv) {
+  Environment* env = Environment::GetCurrent(context);
+  Isolate* isolate = env->isolate();
+
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    // Expose the main script path recorded in the SEA config so the VFS
+    // integration can place the main script at the mount point root.
+    if (static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs)) {
+      Local<String> code_path_str;
+      if (String::NewFromUtf8(isolate,
+                              sea_resource.code_path.data(),
+                              NewStringType::kNormal,
+                              sea_resource.code_path.length())
+              .ToLocal(&code_path_str)) {
+        target
+            ->Set(context,
+                  FIXED_ONE_BYTE_STRING(isolate, "mainCodePath"),
+                  code_path_str)
+            .Check();
+      }
+    }
+  }
+
   SetMethod(context, target, "isSea", IsSea);
+  SetMethod(context, target, "isVfsEnabled", IsVfsEnabled);
   SetMethod(context,
             target,
             "isExperimentalSeaWarningNeeded",
@@ -935,6 +991,7 @@ void Initialize(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(IsSea);
+  registry->Register(IsVfsEnabled);
   registry->Register(IsExperimentalSeaWarningNeeded);
   registry->Register(GetAsset);
   registry->Register(GetAssetKeys);
diff --git a/src/node_sea.h b/src/node_sea.h
index b147caefa5e5..cd633c2f43b7 100644
--- a/src/node_sea.h
+++ b/src/node_sea.h
@@ -30,6 +30,7 @@ enum class SeaFlags : uint32_t {
   kUseCodeCache = 1 << 2,
   kIncludeAssets = 1 << 3,
   kIncludeExecArgv = 1 << 4,
+  kEnableVfs = 1 << 5,
 };
 
 enum class SeaExecArgvExtension : uint8_t {
diff --git a/src/node_sea_bin.cc b/src/node_sea_bin.cc
index ef5dab3a25c0..30197b9bc3c3 100644
--- a/src/node_sea_bin.cc
+++ b/src/node_sea_bin.cc
@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
             {},
             SPrintF("Failed to create new ELF note %s", note_name)};
   }
+  // Left to itself LIEF moves a non-PIE executable's program headers into
+  // the largest gap between two PT_LOADs and extends the earlier one over it,
+  // which can leave that segment sharing a page with the next; kernels that
+  // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+  // to run the file. After .bss every segment keeps its own pages.
+  if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+      binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+          0) {
+    return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+  }
   binary->add(*new_note);
 
   LIEF::ELF::Builder::config_t cfg;
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index 7f5d9b9e1821..e861e499534c 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -1571,17 +1571,17 @@ void CompileSerializeMain(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsString());
   Local<String> filename = args[0].As<String>();
   Local<String> source = args[1].As<String>();
+  Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = args.GetIsolate();
   Local<Context> context = isolate->GetCurrentContext();
   // TODO(joyeecheung): do we need all of these? Maybe we would want a less
   // internal version of them.
-  LocalVector<String> parameters(
-      isolate,
-      {
-          FIXED_ONE_BYTE_STRING(isolate, "require"),
-          FIXED_ONE_BYTE_STRING(isolate, "__filename"),
-          FIXED_ONE_BYTE_STRING(isolate, "__dirname"),
-      });
+  LocalVector<String> parameters(isolate,
+                                 {
+                                     env->require_string(),
+                                     env->__filename_string(),
+                                     env->__dirname_string(),
+                                 });
 
   ScriptOrigin script_origin(filename, 0, 0, true);
   ScriptCompiler::Source script_source(source, script_origin);
diff --git a/src/node_snapshotable.h b/src/node_snapshotable.h
index 18ef5fbd43fd..a9050877a04d 100644
--- a/src/node_snapshotable.h
+++ b/src/node_snapshotable.h
@@ -44,8 +44,11 @@ struct InternalFieldInfoBase {
   template <std::derived_from<InternalFieldInfoBase> T>
   static T* New(EmbedderObjectType type) {
     void* buf = ::operator new[](sizeof(T));
-    memset(buf, 0, sizeof(T));  // Make the padding reproducible.
     T* result = new (buf) T;
+    // Zero the padding to make the bytes handed to V8 reproducible. Must come
+    // after the placement new, or -flifetime-dse drops it as a dead store.
+    // https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
+    memset(static_cast<void*>(result), 0, sizeof(T));
     result->type = type;
     result->length = sizeof(T);
     return result;
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 5775824a1f67..76accf1c2731 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -25,6 +25,7 @@ namespace sqlite {
 
 using v8::Array;
 using v8::ArrayBuffer;
+using v8::BackingStore;
 using v8::BackingStoreInitializationMode;
 using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
@@ -169,6 +170,16 @@ inline MaybeLocal<Value> IntegerToValue(Isolate* isolate,
           sqlite3_stmt_busy((stmt)->statement_.get()),                         \
       "database cannot be accessed from an authorizer callback")
 
+// SQLite's session module reaches back into JavaScript from inside the
+// pre-update hook, while it is still walking the connection's session list and
+// reading the table it found there. Deleting a session frees memory that walk
+// is still using, so no callback may close one.
+#define THROW_AND_RETURN_IF_SESSION_IN_CALLBACK(env, session)                  \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (session)->database_->IsInCallback(),                                    \
+      "session cannot be closed while in a callback")
+
 // A statement's virtual machine cannot be reentered while sqlite3_step() is
 // running it. Finalizing it frees the VM outright, and re-running it resets the
 // VM mid-execution; both are use-after-free rather than merely a contract
@@ -593,11 +604,13 @@ class BackupJob : public ThreadPoolWork {
   void ScheduleBackup() {
     Isolate* isolate = env()->isolate();
     HandleScope handle_scope(isolate);
+    sqlite3* dest_raw = nullptr;
     backup_status_ = sqlite3_open_v2(
         destination_name_.c_str(),
-        &dest_,
+        &dest_raw,
         SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_URI,
         nullptr);
+    dest_.reset(dest_raw);
     Local<Promise::Resolver> resolver =
         Local<Promise::Resolver>::New(env()->isolate(), resolver_);
     if (backup_status_ != SQLITE_OK) {
@@ -605,9 +618,11 @@ class BackupJob : public ThreadPoolWork {
       return;
     }
 
-    backup_ = sqlite3_backup_init(
-        dest_, dest_db_.c_str(), source_->Connection(), source_db_.c_str());
-    if (backup_ == nullptr) {
+    backup_.reset(sqlite3_backup_init(dest_.get(),
+                                      dest_db_.c_str(),
+                                      source_->Connection(),
+                                      source_db_.c_str()));
+    if (!backup_) {
       HandleBackupError(resolver);
       return;
     }
@@ -616,13 +631,17 @@ class BackupJob : public ThreadPoolWork {
   }
 
   void DoThreadPoolWork() override {
-    backup_status_ = sqlite3_backup_step(backup_, pages_);
+    backup_status_ = sqlite3_backup_step(backup_.get(), pages_);
   }
 
   void AfterThreadPoolWork(int status) override {
-    HandleScope handle_scope(env()->isolate());
+    Isolate* isolate = env()->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env()->context());
+    InternalCallbackScope callback_scope(
+        env(), Object::New(isolate), {0, 0}, InternalCallbackScope::kNoFlags);
     Local<Promise::Resolver> resolver =
-        Local<Promise::Resolver>::New(env()->isolate(), resolver_);
+        Local<Promise::Resolver>::New(isolate, resolver_);
 
     if (!(backup_status_ == SQLITE_OK || backup_status_ == SQLITE_DONE ||
           backup_status_ == SQLITE_BUSY || backup_status_ == SQLITE_LOCKED)) {
@@ -630,8 +649,8 @@ class BackupJob : public ThreadPoolWork {
       return;
     }
 
-    int total_pages = sqlite3_backup_pagecount(backup_);
-    int remaining_pages = sqlite3_backup_remaining(backup_);
+    int total_pages = sqlite3_backup_pagecount(backup_.get());
+    int remaining_pages = sqlite3_backup_remaining(backup_.get());
     if (remaining_pages != 0) {
       Local<Function> fn =
           Local<Function>::New(env()->isolate(), progressFunc_);
@@ -689,21 +708,19 @@ class BackupJob : public ThreadPoolWork {
 
   void Cleanup() {
     if (backup_) {
-      sqlite3_backup_finish(backup_);
-      backup_ = nullptr;
+      sqlite3_backup_finish(backup_.release());
     }
 
     if (dest_) {
-      backup_status_ = sqlite3_errcode(dest_);
-      sqlite3_close_v2(dest_);
-      dest_ = nullptr;
+      backup_status_ = sqlite3_errcode(dest_.get());
+      dest_.reset();
     }
   }
 
  private:
   void HandleBackupError(Local<Promise::Resolver> resolver) {
     Local<Object> e;
-    if (!CreateSQLiteError(env()->isolate(), dest_).ToLocal(&e)) {
+    if (!CreateSQLiteError(env()->isolate(), dest_.get()).ToLocal(&e)) {
       Finalize();
       delete this;
       return;
@@ -733,8 +750,14 @@ class BackupJob : public ThreadPoolWork {
   BaseObjectPtr<DatabaseSync> source_;
   Global<Promise::Resolver> resolver_;
   Global<Function> progressFunc_;
-  sqlite3* dest_ = nullptr;
-  sqlite3_backup* backup_ = nullptr;
+  struct Sqlite3Deleter {
+    void operator()(sqlite3* db) const { sqlite3_close_v2(db); }
+  };
+  struct BackupDeleter {
+    void operator()(sqlite3_backup* b) const { sqlite3_backup_finish(b); }
+  };
+  std::unique_ptr<sqlite3, Sqlite3Deleter> dest_;
+  std::unique_ptr<sqlite3_backup, BackupDeleter> backup_;
   int pages_;
   int backup_status_ = SQLITE_OK;
   std::string source_db_;
@@ -996,7 +1019,6 @@ DatabaseSync::DatabaseSync(Environment* env,
                            bool allow_load_extension)
     : BaseObject(env, object), open_config_(std::move(open_config)) {
   MakeWeak();
-  connection_ = nullptr;
   allow_load_extension_ = allow_load_extension;
   enable_load_extension_ = allow_load_extension;
   ignore_next_sqlite_error_ = false;
@@ -1017,6 +1039,15 @@ void DatabaseSync::RemoveBackup(BackupJob* job) {
   backups_.erase(job);
 }
 
+std::vector<BaseObjectPtr<Session>> DatabaseSync::PinSessions() const {
+  std::vector<BaseObjectPtr<Session>> pinned;
+  pinned.reserve(sessions_.size());
+  for (Session* session : sessions_) {
+    pinned.emplace_back(session);
+  }
+  return pinned;
+}
+
 void DatabaseSync::DeleteSessions() {
   // all attached sessions need to be deleted before the database is closed
   // https://www.sqlite.org/session/sqlite3session_create.html
@@ -1035,8 +1066,7 @@ DatabaseSync::~DatabaseSync() {
   if (IsOpen()) {
     FinalizeStatements();
     DeleteSessions();
-    sqlite3_close_v2(connection_);
-    connection_ = nullptr;
+    connection_.reset();
   }
 }
 
@@ -1059,9 +1089,8 @@ bool DatabaseSync::Open() {
   // database in an open state.
   bool opened = false;
   auto reset_connection_on_failure = OnScopeLeave([&]() {
-    if (!opened && connection_ != nullptr) {
-      sqlite3_close_v2(connection_);
-      connection_ = nullptr;
+    if (!opened) {
+      connection_.reset();
     }
   });
 
@@ -1070,18 +1099,20 @@ bool DatabaseSync::Open() {
   int flags = open_config_.get_read_only()
                   ? SQLITE_OPEN_READONLY
                   : SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE;
+  sqlite3* raw_conn = nullptr;
   int r = sqlite3_open_v2(open_config_.location().c_str(),
-                          &connection_,
+                          &raw_conn,
                           flags | default_flags,
                           nullptr);
+  connection_.reset(raw_conn);
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
 
-  r = sqlite3_db_config(connection_,
+  r = sqlite3_db_config(connection_.get(),
                         SQLITE_DBCONFIG_DQS_DML,
                         static_cast<int>(open_config_.get_enable_dqs()),
                         nullptr);
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
-  r = sqlite3_db_config(connection_,
+  r = sqlite3_db_config(connection_.get(),
                         SQLITE_DBCONFIG_DQS_DDL,
                         static_cast<int>(open_config_.get_enable_dqs()),
                         nullptr);
@@ -1089,7 +1120,7 @@ bool DatabaseSync::Open() {
 
   int foreign_keys_enabled;
   r = sqlite3_db_config(
-      connection_,
+      connection_.get(),
       SQLITE_DBCONFIG_ENABLE_FKEY,
       static_cast<int>(open_config_.get_enable_foreign_keys()),
       &foreign_keys_enabled);
@@ -1097,20 +1128,20 @@ bool DatabaseSync::Open() {
   CHECK_EQ(foreign_keys_enabled, open_config_.get_enable_foreign_keys());
 
   int defensive_enabled;
-  r = sqlite3_db_config(connection_,
+  r = sqlite3_db_config(connection_.get(),
                         SQLITE_DBCONFIG_DEFENSIVE,
                         static_cast<int>(open_config_.get_enable_defensive()),
                         &defensive_enabled);
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
   CHECK_EQ(defensive_enabled, open_config_.get_enable_defensive());
 
-  sqlite3_busy_timeout(connection_, open_config_.get_timeout());
+  sqlite3_busy_timeout(connection_.get(), open_config_.get_timeout());
 
   // Apply initial limits
   for (const auto& [js_name, sqlite_limit_id] : kLimitMapping) {
     const auto& limit_value = open_config_.initial_limits()[sqlite_limit_id];
     if (limit_value.has_value()) {
-      sqlite3_limit(connection_, sqlite_limit_id, *limit_value);
+      sqlite3_limit(connection_.get(), sqlite_limit_id, *limit_value);
     }
   }
 
@@ -1122,14 +1153,15 @@ bool DatabaseSync::Open() {
       return false;
     }
     const int load_extension_ret = sqlite3_db_config(
-        connection_, SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, 1, nullptr);
+        connection_.get(), SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, 1, nullptr);
     CHECK_ERROR_OR_THROW(
         env()->isolate(), this, load_extension_ret, SQLITE_OK, false);
   }
 
   trace_channel_ = diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
   if (trace_channel_ && trace_channel_->HasSubscribers()) {
-    sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+    sqlite3_trace_v2(
+        connection_.get(), SQLITE_TRACE_PROFILE, TraceCallback, this);
   }
 
   opened = true;
@@ -1142,12 +1174,13 @@ void DatabaseSync::EnableTracing() {
     trace_channel_ =
         diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
   }
-  sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+  sqlite3_trace_v2(
+      connection_.get(), SQLITE_TRACE_PROFILE, TraceCallback, this);
 }
 
 void DatabaseSync::DisableTracing() {
   if (!IsOpen()) return;
-  sqlite3_trace_v2(connection_, 0, nullptr, nullptr);
+  sqlite3_trace_v2(connection_.get(), 0, nullptr, nullptr);
 }
 
 void DatabaseSync::FinalizeBackups() {
@@ -1175,7 +1208,7 @@ inline bool DatabaseSync::IsOpen() {
 }
 
 inline sqlite3* DatabaseSync::Connection() {
-  return connection_;
+  return connection_.get();
 }
 
 void DatabaseSync::SetIgnoreNextSQLiteError(bool ignore) {
@@ -1547,7 +1580,7 @@ void DatabaseSync::IsTransactionGetter(
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
-  args.GetReturnValue().Set(sqlite3_get_autocommit(db->connection_) == 0);
+  args.GetReturnValue().Set(sqlite3_get_autocommit(db->connection_.get()) == 0);
 }
 
 void DatabaseSync::LimitsGetter(const FunctionCallbackInfo<Value>& args) {
@@ -1579,9 +1612,9 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
       env, db->IsInCallback(), "database cannot be closed while in a callback");
   db->FinalizeStatements();
   db->DeleteSessions();
-  int r = sqlite3_close_v2(db->connection_);
+  int r = sqlite3_close_v2(db->connection_.get());
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
-  db->connection_ = nullptr;
+  db->connection_.release();
 }
 
 void DatabaseSync::Dispose(const v8::FunctionCallbackInfo<v8::Value>& args) {
@@ -1709,14 +1742,18 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Utf8Value sql(env->isolate(), args[0].As<String>());
   sqlite3_stmt* s = nullptr;
 
   unsigned int prep_flags =
       persistent.value_or(false) ? SQLITE_PREPARE_PERSISTENT : 0;
 
-  int r =
-      sqlite3_prepare_v3(db->connection_, *sql, -1, prep_flags, &s, nullptr);
+  int r = sqlite3_prepare_v3(
+      db->connection_.get(), *sql, -1, prep_flags, &s, nullptr);
 
   StatementPtr stmt_ptr(s);
 
@@ -1775,7 +1812,7 @@ void DatabaseSync::Exec(const FunctionCallbackInfo<Value>& args) {
   BaseObjectPtr<DatabaseSync> guard(db);
 
   Utf8Value sql(env->isolate(), args[0].As<String>());
-  int r = sqlite3_exec(db->connection_, *sql, nullptr, nullptr, nullptr);
+  int r = sqlite3_exec(db->connection_.get(), *sql, nullptr, nullptr, nullptr);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
 }
 
@@ -1896,9 +1933,22 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     if (!fn->Get(env->context(), env->length_string()).ToLocal(&js_len)) {
       return;
     }
+
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"function.length\" property must be an integer.");
+      return;
+    }
+
     argc = js_len.As<Int32>()->Value();
   }
 
+  // Reading the options bag and "function.length" above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   UserDefinedFunction* user_data = new UserDefinedFunction(
       env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
@@ -1911,7 +1961,7 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     text_rep |= SQLITE_DIRECTONLY;
   }
 
-  int r = sqlite3_create_function_v2(db->connection_,
+  int r = sqlite3_create_function_v2(db->connection_.get(),
                                      *name,
                                      argc,
                                      text_rep,
@@ -1941,7 +1991,7 @@ void DatabaseSync::Location(const FunctionCallbackInfo<Value>& args) {
   }
 
   const char* db_filename =
-      sqlite3_db_filename(db->connection_, db_name.c_str());
+      sqlite3_db_filename(db->connection_.get(), db_name.c_str());
   if (!db_filename || db_filename[0] == '\0') {
     args.GetReturnValue().Set(Null(env->isolate()));
     return;
@@ -1972,7 +2022,7 @@ void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
 
   sqlite3_int64 size = 0;
   unsigned char* data =
-      sqlite3_serialize(db->connection_, db_name.c_str(), &size, 0);
+      sqlite3_serialize(db->connection_.get(), db_name.c_str(), &size, 0);
 
   if (data == nullptr) {
     if (size == 0) {
@@ -2061,6 +2111,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   // sqlite3_malloc64 is required because SQLITE_DESERIALIZE_FREEONCLOSE
   // transfers ownership to SQLite, which calls sqlite3_free() on close.
   // See: https://www.sqlite.org/c3ref/deserialize.html
@@ -2071,12 +2125,21 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  input->CopyContents(buf, byte_length);
+  // The same user JavaScript may also have shrunk or detached the backing
+  // store, in which case byte_length is stale and CopyContents() leaves the
+  // remainder of buf uninitialized. Handing that to SQLite would disclose it
+  // through serialize().
+  if (input->CopyContents(buf, byte_length) != byte_length) {
+    sqlite3_free(buf);
+    THROW_ERR_INVALID_STATE(
+        env, "The \"buffer\" argument was resized while reading \"options\"");
+    return;
+  }
 
   db->FinalizeStatements();
 
   int r = sqlite3_deserialize(
-      db->connection_,
+      db->connection_.get(),
       db_name.c_str(),
       buf,
       byte_length,
@@ -2209,17 +2272,37 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
       return;
     }
 
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"options.step.length\" property must be an integer.");
+      return;
+    }
+
     // Subtract 1 because the first argument is the aggregate value.
     argc = js_len.As<Int32>()->Value() - 1;
-    if (!inverseFunc.IsEmpty() &&
-        !inverseFunc->Get(env->context(), env->length_string())
-             .ToLocal(&js_len)) {
-      return;
+    if (!inverseFunc.IsEmpty()) {
+      if (!inverseFunc->Get(env->context(), env->length_string())
+               .ToLocal(&js_len)) {
+        return;
+      }
+
+      if (!js_len->IsInt32()) {
+        THROW_ERR_INVALID_ARG_TYPE(
+            env->isolate(),
+            "The \"options.inverse.length\" property must be an integer.");
+        return;
+      }
     }
 
     argc = std::max({argc, js_len.As<Int32>()->Value() - 1, 0});
   }
 
+  // Reading the options bag and the step/inverse "length" properties above can
+  // run user JavaScript through a property getter, which may have closed the
+  // database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   int text_rep = SQLITE_UTF8;
   if (direct_only) {
     text_rep |= SQLITE_DIRECTONLY;
@@ -2228,7 +2311,7 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
   auto xInverse = !inverseFunc.IsEmpty() ? CustomAggregate::xInverse : nullptr;
   auto xValue = xInverse ? CustomAggregate::xValue : nullptr;
   int r = sqlite3_create_window_function(
-      db->connection_,
+      db->connection_.get(),
       *name,
       argc,
       text_rep,
@@ -2248,10 +2331,15 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
 }
 
 void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
+  DatabaseSync* db;
+  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
+
   std::string table;
   std::string db_name = "main";
 
-  Environment* env = Environment::GetCurrent(args);
   if (args.Length() > 0) {
     if (!args[0]->IsObject()) {
       THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2302,13 +2390,13 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  DatabaseSync* db;
-  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
-  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   sqlite3_session* pSession;
-  int r = sqlite3session_create(db->connection_, db_name.c_str(), &pSession);
+  int r =
+      sqlite3session_create(db->connection_.get(), db_name.c_str(), &pSession);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
   bool wrapper_owns_session = false;
   auto delete_session_on_failure = OnScopeLeave([&]() {
@@ -2431,6 +2519,11 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the destination path and the options bag above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Local<Promise::Resolver> resolver;
   if (!Promise::Resolver::New(env->context()).ToLocal(&resolver)) {
     return;
@@ -2574,21 +2667,46 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  // Keep the database alive during sqlite3changeset_apply(), which may
-  // call conflict or filter callbacks that trigger JavaScript execution.
-  // If the JavaScript callback drops all references to the database,
-  // the DatabaseSync could otherwise be garbage-collected while the
-  // callback is still executing, causing a use-after-free.
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
+  // Keep the database alive in case a callback drops all references to it,
+  // which could otherwise let it be garbage-collected mid-callback.
   BaseObjectPtr<DatabaseSync> guard(db);
 
   ArrayBufferViewContents<uint8_t> buf(args[0]);
+  if (buf.length() > std::numeric_limits<int>::max()) {
+    THROW_ERR_OUT_OF_RANGE(env, "The changeset is too large.");
+    return;
+  }
+
+  // A callback may detach/modify the input buffer mid-apply, so copy it.
+  // With no callbacks, no JS runs during sqlite3changeset_apply(), so no
+  // copy is needed.
+  std::unique_ptr<BackingStore> changeset;
+  if (buf.length() > 0 &&
+      (context.filterCallback || context.conflictCallback)) {
+    changeset = ArrayBuffer::NewBackingStore(
+        env->isolate(),
+        buf.length(),
+        BackingStoreInitializationMode::kUninitialized,
+        BackingStoreOnFailureMode::kReturnNull);
+    if (!changeset) {
+      THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+      return;
+    }
+    std::memcpy(changeset->Data(), buf.data(), buf.length());
+  }
+
   int r;
   {
     CallbackDepthGuard guard(db);
     r = sqlite3changeset_apply(
-        db->connection_,
-        buf.length(),
-        const_cast<void*>(static_cast<const void*>(buf.data())),
+        db->connection_.get(),
+        static_cast<int>(buf.length()),
+        changeset ? changeset->Data()
+                  : const_cast<void*>(static_cast<const void*>(buf.data())),
         context.filterCallback ? xFilter : nullptr,
         xConflict,
         static_cast<void*>(&context));
@@ -2630,8 +2748,11 @@ void DatabaseSync::EnableLoadExtension(
     return;
   }
   db->enable_load_extension_ = enable;
-  const int load_extension_ret = sqlite3_db_config(
-      db->connection_, SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION, enable, nullptr);
+  const int load_extension_ret =
+      sqlite3_db_config(db->connection_.get(),
+                        SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION,
+                        enable,
+                        nullptr);
   CHECK_ERROR_OR_THROW(isolate, db, load_extension_ret, SQLITE_OK, void());
 }
 
@@ -2651,8 +2772,10 @@ void DatabaseSync::EnableDefensive(const FunctionCallbackInfo<Value>& args) {
 
   const int enable = args[0].As<Boolean>()->Value();
   int defensive_enabled;
-  const int defensive_ret = sqlite3_db_config(
-      db->connection_, SQLITE_DBCONFIG_DEFENSIVE, enable, &defensive_enabled);
+  const int defensive_ret = sqlite3_db_config(db->connection_.get(),
+                                              SQLITE_DBCONFIG_DEFENSIVE,
+                                              enable,
+                                              &defensive_enabled);
   CHECK_ERROR_OR_THROW(isolate, db, defensive_ret, SQLITE_OK, void());
 }
 
@@ -2661,7 +2784,7 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
-      env, db->connection_ == nullptr, "database is not open");
+      env, !db->connection_.get(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !db->allow_load_extension_, "extension loading is not allowed");
   THROW_AND_RETURN_ON_BAD_STATE(
@@ -2683,8 +2806,8 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
   THROW_IF_INSUFFICIENT_PERMISSIONS(
       env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
   char* errmsg = nullptr;
-  const int r =
-      sqlite3_load_extension(db->connection_, *path, *entryPoint, &errmsg);
+  const int r = sqlite3_load_extension(
+      db->connection_.get(), *path, *entryPoint, &errmsg);
   if (r != SQLITE_OK) {
     isolate->ThrowException(ERR_LOAD_SQLITE_EXTENSION(isolate, errmsg));
   }
@@ -2701,7 +2824,7 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
 
   if (args[0]->IsNull()) {
     // Clear the authorizer
-    sqlite3_set_authorizer(db->connection_, nullptr, nullptr);
+    sqlite3_set_authorizer(db->connection_.get(), nullptr, nullptr);
     db->object()->SetInternalField(kAuthorizerCallback, Null(isolate));
     return;
   }
@@ -2717,7 +2840,7 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
   db->object()->SetInternalField(kAuthorizerCallback, fn);
 
   int r = sqlite3_set_authorizer(
-      db->connection_, DatabaseSync::AuthorizerCallback, db);
+      db->connection_.get(), DatabaseSync::AuthorizerCallback, db);
 
   if (r != SQLITE_OK) {
     CHECK_ERROR_OR_THROW(isolate, db, r, SQLITE_OK, void());
@@ -2817,6 +2940,10 @@ int DatabaseSync::TraceCallback(unsigned int type,
     return 0;
   }
 
+  // Entered before building the payload below, because allocating it can
+  // trigger a garbage collection that SQLite is not prepared for.
+  CallbackDepthGuard guard(db);
+
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
 
@@ -2855,7 +2982,6 @@ int DatabaseSync::TraceCallback(unsigned int type,
 
   Local<Object> payload = Object::New(isolate, Null(isolate), keys, values, 3);
 
-  CallbackDepthGuard guard(db);
   ch->Publish(env, payload);
 
   return 0;
@@ -3964,7 +4090,7 @@ BaseObjectPtr<StatementSync> SQLTagStore::PrepareStatement(
 
   if (stmt == nullptr) {
     sqlite3_stmt* s = nullptr;
-    int r = sqlite3_prepare_v3(session->database_->connection_,
+    int r = sqlite3_prepare_v3(session->database_->connection_.get(),
                                sql.data(),
                                sql.size(),
                                SQLITE_PREPARE_PERSISTENT,
@@ -4240,7 +4366,7 @@ Session::Session(Environment* env,
                  BaseObjectPtr<DatabaseSync> database,
                  sqlite3_session* session)
     : BaseObject(env, object),
-      session_(session),
+      session_(std::unique_ptr<sqlite3_session, SessionDeleter>(session)),
       database_(std::move(database)) {
   database_->sessions_.insert(this);
   MakeWeak();
@@ -4296,8 +4422,7 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
-  THROW_AND_RETURN_ON_BAD_STATE(
-      env, session->session_ == nullptr, "session is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(env, !session->session_, "session is not open");
   THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   session->is_generating_changeset_ = true;
@@ -4306,7 +4431,8 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
 
   int nChangeset;
   void* pChangeset;
-  int r = sqliteChangesetFunc(session->session_, &nChangeset, &pChangeset);
+  int r =
+      sqliteChangesetFunc(session->session_.get(), &nChangeset, &pChangeset);
   CHECK_ERROR_OR_THROW(
       env->isolate(), session->database_.get(), r, SQLITE_OK, void());
 
@@ -4331,22 +4457,30 @@ void Session::Close(const FunctionCallbackInfo<Value>& args) {
       env, session->session_ == nullptr, "session is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->is_generating_changeset_, "session is currently in use");
+  // Checked last: changeset generation runs the authorizer, so both conditions
+  // hold in that case and the more specific message above has to win.
+  THROW_AND_RETURN_IF_SESSION_IN_CALLBACK(env, session);
 
   session->Delete();
 }
 
-void Session::Dispose(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::TryCatch try_catch(args.GetIsolate());
-  Close(args);
-  if (try_catch.HasCaught()) {
-    CHECK(try_catch.CanContinue());
+void Session::Dispose(const FunctionCallbackInfo<Value>& args) {
+  Session* session;
+  ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  if (session->session_ == nullptr) {
+    return;
   }
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, session->is_generating_changeset_, "session is currently in use");
+  THROW_AND_RETURN_IF_SESSION_IN_CALLBACK(env, session);
+
+  session->Delete();
 }
 
 void Session::Delete() {
-  if (session_ == nullptr) return;
-  sqlite3session_delete(session_);
-  session_ = nullptr;
+  if (!session_) return;
+  session_.reset();
   if (database_) {
     database_->sessions_.erase(this);
   }
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 7b34d4222b4a..306a47f6c47f 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -289,6 +289,13 @@ class DatabaseSync : public BaseObject {
   void DecrementCallbackDepth() { --callback_depth_; }
   bool IsInCallback() const { return callback_depth_ > 0; }
 
+  // SQLite reaches back into JavaScript from inside its pre-update hook, while
+  // it is still walking this connection's session list. Session objects are
+  // weak, so a garbage collection during such a callback could collect one and
+  // free memory SQLite is still using. Returns a strong reference to every
+  // attached session so that a callback can hold them for its duration.
+  std::vector<BaseObjectPtr<Session>> PinSessions() const;
+
   // SQLite forbids an authorizer callback from doing anything that modifies
   // the database connection that invoked it, which includes preparing and
   // stepping statements. See https://www.sqlite.org/c3ref/set_authorizer.html.
@@ -323,7 +330,10 @@ class DatabaseSync : public BaseObject {
   DatabaseOpenConfiguration open_config_;
   bool allow_load_extension_;
   bool enable_load_extension_;
-  sqlite3* connection_;
+  struct ConnectionDeleter {
+    void operator()(sqlite3* db) const { sqlite3_close_v2(db); }
+  };
+  std::unique_ptr<sqlite3, ConnectionDeleter> connection_;
   bool ignore_next_sqlite_error_;
   int callback_depth_ = 0;
   int authorizer_depth_ = 0;
@@ -452,7 +462,10 @@ class Session : public BaseObject {
 
  private:
   void Delete();
-  sqlite3_session* session_;
+  struct SessionDeleter {
+    void operator()(sqlite3_session* s) const { sqlite3session_delete(s); }
+  };
+  std::unique_ptr<sqlite3_session, SessionDeleter> session_;
   BaseObjectPtr<DatabaseSync> database_;  // The Parent Database
   bool is_generating_changeset_ = false;
 
@@ -499,9 +512,13 @@ class SQLTagStore : public BaseObject {
   friend class StatementExecutionHelper;
 };
 
+// Guards a window in which SQLite hands control back to JavaScript. Construct
+// it before allocating anything on the V8 heap, since the pinned sessions
+// below are what keep a garbage collection during that window safe.
 class CallbackDepthGuard {
  public:
-  explicit CallbackDepthGuard(DatabaseSync* db) : db_(db) {
+  explicit CallbackDepthGuard(DatabaseSync* db)
+      : db_(db), pinned_sessions_(db->PinSessions()) {
     db_->IncrementCallbackDepth();
   }
   ~CallbackDepthGuard() { db_->DecrementCallbackDepth(); }
@@ -510,6 +527,7 @@ class CallbackDepthGuard {
 
  private:
   DatabaseSync* db_;
+  std::vector<BaseObjectPtr<Session>> pinned_sessions_;
 };
 
 class TraceEventSuppressionGuard {
diff --git a/src/node_task_runner.cc b/src/node_task_runner.cc
index e7cc9ccf3f13..55f348afc69a 100644
--- a/src/node_task_runner.cc
+++ b/src/node_task_runner.cc
@@ -254,6 +254,27 @@ FindPackageJson(const std::filesystem::path& cwd) {
   return {{package_json_path, raw_content, path_env_var}};
 }
 
+// Prints every "name: command" pair in the scripts object to the given stream.
+static void PrintScripts(FILE* out,
+                         simdjson::ondemand::object& scripts_object) {
+  // Reset the object to iterate from the beginning, in case it was read before.
+  scripts_object.reset();
+  simdjson::ondemand::value value;
+  for (auto field : scripts_object) {
+    std::string_view key_str;
+    std::string_view value_str;
+    if (!field.unescaped_key().get(key_str) && !field.value().get(value) &&
+        !value.get_string().get(value_str)) {
+      fprintf(out,
+              "  %.*s: %.*s\n",
+              static_cast<int>(key_str.size()),
+              key_str.data(),
+              static_cast<int>(value_str.size()),
+              value_str.data());
+    }
+  }
+}
+
 void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
              std::string_view command_id,
              const std::vector<std::string_view>& positional_args) {
@@ -306,6 +327,16 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
     return;
   }
 
+  // With no command (e.g. bare `node --run`), list the available scripts but
+  // exit non-zero so a script invoking `node --run $CMD` with an unset
+  // variable still fails, as it did before bare `--run` was allowed.
+  if (command_id.empty()) {
+    fprintf(stderr, "Available scripts are:\n");
+    PrintScripts(stderr, scripts_object);
+    result->exit_code_ = ExitCode::kInvalidCommandLineArgument;
+    return;
+  }
+
   // If the command_id is not found in the scripts object, throw an error.
   std::string_view command;
   if (auto command_error =
@@ -323,23 +354,7 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
               command_id.data(),
               ConvertPathToUTF8(path).c_str());
       fprintf(stderr, "Available scripts are:\n");
-
-      // Reset the object to iterate over it again
-      scripts_object.reset();
-      simdjson::ondemand::value value;
-      for (auto field : scripts_object) {
-        std::string_view key_str;
-        std::string_view value_str;
-        if (!field.unescaped_key().get(key_str) && !field.value().get(value) &&
-            !value.get_string().get(value_str)) {
-          fprintf(stderr,
-                  "  %.*s: %.*s\n",
-                  static_cast<int>(key_str.size()),
-                  key_str.data(),
-                  static_cast<int>(value_str.size()),
-                  value_str.data());
-        }
-      }
+      PrintScripts(stderr, scripts_object);
     }
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
diff --git a/src/node_url_pattern.cc b/src/node_url_pattern.cc
index bc007db47dac..358a102749ca 100644
--- a/src/node_url_pattern.cc
+++ b/src/node_url_pattern.cc
@@ -307,32 +307,21 @@ MaybeLocal<Value> URLPattern::URLPatternInit::ToJsObject(
   auto tmpl = env->urlpatterninit_template();
   if (tmpl.IsEmpty()) {
     static constexpr std::string_view namesVec[] = {
-        "protocol",
-        "username",
-        "password",
+        "baseURL",
+        "hash",
         "hostname",
-        "port",
+        "password",
         "pathname",
+        "port",
+        "protocol",
         "search",
-        "hash",
-        "baseURL",
+        "username",
     };
     tmpl = DictionaryTemplate::New(isolate, namesVec);
     env->set_urlpatterninit_template(tmpl);
   }
 
-  MaybeLocal<Value> values[] = {
-      Undefined(isolate),  // protocol
-      Undefined(isolate),  // username
-      Undefined(isolate),  // password
-      Undefined(isolate),  // hostname
-      Undefined(isolate),  // port
-      Undefined(isolate),  // pathname
-      Undefined(isolate),  // search
-      Undefined(isolate),  // hash
-      Undefined(isolate),  // baseURL
-  };
-
+  MaybeLocal<Value> values[9];
   int idx = 0;
   Local<Value> temp;
   const auto trySet = [&](const std::optional<std::string>& val) {
@@ -346,28 +335,28 @@ MaybeLocal<Value> URLPattern::URLPatternInit::ToJsObject(
     return true;
   };
 
-  if (!trySet(init.protocol) || !trySet(init.username) ||
-      !trySet(init.password) || !trySet(init.hostname) || !trySet(init.port) ||
-      !trySet(init.pathname) || !trySet(init.search) || !trySet(init.hash) ||
-      !trySet(init.base_url)) {
+  if (!trySet(init.base_url) || !trySet(init.hash) || !trySet(init.hostname) ||
+      !trySet(init.password) || !trySet(init.pathname) || !trySet(init.port) ||
+      !trySet(init.protocol) || !trySet(init.search) ||
+      !trySet(init.username)) {
     return {};
   }
-  return NewDictionaryInstance(env->context(), tmpl, values);
+  return tmpl->NewInstance(context, values);
 }
 
 std::optional<ada::url_pattern_init> URLPattern::URLPatternInit::FromJsObject(
     Environment* env, Local<Object> obj) {
   ada::url_pattern_init init{};
   Local<String> components[] = {
-      env->protocol_string(),
-      env->username_string(),
-      env->password_string(),
+      env->base_url_string(),
+      env->hash_string(),
       env->hostname_string(),
-      env->port_string(),
+      env->password_string(),
       env->pathname_string(),
+      env->port_string(),
+      env->protocol_string(),
       env->search_string(),
-      env->hash_string(),
-      env->base_url_string(),
+      env->username_string(),
   };
   auto isolate = env->isolate();
   const auto set_parameter = [&](std::string_view key, std::string_view value) {
diff --git a/src/node_v8.cc b/src/node_v8.cc
index 14ee626c9f3e..14b74f4b6d42 100644
--- a/src/node_v8.cc
+++ b/src/node_v8.cc
@@ -213,6 +213,23 @@ void SetHeapSnapshotNearHeapLimit(const FunctionCallbackInfo<Value>& args) {
   env->set_heap_snapshot_near_heap_limit(limit);
 }
 
+void SetHeapProfileNearHeapLimit(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args[0]->IsUint32());
+  Environment* env = Environment::GetCurrent(args);
+  uint32_t limit = args[0].As<v8::Uint32>()->Value();
+  CHECK_GT(limit, 0);
+
+  std::string dir = env->options()->diagnostic_dir;
+  if (dir.empty()) {
+    dir = Environment::GetCwd(env->exec_path());
+  }
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, dir);
+
+  env->AddHeapProfileNearHeapLimitCallback();
+  env->set_heap_profile_near_heap_limit(limit);
+}
+
 void UpdateHeapStatisticsBuffer(const FunctionCallbackInfo<Value>& args) {
   BindingData* data = Realm::GetBindingData<BindingData>(args);
   HeapStatistics s;
@@ -309,6 +326,7 @@ void StopHeapProfile(const FunctionCallbackInfo<Value>& args) {
   std::ostringstream out_stream;
   bool success = node::SerializeHeapProfile(isolate, out_stream);
   if (success) {
+    isolate->GetHeapProfiler()->StopSamplingHeapProfiler();
     Local<Value> result;
     if (ToV8Value(env->context(), out_stream.str(), isolate).ToLocal(&result)) {
       args.GetReturnValue().Set(result);
@@ -728,6 +746,10 @@ void Initialize(Local<Object> target,
                         target,
                         "setHeapSnapshotNearHeapLimit",
                         SetHeapSnapshotNearHeapLimit);
+  SetMethod(context,
+            target,
+            "setHeapProfileNearHeapLimit",
+            SetHeapProfileNearHeapLimit);
   SetMethod(context,
             target,
             "updateHeapStatisticsBuffer",
@@ -839,6 +861,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(SetFlagsFromString);
   registry->Register(GetHashSeed);
   registry->Register(SetHeapSnapshotNearHeapLimit);
+  registry->Register(SetHeapProfileNearHeapLimit);
   registry->Register(GCProfiler::New);
   registry->Register(GCProfiler::Start);
   registry->Register(GCProfiler::Stop);
diff --git a/src/node_v8_platform-inl.h b/src/node_v8_platform-inl.h
index 9e05928e2a57..0538b5feeb59 100644
--- a/src/node_v8_platform-inl.h
+++ b/src/node_v8_platform-inl.h
@@ -26,9 +26,9 @@ struct V8Platform {
       StartTracingAgent();
     }
     // Tracing must be initialized before platform threads are created.
-    platform_ = new NodePlatform(thread_pool_size,
-                                 tracing_agent_->GetTracingController());
-    v8::V8::InitializePlatform(platform_);
+    platform_ = std::make_unique<NodePlatform>(
+        thread_pool_size, tracing_agent_->GetTracingController());
+    v8::V8::InitializePlatform(platform_.get());
   }
   // Make sure V8Platform don not call into Libuv threadpool,
   // see DefaultProcessExitHandlerInternal in environment.cc
@@ -38,8 +38,7 @@ struct V8Platform {
     initialized_ = false;
     StopTracingAgent();
     platform_->Shutdown();
-    delete platform_;
-    platform_ = nullptr;
+    platform_.reset();
     // Destroy tracing after the platform (and platform threads) have been
     // stopped.
     tracing_agent_.reset(nullptr);
@@ -60,10 +59,12 @@ struct V8Platform {
     tracing_agent_->StopTracing();
   }
 
-  inline NodePlatform* Platform() { return platform_; }
+  inline NodePlatform* Platform() {
+    return platform_.get();
+  }
 
   std::unique_ptr<tracing::Agent, tracing::Agent::Deleter> tracing_agent_;
-  NodePlatform* platform_;
+  std::unique_ptr<NodePlatform> platform_;
 #else   // !NODE_USE_V8_PLATFORM
   inline void Initialize(int thread_pool_size) {}
   inline void Dispose() {}
diff --git a/src/node_version.h b/src/node_version.h
index affcaa33c7b2..5c05f45715ed 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -23,13 +23,13 @@
 #define SRC_NODE_VERSION_H_
 
 #define NODE_MAJOR_VERSION 26
-#define NODE_MINOR_VERSION 8
-#define NODE_PATCH_VERSION 2
+#define NODE_MINOR_VERSION 9
+#define NODE_PATCH_VERSION 0
 
 #define NODE_VERSION_IS_LTS 0
 #define NODE_VERSION_LTS_CODENAME ""
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)
diff --git a/src/node_worker.cc b/src/node_worker.cc
index edc21e7e5561..1a12946593ab 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -16,6 +16,7 @@
 #include "v8-profiler.h"
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <vector>
 
@@ -190,8 +191,6 @@ class WorkerThreadData {
       return;
     }
 
-    SetIsolateUpForNode(isolate);
-
     // Be sure it's called before Environment::InitializeDiagnostics()
     // so that this callback stays when the callback of
     // --heapsnapshot-near-heap-limit gets is popped.
@@ -280,6 +279,7 @@ size_t Worker::NearHeapLimit(void* data, size_t current_heap_limit,
   Environment* env = worker->env();
   if (env != nullptr) {
     DCHECK(!env->is_in_heapsnapshot_heap_limit_callback());
+    DCHECK(!env->is_in_heap_profile_near_heap_limit_callback());
     Debug(env,
           DebugCategory::DIAGNOSTICS,
           "Throwing ERR_WORKER_OUT_OF_MEMORY, "
@@ -293,6 +293,18 @@ size_t Worker::NearHeapLimit(void* data, size_t current_heap_limit,
   return new_limit;
 }
 
+// Can this worker start by deserializing the bootstrapped principal context
+// from the embedded snapshot (plus the worker-side switches) instead of
+// bootstrapping from scratch? Only that snapshot qualifies: an embedder's own
+// or a --snapshot-blob one has run application code in its main context.
+// --no-worker-snapshot opts out; kNoBrowserGlobals changes the bootstrap.
+bool Worker::UseWorkerContextSnapshot() const {
+  return snapshot_data_ != nullptr &&
+         snapshot_data_ == SnapshotBuilder::GetEmbeddedSnapshotData() &&
+         !(environment_flags_ & EnvironmentFlags::kNoBrowserGlobals) &&
+         per_process::cli_options->per_isolate->worker_snapshot;
+}
+
 void Worker::Run() {
   std::string trace_name = "[worker " + std::to_string(thread_id_.id) + "]" +
                            (name_ == "" ? "" : " " + name_);
@@ -341,7 +353,15 @@ void Worker::Run() {
         // resource constraints, we need something in place to handle it,
         // though.
         TryCatch try_catch(isolate_);
-        if (snapshot_data_ != nullptr) {
+        if (UseWorkerContextSnapshot()) {
+          // Leave `context` empty: CreateEnvironment() deserializes the
+          // bootstrapped principal context (kNodeMainContextIndex) and the
+          // Environment state that goes with it, applies the worker-side
+          // switches, and skips RunBootstrapping().
+          Debug(this,
+                "Worker %llu deserializes the bootstrapped context\n",
+                thread_id_.id);
+        } else if (snapshot_data_ != nullptr) {
           Debug(this,
                 "Worker %llu uses context from snapshot %d\n",
                 thread_id_.id,
@@ -358,7 +378,7 @@ void Worker::Run() {
               this, "Worker %llu builds context from scratch\n", thread_id_.id);
           context = NewContext(isolate_);
         }
-        if (context.IsEmpty()) {
+        if (context.IsEmpty() && !UseWorkerContextSnapshot()) {
           // TODO(joyeecheung): maybe this should be kBootstrapFailure instead?
           Exit(ExitCode::kGenericUserError,
                "ERR_WORKER_INIT_FAILED",
@@ -368,8 +388,8 @@ void Worker::Run() {
       }
 
       if (is_stopped()) return;
-      CHECK(!context.IsEmpty());
-      Context::Scope context_scope(context);
+      std::optional<Context::Scope> context_scope;
+      if (!context.IsEmpty()) context_scope.emplace(context);
       {
 #if HAVE_INSPECTOR
         environment_flags_ |= EnvironmentFlags::kNoWaitForInspectorFrontend;
@@ -385,6 +405,7 @@ void Worker::Run() {
             name_));
         if (is_stopped()) return;
         CHECK_NOT_NULL(env_);
+        if (!context_scope) context_scope.emplace(env_->context());
         env_->set_env_vars(std::move(env_vars_));
         SetProcessExitHandler(env_.get(), [this](Environment*, int exit_code) {
           Exit(static_cast<ExitCode>(exit_code));
@@ -1109,6 +1130,9 @@ void Worker::StopHeapProfile(const FunctionCallbackInfo<Value>& args) {
     std::ostringstream out_stream;
     bool success =
         node::SerializeHeapProfile(worker_env->isolate(), out_stream);
+    if (success) {
+      worker_env->isolate()->GetHeapProfiler()->StopSamplingHeapProfiler();
+    }
     env->SetImmediateThreadsafe(
         [taker = std::move(taker),
          out_stream = std::move(out_stream),
@@ -1414,8 +1438,70 @@ void GetEnvMessagePort(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// Per-thread values of the `worker` binding are lazy properties of the
+// per-isolate template, so that a bootstrapped context carries none of them
+// and can be deserialized by any thread.
+void ThreadIdGetter(Local<v8::Name>,
+                    const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  info.GetReturnValue().Set(static_cast<double>(env->thread_id()));
+}
+
+void ThreadNameGetter(Local<v8::Name>,
+                      const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  Local<String> name;
+  if (String::NewFromUtf8(info.GetIsolate(),
+                          env->thread_name().data(),
+                          NewStringType::kNormal,
+                          env->thread_name().size())
+          .ToLocal(&name)) {
+    info.GetReturnValue().Set(name);
+  }
+}
+
+void IsMainThreadGetter(Local<v8::Name>,
+                        const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(Environment::GetCurrent(info)->is_main_thread());
+}
+
+void IsInternalThreadGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  Worker* worker =
+      Environment::GetCurrent(info)->isolate_data()->worker_context();
+  info.GetReturnValue().Set(worker != nullptr && worker->is_internal());
+}
+
+void OwnsProcessStateGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(
+      Environment::GetCurrent(info)->owns_process_state());
+}
+
+void ResourceLimitsGetter(Local<v8::Name>,
+                          const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  if (env->worker_context() != nullptr) {
+    info.GetReturnValue().Set(
+        env->worker_context()->GetResourceLimits(info.GetIsolate()));
+  }
+}
+
 void CreateWorkerPerIsolateProperties(IsolateData* isolate_data,
                                       Local<ObjectTemplate> target) {
+  {
+    Isolate* isolate = isolate_data->isolate();
+    auto lazy = [&](const char* name, v8::AccessorNameGetterCallback getter) {
+      target->SetLazyDataProperty(OneByteString(isolate, name), getter);
+    };
+    lazy("threadId", ThreadIdGetter);
+    lazy("threadName", ThreadNameGetter);
+    lazy("isMainThread", IsMainThreadGetter);
+    lazy("isInternalThread", IsInternalThreadGetter);
+    lazy("ownsProcessState", OwnsProcessStateGetter);
+    lazy("resourceLimits", ResourceLimitsGetter);
+  }
+
   Isolate* isolate = isolate_data->isolate();
 
   {
@@ -1520,55 +1606,9 @@ void CreateWorkerPerContextProperties(Local<Object> target,
                                       Local<Value> unused,
                                       Local<Context> context,
                                       void* priv) {
-  Environment* env = Environment::GetCurrent(context);
-  Isolate* isolate = env->isolate();
-
-  target
-      ->Set(env->context(),
-            env->thread_id_string(),
-            Number::New(isolate, static_cast<double>(env->thread_id())))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            env->thread_name_string(),
-            String::NewFromUtf8(isolate,
-                                env->thread_name().data(),
-                                NewStringType::kNormal,
-                                env->thread_name().size())
-                .ToLocalChecked())
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isMainThread"),
-            Boolean::New(isolate, env->is_main_thread()))
-      .Check();
-
-  Worker* worker = env->isolate_data()->worker_context();
-  bool is_internal = worker != nullptr && worker->is_internal();
-
-  // Set the is_internal property
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isInternalThread"),
-            Boolean::New(isolate, is_internal))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "ownsProcessState"),
-            Boolean::New(isolate, env->owns_process_state()))
-      .Check();
-
-  if (!env->is_main_thread()) {
-    target
-        ->Set(env->context(),
-              FIXED_ONE_BYTE_STRING(isolate, "resourceLimits"),
-              env->worker_context()->GetResourceLimits(isolate))
-        .Check();
-  }
-
+  // threadId, threadName, isMainThread, isInternalThread, ownsProcessState
+  // and resourceLimits are lazy properties of the per-isolate template (see
+  // CreateWorkerPerIsolateProperties).
   NODE_DEFINE_CONSTANT(target, kMaxYoungGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kMaxOldGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kCodeRangeSizeMb);
@@ -1578,6 +1618,12 @@ void CreateWorkerPerContextProperties(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetEnvMessagePort);
+  registry->Register(ThreadIdGetter);
+  registry->Register(ThreadNameGetter);
+  registry->Register(IsMainThreadGetter);
+  registry->Register(IsInternalThreadGetter);
+  registry->Register(OwnsProcessStateGetter);
+  registry->Register(ResourceLimitsGetter);
   registry->Register(Worker::New);
   registry->Register(Worker::StartThread);
   registry->Register(Worker::StopThread);
diff --git a/src/node_worker.h b/src/node_worker.h
index fd02b1d381ed..894256053dc0 100644
--- a/src/node_worker.h
+++ b/src/node_worker.h
@@ -42,6 +42,7 @@ class Worker : public AsyncWrap {
 
   // Run the worker. This is only called from the worker thread.
   void Run();
+  bool UseWorkerContextSnapshot() const;
 
   // Forcibly exit the thread with a specified exit code. This may be called
   // from any thread. `error_code` and `error_message` can be used to create
diff --git a/src/permission/fs_permission.cc b/src/permission/fs_permission.cc
index b2f3cbb31a6e..dbd28259f54f 100644
--- a/src/permission/fs_permission.cc
+++ b/src/permission/fs_permission.cc
@@ -30,20 +30,6 @@ std::string WildcardIfDir(const std::string& res) noexcept {
   return res;
 }
 
-void FreeRecursivelyNode(
-    node::permission::FSPermission::RadixTree::Node* node) {
-  if (node == nullptr) {
-    return;
-  }
-
-  for (auto& [label, child] : node->children) {
-    FreeRecursivelyNode(child);
-  }
-
-  delete node->wildcard_child;
-  delete node;
-}
-
 bool is_tree_granted(
     node::Environment* env,
     const node::permission::FSPermission::RadixTree* granted_tree,
@@ -118,7 +104,7 @@ void PrintTree(const node::permission::FSPermission::RadixTree::Node* node,
     for (const auto& [label, child] : node->children) {
       count++;
       bool child_is_last = (count == total);
-      PrintTree(child, depth + 1, next_branch_prefix, child_is_last);
+      PrintTree(child.get(), depth + 1, next_branch_prefix, child_is_last);
     }
   }
 }
@@ -266,25 +252,19 @@ bool FSPermission::is_granted(Environment* env,
   }
 }
 
-FSPermission::RadixTree::RadixTree() : root_node_(new Node("")) {}
+FSPermission::RadixTree::RadixTree() : root_node_(std::make_unique<Node>("")) {}
 
-FSPermission::RadixTree::~RadixTree() {
-  FreeRecursivelyNode(root_node_);
-}
+FSPermission::RadixTree::~RadixTree() = default;
 
 void FSPermission::RadixTree::Clear() {
-  for (auto& [label, child] : root_node_->children) {
-    FreeRecursivelyNode(child);
-  }
   root_node_->children.clear();
-  delete root_node_->wildcard_child;
-  root_node_->wildcard_child = nullptr;
+  root_node_->wildcard_child.reset();
   root_node_->is_leaf = false;
 }
 
 bool FSPermission::RadixTree::Lookup(std::string_view s,
                                      bool when_empty_return) const {
-  FSPermission::RadixTree::Node* current_node = root_node_;
+  FSPermission::RadixTree::Node* current_node = root_node_.get();
   if (current_node->children.empty()) {
     return when_empty_return;
   }
@@ -311,7 +291,7 @@ bool FSPermission::RadixTree::Lookup(std::string_view s,
 }
 
 void FSPermission::RadixTree::Insert(const std::string& path) {
-  FSPermission::RadixTree::Node* current_node = root_node_;
+  FSPermission::RadixTree::Node* current_node = root_node_.get();
 
   size_t parent_node_prefix_len = current_node->prefix.length();
   size_t path_len = path.length();
@@ -334,7 +314,7 @@ void FSPermission::RadixTree::Insert(const std::string& path) {
   if (per_process::enabled_debug_list.enabled(DebugCategory::PERMISSION_MODEL))
       [[unlikely]] {
     per_process::Debug(DebugCategory::PERMISSION_MODEL, "Inserting %s\n", path);
-    PrintTree(root_node_);
+    PrintTree(root_node_.get());
   }
 }
 
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index f2e1720ed9bd..ab05623e1db8 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -3,6 +3,7 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
+#include <memory>
 #include <vector>
 #include "permission/permission_base.h"
 #include "util.h"
@@ -24,8 +25,8 @@ class FSPermission final : public PermissionBase {
   struct RadixTree {
     struct Node {
       std::string prefix;
-      std::vector<std::pair<char, Node*>> children;
-      Node* wildcard_child = nullptr;
+      std::vector<std::pair<char, std::unique_ptr<Node>>> children;
+      std::unique_ptr<Node> wildcard_child;
       bool is_leaf = false;
 
       explicit Node(std::string_view pre) : prefix(pre) {}
@@ -34,19 +35,19 @@ class FSPermission final : public PermissionBase {
 
       Node* FindChild(char label) const {
         for (const auto& [c, node] : children) {
-          if (c == label) return node;
+          if (c == label) return node.get();
         }
         return nullptr;
       }
 
-      void SetChild(char label, Node* node) {
+      void SetChild(char label, std::unique_ptr<Node> node) {
         for (auto& [c, n] : children) {
           if (c == label) {
-            n = node;
+            n = std::move(node);
             return;
           }
         }
-        children.emplace_back(label, node);
+        children.emplace_back(label, std::move(node));
       }
 
       Node* CreateChild(std::string_view path_prefix) {
@@ -60,8 +61,9 @@ class FSPermission final : public PermissionBase {
 
         Node* child = FindChild(label);
         if (child == nullptr) {
-          child = new Node(path_prefix);
-          children.emplace_back(label, child);
+          auto new_child = std::make_unique<Node>(path_prefix);
+          child = new_child.get();
+          children.emplace_back(label, std::move(new_child));
           return child;
         }
         bool child_was_end_node = child->IsEndNode();
@@ -75,11 +77,20 @@ class FSPermission final : public PermissionBase {
             std::string child_prefix(child->prefix.substr(i));
 
             child->prefix = child_prefix;
-            Node* split_child = new Node(parent_prefix);
-            split_child->children.emplace_back(child_prefix[0], child);
-            SetChild(parent_prefix[0], split_child);
+            auto split_child = std::make_unique<Node>(parent_prefix);
+            Node* split_raw = split_child.get();
+            std::unique_ptr<Node> detached;
+            for (auto& [c, n] : children) {
+              if (c == label) {
+                detached = std::move(n);
+                break;
+              }
+            }
+            split_child->children.emplace_back(child_prefix[0],
+                                               std::move(detached));
+            SetChild(parent_prefix[0], std::move(split_child));
 
-            return split_child->CreateChild(path_prefix.substr(i));
+            return split_raw->CreateChild(path_prefix.substr(i));
           }
         }
         if (child_was_end_node) {
@@ -90,10 +101,10 @@ class FSPermission final : public PermissionBase {
 
       Node* CreateWildcardChild() {
         if (wildcard_child != nullptr) {
-          return wildcard_child;
+          return wildcard_child.get();
         }
-        wildcard_child = new Node();
-        return wildcard_child;
+        wildcard_child = std::make_unique<Node>();
+        return wildcard_child.get();
       }
 
       Node* NextNode(std::string_view path, size_t idx) const {
@@ -165,7 +176,7 @@ class FSPermission final : public PermissionBase {
     bool Lookup(std::string_view s, bool when_empty_return) const;
 
    private:
-    Node* root_node_;
+    std::unique_ptr<Node> root_node_;
   };
 
  private:
@@ -179,11 +190,11 @@ class FSPermission final : public PermissionBase {
   std::vector<std::string> granted_paths_in_;
   std::vector<std::string> granted_paths_out_;
 
-  bool deny_all_in_ = true;
-  bool deny_all_out_ = true;
+  bool deny_all_in_ : 1 = true;
+  bool deny_all_out_ : 1 = true;
 
-  bool allow_all_in_ = false;
-  bool allow_all_out_ = false;
+  bool allow_all_in_ : 1 = false;
+  bool allow_all_out_ : 1 = false;
 };
 
 }  // namespace node::permission
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 29449c0ec028..da86d6bbb923 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -90,9 +90,12 @@ static void Drop(const FunctionCallbackInfo<Value>& args) {
   }
 
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
-    Utf8Value utf8_arg(env->isolate(), args[1]);
-    if (utf8_arg.length() > 0) {
-      env->permission()->Drop(env, scope, utf8_arg.ToStringView());
+    // BufferValue copies raw bytes out of a Buffer/TypedArray as-is instead
+    // of forcing a (potentially lossy) UTF-8 string conversion, since paths
+    // are not guaranteed to be valid UTF-8.
+    BufferValue resource(env->isolate(), args[1]);
+    if (resource.length() > 0) {
+      env->permission()->Drop(env, scope, resource.ToStringView());
       return;
     }
   }
@@ -113,13 +116,16 @@ static void Has(const FunctionCallbackInfo<Value>& args) {
   }
 
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
-    Utf8Value utf8_arg(env->isolate(), args[1]);
-    if (utf8_arg.length() == 0) {
+    // BufferValue copies raw bytes out of a Buffer/TypedArray as-is instead
+    // of forcing a (potentially lossy) UTF-8 string conversion, since paths
+    // are not guaranteed to be valid UTF-8.
+    BufferValue resource(env->isolate(), args[1]);
+    if (resource.length() == 0) {
       args.GetReturnValue().Set(false);
       return;
     }
     return args.GetReturnValue().Set(
-        env->permission()->is_granted(env, scope, utf8_arg.ToStringView()));
+        env->permission()->is_granted(env, scope, resource.ToStringView()));
   }
 
   return args.GetReturnValue().Set(env->permission()->is_granted(env, scope));
@@ -174,16 +180,22 @@ static bool FastHasResource(
     return false;
   }
 
-  Local<String> res_str;
-  if (!resource_arg->ToString(context).ToLocal(&res_str)) {
-    return false;
+  // The JS wrapper always calls this with 2 arguments, passing undefined
+  // when no resource was given, so this path (unlike Has()) has to check
+  // for that explicitly and fall back to the scope-only check.
+  if (resource_arg->IsUndefined()) {
+    return env->permission()->is_granted(env, scope);
   }
-  Utf8Value utf8_res(isolate, res_str);
-  if (utf8_res.length() == 0) {
+
+  // BufferValue is constructed directly from resource_arg (not from a
+  // pre-converted String) so that a Buffer/TypedArray's raw bytes are
+  // copied as-is instead of going through a lossy UTF-8 string conversion.
+  BufferValue resource(isolate, resource_arg);
+  if (resource.length() == 0) {
     return false;
   }
 
-  return env->permission()->is_granted(env, scope, utf8_res.ToStringView());
+  return env->permission()->is_granted(env, scope, resource.ToStringView());
 }
 
 static CFunction fast_has_methods_[] = {CFunction::Make(FastHas),
diff --git a/src/quic/README.md b/src/quic/README.md
index 3d90cacdbb6c..8c23ed2f4af9 100644
--- a/src/quic/README.md
+++ b/src/quic/README.md
@@ -146,9 +146,9 @@ ALPN-specific behavior to. Two implementations exist:
   server push, and stream prioritization. Manages unidirectional control
   streams internally.
 
-The Application is selected during ALPN negotiation — immediately for
-clients (ALPN known upfront), during the `OnSelectAlpn` TLS callback for
-servers.
+The Application is selected as soon as the ALPN protocol is known:
+immediately for clients, and for servers from the `OnClientHello` TLS
+callback (see [Server handshake ordering](#server-handshake-ordering)).
 
 ### Thread-Local Allocator
 
@@ -183,8 +183,44 @@ succeed but memory tracking is silently skipped.
 
 **Server**: `Endpoint::Receive()` processes an Initial packet through
 address validation (retry tokens, LRU cache), then calls `Session::Create()`
-→ `ngtcp2_conn_server_new()`. The Application is selected later, during ALPN
-negotiation in the TLS handshake.
+→ `ngtcp2_conn_server_new()`. The Application is selected later, once the
+ClientHello names an ALPN protocol.
+
+### Server handshake ordering
+
+A server has to make several decisions from the ClientHello, and the order
+matters: the ALPN protocol depends on which identity SNI selected, the
+Application depends on the ALPN protocol, and JavaScript needs a
+`QuicSession` object before any 0-RTT request arrives on it. TLS is
+therefore stopped at the ClientHello, before the point where a session
+ticket could be accepted and early data could start flowing:
+
+```text
+ngtcp2_conn_read_pkt()
+ → SSL_do_handshake()
+    → TLSContext::OnClientHello()        // SSL_CTX_set_client_hello_cb
+       ├── SelectSNIContext() + SSL_set_SSL_CTX()
+       ├── crypto::SelectNextProtocol()  // against that identity's list
+       ├── Session::InstallApplicationForAlpn()
+       └── return SSL_CLIENT_HELLO_RETRY  // handshake suspended here
+    ← SSL_ERROR_WANT_CLIENT_HELLO_CB     // ngtcp2 treats this as "not done"
+ ← 0
+Session::AfterNgtcp2Read()
+ → Endpoint::EmitNewSession()            // JS sees the session, TLS paused
+ → Session::ResumeHandshake()
+    → ngtcp2_conn_continue_handshake()
+       → OnClientHello() again           // returns success immediately
+       → session ticket, 0-RTT keys, early data, ...
+```
+
+The later servername and ALPN callbacks do not repeat any of this; they
+only hand the cached result back to OpenSSL, which is what OpenSSL needs
+in order to emit the corresponding extensions.
+
+Because nothing application-level can happen before the resume, no event
+deferral is needed. The one exception is qlog: ngtcp2 writes it from the
+first inbound packet, so those chunks are buffered on the Session and
+flushed immediately after the new-session callback returns.
 
 ### The Receive Path
 
@@ -363,10 +399,10 @@ The `Http3ApplicationImpl` wraps `nghttp3_conn` and handles:
   CONNECT protocol, datagrams) are negotiated and enforced. Datagram
   support follows RFC 9297 — when the peer's SETTINGS disable datagrams,
   `sendDatagram()` is blocked.
-* **0-RTT**: Early data settings are validated during ticket extraction
-  (`ValidateTicketData` in `ExtractSessionTicketAppData`). If the server's
-  settings changed incompatibly, the ticket is rejected before TLS accepts
-  it.
+* **0-RTT**: Early data settings are validated in
+  `ExtractSessionTicketAppData`. If the server's settings changed
+  incompatibly, the ticket is rejected before TLS accepts it and the
+  connection falls back to a full 1-RTT handshake.
 
 ## Error Handling
 
diff --git a/src/quic/application.cc b/src/quic/application.cc
index d3c5e2611f5f..f83b64bad49e 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -195,47 +195,18 @@ void Session::Application::CollectSessionTicketAppData(
 SessionTicket::AppData::Status
 Session::Application::ExtractSessionTicketAppData(
     const SessionTicket::AppData& app_data, Flag flag) {
-  // By default we do not have any application data to retrieve.
+  // CollectSessionTicketAppData writes just the type byte, so all this can
+  // check is that the ticket came from the same application type.
+  auto data = app_data.Get();
+  if (!data || data->len != 1 ||
+      static_cast<uint8_t>(data->base[0]) != static_cast<uint8_t>(type())) {
+    return SessionTicket::AppData::Status::TICKET_IGNORE_RENEW;
+  }
   return flag == Flag::STATUS_RENEW
              ? SessionTicket::AppData::Status::TICKET_USE_RENEW
              : SessionTicket::AppData::Status::TICKET_USE;
 }
 
-std::optional<PendingTicketAppData> Session::Application::ParseTicketData(
-    const uv_buf_t& data) {
-  if (data.len == 0 || data.base == nullptr) return std::nullopt;
-  auto app_type =
-      static_cast<Type>(reinterpret_cast<const uint8_t*>(data.base)[0]);
-  switch (app_type) {
-    case Type::DEFAULT:
-      return DefaultTicketData{};
-    case Type::HTTP3:
-      return ParseHttp3TicketData(data);
-    default:
-      return std::nullopt;
-  }
-}
-
-bool Session::Application::ValidateTicketData(
-    const PendingTicketAppData& data, const Application_Options& options) {
-  if (std::holds_alternative<Http3TicketData>(data)) {
-    // TODO(@jasnell): This validation probably belongs in http3.cc but keeping
-    // it here for now.
-    const auto& ticket = std::get<Http3TicketData>(data);
-    return options.max_field_section_size >= ticket.max_field_section_size &&
-           options.qpack_max_dtable_capacity >=
-               ticket.qpack_max_dtable_capacity &&
-           options.qpack_encoder_max_dtable_capacity >=
-               ticket.qpack_encoder_max_dtable_capacity &&
-           options.qpack_blocked_streams >= ticket.qpack_blocked_streams &&
-           (!ticket.enable_connect_protocol ||
-            options.enable_connect_protocol) &&
-           (!ticket.enable_datagrams || options.enable_datagrams);
-  }
-  // DefaultTicketData always validates.
-  return true;
-}
-
 void Session::Application::ReceiveStreamClose(Stream* stream,
                                               QuicError&& error) {
   DCHECK_NOT_NULL(stream);
@@ -254,6 +225,12 @@ void Session::Application::ReceiveStreamReset(Stream* stream,
   stream->ReceiveStreamReset(final_size, std::move(error));
 }
 
+void Session::Application::ReturnConnectionCredit(size_t datalen) {
+  if (datalen == 0 || session().is_destroyed()) return;
+  Session::SendPendingDataScope send_scope(&session());
+  session().ExtendOffset(datalen);
+}
+
 // ============================================================================
 // The DefaultApplication is the default implementation of Session::Application
 // that is used for all unrecognized ALPN identifiers.
@@ -297,10 +274,6 @@ class DefaultApplication final : public Session::Application {
     }
   }
 
-  bool ApplySessionTicketData(const PendingTicketAppData& data) override {
-    return std::holds_alternative<DefaultTicketData>(data);
-  }
-
   bool ReceiveStreamOpen(stream_id id) override {
     auto stream = session().CreateStream(id);
     if (!stream || session().is_destroyed()) [[unlikely]] {
@@ -316,6 +289,22 @@ class DefaultApplication final : public Session::Application {
                          void* stream_user_data) override {
     BaseObjectPtr<Stream> stream;
     if (stream_user_data == nullptr) {
+      // A locally-initiated stream only exists because we created it, so a
+      // missing Stream means we already destroyed it. Data the peer had put in
+      // flight must not resurrect it as a bogus "incoming" stream. Discard it
+      // and return its credit instead. The is_destroyed() check must come
+      // first: an earlier callback in this same ngtcp2 batch may have
+      // destroyed the session, after which none of this may be touched.
+      if (!session().is_destroyed() &&
+          ngtcp2_conn_is_local_stream(session(), id)) {
+        Debug(&session(),
+              "Discarding %zu bytes for destroyed local stream %" PRIi64,
+              datalen,
+              id);
+        ReturnConnectionCredit(datalen);
+        return true;
+      }
+
       // This is the first time we're seeing this stream. Implicitly create it.
       stream = session().CreateStream(id);
       if (!stream || session().is_destroyed()) [[unlikely]] {
@@ -324,9 +313,11 @@ class DefaultApplication final : public Session::Application {
         return false;
       }
 
-      // The stream was created, but was immediately destroyed because there's
-      // no onstream handler.
+      // The stream was created but immediately destroyed, either because there
+      // is no onstream handler or because the handler destroyed it. Nothing
+      // will consume the data, so discard it and return its credit.
       if (stream->is_destroyed()) [[unlikely]] {
+        ReturnConnectionCredit(datalen);
         return true;
       }
     } else {
diff --git a/src/quic/application.h b/src/quic/application.h
index ace6035a0ab7..df472e0a9fd7 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -2,9 +2,6 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include <optional>
-#include <variant>
-
 #include "base_object.h"
 #include "bindingdata.h"
 #include "defs.h"
@@ -14,21 +11,6 @@
 
 namespace node::quic {
 
-// Parsed session ticket application data, produced by
-// Application::ParseTicketData() before ALPN negotiation and consumed
-// by Application::ApplySessionTicketData() after.
-struct DefaultTicketData {};
-struct Http3TicketData {
-  uint64_t max_field_section_size;
-  uint64_t qpack_max_dtable_capacity;
-  uint64_t qpack_encoder_max_dtable_capacity;
-  uint64_t qpack_blocked_streams;
-  bool enable_connect_protocol;
-  bool enable_datagrams;
-};
-using PendingTicketAppData =
-    std::variant<std::monostate, DefaultTicketData, Http3TicketData>;
-
 // An Application implements the ALPN-protocol specific semantics on behalf
 // of a QUIC Session.
 class Session::Application : public MemoryRetainer {
@@ -98,9 +80,11 @@ class Session::Application : public MemoryRetainer {
   virtual bool ReceiveStreamOpen(stream_id id) = 0;
 
   // Session will forward all received stream data immediately on to the
-  // Application. The only additional processing the Session does is to
-  // automatically adjust the session-level flow control window. It is up to
-  // the Application to do the same for the Stream-level flow control.
+  // Application without any additional processing. Every byte delivered here
+  // is charged against both the session-level and the stream-level receive
+  // window, and it is up to the Application to return that credit (see
+  // ReturnConnectionCredit and Stream::ReturnFlowControlCredit) once the
+  // bytes have been consumed or discarded.
   virtual bool ReceiveStreamData(stream_id id,
                                  const uint8_t* data,
                                  size_t datalen,
@@ -164,32 +148,15 @@ class Session::Application : public MemoryRetainer {
   virtual void CollectSessionTicketAppData(
       SessionTicket::AppData* app_data) const;
 
-  // Different Applications may set some application data in the session
-  // ticket (e.g. http/3 would set server settings in the application data).
-  // By default, there's nothing to get.
+  // Validates the application data embedded in a session ticket offered by
+  // a resuming client, and decides whether the ticket may be used. The
+  // Application is always installed by the time a ticket can be decrypted,
+  // so each Application checks its own data here. By default, there's
+  // nothing to get.
   virtual SessionTicket::AppData::Status ExtractSessionTicketAppData(
       const SessionTicket::AppData& app_data,
       SessionTicket::AppData::Source::Flag flag);
 
-  // Validates parsed ticket data against current application options.
-  // Returns false if the stored settings are more permissive than the
-  // current config (e.g., a feature was enabled when the ticket was
-  // issued but is now disabled).
-  static bool ValidateTicketData(const PendingTicketAppData& data,
-                                 const Application_Options& options);
-
-  // Parse session ticket app data before ALPN negotiation. Reads the
-  // type byte and dispatches to the appropriate application-specific
-  // parser. Returns std::nullopt if parsing fails.
-  static std::optional<PendingTicketAppData> ParseTicketData(
-      const uv_buf_t& data);
-
-  // Called after ALPN negotiation to validate and apply previously
-  // parsed session ticket app data. Returns false if the data is
-  // incompatible (e.g., type mismatch or settings downgrade), which
-  // causes the handshake to fail.
-  virtual bool ApplySessionTicketData(const PendingTicketAppData& data) = 0;
-
   // Notifies the Application that the identified stream has been closed.
   virtual void ReceiveStreamClose(Stream* stream,
                                   QuicError&& error = QuicError());
@@ -266,6 +233,12 @@ class Session::Application : public MemoryRetainer {
     return *session_;
   }
 
+  // Returns the connection-level flow control credit for `datalen` bytes that
+  // were delivered to the Application but discarded without ever reaching a
+  // Stream. Dropping them silently would permanently shrink the session's
+  // shared receive window.
+  void ReturnConnectionCredit(size_t datalen);
+
  private:
   Session* session_ = nullptr;
 };
diff --git a/src/quic/endpoint.cc b/src/quic/endpoint.cc
index d83b70ba949f..a6a4109509ae 100644
--- a/src/quic/endpoint.cc
+++ b/src/quic/endpoint.cc
@@ -1999,10 +1999,10 @@ void Endpoint::EmitNewSession(const BaseObjectPtr<Session>& session) {
   // exists but it is in a destroyed state. Care should be taken accessing
   // session after this point.
 
-  // Deliver any stream events that were held until the stream was setup,
-  // e.g. 0-RTT streams from the first flight.
+  // Deliver any qlog written while processing the packets that carried the
+  // ClientHello, which is the only output that can predate this callback.
   if (!session->is_destroyed()) {
-    session->ReplayDeferredEmits();
+    session->FlushPendingQlog();
   }
 }
 
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index ff54bba0354f..6e1d0c44a048 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -486,21 +486,6 @@ class Http3ApplicationImpl final : public Session::Application {
                : SessionTicket::AppData::Status::TICKET_USE;
   }
 
-  bool ApplySessionTicketData(const PendingTicketAppData& data) override {
-    if (!std::holds_alternative<Http3TicketData>(data)) return false;
-    const auto& ticket = std::get<Http3TicketData>(data);
-    // Validate that current settings are >= stored settings.
-    return options_.max_field_section_size >= ticket.max_field_section_size &&
-           options_.qpack_max_dtable_capacity >=
-               ticket.qpack_max_dtable_capacity &&
-           options_.qpack_encoder_max_dtable_capacity >=
-               ticket.qpack_encoder_max_dtable_capacity &&
-           options_.qpack_blocked_streams >= ticket.qpack_blocked_streams &&
-           (!ticket.enable_connect_protocol ||
-            options_.enable_connect_protocol) &&
-           (!ticket.enable_datagrams || options_.enable_datagrams);
-  }
-
   void ReceiveStreamClose(Stream* stream,
                           QuicError&& error = QuicError()) override {
     Debug(
@@ -877,6 +862,10 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application received end of headers for stream %" PRIi64,
           id);
     stream->EmitHeaders();
+    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    // stream. Its arena-backed state is released by Destroy(), so do not touch
+    // the stream again if that happened.
+    if (stream->is_destroyed()) return;
     if (fin) {
       // The stream is done. There's no more data to receive!
       Debug(&session(), "Headers are final for stream %" PRIi64, id);
@@ -919,6 +908,10 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application received end of trailers for stream %" PRIi64,
           id);
     stream->EmitHeaders();
+    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    // stream. Its arena-backed state is released by Destroy(), so do not touch
+    // the stream again if that happened.
+    if (stream->is_destroyed()) return;
     if (fin) {
       Debug(&session(), "Trailers are final for stream %" PRIi64, id);
       Stream::ReceiveDataFlags flags{
@@ -1083,6 +1076,13 @@ class Http3ApplicationImpl final : public Session::Application {
     if (auto stream = session->FindStream(id)) {
       return stream;
     }
+    // No record of a locally-initiated stream means we already destroyed it,
+    // and frames still in flight must not bring it back to life. See
+    // DefaultApplication::ReceiveStreamData for the same guard on the raw
+    // QUIC path.
+    if (!session->is_destroyed() && ngtcp2_conn_is_local_stream(*session, id)) {
+      return {};
+    }
     if (auto stream = session->CreateStream(id)) {
       return stream;
     }
@@ -1224,6 +1224,23 @@ class Http3ApplicationImpl final : public Session::Application {
       return NGHTTP3_ERR_CALLBACK_FAILURE;
     }
     auto& session = app.session();
+
+    // DATA frames for a request stream the application already destroyed can
+    // still arrive. Drop the payload rather than resurrecting the stream or
+    // tearing down the connection, but return its credit: unlike framing
+    // bytes, DATA payload is not included in the count nghttp3 reports to
+    // ReceiveStreamData, so we own it. The is_destroyed() check must come
+    // first, see DefaultApplication::ReceiveStreamData.
+    if (!session.is_destroyed() && !session.FindStream(id) &&
+        ngtcp2_conn_is_local_stream(session, id)) {
+      Debug(&session,
+            "HTTP/3 discarding %zu bytes for destroyed local stream %" PRIi64,
+            datalen,
+            id);
+      app.ReturnConnectionCredit(datalen);
+      return NGTCP2_SUCCESS;
+    }
+
     if (auto stream = FindOrCreateStream(conn, &session, id)) [[likely]] {
       stream->ReceiveData(data, datalen, Stream::ReceiveDataFlags{});
       return NGTCP2_SUCCESS;
@@ -1413,7 +1430,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
   static constexpr nghttp3_callbacks kCallbacks = {
       on_acked_stream_data,
-      nullptr,  // nghttp3_stream_close (deprecated)
+      nullptr,  // stream_close (deprecated, use v2 below)
       on_receive_data,
       on_deferred_consume,
       on_begin_headers,
@@ -1426,7 +1443,7 @@ class Http3ApplicationImpl final : public Session::Application {
       on_end_stream,
       on_do_reset_stream,
       on_shutdown,
-      nullptr,  // recv_settings (deprecated)
+      nullptr,  // recv_settings (deprecated, use v2 below)
       on_receive_origin,
       on_end_origin,
       on_rand,
@@ -1434,30 +1451,6 @@ class Http3ApplicationImpl final : public Session::Application {
       on_stream_close};
 };
 
-std::optional<PendingTicketAppData> ParseHttp3TicketData(const uv_buf_t& data) {
-  if (data.len != kSessionTicketAppDataSize) return std::nullopt;
-
-  const uint8_t* buf = reinterpret_cast<const uint8_t*>(data.base);
-
-  // buf[0] is the type byte (already checked by caller), buf[1] is version.
-  if (buf[1] != kSessionTicketAppDataVersion) return std::nullopt;
-
-  const uint8_t* payload = buf + kSessionTicketAppDataHeaderSize;
-  uint32_t stored_crc = ReadBE32(buf + 2);
-  uLong computed_crc = crc32(0L, Z_NULL, 0);
-  computed_crc = crc32(computed_crc, payload, kSessionTicketAppDataPayloadSize);
-  if (stored_crc != static_cast<uint32_t>(computed_crc)) return std::nullopt;
-
-  return Http3TicketData{
-      ReadBE64(payload),
-      ReadBE64(payload + 8),
-      ReadBE64(payload + 16),
-      ReadBE64(payload + 24),
-      payload[32] != 0,
-      payload[33] != 0,
-  };
-}
-
 std::unique_ptr<Session::Application> CreateHttp3Application(
     Session* session, const Session::Application_Options& options) {
   Debug(session, "Selecting HTTP/3 application");
diff --git a/src/quic/http3.h b/src/quic/http3.h
index f1a1b674d969..09033ca78b3d 100644
--- a/src/quic/http3.h
+++ b/src/quic/http3.h
@@ -3,7 +3,6 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <memory>
-#include <optional>
 #include "application.h"
 #include "session.h"
 
@@ -15,11 +14,6 @@ namespace node::quic {
 std::unique_ptr<Session::Application> CreateHttp3Application(
     Session* session, const Session::Application_Options& options);
 
-// Parse HTTP/3 specific session ticket app data. Called from
-// Application::ParseTicketData() when the type byte is HTTP3.
-// The data includes the type byte prefix.
-std::optional<PendingTicketAppData> ParseHttp3TicketData(const uv_buf_t& data);
-
 }  // namespace node::quic
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 2266f74a1277..1c159d763521 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -17,6 +17,7 @@
 #include <util-inl.h>
 #include <uv.h>
 #include <v8.h>
+#include <span>
 #include "application.h"
 #include "bindingdata.h"
 #include "cid.h"
@@ -785,8 +786,8 @@ struct Session::Impl final : public MemoryRetainer {
   SocketAddress remote_address_;
   std::unique_ptr<Application> application_;
   StreamsMap streams_;
-  // Emits deferred until after session setup is completed
-  std::vector<std::function<void()>> deferred_emits_;
+  // qlog chunks produced before the server session was handed to JS.
+  std::vector<std::pair<uint32_t, std::string>> pending_qlog_;
   TimerWrapHandle timer_;
   size_t send_scope_depth_ = 0;
   QuicError last_error_;
@@ -797,11 +798,6 @@ struct Session::Impl final : public MemoryRetainer {
   PendingStream::PendingStreamQueue pending_bidi_stream_queue_;
   PendingStream::PendingStreamQueue pending_uni_stream_queue_;
 
-  // Session ticket app data parsed before ALPN negotiation.
-  // Validated and applied in SetApplication() after ALPN selects
-  // the application type.
-  std::optional<PendingTicketAppData> pending_ticket_data_;
-
   // When true, the handshake is deferred until the first stream or
   // datagram is sent. This is set for client sessions with a session
   // ticket, enabling 0-RTT: the first send triggers the handshake
@@ -881,6 +877,9 @@ struct Session::Impl final : public MemoryRetainer {
     tracker->TrackField("remote_address", remote_address_);
     tracker->TrackField("application", application_);
     tracker->TrackField("timer", timer_);
+    size_t qlog_size = 0;
+    for (const auto& [flags, data] : pending_qlog_) qlog_size += data.size();
+    tracker->TrackFieldWithSize("pending_qlog", qlog_size);
   }
   SET_SELF_SIZE(Impl)
   SET_MEMORY_INFO_NAME(Session::Impl)
@@ -1654,7 +1653,7 @@ struct Session::Impl final : public MemoryRetainer {
 
   static constexpr ngtcp2_callbacks CLIENT = {
       ngtcp2_crypto_client_initial_cb,
-      nullptr,  // stream_stop_sending
+      nullptr,  // recv_client_initial
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
       on_receive_version_negotiation,
@@ -1688,7 +1687,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
       on_receive_rx_key,
       on_receive_tx_key,
@@ -1698,20 +1697,18 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 
   static constexpr ngtcp2_callbacks SERVER = {
-      nullptr,  // stream_stop_sending
+      nullptr,  // client_initial
       ngtcp2_crypto_recv_client_initial_cb,
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
-      nullptr,
+      nullptr,  // recv_version_negotiation
       ngtcp2_crypto_encrypt_cb,
       ngtcp2_crypto_decrypt_cb,
       ngtcp2_crypto_hp_mask_cb,
@@ -1720,7 +1717,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_stream_open,
       on_stream_close,
       nullptr,  // recv_stateless_reset (deprecated, use v2 below)
-      nullptr,
+      nullptr,  // recv_retry
       on_extend_max_streams_bidi,
       on_extend_max_streams_uni,
       on_rand,
@@ -1728,23 +1725,23 @@ struct Session::Impl final : public MemoryRetainer {
       on_remove_connection_id,
       ngtcp2_crypto_update_key_cb,
       on_path_validation,
-      nullptr,
+      nullptr,  // select_preferred_addr
       on_stream_reset,
       on_extend_max_remote_streams_bidi,
       on_extend_max_remote_streams_uni,
       on_extend_max_stream_data,
       nullptr,  // dcid_status (deprecated, use v2 below)
-      nullptr,
-      nullptr,
+      nullptr,  // handshake_confirmed
+      nullptr,  // recv_new_token
       ngtcp2_crypto_delete_crypto_aead_ctx_cb,
       ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
       on_receive_datagram,
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
-      nullptr,
+      nullptr,  // recv_rx_key
       on_receive_tx_key,
       on_early_data_rejected,
       on_begin_path_validation,
@@ -1752,12 +1749,10 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 };
 
@@ -2265,13 +2260,11 @@ Session::Session(Endpoint* endpoint,
   DCHECK(impl_);
   STAT_RECORD_TIMESTAMP(Stats, created_at);
 
-  // For clients, select the Application immediately — the ALPN is
+  // For clients, select the Application immediately - the ALPN is
   // known upfront from the options. For servers, application_ stays
-  // null until OnSelectAlpn fires during the TLS handshake.
+  // null until the ClientHello names a protocol.
   if (config.side == Side::CLIENT) {
-    auto app =
-        SelectApplicationFromAlpn(DecodeAlpn(config.options.tls_options.alpn));
-    if (app) SetApplication(std::move(app));
+    InstallApplicationForAlpn(DecodeAlpn(config.options.tls_options.alpn));
   }
 
   // For client sessions with a session ticket and early data enabled,
@@ -2632,21 +2625,22 @@ std::unique_ptr<Session::Application> Session::SelectApplicationFromAlpn(
   return CreateDefaultApplication(this, config().options.application_options);
 }
 
+void Session::InstallApplicationForAlpn(std::string_view alpn) {
+  // Acting on the ClientHello twice would install a second Application over
+  // a live one; TLSSession::EarlySelection is what prevents that.
+  CHECK(!has_application());
+  SetApplication(SelectApplicationFromAlpn(alpn));
+}
+
+void Session::SetEarlyRemoteTransportParams(std::span<const uint8_t> params) {
+  DCHECK(!is_destroyed());
+  if (params.empty()) return;
+  USE(ngtcp2_conn_decode_and_set_remote_transport_params(
+      *this, params.data(), params.size()));
+}
+
 void Session::SetApplication(std::unique_ptr<Application> app) {
   DCHECK(!impl_->application_);
-  // If we have pending ticket data from a session ticket that was
-  // parsed before ALPN negotiation, validate it against the selected
-  // application now. If the type doesn't match or the application
-  // rejects the data, the handshake will fail (application_ stays null
-  // and the caller returns an error).
-  if (impl_->pending_ticket_data_.has_value()) {
-    auto data = std::move(*impl_->pending_ticket_data_);
-    impl_->pending_ticket_data_.reset();
-    if (!app->ApplySessionTicketData(data)) {
-      Debug(this, "Session ticket app data rejected by application");
-      return;
-    }
-  }
   impl_->state()->application_type = static_cast<uint8_t>(app->type());
   impl_->state()->headers_supported = static_cast<uint8_t>(
       app->SupportsHeaders() ? HeadersSupportState::SUPPORTED
@@ -2701,9 +2695,8 @@ const Session::Options& Session::options() const {
 void Session::EmitQlog(uint32_t flags, std::string_view data) {
   if (!env()->can_call_into_js()) return;
 
-  if (!is_destroyed() && must_defer_emits()) {
-    QueueDeferredEmit(
-        [this, flags, held = std::string(data)]() { EmitQlog(flags, held); });
+  if (!is_destroyed() && is_server() && !impl_->state()->wrapped) {
+    impl_->pending_qlog_.emplace_back(flags, std::string(data));
     return;
   }
 
@@ -2821,23 +2814,48 @@ bool Session::ReadPacket(const uint8_t* data,
 
   Debug(this, "Session receiving %zu-byte packet with result %d", len, err);
 
+  if (err == 0 && !is_destroyed()) [[likely]] {
+    STAT_INCREMENT_N(Stats, bytes_received, len);
+  }
+  return AfterNgtcp2Read(err);
+}
+
+void Session::ResumeHandshake() {
+  DCHECK(!is_destroyed());
+  DCHECK(is_server());
+  // From here on the ClientHello callback is a no-op, so the handshake
+  // runs on into ticket decryption, early data and the rest.
+  tls_session().set_early_selection(TLSSession::EarlySelection::kComplete);
+  Debug(this, "Resuming the TLS handshake");
+  int err;
+  {
+    NgTcp2CallbackScope callback_scope(this);
+    err = ngtcp2_conn_continue_handshake(*this, uv_hrtime());
+  }
+  if (is_destroyed()) return;
+  AfterNgtcp2Read(err);
+}
+
+bool Session::AfterNgtcp2Read(int err) {
   switch (err) {
     case 0: {
-      Debug(this, "Session successfully received %zu-byte packet", len);
       if (!is_destroyed()) [[likely]] {
-        STAT_INCREMENT_N(Stats, bytes_received, len);
         // Process deferred application operations after ALPN selection - not
         // necessarily resolved yet as ClientHello can span multiple packets.
         if (has_application()) application().PostReceive();
-        // Surface a server session to JS once its ClientHello has been
-        // processed (OnSelectAlpn fired: SNI + ALPN are known and reliable).
-        // Held first-flight events - including 0-RTT request streams - replay
-        // at emit. The !wrapped guard makes this fire exactly once, on
-        // whichever packet completes the ClientHello (so a multi-datagram
-        // ClientHello is handled correctly).
-        if (is_server() && hello_processed_ && !impl_->state()->wrapped &&
-            !is_destroyed()) {
+
+        if (is_destroyed()) return true;
+
+        // The ClientHello has been processed: SNI and ALPN are selected and
+        // the Application is installed, but the handshake is stopped short
+        // of ticket decryption, so no early data exists yet. Surface the
+        // session, then let the handshake run on. The guard makes this fire
+        // exactly once, on whichever packet completed the ClientHello, so a
+        // ClientHello split across datagrams is handled correctly.
+        if (is_server() && tls_session().early_selection() ==
+                               TLSSession::EarlySelection::kSelected) {
           endpoint().EmitNewSession(BaseObjectPtr<Session>(this));
+          if (!is_destroyed()) ResumeHandshake();
         }
       }
       return true;
@@ -3389,42 +3407,11 @@ void Session::CollectSessionTicketAppData(
 SessionTicket::AppData::Status Session::ExtractSessionTicketAppData(
     const SessionTicket::AppData& app_data, Flag flag) {
   DCHECK(!is_destroyed());
-  // If the application is already selected (client side, or server after
-  // ALPN), delegate directly.
-  if (impl_->application_) {
-    return application().ExtractSessionTicketAppData(app_data, flag);
-  }
-  // The application is not yet selected (server during ClientHello
-  // processing, before ALPN). Parse the ticket data now while the
-  // SSL_SESSION is still valid, and stash the result for validation
-  // after ALPN negotiation in SetApplication().
-  auto data = app_data.Get();
-  if (!data.has_value() || data->len == 0) {
-    // No app data in the ticket. Accept optimistically.
-    return flag == Flag::STATUS_RENEW
-               ? SessionTicket::AppData::Status::TICKET_USE_RENEW
-               : SessionTicket::AppData::Status::TICKET_USE;
-  }
-  auto parsed = Application::ParseTicketData(*data);
-  if (!parsed.has_value()) {
-    return SessionTicket::AppData::Status::TICKET_IGNORE_RENEW;
-  }
-  // Pre-validate the ticket data against the current application options.
-  // If the stored settings are more permissive than the current config
-  // (e.g., a feature was enabled when the ticket was issued but is now
-  // disabled), reject the ticket so 0-RTT is not used. This must happen
-  // here (during TLS ticket processing) rather than in SetApplication,
-  // because by SetApplication time the TLS layer has already accepted
-  // the ticket and told the client 0-RTT is ok.
-  if (!Application::ValidateTicketData(*parsed,
-                                       config().options.application_options)) {
-    Debug(this, "Session ticket app data incompatible with current settings");
+  // Renew, so the client stops offering a ticket that is never accepted.
+  if (!has_application()) [[unlikely]] {
     return SessionTicket::AppData::Status::TICKET_IGNORE_RENEW;
   }
-  impl_->pending_ticket_data_ = std::move(parsed);
-  return flag == Flag::STATUS_RENEW
-             ? SessionTicket::AppData::Status::TICKET_USE_RENEW
-             : SessionTicket::AppData::Status::TICKET_USE;
+  return application().ExtractSessionTicketAppData(app_data, flag);
 }
 
 void Session::MemoryInfo(MemoryTracker* tracker) const {
@@ -3528,33 +3515,20 @@ void Session::set_wrapped() {
   impl_->state()->wrapped = 1;
 }
 
-bool Session::must_defer_emits() const {
-  // Server sessions are surfaced to JS (via the deferred new-session emit)
-  // only after the ClientHello has been processed and wrapped; anything
-  // emitted before then has no JS wrapper to receive it and must be held
-  // for replay.
-  return is_server() && !impl_->state()->wrapped;
-}
-
 bool Session::tls_info_ready() const {
   // hello_processed_ is set server-side, handshake_completed covers
   // the client. Together they mark the point when SNI/ALPN are final.
   return hello_processed_ || impl_->state()->handshake_completed;
 }
 
-void Session::QueueDeferredEmit(std::function<void()> fn) {
-  impl_->deferred_emits_.emplace_back(std::move(fn));
-}
-
-void Session::ReplayDeferredEmits() {
+void Session::FlushPendingQlog() {
   if (is_destroyed()) return;
   DCHECK(impl_->state()->wrapped);
-  // Runs synchronously immediately after the new-session callback
-  // returns (still within first-flight processing).
-  auto emits = std::move(impl_->deferred_emits_);
-  for (auto& emit : emits) {
+  // Runs synchronously immediately after the new-session callback returns.
+  auto pending = std::move(impl_->pending_qlog_);
+  for (auto& [flags, data] : pending) {
     if (is_destroyed()) return;
-    emit();
+    EmitQlog(flags, data);
   }
 }
 
@@ -4069,7 +4043,6 @@ void Session::set_max_datagram_size(uint16_t size) {
 
 void Session::EmitGoaway(stream_id last_stream_id) {
   if (is_destroyed()) return;
-  if (DeferEmit([this, last_stream_id] { EmitGoaway(last_stream_id); })) return;
   if (!env()->can_call_into_js()) return;
 
   CallbackScope<Session> cb_scope(this);
@@ -4085,13 +4058,6 @@ void Session::EmitGoaway(stream_id last_stream_id) {
 void Session::EmitDatagram(Store&& datagram, DatagramReceivedFlags flag) {
   DCHECK(!is_destroyed());
 
-  if (must_defer_emits()) {
-    QueueDeferredEmit([this, datagram = std::move(datagram), flag]() mutable {
-      EmitDatagram(std::move(datagram), flag);
-    });
-    return;
-  }
-
   if (!env()->can_call_into_js()) return;
 
   CallbackScope<Session> cbv_scope(this);
@@ -4107,8 +4073,6 @@ void Session::EmitDatagram(Store&& datagram, DatagramReceivedFlags flag) {
 void Session::EmitDatagramStatus(datagram_id id, quic::DatagramStatus status) {
   DCHECK(!is_destroyed());
 
-  if (DeferEmit([this, id, status] { EmitDatagramStatus(id, status); })) return;
-
   if (!env()->can_call_into_js()) return;
 
   CallbackScope<Session> cb_scope(this);
@@ -4270,7 +4234,6 @@ void Session::EmitSessionTicket(Store&& ticket) {
 
 void Session::EmitApplication() {
   if (is_destroyed()) return;
-  if (DeferEmit([this] { EmitApplication(); })) return;
   if (!env()->can_call_into_js()) return;
 
   if (!has_application()) {
@@ -4341,8 +4304,6 @@ void Session::EmitNewToken(const uint8_t* token, size_t len) {
 void Session::EmitStream(const BaseObjectWeakPtr<Stream>& stream) {
   DCHECK(!is_destroyed());
 
-  if (DeferEmit([this, stream] { EmitStream(stream); })) return;
-
   if (!stream) return;
 
   if (!env()->can_call_into_js()) return;
@@ -4401,13 +4362,6 @@ void Session::EmitVersionNegotiation(const ngtcp2_pkt_hd& hd,
 void Session::EmitOrigins(std::vector<std::string>&& origins) {
   DCHECK(!is_destroyed());
 
-  if (must_defer_emits()) {
-    QueueDeferredEmit([this, origins = std::move(origins)]() mutable {
-      EmitOrigins(std::move(origins));
-    });
-    return;
-  }
-
   if (!HasListenerFlag(impl_->state()->listener_flags,
                        SessionListenerFlags::ORIGIN))
     return;
@@ -4434,12 +4388,6 @@ void Session::EmitOrigins(std::vector<std::string>&& origins) {
 void Session::EmitKeylog(const char* line) {
   DCHECK(!is_destroyed());
 
-  if (must_defer_emits()) {
-    QueueDeferredEmit(
-        [this, str = std::string(line)]() { EmitKeylog(str.c_str()); });
-    return;
-  }
-
   if (!env()->can_call_into_js()) return;
 
   Local<Value> argv[] = {Undefined(env()->isolate())};
diff --git a/src/quic/session.h b/src/quic/session.h
index 3b2a9773a380..6cc3db4c86f4 100644
--- a/src/quic/session.h
+++ b/src/quic/session.h
@@ -12,6 +12,7 @@
 #include <timer_wrap.h>
 #include <util.h>
 #include <optional>
+#include <span>
 #include "bindingdata.h"
 #include "cid.h"
 #include "data.h"
@@ -123,19 +124,6 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
     std::string ToString() const;
   };
 
-  // Decode the first ALPN protocol name from wire format (length-prefixed).
-  static std::string_view DecodeAlpn(std::string_view wire);
-
-  // Select the Application implementation based on the negotiated ALPN.
-  // h3 (and h3-XX variants) map to Http3ApplicationImpl; all others map
-  // to DefaultApplication. Sets the application_type state field.
-  std::unique_ptr<Application> SelectApplicationFromAlpn(std::string_view alpn);
-
-  // Install the Application on the session. Called at construction for
-  // clients (ALPN known upfront) or from OnSelectAlpn for servers
-  // (ALPN negotiated during handshake). Must be called before any
-  // application data is received.
-  void SetApplication(std::unique_ptr<Application> app);
   // Controls which datagram to drop when the pending datagram queue is full.
   enum class DatagramDropPolicy : uint8_t {
     DROP_OLDEST = 0,  // Drop the oldest queued datagram (default).
@@ -431,6 +419,29 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
                   const PacketInfo& pkt_info = PacketInfo(),
                   uint64_t ts = 0);
 
+  // Handles the result of an ngtcp2 call that drives inbound processing
+  // (ngtcp2_conn_read_pkt or ngtcp2_conn_continue_handshake).
+  bool AfterNgtcp2Read(int err);
+
+  // Decode the first ALPN protocol name from wire format (length-prefixed).
+  static std::string_view DecodeAlpn(std::string_view wire);
+
+  // Select the Application implementation based on the negotiated ALPN.
+  // h3 (and h3-XX variants) map to Http3ApplicationImpl; all others map
+  // to DefaultApplication. Sets the application_type state field.
+  std::unique_ptr<Application> SelectApplicationFromAlpn(std::string_view alpn);
+
+  // Install the Application on the session. Called at construction for
+  // clients (ALPN known upfront) or from the ClientHello callback for
+  // servers (ALPN negotiated during handshake). Must be called before any
+  // application data is received.
+  void SetApplication(std::unique_ptr<Application> app);
+
+  void InstallApplicationForAlpn(std::string_view alpn);
+
+  // ngtcp2 ignores the duplicate when the TLS stack reports these again.
+  void SetEarlyRemoteTransportParams(std::span<const uint8_t> params);
+
   // Called by BindingData's flush callback to trigger SendPendingData
   // on this session. Encapsulates the application() access so that
   // bindingdata.cc doesn't need the full Application type definition.
@@ -610,24 +621,9 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
   // defined there to manage it.
   void set_wrapped();
 
-  // True while JS emits must be held for later replay, before the handshake
-  // is complete and the server session event has been emitted.
-  bool must_defer_emits() const;
-
-  // Replays, in order, any emits held while must_defer_emits() was true.
-  // Called synchronously right after the new-session emit.
-  void ReplayDeferredEmits();
-
-  // Queues fn to be replayed by ReplayDeferredEmits(). Out-of-line so the
-  // header does not need the full Impl definition.
-  void QueueDeferredEmit(std::function<void()> fn);
+  void ResumeHandshake();
 
-  template <typename F>
-  bool DeferEmit(F&& fn) {
-    if (!must_defer_emits()) return false;
-    QueueDeferredEmit(std::forward<F>(fn));
-    return true;
-  }
+  void FlushPendingQlog();
 
   enum class CloseMethod : uint8_t {
     // Immediate close with a roundtrip through JavaScript, causing all
diff --git a/src/quic/streams.cc b/src/quic/streams.cc
index c2691362447a..1f8761c75049 100644
--- a/src/quic/streams.cc
+++ b/src/quic/streams.cc
@@ -1211,11 +1211,9 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
   STAT_SET(Stats, max_offset, params->initial_max_data);
 }
 
-Stream::~Stream() {
-  // Make sure that Destroy() was called before Stream is actually destructed.
-  DCHECK_NE(stats()->destroyed_at, 0);
+Stream::~Stream() = default;
 
-  // Release arena slots back to the freelist.
+void Stream::ReleaseArenaSlots() {
   auto& binding = BindingData::Get(env());
   if (stats_slot_) {
     GetStreamStatsArena(binding).ReleaseSlot(stats_slot_);
@@ -1306,6 +1304,7 @@ bool Stream::is_pending() const {
 }
 
 bool Stream::is_destroyed() const {
+  if (!stats_slot_) return true;
   return stats()->destroyed_at != 0;
 }
 
@@ -1499,12 +1498,37 @@ void Stream::EndWriting() {
   if (!is_pending()) session_->ResumeStream(id());
 }
 
+void Stream::ReturnFlowControlCredit(uint64_t amount, CreditScope scope) {
+  if (amount == 0) return;
+  // The stream can outlive a destroyed session (the JS side may still hold a
+  // reader over the inbound queue), leaving no window to extend.
+  if (!session_ || session_->is_destroyed()) return;
+  // Extending a window queues MAX_STREAM_DATA / MAX_DATA. The scope flushes
+  // them; inside an ngtcp2 callback the flush is a no-op and they go out with
+  // the next scheduled send instead.
+  Session::SendPendingDataScope send_scope(&session());
+  if (scope == CreditScope::STREAM_AND_CONNECTION) {
+    // Receiving data requires an id, so this should always hold.
+    DCHECK(!is_pending());
+    session().Consume(id(), amount);
+  } else {
+    session().ExtendOffset(amount);
+  }
+}
+
+void Stream::CreditConsumedBytes(uint64_t amount) {
+  // Clamped because Destroy() returns the outstanding credit in bulk and the
+  // flush that triggers can re-enter JS, which may then report some of those
+  // same bytes as read. Never give the peer more credit than we took.
+  amount = std::min(uncredited_bytes_, amount);
+  uncredited_bytes_ -= amount;
+  ReturnFlowControlCredit(amount, CreditScope::STREAM_AND_CONNECTION);
+}
+
 void Stream::EntryRead(size_t amount) {
   // Called when the JS consumer reads data from the inbound DataQueue.
   // Extend the flow control window so the sender can transmit more.
-  if (session().is_destroyed()) return;
-  Session::SendPendingDataScope send_scope(&session());
-  session().Consume(id(), amount);
+  CreditConsumedBytes(amount);
 }
 
 void Stream::BeforePull() {
@@ -1517,16 +1541,26 @@ void Stream::BeforePull() {
 
 void Stream::FlushAccumulation() {
   if (!recv_accumulator_ || recv_accumulator_->available() == 0) return;
+  size_t flushed = recv_accumulator_->available();
   auto entry = recv_accumulator_->Flush(env());
-  if (entry) {
-    inbound_->append(std::move(entry));
+  // Flush() always drains the accumulator, so the stat is reset either way.
+  STAT_SET(Stats, bytes_accumulated, 0);
+  if (entry && inbound_->append(std::move(entry)).value_or(false)) {
     // Notify the reader that data is now available in the DataQueue.
     // This is the only place we notify — not on every ReceiveData call —
     // so the reader only wakes up when there is a well-sized entry to
     // consume.
     if (reader_) reader_->NotifyPull();
+    return;
   }
-  STAT_SET(Stats, bytes_accumulated, 0);
+  // Should be unreachable: append() only fails once the queue has been capped,
+  // EndReadable() flushes before capping, and ReceiveData() accumulates
+  // nothing once read_ended is set. Reaching here means received stream data
+  // is being dropped on the floor, so say so and at least do not also leak
+  // the flow control credit for it.
+  DCHECK(false);
+  Debug(this, "Inbound queue rejected %zu accumulated bytes", flushed);
+  CreditConsumedBytes(flushed);
 }
 
 int Stream::DoPull(bob::Next<ngtcp2_vec> next,
@@ -1614,14 +1648,13 @@ void Stream::EndReadable(std::optional<uint64_t> maybe_final_size) {
   FlushAccumulation();
   set_final_size(maybe_final_size.value_or(STAT_GET(Stats, bytes_received)));
   inbound_->cap(STAT_GET(Stats, final_size));
-  // Notify the JS reader so it can see EOS. Pass fin=true so the
-  // wakeup promise resolves with a value the iterator can check to
-  // avoid waiting for another wakeup that will never come.
-  if (reader_) reader_->NotifyPull(true);
+  // Notify the JS reader so it can see EOS. The subsequent pull observes
+  // the now-capped DataQueue and returns EOS.
+  if (reader_) reader_->NotifyPull();
 }
 
 void Stream::Destroy(QuicError error) {
-  if (stats()->destroyed_at != 0) return;
+  if (is_destroyed()) return;
 
   // Record the destroyed at timestamp before notifying the JavaScript side
   // that the stream is being destroyed.
@@ -1652,6 +1685,16 @@ void Stream::Destroy(QuicError error) {
   // the ring buffer memory.
   recv_accumulator_.reset();
 
+  // Data that was received but never consumed still holds connection-level
+  // flow control credit, and EntryRead() will never fire for it once the
+  // listener is detached below. Leaking it would permanently shrink the
+  // session's shared receive window and, over enough streams, deadlock the
+  // connection. Zero the counter first: returning credit flushes packets,
+  // which can re-enter JS and report some of these bytes as read.
+  const uint64_t outstanding = uncredited_bytes_;
+  uncredited_bytes_ = 0;
+  ReturnFlowControlCredit(outstanding, CreditScope::CONNECTION_ONLY);
+
   // We reset the inbound here also. However, it's important to note that
   // the JavaScript side could still have a reader on the inbound DataQueue,
   // which may keep that data alive a bit longer.
@@ -1666,6 +1709,9 @@ void Stream::Destroy(QuicError error) {
   // handle.
   EmitClose(error);
 
+  stream_id id_to_remove = id();
+  ReleaseArenaSlots();
+
   auto session = session_;
   session_.reset();
   // EmitClose above triggers MakeCallback which can destroy the session
@@ -1673,7 +1719,7 @@ void Stream::Destroy(QuicError error) {
   // Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
   // e.g. OnTimeout's ref) even though impl_ has been reset. We must
   // check is_destroyed() to avoid dereferencing the null impl_.
-  if (session && !session->is_destroyed()) session->RemoveStream(id());
+  if (session && !session->is_destroyed()) session->RemoveStream(id_to_remove);
 
   // Critically, make sure that the RemoveStream call is the last thing
   // trying to use this stream object. Once that call is made, the stream
@@ -1691,6 +1737,13 @@ void Stream::ReceiveData(const uint8_t* data,
   Debug(this, "Receiving %zu bytes of data", len);
   if (state()->read_ended == 1 || len == 0) {
     if (flags.fin) EndReadable();
+    // Nothing will ever consume these bytes, so return the connection-level
+    // credit ngtcp2 charged for them. The stream window is deliberately left
+    // alone: there is no point inviting more data onto a stream we have
+    // stopped reading. Reachable when, for example, HTTP/3 replays DATA
+    // payload it had buffered for QPACK head-of-line blocking after the
+    // readable side was shut down.
+    ReturnFlowControlCredit(len, CreditScope::CONNECTION_ONLY);
     return;
   }
 
@@ -1699,6 +1752,9 @@ void Stream::ReceiveData(const uint8_t* data,
   STAT_SET(Stats, max_offset_received, STAT_GET(Stats, bytes_received));
   STAT_RECORD_TIMESTAMP(Stats, received_at);
 
+  // These bytes now hold inbound flow control credit. See uncredited_bytes_.
+  uncredited_bytes_ += len;
+
   // Lazy-allocate the receive accumulation buffer on first data-carrying
   // call. Streams that never receive data (write-only, immediately reset)
   // pay zero cost.
diff --git a/src/quic/streams.h b/src/quic/streams.h
index f18702ae75ab..cd4849aae277 100644
--- a/src/quic/streams.h
+++ b/src/quic/streams.h
@@ -395,6 +395,22 @@ class Stream final : public AsyncWrap,
   // inbound DataQueue as a single right-sized entry.
   void FlushAccumulation();
 
+  // Every byte ngtcp2 delivers is charged against both the stream-level and
+  // the connection-level receive window until we hand the credit back.
+  enum class CreditScope : uint8_t {
+    // The stream is still readable, so the peer may usefully send more on it.
+    STREAM_AND_CONNECTION,
+    // The stream is finished, so only the session-wide window is extended.
+    CONNECTION_ONLY,
+  };
+
+  // Returns `amount` bytes of inbound flow control credit to the peer.
+  void ReturnFlowControlCredit(uint64_t amount, CreditScope scope);
+
+  // Returns credit for bytes that have left our custody, either read by the
+  // consumer or dropped before reaching one.
+  void CreditConsumedBytes(uint64_t amount);
+
   // Gets a reader for the data received for this stream from the peer,
   BaseObjectPtr<Blob::Reader> get_reader();
 
@@ -408,6 +424,7 @@ class Stream final : public AsyncWrap,
 
   bool is_local_unidirectional() const;
   bool is_remote_unidirectional() const;
+  void ReleaseArenaSlots();
 
   // JavaScript callouts
 
@@ -458,6 +475,14 @@ class Stream final : public AsyncWrap,
   BaseObjectWeakPtr<Blob::Reader> reader_;
   std::unique_ptr<RecvAccumulator> recv_accumulator_;
 
+  // Bytes delivered to ReceiveData() that still hold inbound flow control
+  // credit. Returned incrementally as the consumer reads them, and in bulk
+  // when the stream is destroyed -- otherwise abandoning a stream with unread
+  // data would permanently shrink the session's receive window. Data still
+  // buffered inside nghttp3 is deliberately not counted: nghttp3 returns that
+  // credit itself through its deferred_consume callback.
+  uint64_t uncredited_bytes_ = 0;
+
   // If the stream cannot be opened yet, it will be created in a pending state.
   // Once the owning session is able to, it will complete opening of the stream
   // and the stream id will be assigned.
diff --git a/src/quic/tlscontext.cc b/src/quic/tlscontext.cc
index cbbee77c85c1..e68380fd0424 100644
--- a/src/quic/tlscontext.cc
+++ b/src/quic/tlscontext.cc
@@ -3,6 +3,7 @@
 #ifndef OPENSSL_NO_QUIC
 #include <async_wrap-inl.h>
 #include <base_object-inl.h>
+#include <crypto/crypto_tls_certificates.h>
 #include <crypto/crypto_util.h>
 #include <debug_utils-inl.h>
 #include <env-inl.h>
@@ -32,7 +33,6 @@ using ncrypto::MarkPopErrorOnReturn;
 using ncrypto::SSLCtxPointer;
 using ncrypto::SSLPointer;
 using ncrypto::SSLSessionPointer;
-using ncrypto::X509Pointer;
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
@@ -334,52 +334,100 @@ TLSContext::operator SSL_CTX*() const {
   return ctx_.get();
 }
 
+crypto::ClientHelloResult TLSContext::OnClientHello(
+    const crypto::ClientHelloContext& hello) {
+  auto& tls_session = TLSSession::From(hello.ssl());
+  auto& session = tls_session.session();
+
+  using EarlySelection = TLSSession::EarlySelection;
+  switch (tls_session.early_selection()) {
+    case EarlySelection::kPending:
+      break;
+    case EarlySelection::kSelected:
+      // Selected already, but the Session has not been surfaced yet, so
+      // the handshake must stay where it is.
+      return crypto::ClientHelloResult::kRetry;
+    case EarlySelection::kComplete: {
+      // Don't let HelloRetryRequests change SNI:
+      auto name = hello.servername();
+      if (!name.has_value() || *name != tls_session.servername()) {
+        Debug(&session, "ClientHello changed the requested servername");
+        hello.set_alert(SSL_AD_ILLEGAL_PARAMETER);
+        return crypto::ClientHelloResult::kFail;
+      }
+      // Everything else the TLS library needs from here on is cached on the
+      // TLSSession, so just let the handshake run.
+      return crypto::ClientHelloResult::kContinue;
+    }
+  }
+
+  auto requested = hello.servername();
+  if (!requested.has_value()) {
+    Debug(&session, "Unusable servername in ClientHello");
+    hello.set_alert(SSL_AD_DECODE_ERROR);
+    return crypto::ClientHelloResult::kFail;
+  }
+  const std::string_view servername = *requested;
+
+  auto* selected = tls_session.context().SelectSNIContext(servername);
+  if (selected == nullptr) {
+    Debug(&session, "No TLS context for servername %s", servername);
+    hello.set_alert(SSL_AD_UNRECOGNIZED_NAME);
+    return crypto::ClientHelloResult::kFail;
+  }
+  if (selected != &tls_session.context()) {
+    SSL_set_SSL_CTX(hello.ssl(), *selected);
+  }
+  tls_session.set_servername(servername);
+
+  // The client's QUIC transport parameters travel in the ClientHello, but
+  // the TLS stack does not hand them to ngtcp2 until it parses extensions,
+  // which is after this callback.
+  auto params = hello.extension(TLSEXT_TYPE_quic_transport_parameters);
+  if (params.has_value()) session.SetEarlyRemoteTransportParams(*params);
+
+  const auto& supported = selected->options().alpn;
+  auto negotiated = crypto::SelectNextProtocol(
+      {reinterpret_cast<const uint8_t*>(supported.data()), supported.size()},
+      hello.alpn_protocols());
+  if (!negotiated.has_value()) {
+    Debug(&session, "ALPN negotiation failed");
+    hello.set_alert(SSL_AD_NO_APPLICATION_PROTOCOL);
+    return crypto::ClientHelloResult::kFail;
+  }
+  Debug(&session, "ALPN negotiation succeeded: %s", *negotiated);
+  tls_session.set_alpn(*negotiated);
+
+  // Install the Application while the handshake is still stopped, so that
+  // it is in place before a session ticket can be accepted and early data
+  // can start arriving.
+  session.InstallApplicationForAlpn(*negotiated);
+  session.set_hello_processed();
+
+  // Stop here. Session::AfterNgtcp2Read surfaces the server session to
+  // JavaScript and then resumes the handshake, at which point this callback
+  // runs again and takes the kComplete path.
+  tls_session.set_early_selection(EarlySelection::kSelected);
+  return crypto::ClientHelloResult::kRetry;
+}
+
 int TLSContext::OnSelectAlpn(SSL* ssl,
                              const unsigned char** out,
                              unsigned char* outlen,
                              const unsigned char* in,
                              unsigned int inlen,
                              void* arg) {
-  auto& tls_session = TLSSession::From(ssl);
-
-  const auto& requested = tls_session.context().options().alpn;
-  if (requested.empty()) return SSL_TLSEXT_ERR_NOACK;
-
-  // The requested ALPN string is in wire format (one or more
-  // length-prefixed protocol names). SSL_select_next_proto finds the
-  // first match between the server's list and the client's list.
-  if (SSL_select_next_proto(
-          const_cast<unsigned char**>(out),
-          outlen,
-          reinterpret_cast<const unsigned char*>(requested.data()),
-          requested.length(),
-          in,
-          inlen) == OPENSSL_NPN_NO_OVERLAP) {
-    Debug(&tls_session.session(), "ALPN negotiation failed");
+  // The protocol was already chosen from the ClientHello. OpenSSL still
+  // requires it to be handed back here for the ALPN extension to be sent.
+  const auto& negotiated = TLSSession::From(ssl).alpn();
+  if (negotiated.empty()) return SSL_TLSEXT_ERR_NOACK;
+  // The list offered here should be the one the choice was made from, but
+  // a peer can send a second ClientHello after HelloRetryRequest; never
+  // answer with a protocol this one does not offer.
+  if (!crypto::AlpnListContains({in, inlen}, negotiated)) {
     return SSL_TLSEXT_ERR_ALERT_FATAL;
   }
-
-  // ALPN negotiated successfully. *out/*outlen point to the selected
-  // protocol name (without the length prefix). Select the Application
-  // implementation based on the negotiated ALPN. This must happen now
-  // because early data (0-RTT) may arrive in the same ngtcp2_conn_read_pkt
-  // call and needs the Application to be ready.
-  std::string_view negotiated(reinterpret_cast<const char*>(*out), *outlen);
-  Debug(&tls_session.session(),
-        "ALPN negotiation succeeded: %s",
-        std::string(negotiated).c_str());
-
-  auto& session = tls_session.session();
-  auto app = session.SelectApplicationFromAlpn(negotiated);
-  if (!app) {
-    Debug(&session,
-          "Failed to create Application for ALPN %s",
-          std::string(negotiated).c_str());
-    return SSL_TLSEXT_ERR_NOACK;
-  }
-  session.SetApplication(std::move(app));
-  session.set_hello_processed();
-
+  crypto::SetSelectedProtocol(out, outlen, negotiated);
   return SSL_TLSEXT_ERR_OK;
 }
 
@@ -486,6 +534,7 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
 
       SSL_CTX_set_mode(ctx.get(), SSL_MODE_RELEASE_BUFFERS);
       SSL_CTX_set_alpn_select_cb(ctx.get(), OnSelectAlpn, this);
+      crypto::SetClientHelloCallback<OnClientHello>(ctx.get());
 
       if (SSL_CTX_set_session_id_context(
               ctx.get(), kSidCtx, sizeof(kSidCtx) - 1) != 1) {
@@ -506,8 +555,9 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
                                              nullptr),
                1);
 
+      // The SNI context is selected from the ClientHello; this callback
+      // exists only so that OpenSSL acknowledges the extension.
       SSL_CTX_set_tlsext_servername_callback(ctx.get(), OnSNI);
-      SSL_CTX_set_tlsext_servername_arg(ctx.get(), this);
       break;
     }
     case Side::CLIENT: {
@@ -528,12 +578,6 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
     }
   }
 
-  // Only load system CA certificates if no custom CAs are provided.
-  // SSL_CTX_set_default_verify_paths involves filesystem I/O to read
-  // the system CA bundle.
-  if (options_.ca.empty()) {
-    SSL_CTX_set_default_verify_paths(ctx.get());
-  }
   if (options_.keylog) {
     SSL_CTX_set_keylog_callback(ctx.get(), OnKeylog);
   }
@@ -551,30 +595,16 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
   {
     ClearErrorOnReturn clear_error_on_return;
     if (options_.ca.empty()) {
-      auto store = crypto::GetOrCreateRootCertStore(env);
-      X509_STORE_up_ref(store);
-      SSL_CTX_set_cert_store(ctx.get(), store);
+      crypto::UseDefaultRootCertStore(env, ctx.get());
     } else {
       for (const auto& ca : options_.ca) {
         uv_buf_t buf = ca;
         if (buf.len == 0) {
-          auto store = crypto::GetOrCreateRootCertStore(env);
-          X509_STORE_up_ref(store);
-          SSL_CTX_set_cert_store(ctx.get(), store);
+          crypto::UseDefaultRootCertStore(env, ctx.get());
         } else {
           BIOPointer bio = crypto::NodeBIO::NewFixed(buf.base, buf.len);
           CHECK(bio);
-          X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx.get());
-          while (
-              auto x509 = X509Pointer(PEM_read_bio_X509_AUX(
-                  bio.get(), nullptr, crypto::NoPasswordCallback, nullptr))) {
-            if (cert_store == crypto::GetOrCreateRootCertStore(env)) {
-              cert_store = crypto::NewRootCertStore(env);
-              SSL_CTX_set_cert_store(ctx.get(), cert_store);
-            }
-            CHECK_EQ(1, X509_STORE_add_cert(cert_store, x509.get()));
-            CHECK_EQ(1, SSL_CTX_add_client_CA(ctx.get(), x509.get()));
-          }
+          crypto::AddCACertificates(env, ctx.get(), bio);
         }
       }
     }
@@ -643,11 +673,7 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
   {
     ClearErrorOnReturn clear_error_on_return;
     for (const auto& key : options_.keys) {
-      if (key.GetKeyType() != crypto::KeyType::kKeyTypePrivate) {
-        validation_error_ = "Invalid key";
-        return SSLCtxPointer();
-      }
-      if (!SSL_CTX_use_PrivateKey(ctx.get(), key.GetAsymmetricKey().get())) {
+      if (!crypto::UsePrivateKey(ctx.get(), key)) {
         validation_error_ = "Invalid key";
         return SSLCtxPointer();
       }
@@ -659,25 +685,10 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
     for (const auto& crl : options_.crl) {
       uv_buf_t buf = crl;
       BIOPointer bio = crypto::NodeBIO::NewFixed(buf.base, buf.len);
-      DeleteFnPtr<X509_CRL, X509_CRL_free> crlptr(PEM_read_bio_X509_CRL(
-          bio.get(), nullptr, crypto::NoPasswordCallback, nullptr));
-
-      if (!crlptr) {
+      if (!crypto::AddCRL(env, ctx.get(), bio)) {
         validation_error_ = "Invalid CRL";
         return SSLCtxPointer();
       }
-
-      X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx.get());
-      if (cert_store == crypto::GetOrCreateRootCertStore(env)) {
-        cert_store = crypto::NewRootCertStore(env);
-        SSL_CTX_set_cert_store(ctx.get(), cert_store);
-      }
-
-      CHECK_EQ(1, X509_STORE_add_crl(cert_store, crlptr.get()));
-      CHECK_EQ(
-          1,
-          X509_STORE_set_flags(
-              cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
     }
   }
 
@@ -693,23 +704,22 @@ SSLCtxPointer TLSContext::Initialize(Environment* env) {
   return ctx;
 }
 
-int TLSContext::OnSNI(SSL* ssl, int* ad, void* arg) {
-  auto* default_ctx = static_cast<TLSContext*>(arg);
-  const char* servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
-  if (servername != nullptr) {
-    auto it = default_ctx->sni_contexts_.find(servername);
-    if (it != default_ctx->sni_contexts_.end()) {
-      SSL_set_SSL_CTX(ssl, it->second->ctx_.get());
-      return SSL_TLSEXT_ERR_OK;
-    }
-  }
-  // No matching hostname found. If the default context has a certificate
-  // (from the sni['*'] wildcard identity), fall through to use it.
-  // Otherwise, reject the connection with an unrecognized_name alert.
-  if (SSL_CTX_get0_certificate(default_ctx->ctx_.get()) == nullptr) {
-    *ad = SSL_AD_UNRECOGNIZED_NAME;
-    return SSL_TLSEXT_ERR_ALERT_FATAL;
+TLSContext* TLSContext::SelectSNIContext(std::string_view servername) {
+  DCHECK_EQ(side_, Side::SERVER);
+  if (!servername.empty()) {
+    auto it = sni_contexts_.find(servername);
+    if (it != sni_contexts_.end()) return it->second.get();
   }
+  // No matching hostname. If this context has a certificate (from the
+  // sni['*'] wildcard identity), fall back to it. Otherwise there is no
+  // identity that can serve this connection.
+  if (SSL_CTX_get0_certificate(ctx_.get()) == nullptr) return nullptr;
+  return this;
+}
+
+int TLSContext::OnSNI(SSL* ssl, int* ad, void* arg) {
+  // The context for this host name was already selected and applied from
+  // the ClientHello. OpenSSL only needs the extension acknowledged here.
   return SSL_TLSEXT_ERR_OK;
 }
 
@@ -726,7 +736,7 @@ bool TLSContext::AddSNIContext(Environment* env,
 bool TLSContext::SetSNIContexts(
     Environment* env, const std::unordered_map<std::string, Options>& entries) {
   DCHECK_EQ(side_, Side::SERVER);
-  std::unordered_map<std::string, std::shared_ptr<TLSContext>> new_contexts;
+  decltype(sni_contexts_) new_contexts;
   for (const auto& [hostname, options] : entries) {
     auto ctx = std::make_shared<TLSContext>(env, Side::SERVER, options);
     if (!*ctx) return false;
@@ -828,7 +838,7 @@ const TLSContext::Options TLSContext::Options::kDefault = {};
 
 // ============================================================================
 
-const TLSSession& TLSSession::From(const SSL* ssl) {
+TLSSession& TLSSession::From(const SSL* ssl) {
   auto ref = static_cast<ngtcp2_crypto_conn_ref*>(SSL_get_app_data(ssl));
   CHECK_NOT_NULL(ref);
   return *static_cast<TLSSession*>(ref->user_data);
@@ -1029,12 +1039,19 @@ MaybeLocal<Value> TLSSession::cipher_version(Environment* env) const {
 }
 
 const std::string_view TLSSession::servername() const {
+  // A server caches the name from the ClientHello, which is available
+  // earlier than SSL_get_servername() and stays available while the
+  // handshake is paused. A client just reports what it asked for.
+  if (context_->side() == Side::SERVER) return servername_;
   SSLPointerRef ssl(ossl_context_);
   return ssl->getServerName().value_or(std::string_view());
 }
 
 const std::string TLSSession::protocol() const {
   CHECK(ossl_context_);
+  // As with servername(), a server has the answer cached from the
+  // ClientHello; a client learns it from the ServerHello.
+  if (context_->side() == Side::SERVER) return alpn_;
   return ossl_context_.get_selected_alpn();
 }
 
diff --git a/src/quic/tlscontext.h b/src/quic/tlscontext.h
index f1d6451bcfa7..8209eda12dbc 100644
--- a/src/quic/tlscontext.h
+++ b/src/quic/tlscontext.h
@@ -3,6 +3,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <base_object.h>
+#include <crypto/crypto_client_hello.h>
 #include <crypto/crypto_context.h>
 #include <crypto/crypto_keys.h>
 #include <memory_tracker.h>
@@ -91,7 +92,7 @@ class TLSSession final : public MemoryRetainer {
   // for each.
 
   // Gets the TLSSession from the SSL pointer app data.
-  static const TLSSession& From(const SSL* ssl);
+  static TLSSession& From(const SSL* ssl);
 
   // The constructor is public in order to satisfy the call to std::make_unique
   // in TLSContext::NewSession. It should not be called directly.
@@ -124,6 +125,38 @@ class TLSSession final : public MemoryRetainer {
   // The ALPN (protocol name) negotiated for the session
   const std::string protocol() const;
 
+  // Server-side early selection. A server picks the SNI context and the
+  // ALPN protocol from the ClientHello itself, before the TLS library
+  // reaches ticket decryption and early data, and holds the handshake
+  // there while the Session is handed to JavaScript. The results are
+  // cached here because the SSL object does not carry them until the
+  // later servername/ALPN callbacks run, which is after the pause.
+  //
+  // The state is explicit because the ClientHello callback can run more
+  // than once per handshake: the TLS stack restarts ClientHello
+  // processing when the handshake is resumed, and ngtcp2 can hand it
+  // further CRYPTO data - a reordered chunk replayed by
+  // conn_emit_pending_crypto_data, another CRYPTO frame in the same
+  // packet - while the handshake is still suspended. Only kPending does
+  // the work; kSelected keeps the handshake suspended until the Session
+  // has been surfaced.
+  enum class EarlySelection : uint8_t {
+    // Nothing selected yet.
+    kPending,
+    // Selected, and the handshake is suspended waiting for the Session
+    // to be handed to JavaScript.
+    kSelected,
+    // The Session has been surfaced; the handshake may run on.
+    kComplete,
+  };
+  inline EarlySelection early_selection() const { return early_selection_; }
+  inline void set_early_selection(EarlySelection state) {
+    early_selection_ = state;
+  }
+  inline void set_servername(std::string_view name) { servername_ = name; }
+  inline void set_alpn(std::string_view alpn) { alpn_ = alpn; }
+  inline const std::string& alpn() const { return alpn_; }
+
   // Triggers key update to begin. This will fail and return false if either a
   // previous key update is in progress or if the initial handshake has not yet
   // been confirmed.
@@ -161,6 +194,9 @@ class TLSSession final : public MemoryRetainer {
   Session* session_;
   ncrypto::BIOPointer bio_trace_;
   std::string validation_error_ = "";
+  std::string servername_;
+  std::string alpn_;
+  EarlySelection early_selection_ = EarlySelection::kPending;
 };
 
 // The TLSContext is used to create a TLSSession. For the client, there is
@@ -326,6 +362,17 @@ class TLSContext final : public MemoryRetainer,
   ncrypto::SSLCtxPointer Initialize(Environment* env);
   operator SSL_CTX*() const;
 
+  // Returns the context to use for the requested host name, which is this
+  // context when nothing more specific matches. Returns nullptr when the
+  // connection cannot be served at all.
+  TLSContext* SelectSNIContext(std::string_view servername);
+
+  // Performs the server's early selection: SNI, then ALPN, then the
+  // Application, and then suspends the handshake. See the comment on
+  // TLSSession::EarlySelection.
+  static crypto::ClientHelloResult OnClientHello(
+      const crypto::ClientHelloContext& hello);
+
   static void OnKeylog(const SSL* ssl, const char* line);
   static int OnNewSession(SSL* ssl, SSL_SESSION* session);
   static int OnSelectAlpn(SSL* ssl,
@@ -337,13 +384,26 @@ class TLSContext final : public MemoryRetainer,
   static int OnVerifyClientCertificate(int preverify_ok, X509_STORE_CTX* ctx);
   static int OnSNI(SSL* ssl, int* ad, void* arg);
 
+  // Lets sni_contexts_ be looked up by string_view, so a connection that
+  // sends SNI does not have to build a std::string key to find its identity.
+  struct StringHash {
+    using is_transparent = void;
+    size_t operator()(std::string_view value) const {
+      return std::hash<std::string_view>{}(value);
+    }
+  };
+
   Side side_;
   Options options_;
   ncrypto::X509Pointer cert_;
   ncrypto::X509Pointer issuer_;
   std::string validation_error_ = "";
   ncrypto::SSLCtxPointer ctx_;
-  std::unordered_map<std::string, std::shared_ptr<TLSContext>> sni_contexts_;
+  std::unordered_map<std::string,
+                     std::shared_ptr<TLSContext>,
+                     StringHash,
+                     std::equal_to<>>
+      sni_contexts_;
 
   friend class TLSSession;
 };
diff --git a/src/string_bytes.cc b/src/string_bytes.cc
index 88b499fb4289..6e628b907e66 100644
--- a/src/string_bytes.cc
+++ b/src/string_bytes.cc
@@ -60,7 +60,6 @@ class ExternString: public ResourceType {
   ~ExternString() override {
     free(const_cast<TypeName*>(data_));
     external_memory_accounter_->Decrease(isolate(), byte_length());
-    delete external_memory_accounter_;
   }
 
   const TypeName* data() const override {
@@ -126,7 +125,7 @@ class ExternString: public ResourceType {
  private:
   ExternString(Isolate* isolate, const TypeName* data, size_t length)
       : isolate_(isolate),
-        external_memory_accounter_(new ExternalMemoryAccounter()),
+        external_memory_accounter_(std::make_unique<ExternalMemoryAccounter>()),
         data_(data),
         length_(length) {
     external_memory_accounter_->Increase(isolate, byte_length());
@@ -140,7 +139,7 @@ class ExternString: public ResourceType {
                                              size_t length);
 
   Isolate* isolate_;
-  ExternalMemoryAccounter* external_memory_accounter_;
+  std::unique_ptr<ExternalMemoryAccounter> external_memory_accounter_;
   const TypeName* data_;
   size_t length_;
 };
@@ -534,8 +533,10 @@ Maybe<size_t> StringBytes::Size(Isolate* isolate,
         return Just<size_t>(simdutf::utf8_length_from_latin1(
             reinterpret_cast<const char*>(view.data8()), view.length()));
       }
-      return Just<size_t>(simdutf::utf8_length_from_utf16(
-          reinterpret_cast<const char16_t*>(view.data16()), view.length()));
+      return Just<size_t>(
+          simdutf::utf8_length_from_utf16_with_replacement(
+              reinterpret_cast<const char16_t*>(view.data16()), view.length())
+              .count);
 
     case UCS2:
       return Just(view.length() * sizeof(uint16_t));
diff --git a/src/undici_version.h b/src/undici_version.h
index 8afd91ad6f9a..3dd10c8a2aa7 100644
--- a/src/undici_version.h
+++ b/src/undici_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-undici.sh
 #ifndef SRC_UNDICI_VERSION_H_
 #define SRC_UNDICI_VERSION_H_
-#define UNDICI_VERSION "8.10.0"
+#define UNDICI_VERSION "8.10.2"
 #endif  // SRC_UNDICI_VERSION_H_
diff --git a/src/zlib_version.h b/src/zlib_version.h
index 861b339e2bfc..a9d28e3a7cd4 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.2.1-motley-8002e91"
+#define ZLIB_VERSION "1.3.2.1-motley-5eb4d7e"
 #endif  // SRC_ZLIB_VERSION_H_
diff --git a/test/addons/addons.status b/test/addons/addons.status
index 18b1c2b2157d..60a33ec9acc6 100644
--- a/test/addons/addons.status
+++ b/test/addons/addons.status
@@ -14,6 +14,7 @@ openssl-binding/test: PASS,FLAKY
 openssl-binding/test: SKIP
 openssl-get-ssl-ctx/test: SKIP
 openssl-providers/test-default-only-config: SKIP
+openssl-providers/test-default-properties-config: SKIP
 openssl-providers/test-legacy-provider-config: SKIP
 openssl-providers/test-legacy-provider-inactive-config: SKIP
 openssl-providers/test-legacy-provider-option: SKIP
diff --git a/test/addons/openssl-binding/binding.gyp b/test/addons/openssl-binding/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-binding/binding.gyp
+++ b/test/addons/openssl-binding/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-get-ssl-ctx/binding.gyp b/test/addons/openssl-get-ssl-ctx/binding.gyp
index 46a558e12030..a405ba25bbe7 100644
--- a/test/addons/openssl-get-ssl-ctx/binding.gyp
+++ b/test/addons/openssl-get-ssl-ctx/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/binding.gyp b/test/addons/openssl-providers/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-providers/binding.gyp
+++ b/test/addons/openssl-providers/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index efa1019c62d9..fc0f93ef45c8 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -10,7 +10,13 @@ if (!hasOpenSSL3) {
   common.skip('this test requires OpenSSL 3.x');
 }
 const assert = require('node:assert');
-const { createHash, getCiphers, getHashes } = require('node:crypto');
+const {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  getCiphers,
+  getHashes,
+} = require('node:crypto');
 const { debuglog } = require('node:util');
 const { getProviders } = require(`./build/${common.buildType}/binding`);
 
@@ -20,11 +26,45 @@ const { getProviders } = require(`./build/${common.buildType}/binding`);
 // supported by the provider.
 const providers = {
   'default': {
-    ciphers: ['des3-wrap'],
-    hashes: ['sha512-256'],
+    ciphers: [
+      {
+        name: 'aes-128-cbc-cts',
+        keyLength: 16,
+        ivLength: 16,
+        plaintextLength: 32,
+        unavailableCode: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+      },
+      {
+        name: 'des3-wrap',
+        keyLength: 24,
+        ivLength: null,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+    ],
+    hashes: [
+      'sha512-256',
+      ...['keccak-kmac-128', 'keccak-kmac128']
+        .filter((name) => getHashes().includes(name)),
+    ],
   },
   'legacy': {
-    ciphers: ['blowfish', 'idea'],
+    ciphers: [
+      {
+        name: 'blowfish',
+        keyLength: 16,
+        ivLength: 8,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+      {
+        name: 'idea',
+        keyLength: 16,
+        ivLength: 8,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+    ],
     hashes: ['md4', 'whirlpool'],
   },
 };
@@ -47,17 +87,50 @@ function assertArrayIncludes(array, item, desc) {
          `${desc} [${array}] does not include "${item}"`);
 }
 
+function createSupportedHash(hash) {
+  try {
+    return createHash(hash);
+  } catch (err) {
+    if (err?.code !== 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH') throw err;
+    return createHash(hash, { outputLength: 32 });
+  }
+}
+
+function assertCipherRoundTrip({
+  name,
+  keyLength,
+  ivLength,
+  plaintextLength,
+}) {
+  const key = Buffer.alloc(keyLength, 0x42);
+  const iv = ivLength === null ? null : Buffer.alloc(ivLength, 0x24);
+  const plaintext = Buffer.alloc(plaintextLength, 0x61);
+
+  const cipher = createCipheriv(name, key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final(),
+  ]);
+  const decipher = createDecipheriv(name, key, iv);
+  const received = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]);
+  assert.deepStrictEqual(received, plaintext);
+}
+
 function testProviderPresent(provider) {
   debug(`Checking '${provider}' is present`);
   assertArrayIncludes(getProviders(), provider, 'Loaded providers');
   for (const cipher of providers[provider].ciphers || []) {
-    debug(`Checking '${cipher}' cipher is available`);
-    assertArrayIncludes(getCiphers(), cipher, 'Available ciphers');
+    debug(`Checking '${cipher.name}' cipher is available`);
+    assertArrayIncludes(getCiphers(), cipher.name, 'Available ciphers');
+    assertCipherRoundTrip(cipher);
   }
   for (const hash of providers[provider].hashes || []) {
     debug(`Checking '${hash}' hash is available`);
     assertArrayIncludes(getHashes(), hash, 'Available hashes');
-    createHash(hash);
+    createSupportedHash(hash);
   }
 }
 
@@ -65,8 +138,14 @@ function testProviderAbsent(provider) {
   debug(`Checking '${provider}' is absent`);
   assertArrayDoesNotInclude(getProviders(), provider, 'Loaded providers');
   for (const cipher of providers[provider].ciphers || []) {
-    debug(`Checking '${cipher}' cipher is unavailable`);
-    assertArrayDoesNotInclude(getCiphers(), cipher, 'Available ciphers');
+    const { name, keyLength, ivLength, unavailableCode } = cipher;
+    debug(`Checking '${name}' cipher is unavailable`);
+    assertArrayDoesNotInclude(getCiphers(), name, 'Available ciphers');
+    const key = Buffer.alloc(keyLength, 0x42);
+    const iv = ivLength === null ? null : Buffer.alloc(ivLength, 0x24);
+    assert.throws(() => createCipheriv(name, key, iv), {
+      code: unavailableCode,
+    });
   }
   for (const hash of providers[provider].hashes || []) {
     debug(`Checking '${hash}' hash is unavailable`);
diff --git a/test/addons/openssl-providers/test-default-properties-config.js b/test/addons/openssl-providers/test-default-properties-config.js
new file mode 100644
index 000000000000..43f42864def4
--- /dev/null
+++ b/test/addons/openssl-providers/test-default-properties-config.js
@@ -0,0 +1,158 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../../common');
+const fixtures = require('../../common/fixtures');
+const providers = require('./providers.cjs');
+
+const assert = require('node:assert');
+const { fork } = require('node:child_process');
+const {
+  createHash,
+  getHashes,
+  hash: oneShotHash,
+  setFips,
+} = require('node:crypto');
+const { Worker } = require('node:worker_threads');
+const { getHashCache } = require('internal/crypto/util');
+const option = `--openssl-config=${fixtures.path(
+  'openssl3-conf',
+  'default_properties.cnf',
+)}`;
+
+if (!process.execArgv.includes(option)) {
+  const cp = fork(__filename, { execArgv: [...process.execArgv, option] });
+  cp.on('exit', common.mustCall((code, signal) => {
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  }));
+  return;
+}
+
+assert(providers.getCurrentProviders().includes('default'));
+assert(providers.getCurrentProviders().includes('legacy'));
+providers.testProviderPresent('default');
+
+const hashes = getHashes();
+const input = Buffer.alloc(0);
+const md5 = 'd41d8cd98f00b204e9800998ecf8427e';
+assert.strictEqual(createHash('md5').update(input).digest('hex'), md5);
+assert.strictEqual(oneShotHash('md5', input), md5);
+
+const hashName = 'SHA256';
+const hashCache = getHashCache();
+const descriptor = Object.getOwnPropertyDescriptor(hashCache, hashName);
+assert(descriptor);
+const cacheId = descriptor.value;
+const sentinel = new Error('hash cache setter');
+const throwsSentinel = (err) => err === sentinel;
+
+function installThrowingHashCacheEntry(id) {
+  Object.defineProperty(hashCache, hashName, {
+    __proto__: null,
+    configurable: true,
+    enumerable: descriptor.enumerable,
+    get() { return id; },
+    set() { throw sentinel; },
+  });
+}
+
+installThrowingHashCacheEntry(-1);
+assert.throws(() => createHash(hashName), throwsSentinel);
+assert.throws(() => oneShotHash(hashName, input), throwsSentinel);
+Object.defineProperty(hashCache, hashName, descriptor);
+
+installThrowingHashCacheEntry(cacheId);
+setFips(true);
+assert.throws(() => createHash(hashName), throwsSentinel);
+assert.throws(() => oneShotHash(hashName, input), throwsSentinel);
+Object.defineProperty(hashCache, hashName, descriptor);
+assert.deepStrictEqual(getHashes(), []);
+assert.throws(
+  () => createHash('md5'),
+  { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+);
+assert.throws(
+  () => oneShotHash('md5', input),
+  { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+);
+
+setFips(false);
+assert.deepStrictEqual(getHashes(), hashes);
+assert.strictEqual(createHash('md5').update(input).digest('hex'), md5);
+assert.strictEqual(oneShotHash('md5', input), md5);
+
+for (const hash of ['md4', 'whirlpool']) {
+  assert(!hashes.includes(hash));
+  assert.throws(() => createHash(hash), { code: 'ERR_OSSL_EVP_UNSUPPORTED' });
+}
+
+const worker = new Worker(`
+  'use strict';
+  const {
+    createHash,
+    getHashes,
+    hash,
+  } = require('node:crypto');
+  const { parentPort } = require('node:worker_threads');
+
+  const input = Buffer.alloc(0);
+  const hashes = getHashes();
+  const liveHash = createHash('md5').update(input);
+  hash('md5', input);
+  parentPort.postMessage({ phase: 'warm' });
+
+  function getErrorCode(fn) {
+    try {
+      fn();
+    } catch (err) {
+      return err.code;
+    }
+  }
+
+  parentPort.on('message', (phase) => {
+    if (phase === 'fips-on') {
+      parentPort.postMessage({
+        phase,
+        createHashError: getErrorCode(() => createHash('md5')),
+        oneShotHashError: getErrorCode(() => hash('md5', input)),
+        hashes: getHashes(),
+        liveDigest: liveHash.digest('hex'),
+      });
+    } else {
+      parentPort.postMessage({
+        phase,
+        createHashDigest: createHash('md5').update(input).digest('hex'),
+        oneShotHashDigest: hash('md5', input),
+        hashes: getHashes(),
+      });
+      parentPort.close();
+    }
+  });
+`, { eval: true });
+
+worker.once('message', common.mustCall((message) => {
+  assert.strictEqual(message.phase, 'warm');
+  setFips(true);
+
+  worker.once('message', common.mustCall((message) => {
+    assert.strictEqual(message.phase, 'fips-on');
+    assert.strictEqual(message.createHashError, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.strictEqual(message.oneShotHashError, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.deepStrictEqual(message.hashes, []);
+    assert.strictEqual(message.liveDigest, md5);
+
+    setFips(false);
+
+    worker.once('message', common.mustCall((message) => {
+      assert.strictEqual(message.phase, 'fips-off');
+      assert.strictEqual(message.createHashDigest, md5);
+      assert.strictEqual(message.oneShotHashDigest, md5);
+      assert.deepStrictEqual(message.hashes, hashes);
+    }));
+    worker.postMessage('fips-off');
+  }));
+  worker.postMessage('fips-on');
+}));
+worker.on('error', common.mustNotCall());
+worker.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));
diff --git a/test/addons/zlib-binding/binding.gyp b/test/addons/zlib-binding/binding.gyp
index f6a822d47e9c..5bd4f999218b 100644
--- a/test/addons/zlib-binding/binding.gyp
+++ b/test/addons/zlib-binding/binding.gyp
@@ -9,6 +9,9 @@
             'aix_variant_name': '<!(uname -s)',
           },
           'conditions': [
+            [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+              'type': 'none',
+            }],
             [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
               'sources': ['binding.cc'],
               'include_dirs': ['../../../deps/zlib'],
diff --git a/test/benchmark/test-benchmark-vfs.js b/test/benchmark/test-benchmark-vfs.js
new file mode 100644
index 000000000000..47988ddd5fdb
--- /dev/null
+++ b/test/benchmark/test-benchmark-vfs.js
@@ -0,0 +1,7 @@
+'use strict';
+
+require('../common');
+
+const runBenchmark = require('../common/benchmark');
+
+runBenchmark('vfs');
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 109e224f788d..449d7d38750b 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -1,6 +1,7 @@
 #include "libplatform/libplatform.h"
 #include "node_buffer.h"
 #include "node_internals.h"
+#include "node_realm-inl.h"
 #include "node_url.h"
 #include "util.h"
 
@@ -28,6 +29,12 @@ static void at_exit_callback_ordered2(void* arg);
 static void at_exit_js(void* arg);
 static std::string cb_1_arg;  // NOLINT(runtime/string)
 
+struct SelfRemovingCleanupHookState {
+  v8::Isolate* isolate;
+  bool ran = false;
+};
+static void self_removing_cleanup_hook(void* arg);
+
 class EnvironmentTest : public EnvironmentTestFixture {
  private:
   void TearDown() override {
@@ -310,6 +317,27 @@ TEST_F(EnvironmentTest, AtExitRunsJS) {
   EXPECT_TRUE(called_at_exit_js);
 }
 
+// A cleanup hook that removes itself while the environment cleanup queue is
+// being drained must not cause a use-after-free. This registers such a hook
+// directly rather than through node::ObjectWrap, whose destructor removes
+// its own hook and is what makes this reachable for addons since #63642.
+// The use-after-free is silent in ordinary builds; it is caught by the
+// ASan/Valgrind CI, which is also how the original assertion (#63923)
+// surfaced. Regression test for https://github.com/nodejs/node/issues/65195.
+TEST_F(EnvironmentTest, RemoveEnvironmentCleanupHookDuringCleanup) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  SelfRemovingCleanupHookState state{isolate_};
+  {
+    Env env{handle_scope, argv};
+    node::AddEnvironmentCleanupHook(
+        isolate_, self_removing_cleanup_hook, &state);
+    // Destroying `env` runs FreeEnvironment() -> RunCleanup(), which drains
+    // the cleanup queue and invokes CleanupHookThunkRun() for the hook above.
+  }
+  EXPECT_TRUE(state.ran);
+}
+
 TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   const v8::HandleScope handle_scope(isolate_);
   const Argv argv;
@@ -393,6 +421,19 @@ static void at_exit_js(void* arg) {
   called_at_exit_js = true;
 }
 
+// Reproduces the sequence node::ObjectWrap performs since
+// https://github.com/nodejs/node/pull/63642, without using ObjectWrap
+// itself: the hook removes its own environment cleanup hook. When that runs
+// while the cleanup queue is being drained, CleanupHookThunkRun() must not
+// read the CleanupHookThunk after invoking the hook -- the hook has already
+// erased and freed it. See https://github.com/nodejs/node/issues/65195.
+static void self_removing_cleanup_hook(void* arg) {
+  auto* state = static_cast<SelfRemovingCleanupHookState*>(arg);
+  state->ran = true;
+  node::RemoveEnvironmentCleanupHook(
+      state->isolate, self_removing_cleanup_hook, state);
+}
+
 TEST_F(EnvironmentTest, SetImmediateCleanup) {
   int called = 0;
   int called_unref = 0;
@@ -869,6 +910,41 @@ TEST_F(EnvironmentTest, RequestInterruptAtExit) {
   context->Exit();
 }
 
+TEST_F(EnvironmentTest, EmbedderBuiltinCodeCache) {
+  v8::HandleScope handle_scope(isolate_);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> entries =
+      node::EmbedderBuiltinCodeCache::Generate(context);
+  ASSERT_GT(entries.size(), 100u);
+  {
+    node::EmbedderBuiltinCodeCache cache(std::move(entries));
+    EXPECT_EQ(node::SetBuiltinCodeCache(isolate_data_, &cache),
+              v8::ScriptCompiler::CachedData::kSuccess);
+  }
+  std::unique_ptr<node::Environment, decltype(&node::FreeEnvironment)> env(
+      node::CreateEnvironment(isolate_data_, context, {}, {}),
+      node::FreeEnvironment);
+  node::Realm* realm = env->principal_realm();
+  EXPECT_EQ(realm->builtins_with_cache.count("internal/bootstrap/node"), 1u);
+  for (const std::string& id : realm->builtins_without_cache) {
+    EXPECT_EQ(id.rfind("internal/per_context/", 0), 0u) << id;
+  }
+
+  uint8_t* bytes = new uint8_t[64]();
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> bad;
+  bad.push_back({"internal/bootstrap/node",
+                 std::make_unique<v8::ScriptCompiler::CachedData>(
+                     bytes, 64, v8::ScriptCompiler::CachedData::BufferOwned)});
+  node::EmbedderBuiltinCodeCache bad_cache(std::move(bad));
+  EXPECT_NE(node::SetBuiltinCodeCache(isolate_data_, &bad_cache),
+            v8::ScriptCompiler::CachedData::kSuccess);
+  EXPECT_FALSE(isolate_data_->builtin_code_cache().empty());
+  node::SetBuiltinCodeCache(isolate_data_, nullptr);
+  EXPECT_TRUE(isolate_data_->builtin_code_cache().empty());
+}
+
 TEST_F(EnvironmentTest, EmbedderPreload) {
   v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = node::NewContext(isolate_);
diff --git a/test/cctest/test_node_api.cc b/test/cctest/test_node_api.cc
index 902776c157e9..29f1f3098fe4 100644
--- a/test/cctest/test_node_api.cc
+++ b/test/cctest/test_node_api.cc
@@ -40,3 +40,109 @@ TEST_F(NodeApiTest, CreateNodeApiEnv) {
   node_napi_env internal_env = reinterpret_cast<node_napi_env>(addon_env);
   EXPECT_EQ(internal_env->node_env(), env);
 }
+
+namespace {
+
+struct ContextCheckState {
+  napi_async_work work = nullptr;
+  bool complete_called = false;
+  bool complete_in_own_context = false;
+  bool call_js_called = false;
+  bool call_js_in_own_context = false;
+  bool tsfn_finalize_called = false;
+  bool tsfn_finalize_in_own_context = false;
+};
+
+bool InOwnContext(napi_env env) {
+  node_napi_env internal_env = reinterpret_cast<node_napi_env>(env);
+  return internal_env->isolate->GetCurrentContext() == internal_env->context();
+}
+
+}  // namespace
+
+TEST_F(NodeApiTest, AsyncCallbacksEnterOwnContext) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+
+  Env env1{handle_scope, argv};
+  node::LoadEnvironment(*env1, "");
+  Env env2{handle_scope, argv, node::EnvironmentFlags::kNoFlags};
+  node::LoadEnvironment(*env2, "");
+  ASSERT_EQ(isolate_->GetCurrentContext(), env2.context());
+
+  ContextCheckState state;
+  {
+    v8::Context::Scope context_scope(env1.context());
+    napi_addon_register_func init = [](napi_env env, napi_value exports) {
+      addon_env = env;
+      return exports;
+    };
+    addon_env = nullptr;
+    napi_module_register_by_symbol(Object::New(isolate_),
+                                   Object::New(isolate_),
+                                   env1.context(),
+                                   init,
+                                   NAPI_VERSION);
+    ASSERT_NE(addon_env, nullptr);
+
+    napi_value resource_name;
+    ASSERT_EQ(napi_create_string_utf8(
+                  addon_env, "cctest", NAPI_AUTO_LENGTH, &resource_name),
+              napi_ok);
+
+    ASSERT_EQ(napi_create_async_work(
+                  addon_env,
+                  nullptr,
+                  resource_name,
+                  [](napi_env env, void* data) {},
+                  [](napi_env env, napi_status status, void* data) {
+                    auto* state = static_cast<ContextCheckState*>(data);
+                    state->complete_called = true;
+                    state->complete_in_own_context = InOwnContext(env);
+                    napi_delete_async_work(env, state->work);
+                  },
+                  &state,
+                  &state.work),
+              napi_ok);
+    ASSERT_EQ(napi_queue_async_work(addon_env, state.work), napi_ok);
+
+    napi_threadsafe_function tsfn;
+    ASSERT_EQ(napi_create_threadsafe_function(
+                  addon_env,
+                  nullptr,
+                  nullptr,
+                  resource_name,
+                  0,
+                  1,
+                  &state,
+                  [](napi_env env, void* finalize_data, void* hint) {
+                    auto* state =
+                        static_cast<ContextCheckState*>(finalize_data);
+                    state->tsfn_finalize_called = true;
+                    state->tsfn_finalize_in_own_context = InOwnContext(env);
+                  },
+                  &state,
+                  [](napi_env env, napi_value cb, void* context, void* data) {
+                    auto* state = static_cast<ContextCheckState*>(context);
+                    state->call_js_called = true;
+                    state->call_js_in_own_context = InOwnContext(env);
+                  },
+                  &tsfn),
+              napi_ok);
+    ASSERT_EQ(napi_call_threadsafe_function(tsfn, nullptr, napi_tsfn_blocking),
+              napi_ok);
+    ASSERT_EQ(napi_release_threadsafe_function(tsfn, napi_tsfn_release),
+              napi_ok);
+  }
+
+  ASSERT_EQ(isolate_->GetCurrentContext(), env2.context());
+  uv_run(&current_loop, UV_RUN_DEFAULT);
+
+  EXPECT_TRUE(state.complete_called);
+  EXPECT_TRUE(state.complete_in_own_context);
+  EXPECT_TRUE(state.call_js_called);
+  EXPECT_TRUE(state.call_js_in_own_context);
+  EXPECT_TRUE(state.tsfn_finalize_called);
+  EXPECT_TRUE(state.tsfn_finalize_in_own_context);
+  EXPECT_EQ(isolate_->GetCurrentContext(), env2.context());
+}
diff --git a/test/cctest/test_per_process.cc b/test/cctest/test_per_process.cc
index 7a6f53d56222..937e9cab54dd 100644
--- a/test/cctest/test_per_process.cc
+++ b/test/cctest/test_per_process.cc
@@ -4,18 +4,45 @@
 #include "gtest/gtest.h"
 #include "node_test_fixture.h"
 
+#include <algorithm>
+#include <memory>
 #include <string>
+#include <vector>
 
+using node::builtins::BuiltinCodeCacheData;
 using node::builtins::BuiltinLoader;
 using node::builtins::BuiltinSourceMap;
+using node::builtins::CodeCacheInfo;
 
 class PerProcessTest : public ::testing::Test {
  protected:
   static const BuiltinSourceMap get_sources_for_test() {
     return *BuiltinLoader().source_.read();
   }
+
+  // id -> first byte of the cached data, after feeding `batches` in order.
+  static std::vector<std::pair<std::string, uint8_t>> RefreshCodeCacheWith(
+      const std::vector<std::vector<CodeCacheInfo>>& batches) {
+    BuiltinLoader loader;
+    for (const auto& batch : batches) loader.RefreshCodeCache(batch);
+    std::vector<std::pair<std::string, uint8_t>> out;
+    node::RwLock::ScopedReadLock lock(loader.code_cache_->mutex);
+    EXPECT_TRUE(loader.code_cache_->has_code_cache);
+    for (const auto& [id, data] : loader.code_cache_->map) {
+      out.emplace_back(id, data.data[0]);
+    }
+    std::sort(out.begin(), out.end());
+    return out;
+  }
 };
 
+CodeCacheInfo MakeCodeCacheInfo(const std::string& id, uint8_t marker) {
+  auto* bytes = new uint8_t[4]{marker, marker, marker, marker};
+  auto cached_data = std::make_shared<v8::ScriptCompiler::CachedData>(
+      bytes, 4, v8::ScriptCompiler::CachedData::BufferOwned);
+  return CodeCacheInfo{id, BuiltinCodeCacheData(std::move(cached_data))};
+}
+
 namespace {
 
 TEST_F(PerProcessTest, EmbeddedSources) {
@@ -29,4 +56,22 @@ TEST_F(PerProcessTest, EmbeddedSources) {
   })) << "BuiltinLoader::source_ should have some 16bit items";
 }
 
+// RefreshCodeCache() merges: it can be fed the snapshot's code cache and then
+// an embedder's, and the entry supplied last wins for a shared id.
+TEST_F(PerProcessTest, RefreshCodeCacheMerges) {
+  const auto merged = PerProcessTest::RefreshCodeCacheWith({
+      {MakeCodeCacheInfo("internal/a", 1), MakeCodeCacheInfo("internal/b", 1)},
+      {MakeCodeCacheInfo("internal/b", 2), MakeCodeCacheInfo("embedder/c", 2)},
+  });
+  const std::vector<std::pair<std::string, uint8_t>> expected = {
+      {"embedder/c", 2}, {"internal/a", 1}, {"internal/b", 2}};
+  EXPECT_EQ(merged, expected);
+
+  // A single call still behaves as before.
+  const auto single = PerProcessTest::RefreshCodeCacheWith(
+      {{MakeCodeCacheInfo("internal/a", 7)}});
+  ASSERT_EQ(single.size(), 1u);
+  EXPECT_EQ(single[0].second, 7);
+}
+
 }  // end namespace
diff --git a/test/client-proxy/test-https-proxy-request-header-overflow.mjs b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
new file mode 100644
index 000000000000..2ffc215bafa9
--- /dev/null
+++ b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
@@ -0,0 +1,45 @@
+// This tests that the proxy server cannot send unbounded incomplete headers
+// while establishing a CONNECT tunnel.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import http from 'node:http';
+import { runProxiedRequest } from '../common/proxy-server.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const proxy = http.createServer();
+proxy.on('connect', common.mustCall((req, socket) => {
+  socket.write('HTTP/1.1 200 Connection Established\r\n');
+
+  const interval = setInterval(() => {
+    if (socket.destroyed) {
+      clearInterval(interval);
+      return;
+    }
+    socket.write('x'.repeat(100));
+  }, 10);
+  socket.on('close', () => clearInterval(interval));
+  socket.on('error', () => clearInterval(interval));
+}, 1));
+proxy.listen(0);
+await once(proxy, 'listening');
+
+const { code, signal, stderr, stdout } = await runProxiedRequest({
+  NODE_USE_ENV_PROXY: 1,
+  REQUEST_URL: 'https://localhost:1/test',
+  HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
+}, ['--max-http-header-size=1024']);
+
+assert.match(
+  stderr,
+  /ERR_PROXY_TUNNEL.*Proxy response headers exceeded 1024 bytes/,
+);
+assert.doesNotMatch(stderr, /MaxListenersExceededWarning/);
+assert.strictEqual(stdout.trim(), '');
+assert.strictEqual(code, 0);
+assert.strictEqual(signal, null);
+
+proxy.close();
diff --git a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
index 888137b9a5a6..6f27f0775aee 100644
--- a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
+++ b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
@@ -83,7 +83,9 @@ for (const testCase of testCases) {
           server.close();
           assert.deepStrictEqual(requests, expectedUrls);
           const requestLogs = logs.filter((log) => !('error' in log));
-          const errors = logs.filter((log) => 'error' in log);
+          // The client may reset a tunnel while the proxy is still relaying
+          // the upstream's TLS shutdown; that says nothing about the URLs.
+          const errors = logs.filter((log) => 'error' in log && log.error.code !== 'ECONNRESET');
           assert.deepStrictEqual(new Set(requestLogs), expectedProxyLogs);
           assert.deepStrictEqual(errors, []);
         }));
diff --git a/test/common/README.md b/test/common/README.md
index 6c8fcf42847a..193250562972 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -28,6 +28,7 @@ several other tasks:
 ## Table of contents
 
 * [ArrayStream module](#arraystream-module)
+* [Bench module](#bench-module)
 * [Benchmark module](#benchmark-module)
 * [Child process module](#child-process-module)
 * [Common module API](#common-module-api)
@@ -49,6 +50,21 @@ several other tasks:
 * [UDP pair helper](#udp-pair-helper)
 * [WPT module](#wpt-module)
 
+## Bench module
+
+The `bench` module has helpers for tests of `node:bench`.
+
+### `completeSample(b[, operations[, options]])`
+
+* `b` The `BenchContext` passed to a `node:bench` benchmark function.
+* `operations` [\<number>][<number>] Passed to `b.end()`. **Default:** `1`.
+* `options` [\<Object>][<Object>] Passed to `b.end()`.
+* return the sample returned by `b.end()`.
+
+Calls `b.start()` and `b.end()` with at least one `process.hrtime.bigint()`
+tick in between, so the sample has a non-zero duration on hosts whose
+monotonic clock is coarse.
+
 ## Benchmark module
 
 The `benchmark` module is used by tests to run benchmarks.
diff --git a/test/common/bench.js b/test/common/bench.js
new file mode 100644
index 000000000000..25d67e3a17b2
--- /dev/null
+++ b/test/common/bench.js
@@ -0,0 +1,13 @@
+'use strict';
+
+// Records a sample with start()/end() and at least one hrtime tick in
+// between, so its duration is non-zero even on hosts with a coarse clock.
+function completeSample(b, operations = 1, options = undefined) {
+  b.start();
+  const started = process.hrtime.bigint();
+  let now = started;
+  while (now === started) now = process.hrtime.bigint();
+  return b.end(operations, options);
+}
+
+module.exports = { completeSample };
diff --git a/test/common/index.js b/test/common/index.js
index 0eb8b781442d..3ec677e566d8 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -73,6 +73,7 @@ const hasSQLite = Boolean(process.versions.sqlite);
 const hasFFI = Boolean(process.config.variables.node_use_ffi);
 const hasPerfetto = Boolean(process.config.variables.v8_use_perfetto);
 
+const hasDtls = hasCrypto && !!process.features.dtls;
 const hasQuic = hasCrypto && !!process.features.quic;
 
 const hasLocalStorage = (() => {
@@ -854,8 +855,9 @@ function invalidArgTypeHelper(input) {
     return ` Received function ${input.name}`;
   }
   if (typeof input === 'object') {
-    if (input.constructor?.name) {
-      return ` Received an instance of ${input.constructor.name}`;
+    const name = input.constructor?.name;
+    if (typeof name === 'string' && name !== '') {
+      return ` Received an instance of ${name}`;
     }
     return ` Received ${inspect(input, { depth: -1 })}`;
   }
@@ -1019,6 +1021,7 @@ const common = {
   hasTemporal,
   hasFullICU,
   hasCrypto,
+  hasDtls,
   hasQuic,
   hasInspector,
   hasSQLite,
diff --git a/test/common/index.mjs b/test/common/index.mjs
index 3327ae8df9db..108cae290999 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -16,6 +16,7 @@ const {
   getBufferSources,
   getTTYfd,
   hasCrypto,
+  hasDtls,
   hasQuic,
   hasInspector,
   hasSQLite,
@@ -74,6 +75,7 @@ export {
   getPort,
   getTTYfd,
   hasCrypto,
+  hasDtls,
   hasQuic,
   hasInspector,
   hasSQLite,
diff --git a/test/common/quic.mjs b/test/common/quic.mjs
index d05ee634f5e5..dc4b094cf900 100644
--- a/test/common/quic.mjs
+++ b/test/common/quic.mjs
@@ -53,9 +53,56 @@ async function connect(address, options = {}) {
   return quic.connect(address, { alpn, verifyPeer, ...rest });
 }
 
+/**
+ * Build a deterministic payload whose content depends on absolute position.
+ *
+ * Flow control bugs frequently show up as duplicated, dropped, or reordered
+ * regions rather than as a wrong total length, so the pattern deliberately
+ * varies over a long period (not a repeating 256-byte ramp) to make such
+ * damage detectable by `hashBytes` below.
+ * @param {number} size Number of bytes to generate.
+ * @param {number} [seed] Offsets the pattern so callers can build distinct
+ *   payloads of the same length.
+ * @returns {Uint8Array}
+ */
+function makePayload(size, seed = 0) {
+  const out = new Uint8Array(size);
+  let state = (seed * 2654435761 + 1) >>> 0;
+  for (let i = 0; i < size; i++) {
+    // xorshift32 -- cheap, deterministic, and position sensitive.
+    state ^= state << 13; state >>>= 0;
+    state ^= state >>> 17;
+    state ^= state << 5; state >>>= 0;
+    out[i] = state & 0xff;
+  }
+  return out;
+}
+
+/**
+ * Order-sensitive FNV-1a 32-bit hash.
+ *
+ * Note this is deliberately not a simple additive checksum: addition is
+ * commutative, so it cannot distinguish correctly ordered data from
+ * reordered data. Flow control errors can reorder or duplicate regions
+ * while preserving the byte total, so verification needs to be sensitive to
+ * position.
+ * @param {Uint8Array} buf
+ * @returns {number} Hash as an unsigned 32-bit integer.
+ */
+function hashBytes(buf) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < buf.byteLength; i++) {
+    h ^= buf[i];
+    h = Math.imul(h, 0x01000193) >>> 0;
+  }
+  return h >>> 0;
+}
+
 export {
   key,
   cert,
   listen,
   connect,
+  makePayload,
+  hashBytes,
 };
diff --git a/test/common/wpt.js b/test/common/wpt.js
index 41c56e964f76..4ad788ae029d 100644
--- a/test/common/wpt.js
+++ b/test/common/wpt.js
@@ -8,9 +8,12 @@ const path = require('path');
 const events = require('events');
 const os = require('os');
 const { inspect } = require('util');
+const { pathToFileURL } = require('url');
 const { Worker } = require('worker_threads');
+const { fork } = require('child_process');
 
 const workerPath = path.join(__dirname, 'wpt/worker.js');
+const wptNonTestDirs = new Set(['resources', 'support', 'tools']);
 
 function getBrowserProperties() {
   const { node: version } = process.versions; // e.g. 18.13.0, 20.0.0-nightly202302078e6e215481
@@ -107,7 +110,7 @@ class WPTReport {
    * @returns {ReportResult}
    */
   getResult(spec) {
-    const name = `/${spec.getRelativePath()}${spec.variant}`;
+    const name = `/${spec.getTestPath()}`;
     if (this.results.has(name)) {
       return this.results.get(name);
     }
@@ -121,13 +124,7 @@ class WPTReport {
    */
   write() {
     this.time_end = Date.now();
-    const results = Array.from(this.results.values())
-      .map((result) => {
-        const url = new URL(result.test, 'http://wpt');
-        url.pathname = url.pathname.replace(/\.js$/, '.html');
-        result.test = url.href.slice(url.origin.length);
-        return result;
-      });
+    const results = Array.from(this.results.values());
 
     /**
      * Return required and some optional properties
@@ -194,6 +191,24 @@ class ResourceLoader {
       fixtures.path('wpt', base, url);
   }
 
+  /**
+   * Map a URL that a test would have fetched from the WPT server (an
+   * absolute path, or a path relative to the test file) to a file: URL
+   * into the fixtures directory. URLs that already have a scheme (data:,
+   * blob:, http:, ...) are returned unchanged.
+   * @param {string} from the path of the file loading this resource,
+   *   relative to the WPT folder.
+   * @param {string|URL} url the url of the resource being loaded.
+   * @returns {string}
+   */
+  mapServerURL(from, url) {
+    url = `${url}`;
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:|^\/\//.test(url)) {
+      return url;
+    }
+    return pathToFileURL(this.toRealFilePath(from, url)).href;
+  }
+
   /**
    * Load a resource in test/fixtures/wpt specified with a URL
    * @param {string} from the path of the file loading this resource,
@@ -304,18 +319,21 @@ class WPTTestSpec {
    *   'test.any.js'
    * @param {StatusRule[]} rules
    * @param {string} variant test file variant
+   * @param {'window'|'dedicatedworker'} [globalScope] generated test global
    */
-  constructor(mod, filename, rules, variant = '') {
+  constructor(mod, filename, rules, variant = '', globalScope) {
     this.module = mod;
     this.filename = filename;
     this.variant = variant;
+    this.globalScope = globalScope;
+    this.rules = [...new Set(rules)];
 
     this.requires = new Set();
     this.failedTests = [];
     this.flakyTests = [];
     this.skipReasons = [];
     this.skippedTests = [];
-    for (const item of rules) {
+    for (const item of this.rules) {
       if (item.requires.length) {
         for (const req of item.requires) {
           this.requires.add(req);
@@ -345,12 +363,63 @@ class WPTTestSpec {
    * @param {string} mod
    * @param {string} filename
    * @param {StatusRule[]} rules
-   * @returns {ReturnType<WPTTestSpec['getMeta']>[]}
+   * @param {(spec: WPTTestSpec) => StatusRule[]} [getAdditionalRules]
+   * @returns {WPTTestSpec[]}
    */
-  static from(mod, filename, rules) {
+  static from(mod, filename, rules, getAdditionalRules) {
     const spec = new WPTTestSpec(mod, filename, rules);
     const meta = spec.getMeta();
-    return meta.variant?.map((variant) => new WPTTestSpec(mod, filename, rules, variant)) || [spec];
+    const variants = meta.variant || [''];
+    const createSpec = (variant, globalScope) => {
+      let result = new WPTTestSpec(mod, filename, rules, variant, globalScope);
+      const additionalRules = getAdditionalRules?.(result) || [];
+      if (additionalRules.length > 0) {
+        result = new WPTTestSpec(
+          mod,
+          filename,
+          [...new Set([...rules, ...additionalRules])],
+          variant,
+          globalScope,
+        );
+      }
+      return result;
+    };
+
+    if (!spec.isAnyTest()) {
+      return variants.map((variant) => createSpec(variant));
+    }
+
+    const requestedGlobals = meta.global ?
+      meta.global.split(',').map((item) => item.trim()) :
+      ['window', 'dedicatedworker'];
+    const supportedGlobals = new Set();
+    for (const globalScope of requestedGlobals) {
+      if (globalScope === 'window' || globalScope === 'dedicatedworker') {
+        supportedGlobals.add(globalScope);
+      } else if (globalScope === 'worker') {
+        supportedGlobals.add('dedicatedworker');
+      }
+    }
+
+    return ['window', 'dedicatedworker']
+      .filter((globalScope) => supportedGlobals.has(globalScope))
+      .flatMap((globalScope) => variants.map(
+        (variant) => createSpec(variant, globalScope)));
+  }
+
+  /**
+   * @returns {boolean}
+   */
+  isAnyTest() {
+    return /\.any\.js$/.test(this.filename);
+  }
+
+  /**
+   * @returns {boolean}
+   */
+  isWebWorkerTest() {
+    return /\.worker\.js$/.test(this.filename) ||
+      this.globalScope === 'dedicatedworker';
   }
 
   /**
@@ -373,6 +442,41 @@ class WPTTestSpec {
     return path.join(this.module, this.filename);
   }
 
+  getStatusKey() {
+    if (this.globalScope === 'dedicatedworker') {
+      return this.filename.replace(/\.any\.js$/, '.any.worker.html');
+    }
+    if (this.globalScope === 'window') {
+      return this.filename.replace(/\.any\.js$/, '.any.html');
+    }
+    return this.filename;
+  }
+
+  getTestPath() {
+    let testPath = path.join(this.module, this.getStatusKey());
+    testPath = testPath.replace(/\.js$/, '.html');
+    return `${testPath.split(path.sep).join('/')}${this.variant}`;
+  }
+
+  /**
+   * Whether a command line argument selects this spec. Accepts the source file
+   * name, which selects every global and variant generated from it, or a test
+   * path as printed alongside the results, which selects only this one.
+   * @param {string} arg
+   * @returns {boolean}
+   */
+  isSelectedBy(arg) {
+    if (arg === this.getTestPath()) {
+      return true;
+    }
+    const [filename, variant = ''] = arg.split('?');
+    // Spec filenames are relative paths, so they use the platform separator,
+    // while the argument is written with forward slashes.
+    return filename.split(path.sep).join('/') ===
+      this.filename.split(path.sep).join('/') &&
+      (!variant || this.variant.substring(1) === variant);
+  }
+
   getAbsolutePath() {
     return fixtures.path('wpt', this.getRelativePath());
   }
@@ -389,13 +493,15 @@ class WPTTestSpec {
    * @returns {{ script?: string[]; variant?: string[]; [key: string]: string }} parsed META tags of a spec file
    */
   getMeta() {
-    const matches = this.getContent().match(/\/\/ META: .+/g);
+    // Like upstream, tolerate missing whitespace around "META:".
+    // Refs: https://github.com/web-platform-tests/wpt/blob/master/tools/manifest/sourcefile.py
+    const matches = this.getContent().match(/\/\/\s*META:\s*.+/g);
     if (!matches) {
       return {};
     }
     const result = {};
     for (const match of matches) {
-      const parts = match.match(/\/\/ META: ([^=]+?)=(.+)/);
+      const parts = match.match(/\/\/\s*META:\s*([^=]+?)=(.+)/);
       const key = parts[1];
       const value = parts[2];
       if (key === 'script' || key === 'variant') {
@@ -487,6 +593,9 @@ class StatusLoader {
       const filepath = path.join(dir, file);
       const stat = fs.statSync(filepath);
       if (stat.isDirectory()) {
+        if (wptNonTestDirs.has(file)) {
+          continue;
+        }
         const list = this.grep(filepath);
         result = result.concat(list);
       } else {
@@ -520,7 +629,15 @@ class StatusLoader {
     for (const file of list) {
       const relativePath = path.relative(subDir, file);
       const match = this.rules.match(relativePath);
-      this.specs.push(...WPTTestSpec.from(this.path, relativePath, match));
+      this.specs.push(...WPTTestSpec.from(
+        this.path,
+        relativePath,
+        match,
+        (spec) => [
+          ...this.rules.match(spec.getStatusKey()),
+          ...this.rules.match(`${spec.getStatusKey()}${spec.variant}`),
+        ],
+      ));
     }
   }
 }
@@ -537,27 +654,173 @@ const limit = (concurrency) => {
   let running = 0;
   const queue = [];
 
-  const execute = async (fn) => {
-    if (running < concurrency) {
-      running++;
-      try {
-        await fn();
-      } finally {
-        running--;
-        if (queue.length > 0) {
-          execute(queue.shift());
-        }
+  const execute = async ({ fn, resolve, reject }) => {
+    running++;
+    try {
+      resolve(await fn());
+    } catch (err) {
+      reject(err);
+    } finally {
+      running--;
+      if (queue.length > 0) {
+        execute(queue.shift());
       }
+    }
+  };
+
+  return (fn) => new Promise((resolve, reject) => {
+    const task = { fn, resolve, reject };
+    if (running < concurrency) {
+      execute(task);
     } else {
-      queue.push(fn);
+      queue.push(task);
+    }
+  });
+};
+
+function isUnexpectedPass(spec, name) {
+  return spec.failedTests.includes(name) && !spec.flakyTests.includes(name);
+}
+
+function getUnexpectedPasses(queue, results) {
+  const unexpectedPasses = [];
+  for (const spec of queue) {
+    const key = spec.getStatusKey();
+    if (results[key]?.skip) {
+      continue;
+    }
+
+    for (const expectedToFail of spec.failedTests) {
+      if (isUnexpectedPass(spec, expectedToFail) &&
+          !results[key]?.fail?.expected?.includes(expectedToFail)) {
+        unexpectedPasses.push(`${key}:${expectedToFail}`);
+      }
+    }
+  }
+  return unexpectedPasses;
+}
+
+function getHarnessErrorName(harnessStatus) {
+  if (typeof harnessStatus.stack === 'string') {
+    const name = harnessStatus.stack.split('\n', 1)[0];
+    if (name) {
+      return name;
+    }
+  }
+  return harnessStatus.message || 'WPT test harness error';
+}
+
+/**
+ * @typedef {object} SpecHandlers
+ * @property {(message: object) => void} message Handles a message from the spec.
+ * @property {(failure: { name: string, message: string, stack: string })
+ *   => boolean} failure Reports a spec that died without completing. Returns
+ *   false when the spec had already finished and the failure was ignored.
+ */
+
+/**
+ * @typedef {object} SpecHandle
+ * @property {() => void} kill Forces the spec to stop running.
+ * @property {Promise<unknown>} finished Settles once the spec has stopped.
+ */
+
+/**
+ * Run a spec on a worker thread.
+ * @param {string[]} execArgv
+ * @param {object} workerData
+ * @param {SpecHandlers} handlers
+ * @returns {SpecHandle}
+ */
+function runSpecOnThread(execArgv, workerData, handlers) {
+  const worker = new Worker(workerPath, { execArgv, workerData });
+  worker.on('message', handlers.message);
+  worker.on('error', (err) => handlers.failure({
+    name: `${err}`,
+    message: err.message,
+    stack: inspect(err),
+  }));
+  return {
+    kill: () => worker.terminate(),
+    finished: events.once(worker, 'exit').catch(() => {}),
+  };
+}
+
+/**
+ * Run a spec in a child process, so that a spec crashing the process only
+ * takes down its own run and the runner can attribute the crash to it.
+ * @param {string[]} execArgv
+ * @param {object} workerData
+ * @param {SpecHandlers} handlers
+ * @returns {SpecHandle}
+ */
+function runSpecInProcess(execArgv, workerData, handlers) {
+  const forwardStderr = execArgv.some(
+    (flag) => flag === '--inspect-brk' || flag.startsWith('--inspect-brk='));
+  const child = fork(workerPath, {
+    execArgv,
+    // Status files may skip subtests by regular expression, which JSON
+    // serialization would not preserve.
+    serialization: 'advanced',
+    stdio: ['ignore', 'inherit', 'pipe', 'ipc'],
+  });
+  child.send(workerData);
+
+  let stderr = '';
+  child.stderr.setEncoding('utf8');
+  child.stderr.on('data', (chunk) => {
+    stderr += chunk;
+    if (forwardStderr) {
+      process.stderr.write(chunk);
+    }
+  });
+
+  child.on('message', (message) => {
+    // The spec reports uncaught errors itself so that they are named the same
+    // way as they would be on the worker thread backend.
+    if (message.type === 'uncaught') {
+      handlers.failure(message.error);
+      return;
     }
+    handlers.message(message);
+  });
+  child.on('error', (err) => handlers.failure({
+    name: `${err}`,
+    message: err.message,
+    stack: inspect(err),
+  }));
+  // `close` rather than `exit` so that everything the process wrote to stderr
+  // on its way out is part of the reported failure.
+  child.on('close', (code, signal) => {
+    const name = signal ?
+      `Test process was killed by signal ${signal}` :
+      `Test process exited with code ${code}`;
+    if (!handlers.failure({ name, message: name, stack: stderr }) &&
+        stderr && !forwardStderr) {
+      process.stderr.write(stderr);
+    }
+  });
+
+  return {
+    kill: () => child.kill('SIGKILL'),
+    finished: events.once(child, 'close').catch(() => {}),
   };
+}
 
-  return execute;
+const backends = {
+  __proto__: null,
+  thread: runSpecOnThread,
+  process: runSpecInProcess,
 };
 
 class WPTRunner {
-  constructor(path, { concurrency = os.availableParallelism() - 1 || 1 } = {}) {
+  constructor(path, {
+    concurrency = os.availableParallelism() - 1 || 1,
+    backend = 'thread',
+  } = {}) {
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+      throw new TypeError('WPT concurrency must be a positive integer');
+    }
+
     // RISC-V has very limited virtual address space in the currently common
     // sv39 mode, in which we can only create a very limited number of wasm
     // memories(27 from a fresh node repl). Limit the concurrency to avoid
@@ -566,11 +829,33 @@ class WPTRunner {
       concurrency = Math.min(10, concurrency);
     }
 
+    this.inspectBrk = process.env.WPT_INSPECT !== undefined;
+
+    // The override exists so that every suite can be run either way without
+    // editing the drivers, which is how the two backends are kept compatible.
+    if (this.inspectBrk) {
+      backend = 'process';
+    } else {
+      backend = process.env.WPT_BACKEND || backend;
+    }
+    this.runSpec = backends[backend];
+    if (this.runSpec === undefined) {
+      throw new Error(`Invalid WPT backend ${backend}, expected one of ` +
+                      `${Object.keys(backends).join(', ')}`);
+    }
+
     this.path = path;
     this.resource = new ResourceLoader(path);
     this.concurrency = concurrency;
 
-    this.flags = [];
+    // Since we need to prepare the Web Worker APIs
+    // in the harness that runs on all WPT workers,
+    // we enable the API globally. This has no practical
+    // effect on the non-web-worker tests, however.
+    this.flags = ['--experimental-web-worker'];
+    if (this.inspectBrk) {
+      this.flags.push('--inspect-brk=0');
+    }
     this.globalThisInitScripts = [];
     this.initScript = null;
 
@@ -581,8 +866,9 @@ class WPTRunner {
 
     this.results = {};
     this.inProgress = new Set();
-    this.workers = new Map();
+    this.handles = new Map();
     this.unexpectedFailures = [];
+    this.skippedSpecCount = 0;
 
     this.subtestCounts = { passed: 0, failed: 0, expectedFailures: 0, skipped: 0, unexpectedPasses: 0 };
 
@@ -596,7 +882,7 @@ class WPTRunner {
    * @param {string[]} flags
    */
   setFlags(flags) {
-    this.flags = flags;
+    this.flags = this.flags.concat(flags);
   }
 
   /**
@@ -620,7 +906,7 @@ class WPTRunner {
    * @returns {string}
    */
   fullInitScript(spec) {
-    const url = new URL(`/${spec.getRelativePath().replace(/\.js$/, '.html')}${spec.variant}`, 'http://wpt');
+    const url = new URL(`/${spec.getTestPath()}`, 'http://wpt');
     const title = spec.getMeta().title;
     let { initScript } = this;
 
@@ -634,6 +920,10 @@ class WPTRunner {
       return initScript;
     }
 
+    if (spec.isWebWorkerTest()) {
+      return initScript;
+    }
+
     const globalThisInitScript = this.globalThisInitScripts.join('\n\n//===\n');
 
     if (initScript === null) {
@@ -671,6 +961,7 @@ class WPTRunner {
     const queue = this.buildQueue();
 
     const run = limit(this.concurrency);
+    const jobs = [];
 
     for (const spec of queue) {
       const content = spec.getContent();
@@ -679,9 +970,17 @@ class WPTRunner {
       const absolutePath = spec.getAbsolutePath();
       const relativePath = spec.getRelativePath();
       const harnessPath = fixtures.path('wpt', 'resources', 'testharness.js');
-
-      // Scripts specified with the `// META: script=` header
-      const scriptsToRun = meta.script?.map((script) => {
+      // *.worker.js tests are dedicated worker tests by definition. Each
+      // dedicated worker variant generated from a multi-global (*.any.js)
+      // test also runs inside an actual Web Worker. Refs:
+      // https://web-platform-tests.org/writing-tests/testharness.html#multi-global-tests
+      const isAnyTest = spec.isAnyTest();
+      const isWebWorkerTest = spec.isWebWorkerTest();
+
+      // Scripts specified with the `// META: script=` header. For tests
+      // that run inside a Web Worker they are imported by the worker
+      // instead.
+      const scriptsToRun = isWebWorkerTest ? [] : meta.script?.map((script) => {
         const obj = {
           filename: this.resource.toRealFilePath(relativePath, script),
           code: this.resource.read(relativePath, script),
@@ -689,74 +988,77 @@ class WPTRunner {
         this.scriptsModifier?.(obj);
         return obj;
       }) ?? [];
-      // The actual test
-      const obj = {
-        code: content,
-        filename: absolutePath,
-      };
-      this.scriptsModifier?.(obj);
-      scriptsToRun.push(obj);
-
-      run(async () => {
-        const worker = new Worker(workerPath, {
-          execArgv: this.flags,
-          workerData: {
-            testRelativePath: relativePath,
-            wptRunner: __filename,
-            wptPath: this.path,
-            initScript: this.fullInitScript(spec),
-            harness: {
-              code: fs.readFileSync(harnessPath, 'utf8'),
-              filename: harnessPath,
-            },
-            scriptsToRun,
-            needsGc: !!meta.script?.find((script) => script === '/common/gc.js'),
-            skippedTests: spec.skippedTests,
-          },
-        });
-        this.inProgress.add(spec);
-        this.workers.set(spec, worker);
+      if (!isWebWorkerTest) {
+        // The actual test
+        const obj = {
+          code: content,
+          filename: absolutePath,
+        };
+        this.scriptsModifier?.(obj);
+        scriptsToRun.push(obj);
+      }
 
+      jobs.push(run(async () => {
+        this.inProgress.add(spec);
         const reportResult = this.report?.getResult(spec);
-        worker.on('message', (message) => {
-          switch (message.type) {
-            case 'result':
-              return this.resultCallback(spec, message.result, reportResult);
-            case 'skip':
-              return this.skipTest(spec, { name: message.name }, reportResult);
-            case 'completion':
-              return this.completionCallback(spec, message.status, reportResult);
-            default:
-              throw new Error(`Unexpected message from worker: ${message.type}`);
-          }
-        });
 
-        worker.on('error', (err) => {
-          if (!this.inProgress.has(spec)) {
-            // The test is already finished. Ignore errors that occur after it.
-            // This can happen normally, for example in timers tests.
-            return;
-          }
-          // Generate a subtest failure for visibility.
-          // No need to record this synthetic failure with wpt.fyi.
-          this.fail(
-            spec,
-            {
-              status: NODE_UNCAUGHT,
-              name: `${err}`,
-              message: err.message,
-              stack: inspect(err),
-            },
-            kUncaught,
-          );
-          // Mark the whole test as failed in wpt.fyi report.
-          reportResult?.finish('ERROR');
-          this.inProgress.delete(spec);
-          this.report?.write();
+        const handle = this.runSpec(this.flags, {
+          testRelativePath: relativePath,
+          wptRunner: __filename,
+          wptPath: this.path,
+          initScript: this.fullInitScript(spec),
+          harness: {
+            code: fs.readFileSync(harnessPath, 'utf8'),
+            filename: harnessPath,
+          },
+          scriptsToRun,
+          // Set when the test runs inside an actual Web Worker.
+          webWorker: isWebWorkerTest ? {
+            path: absolutePath,
+            isAnyTest,
+            initScript: this.initScript,
+            title: meta.title,
+            variant: spec.variant,
+            scripts: meta.script?.map(
+              (script) => this.resource.toRealFilePath(relativePath, script),
+            ) ?? [],
+            skippedTests: spec.skippedTests,
+          } : undefined,
+          needsGc: !!meta.script?.find((script) => script === '/common/gc.js'),
+          skippedTests: spec.skippedTests,
+        }, {
+          message: (message) => {
+            switch (message.type) {
+              case 'result':
+                return this.resultCallback(spec, message.result, reportResult);
+              case 'skip':
+                return this.skipTest(spec, { name: message.name }, reportResult);
+              case 'completion':
+                return this.completionCallback(spec, message.status, reportResult);
+              default:
+                throw new Error(`Unexpected message from spec runner: ${message.type}`);
+            }
+          },
+          failure: (failure) => {
+            if (!this.inProgress.has(spec)) {
+              // The test is already finished. Ignore anything that happens
+              // after it, including the runner terminating it itself.
+              return false;
+            }
+            // Generate a subtest failure for visibility.
+            // No need to record this synthetic failure with wpt.fyi.
+            this.fail(spec, { status: NODE_UNCAUGHT, ...failure }, kUncaught);
+            // Mark the whole test as failed in wpt.fyi report.
+            reportResult?.finish('ERROR');
+            this.inProgress.delete(spec);
+            this.report?.write();
+            return true;
+          },
         });
+        this.handles.set(spec, handle);
 
-        await events.once(worker, 'exit').catch(() => {});
-      });
+        await handle.finished;
+      }));
     }
 
     process.on('exit', () => {
@@ -780,7 +1082,6 @@ class WPTRunner {
 
       const failures = [];
       let expectedFailures = 0;
-      let skipped = 0;
       for (const [key, item] of Object.entries(this.results)) {
         if (item.fail?.unexpected) {
           failures.push(key);
@@ -788,37 +1089,9 @@ class WPTRunner {
         if (item.fail?.expected) {
           expectedFailures++;
         }
-        if (item.skip) {
-          skipped++;
-        }
       }
 
-      const unexpectedPasses = [];
-      for (const specs of queue) {
-        const key = specs.filename;
-
-        // File has no expected failures
-        if (!specs.failedTests.length) {
-          continue;
-        }
-
-        // File was (maybe even conditionally) skipped
-        if (this.results[key]?.skip) {
-          continue;
-        }
-
-        // Full check: every expected to fail test is present
-        const _unexpectedPasses = specs.failedTests.filter((expectedToFail) => {
-          if (specs.flakyTests.includes(expectedToFail)) {
-            return false;
-          }
-          return this.results[key]?.fail?.expected?.includes(expectedToFail) !== true;
-        });
-        if (_unexpectedPasses.length) {
-          unexpectedPasses.push(..._unexpectedPasses.map((name) => `${key}:${name}`));
-          continue;
-        }
-      }
+      const unexpectedPasses = getUnexpectedPasses(queue, this.results);
 
       // Write the report on clean exit. The report is also written
       // incrementally after each spec completes (see completionCallback)
@@ -827,6 +1100,7 @@ class WPTRunner {
 
       const p = (n, word, suffix = 's') => `${n} ${word}${n === 1 ? '' : suffix}`;
       const ran = queue.length;
+      const skipped = this.skippedSpecCount;
       const total = ran + skipped;
       const passed = ran - expectedFailures - failures.length;
       const { subtestCounts } = this;
@@ -852,6 +1126,25 @@ class WPTRunner {
           `Consider updating ${file} for these files:\n${unexpectedPasses.join('\n')}`);
       }
     });
+
+    // Promises do not keep the event loop alive. Keep a referenced handle
+    // until every queued spec has run, including the gap between terminating
+    // one spec runner and receiving its exit event.
+    const keepAlive = setInterval(() => {}, 2 ** 31 - 1);
+    try {
+      const outcomes = await Promise.allSettled(jobs);
+      const errors = outcomes
+        .filter((outcome) => outcome.status === 'rejected')
+        .map((outcome) => outcome.reason);
+      if (errors.length === 1) {
+        throw errors[0];
+      }
+      if (errors.length > 1) {
+        throw new AggregateError(errors, 'Multiple WPT spec runners failed');
+      }
+    } finally {
+      clearInterval(keepAlive);
+    }
   }
 
   // Map WPT test status to strings
@@ -905,7 +1198,7 @@ class WPTRunner {
       // No need to record this synthetic failure with wpt.fyi.
       this.fail(spec, {
         status: status,
-        name: 'WPT test harness error',
+        name: getHarnessErrorName(harnessStatus),
         message: harnessStatus.message,
         stack: harnessStatus.stack,
       }, status);
@@ -918,14 +1211,15 @@ class WPTRunner {
     // Write report incrementally so results survive even if the process
     // is killed before the exit handler runs.
     this.report?.write();
-    // Always force termination of the worker. Some tests allocate resources
-    // that would otherwise keep it alive.
-    this.workers.get(spec).terminate();
+    // Always force termination of the spec runner. Some tests allocate
+    // resources that would otherwise keep it alive.
+    this.handles.get(spec).kill();
   }
 
   addTestResult(spec, item) {
-    let result = this.results[spec.filename];
-    result ||= this.results[spec.filename] = {};
+    const key = spec.getStatusKey();
+    let result = this.results[key];
+    result ||= this.results[key] = {};
     if (item.status === kSkip) {
       if (item.name) {
         // Subtest-level skip: { filename: { skipTests: [ ... ] } }
@@ -951,19 +1245,19 @@ class WPTRunner {
   }
 
   succeed(spec, test, status, reportResult) {
-    const unexpectedPass = spec.failedTests.includes(test.name);
+    const unexpectedPass = isUnexpectedPass(spec, test.name);
     if (unexpectedPass) {
-      console.log(`[UNEXPECTED_PASS][${status.toUpperCase()}] ${test.name}`);
+      console.log(`[UNEXPECTED_PASS][${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
       this.subtestCounts.unexpectedPasses++;
     } else {
-      console.log(`[${status.toUpperCase()}] ${test.name}`);
+      console.log(`[${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
       this.subtestCounts.passed++;
     }
     reportResult?.addSubtest(test.name, 'PASS');
   }
 
   skipTest(spec, test, reportResult) {
-    console.log(`[SKIP] ${test.name}`);
+    console.log(`[SKIP] ${spec.getTestPath()}: ${test.name}`);
     reportResult?.addSubtest(test.name, 'NOTRUN');
     this.subtestCounts.skipped++;
     this.addTestResult(spec, {
@@ -975,16 +1269,20 @@ class WPTRunner {
   fail(spec, test, status, reportResult) {
     const expected = spec.failedTests.includes(test.name);
     if (expected) {
-      console.log(`[EXPECTED_FAILURE][${status.toUpperCase()}] ${test.name}`);
+      console.log(`[EXPECTED_FAILURE][${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
     } else {
-      console.log(`[UNEXPECTED_FAILURE][${status.toUpperCase()}] ${test.name}`);
+      console.log(`[UNEXPECTED_FAILURE][${status.toUpperCase()}] ${spec.getTestPath()}: ${test.name}`);
     }
     if (status === kFail || status === kUncaught) {
       console.log(test.message);
       console.log(test.stack);
     }
-    const command = `${process.execPath} ${process.execArgv}` +
-                    ` ${require.main?.filename} '${spec.filename}${spec.variant}'`;
+    const command = [
+      process.execPath,
+      ...process.execArgv,
+      require.main?.filename,
+      `'${spec.getTestPath()}'`,
+    ].join(' ');
     console.log(`Command: ${command}\n`);
 
     reportResult?.addSubtest(test.name, 'FAIL', test.message);
@@ -1004,7 +1302,8 @@ class WPTRunner {
 
   skip(spec, reasons) {
     const joinedReasons = reasons.join('; ');
-    console.log(`[SKIPPED] ${spec.filename}${spec.variant}: ${joinedReasons}`);
+    console.log(`[SKIPPED] ${spec.getTestPath()}: ${joinedReasons}`);
+    this.skippedSpecCount++;
     this.addTestResult(spec, {
       status: kSkip,
       reason: joinedReasons,
@@ -1013,14 +1312,14 @@ class WPTRunner {
 
   buildQueue() {
     const queue = [];
-    let argFilename;
-    let argVariant;
-    if (process.argv[2]) {
-      ([argFilename, argVariant = ''] = process.argv[2].split('?'));
+    this.skippedSpecCount = 0;
+    const arg = process.argv[2];
+    if (this.inspectBrk && !arg) {
+      throw new Error('WPT_INSPECT requires a WPT test path');
     }
     for (const spec of this.specs) {
-      if (argFilename) {
-        if (spec.filename === argFilename && (!argVariant || spec.variant.substring(1) === argVariant)) {
+      if (arg) {
+        if (spec.isSelectedBy(arg)) {
           queue.push(spec);
         }
         continue;
@@ -1041,11 +1340,25 @@ class WPTRunner {
     }
 
     // If the tests are run as `node test/wpt/test-something.js subset.any.js`,
-    // only `subset.any.js` (all variants) will be run by the runner.
+    // only `subset.any.js` (all variants and globals) will be run by the runner.
     // If the tests are run as `node test/wpt/test-something.js 'subset.any.js?1-10'`,
     // only the `?1-10` variant of `subset.any.js` will be run by the runner.
-    if (argFilename && queue.length === 0) {
-      throw new Error(`${process.argv[2]} not found!`);
+    // A test path as printed with the results, e.g.
+    // `'dir/subset.any.worker.html?1-10'`, runs exactly that one.
+    if (arg && queue.length === 0) {
+      throw new Error(`${arg} not found!`);
+    }
+    if (this.inspectBrk && queue.length !== 1) {
+      const matches = queue.map((spec) => spec.getTestPath()).join('\n');
+      throw new Error(
+        `WPT_INSPECT requires exactly one generated WPT test path; ` +
+        `${arg} matched ${queue.length}:\n${matches}`,
+      );
+    }
+    if (this.inspectBrk && queue[0].isWebWorkerTest()) {
+      throw new Error(
+        `WPT_INSPECT does not support worker tests: ${queue[0].getTestPath()}`,
+      );
     }
 
     return queue;
@@ -1053,7 +1366,12 @@ class WPTRunner {
 }
 
 module.exports = {
+  backends,
+  getHarnessErrorName,
+  getUnexpectedPasses,
   harness: harnessMock,
+  isUnexpectedPass,
   ResourceLoader,
+  WPTTestSpec,
   WPTRunner,
 };
diff --git a/test/common/wpt/webworker.js b/test/common/wpt/webworker.js
new file mode 100644
index 000000000000..1f94c82c02a3
--- /dev/null
+++ b/test/common/wpt/webworker.js
@@ -0,0 +1,133 @@
+'use strict';
+
+// Runs a WPT test file inside a Web Worker
+// Refs: https://web-platform-tests.org/writing-tests/testharness.html
+
+const { pathToFileURL } = require('url');
+const {
+  runInThisContext,
+  constants: { USE_MAIN_CONTEXT_DEFAULT_LOADER },
+} = require('vm');
+
+globalThis.onmessage = ({ data }) => {
+  // Let the test install its own handler.
+  globalThis.onmessage = null;
+
+  const { ResourceLoader } = require(data.wptRunner);
+  const resource = new ResourceLoader(data.wptPath);
+
+  globalThis.fetch = function fetch(file) {
+    return resource.readAsFetch(data.testRelativePath, file);
+  };
+
+  // Pretend the worker was served from the URL the WPT server would have
+  // used
+  const fakePath = (data.isAnyTest ?
+    data.testRelativePath.replace(/\.any\.js$/, '.any.worker.js') :
+    data.testRelativePath).replace(/\\/g, '/');
+  const fakeURL = new URL(`/${fakePath}${data.variant}`, 'http://wpt');
+  // eslint-disable-next-line no-undef
+  const fakeLocation = { __proto__: WorkerLocation.prototype };
+  for (const key of ['href', 'origin', 'protocol', 'host', 'hostname',
+                     'port', 'pathname', 'search', 'hash']) {
+    Object.defineProperty(fakeLocation, key, {
+      value: fakeURL[key],
+      enumerable: true,
+    });
+  }
+  Object.defineProperty(fakeLocation, 'toString', {
+    value: function toString() { return fakeURL.href; },
+    enumerable: true,
+  });
+  Object.defineProperty(globalThis, 'location', {
+    value: fakeLocation,
+    enumerable: true,
+    configurable: true,
+  });
+
+  const testharnessPath =
+    pathToFileURL(resource.toRealFilePath(data.testRelativePath,
+                                          '/resources/testharness.js')).href;
+
+  // If there are skip patterns, wrap the test functions to prevent
+  // execution of matching tests. This must happen after testharness.js is
+  // loaded but before the test scripts run.
+  function applySkips() {
+    if (!data.skippedTests?.length) {
+      return;
+    }
+    function isSkipped(name) {
+      for (const matcher of data.skippedTests) {
+        if (typeof matcher === 'string') {
+          if (name === matcher) return true;
+        } else if (matcher.test(name)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    for (const fn of ['test', 'async_test', 'promise_test']) {
+      const original = globalThis[fn];
+      globalThis[fn] = function(func, name, ...rest) {
+        if (typeof name === 'string' && isSkipped(name)) {
+          // eslint-disable-next-line no-undef
+          postMessage({ type: 'skip', name });
+          return;
+        }
+        return original.call(this, func, name, ...rest);
+      };
+    }
+  }
+
+  // Tests fetch scripts and nested worker scripts from the WPT server; map
+  // those URLs into the fixtures directory.
+  const realImportScripts = globalThis.importScripts;
+  globalThis.importScripts = function importScripts(...urls) {
+    const mapped = urls.map(
+      (url) => resource.mapServerURL(data.testRelativePath, url));
+    const result = realImportScripts.apply(this, mapped);
+    if (mapped.includes(testharnessPath)) {
+      applySkips();
+    }
+    return result;
+  };
+  const RealWorker = globalThis.Worker;
+  globalThis.Worker = class Worker extends RealWorker {
+    constructor(url, options) {
+      super(resource.mapServerURL(data.testRelativePath, url), options);
+    }
+  };
+
+  if (data.isAnyTest) {
+    // Emulate the generated .any.worker.js wrapper script.
+    // Refs: https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py
+    globalThis.GLOBAL = {
+      isWindow() { return false; },
+      isWorker() { return true; },
+      isShadowRealm() { return false; },
+    };
+  }
+
+  if (data.initScript) {
+    runInThisContext(data.initScript, {
+      importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+    });
+  }
+
+  if (data.title) {
+    globalThis.META_TITLE = data.title;
+  }
+
+  if (data.isAnyTest) {
+    globalThis.importScripts('/resources/testharness.js');
+    for (const script of data.scripts) {
+      globalThis.importScripts(pathToFileURL(script).href);
+    }
+    globalThis.importScripts(pathToFileURL(data.path).href);
+    // eslint-disable-next-line no-undef
+    done();
+  } else {
+    // *.worker.js tests import testharness.js and call done() themselves.
+    globalThis.importScripts(pathToFileURL(data.path).href);
+  }
+};
diff --git a/test/common/wpt/worker.js b/test/common/wpt/worker.js
index 74a35419cd1d..ca4f4706f89b 100644
--- a/test/common/wpt/worker.js
+++ b/test/common/wpt/worker.js
@@ -1,106 +1,185 @@
 'use strict';
 
+const path = require('path');
+const { pathToFileURL } = require('url');
 const {
   runInNewContext,
   runInThisContext,
   constants: { USE_MAIN_CONTEXT_DEFAULT_LOADER },
 } = require('vm');
 const { setFlagsFromString } = require('v8');
-const { parentPort, workerData } = require('worker_threads');
-
-const { ResourceLoader } = require(workerData.wptRunner);
-const resource = new ResourceLoader(workerData.wptPath);
+const { inspect } = require('util');
+const {
+  isMainThread,
+  parentPort,
+  workerData: threadData,
+} = require('worker_threads');
 
-if (workerData.needsGc) {
-  // See https://github.com/nodejs/node/issues/16595#issuecomment-340288680
-  setFlagsFromString('--expose-gc');
-  globalThis.gc = runInNewContext('gc');
-}
+// The runner starts this either on a worker thread, where the spec to run
+// arrives as workerData, or in a child process, where it arrives over IPC.
+const send = isMainThread ?
+  (message) => process.send(message) :
+  (message) => parentPort.postMessage(message);
 
-globalThis.self = global;
-globalThis.GLOBAL = {
-  isWindow() { return false; },
-  isShadowRealm() { return false; },
-};
-globalThis.require = require;
-
-// This is a mock for non-fetch tests that use fetch to resolve
-// a relative fixture file.
-// Actual Fetch API WPTs are executed in nodejs/undici.
-globalThis.fetch = function fetch(file) {
-  return resource.readAsFetch(workerData.testRelativePath, file);
-};
-
-if (workerData.initScript) {
-  runInThisContext(workerData.initScript, {
-    importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+if (isMainThread) {
+  // A worker thread surfaces uncaught errors through its 'error' event; a
+  // process has to report them itself so that the runner names the failure
+  // exactly the same way.
+  process.on('uncaughtException', (err) => {
+    process.send({
+      type: 'uncaught',
+      error: { name: `${err}`, message: err.message, stack: inspect(err) },
+    }, () => process.exit(1));
   });
+  process.once('message', run);
+} else {
+  run(threadData);
 }
 
-runInThisContext(workerData.harness.code, {
-  filename: workerData.harness.filename,
-  importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
-});
-
-// If there are skip patterns, wrap test functions to prevent execution of
-// matching tests. This must happen after testharness.js is loaded but before
-// the test scripts run.
-if (workerData.skippedTests?.length) {
-  function isSkipped(name) {
-    for (const matcher of workerData.skippedTests) {
-      if (typeof matcher === 'string') {
-        if (name === matcher) return true;
-      } else if (matcher.test(name)) {
-        return true;
-      }
+function run(workerData) {
+  const { ResourceLoader } = require(workerData.wptRunner);
+  const resource = new ResourceLoader(workerData.wptPath);
+
+  // Tests create workers with URLs the WPT server would have served them
+  // from; map them into the fixtures directory.
+  const RealWorker = globalThis.Worker;
+  globalThis.Worker = class Worker extends RealWorker {
+    constructor(url, options) {
+      super(resource.mapServerURL(workerData.testRelativePath, url), options);
     }
-    return false;
+  };
+
+  if (workerData.needsGc) {
+    // See https://github.com/nodejs/node/issues/16595#issuecomment-340288680
+    setFlagsFromString('--expose-gc');
+    globalThis.gc = runInNewContext('gc');
   }
-  for (const fn of ['test', 'async_test', 'promise_test']) {
-    const original = globalThis[fn];
-    globalThis[fn] = function(func, name, ...rest) {
-      if (typeof name === 'string' && isSkipped(name)) {
-        parentPort.postMessage({ type: 'skip', name });
-        return;
+
+  globalThis.self = global;
+  globalThis.GLOBAL = {
+    isWindow() { return false; },
+    isShadowRealm() { return false; },
+  };
+  globalThis.require = require;
+
+  // This is a mock for non-fetch tests that use fetch to resolve
+  // a relative fixture file.
+  // Actual Fetch API WPTs are executed in nodejs/undici.
+  globalThis.fetch = function fetch(file) {
+    return resource.readAsFetch(workerData.testRelativePath, file);
+  };
+
+  if (workerData.initScript) {
+    runInThisContext(workerData.initScript, {
+      importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+    });
+  }
+
+  runInThisContext(workerData.harness.code, {
+    filename: workerData.harness.filename,
+    importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+  });
+
+  // If there are skip patterns, wrap test functions to prevent execution of
+  // matching tests. This must happen after testharness.js is loaded but before
+  // the test scripts run.
+  if (workerData.skippedTests?.length) {
+    const isSkipped = (name) => {
+      for (const matcher of workerData.skippedTests) {
+        if (typeof matcher === 'string') {
+          if (name === matcher) return true;
+        } else if (matcher.test(name)) {
+          return true;
+        }
       }
-      return original.call(this, func, name, ...rest);
+      return false;
     };
+    for (const fn of ['test', 'async_test', 'promise_test']) {
+      const original = globalThis[fn];
+      globalThis[fn] = function(func, name, ...rest) {
+        if (typeof name === 'string' && isSkipped(name)) {
+          send({ type: 'skip', name });
+          return;
+        }
+        return original.call(this, func, name, ...rest);
+      };
+    }
   }
-}
 
-// eslint-disable-next-line no-undef
-add_result_callback((result) => {
-  parentPort.postMessage({
-    type: 'result',
-    result: {
-      status: result.status,
-      name: result.name,
-      message: result.message,
-      stack: result.stack,
-    },
+  // eslint-disable-next-line no-undef
+  add_result_callback((result) => {
+    send({
+      type: 'result',
+      result: {
+        status: result.status,
+        name: result.name,
+        message: result.message,
+        stack: result.stack,
+      },
+    });
   });
-});
 
-// Keep the event loop alive
-const timeout = setTimeout(() => {
-  parentPort.postMessage({
-    type: 'completion',
-    status: { status: 2 },
-  });
-}, 2 ** 31 - 1); // Max timeout is 2^31-1, when overflown the timeout is set to 1.
-
-// eslint-disable-next-line no-undef
-add_completion_callback((_, status) => {
-  clearTimeout(timeout);
-  parentPort.postMessage({
-    type: 'completion',
-    status,
-  });
-});
+  // Keep the event loop alive
+  const timeout = setTimeout(() => {
+    send({
+      type: 'completion',
+      status: { status: 2 },
+    });
+  }, 2 ** 31 - 1); // Max timeout is 2^31-1, when overflown the timeout is set to 1.
 
-for (const scriptToRun of workerData.scriptsToRun) {
-  runInThisContext(scriptToRun.code, {
-    filename: scriptToRun.filename,
-    importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+  // eslint-disable-next-line no-undef
+  add_completion_callback((_, status) => {
+    clearTimeout(timeout);
+    send({
+      type: 'completion',
+      status,
+    });
   });
+
+  for (const scriptToRun of workerData.scriptsToRun) {
+    runInThisContext(scriptToRun.code, {
+      filename: scriptToRun.filename,
+      importModuleDynamically: USE_MAIN_CONTEXT_DEFAULT_LOADER,
+    });
+  }
+
+  if (workerData.webWorker) {
+    const worker = new RealWorker(
+      pathToFileURL(path.join(__dirname, 'webworker.js')));
+    worker.postMessage({
+      wptRunner: workerData.wptRunner,
+      wptPath: workerData.wptPath,
+      testRelativePath: workerData.testRelativePath,
+      ...workerData.webWorker,
+    });
+
+    let completed = false;
+    worker.addEventListener('message', (event) => {
+      if (event.data?.type === 'complete') {
+        completed = true;
+      }
+      // Skipped subtests never register with the testharness inside the
+      // worker; the runner is notified about them directly.
+      if (event.data?.type === 'skip') {
+        send({ type: 'skip', name: event.data.name });
+      }
+    });
+    worker.addEventListener('error', (event) => {
+      if (completed) {
+        return;
+      }
+      clearTimeout(timeout);
+      send({
+        type: 'completion',
+        status: {
+          status: 1,
+          message: event.message,
+          stack: event.error?.stack,
+        },
+      });
+    });
+
+    // eslint-disable-next-line no-undef
+    fetch_tests_from_worker(worker);
+  }
 }
diff --git a/test/doctool/test-make-doc.mjs b/test/doctool/test-make-doc.mjs
index e7a6f1b85e75..59e681707dd4 100644
--- a/test/doctool/test-make-doc.mjs
+++ b/test/doctool/test-make-doc.mjs
@@ -46,7 +46,7 @@ const expectedJsons = linkedHtmls
                        .map((name) => name.replace('.html', '.json'));
 const expectedDocs = linkedHtmls.concat(expectedJsons);
 const renamedDocs = ['policy.json', 'policy.html'];
-const skipedDocs = ['quic.json', 'quic.html'];
+const skipedDocs = ['dtls.json', 'dtls.html', 'quic.json', 'quic.html'];
 
 // Test that all the relative links in the TOC match to the actual documents.
 for (const expectedDoc of expectedDocs) {
@@ -61,7 +61,8 @@ for (const actualDoc of actualDocs) {
   // Unless the old file is still available pointing to the correct location
   // 301 redirects are not yet automated. So keeping the old URL is a
   // reasonable workaround.
-  if (renamedDocs.includes(actualDoc) || actualDoc === 'apilinks.json') continue;
+  if (renamedDocs.includes(actualDoc) || skipedDocs.includes(actualDoc) ||
+      actualDoc === 'apilinks.json') continue;
   assert.ok(
     expectedDocs.includes(actualDoc), `${actualDoc} does not match TOC`);
 
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index 982eed74f954..b9b22c0efee7 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -19,6 +19,7 @@ using node::MultiIsolatePlatform;
 using v8::Context;
 using v8::HandleScope;
 using v8::Isolate;
+using v8::Local;
 using v8::Locker;
 using v8::MaybeLocal;
 using v8::V8;
@@ -27,25 +28,35 @@ using v8::Value;
 static int RunNodeInstance(MultiIsolatePlatform* platform,
                            const std::vector<std::string>& args,
                            const std::vector<std::string>& exec_args);
+static int RunSnapshotWithIsolateSettings(
+    MultiIsolatePlatform* platform,
+    const node::EmbedderSnapshotData* snapshot,
+    const std::vector<std::string>& args,
+    const std::vector<std::string>& exec_args);
 
 NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   char** argv = nullptr;
   node::FixupMain(argc, raw_argv, &argv);
 
   std::vector<std::string> args(argv, argv + argc);
+  uint32_t flags =
+      node::ProcessInitializationFlags::kNoInitializeV8 |
+      node::ProcessInitializationFlags::kNoInitializeNodeV8Platform |
+      // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
+      // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
+      // support in the future, split this configuration out as a
+      // command line option.
+      node::ProcessInitializationFlags::kDisableNodeOptionsEnv |
+      node::ProcessInitializationFlags::kNoInitializeCppgc;
+  auto it =
+      std::find(args.begin(), args.end(), "--no-harvest-builtin-code-cache");
+  if (it != args.end()) {
+    args.erase(it);
+    flags |= node::ProcessInitializationFlags::kNoHarvestBuiltinCodeCache;
+  }
   std::shared_ptr<node::InitializationResult> result =
       node::InitializeOncePerProcess(
-          args,
-          {
-              node::ProcessInitializationFlags::kNoInitializeV8,
-              node::ProcessInitializationFlags::kNoInitializeNodeV8Platform,
-              // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
-              // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
-              // support in the future, split this configuration out as a
-              // command line option.
-              node::ProcessInitializationFlags::kDisableNodeOptionsEnv,
-              node::ProcessInitializationFlags::kNoInitializeCppgc,
-          });
+          args, static_cast<node::ProcessInitializationFlags::Flags>(flags));
 
   for (const std::string& error : result->errors())
     fprintf(stderr, "%s: %s\n", args[0].c_str(), error.c_str());
@@ -84,6 +95,7 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
   // Running snapshot:
   // embedtest --embedder-snapshot-blob blob-path
   //           [--embedder-snapshot-as-file]
+  //           [--embedder-isolate-settings]
   //           arg1 arg2...
   // No snapshot:
   // embedtest arg1 arg2...
@@ -93,6 +105,7 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
   std::vector<std::string> filtered_args;
   bool is_building_snapshot = false;
   bool snapshot_as_file = false;
+  bool with_isolate_settings = false;
   std::optional<node::SnapshotConfig> snapshot_config;
   std::string snapshot_blob_path;
   for (size_t i = 0; i < args.size(); ++i) {
@@ -101,6 +114,8 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
       is_building_snapshot = true;
     } else if (arg == "--embedder-snapshot-as-file") {
       snapshot_as_file = true;
+    } else if (arg == "--embedder-isolate-settings") {
+      with_isolate_settings = true;
     } else if (arg == "--without-code-cache") {
       if (!snapshot_config.has_value()) {
         snapshot_config = node::SnapshotConfig{};
@@ -150,6 +165,11 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
                          node::GetAnonymousMainPath());
   }
 
+  if (snapshot && with_isolate_settings) {
+    return RunSnapshotWithIsolateSettings(
+        platform, snapshot.get(), filtered_args, exec_args);
+  }
+
   std::vector<std::string> errors;
   std::unique_ptr<CommonEnvironmentSetup> setup;
 
@@ -233,3 +253,67 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
 
   return exit_code;
 }
+
+// CommonEnvironmentSetup does not take IsolateSettings, so this goes through
+// NewIsolate()/CreateIsolateData()/CreateEnvironment() directly.
+static int RunSnapshotWithIsolateSettings(
+    MultiIsolatePlatform* platform,
+    const node::EmbedderSnapshotData* snapshot,
+    const std::vector<std::string>& args,
+    const std::vector<std::string>& exec_args) {
+  uv_loop_t loop;
+  int ret = uv_loop_init(&loop);
+  assert(ret == 0);
+
+  std::shared_ptr<node::ArrayBufferAllocator> allocator =
+      node::ArrayBufferAllocator::Create();
+  node::IsolateSettings settings;
+  settings.prepare_stack_trace_callback = [](Local<Context> context,
+                                             Local<Value> exception,
+                                             Local<v8::Array> trace) {
+    return MaybeLocal<Value>(v8::String::NewFromUtf8Literal(
+        v8::Isolate::GetCurrent(), "stack trace prepared by the embedder"));
+  };
+  Isolate* isolate =
+      node::NewIsolate(allocator, &loop, platform, snapshot, settings);
+  assert(isolate != nullptr);
+
+  int exit_code = 1;
+  {
+    Locker locker(isolate);
+    Isolate::Scope isolate_scope(isolate);
+    HandleScope handle_scope(isolate);
+
+    std::unique_ptr<node::IsolateData, decltype(&node::FreeIsolateData)>
+        isolate_data(node::CreateIsolateData(
+                         isolate, &loop, platform, allocator.get(), snapshot),
+                     node::FreeIsolateData);
+    std::unique_ptr<Environment, decltype(&node::FreeEnvironment)> env(
+        node::CreateEnvironment(
+            isolate_data.get(), Local<Context>(), args, exec_args),
+        node::FreeEnvironment);
+    assert(env);
+
+    Context::Scope context_scope(node::GetMainContext(env.get()));
+    if (!node::LoadEnvironment(env.get(), node::StartExecutionCallback{})
+             .IsEmpty()) {
+      exit_code = node::SpinEventLoop(env.get()).FromMaybe(1);
+    }
+    node::Stop(env.get());
+  }
+
+  bool platform_finished = false;
+  platform->AddIsolateFinishedCallback(
+      isolate,
+      [](void* data) {
+        bool* finished = static_cast<bool*>(data);
+        *finished = true;
+      },
+      &platform_finished);
+  platform->DisposeIsolate(isolate);
+  while (!platform_finished) uv_run(&loop, UV_RUN_ONCE);
+  ret = uv_loop_close(&loop);
+  assert(ret == 0);
+
+  return exit_code;
+}
diff --git a/test/embedding/test-embedding-builtin-code-cache-harvest.js b/test/embedding/test-embedding-builtin-code-cache-harvest.js
new file mode 100644
index 000000000000..19cdd499c6ea
--- /dev/null
+++ b/test/embedding/test-embedding-builtin-code-cache-harvest.js
@@ -0,0 +1,25 @@
+'use strict';
+// By default a builtin compiled without a code cache serializes one that worker
+// threads then start from; with kNoHarvestBuiltinCodeCache it does not.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+tmpdir.refresh();
+const embedtest = common.resolveBuiltBinary('embedtest');
+const workerScript = 'new (require("worker_threads").Worker)("", { eval: true })';
+
+function workerCompileLog(args) {
+  let log;
+  spawnSyncAndAssert(
+    embedtest, ['--', ...args, workerScript],
+    { cwd: tmpdir.path, env: { ...process.env, NODE_DEBUG_NATIVE: 'CODE_CACHE' } },
+    { stderr(output) { log = output; return true; } });
+  const worker = log.slice(log.lastIndexOf('Compiling internal/bootstrap/realm'));
+  assert.notStrictEqual(worker, log);
+  return worker;
+}
+assert.match(workerCompileLog([]), /Code cache of internal\/bootstrap\/node \(\w+\) is accepted/);
+assert.match(workerCompileLog(['--no-harvest-builtin-code-cache']),
+             /Compiling internal\/bootstrap\/node without code cache/);
diff --git a/test/embedding/test-embedding-snapshot-isolate-settings.js b/test/embedding/test-embedding-snapshot-isolate-settings.js
new file mode 100644
index 000000000000..67444da1e4cf
--- /dev/null
+++ b/test/embedding/test-embedding-snapshot-isolate-settings.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// IsolateSettings passed to NewIsolate() with a snapshot must survive
+// CreateEnvironment(); see RunSnapshotWithIsolateSettings() in embedtest.cc.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+
+const {
+  spawnSyncAndAssert,
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+
+const embedtest = common.resolveBuiltBinary('embedtest');
+const snapshotBlobArgs = [
+  '--embedder-snapshot-blob', tmpdir.resolve('embedder-snapshot.blob'),
+];
+const buildSnapshotScript = `
+  require('v8').startupSnapshot.setDeserializeMainFunction(() => {
+    console.log(new Error('from the snapshot main function').stack);
+  });
+`;
+
+tmpdir.refresh();
+
+spawnSyncAndExitWithoutError(
+  embedtest,
+  ['--', buildSnapshotScript, ...snapshotBlobArgs, '--embedder-snapshot-create'],
+  { cwd: tmpdir.path });
+
+spawnSyncAndAssert(
+  embedtest,
+  ['--', ...snapshotBlobArgs, '--embedder-isolate-settings'],
+  { cwd: tmpdir.path },
+  {
+    trim: true,
+    stdout: 'stack trace prepared by the embedder',
+  });
diff --git a/test/ffi/test-ffi-calls.js b/test/ffi/test-ffi-calls.js
index e966809de666..3314c566b1cf 100644
--- a/test/ffi/test-ffi-calls.js
+++ b/test/ffi/test-ffi-calls.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-gc --allow-natives-syntax
+// Flags: --expose-gc --allow-natives-syntax
 'use strict';
 const common = require('../common');
 common.skipIfFFIMissing();
@@ -313,7 +313,6 @@ test('ffi division helpers behave as expected', () => {
 
 function assertInvalidCallbackReturnAborts(returnExpression) {
   const { stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     `'use strict';
 const ffi = require('node:ffi');
@@ -336,7 +335,6 @@ stderr: ${stderr}`);
 
 function assertInvalidCallbackBehaviorAborts(callbackBody, message) {
   const { stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     `'use strict';
 const ffi = require('node:ffi');
@@ -366,7 +364,6 @@ const { functions } = ffi.dlopen(libraryPath, fixtureSymbols);
 functions.call_int_callback(workerData, 21);
 `;
   const { stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     `'use strict';
 const { Worker } = require('node:worker_threads');
diff --git a/test/ffi/test-ffi-dynamic-library.js b/test/ffi/test-ffi-dynamic-library.js
index c7dab03f64e9..c7741a9eed55 100644
--- a/test/ffi/test-ffi-dynamic-library.js
+++ b/test/ffi/test-ffi-dynamic-library.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-gc --allow-natives-syntax
+// Flags: --expose-gc --allow-natives-syntax
 'use strict';
 const common = require('../common');
 common.skipIfFFIMissing();
@@ -124,6 +124,24 @@ test('DynamicLibrary exposes functions and symbols', () => {
   }
 });
 
+test('DynamicLibrary getters reject incompatible receivers', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+
+  try {
+    const invalidGets = [
+      () => Reflect.get(lib, 'path', {}),
+      () => Reflect.get(lib, 'symbols', {}),
+      () => Reflect.get(ffi.DynamicLibrary.prototype, 'functions', {}),
+    ];
+
+    for (const invalidGet of invalidGets) {
+      assert.throws(invalidGet, TypeError);
+    }
+  } finally {
+    lib.close();
+  }
+});
+
 test('DynamicLibrary evaluates function signatures once', () => {
   function makeChangingSignature() {
     const reads = { arguments: 0, return: 0 };
diff --git a/test/ffi/test-ffi-fast-buffer.js b/test/ffi/test-ffi-fast-buffer.js
index add25a27f4e4..0358b4f33c29 100644
--- a/test/ffi/test-ffi-fast-buffer.js
+++ b/test/ffi/test-ffi-fast-buffer.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals --allow-natives-syntax
+// Flags: --expose-internals --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
diff --git a/test/ffi/test-ffi-fast-integer-validation.js b/test/ffi/test-ffi-fast-integer-validation.js
index 66b6866b4e47..e6bedfab967c 100644
--- a/test/ffi/test-ffi-fast-integer-validation.js
+++ b/test/ffi/test-ffi-fast-integer-validation.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --allow-natives-syntax
+// Flags: --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index 72d37efacd5a..6d47200db187 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 
 const common = require('../common');
@@ -319,3 +318,23 @@ test('ffi validates memory access arguments', () => {
     }
   }));
 });
+
+test('ffi memory helpers reject missing required arguments', () => {
+  const widths = ['Int8', 'Uint8', 'Int16', 'Uint16', 'Int32', 'Uint32',
+                  'Int64', 'Uint64', 'Float32', 'Float64'];
+
+  // Calling a helper with no arguments must report the missing pointer the
+  // same way an explicitly passed `undefined` does, instead of returning
+  // `undefined` as if the read or the write had succeeded.
+  for (const width of widths) {
+    for (const name of [`get${width}`, `set${width}`]) {
+      assert.throws(() => ffi[name](), { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => ffi[name](undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+  }
+
+  assert.throws(() => ffi.toBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+});
diff --git a/test/ffi/test-ffi-module.js b/test/ffi/test-ffi-module.js
index 7fe265972a74..97b7072c7622 100644
--- a/test/ffi/test-ffi-module.js
+++ b/test/ffi/test-ffi-module.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 const common = require('../common');
 const { spawnSyncAndAssert } = require('../common/child_process');
@@ -33,22 +32,24 @@ test('ffi builtin is unavailable when disabled', () => {
   assert.strictEqual(signal, null);
 });
 
-test('ffi builtin is listed', () => {
-  for (const [flag, stdout] of Object.entries({
-    '--experimental-ffi': 'true\n',
-    '--no-experimental-ffi': 'false\n',
-  })) {
+test('ffi builtin is listed by default', () => {
+  for (const flags of [[], ['--experimental-ffi']]) {
     spawnSyncAndAssert(process.execPath, [
-      flag,
+      ...flags,
       '-p',
       'require("node:module").builtinModules.includes("node:ffi")',
-    ], { stdout });
+    ], { stdout: 'true\n' });
   }
+
+  spawnSyncAndAssert(process.execPath, [
+    '--no-experimental-ffi',
+    '-p',
+    'require("node:module").builtinModules.includes("node:ffi")',
+  ], { stdout: 'false\n' });
 });
 
 test('ffi can be imported from ESM', () => {
   const { stdout, stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '--input-type=module',
     '-e',
     'import * as ffi from "node:ffi"; console.log(typeof ffi.dlopen);',
@@ -64,7 +65,6 @@ test('ffi can be imported from ESM', () => {
 
 test('DynamicLibrary requires new', () => {
   const { stdout, stderr, status, signal } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-e',
     'const ffi = require("node:ffi"); ffi.DynamicLibrary("missing");',
   ], {
diff --git a/test/ffi/test-ffi-permission-allow-cli.js b/test/ffi/test-ffi-permission-allow-cli.js
index f84ff69223a9..5a65f61091d7 100644
--- a/test/ffi/test-ffi-permission-allow-cli.js
+++ b/test/ffi/test-ffi-permission-allow-cli.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-ffi --allow-child-process --experimental-ffi --allow-fs-read=* --allow-fs-write=*
+// Flags: --permission --allow-ffi --allow-child-process --allow-fs-read=* --allow-fs-write=*
 'use strict';
 
 const { skipIfFFIMissing } = require('../common');
@@ -19,7 +19,6 @@ test('allow-ffi enables ffi APIs and permission flag discovery', () => {
   const { stdout, status, signal } = spawnSync(process.execPath, [
     '--permission',
     '--expose-internals',
-    '--experimental-ffi',
     '-p',
     'JSON.stringify(require("internal/process/permission").availableFlags())',
   ], {
diff --git a/test/ffi/test-ffi-permission-audit.js b/test/ffi/test-ffi-permission-audit.js
index 5e0d227c5eae..e4c79c8381b7 100644
--- a/test/ffi/test-ffi-permission-audit.js
+++ b/test/ffi/test-ffi-permission-audit.js
@@ -10,7 +10,6 @@ skipIfFFIMissing();
 test('permission audit does not deny ffi access', () => {
   const { stdout, stderr, status, signal } = spawnSync(process.execPath, [
     '--permission-audit',
-    '--experimental-ffi',
     '-e',
     'const ffi = require("node:ffi"); ' +
       'console.log(JSON.stringify({ ' +
diff --git a/test/ffi/test-ffi-permissions.js b/test/ffi/test-ffi-permissions.js
index 970f5f019ee7..e441d88efac2 100644
--- a/test/ffi/test-ffi-permissions.js
+++ b/test/ffi/test-ffi-permissions.js
@@ -1,4 +1,4 @@
-// Flags: --permission --experimental-ffi --allow-fs-read=*
+// Flags: --permission --allow-fs-read=*
 'use strict';
 const common = require('../common');
 const assert = require('node:assert');
diff --git a/test/ffi/test-ffi-readonly-write.js b/test/ffi/test-ffi-readonly-write.js
index 33aa2245752c..426af583361a 100644
--- a/test/ffi/test-ffi-readonly-write.js
+++ b/test/ffi/test-ffi-readonly-write.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 const { skipIfFFIMissing, isWindows, skip } = require('../common');
 const assert = require('node:assert');
@@ -15,7 +14,6 @@ test('writing to readonly memory via buffer fails', () => {
   const symbols = JSON.stringify(fixtureSymbols);
   const libPath = JSON.stringify(libraryPath);
   const { stdout, status } = spawnSync(process.execPath, [
-    '--experimental-ffi',
     '-p',
     `
     const ffi = require('node:ffi');
diff --git a/test/ffi/test-ffi-shared-buffer.js b/test/ffi/test-ffi-shared-buffer.js
index 2e982e37ab2d..a56df8daeabd 100644
--- a/test/ffi/test-ffi-shared-buffer.js
+++ b/test/ffi/test-ffi-shared-buffer.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals
+// Flags: --expose-internals
 'use strict';
 const common = require('../common');
 common.skipIfFFIMissing();
diff --git a/test/ffi/test-ffi-void-parameter.js b/test/ffi/test-ffi-void-parameter.js
index d79631ed542f..c25105f33716 100644
--- a/test/ffi/test-ffi-void-parameter.js
+++ b/test/ffi/test-ffi-void-parameter.js
@@ -1,4 +1,3 @@
-// Flags: --experimental-ffi
 'use strict';
 
 const common = require('../common');
diff --git a/test/ffi/test-ffi-weakref-calls.js b/test/ffi/test-ffi-weakref-calls.js
index b158ee810776..432b39797f44 100644
--- a/test/ffi/test-ffi-weakref-calls.js
+++ b/test/ffi/test-ffi-weakref-calls.js
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-gc
+// Flags: --expose-gc
 'use strict';
 const { skipIfFFIMissing } = require('../common');
 skipIfFFIMissing();
diff --git a/test/fixtures/aead-vectors.js b/test/fixtures/aead-vectors.js
index e511c6babf38..4784b8165ffa 100644
--- a/test/fixtures/aead-vectors.js
+++ b/test/fixtures/aead-vectors.js
@@ -52,6 +52,38 @@ module.exports = [
     ct: '0eaccb',
     tag: '93da9bb81333aee0c785b240d319719d', tampered: false },
 
+  // RFC 8998, Appendix A.1
+  { algo: 'sm4-gcm',
+    key: '0123456789abcdeffedcba9876543210',
+    iv: '00001234567800000000abcd',
+    plain: 'aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb' +
+           'ccccccccccccccccdddddddddddddddd' +
+           'eeeeeeeeeeeeeeeeffffffffffffffff' +
+           'eeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaa',
+    plainIsHex: true,
+    aad: 'feedfacedeadbeeffeedfacedeadbeefabaddad2',
+    ct: '17f399f08c67d5ee19d0dc9969c4bb7d' +
+        '5fd46fd3756489069157b282bb200735' +
+        'd82710ca5c22f0ccfa7cbf93d496ac15' +
+        'a56834cbcf98c397b4024a2691233b8d',
+    tag: '83de3541e4c2b58177e065a9bf7b62ec', tampered: false },
+
+  // RFC 8998, Appendix A.2
+  { algo: 'sm4-ccm',
+    key: '0123456789abcdeffedcba9876543210',
+    iv: '00001234567800000000abcd',
+    plain: 'aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb' +
+           'ccccccccccccccccdddddddddddddddd' +
+           'eeeeeeeeeeeeeeeeffffffffffffffff' +
+           'eeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaa',
+    plainIsHex: true,
+    aad: 'feedfacedeadbeeffeedfacedeadbeefabaddad2',
+    ct: '48af93501fa62adbcd414cce6034d895' +
+        'dda1bf8f132f042098661572e7483094' +
+        'fd12e518ce062c98acee28d95df4416b' +
+        'ed31a2f04476c18bb40c84a74b97dc5b',
+    tag: '16842d4fa186f56ab33256971fa110f4', tampered: false },
+
   { algo: 'aes-128-gcm',
     key: '6970787039613669314d623455536234',
     iv: '583673497131313748307652', plain: 'Hello World!',
diff --git a/test/fixtures/bench-runner/a.cjs b/test/fixtures/bench-runner/a.cjs
new file mode 100644
index 000000000000..3edaf85ad856
--- /dev/null
+++ b/test/fixtures/bench-runner/a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('alpha', {
+  params: { file: 'a', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/abrupt-exit.cjs b/test/fixtures/bench-runner/abrupt-exit.cjs
new file mode 100644
index 000000000000..3489f424b8da
--- /dev/null
+++ b/test/fixtures/bench-runner/abrupt-exit.cjs
@@ -0,0 +1,16 @@
+'use strict';
+
+const mode = process.env.NODE_BENCH_EXIT_MODE;
+
+if (mode === 'code') process.exit(2);
+if (mode === 'signal') process.kill(process.pid, 'SIGTERM');
+
+const { bench } = require('node:bench');
+
+if (mode === 'late') {
+  process.on('beforeExit', () => { process.exitCode = 2; });
+}
+
+bench('abrupt exit', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/acknowledged-records.mjs b/test/fixtures/bench-runner/acknowledged-records.mjs
new file mode 100644
index 000000000000..633f3412eaaf
--- /dev/null
+++ b/test/fixtures/bench-runner/acknowledged-records.mjs
@@ -0,0 +1,41 @@
+import common from '../../common/index.js';
+
+const pending = new Map();
+const onMessage = (message) => {
+  if (message?.type !== 'node:bench:ack') return;
+  pending.get(message.id)?.();
+  pending.delete(message.id);
+};
+process.on('message', onMessage);
+
+const timeout = setTimeout(() => {
+  throw new Error('benchmark record was not acknowledged');
+}, common.platformTimeout(10_000));
+
+function sendDiagnostic(id) {
+  return new Promise((resolve, reject) => {
+    pending.set(id, resolve);
+    process.send({
+      id,
+      type: 'node:bench:record',
+      record: {
+        type: 'bench:diagnostic',
+        data: {
+          runId: process.env.NODE_BENCH_RUN_ID,
+          fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+          entryFile: process.argv[1],
+          message: `acknowledged ${id}`,
+          level: 'info',
+          file: process.argv[1],
+        },
+      },
+    }, (error) => {
+      if (error) reject(error);
+    });
+  });
+}
+
+for (let i = 0; i < 32; i++) await sendDiagnostic(10_000 + i);
+
+clearTimeout(timeout);
+process.off('message', onMessage);
diff --git a/test/fixtures/bench-runner/b.mjs b/test/fixtures/bench-runner/b.mjs
new file mode 100644
index 000000000000..ca35178ecf79
--- /dev/null
+++ b/test/fixtures/bench-runner/b.mjs
@@ -0,0 +1,8 @@
+import { bench } from 'node:bench';
+
+bench('beta', {
+  params: { file: 'b', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/destroying-reporter.cjs b/test/fixtures/bench-runner/destroying-reporter.cjs
new file mode 100644
index 000000000000..8a2a2406f932
--- /dev/null
+++ b/test/fixtures/bench-runner/destroying-reporter.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = async function* destroyingReporter(source) {
+  source.once('bench:plan', () => {
+    source.destroy(new Error('benchmark reporter closed the stream'));
+  });
+  yield* source;
+};
diff --git a/test/fixtures/bench-runner/diagnostic.cjs b/test/fixtures/bench-runner/diagnostic.cjs
new file mode 100644
index 000000000000..9e413e943dd7
--- /dev/null
+++ b/test/fixtures/bench-runner/diagnostic.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const { channel } = require('diagnostics_channel');
+
+const channelName = 'node:bench:test:diagnostic';
+const diagnosticChannel = channel(channelName);
+
+bench('diagnostic relay', {
+  diagnosticChannels: [channelName],
+  samples: 1,
+}, (b) => {
+  const message = { value: 42n };
+  diagnosticChannel.publish(message);
+  message.value = 0n;
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/error.cjs b/test/fixtures/bench-runner/error.cjs
new file mode 100644
index 000000000000..cf1db903e2b7
--- /dev/null
+++ b/test/fixtures/bench-runner/error.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('failure', {
+  params: { kind: 'structured-error' },
+  samples: 1,
+}, () => {
+  const error = new Error('benchmark fixture failed', {
+    cause: { value: 42n },
+  });
+  error.code = 'ERR_BENCHMARK_FIXTURE';
+  throw error;
+});
diff --git a/test/fixtures/bench-runner/exit-code.cjs b/test/fixtures/bench-runner/exit-code.cjs
new file mode 100644
index 000000000000..67f065fea7eb
--- /dev/null
+++ b/test/fixtures/bench-runner/exit-code.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('sets exit code', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  process.exitCode = 2;
+});
diff --git a/test/fixtures/bench-runner/failing-reporter.cjs b/test/fixtures/bench-runner/failing-reporter.cjs
new file mode 100644
index 000000000000..da1299fd17d5
--- /dev/null
+++ b/test/fixtures/bench-runner/failing-reporter.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { Transform } = require('stream');
+
+module.exports = new Transform({
+  writableObjectMode: true,
+  transform(_record, _encoding, callback) {
+    callback(new Error('benchmark reporter failed'));
+  },
+});
diff --git a/test/fixtures/bench-runner/fake-ipc.cjs b/test/fixtures/bench-runner/fake-ipc.cjs
new file mode 100644
index 000000000000..7b2afa8dda93
--- /dev/null
+++ b/test/fixtures/bench-runner/fake-ipc.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+process.send = () => {};
diff --git a/test/fixtures/bench-runner/identity-child-a.cjs b/test/fixtures/bench-runner/identity-child-a.cjs
new file mode 100644
index 000000000000..ae7824d0ab7d
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function declareChildA() {
+  bench('child a', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-child-b.cjs b/test/fixtures/bench-runner/identity-child-b.cjs
new file mode 100644
index 000000000000..2841a98055e0
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function declareChildB() {
+  bench('child b', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-entry-a.cjs b/test/fixtures/bench-runner/identity-entry-a.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-entry-b.cjs b/test/fixtures/bench-runner/identity-entry-b.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-hook.cjs b/test/fixtures/bench-runner/identity-hook.cjs
new file mode 100644
index 000000000000..14c4cacd9cdc
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-hook.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { before, bench } = require('node:bench');
+
+before(() => {
+  throw new Error('scoped hook failed');
+});
+
+bench('scoped hook benchmark', { samples: 1 }, () => {});
diff --git a/test/fixtures/bench-runner/identity-preload.cjs b/test/fixtures/bench-runner/identity-preload.cjs
new file mode 100644
index 000000000000..bcc9df72c410
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-preload.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+bench('preload identity', { samples: 1 }, (b) => {
+  completeSample(b);
+});
diff --git a/test/fixtures/bench-runner/identity-shared.cjs b/test/fixtures/bench-runner/identity-shared.cjs
new file mode 100644
index 000000000000..c47bcc954745
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-shared.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function registerSharedIdentity() {
+  bench('shared identity', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-suite.cjs b/test/fixtures/bench-runner/identity-suite.cjs
new file mode 100644
index 000000000000..53c5982ce1a9
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-suite.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const declareChildA = require('./identity-child-a.cjs');
+const declareChildB = require('./identity-child-b.cjs');
+
+suite('cross-module suite', () => {
+  declareChildA();
+  declareChildB();
+});
diff --git a/test/fixtures/bench-runner/import.mjs b/test/fixtures/bench-runner/import.mjs
new file mode 100644
index 000000000000..e027d905eec0
--- /dev/null
+++ b/test/fixtures/bench-runner/import.mjs
@@ -0,0 +1 @@
+globalThis.benchImport = 'loaded';
diff --git a/test/fixtures/bench-runner/imported.cjs b/test/fixtures/bench-runner/imported.cjs
new file mode 100644
index 000000000000..9a5fb24bb33d
--- /dev/null
+++ b/test/fixtures/bench-runner/imported.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('imported', {
+  samples: 1,
+  params: { imported: globalThis.benchImport },
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/inspector.cjs b/test/fixtures/bench-runner/inspector.cjs
new file mode 100644
index 000000000000..d357b54f864e
--- /dev/null
+++ b/test/fixtures/bench-runner/inspector.cjs
@@ -0,0 +1,13 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+const inspectPort = process.execArgv.filter(
+  (arg) => arg.startsWith('--inspect-port=')).at(-1);
+
+bench('inspector option', {
+  params: { inspectPort },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/ipc.cjs b/test/fixtures/bench-runner/ipc.cjs
new file mode 100644
index 000000000000..e6b9ceb49823
--- /dev/null
+++ b/test/fixtures/bench-runner/ipc.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.send?.({ type: 'user-message' });
+
+bench('user IPC', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/load-error-after-declaration.cjs b/test/fixtures/bench-runner/load-error-after-declaration.cjs
new file mode 100644
index 000000000000..6f2cf085742c
--- /dev/null
+++ b/test/fixtures/bench-runner/load-error-after-declaration.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+bench('declared before load error', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+
+throw new Error('load failed after declaration');
diff --git a/test/fixtures/bench-runner/malformed-plan-order.mjs b/test/fixtures/bench-runner/malformed-plan-order.mjs
new file mode 100644
index 000000000000..80c8cdf4cd8f
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-plan-order.mjs
@@ -0,0 +1,34 @@
+import { bench } from 'node:bench';
+import common from '../../common/index.js';
+
+await new Promise((resolve, reject) => {
+  const timeout = setTimeout(() => {
+    reject(new Error('benchmark summary was not acknowledged'));
+  }, common.platformTimeout(10_000));
+  process.on('message', (message) => {
+    if (message?.type === 'node:bench:ack' && message.id === 0) {
+      clearTimeout(timeout);
+      resolve();
+    }
+  });
+  process.send?.({
+    id: 0,
+    type: 'node:bench:record',
+    record: {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 0, failed: 0, skipped: 0, total: 0 },
+        duration_ns: 1n,
+        entryFile: import.meta.filename,
+        fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+        file: import.meta.filename,
+        runId: process.env.NODE_BENCH_RUN_ID,
+        success: true,
+      },
+    },
+  });
+});
+
+bench('late plan', { samples: 1 }, () => {
+  throw new Error('late plan benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
new file mode 100644
index 000000000000..3550694532f5
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -0,0 +1,81 @@
+'use strict';
+
+const common = require('../../common');
+
+const kind = process.env.NODE_BENCH_MALFORMED_RECORD;
+const id = kind === 'sequence' ? null : 0;
+const benchmarkData = {
+  __proto__: null,
+  benchId: 'invalid plan',
+  column: 1,
+  entryFile: __filename,
+  file: __filename,
+  fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+  line: 1,
+  name: 'invalid plan',
+  namePath: ['invalid plan'],
+  params: {},
+  parentId: null,
+  runId: process.env.NODE_BENCH_RUN_ID,
+  tags: [],
+};
+const plan = {
+  type: 'bench:plan',
+  data: {
+    __proto__: null,
+    ...benchmarkData,
+    samples: 1,
+    selected: true,
+    timeout: null,
+    warmup: 0,
+    yieldBetweenSamples: true,
+  },
+};
+const record = kind === 'summary' ? {
+  type: 'bench:summary',
+  data: {
+    counts: { completed: 0, failed: 0, skipped: 0, total: -1 },
+    duration_ns: 1n,
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+    success: true,
+  },
+} : kind === 'name-path' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    namePath: [1],
+  },
+} : kind === 'plan' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    samples: 0,
+  },
+} : kind === 'timeout' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    timeout: -1,
+  },
+} : kind === 'identity' ? {
+  type: 'bench:complete',
+  data: {
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+  },
+} : kind === 'diagnostic' || kind === 'diagnostic-order' ? {
+  type: 'bench:diagnostic',
+  data: {
+    ...benchmarkData,
+    index: 0,
+    level: kind === 'diagnostic' ? 'error' : 'warning',
+    message: 'invalid diagnostic',
+    phase: 'measurement',
+  },
+} : null;
+
+process.send?.({ id, type: 'node:bench:record', record });
+setTimeout(() => process.exit(2), common.platformTimeout(10_000));
diff --git a/test/fixtures/bench-runner/many-records.cjs b/test/fixtures/bench-runner/many-records.cjs
new file mode 100644
index 000000000000..aacb17821035
--- /dev/null
+++ b/test/fixtures/bench-runner/many-records.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('many records', { samples: 30 }, (b) => {
+  process.stdout.write(`${b.index}\n`);
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/node.config.json b/test/fixtures/bench-runner/node.config.json
new file mode 100644
index 000000000000..0344e2a4b7f4
--- /dev/null
+++ b/test/fixtures/bench-runner/node.config.json
@@ -0,0 +1,7 @@
+{
+  "bench": {
+    "bench-isolation": "none",
+    "bench-reporter": ["json"],
+    "bench-samples": 1
+  }
+}
diff --git a/test/fixtures/bench-runner/options.cjs b/test/fixtures/bench-runner/options.cjs
new file mode 100644
index 000000000000..e9a1bcde9af3
--- /dev/null
+++ b/test/fixtures/bench-runner/options.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+let invocations = 0;
+bench('selected', {
+  params: { boolean: true, number: 42, string: 'value' },
+  samples: 8,
+  warmup: 8,
+}, (b) => {
+  invocations++;
+  b.record({ duration_ns: 1n, operations: invocations });
+});
+
+bench('filtered out', { samples: 1 }, () => {
+  throw new Error('filtered benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/output.cjs b/test/fixtures/bench-runner/output.cjs
new file mode 100644
index 000000000000..3500f2a23383
--- /dev/null
+++ b/test/fixtures/bench-runner/output.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.stdout.write('benchmark stdout\n');
+process.stderr.write('benchmark stderr\n');
+
+bench('output', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/preload.cjs b/test/fixtures/bench-runner/preload.cjs
new file mode 100644
index 000000000000..1b03dcbf65cf
--- /dev/null
+++ b/test/fixtures/bench-runner/preload.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+globalThis.benchRunnerPreloaded = true;
diff --git a/test/fixtures/bench-runner/preloaded.cjs b/test/fixtures/bench-runner/preloaded.cjs
new file mode 100644
index 000000000000..b141b49e9695
--- /dev/null
+++ b/test/fixtures/bench-runner/preloaded.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+if (globalThis.benchRunnerPreloaded !== true) {
+  throw new Error('benchmark preload did not run');
+}
+
+bench('preloaded', {
+  params: { preloaded: true },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/recorded-detail.cjs b/test/fixtures/bench-runner/recorded-detail.cjs
new file mode 100644
index 000000000000..1643783225d0
--- /dev/null
+++ b/test/fixtures/bench-runner/recorded-detail.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('recorded detail', { samples: 3 }, (b) => {
+  b.record({
+    __proto__: null,
+    detail: {
+      index: b.index,
+      phase: b.phase,
+      value: 42n,
+    },
+    duration_ns: 4n,
+    operations: 2,
+  });
+  b.done();
+});
diff --git a/test/fixtures/bench-runner/run-file-blocked.cjs b/test/fixtures/bench-runner/run-file-blocked.cjs
new file mode 100644
index 000000000000..9298d0dccc4b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-blocked.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('blocked run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file-lingering.cjs b/test/fixtures/bench-runner/run-file-lingering.cjs
new file mode 100644
index 000000000000..954bc108d01d
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-lingering.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+setInterval(() => {}, 1_000);
+if (process.platform !== 'win32') process.on('SIGTERM', () => {});
+process.on('disconnect', () => process.stdout.write('child disconnected\n'));
+
+bench('lingering run file', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/run-file-partial.cjs b/test/fixtures/bench-runner/run-file-partial.cjs
new file mode 100644
index 000000000000..9e3019e94e62
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-partial.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('completed before abort', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+bench('aborted run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file.cjs b/test/fixtures/bench-runner/run-file.cjs
new file mode 100644
index 000000000000..436665074b6b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file.cjs
@@ -0,0 +1,22 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('run file', {
+  samples: 1,
+  params: {
+    context: process.env.NODE_BENCH_CONTEXT,
+    exposed: typeof globalThis.gc === 'function',
+    omitted: process.env.NODE_BENCH_OMITTED === undefined,
+    value: process.env.NODE_BENCH_RUN_FILE ?? 'unset',
+  },
+}, (b) => {
+  b.record({
+    duration_ns: 1n,
+    operations: 1,
+    detail: {
+      execArgv: process.execArgv,
+      pid: process.pid,
+    },
+  });
+});
diff --git a/test/fixtures/bench-runner/run.cjs b/test/fixtures/bench-runner/run.cjs
new file mode 100644
index 000000000000..4064dc1c9797
--- /dev/null
+++ b/test/fixtures/bench-runner/run.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench, run } = require('node:bench');
+
+bench('declared before run', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+run();
diff --git a/test/fixtures/bench-runner/send-error.cjs b/test/fixtures/bench-runner/send-error.cjs
new file mode 100644
index 000000000000..9e1df941dfeb
--- /dev/null
+++ b/test/fixtures/bench-runner/send-error.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+if (process.env.NODE_BENCH_SEND_ERROR === 'callback') {
+  process.send = (_message, _handle, _options, callback) => {
+    callback(new Error('benchmark send callback failed'));
+  };
+} else {
+  process.send = () => { throw new Error('benchmark send threw'); };
+}
+
+const { bench } = require('node:bench');
+
+bench('send error', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/serial-a.cjs b/test/fixtures/bench-runner/serial-a.cjs
new file mode 100644
index 000000000000..02ea8d8d972a
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-a.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial a');
diff --git a/test/fixtures/bench-runner/serial-b.cjs b/test/fixtures/bench-runner/serial-b.cjs
new file mode 100644
index 000000000000..58f87d933473
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-b.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial b');
diff --git a/test/fixtures/bench-runner/serial.js b/test/fixtures/bench-runner/serial.js
new file mode 100644
index 000000000000..4e6f44c3b679
--- /dev/null
+++ b/test/fixtures/bench-runner/serial.js
@@ -0,0 +1,17 @@
+'use strict';
+
+const fs = require('fs');
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+module.exports = function register(name) {
+  const lock = process.env.NODE_BENCH_LOCK;
+  fs.writeFileSync(lock, `${process.pid}`, { flag: 'wx' });
+  process.on('exit', () => fs.unlinkSync(lock));
+
+  bench(name, { samples: 1 }, async (b) => {
+    b.start();
+    await setTimeout(25);
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/slow-reporter.cjs b/test/fixtures/bench-runner/slow-reporter.cjs
new file mode 100644
index 000000000000..7832bd94cd49
--- /dev/null
+++ b/test/fixtures/bench-runner/slow-reporter.cjs
@@ -0,0 +1,36 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+
+module.exports = async function* slowReporter(source) {
+  const { promise, resolve } = Promise.withResolvers();
+  let emitted = 0;
+  const onRecord = () => {
+    if (++emitted === source.readableHighWaterMark) resolve();
+  };
+  for (const type of [
+    'bench:plan',
+    'bench:start',
+    'bench:sample',
+    'bench:complete',
+    'bench:diagnostic',
+    'bench:summary',
+  ]) {
+    source.on(type, onRecord);
+  }
+  await promise;
+
+  let samples = 0;
+  let stdout = '';
+  for await (const record of source) {
+    await setTimeout(2);
+    if (record.type === 'bench:sample') samples++;
+    if (record.type === 'bench:diagnostic' &&
+        record.data.stream === 'stdout') {
+      stdout += record.data.message;
+    }
+    if (record.type === 'bench:summary') {
+      yield `${JSON.stringify({ samples, stdout })}\n`;
+    }
+  }
+};
diff --git a/test/fixtures/bench-runner/throws-null.cjs b/test/fixtures/bench-runner/throws-null.cjs
new file mode 100644
index 000000000000..562e969ac350
--- /dev/null
+++ b/test/fixtures/bench-runner/throws-null.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+throw null;
diff --git a/test/fixtures/bench-runner/tools-collision.cjs b/test/fixtures/bench-runner/tools-collision.cjs
new file mode 100644
index 000000000000..40ab0a4d4a50
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-collision.cjs
@@ -0,0 +1,12 @@
+'use strict';
+
+const { bench, suite } = require('node:bench');
+
+function register(name) {
+  bench(name, { params: { size: 1 } }, (b) => {
+    b.record({ duration_ns: 1n, operations: 1 });
+  });
+}
+
+suite('first', () => register('same'));
+suite('second', () => register('same'));
diff --git a/test/fixtures/bench-runner/tools-no-params.cjs b/test/fixtures/bench-runner/tools-no-params.cjs
new file mode 100644
index 000000000000..182a7886286e
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-no-params.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/no-params.js', (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/tools-reserved-param.cjs b/test/fixtures/bench-runner/tools-reserved-param.cjs
new file mode 100644
index 000000000000..8084d6c33f81
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-reserved-param.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/reserved.js', { params: { rate: 'parameter' } }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/tools.cjs b/test/fixtures/bench-runner/tools.cjs
new file mode 100644
index 000000000000..073a090d8829
--- /dev/null
+++ b/test/fixtures/bench-runner/tools.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+if (process.env.NODE_BENCH_PID_LOG !== undefined) {
+  require('fs').appendFileSync(
+    process.env.NODE_BENCH_PID_LOG, `${process.pid}\n`);
+}
+
+for (const size of [1, 2]) {
+  bench('tools/simple.js', {
+    params: { method: 'loop', size },
+  }, (b) => completeSample(b, 1_000));
+}
diff --git a/test/fixtures/bench-runner/utf8-output.cjs b/test/fixtures/bench-runner/utf8-output.cjs
new file mode 100644
index 000000000000..7dab41cd7c22
--- /dev/null
+++ b/test/fixtures/bench-runner/utf8-output.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+const output = Buffer.from('split:\u20ac\n');
+process.stdout.write(output.subarray(0, 7));
+
+bench('UTF-8 output', { samples: 1 }, async (b) => {
+  b.start();
+  await setTimeout(20);
+  process.stdout.write(output.subarray(7));
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/v8-option.cjs b/test/fixtures/bench-runner/v8-option.cjs
new file mode 100644
index 000000000000..833024161c50
--- /dev/null
+++ b/test/fixtures/bench-runner/v8-option.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const assert = require('assert');
+const { bench } = require('node:bench');
+
+assert.strictEqual(Error.stackTraceLimit, 17);
+assert(process.execArgv.includes('--random-seed=17'));
+
+bench('V8 option', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/verifying-reporter.cjs b/test/fixtures/bench-runner/verifying-reporter.cjs
new file mode 100644
index 000000000000..2dd467e12597
--- /dev/null
+++ b/test/fixtures/bench-runner/verifying-reporter.cjs
@@ -0,0 +1,21 @@
+'use strict';
+
+const assert = require('assert');
+
+module.exports = async function* verify(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:sample') {
+      assert.strictEqual(typeof data.duration_ns, 'bigint');
+      assert.strictEqual(typeof data.rate, 'number');
+    }
+    if (type === 'bench:complete' && data.error !== undefined) {
+      assert(data.error instanceof Error);
+      assert.strictEqual(data.error.code, 'ERR_BENCHMARK_FIXTURE');
+      assert.deepStrictEqual(data.error.cause, { value: 42n });
+    }
+    if (type === 'bench:complete' && data.summary !== undefined) {
+      assert(Number.isFinite(data.summary.medianConfidenceInterval.lower));
+    }
+    if (type === 'bench:summary') yield 'verified\n';
+  }
+};
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 3ef61d00afff..0960e69f36fd 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -70,6 +70,7 @@ all: \
   rsa_spkac.spkac \
   rsa_spkac_invalid.spkac \
   rsa_private_2048.pem \
+  rsa_private_2048_3_primes.pem \
   rsa_private_4096.pem \
   rsa_public_2048.pem \
   rsa_public_4096.pem \
@@ -927,6 +928,13 @@ rsa_spkac_invalid.spkac: rsa_spkac.spkac
 rsa_private_2048.pem:
 	openssl genrsa -out rsa_private_2048.pem 2048
 
+rsa_private_2048_3_primes.pem:
+	openssl genpkey \
+		-algorithm RSA \
+		-pkeyopt rsa_keygen_bits:2048 \
+		-pkeyopt rsa_keygen_primes:3 \
+		-out rsa_private_2048_3_primes.pem
+
 rsa_private_4096.pem:
 	openssl genrsa -out rsa_private_4096.pem 4096
 
diff --git a/test/fixtures/keys/rsa_private_2048_3_primes.pem b/test/fixtures/keys/rsa_private_2048_3_primes.pem
new file mode 100644
index 000000000000..49535f2cd7f7
--- /dev/null
+++ b/test/fixtures/keys/rsa_private_2048_3_primes.pem
@@ -0,0 +1,29 @@
+-----BEGIN PRIVATE KEY-----
+MIIE8wIBADANBgkqhkiG9w0BAQEFAASCBN0wggTZAgEBAoIBAQC1Lu9a9Hlj8/OA
+J3I2h/1aFYV59SxWb1KzbuRb2nAoOVWCqG8ettkT7kGN6qva3C/oCw2pYPIlRxpX
+0Vve0fNRqpSCCXcnN9vlKpU0BrHfpIHuXSleT7vwSq70UV5YwjFhL+g5wcCUVCuz
+Fkd8dYb0keqVApSKkcydepk5/BwBwQdkfibs3RuIjROkgIbDKSXrm1lFinqyCBTG
+umLcaL9XMhaJRxsVIVqkCM6hs+kEXhIBvlFIqcycECKEV3l71nV0VM3RwlbORIjx
+iHpSvNEUixGR0Rwx4WdJNU4GiUJGZACKj+RrLX+mh0odOl5r8Up9TkTgWp4UEdUx
+GHbQ6lIrAgMBAAECggEAA8mZY1Nc/kPpQTKR5qXtG+b7RVNku+HT3sBgsbLdSVn5
+eaO/vuqfmxUN9cOEGC0mKzmf7XyDU1grKs7LltrYtUpVlGpSPVWjmSTMvauuKDiu
+Jqd35+irM+pQerj/AYOs9Lv2lLzzA1ivcSmB0uR2gNyiVvVxBAxydNXiBwCn+v8M
++qosREPVN9eEQ+1j+ZWvZ2j/AkT6EDdOl0qbhkLDkaLgDkO4uhAZfNKjwmuVkBoW
+BI9bUiQv9vzsSp7AIVXwd8D+NaX0VuDpbcIq/tIfrl2OxwUDuTkYYsvwlIwvAkZ4
+yMl57x2YjRJu2u4f4t+fuagqCisbbbE+LywM5r+YEQJWB/Z/lOoAXXCRSBSGhI29
+zI+pXWiK4UneitEKTJpdR7i38Var03aciK+q64z4gWDNSBRzYq5eyVWosv0f9WkO
+lQFRfOy0HM68dg2KYDCIVnquCwwgaDcCVgZ7lxyKqwirCDYL9VFxRNiBIOXuMLdl
+6c4YNpdPTrp/AILBeINJYKBYjpro6fPe0YHcxJpMNf5Izaow17VVAqJKDmXbca7y
+SclsgBR6mAnFf6WfFM5rAlYBe2nHp74lphwEVH2tEkyvVFXrotemkv8uyzWliF2w
+SbtC2iTlGQCNmFSxvu1J92B9+AB574aI5r6dget+2+zw4uvt2oizi+8b8e09dgsK
+PY9DUyB9BQJWBTsT4uPAvW3DYlijyOMsOcV3Vg+rH1AMJ09CPTSwwapYLykMpGJA
+pSDPcA8fNrdDNRV9TULRDiyQRhLC+n1tcqVumKFISXEWOIBjmCKTKs9A/9IsZ6EC
+VgQG607Arq/ztxJFVKHY4RW0v8Ofx9Q0h+GDcKqqxDlymZfrDsdKJjC1QTofRUR+
+JJiwshahF2jBtlsPwEjX8/InboaF2f2VlIxzxe2+GpzWeRgzIN9yMIIBDDCCAQgC
+VgOChKyWwWrVMfjdfwtFnMA/OjwK4KBtR8VWwAapaiJPFhZRM0jh8EMsC03X7xm9
+AbL3hfE3eLU2mRLxw1pPh0RfK2xtKTCZWjgnQDhPznMUUvF+FYxHAlYCZbRvGa1U
+Zffy7n7m2Q4+tTD2b8uLZ/jcjess4awvcOs6JQ4tWr07dCroaXPTlahCcBRZdLUK
+uRcGvIDc/3L5vTMwpMK8ghIARrbzf3cYXSpl7eOT4wJWAuPXcrk1PE1YuMidPa2v
+3OshgH2no6BeVW2vChBDnK9IBstWII/AhjQzDHjbj9S8xjLZA6bqHH89uXc+0Z/2
+hF8lLDsruEceLVckmk7wb1eFAvns/XA=
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/openssl3-conf/default_properties.cnf b/test/fixtures/openssl3-conf/default_properties.cnf
new file mode 100644
index 000000000000..bb26de636b2c
--- /dev/null
+++ b/test/fixtures/openssl3-conf/default_properties.cnf
@@ -0,0 +1,19 @@
+nodejs_conf = nodejs_init
+
+[nodejs_init]
+providers = provider_sect
+alg_section = algorithm_sect
+
+# Load both providers but select only implementations from the default provider.
+[provider_sect]
+default = default_sect
+legacy = legacy_sect
+
+[default_sect]
+activate = 1
+
+[legacy_sect]
+activate = 1
+
+[algorithm_sect]
+default_properties = provider=default
diff --git a/test/fixtures/permission/has-reference-types.js b/test/fixtures/permission/has-reference-types.js
new file mode 100644
index 000000000000..c16a99e69adb
--- /dev/null
+++ b/test/fixtures/permission/has-reference-types.js
@@ -0,0 +1,41 @@
+'use strict';
+
+const assert = require('assert');
+const { pathToFileURL } = require('url');
+
+const allowedDir = process.env.ALLOWED_DIR;
+const allowedFile = process.env.ALLOWED_FILE;
+const deniedFile = process.env.DENIED_FILE;
+
+// file: URL
+{
+  assert.strictEqual(process.permission.has('fs.read', pathToFileURL(allowedFile)), true);
+  assert.strictEqual(process.permission.has('fs.read', pathToFileURL(deniedFile)), false);
+  assert.throws(() => {
+    process.permission.has('fs.read', new URL('https://example.com'));
+  }, { code: 'ERR_INVALID_URL_SCHEME' });
+}
+
+// Non-fs scopes like net ignore the reference, so a non-file: URL must not be rejected here.
+{
+  assert.strictEqual(process.permission.has('net', new URL('https://example.com')), false);
+}
+
+// Uint8Array
+{
+  const allowedBytes = new Uint8Array(Buffer.from(allowedFile));
+  const deniedBytes = new Uint8Array(Buffer.from(deniedFile));
+  assert.strictEqual(process.permission.has('fs.read', allowedBytes), true);
+  assert.strictEqual(process.permission.has('fs.read', deniedBytes), false);
+
+  // Must respect byteOffset/byteLength, not read from the start of the buffer.
+  const padded = Buffer.concat([Buffer.from('padding-'), Buffer.from(allowedFile)]);
+  const view = new Uint8Array(padded.buffer, padded.byteOffset + 8, Buffer.byteLength(allowedFile));
+  assert.strictEqual(process.permission.has('fs.read', view), true);
+}
+
+// drop() only matches the exact granted path (the directory), not a file inside it.
+{
+  process.permission.drop('fs.read', pathToFileURL(allowedDir));
+  assert.strictEqual(process.permission.has('fs.read', pathToFileURL(allowedFile)), false);
+}
diff --git a/test/fixtures/sea/vfs-esm/calculator.cjs b/test/fixtures/sea/vfs-esm/calculator.cjs
new file mode 100644
index 000000000000..3499fb2cad12
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/calculator.cjs
@@ -0,0 +1,5 @@
+'use strict';
+// CommonJS module imported from the ESM main to test interop inside the VFS.
+module.exports = {
+  sum: (a, b) => a + b,
+};
diff --git a/test/fixtures/sea/vfs-esm/config.json b/test/fixtures/sea/vfs-esm/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs-esm/greeting.txt b/test/fixtures/sea/vfs-esm/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs-esm/main.mjs b/test/fixtures/sea/vfs-esm/main.mjs
new file mode 100644
index 000000000000..24ae629a5bce
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/main.mjs
@@ -0,0 +1,63 @@
+// The ESM SEA main script runs from inside the VFS mount: import.meta
+// reflects the mount, and static imports, dynamic imports, and bare
+// specifier lookups all resolve against the bundled assets.
+import fs from 'node:fs';
+import path from 'node:path';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+
+// Static import of a relative ESM module from the VFS.
+import { add, multiply } from './modules/math.mjs';
+
+// Static import of a CommonJS module from the VFS (interop).
+import calculator from './modules/calculator.cjs';
+
+// Static import of a bare specifier resolved via the in-VFS node_modules.
+import { name as pkgName, greet } from 'test-esm-pkg';
+
+// The main script runs from inside the VFS, not from the executable.
+assert.ok(import.meta.url.startsWith('file:'));
+assert.strictEqual(path.basename(import.meta.filename), 'main.mjs');
+assert.notStrictEqual(import.meta.filename, process.execPath);
+console.log('main module runs from', import.meta.url);
+
+// import.meta.dirname is the root of the mounted assets.
+const config = JSON.parse(
+  fs.readFileSync(path.join(import.meta.dirname, 'config.json'), 'utf8'));
+assert.strictEqual(config.name, 'test-app');
+const greeting = fs.readFileSync(
+  path.join(import.meta.dirname, 'data', 'greeting.txt'), 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!');
+console.log('fs access through import.meta.dirname passed');
+
+// Static ESM import from the VFS.
+assert.strictEqual(add(2, 3), 5);
+assert.strictEqual(multiply(4, 5), 20);
+console.log('static relative import passed');
+
+// CommonJS interop from the VFS.
+assert.strictEqual(calculator.sum(10, 20), 30);
+console.log('static import of CommonJS module passed');
+
+// Bare specifier resolution confined to the in-VFS node_modules.
+assert.strictEqual(pkgName, 'test-esm-pkg');
+assert.strictEqual(greet('World'), 'Hello, World!');
+console.log('bare specifier import passed');
+
+// Dynamic import from the VFS.
+const dynamicMath = await import('./modules/math.mjs');
+assert.strictEqual(dynamicMath.add(1, 1), 2);
+console.log('dynamic import passed');
+
+// createRequire against the VFS main URL.
+const require = createRequire(import.meta.url);
+const requiredCalculator = require('./modules/calculator.cjs');
+assert.strictEqual(requiredCalculator.sum(3, 4), 7);
+console.log('createRequire from import.meta.url passed');
+
+// node:sea and the VFS serve the same content.
+const { getAsset } = await import('node:sea');
+assert.strictEqual(getAsset('data/greeting.txt', 'utf8'), greeting);
+console.log('node:sea API and VFS coexistence passed');
+
+console.log('All SEA VFS ESM tests passed!');
diff --git a/test/fixtures/sea/vfs-esm/math.mjs b/test/fixtures/sea/vfs-esm/math.mjs
new file mode 100644
index 000000000000..acc4868a6f6e
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/math.mjs
@@ -0,0 +1,6 @@
+export function add(a, b) {
+  return a + b;
+}
+export function multiply(a, b) {
+  return a * b;
+}
diff --git a/test/fixtures/sea/vfs-esm/sea-config.json b/test/fixtures/sea/vfs-esm/sea-config.json
new file mode 100644
index 000000000000..c17694a412fa
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/sea-config.json
@@ -0,0 +1,14 @@
+{
+  "main": "main.mjs",
+  "mainFormat": "module",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.mjs": "math.mjs",
+    "modules/calculator.cjs": "calculator.cjs",
+    "node_modules/test-esm-pkg/package.json": "test-esm-pkg-package.json",
+    "node_modules/test-esm-pkg/index.mjs": "test-esm-pkg-index.mjs"
+  }
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
new file mode 100644
index 000000000000..1cc3c9c7fa55
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
@@ -0,0 +1,4 @@
+export const name = 'test-esm-pkg';
+export function greet(who) {
+  return `Hello, ${who}!`;
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
new file mode 100644
index 000000000000..ee0ab8500ba1
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
@@ -0,0 +1,6 @@
+{
+  "name": "test-esm-pkg",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": { ".": "./index.mjs" }
+}
diff --git a/test/fixtures/sea/vfs/calculator.js b/test/fixtures/sea/vfs/calculator.js
new file mode 100644
index 000000000000..dc8e496a85ee
--- /dev/null
+++ b/test/fixtures/sea/vfs/calculator.js
@@ -0,0 +1,9 @@
+'use strict';
+// This module tests transitive requires - it requires math.js using a
+// relative path, which tests that module hooks resolve correctly.
+const math = require('./math.js');
+
+module.exports = {
+  sum: (a, b) => math.add(a, b),
+  product: (a, b) => math.multiply(a, b),
+};
diff --git a/test/fixtures/sea/vfs/config.json b/test/fixtures/sea/vfs/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs/greeting.txt b/test/fixtures/sea/vfs/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs/math.js b/test/fixtures/sea/vfs/math.js
new file mode 100644
index 000000000000..26be73d850ac
--- /dev/null
+++ b/test/fixtures/sea/vfs/math.js
@@ -0,0 +1,4 @@
+module.exports = {
+  add: (a, b) => a + b,
+  multiply: (a, b) => a * b,
+};
diff --git a/test/fixtures/sea/vfs/sea-config.json b/test/fixtures/sea/vfs/sea-config.json
new file mode 100644
index 000000000000..767e778ea26e
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea-config.json
@@ -0,0 +1,15 @@
+{
+  "main": "sea.js",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.js": "math.js",
+    "modules/calculator.js": "calculator.js",
+    "node_modules/test-pkg/package.json": "test-pkg-package.json",
+    "node_modules/test-pkg/index.js": "test-pkg-index.js",
+    "node_modules/test-exports-pkg/package.json": "test-exports-pkg-package.json",
+    "node_modules/test-exports-pkg/lib/entry.js": "test-exports-pkg-entry.js"
+  }
+}
diff --git a/test/fixtures/sea/vfs/sea.js b/test/fixtures/sea/vfs/sea.js
new file mode 100644
index 000000000000..59989390c7d1
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea.js
@@ -0,0 +1,106 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+// The SEA VFS never shadows the real file system: the assets are mounted at
+// a reserved mount point and the main script runs from inside the mount, so
+// everything is reachable through __dirname-relative paths and relative
+// requires.
+
+// The main script runs from inside the VFS, not from the executable.
+assert.notStrictEqual(__filename, process.execPath);
+assert.strictEqual(path.basename(__filename), 'sea.js');
+assert.strictEqual(require.main, module);
+console.log('main script runs from', __filename);
+
+// The main script itself is readable through fs.
+assert.strictEqual(fs.existsSync(__filename), true);
+
+// Read the config file through standard fs (via VFS hooks)
+const configContent = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const config = JSON.parse(configContent);
+assert.strictEqual(config.name, 'test-app', 'config.name should match');
+assert.strictEqual(config.version, '1.0.0', 'config.version should match');
+console.log('Read config.json:', config);
+
+// Read a text file
+const greetingPath = path.join(__dirname, 'data', 'greeting.txt');
+const greeting = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!', 'greeting should match');
+console.log('Read greeting.txt:', greeting);
+
+// Test existsSync
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'config.json')), true);
+assert.strictEqual(fs.existsSync(greetingPath), true);
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'nonexistent.txt')), false);
+console.log('existsSync tests passed');
+
+// Test statSync
+const configStat = fs.statSync(path.join(__dirname, 'config.json'));
+assert.strictEqual(configStat.isFile(), true);
+assert.strictEqual(configStat.isDirectory(), false);
+const dirStat = fs.statSync(path.join(__dirname, 'data'));
+assert.strictEqual(dirStat.isDirectory(), true);
+console.log('statSync tests passed');
+
+// Test readdirSync - the mount root lists the assets and the main script
+const entries = fs.readdirSync(__dirname);
+assert.ok(entries.includes('config.json'), 'Should include config.json');
+assert.ok(entries.includes('data'), 'Should include data directory');
+assert.ok(entries.includes('sea.js'), 'Should include the main script');
+console.log('readdirSync tests passed, entries:', entries);
+
+// The VFS is read-only
+assert.throws(() => {
+  fs.writeFileSync(path.join(__dirname, 'new-file.txt'), 'nope');
+}, { code: 'EROFS' });
+console.log('read-only test passed');
+
+// Test relative require from main script - __filename is inside the mount so
+// relative paths resolve against the bundled assets via module hooks
+const mathModule = require('./modules/math.js');
+assert.strictEqual(mathModule.add(2, 3), 5, 'math.add should work');
+assert.strictEqual(mathModule.multiply(4, 5), 20, 'math.multiply should work');
+console.log('relative require from main script passed');
+
+// Test transitive requires: calculator.js requires ./math.js internally
+const calculator = require('./modules/calculator.js');
+assert.strictEqual(calculator.sum(10, 20), 30, 'calculator.sum should work');
+assert.strictEqual(calculator.product(3, 7), 21, 'calculator.product should work');
+console.log('transitive require from VFS tests passed');
+
+// Module lookup paths are confined to the mount
+assert.deepStrictEqual(module.paths, [path.join(__dirname, 'node_modules')]);
+console.log('module.paths confinement test passed');
+
+// Test that node:sea API and VFS can load the same asset
+const sea = require('node:sea');
+const seaAsset = sea.getAsset('data/greeting.txt', 'utf8');
+const vfsAsset = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(seaAsset, vfsAsset, 'node:sea and VFS should return the same content');
+console.log('node:sea API and VFS coexistence test passed');
+
+// Test buffer independence: multiple reads return independent copies
+const buf1 = fs.readFileSync(greetingPath);
+const buf2 = fs.readFileSync(greetingPath);
+const original = buf1[0];
+buf1[0] = 0xFF;
+assert.strictEqual(buf2[0], original, 'buf2 should be unaffected by buf1 mutation');
+assert.strictEqual(buf1[0], 0xFF, 'buf1 mutation should persist');
+console.log('buffer independence test passed');
+
+// Test node_modules package lookup via VFS (resolved through "exports" field)
+const testPkg = require('test-pkg');
+assert.strictEqual(testPkg.name, 'test-pkg', 'package name should match');
+assert.strictEqual(testPkg.greet('World'), 'Hello, World!', 'package function should work');
+console.log('node_modules package lookup test passed');
+
+// Test exports-only package (no "main" field, entry in subdirectory)
+// This proves the package.json reader is VFS-aware - without it,
+// "exports" would not be consulted and resolution would fail.
+const exportsPkg = require('test-exports-pkg');
+assert.strictEqual(exportsPkg.fromExports, true, 'exports-only package should resolve');
+console.log('exports-only package lookup test passed');
+
+console.log('All SEA VFS tests passed!');
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-entry.js b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
new file mode 100644
index 000000000000..3ef6bdcadc7a
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
@@ -0,0 +1,2 @@
+'use strict';
+module.exports = { fromExports: true };
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-package.json b/test/fixtures/sea/vfs/test-exports-pkg-package.json
new file mode 100644
index 000000000000..86f62f622da5
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-exports-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./lib/entry.js" }
+}
diff --git a/test/fixtures/sea/vfs/test-pkg-index.js b/test/fixtures/sea/vfs/test-pkg-index.js
new file mode 100644
index 000000000000..e6c2ee94611c
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-index.js
@@ -0,0 +1,5 @@
+'use strict';
+module.exports = {
+  name: 'test-pkg',
+  greet: (name) => `Hello, ${name}!`,
+};
diff --git a/test/fixtures/sea/vfs/test-pkg-package.json b/test/fixtures/sea/vfs/test-pkg-package.json
new file mode 100644
index 000000000000..bc4109d609ae
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./index.js" }
+}
diff --git a/test/fixtures/snapshot/crypto-provider-cipher-cache.js b/test/fixtures/snapshot/crypto-provider-cipher-cache.js
new file mode 100644
index 000000000000..6d765f6b89bb
--- /dev/null
+++ b/test/fixtures/snapshot/crypto-provider-cipher-cache.js
@@ -0,0 +1,55 @@
+'use strict';
+
+const assert = require('assert');
+const {
+  createHash,
+  createCipheriv,
+  getCipherInfo,
+  getCiphers,
+  getHashes,
+  setFips,
+} = require('crypto');
+const { setDeserializeMainFunction } = require('v8').startupSnapshot;
+
+const algorithm = 'aes-128-cbc-cts';
+const key = Buffer.alloc(16);
+const iv = Buffer.alloc(16);
+const legacyCipher = 'blowfish';
+const legacyHash = 'md4';
+
+setFips(0);
+assert(getCiphers().includes(algorithm));
+assert(getCiphers().includes(legacyCipher));
+assert(getHashes().includes(legacyHash));
+assert(getCipherInfo(algorithm));
+createCipheriv(algorithm, key, iv);
+createHash(legacyHash).digest();
+
+setDeserializeMainFunction(() => {
+  assert(getCiphers().includes(algorithm));
+  assert(!getCiphers().includes(legacyCipher));
+  assert(!getHashes().includes(legacyHash));
+  assert(getCipherInfo(algorithm));
+  createCipheriv(algorithm, key, iv);
+  assert.throws(
+    () => createCipheriv(legacyCipher, key, Buffer.alloc(8)),
+    { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+  );
+  assert.throws(
+    () => createHash(legacyHash),
+    { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+  );
+
+  setFips(1);
+  assert(!getCiphers().includes(algorithm));
+  assert.strictEqual(getCipherInfo(algorithm), undefined);
+  assert.throws(() => createCipheriv(algorithm, key, iv), {
+    code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+  });
+
+  setFips(0);
+  assert(getCiphers().includes(algorithm));
+  assert(getCipherInfo(algorithm));
+  createCipheriv(algorithm, key, iv);
+  console.log('provider crypto caches snapshot: ok');
+});
diff --git a/test/fixtures/snapshot/crypto-provider-mac-cache.js b/test/fixtures/snapshot/crypto-provider-mac-cache.js
new file mode 100644
index 000000000000..ac401d8a979a
--- /dev/null
+++ b/test/fixtures/snapshot/crypto-provider-mac-cache.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const assert = require('node:assert');
+const {
+  createMac,
+  getFips,
+  getMacs,
+  setFips,
+} = require('node:crypto');
+const { setDeserializeMainFunction } = require('node:v8').startupSnapshot;
+
+const algorithm = 'poly1305';
+const key = Buffer.from(
+  '85d6be7857556d337f4452fe42d506a8' +
+  '0103808afb0db2fd4abff6af4149f51b',
+  'hex',
+);
+const data = Buffer.from('Cryptographic Forum Research Group');
+const expected = 'a8061dc1305136c6c22b8baf0c0127a9';
+
+setFips(0);
+assert(getMacs().includes(algorithm));
+assert.strictEqual(
+  createMac(algorithm, key).update(data).final('hex'),
+  expected,
+);
+
+setDeserializeMainFunction(() => {
+  // Resolve through the JavaScript alias cache before refreshing getMacs().
+  // Startup snapshot serialization must not retain the build-time cache IDs.
+  assert.strictEqual(
+    createMac(algorithm, key).update(data).final('hex'),
+    expected,
+  );
+  const expectedMacs = getMacs();
+  assert(expectedMacs.includes(algorithm));
+  const disposableMacs = getMacs();
+  disposableMacs.length = 0;
+  assert.deepStrictEqual(getMacs(), expectedMacs);
+  assert.strictEqual(
+    createMac(algorithm, key).update(data).final('hex'),
+    expected,
+  );
+
+  let toggled = false;
+  try {
+    setFips(1);
+    toggled = getFips() === 1;
+  } catch {
+    // FIPS mode is optional; snapshot cache rebuilding is still covered.
+  }
+  if (toggled && !getMacs().includes(algorithm)) {
+    assert.throws(() => createMac(algorithm, key), {
+      code: 'ERR_CRYPTO_INVALID_MAC',
+    });
+  }
+  setFips(0);
+
+  assert(getMacs().includes(algorithm));
+  assert.strictEqual(
+    createMac(algorithm, key).update(data).final('hex'),
+    expected,
+  );
+  console.log('provider MAC cache snapshot: ok');
+});
diff --git a/test/fixtures/sqlite/backup-last-request.mjs b/test/fixtures/sqlite/backup-last-request.mjs
new file mode 100644
index 000000000000..91ad84e77ed5
--- /dev/null
+++ b/test/fixtures/sqlite/backup-last-request.mjs
@@ -0,0 +1,34 @@
+import { backup, DatabaseSync } from 'node:sqlite';
+
+const source = new DatabaseSync(':memory:');
+source.exec(`
+  CREATE TABLE data(value);
+  INSERT INTO data VALUES (zeroblob(1048576));
+`);
+
+let keepAlive = setInterval(() => {}, 1_000);
+let settled = false;
+
+process.once('beforeExit', () => {
+  if (!settled) {
+    process.stderr.write('backup promise did not settle before the event loop became idle\n');
+    process.exit(1);
+  }
+});
+
+backup(source, process.argv[2], {
+  rate: 1,
+  progress() {
+    if (keepAlive !== undefined) {
+      clearInterval(keepAlive);
+      keepAlive = undefined;
+    }
+  },
+}).then(() => {
+  settled = true;
+  source.close();
+}, (error) => {
+  settled = true;
+  process.stderr.write(`${error.stack ?? error}\n`);
+  process.exitCode = 1;
+});
diff --git a/test/fixtures/wasi-preview-1.js b/test/fixtures/wasi-preview-1.js
index 535bc3e5ec18..3fde5a30b759 100644
--- a/test/fixtures/wasi-preview-1.js
+++ b/test/fixtures/wasi-preview-1.js
@@ -68,6 +68,9 @@ assert.strictEqual(wasiPreview1.wasiImport,
       const name = `pthread-${tid}`;
       const sab = new SharedArrayBuffer(8 + 8192);
       const result = new Int32Array(sab);
+      // The thread stores 0 once it has loaded or 1 with an error; wait on a
+      // value neither of them writes so an early notify cannot be missed.
+      Atomics.store(result, 0, -1);
 
       const workerData = {
         name,
@@ -106,7 +109,7 @@ assert.strictEqual(wasiPreview1.wasiImport,
         throw new Error(e);
       });
 
-      const r = Atomics.wait(result, 0, 0, 1000);
+      const r = Atomics.wait(result, 0, -1, common.platformTimeout(30_000));
       if (r === 'timed-out') {
         workers[tid].terminate();
         delete workers[tid];
diff --git a/test/fixtures/web-worker/classic.mjs b/test/fixtures/web-worker/classic.mjs
new file mode 100644
index 000000000000..b2ecbaa7030d
--- /dev/null
+++ b/test/fixtures/web-worker/classic.mjs
@@ -0,0 +1,7 @@
+var classicBinding = 'classic';
+
+postMessage({
+  binding: globalThis.classicBinding,
+  requireType: typeof require,
+  thisIsGlobal: this === globalThis,
+});
diff --git a/test/fixtures/web-worker/close.js b/test/fixtures/web-worker/close.js
new file mode 100644
index 000000000000..2f7c3b351d44
--- /dev/null
+++ b/test/fixtures/web-worker/close.js
@@ -0,0 +1,7 @@
+'use strict';
+
+postMessage('before-close');
+// close() terminates the worker immediately
+close();
+// This shouldn't be called
+postMessage('after-close');
diff --git a/test/fixtures/web-worker/echo.js b/test/fixtures/web-worker/echo.js
new file mode 100644
index 000000000000..753c32599775
--- /dev/null
+++ b/test/fixtures/web-worker/echo.js
@@ -0,0 +1,5 @@
+'use strict';
+
+addEventListener('message', (event) => {
+  postMessage(event.data);
+});
diff --git a/test/fixtures/web-worker/import-scheme.js b/test/fixtures/web-worker/import-scheme.js
new file mode 100644
index 000000000000..af52513a65ea
--- /dev/null
+++ b/test/fixtures/web-worker/import-scheme.js
@@ -0,0 +1,11 @@
+'use strict';
+
+let name = null;
+try {
+  // The only accepted schemes are 'blob', 'file', and 'data'
+  importScripts('https://nodejs.org/worker.js');
+} catch (err) {
+  name = err.name;
+}
+
+postMessage(name);
diff --git a/test/fixtures/web-worker/module-dependency.mjs b/test/fixtures/web-worker/module-dependency.mjs
new file mode 100644
index 000000000000..bd1596224653
--- /dev/null
+++ b/test/fixtures/web-worker/module-dependency.mjs
@@ -0,0 +1 @@
+export default 'module';
diff --git a/test/fixtures/web-worker/module.cjs b/test/fixtures/web-worker/module.cjs
new file mode 100644
index 000000000000..0f5507a85c5d
--- /dev/null
+++ b/test/fixtures/web-worker/module.cjs
@@ -0,0 +1,7 @@
+import value from './module-dependency.mjs';
+
+postMessage({
+  requireType: typeof require,
+  thisIsUndefined: this === undefined,
+  value,
+});
diff --git a/test/fixtures/web-worker/no-events.js b/test/fixtures/web-worker/no-events.js
new file mode 100644
index 000000000000..599b9e1e8674
--- /dev/null
+++ b/test/fixtures/web-worker/no-events.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const dispatched = [];
+for (const name of ['languagechange', 'online', 'offline',
+                    'rejectionhandled', 'unhandledrejection']) {
+  addEventListener(name, () => dispatched.push(name));
+}
+
+let processEvents = 0;
+process.on('unhandledRejection', () => {
+  processEvents++;
+  // Give the event target a chance to fire before reporting back.
+  setImmediate(() => postMessage({
+    dispatched,
+    processEvents,
+  }));
+});
+
+Promise.reject(new Error('reported through process, not the event target'));
diff --git a/test/fixtures/web-worker/relative.js b/test/fixtures/web-worker/relative.js
new file mode 100644
index 000000000000..87f67b64cb26
--- /dev/null
+++ b/test/fixtures/web-worker/relative.js
@@ -0,0 +1,3 @@
+'use strict';
+
+postMessage('relative');
diff --git a/test/fixtures/web-worker/wpt-error-after-result.js b/test/fixtures/web-worker/wpt-error-after-result.js
new file mode 100644
index 000000000000..4dfb835a92f3
--- /dev/null
+++ b/test/fixtures/web-worker/wpt-error-after-result.js
@@ -0,0 +1,12 @@
+'use strict';
+
+// Throw only once a result has been reported, so the harness has to surface
+// the error rather than treat the test file as already done.
+add_result_callback(() => {
+  setTimeout(() => {
+    throw new Error('probe error after first result');
+  }, 0);
+});
+
+test(() => {}, 'reported before error');
+async_test(() => {}, 'waiting for error');
diff --git a/test/fixtures/workload/heap-profile-and-snapshot-near-heap-limit.js b/test/fixtures/workload/heap-profile-and-snapshot-near-heap-limit.js
new file mode 100644
index 000000000000..2f9ad332aa20
--- /dev/null
+++ b/test/fixtures/workload/heap-profile-and-snapshot-near-heap-limit.js
@@ -0,0 +1,9 @@
+'use strict';
+const path = require('path');
+const v8 = require('v8');
+
+v8.setHeapSnapshotNearHeapLimit(1);
+v8.startHeapProfile();
+v8.setHeapProfileNearHeapLimit(1);
+
+require(path.resolve(__dirname, 'grow.js'));
diff --git a/test/fixtures/workload/heap-profile-near-heap-limit-with-heap-prof.js b/test/fixtures/workload/heap-profile-near-heap-limit-with-heap-prof.js
new file mode 100644
index 000000000000..1e39cf5df896
--- /dev/null
+++ b/test/fixtures/workload/heap-profile-near-heap-limit-with-heap-prof.js
@@ -0,0 +1,7 @@
+'use strict';
+const path = require('path');
+const v8 = require('v8');
+
+v8.setHeapProfileNearHeapLimit(1);
+
+require(path.resolve(__dirname, 'grow.js'));
diff --git a/test/fixtures/workload/heap-profile-near-heap-limit.js b/test/fixtures/workload/heap-profile-near-heap-limit.js
new file mode 100644
index 000000000000..303cd71ad12c
--- /dev/null
+++ b/test/fixtures/workload/heap-profile-near-heap-limit.js
@@ -0,0 +1,8 @@
+'use strict';
+const path = require('path');
+const v8 = require('v8');
+
+v8.startHeapProfile();
+v8.setHeapProfileNearHeapLimit(1);
+
+require(path.resolve(__dirname, 'grow.js'));
diff --git a/test/fixtures/wpt-backends-spec.js b/test/fixtures/wpt-backends-spec.js
new file mode 100644
index 000000000000..19424eddad27
--- /dev/null
+++ b/test/fixtures/wpt-backends-spec.js
@@ -0,0 +1,24 @@
+'use strict';
+
+// Driven through both WPT runner backends by
+// test/parallel/test-common-wpt-backends.js. Between them these produce every
+// kind of message the two backends have to agree on.
+
+test(() => {}, 'passes');
+
+test(() => {
+  assert_true(false, 'deliberate failure');
+}, 'fails');
+
+test(() => {}, 'skipped by name');
+
+test(() => {}, 'skipped by pattern');
+
+promise_test(async () => {}, 'passes asynchronously');
+
+if (globalThis.WPT_BACKENDS_THROW) {
+  // Thrown once results have already been reported, which is when the backends
+  // stop sharing a mechanism: a worker thread surfaces this through its
+  // 'error' event, a process has to report it before exiting.
+  throw new Error('deliberate uncaught error');
+}
diff --git a/test/fixtures/wpt/interfaces/FileAPI.idl b/test/fixtures/wpt/interfaces/FileAPI.idl
index 49219fce277f..4a711a684459 100644
--- a/test/fixtures/wpt/interfaces/FileAPI.idl
+++ b/test/fixtures/wpt/interfaces/FileAPI.idl
@@ -20,6 +20,7 @@ interface Blob {
   [NewObject] ReadableStream stream();
   [NewObject] Promise<USVString> text();
   [NewObject] Promise<ArrayBuffer> arrayBuffer();
+  [NewObject] ReadableStream textStream();
   [NewObject] Promise<Uint8Array> bytes();
 };
 
diff --git a/test/fixtures/wpt/interfaces/compression.idl b/test/fixtures/wpt/interfaces/compression.idl
index defe4ba55cdf..6e44b4ad6dd9 100644
--- a/test/fixtures/wpt/interfaces/compression.idl
+++ b/test/fixtures/wpt/interfaces/compression.idl
@@ -4,6 +4,7 @@
 // Source: Compression Standard (https://compression.spec.whatwg.org/)
 
 enum CompressionFormat {
+  "brotli",
   "deflate",
   "deflate-raw",
   "gzip",
diff --git a/test/fixtures/wpt/interfaces/dom.idl b/test/fixtures/wpt/interfaces/dom.idl
index 1ddc084b949d..f61580f43a90 100644
--- a/test/fixtures/wpt/interfaces/dom.idl
+++ b/test/fixtures/wpt/interfaces/dom.idl
@@ -328,7 +328,7 @@ interface DOMImplementation {
   [NewObject] XMLDocument createDocument(DOMString? namespace, [LegacyNullToEmptyString] DOMString qualifiedName, optional DocumentType? doctype = null);
   [NewObject] Document createHTMLDocument(optional DOMString title);
 
-  boolean hasFeature(); // useless; always returns true
+  boolean hasFeature(); // historical; always returns true
 };
 
 [Exposed=Window]
@@ -347,9 +347,9 @@ interface DocumentFragment : Node {
 interface ShadowRoot : DocumentFragment {
   readonly attribute ShadowRootMode mode;
   readonly attribute boolean delegatesFocus;
+  readonly attribute boolean serializable;
   readonly attribute SlotAssignmentMode slotAssignment;
   readonly attribute boolean clonable;
-  readonly attribute boolean serializable;
   readonly attribute Element host;
 
   attribute EventHandler onslotchange;
@@ -409,9 +409,9 @@ interface Element : Node {
 dictionary ShadowRootInit {
   required ShadowRootMode mode;
   boolean delegatesFocus = false;
+  boolean serializable = false;
   SlotAssignmentMode slotAssignment = "named";
   boolean clonable = false;
-  boolean serializable = false;
   CustomElementRegistry? customElementRegistry;
 };
 
@@ -438,7 +438,7 @@ interface Attr : Node {
 
   readonly attribute Element? ownerElement;
 
-  readonly attribute boolean specified; // useless; always returns true
+  readonly attribute boolean specified; // historical; always returns true
 };
 [Exposed=Window]
 interface CharacterData : Node {
@@ -464,7 +464,17 @@ interface CDATASection : Text {
 };
 [Exposed=Window]
 interface ProcessingInstruction : CharacterData {
+  constructor(DOMString target, optional DOMString data = "");
+
   readonly attribute DOMString target;
+
+  boolean hasAttributes();
+  sequence<DOMString> getAttributeNames();
+  DOMString? getAttribute(DOMString name);
+  undefined setAttribute(DOMString name, DOMString value);
+  undefined removeAttribute(DOMString name);
+  boolean toggleAttribute(DOMString name, optional boolean force);
+  boolean hasAttribute(DOMString name);
 };
 [Exposed=Window]
 interface Comment : CharacterData {
diff --git a/test/fixtures/wpt/interfaces/html.idl b/test/fixtures/wpt/interfaces/html.idl
index 567e5a79a36a..e5ce24af481a 100644
--- a/test/fixtures/wpt/interfaces/html.idl
+++ b/test/fixtures/wpt/interfaces/html.idl
@@ -48,7 +48,8 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
 
 [LegacyOverrideBuiltIns]
 partial interface Document {
-  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html);
+  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html, optional ParseHTMLUnsafeOptions options = {});
+  static Document parseHTML(DOMString html, optional SetHTMLOptions options = {});
 
   // resource metadata management
   [PutForwards=href, LegacyUnforgeable] readonly attribute Location? location;
@@ -152,14 +153,14 @@ dictionary TogglePopoverOptions : ShowPopoverOptions {
 
 HTMLElement includes GlobalEventHandlers;
 HTMLElement includes ElementContentEditable;
-HTMLElement includes HTMLOrSVGElement;
+HTMLElement includes HTMLOrSVGOrMathMLElement;
 
 [Exposed=Window]
 interface HTMLUnknownElement : HTMLElement {
   // Note: intentionally no [HTMLConstructor]
 };
 
-interface mixin HTMLOrSVGElement {
+interface mixin HTMLOrSVGOrMathMLElement {
   [SameObject] readonly attribute DOMStringMap dataset;
   attribute DOMString nonce; // intentionally no [CEReactions]
 
@@ -349,13 +350,10 @@ interface HTMLDivElement : HTMLElement {
 interface HTMLAnchorElement : HTMLElement {
   [HTMLConstructor] constructor();
 
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
   [SameObject, PutForwards=value, Reflect="rel"] readonly attribute DOMTokenList relList;
-  [CEReactions, Reflect] attribute DOMString hreflang;
-  [CEReactions, Reflect] attribute DOMString type;
 
   [CEReactions] attribute DOMString text;
 
@@ -403,10 +401,14 @@ interface mixin HyperlinkElementUtils {
   [CEReactions] attribute USVString pathname;
   [CEReactions] attribute USVString search;
   [CEReactions] attribute USVString hash;
+
+  [CEReactions, Reflect] attribute DOMString hreflang;
+  [CEReactions, Reflect] attribute DOMString type;
 };
 
 interface mixin HTMLHyperlinkElementUtils {
   [CEReactions, ReflectSetter] stringifier attribute USVString href;
+  [CEReactions, Reflect] attribute DOMString target;
 };
 
 [Exposed=Window]
@@ -447,6 +449,7 @@ interface HTMLImageElement : HTMLElement {
   [CEReactions] attribute DOMString? crossOrigin;
   [CEReactions, Reflect] attribute DOMString useMap;
   [CEReactions, Reflect] attribute boolean isMap;
+  [CEReactions, Reflect] attribute boolean controls;
   [CEReactions, ReflectSetter] attribute unsigned long width;
   [CEReactions, ReflectSetter] attribute unsigned long height;
   readonly attribute unsigned long naturalWidth;
@@ -531,6 +534,7 @@ interface HTMLVideoElement : HTMLMediaElement {
   readonly attribute unsigned long videoHeight;
   [CEReactions, ReflectURL] attribute USVString poster;
   [CEReactions, Reflect] attribute boolean playsInline;
+
 };
 
 [Exposed=Window,
@@ -613,6 +617,7 @@ interface HTMLMediaElement : HTMLElement {
   attribute double volume;
   attribute boolean muted;
   [CEReactions, Reflect="muted"] attribute boolean defaultMuted;
+  [CEReactions] attribute DOMString loading;
 
   // tracks
   [SameObject] readonly attribute AudioTrackList audioTracks;
@@ -760,7 +765,6 @@ interface HTMLAreaElement : HTMLElement {
   [CEReactions, Reflect] attribute DOMString alt;
   [CEReactions, Reflect] attribute DOMString coords;
   [CEReactions, Reflect] attribute DOMString shape;
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
@@ -966,7 +970,7 @@ interface HTMLButtonElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   [CEReactions, ReflectSetter] attribute DOMString command;
-  [CEReactions, Reflect] attribute Element? commandForElement;
+  [CEReactions, Reflect="commandfor"] attribute Element? commandForElement;
   [CEReactions, Reflect] attribute boolean disabled;
   readonly attribute HTMLFormElement? form;
   [CEReactions, ReflectSetter] attribute USVString formAction;
@@ -1271,10 +1275,12 @@ interface HTMLTemplateElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   readonly attribute DocumentFragment content;
+  [CEReactions, Reflect="for"] attribute DOMString htmlFor;
   [CEReactions] attribute DOMString shadowRootMode;
   [CEReactions, Reflect] attribute boolean shadowRootDelegatesFocus;
-  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute boolean shadowRootSerializable;
+  [CEReactions] attribute DOMString shadowRootSlotAssignment;
+  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute DOMString shadowRootCustomElementRegistry;
 };
 
@@ -1808,7 +1814,7 @@ dictionary DragEventInit : MouseEventInit {
 };
 
 interface mixin PopoverTargetAttributes {
-  [CEReactions, Reflect] attribute Element? popoverTargetElement;
+  [CEReactions, Reflect="popovertarget"] attribute Element? popoverTargetElement;
   [CEReactions] attribute DOMString popoverTargetAction;
 };
 
@@ -2357,7 +2363,8 @@ Window includes WindowOrWorkerGlobalScope;
 WorkerGlobalScope includes WindowOrWorkerGlobalScope;
 
 partial interface Element {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
@@ -2366,12 +2373,25 @@ partial interface Element {
 };
 
 partial interface ShadowRoot {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
 };
 
+enum SanitizerPresets { "default" };
+dictionary SetHTMLOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
+};
+dictionary SetHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+  boolean runScripts = false;
+};
+dictionary ParseHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+};
+
 dictionary GetHTMLOptions {
   boolean serializableShadowRoots = false;
   sequence<ShadowRoot> shadowRoots = [];
@@ -2403,6 +2423,68 @@ interface XMLSerializer {
   DOMString serializeToString(Node root);
 };
 
+[Exposed=Window]
+interface Sanitizer {
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");
+
+  // Query configuration:
+  SanitizerConfig get();
+
+  // Modify a Sanitizer's lists and fields:
+  boolean allowElement(SanitizerElementWithAttributes element);
+  boolean removeElement(SanitizerElement element);
+  boolean replaceElementWithChildren(SanitizerElement element);
+  boolean allowProcessingInstruction(SanitizerPI pi);
+  boolean removeProcessingInstruction(SanitizerPI pi);
+  boolean allowAttribute(SanitizerAttribute attribute);
+  boolean removeAttribute(SanitizerAttribute attribute);
+  boolean setComments(boolean allow);
+  boolean setDataAttributes(boolean allow);
+
+  // Remove markup that executes script.
+  boolean removeUnsafe();
+};
+
+dictionary SanitizerElementNamespace {
+  required DOMString name;
+  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
+};
+
+// Used by "elements"
+dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+};
+
+dictionary SanitizerAttributeNamespace {
+  required DOMString name;
+  DOMString? _namespace = null;
+};
+
+dictionary SanitizerProcessingInstruction {
+  required DOMString target;
+};
+
+typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
+typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
+typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
+typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;
+
+dictionary SanitizerConfig {
+  sequence<SanitizerElementWithAttributes> elements;
+  sequence<SanitizerElement> removeElements;
+  sequence<SanitizerElement> replaceWithChildrenElements;
+
+  sequence<SanitizerPI> processingInstructions;
+  sequence<SanitizerPI> removeProcessingInstructions;
+
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+
+  boolean comments;
+  boolean dataAttributes;
+};
+
 [Exposed=Window]
 interface Navigator {
   // objects implementing this interface also implement the interfaces given below
diff --git a/test/fixtures/wpt/interfaces/resource-timing.idl b/test/fixtures/wpt/interfaces/resource-timing.idl
index ba8e3953b497..1391b09022e1 100644
--- a/test/fixtures/wpt/interfaces/resource-timing.idl
+++ b/test/fixtures/wpt/interfaces/resource-timing.idl
@@ -41,7 +41,8 @@ enum RenderBlockingStatusType {
     "non-blocking"
 };
 
-partial interface Performance {  undefined clearResourceTimings ();
-  undefined setResourceTimingBufferSize (unsigned long maxSize);
-  attribute EventHandler onresourcetimingbufferfull;
-};
+partial interface Performance {
+      undefined clearResourceTimings ();
+      undefined setResourceTimingBufferSize (unsigned long maxSize);
+      attribute EventHandler onresourcetimingbufferfull;
+    };
diff --git a/test/fixtures/wpt/interfaces/streams.idl b/test/fixtures/wpt/interfaces/streams.idl
index 8abc8f5cfda9..a0de8b89aa46 100644
--- a/test/fixtures/wpt/interfaces/streams.idl
+++ b/test/fixtures/wpt/interfaces/streams.idl
@@ -7,7 +7,7 @@
 interface ReadableStream {
   constructor(optional object underlyingSource, optional QueuingStrategy strategy = {});
 
-  static ReadableStream from(any asyncIterable);
+  static ReadableStream from(async_sequence<any> asyncIterable);
 
   readonly attribute boolean locked;
 
@@ -114,7 +114,7 @@ interface ReadableByteStreamController {
 
 [Exposed=*]
 interface ReadableStreamBYOBRequest {
-  readonly attribute ArrayBufferView? view;
+  readonly attribute Uint8Array? view;
 
   undefined respond([EnforceRange] unsigned long long bytesWritten);
   undefined respondWithNewView(ArrayBufferView view);
diff --git a/test/fixtures/wpt/interfaces/web-locks.idl b/test/fixtures/wpt/interfaces/web-locks.idl
index 00648cc3b1e5..d79e404b983f 100644
--- a/test/fixtures/wpt/interfaces/web-locks.idl
+++ b/test/fixtures/wpt/interfaces/web-locks.idl
@@ -10,7 +10,7 @@ interface mixin NavigatorLocks {
 Navigator includes NavigatorLocks;
 WorkerNavigator includes NavigatorLocks;
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface LockManager {
   Promise<any> request(DOMString name,
                        LockGrantedCallback callback);
@@ -43,7 +43,7 @@ dictionary LockInfo {
   DOMString clientId;
 };
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface Lock {
   readonly attribute DOMString name;
   readonly attribute LockMode mode;
diff --git a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
index aeb1d650b7d7..00df80f74ccf 100644
--- a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
@@ -38,7 +38,7 @@ partial interface SubtleCrypto {
 
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
-                   optional unsigned long? length = null);
+                   optional [EnforceRange] unsigned long? length = null);
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
                    AlgorithmIdentifier additionalAlgorithm);
@@ -59,7 +59,7 @@ dictionary EncapsulatedBits {
 };
 
 partial dictionary JsonWebKey {
-  // The following fields are defined in draft-ietf-cose-dilithium-08
+  // The following fields are defined in RFC 9964
   DOMString pub;
   DOMString priv;
 };
@@ -99,7 +99,7 @@ dictionary KmacImportParams : Algorithm {
 };
 
 dictionary KmacKeyAlgorithm : KeyAlgorithm {
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary KmacParams : Algorithm {
diff --git a/test/fixtures/wpt/interfaces/webcrypto.idl b/test/fixtures/wpt/interfaces/webcrypto.idl
index ebb9cf5718b9..7599a1a994aa 100644
--- a/test/fixtures/wpt/interfaces/webcrypto.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto.idl
@@ -79,7 +79,7 @@ interface SubtleCrypto {
   Promise<ArrayBuffer> deriveBits(
     AlgorithmIdentifier algorithm,
     CryptoKey baseKey,
-    optional unsigned long? length = null
+    optional [EnforceRange] unsigned long? length = null
   );
 
   Promise<CryptoKey> importKey(
@@ -161,7 +161,7 @@ dictionary RsaHashedKeyGenParams : RsaKeyGenParams {
 };
 
 dictionary RsaKeyAlgorithm : KeyAlgorithm {
-  required unsigned long modulusLength;
+  required [EnforceRange] unsigned long modulusLength;
   required BigInteger publicExponent;
 };
 
@@ -209,7 +209,7 @@ dictionary AesCtrParams : Algorithm {
 };
 
 dictionary AesKeyAlgorithm : KeyAlgorithm {
-  required unsigned short length;
+  required [EnforceRange] unsigned short length;
 };
 
 dictionary AesKeyGenParams : Algorithm {
@@ -237,7 +237,7 @@ dictionary HmacImportParams : Algorithm {
 
 dictionary HmacKeyAlgorithm : KeyAlgorithm {
   required KeyAlgorithm hash;
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary HmacKeyGenParams : Algorithm {
diff --git a/test/fixtures/wpt/service-workers/META.yml b/test/fixtures/wpt/service-workers/META.yml
new file mode 100644
index 000000000000..03a0dd0fe16e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/META.yml
@@ -0,0 +1,6 @@
+spec: https://w3c.github.io/ServiceWorker/
+suggested_reviewers:
+  - asutherland
+  - mkruisselbrink
+  - mattto
+  - wanderview
diff --git a/test/fixtures/wpt/service-workers/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..4c579802fad5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "*": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/cache-storage/META.yml b/test/fixtures/wpt/service-workers/cache-storage/META.yml
new file mode 100644
index 000000000000..bf34474f74aa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/META.yml
@@ -0,0 +1,3 @@
+suggested_reviewers:
+  - inexorabletash
+  - wanderview
diff --git a/test/fixtures/wpt/service-workers/cache-storage/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/cache-storage/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-abort.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-abort.https.any.js
new file mode 100644
index 000000000000..99f29b0a08ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-abort.https.any.js
@@ -0,0 +1,81 @@
+// META: title=Cache Storage: Abort
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: script=/common/utils.js
+// META: timeout=long
+
+// We perform the same tests on put, add, addAll. Parameterise the tests to
+// reduce repetition.
+const methodsToTest = {
+  put: async (cache, request) => {
+    const response = await fetch(request);
+    return cache.put(request, response);
+  },
+  add: async (cache, request) => cache.add(request),
+  addAll: async (cache, request) => cache.addAll([request]),
+};
+
+for (const method in methodsToTest) {
+  const perform = methodsToTest[method];
+
+  cache_test(async (cache, test) => {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    controller.abort();
+    const request = new Request('../resources/simple.txt', { signal });
+    return promise_rejects_dom(test, 'AbortError', perform(cache, request),
+                          `${method} should reject`);
+  }, `${method}() on an already-aborted request should reject with AbortError`);
+
+  cache_test(async (cache, test) => {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const request = new Request('../resources/simple.txt', { signal });
+    const promise = perform(cache, request);
+    controller.abort();
+    return promise_rejects_dom(test, 'AbortError', promise,
+                          `${method} should reject`);
+  }, `${method}() synchronously followed by abort should reject with ` +
+     `AbortError`);
+
+  cache_test(async (cache, test) => {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const stateKey = token();
+    const abortKey = token();
+    const request = new Request(
+        `../../../fetch/api/resources/infinite-slow-response.py?stateKey=${stateKey}&abortKey=${abortKey}`,
+        { signal });
+
+    const promise = perform(cache, request);
+
+    // Wait for the server to start sending the response body.
+    let opened = false;
+    do {
+      // Normally only one fetch to 'stash-take' is needed, but the fetches
+      // will be served in reverse order sometimes
+      // (i.e., 'stash-take' gets served before 'infinite-slow-response').
+
+      const response =
+            await fetch(`../../../fetch/api/resources/stash-take.py?key=${stateKey}`);
+      const body = await response.json();
+      if (body === 'open') opened = true;
+    } while (!opened);
+
+    // Sadly the above loop cannot guarantee that the browser has started
+    // processing the response body. This delay is needed to make the test
+    // failures non-flaky in Chrome version 66. My deepest apologies.
+    await new Promise(resolve => setTimeout(resolve, 250));
+
+    controller.abort();
+
+    await promise_rejects_dom(test, 'AbortError', promise,
+                          `${method} should reject`);
+
+    // infinite-slow-response.py doesn't know when to stop.
+    return fetch(`../../../fetch/api/resources/stash-put.py?key=${abortKey}&value=close`);
+  }, `${method}() followed by abort after headers received should reject ` +
+     `with AbortError`);
+}
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-add.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-add.https.any.js
new file mode 100644
index 000000000000..c4846eaae40a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-add.https.any.js
@@ -0,0 +1,368 @@
+// META: title=Cache.add and Cache.addAll
+// META: global=window,worker
+// META: script=/common/get-host-info.sub.js
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+const { REMOTE_HOST } = get_host_info();
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add(),
+      'Cache.add should throw a TypeError when no arguments are given.');
+  }, 'Cache.add called with no arguments');
+
+cache_test(function(cache) {
+    return cache.add('./resources/simple.txt')
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+          return cache.match('./resources/simple.txt');
+        })
+        .then(function(response) {
+          assert_class_string(response, 'Response',
+                              'Cache.add should put a resource in the cache.');
+          return response.text();
+        })
+        .then(function(body) {
+          assert_equals(body, 'a simple text file\n',
+                        'Cache.add should retrieve the correct body.');
+        });
+  }, 'Cache.add called with relative URL specified as a string');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('javascript://this-is-not-http-mmkay'),
+      'Cache.add should throw a TypeError for non-HTTP/HTTPS URLs.');
+  }, 'Cache.add called with non-HTTP/HTTPS URL');
+
+cache_test(function(cache) {
+    var request = new Request('./resources/simple.txt');
+    return cache.add(request)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+        });
+  }, 'Cache.add called with Request object');
+
+cache_test(function(cache, test) {
+    var request = new Request('./resources/simple.txt',
+                              {method: 'POST', body: 'This is a body.'});
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add(request),
+      'Cache.add should throw a TypeError for non-GET requests.');
+  }, 'Cache.add called with POST request');
+
+cache_test(function(cache) {
+    var request = new Request('./resources/simple.txt');
+    return cache.add(request)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+        })
+      .then(function() {
+          return cache.add(request);
+        })
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.add should resolve with undefined on success.');
+        });
+  }, 'Cache.add called twice with the same Request object');
+
+cache_test(function(cache) {
+    var request = new Request('./resources/simple.txt');
+    return request.text()
+      .then(function() {
+          assert_false(request.bodyUsed);
+        })
+      .then(function() {
+          return cache.add(request);
+        });
+  }, 'Cache.add with request with null body (not consumed)');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('./resources/fetch-status.py?status=206'),
+      'Cache.add should reject on partial response');
+  }, 'Cache.add with 206 response');
+
+cache_test(function(cache, test) {
+    var urls = ['./resources/fetch-status.py?status=206',
+                './resources/fetch-status.py?status=200'];
+    var requests = urls.map(function(url) {
+        return new Request(url);
+      });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(requests),
+      'Cache.addAll should reject with TypeError if any request fails');
+  }, 'Cache.addAll with 206 response');
+
+cache_test(function(cache, test) {
+    var urls = ['./resources/fetch-status.py?status=206',
+                './resources/fetch-status.py?status=200'];
+    var requests = urls.map(function(url) {
+        var cross_origin_url = new URL(url, location.href);
+        cross_origin_url.hostname = REMOTE_HOST;
+        return new Request(cross_origin_url.href, { mode: 'no-cors' });
+      });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(requests),
+      'Cache.addAll should reject with TypeError if any request fails');
+  }, 'Cache.addAll with opaque-filtered 206 response');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('this-does-not-exist-please-dont-create-it'),
+      'Cache.add should reject if response is !ok');
+  }, 'Cache.add with request that results in a status of 404');
+
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.add('./resources/fetch-status.py?status=500'),
+      'Cache.add should reject if response is !ok');
+  }, 'Cache.add with request that results in a status of 500');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(),
+      'Cache.addAll with no arguments should throw TypeError.');
+  }, 'Cache.addAll with no arguments');
+
+cache_test(function(cache, test) {
+    // Assumes the existence of ../resources/simple.txt and ../resources/blank.html
+    var urls = ['./resources/simple.txt', undefined, './resources/blank.html'];
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(urls),
+      'Cache.addAll should throw TypeError for an undefined argument.');
+  }, 'Cache.addAll with a mix of valid and undefined arguments');
+
+cache_test(function(cache) {
+    return cache.addAll([])
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.addAll should resolve with undefined on ' +
+                        'success.');
+          return cache.keys();
+        })
+      .then(function(result) {
+          assert_equals(result.length, 0,
+                        'There should be no entry in the cache.');
+        });
+  }, 'Cache.addAll with an empty array');
+
+cache_test(function(cache) {
+    // Assumes the existence of ../resources/simple.txt and
+    // ../resources/blank.html
+    var urls = ['./resources/simple.txt',
+                self.location.href,
+                './resources/blank.html'];
+    return cache.addAll(urls)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.addAll should resolve with undefined on ' +
+                        'success.');
+          return Promise.all(
+            urls.map(function(url) { return cache.match(url); }));
+        })
+      .then(function(responses) {
+          assert_class_string(
+            responses[0], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[1], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[2], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          return Promise.all(
+            responses.map(function(response) { return response.text(); }));
+        })
+      .then(function(bodies) {
+          assert_equals(
+            bodies[0], 'a simple text file\n',
+            'Cache.add should retrieve the correct body.');
+          assert_equals(
+            bodies[2], '<!DOCTYPE html>\n<title>Empty doc</title>\n',
+            'Cache.add should retrieve the correct body.');
+        });
+  }, 'Cache.addAll with string URL arguments');
+
+cache_test(function(cache) {
+    // Assumes the existence of ../resources/simple.txt and
+    // ../resources/blank.html
+    var urls = ['./resources/simple.txt',
+                self.location.href,
+                './resources/blank.html'];
+    var requests = urls.map(function(url) {
+        return new Request(url);
+      });
+    return cache.addAll(requests)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.addAll should resolve with undefined on ' +
+                        'success.');
+          return Promise.all(
+            urls.map(function(url) { return cache.match(url); }));
+        })
+      .then(function(responses) {
+          assert_class_string(
+            responses[0], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[1], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          assert_class_string(
+            responses[2], 'Response',
+            'Cache.addAll should put a resource in the cache.');
+          return Promise.all(
+            responses.map(function(response) { return response.text(); }));
+        })
+      .then(function(bodies) {
+          assert_equals(
+            bodies[0], 'a simple text file\n',
+            'Cache.add should retrieve the correct body.');
+          assert_equals(
+            bodies[2], '<!DOCTYPE html>\n<title>Empty doc</title>\n',
+            'Cache.add should retrieve the correct body.');
+        });
+  }, 'Cache.addAll with Request arguments');
+
+cache_test(function(cache, test) {
+    // Assumes that ../resources/simple.txt and ../resources/blank.html exist.
+    // The second resource does not.
+    var urls = ['./resources/simple.txt',
+                'this-resource-should-not-exist',
+                './resources/blank.html'];
+    var requests = urls.map(function(url) {
+        return new Request(url);
+      });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.addAll(requests),
+      'Cache.addAll should reject with TypeError if any request fails')
+      .then(function() {
+          return Promise.all(urls.map(function(url) {
+              return cache.match(url);
+            }));
+      })
+      .then(function(matches) {
+          assert_array_equals(
+            matches,
+            [undefined, undefined, undefined],
+            'If any response fails, no response should be added to cache');
+      });
+  }, 'Cache.addAll with a mix of succeeding and failing requests');
+
+cache_test(function(cache, test) {
+    var request = new Request('./resources/simple.txt');
+    return promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll([request, request]),
+      'Cache.addAll should throw InvalidStateError if the same request is added ' +
+      'twice.');
+  }, 'Cache.addAll called with the same Request object specified twice');
+
+cache_test(async function(cache, test) {
+    const url = './resources/vary.py?vary=x-shape';
+    let requests = [
+      new Request(url, { headers: { 'x-shape': 'circle' }}),
+      new Request(url, { headers: { 'x-shape': 'square' }}),
+    ];
+    let result = await cache.addAll(requests);
+    assert_equals(result, undefined, 'Cache.addAll() should succeed');
+  }, 'Cache.addAll should succeed when entries differ by vary header');
+
+cache_test(async function(cache, test) {
+    const url = './resources/vary.py?vary=x-shape';
+    let requests = [
+      new Request(url, { headers: { 'x-shape': 'circle' }}),
+      new Request(url, { headers: { 'x-shape': 'circle' }}),
+    ];
+    await promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll(requests),
+      'Cache.addAll() should reject when entries are duplicate by vary header');
+  }, 'Cache.addAll should reject when entries are duplicate by vary header');
+
+// VARY header matching is asymmetric.  Determining if two entries are duplicate
+// depends on which entry's response is used in the comparison.  The target
+// response's VARY header determines what request headers are examined.  This
+// test verifies that Cache.addAll() duplicate checking handles this asymmetric
+// behavior correctly.
+cache_test(async function(cache, test) {
+    const base_url = './resources/vary.py';
+
+    // Define a request URL that sets a VARY header in the
+    // query string to be echoed back by the server.
+    const url = base_url + '?vary=x-size';
+
+    // Set a cookie to override the VARY header of the response
+    // when the request is made with credentials.  This will
+    // take precedence over the query string vary param.  This
+    // is a bit confusing, but it's necessary to construct a test
+    // where the URL is the same, but the VARY headers differ.
+    //
+    // Note, the test could also pass this information in additional
+    // request headers.  If the cookie approach becomes too unwieldy
+    // this test could be rewritten to use that technique.
+    await fetch(base_url + '?set-vary-value-override-cookie=x-shape');
+    test.add_cleanup(_ => fetch(base_url + '?clear-vary-value-override-cookie'));
+
+    let requests = [
+      // This request will result in a Response with a "Vary: x-shape"
+      // header.  This *will not* result in a duplicate match with the
+      // other entry.
+      new Request(url, { headers: { 'x-shape': 'circle',
+                                    'x-size': 'big' },
+                         credentials: 'same-origin' }),
+
+      // This request will result in a Response with a "Vary: x-size"
+      // header.  This *will* result in a duplicate match with the other
+      // entry.
+      new Request(url, { headers: { 'x-shape': 'square',
+                                    'x-size': 'big' },
+                         credentials: 'omit' }),
+    ];
+    await promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll(requests),
+      'Cache.addAll() should reject when one entry has a vary header ' +
+      'matching an earlier entry.');
+
+    // Test the reverse order now.
+    await promise_rejects_dom(
+      test,
+      'InvalidStateError',
+      cache.addAll(requests.reverse()),
+      'Cache.addAll() should reject when one entry has a vary header ' +
+      'matching a later entry.');
+
+  }, 'Cache.addAll should reject when one entry has a vary header ' +
+     'matching another entry');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker.https.html b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker.https.html
new file mode 100644
index 000000000000..769200f66aa3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Cache Storage: Verify nested worker functionality</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-storage">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async function(t) {
+   const worker = new Worker("cache-api-nested-worker1.js");
+   const result = await new Promise((resolve, reject) => {
+       worker.onmessage = e => resolve(e.data);
+       t.step_timeout(() => reject("test timed out"), 2000);
+   });
+   assert_equals(result, "PASS");
+}, "Cache API in nested worker");
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker1.js b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker1.js
new file mode 100644
index 000000000000..1a3c7b7c646e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker1.js
@@ -0,0 +1,3 @@
+const worker2 = new Worker("cache-api-nested-worker2.js");
+worker2.onmessage = e => self.postMessage(e.data);
+
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker2.js b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker2.js
new file mode 100644
index 000000000000..0af8c3eebfef
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-api-nested-worker2.js
@@ -0,0 +1 @@
+self.caches.keys().then(() => postMessage('PASS'), () => postMessage('FAIL'));
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-delete.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-delete.https.any.js
new file mode 100644
index 000000000000..3eae2b6a08b7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-delete.https.any.js
@@ -0,0 +1,164 @@
+// META: title=Cache.delete
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+var test_url = 'https://example.com/foo';
+
+// Construct a generic Request object. The URL is |test_url|. All other fields
+// are defaults.
+function new_test_request() {
+  return new Request(test_url);
+}
+
+// Construct a generic Response object.
+function new_test_response() {
+  return new Response('Hello world!', { status: 200 });
+}
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.delete(),
+      'Cache.delete should reject with a TypeError when called with no ' +
+      'arguments.');
+  }, 'Cache.delete with no arguments');
+
+cache_test(function(cache) {
+    return cache.put(new_test_request(), new_test_response())
+      .then(function() {
+          return cache.delete(test_url);
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should resolve with "true" if an entry ' +
+                      'was successfully deleted.');
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_equals(result, undefined,
+            'Cache.delete should remove matching entries from cache.');
+        });
+  }, 'Cache.delete called with a string URL');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    return cache.put(request, new_test_response())
+      .then(function() {
+          return cache.delete(request);
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should resolve with "true" if an entry ' +
+                      'was successfully deleted.');
+        });
+  }, 'Cache.delete called with a Request object');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new_test_response();
+    return cache.put(request, response)
+      .then(function() {
+          return cache.delete(new Request(test_url, {method: 'HEAD'}));
+        })
+      .then(function(result) {
+          assert_false(result,
+                       'Cache.delete should not match a non-GET request ' +
+                       'unless ignoreMethod option is set.');
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+            'Cache.delete should leave non-matching response in the cache.');
+          return cache.delete(new Request(test_url, {method: 'HEAD'}),
+                              {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should match a non-GET request ' +
+                      ' if ignoreMethod is true.');
+        });
+  }, 'Cache.delete called with a HEAD request');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.delete(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_false(result,
+                       'Cache.delete should not delete if vary does not ' +
+                       'match unless ignoreVary is true');
+          return cache.delete(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_true(result,
+                      'Cache.delete should ignore vary if ignoreVary is true');
+        });
+  }, 'Cache.delete supports ignoreVary');
+
+cache_test(function(cache) {
+    return cache.delete(test_url)
+      .then(function(result) {
+          assert_false(result,
+                       'Cache.delete should resolve with "false" if there ' +
+                       'are no matching entries.');
+        });
+  }, 'Cache.delete with a non-existent entry');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a_with_query.request,
+                          { ignoreSearch: true })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ]);
+          return cache.delete(entries.a_with_query.request,
+                              { ignoreSearch: true });
+        })
+      .then(function(result) {
+          return cache.matchAll(entries.a_with_query.request,
+                                { ignoreSearch: true });
+        })
+      .then(function(result) {
+          assert_response_array_equals(result, []);
+        });
+  },
+  'Cache.delete with ignoreSearch option (request with search parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a_with_query.request,
+                          { ignoreSearch: true })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ]);
+          // cache.delete()'s behavior should be the same if ignoreSearch is
+          // not provided or if ignoreSearch is false.
+          return cache.delete(entries.a_with_query.request,
+                              { ignoreSearch: false });
+        })
+      .then(function(result) {
+          return cache.matchAll(entries.a_with_query.request,
+                                { ignoreSearch: true });
+        })
+      .then(function(result) {
+          assert_response_array_equals(result, [ entries.a.response ]);
+        });
+  },
+  'Cache.delete with ignoreSearch option (when it is specified as false)');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-keys-attributes-for-service-worker.https.html b/test/fixtures/wpt/service-workers/cache-storage/cache-keys-attributes-for-service-worker.https.html
new file mode 100644
index 000000000000..3c96348e0e03
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-keys-attributes-for-service-worker.https.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<title>Cache.keys (checking request attributes that can be set only on service workers)</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-keys">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./../service-worker/resources/test-helpers.sub.js"></script>
+<script>
+const worker = './resources/cache-keys-attributes-for-service-worker.js';
+
+function wait(ms) {
+  return new Promise(resolve => step_timeout(resolve, ms));
+}
+
+promise_test(async (t) => {
+    const scope = './resources/blank.html?name=isReloadNavigation';
+    let frame;
+    let reg;
+
+    try {
+      reg = await service_worker_unregister_and_register(t, worker, scope);
+      await wait_for_state(t, reg.installing, 'activated');
+      frame = await with_iframe(scope);
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: false, stored: false');
+      await new Promise((resolve) => {
+        frame.onload = resolve;
+        frame.contentWindow.location.reload();
+      });
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: true, stored: true');
+    } finally {
+      if (frame) {
+        frame.remove();
+      }
+      if (reg) {
+        await reg.unregister();
+      }
+    }
+}, 'Request.IsReloadNavigation should persist.');
+
+promise_test(async (t) => {
+    const scope = './resources/blank.html?name=isHistoryNavigation';
+    let frame;
+    let reg;
+
+    try {
+      reg = await service_worker_unregister_and_register(t, worker, scope);
+      await wait_for_state(t, reg.installing, 'activated');
+      frame = await with_iframe(scope);
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: false, stored: false');
+      // Use step_timeout(0) to ensure the history entry is created for Blink
+      // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+      await wait(0);
+      await new Promise((resolve) => {
+        frame.onload = resolve;
+        frame.src = '../resources/blank.html?ignore';
+      });
+      await wait(0);
+      await new Promise((resolve) => {
+        frame.onload = resolve;
+        frame.contentWindow.history.go(-1);
+      });
+      assert_equals(frame.contentDocument.body.textContent,
+                    'original: true, stored: true');
+    } finally {
+      if (frame) {
+        frame.remove();
+      }
+      if (reg) {
+        await reg.unregister();
+      }
+    }
+}, 'Request.IsHistoryNavigation should persist.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-keys.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-keys.https.any.js
new file mode 100644
index 000000000000..232fb760d408
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-keys.https.any.js
@@ -0,0 +1,212 @@
+// META: title=Cache.keys
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+cache_test(cache => {
+    return cache.keys()
+      .then(requests => {
+          assert_equals(
+            requests.length, 0,
+            'Cache.keys should resolve to an empty array for an empty cache');
+        });
+  }, 'Cache.keys() called on an empty cache');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys('not-present-in-the-cache')
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should resolve with an empty array on failure.');
+        });
+  }, 'Cache.keys with no matching entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a.request.url)
+      .then(function(result) {
+          assert_request_array_equals(result, [entries.a.request],
+                                      'Cache.keys should match by URL.');
+        });
+  }, 'Cache.keys with URL');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a.request)
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [entries.a.request],
+            'Cache.keys should match by Request.');
+        });
+  }, 'Cache.keys with Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(new Request(entries.a.request.url))
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [entries.a.request],
+            'Cache.keys should match by Request.');
+        });
+  }, 'Cache.keys with new Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a.request, {ignoreSearch: true})
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.a.request,
+              entries.a_with_query.request
+            ],
+            'Cache.keys with ignoreSearch should ignore the ' +
+            'search parameters of cached request.');
+        });
+  },
+  'Cache.keys with ignoreSearch option (request with no search ' +
+  'parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.a_with_query.request, {ignoreSearch: true})
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.a.request,
+              entries.a_with_query.request
+            ],
+            'Cache.keys with ignoreSearch should ignore the ' +
+            'search parameters of request.');
+        });
+  },
+  'Cache.keys with ignoreSearch option (request with search parameters)');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return cache.keys(head_request.clone());
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should resolve with an empty array with a ' +
+            'mismatched method.');
+          return cache.keys(head_request.clone(),
+                            {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              request,
+            ],
+            'Cache.keys with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.keys supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.keys(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should resolve with an empty array with a ' +
+            'mismatched vary.');
+          return cache.keys(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              vary_request,
+            ],
+            'Cache.keys with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'Cache.keys supports ignoreVary');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(entries.cat.request.url + '#mouse')
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.cat.request,
+            ],
+            'Cache.keys should ignore URL fragment.');
+        });
+  }, 'Cache.keys with URL containing fragment');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys('http')
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should treat query as a URL and not ' +
+            'just a string fragment.');
+        });
+  }, 'Cache.keys with string fragment "http" as query');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys()
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            simple_entries.map(entry => entry.request),
+            'Cache.keys without parameters should match all entries.');
+        });
+  }, 'Cache.keys without parameters');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(undefined)
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            simple_entries.map(entry => entry.request),
+            'Cache.keys with undefined request should match all entries.');
+        });
+  }, 'Cache.keys with explicitly undefined request');
+
+cache_test(cache => {
+    return cache.keys(undefined, {})
+      .then(requests => {
+          assert_equals(
+            requests.length, 0,
+            'Cache.keys should resolve to an empty array for an empty cache');
+        });
+  }, 'Cache.keys with explicitly undefined request and empty options');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.keys()
+      .then(function(result) {
+          assert_request_array_equals(
+            result,
+            [
+              entries.vary_cookie_is_cookie.request,
+              entries.vary_cookie_is_good.request,
+              entries.vary_cookie_absent.request,
+            ],
+            'Cache.keys without parameters should match all entries.');
+        });
+  }, 'Cache.keys without parameters and VARY entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.keys(new Request(entries.cat.request.url, {method: 'HEAD'}))
+      .then(function(result) {
+          assert_request_array_equals(
+            result, [],
+            'Cache.keys should not match HEAD request unless ignoreMethod ' +
+            'option is set.');
+        });
+  }, 'Cache.keys with a HEAD Request');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-match.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-match.https.any.js
new file mode 100644
index 000000000000..9ca45903cbb1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-match.https.any.js
@@ -0,0 +1,437 @@
+// META: title=Cache.match
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: script=/common/get-host-info.sub.js
+// META: timeout=long
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match('not-present-in-the-cache')
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.match failures should resolve with undefined.');
+        });
+  }, 'Cache.match with no matching entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a.request.url)
+      .then(function(result) {
+          assert_response_equals(result, entries.a.response,
+                                 'Cache.match should match by URL.');
+        });
+  }, 'Cache.match with URL');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a.request)
+      .then(function(result) {
+          assert_response_equals(result, entries.a.response,
+                                 'Cache.match should match by Request.');
+        });
+  }, 'Cache.match with Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var alt_response = new Response('', {status: 201});
+
+    return self.caches.open('second_matching_cache')
+      .then(function(cache) {
+          return cache.put(entries.a.request, alt_response.clone());
+        })
+      .then(function() {
+          return cache.match(entries.a.request);
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, entries.a.response,
+            'Cache.match should match the first cache.');
+        });
+  }, 'Cache.match with multiple cache hits');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(new Request(entries.a.request.url))
+      .then(function(result) {
+          assert_response_equals(result, entries.a.response,
+                                 'Cache.match should match by Request.');
+        });
+  }, 'Cache.match with new Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(new Request(entries.a.request.url, {method: 'HEAD'}))
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.match should not match HEAD Request.');
+        });
+  }, 'Cache.match with HEAD');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a.request,
+                       {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_in_array(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.match with ignoreSearch should ignore the ' +
+            'search parameters of cached request.');
+        });
+  },
+  'Cache.match with ignoreSearch option (request with no search ' +
+  'parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.a_with_query.request,
+                       {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_in_array(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.match with ignoreSearch should ignore the ' +
+            'search parameters of request.');
+        });
+  },
+  'Cache.match with ignoreSearch option (request with search parameter)');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return cache.match(head_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should resolve as undefined with a ' +
+            'mismatched method.');
+          return cache.match(head_request.clone(),
+                             {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'Cache.match with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.match supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.match(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should resolve as undefined with a ' +
+            'mismatched vary.');
+          return cache.match(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, vary_response,
+            'Cache.match with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'Cache.match supports ignoreVary');
+
+cache_test(function(cache) {
+    let has_cache_name = false;
+    const opts = {
+      get cacheName() {
+        has_cache_name = true;
+        return undefined;
+      }
+    };
+    return self.caches.open('foo')
+      .then(function() {
+          return cache.match('bar', opts);
+        })
+      .then(function() {
+          assert_false(has_cache_name,
+                       'Cache.match does not support cacheName option ' +
+                       'which was removed in CacheQueryOptions.');
+        });
+  }, 'Cache.match does not support cacheName option');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match(entries.cat.request.url + '#mouse')
+      .then(function(result) {
+          assert_response_equals(result, entries.cat.response,
+                                 'Cache.match should ignore URL fragment.');
+        });
+  }, 'Cache.match with URL containing fragment');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.match('http')
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should treat query as a URL and not ' +
+            'just a string fragment.');
+        });
+  }, 'Cache.match with string fragment "http" as query');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.match('http://example.com/c')
+      .then(function(result) {
+          assert_response_in_array(
+            result,
+            [
+              entries.vary_cookie_absent.response
+            ],
+            'Cache.match should honor "Vary" header.');
+        });
+  }, 'Cache.match with responses containing "Vary" header');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com');
+    var response;
+    var request_url = new URL('./resources/simple.txt', location.href).href;
+    return fetch(request_url)
+      .then(function(fetch_result) {
+          response = fetch_result;
+          assert_equals(
+            response.url, request_url,
+            '[https://fetch.spec.whatwg.org/#dom-response-url] ' +
+            'Reponse.url should return the URL of the response.');
+          return cache.put(request, response.clone());
+        })
+      .then(function() {
+          return cache.match(request.url);
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'Cache.match should return a Response object that has the same ' +
+            'properties as the stored response.');
+          return cache.match(response.url);
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'Cache.match should not match cache entry based on response URL.');
+        });
+  }, 'Cache.match with Request and Response objects with different URLs');
+
+cache_test(function(cache) {
+    var request_url = new URL('./resources/simple.txt', location.href).href;
+    return fetch(request_url)
+      .then(function(fetch_result) {
+          return cache.put(new Request(request_url), fetch_result);
+        })
+      .then(function() {
+          return cache.match(request_url);
+        })
+      .then(function(result) {
+          return result.text();
+        })
+      .then(function(body_text) {
+          assert_equals(body_text, 'a simple text file\n',
+                        'Cache.match should return a Response object with a ' +
+                        'valid body.');
+        })
+      .then(function() {
+          return cache.match(request_url);
+        })
+      .then(function(result) {
+          return result.text();
+        })
+      .then(function(body_text) {
+          assert_equals(body_text, 'a simple text file\n',
+                        'Cache.match should return a Response object with a ' +
+                        'valid body each time it is called.');
+        });
+  }, 'Cache.match invoked multiple times for the same Request/Response');
+
+cache_test(function(cache) {
+    var request_url = new URL('./resources/simple.txt', location.href).href;
+    return fetch(request_url)
+      .then(function(fetch_result) {
+          return cache.put(new Request(request_url), fetch_result);
+        })
+      .then(function() {
+          return cache.match(request_url);
+        })
+      .then(function(result) {
+          return result.blob();
+        })
+      .then(function(blob) {
+          var sliced = blob.slice(2,8);
+
+          return new Promise(function (resolve, reject) {
+              var reader = new FileReader();
+              reader.onloadend = function(event) {
+                resolve(event.target.result);
+              };
+              reader.readAsText(sliced);
+            });
+        })
+      .then(function(text) {
+          assert_equals(text, 'simple',
+                        'A Response blob returned by Cache.match should be ' +
+                        'sliceable.' );
+        });
+  }, 'Cache.match blob should be sliceable');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var request = new Request(entries.a.request.clone(), {method: 'POST'});
+    return cache.match(request)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.match should not find a match');
+        });
+  }, 'Cache.match with POST Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var response = entries.non_2xx_response.response;
+    return cache.match(entries.non_2xx_response.request.url)
+      .then(function(result) {
+          assert_response_equals(
+              result, entries.non_2xx_response.response,
+              'Cache.match should return a Response object that has the ' +
+                  'same properties as a stored non-2xx response.');
+        });
+  }, 'Cache.match with a non-2xx Response');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    var response = entries.error_response.response;
+    return cache.match(entries.error_response.request.url)
+      .then(function(result) {
+          assert_response_equals(
+              result, entries.error_response.response,
+              'Cache.match should return a Response object that has the ' +
+                  'same properties as a stored network error response.');
+        });
+  }, 'Cache.match with a network error Response');
+
+cache_test(function(cache) {
+    // This test validates that we can get a Response from the Cache API,
+    // clone it, and read just one side of the clone.  This was previously
+    // bugged in FF for Responses with large bodies.
+    var data = [];
+    data.length = 80 * 1024;
+    data.fill('F');
+    var response;
+    return cache.put('/', new Response(data.toString()))
+      .then(function(result) {
+          return cache.match('/');
+        })
+      .then(function(r) {
+          // Make sure the original response is not GC'd.
+          response = r;
+          // Return only the clone.  We purposefully test that the other
+          // half of the clone does not need to be read here.
+          return response.clone().text();
+        })
+      .then(function(text) {
+          assert_equals(text, data.toString(), 'cloned body text can be read correctly');
+        });
+  }, 'Cache produces large Responses that can be cloned and read correctly.');
+
+cache_test(async (cache) => {
+    const url = get_host_info().HTTPS_REMOTE_ORIGIN +
+      '/service-workers/cache-storage/resources/simple.txt?pipe=' +
+      'header(access-control-allow-origin,*)|' +
+      'header(access-control-expose-headers,*)|' +
+      'header(foo,bar)|' +
+      'header(set-cookie,X)';
+
+    const response = await fetch(url);
+    await cache.put(new Request(url), response);
+    const cached_response = await cache.match(url);
+
+    const headers = cached_response.headers;
+    assert_equals(headers.get('access-control-expose-headers'), '*');
+    assert_equals(headers.get('foo'), 'bar');
+    assert_equals(headers.get('set-cookie'), null);
+  }, 'cors-exposed header should be stored correctly.');
+
+cache_test(async (cache) => {
+    // A URL that should load a resource with a known mime type.
+    const url = '/service-workers/cache-storage/resources/blank.html';
+    const expected_mime_type = 'text/html';
+
+    // Verify we get the expected mime type from the network.  Note,
+    // we cannot use an exact match here since some browsers append
+    // character encoding information to the blob.type value.
+    const net_response = await fetch(url);
+    const net_mime_type = (await net_response.blob()).type;
+    assert_true(net_mime_type.includes(expected_mime_type),
+                'network response should include the expected mime type');
+
+    // Verify we get the exact same mime type when reading the same
+    // URL resource back out of the cache.
+    await cache.add(url);
+    const cache_response = await cache.match(url);
+    const cache_mime_type = (await cache_response.blob()).type;
+    assert_equals(cache_mime_type, net_mime_type,
+                  'network and cache response mime types should match');
+  }, 'MIME type should be set from content-header correctly.');
+
+cache_test(async (cache) => {
+    const url = '/dummy';
+    const original_type = 'text/html';
+    const override_type = 'text/plain';
+    const init_with_headers = {
+      headers: {
+        'content-type': original_type
+      }
+    }
+
+    // Verify constructing a synthetic response with a content-type header
+    // gets the correct mime type.
+    const response = new Response('hello world', init_with_headers);
+    const original_response_type = (await response.blob()).type;
+    assert_true(original_response_type.includes(original_type),
+                'original response should include the expected mime type');
+
+    // Verify overwriting the content-type header changes the mime type.
+    const overwritten_response = new Response('hello world', init_with_headers);
+    overwritten_response.headers.set('content-type', override_type);
+    const overwritten_response_type = (await overwritten_response.blob()).type;
+    assert_equals(overwritten_response_type, override_type,
+                  'mime type can be overridden');
+
+    // Verify the Response read from Cache uses the original mime type
+    // computed when it was first constructed.
+    const tmp = new Response('hello world', init_with_headers);
+    tmp.headers.set('content-type', override_type);
+    await cache.put(url, tmp);
+    const cache_response = await cache.match(url);
+    const cache_mime_type = (await cache_response.blob()).type;
+    assert_equals(cache_mime_type, override_type,
+                  'overwritten and cached response mime types should match');
+  }, 'MIME type should reflect Content-Type headers of response.');
+
+cache_test(async (cache) => {
+  const url = new URL('./resources/vary.py?vary=foo',
+      get_host_info().HTTPS_REMOTE_ORIGIN + self.location.pathname);
+  const original_request = new Request(url, { mode: 'no-cors',
+                                              headers: { 'foo': 'bar' } });
+  const fetch_response = await fetch(original_request);
+  assert_equals(fetch_response.type, 'opaque');
+
+  await cache.put(original_request, fetch_response);
+
+  const match_response_1 = await cache.match(original_request);
+  assert_not_equals(match_response_1, undefined);
+
+  // Verify that cache.match() finds the entry even if queried with a varied
+  // header that does not match the cache key.  Vary headers should be ignored
+  // for opaque responses.
+  const different_request = new Request(url, { headers: { 'foo': 'CHANGED' } });
+  const match_response_2 = await cache.match(different_request);
+  assert_not_equals(match_response_2, undefined);
+}, 'Cache.match ignores vary headers on opaque response.');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-matchAll.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-matchAll.https.any.js
new file mode 100644
index 000000000000..93c55178918c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-matchAll.https.any.js
@@ -0,0 +1,244 @@
+// META: title=Cache.matchAll
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll('not-present-in-the-cache')
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should resolve with an empty array on failure.');
+        });
+  }, 'Cache.matchAll with no matching entries');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a.request.url)
+      .then(function(result) {
+          assert_response_array_equals(result, [entries.a.response],
+                                       'Cache.matchAll should match by URL.');
+        });
+  }, 'Cache.matchAll with URL');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a.request)
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [entries.a.response],
+            'Cache.matchAll should match by Request.');
+        });
+  }, 'Cache.matchAll with Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(new Request(entries.a.request.url))
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [entries.a.response],
+            'Cache.matchAll should match by Request.');
+        });
+  }, 'Cache.matchAll with new Request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(new Request(entries.a.request.url, {method: 'HEAD'}),
+                          {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should not match HEAD Request.');
+        });
+  }, 'Cache.matchAll with HEAD');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a.request,
+                          {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.matchAll with ignoreSearch should ignore the ' +
+            'search parameters of cached request.');
+        });
+  },
+  'Cache.matchAll with ignoreSearch option (request with no search ' +
+  'parameters)');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.a_with_query.request,
+                          {ignoreSearch: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.a.response,
+              entries.a_with_query.response
+            ],
+            'Cache.matchAll with ignoreSearch should ignore the ' +
+            'search parameters of request.');
+        });
+  },
+  'Cache.matchAll with ignoreSearch option (request with search parameters)');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return cache.matchAll(head_request.clone());
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should resolve with empty array for a ' +
+            'mismatched method.');
+          return cache.matchAll(head_request.clone(),
+                                {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [response],
+            'Cache.matchAll with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.matchAll supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return cache.matchAll(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should resolve as undefined with a ' +
+            'mismatched vary.');
+          return cache.matchAll(mismatched_vary_request.clone(),
+                              {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [vary_response],
+            'Cache.matchAll with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'Cache.matchAll supports ignoreVary');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(entries.cat.request.url + '#mouse')
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.cat.response,
+            ],
+            'Cache.matchAll should ignore URL fragment.');
+        });
+  }, 'Cache.matchAll with URL containing fragment');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll('http')
+      .then(function(result) {
+          assert_response_array_equals(
+            result, [],
+            'Cache.matchAll should treat query as a URL and not ' +
+            'just a string fragment.');
+        });
+  }, 'Cache.matchAll with string fragment "http" as query');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll()
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            simple_entries.map(entry => entry.response),
+            'Cache.matchAll without parameters should match all entries.');
+        });
+  }, 'Cache.matchAll without parameters');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+    return cache.matchAll(undefined)
+      .then(result => {
+          assert_response_array_equals(
+            result,
+            simple_entries.map(entry => entry.response),
+            'Cache.matchAll with undefined request should match all entries.');
+        });
+  }, 'Cache.matchAll with explicitly undefined request');
+
+prepopulated_cache_test(simple_entries, function(cache, entries) {
+  return cache.matchAll(undefined, {})
+      .then(result => {
+          assert_response_array_equals(
+            result,
+            simple_entries.map(entry => entry.response),
+            'Cache.matchAll with undefined request should match all entries.');
+        });
+  }, 'Cache.matchAll with explicitly undefined request and empty options');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.matchAll('http://example.com/c')
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.vary_cookie_absent.response
+            ],
+            'Cache.matchAll should exclude matches if a vary header is ' +
+            'missing in the query request, but is present in the cached ' +
+            'request.');
+        })
+
+      .then(function() {
+          return cache.matchAll(
+            new Request('http://example.com/c',
+                        {headers: {'Cookies': 'none-of-the-above'}}));
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+            ],
+            'Cache.matchAll should exclude matches if a vary header is ' +
+            'missing in the cached request, but is present in the query ' +
+            'request.');
+        })
+
+      .then(function() {
+          return cache.matchAll(
+            new Request('http://example.com/c',
+                        {headers: {'Cookies': 'is-for-cookie'}}));
+        })
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [entries.vary_cookie_is_cookie.response],
+            'Cache.matchAll should match the entire header if a vary header ' +
+            'is present in both the query and cached requests.');
+        });
+  }, 'Cache.matchAll with responses containing "Vary" header');
+
+prepopulated_cache_test(vary_entries, function(cache, entries) {
+    return cache.matchAll('http://example.com/c',
+                          {ignoreVary: true})
+      .then(function(result) {
+          assert_response_array_equals(
+            result,
+            [
+              entries.vary_cookie_is_cookie.response,
+              entries.vary_cookie_is_good.response,
+              entries.vary_cookie_absent.response
+            ],
+            'Cache.matchAll should support multiple vary request/response ' +
+            'pairs.');
+        });
+  }, 'Cache.matchAll with multiple vary pairs');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-put.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-put.https.any.js
new file mode 100644
index 000000000000..dbf2650a75a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-put.https.any.js
@@ -0,0 +1,411 @@
+// META: title=Cache.put
+// META: global=window,worker
+// META: script=/common/get-host-info.sub.js
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+var test_url = 'https://example.com/foo';
+var test_body = 'Hello world!';
+const { REMOTE_HOST } = get_host_info();
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response(test_body);
+    return cache.put(request, response)
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Cache.put should resolve with undefined on success.');
+        });
+  }, 'Cache.put called with simple Request and Response');
+
+cache_test(function(cache) {
+    var test_url = new URL('./resources/simple.txt', location.href).href;
+    var request = new Request(test_url);
+    var response;
+    return fetch(test_url)
+      .then(function(fetch_result) {
+          response = fetch_result.clone();
+          return cache.put(request, fetch_result);
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should update the cache with ' +
+                                 'new request and response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, 'a simple text file\n',
+                        'Cache.put should store response body.');
+        });
+  }, 'Cache.put called with Request and Response from fetch()');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response(test_body);
+    assert_false(request.bodyUsed,
+                 '[https://fetch.spec.whatwg.org/#dom-body-bodyused] ' +
+                 'Request.bodyUsed should be initially false.');
+    return cache.put(request, response)
+      .then(function() {
+        assert_false(request.bodyUsed,
+                     'Cache.put should not mark empty request\'s body used');
+      });
+  }, 'Cache.put with Request without a body');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response();
+    assert_false(response.bodyUsed,
+                 '[https://fetch.spec.whatwg.org/#dom-body-bodyused] ' +
+                 'Response.bodyUsed should be initially false.');
+    return cache.put(request, response)
+      .then(function() {
+        assert_false(response.bodyUsed,
+                     'Cache.put should not mark empty response\'s body used');
+      });
+  }, 'Cache.put with Response without a body');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response(test_body);
+    return cache.put(request, response.clone())
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should update the cache with ' +
+                                 'new Request and Response.');
+        });
+  }, 'Cache.put with a Response containing an empty URL');
+
+cache_test(function(cache) {
+    var request = new Request(test_url);
+    var response = new Response('', {
+        status: 200,
+        headers: [['Content-Type', 'text/plain']]
+      });
+    return cache.put(request, response)
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_equals(result.status, 200, 'Cache.put should store status.');
+          assert_equals(result.headers.get('Content-Type'), 'text/plain',
+                        'Cache.put should store headers.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, '',
+                        'Cache.put should store response body.');
+        });
+  }, 'Cache.put with an empty response body');
+
+cache_test(function(cache, test) {
+    var request = new Request(test_url);
+    var response = new Response('', {
+        status: 206,
+        headers: [['Content-Type', 'text/plain']]
+      });
+
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(request, response),
+      'Cache.put should reject 206 Responses with a TypeError.');
+  }, 'Cache.put with synthetic 206 response');
+
+cache_test(function(cache, test) {
+    var test_url = new URL('./resources/fetch-status.py?status=206', location.href).href;
+    var request = new Request(test_url);
+    var response;
+    return fetch(test_url)
+      .then(function(fetch_result) {
+          assert_equals(fetch_result.status, 206,
+                        'Test framework error: The status code should be 206.');
+          response = fetch_result.clone();
+          return promise_rejects_js(test, TypeError, cache.put(request, fetch_result));
+        });
+  }, 'Cache.put with HTTP 206 response');
+
+cache_test(function(cache, test) {
+    // We need to jump through some hoops to allow the test to perform opaque
+    // response filtering, but bypass the ORB safelist check. This is
+    // done, by forcing the MIME type retrieval to fail and the
+    // validation of partial first response to succeed.
+    var pipe = "status(206)|header(Content-Type,)|header(Content-Range, bytes 0-1/41)|slice(null, 1)";
+    var test_url = new URL(`./resources/blank.html?pipe=${pipe}`, location.href);
+    test_url.hostname = REMOTE_HOST;
+    var request = new Request(test_url.href, { mode: 'no-cors' });
+    var response;
+    return fetch(request)
+      .then(function(fetch_result) {
+          assert_equals(fetch_result.type, 'opaque',
+              'Test framework error: The response type should be opaque.');
+          assert_equals(fetch_result.status, 0,
+              'Test framework error: The status code should be 0 for an ' +
+              ' opaque-filtered response. This is actually HTTP 206.');
+          response = fetch_result.clone();
+          return cache.put(request, fetch_result);
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_not_equals(result, undefined,
+              'Cache.put should store an entry for the opaque response');
+        });
+  }, 'Cache.put with opaque-filtered HTTP 206 response');
+
+cache_test(function(cache) {
+    var test_url = new URL('./resources/fetch-status.py?status=500', location.href).href;
+    var request = new Request(test_url);
+    var response;
+    return fetch(test_url)
+      .then(function(fetch_result) {
+          assert_equals(fetch_result.status, 500,
+                        'Test framework error: The status code should be 500.');
+          response = fetch_result.clone();
+          return cache.put(request, fetch_result);
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should update the cache with ' +
+                                 'new request and response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, '',
+                        'Cache.put should store response body.');
+        });
+  }, 'Cache.put with HTTP 500 response');
+
+cache_test(function(cache) {
+    var alternate_response_body = 'New body';
+    var alternate_response = new Response(alternate_response_body,
+                                          { statusText: 'New status' });
+    return cache.put(new Request(test_url),
+                     new Response('Old body', { statusText: 'Old status' }))
+      .then(function() {
+          return cache.put(new Request(test_url), alternate_response.clone());
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, alternate_response,
+                                 'Cache.put should replace existing ' +
+                                 'response with new response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, alternate_response_body,
+                        'Cache put should store new response body.');
+        });
+  }, 'Cache.put called twice with matching Requests and different Responses');
+
+cache_test(function(cache) {
+    var first_url = test_url;
+    var second_url = first_url + '#(O_o)';
+    var third_url = first_url + '#fragment';
+    var alternate_response_body = 'New body';
+    var alternate_response = new Response(alternate_response_body,
+                                          { statusText: 'New status' });
+    return cache.put(new Request(first_url),
+                     new Response('Old body', { statusText: 'Old status' }))
+      .then(function() {
+          return cache.put(new Request(second_url), alternate_response.clone());
+        })
+      .then(function() {
+          return cache.match(test_url);
+        })
+      .then(function(result) {
+          assert_response_equals(result, alternate_response,
+                                 'Cache.put should replace existing ' +
+                                 'response with new response.');
+          return result.text();
+        })
+      .then(function(body) {
+          assert_equals(body, alternate_response_body,
+                        'Cache put should store new response body.');
+        })
+      .then(function() {
+          return cache.put(new Request(third_url), alternate_response.clone());
+        })
+      .then(function() {
+          return cache.keys();
+        })
+      .then(function(results) {
+          // Should match urls (without fragments or with different ones) to the
+          // same cache key. However, result.url should be the latest url used.
+          assert_equals(results[0].url, third_url);
+          return;
+        });
+}, 'Cache.put called multiple times with request URLs that differ only by a fragment');
+
+cache_test(function(cache) {
+    var url = 'http://example.com/foo';
+    return cache.put(url, new Response('some body'))
+      .then(function() { return cache.match(url); })
+      .then(function(response) { return response.text(); })
+      .then(function(body) {
+          assert_equals(body, 'some body',
+                        'Cache.put should accept a string as request.');
+        });
+  }, 'Cache.put with a string request');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url), 'Hello world!'),
+      'Cache.put should only accept a Response object as the response.');
+  }, 'Cache.put with an invalid response');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request('file:///etc/passwd'),
+                new Response(test_body)),
+      'Cache.put should reject non-HTTP/HTTPS requests with a TypeError.');
+  }, 'Cache.put with a non-HTTP/HTTPS request');
+
+cache_test(function(cache) {
+    var response = new Response(test_body);
+    return cache.put(new Request('relative-url'), response.clone())
+      .then(function() {
+          return cache.match(new URL('relative-url', location.href).href);
+        })
+      .then(function(result) {
+          assert_response_equals(result, response,
+                                 'Cache.put should accept a relative URL ' +
+                                 'as the request.');
+        });
+  }, 'Cache.put with a relative URL');
+
+cache_test(function(cache, test) {
+    var request = new Request('http://example.com/foo', { method: 'HEAD' });
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(request, new Response(test_body)),
+      'Cache.put should throw a TypeError for non-GET requests.');
+  }, 'Cache.put with a non-GET request');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url), null),
+      'Cache.put should throw a TypeError for a null response.');
+  }, 'Cache.put with a null response');
+
+cache_test(function(cache, test) {
+    var request = new Request(test_url, {method: 'POST', body: test_body});
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(request, new Response(test_body)),
+      'Cache.put should throw a TypeError for a POST request.');
+  }, 'Cache.put with a POST request');
+
+cache_test(function(cache) {
+    var response = new Response(test_body);
+    assert_false(response.bodyUsed,
+                 '[https://fetch.spec.whatwg.org/#dom-body-bodyused] ' +
+                 'Response.bodyUsed should be initially false.');
+    return response.text().then(function() {
+      assert_true(
+        response.bodyUsed,
+        '[https://fetch.spec.whatwg.org/#concept-body-consume-body] ' +
+          'The text() method should make the body disturbed.');
+      var request = new Request(test_url);
+      return cache.put(request, response).then(() => {
+          assert_unreached('cache.put should be rejected');
+        }, () => {});
+    });
+  }, 'Cache.put with a used response body');
+
+cache_test(function(cache) {
+    var response = new Response(test_body);
+    return cache.put(new Request(test_url), response)
+      .then(function() {
+          assert_throws_js(TypeError, () => response.body.getReader());
+      });
+  }, 'getReader() after Cache.put');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url),
+                new Response(test_body, { headers: { VARY: '*' }})),
+      'Cache.put should reject VARY:* Responses with a TypeError.');
+  }, 'Cache.put with a VARY:* Response');
+
+cache_test(function(cache, test) {
+    return promise_rejects_js(
+      test,
+      TypeError,
+      cache.put(new Request(test_url),
+                new Response(test_body,
+                             { headers: { VARY: 'Accept-Language,*' }})),
+      'Cache.put should reject Responses with an embedded VARY:* with a ' +
+      'TypeError.');
+  }, 'Cache.put with an embedded VARY:* Response');
+
+cache_test(async function(cache, test) {
+    const url = new URL('./resources/vary.py?vary=*',
+        get_host_info().HTTPS_REMOTE_ORIGIN + self.location.pathname);
+    const request = new Request(url, { mode: 'no-cors' });
+    const response = await fetch(request);
+    assert_equals(response.type, 'opaque');
+    await cache.put(request, response);
+  }, 'Cache.put with a VARY:* opaque response should not reject');
+
+cache_test(function(cache) {
+    var url = 'foo.html';
+    var redirectURL = 'http://example.com/foo-bar.html';
+    var redirectResponse = Response.redirect(redirectURL);
+    assert_equals(redirectResponse.headers.get('Location'), redirectURL,
+                  'Response.redirect() should set Location header.');
+    return cache.put(url, redirectResponse.clone())
+      .then(function() {
+          return cache.match(url);
+        })
+      .then(function(response) {
+          assert_response_equals(response, redirectResponse,
+                                 'Redirect response is reproduced by the Cache API');
+          assert_equals(response.headers.get('Location'), redirectURL,
+                        'Location header is preserved by Cache API.');
+        });
+  }, 'Cache.put should store Response.redirect() correctly');
+
+cache_test(async (cache) => {
+    var request = new Request(test_url);
+    var response = new Response(new Blob([test_body]));
+    await cache.put(request, response);
+    var cachedResponse = await cache.match(request);
+    assert_equals(await cachedResponse.text(), test_body);
+  }, 'Cache.put called with simple Request and blob Response');
+
+cache_test(async (cache) => {
+  var formData = new FormData();
+  formData.append("name", "value");
+
+  var request = new Request(test_url);
+  var response = new Response(formData);
+  await cache.put(request, response);
+  var cachedResponse = await cache.match(request);
+  var cachedResponseText = await cachedResponse.text();
+  assert_true(cachedResponseText.indexOf("name=\"name\"\r\n\r\nvalue") !== -1);
+}, 'Cache.put called with simple Request and form data Response');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage-buckets.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-buckets.https.any.js
new file mode 100644
index 000000000000..fd59ba464db0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-buckets.https.any.js
@@ -0,0 +1,64 @@
+// META: title=Cache.put
+// META: global=window,worker
+// META: script=/common/get-host-info.sub.js
+// META: script=resources/test-helpers.js
+// META: script=/storage/buckets/resources/util.js
+// META: timeout=long
+
+var test_url = 'https://example.com/foo';
+var test_body = 'Hello world!';
+const { REMOTE_HOST } = get_host_info();
+
+promise_test(async function(test) {
+  await prepareForBucketTest(test);
+  var inboxBucket = await navigator.storageBuckets.open('inbox');
+  var draftsBucket = await navigator.storageBuckets.open('drafts');
+
+  const cacheName = 'attachments';
+  const cacheKey = 'receipt1.txt';
+
+  var inboxCache = await inboxBucket.caches.open(cacheName);
+  var draftsCache = await draftsBucket.caches.open(cacheName);
+
+  await inboxCache.put(cacheKey, new Response('bread x 2'))
+  await draftsCache.put(cacheKey, new Response('eggs x 1'));
+
+  return inboxCache.match(cacheKey)
+      .then(function(result) {
+        return result.text();
+      })
+      .then(function(body) {
+        assert_equals(body, 'bread x 2', 'Wrong cache contents');
+        return draftsCache.match(cacheKey);
+      })
+      .then(function(result) {
+        return result.text();
+      })
+      .then(function(body) {
+        assert_equals(body, 'eggs x 1', 'Wrong cache contents');
+      });
+}, 'caches from different buckets have different contents');
+
+promise_test(async function(test) {
+  await prepareForBucketTest(test);
+  var inboxBucket = await navigator.storageBuckets.open('inbox');
+  var draftBucket = await navigator.storageBuckets.open('drafts');
+
+  var caches = inboxBucket.caches;
+  var attachments = await caches.open('attachments');
+  await attachments.put('receipt1.txt', new Response('bread x 2'));
+  var result = await attachments.match('receipt1.txt');
+  assert_equals(await result.text(), 'bread x 2');
+
+  await navigator.storageBuckets.delete('inbox');
+
+  await promise_rejects_dom(
+      test, 'UnknownError', caches.open('attachments'));
+
+  // Also test when `caches` is first accessed after the deletion.
+  await navigator.storageBuckets.delete('drafts');
+  return promise_rejects_dom(
+      test, 'UnknownError', draftBucket.caches.open('attachments'));
+}, 'cache.open promise is rejected when bucket is gone');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage-keys.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-keys.https.any.js
new file mode 100644
index 000000000000..f19522be1b43
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-keys.https.any.js
@@ -0,0 +1,35 @@
+// META: title=CacheStorage.keys
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+var test_cache_list =
+  ['', 'example', 'Another cache name', 'A', 'a', 'ex ample'];
+
+promise_test(function(test) {
+    return self.caches.keys()
+      .then(function(keys) {
+          assert_true(Array.isArray(keys),
+                      'CacheStorage.keys should return an Array.');
+          return Promise.all(keys.map(function(key) {
+              return self.caches.delete(key);
+            }));
+        })
+      .then(function() {
+          return Promise.all(test_cache_list.map(function(key) {
+              return self.caches.open(key);
+            }));
+        })
+
+      .then(function() { return self.caches.keys(); })
+      .then(function(keys) {
+          assert_true(Array.isArray(keys),
+                      'CacheStorage.keys should return an Array.');
+          assert_array_equals(keys,
+                              test_cache_list,
+                              'CacheStorage.keys should only return ' +
+                              'existing caches.');
+        });
+  }, 'CacheStorage keys');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage-match.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-match.https.any.js
new file mode 100644
index 000000000000..0c31b726294b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage-match.https.any.js
@@ -0,0 +1,245 @@
+// META: title=CacheStorage.match
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+(function() {
+  var next_index = 1;
+
+  // Returns a transaction (request, response, and url) for a unique URL.
+  function create_unique_transaction(test) {
+    var uniquifier = String(next_index++);
+    var url = 'http://example.com/' + uniquifier;
+
+    return {
+      request: new Request(url),
+      response: new Response('hello'),
+      url: url
+    };
+  }
+
+  self.create_unique_transaction = create_unique_transaction;
+})();
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+
+    return cache.put(transaction.request.clone(), transaction.response.clone())
+      .then(function() {
+          return self.caches.match(transaction.request);
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        });
+}, 'CacheStorageMatch with no cache name provided');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+
+    var test_cache_list = ['a', 'b', 'c'];
+    return cache.put(transaction.request.clone(), transaction.response.clone())
+      .then(function() {
+          return Promise.all(test_cache_list.map(function(key) {
+              return self.caches.open(key);
+            }));
+        })
+      .then(function() {
+          return self.caches.match(transaction.request);
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        });
+}, 'CacheStorageMatch from one of many caches');
+
+promise_test(function(test) {
+    var transaction = create_unique_transaction();
+
+    var test_cache_list = ['x', 'y', 'z'];
+    return Promise.all(test_cache_list.map(function(key) {
+        return self.caches.open(key);
+      }))
+      .then(function() { return self.caches.open('x'); })
+      .then(function(cache) {
+          return cache.put(transaction.request.clone(),
+                           transaction.response.clone());
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: 'x'});
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: 'y'});
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'Cache y should not have a response for the request.');
+        });
+}, 'CacheStorageMatch from one of many caches by name');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+    return cache.put(transaction.url, transaction.response.clone())
+      .then(function() {
+          return self.caches.match(transaction.request);
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should not have changed.');
+        });
+}, 'CacheStorageMatch a string request');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+    return cache.put(transaction.request.clone(), transaction.response.clone())
+      .then(function() {
+          return self.caches.match(new Request(transaction.request.url,
+                                              {method: 'HEAD'}));
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'A HEAD request should not be matched');
+        });
+}, 'CacheStorageMatch a HEAD request');
+
+promise_test(function(test) {
+    var transaction = create_unique_transaction();
+    return self.caches.match(transaction.request)
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'The response should not be found.');
+        });
+}, 'CacheStorageMatch with no cached entry');
+
+promise_test(function(test) {
+    var transaction = create_unique_transaction();
+    return self.caches.delete('foo')
+      .then(function() {
+          return self.caches.has('foo');
+        })
+      .then(function(has_foo) {
+          assert_false(has_foo, "The cache should not exist.");
+          return self.caches.match(transaction.request, {cacheName: 'foo'});
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'The match with bad cache name should resolve to ' +
+                        'undefined.');
+          return self.caches.has('foo');
+        })
+      .then(function(has_foo) {
+          assert_false(has_foo, "The cache should still not exist.");
+        });
+}, 'CacheStorageMatch with no caches available but name provided');
+
+cache_test(function(cache) {
+    var transaction = create_unique_transaction();
+
+    return self.caches.delete('')
+      .then(function() {
+          return self.caches.has('');
+        })
+      .then(function(has_cache) {
+          assert_false(has_cache, "The cache should not exist.");
+          return cache.put(transaction.request, transaction.response.clone());
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: ''});
+        })
+      .then(function(response) {
+          assert_equals(response, undefined,
+                        'The response should not be found.');
+          return self.caches.open('');
+        })
+      .then(function(cache) {
+          return cache.put(transaction.request, transaction.response);
+        })
+      .then(function() {
+          return self.caches.match(transaction.request, {cacheName: ''});
+        })
+      .then(function(response) {
+          assert_response_equals(response, transaction.response,
+                                 'The response should be matched.');
+          return self.caches.delete('');
+        });
+}, 'CacheStorageMatch with empty cache name provided');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/?foo');
+    var no_query_request = new Request('http://example.com/');
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return self.caches.match(no_query_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'CacheStorageMatch should resolve as undefined with a ' +
+            'mismatched query.');
+          return self.caches.match(no_query_request.clone(),
+                                   {ignoreSearch: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'CacheStorageMatch with ignoreSearch should ignore the ' +
+            'query of the request.');
+        });
+  }, 'CacheStorageMatch supports ignoreSearch');
+
+cache_test(function(cache) {
+    var request = new Request('http://example.com/');
+    var head_request = new Request('http://example.com/', {method: 'HEAD'});
+    var response = new Response('foo');
+    return cache.put(request.clone(), response.clone())
+      .then(function() {
+          return self.caches.match(head_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'CacheStorageMatch should resolve as undefined with a ' +
+            'mismatched method.');
+          return self.caches.match(head_request.clone(),
+                                   {ignoreMethod: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, response,
+            'CacheStorageMatch with ignoreMethod should ignore the ' +
+            'method of request.');
+        });
+  }, 'Cache.match supports ignoreMethod');
+
+cache_test(function(cache) {
+    var vary_request = new Request('http://example.com/c',
+                                   {headers: {'Cookies': 'is-for-cookie'}});
+    var vary_response = new Response('', {headers: {'Vary': 'Cookies'}});
+    var mismatched_vary_request = new Request('http://example.com/c');
+
+    return cache.put(vary_request.clone(), vary_response.clone())
+      .then(function() {
+          return self.caches.match(mismatched_vary_request.clone());
+        })
+      .then(function(result) {
+          assert_equals(
+            result, undefined,
+            'CacheStorageMatch should resolve as undefined with a ' +
+            ' mismatched vary.');
+          return self.caches.match(mismatched_vary_request.clone(),
+                                   {ignoreVary: true});
+        })
+      .then(function(result) {
+          assert_response_equals(
+            result, vary_response,
+            'CacheStorageMatch with ignoreVary should ignore the ' +
+            'vary of request.');
+        });
+  }, 'CacheStorageMatch supports ignoreVary');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cache-storage.https.any.js b/test/fixtures/wpt/service-workers/cache-storage/cache-storage.https.any.js
new file mode 100644
index 000000000000..b7d5af7b5320
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cache-storage.https.any.js
@@ -0,0 +1,239 @@
+// META: title=CacheStorage
+// META: global=window,worker
+// META: script=./resources/test-helpers.js
+// META: timeout=long
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/foo';
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(cache) {
+          assert_true(cache instanceof Cache,
+                      'CacheStorage.open should return a Cache.');
+        });
+  }, 'CacheStorage.open');
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/bar';
+    var first_cache = null;
+    var second_cache = null;
+    return self.caches.open(cache_name)
+      .then(function(cache) {
+          first_cache = cache;
+          return self.caches.delete(cache_name);
+        })
+      .then(function() {
+          return first_cache.add('./resources/simple.txt');
+        })
+      .then(function() {
+          return self.caches.keys();
+        })
+      .then(function(cache_names) {
+          assert_equals(cache_names.indexOf(cache_name), -1);
+          return self.caches.open(cache_name);
+        })
+      .then(function(cache) {
+          second_cache = cache;
+          return second_cache.keys();
+        })
+      .then(function(keys) {
+          assert_equals(keys.length, 0);
+          return first_cache.keys();
+        })
+      .then(function(keys) {
+          assert_equals(keys.length, 1);
+          // Clean up
+          return self.caches.delete(cache_name);
+        });
+  }, 'CacheStorage.delete dooms, but does not delete immediately');
+
+promise_test(function(t) {
+    // Note that this test may collide with other tests running in the same
+    // origin that also uses an empty cache name.
+    var cache_name = '';
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(cache) {
+          assert_true(cache instanceof Cache,
+                      'CacheStorage.open should accept an empty name.');
+        });
+  }, 'CacheStorage.open with an empty name');
+
+promise_test(function(t) {
+    return promise_rejects_js(
+      t,
+      TypeError,
+      self.caches.open(),
+      'CacheStorage.open should throw TypeError if called with no arguments.');
+  }, 'CacheStorage.open with no arguments');
+
+promise_test(function(t) {
+    var test_cases = [
+      {
+        name: 'cache-storage/lowercase',
+        should_not_match:
+          [
+            'cache-storage/Lowercase',
+            ' cache-storage/lowercase',
+            'cache-storage/lowercase '
+          ]
+      },
+      {
+        name: 'cache-storage/has a space',
+        should_not_match:
+          [
+            'cache-storage/has'
+          ]
+      },
+      {
+        name: 'cache-storage/has\000_in_the_name',
+        should_not_match:
+          [
+            'cache-storage/has',
+            'cache-storage/has_in_the_name'
+          ]
+      }
+    ];
+    return Promise.all(test_cases.map(function(testcase) {
+        var cache_name = testcase.name;
+        return self.caches.delete(cache_name)
+          .then(function() {
+              return self.caches.open(cache_name);
+            })
+          .then(function() {
+              return self.caches.has(cache_name);
+            })
+          .then(function(result) {
+              assert_true(result,
+                          'CacheStorage.has should return true for existing ' +
+                          'cache.');
+            })
+          .then(function() {
+              return Promise.all(
+                testcase.should_not_match.map(function(cache_name) {
+                    return self.caches.has(cache_name)
+                      .then(function(result) {
+                          assert_false(result,
+                                       'CacheStorage.has should only perform ' +
+                                       'exact matches on cache names.');
+                        });
+                  }));
+            })
+          .then(function() {
+              return self.caches.delete(cache_name);
+            });
+      }));
+  }, 'CacheStorage.has with existing cache');
+
+promise_test(function(t) {
+    return self.caches.has('cheezburger')
+      .then(function(result) {
+          assert_false(result,
+                       'CacheStorage.has should return false for ' +
+                       'nonexistent cache.');
+        });
+  }, 'CacheStorage.has with nonexistent cache');
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/open';
+    var cache;
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(result) {
+          cache = result;
+        })
+      .then(function() {
+          return cache.add('./resources/simple.txt');
+        })
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function(result) {
+          assert_true(result instanceof Cache,
+                      'CacheStorage.open should return a Cache object');
+          assert_not_equals(result, cache,
+                            'CacheStorage.open should return a new Cache ' +
+                            'object each time its called.');
+          return Promise.all([cache.keys(), result.keys()]);
+        })
+      .then(function(results) {
+          var expected_urls = results[0].map(function(r) { return r.url });
+          var actual_urls = results[1].map(function(r) { return r.url });
+          assert_array_equals(actual_urls, expected_urls,
+                              'CacheStorage.open should return a new Cache ' +
+                              'object for the same backing store.');
+        });
+  }, 'CacheStorage.open with existing cache');
+
+promise_test(function(t) {
+    var cache_name = 'cache-storage/delete';
+
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        })
+      .then(function() { return self.caches.delete(cache_name); })
+      .then(function(result) {
+          assert_true(result,
+                      'CacheStorage.delete should return true after ' +
+                      'deleting an existing cache.');
+        })
+
+      .then(function() { return self.caches.has(cache_name); })
+      .then(function(cache_exists) {
+          assert_false(cache_exists,
+                       'CacheStorage.has should return false after ' +
+                       'fulfillment of CacheStorage.delete promise.');
+        });
+  }, 'CacheStorage.delete with existing cache');
+
+promise_test(function(t) {
+    return self.caches.delete('cheezburger')
+      .then(function(result) {
+          assert_false(result,
+                       'CacheStorage.delete should return false for a ' +
+                       'nonexistent cache.');
+        });
+  }, 'CacheStorage.delete with nonexistent cache');
+
+promise_test(function(t) {
+    var unpaired_name = 'unpaired\uD800';
+    var converted_name = 'unpaired\uFFFD';
+
+    // The test assumes that a cache with converted_name does not
+    // exist, but if the implementation fails the test then such
+    // a cache will be created. Start off in a fresh state by
+    // deleting all caches.
+    return delete_all_caches()
+      .then(function() {
+          return self.caches.has(converted_name);
+      })
+      .then(function(cache_exists) {
+          assert_false(cache_exists,
+                       'Test setup failure: cache should not exist');
+      })
+      .then(function() { return self.caches.open(unpaired_name); })
+      .then(function() { return self.caches.keys(); })
+      .then(function(keys) {
+          assert_true(keys.indexOf(unpaired_name) !== -1,
+                      'keys should include cache with bad name');
+      })
+      .then(function() { return self.caches.has(unpaired_name); })
+      .then(function(cache_exists) {
+          assert_true(cache_exists,
+                      'CacheStorage names should be not be converted.');
+        })
+      .then(function() { return self.caches.has(converted_name); })
+      .then(function(cache_exists) {
+          assert_false(cache_exists,
+                       'CacheStorage names should be not be converted.');
+        });
+  }, 'CacheStorage names are DOMStrings not USVStrings');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/cache-storage/common.https.window.js b/test/fixtures/wpt/service-workers/cache-storage/common.https.window.js
new file mode 100644
index 000000000000..eba312c273de
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/common.https.window.js
@@ -0,0 +1,44 @@
+// META: title=Cache Storage: Verify that Window and Workers see same storage
+// META: timeout=long
+
+function wait_for_message(worker) {
+    return new Promise(function(resolve) {
+        worker.addEventListener('message', function listener(e) {
+            resolve(e.data);
+            worker.removeEventListener('message', listener);
+        });
+    });
+}
+
+promise_test(function(t) {
+    var cache_name = 'common-test';
+    return self.caches.delete(cache_name)
+        .then(function() {
+            var worker = new Worker('resources/common-worker.js');
+            worker.postMessage({name: cache_name});
+            return wait_for_message(worker);
+        })
+        .then(function(message) {
+            return self.caches.open(cache_name);
+        })
+        .then(function(cache) {
+            return Promise.all([
+                cache.match('https://example.com/a'),
+                cache.match('https://example.com/b'),
+                cache.match('https://example.com/c')
+            ]);
+        })
+        .then(function(responses) {
+            return Promise.all(responses.map(
+                function(response) { return response.text(); }
+            ));
+        })
+        .then(function(bodies) {
+            assert_equals(bodies[0], 'a',
+                          'Body should match response put by worker');
+            assert_equals(bodies[1], 'b',
+                          'Body should match response put by worker');
+            assert_equals(bodies[2], 'c',
+                          'Body should match response put by worker');
+        });
+}, 'Window sees cache puts by Worker');
diff --git a/test/fixtures/wpt/service-workers/cache-storage/crashtests/cache-response-clone.https.html b/test/fixtures/wpt/service-workers/cache-storage/crashtests/cache-response-clone.https.html
new file mode 100644
index 000000000000..ec930a87d934
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/crashtests/cache-response-clone.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<meta charset="utf-8">
+<script type="module">
+  const cache = await window.caches.open('cache_name_0')
+  await cache.add("")
+  const resp1 = await cache.match("")
+  const readStream = resp1.body
+  // Cloning will open the stream via NS_AsyncCopy in Gecko
+  resp1.clone()
+  // Give a little bit of time
+  await new Promise(setTimeout)
+  // At this point the previous open operation is about to finish but not yet.
+  // It will finish after the second open operation is made, potentially causing incorrect state.
+  await readStream.getReader().read();
+  document.documentElement.classList.remove('test-wait')
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/credentials.https.html b/test/fixtures/wpt/service-workers/cache-storage/credentials.https.html
new file mode 100644
index 000000000000..0fe4a0a0ac0d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/credentials.https.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Cache Storage: Verify credentials are respected by Cache operations</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-storage">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./../service-worker/resources/test-helpers.sub.js"></script>
+<style>iframe { display: none; }</style>
+<script>
+
+var worker = "./resources/credentials-worker.js";
+var scope = "./resources/credentials-iframe.html";
+promise_test(function(t) {
+  return self.caches.delete('credentials')
+    .then(function() {
+      return service_worker_unregister_and_register(t, worker, scope)
+    })
+    .then(function(reg) {
+      return wait_for_state(t, reg.installing, 'activated');
+    })
+    .then(function() {
+      return with_iframe(scope);
+    })
+    .then(function(frame) {
+      frame.contentWindow.postMessage([
+        {name: 'file.txt', username: 'aa', password: 'bb'},
+        {name: 'file.txt', username: 'cc', password: 'dd'},
+        {name: 'file.txt'}
+      ], '*');
+      return new Promise(function(resolve, reject) {
+        window.onmessage = t.step_func(function(e) {
+          resolve(e.data);
+        });
+      });
+    })
+    .then(function(data) {
+      assert_equals(data.length, 3, 'three entries should be present');
+      assert_equals(data.filter(function(url) { return /@/.test(url); }).length, 2,
+        'two entries should contain credentials');
+      assert_true(data.some(function(url) { return /aa:bb@/.test(url); }),
+        'entry with credentials aa:bb should be present');
+      assert_true(data.some(function(url) { return /cc:dd@/.test(url); }),
+        'entry with credentials cc:dd should be present');
+    });
+}, "Cache API matching includes credentials");
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/cross-partition.https.tentative.html b/test/fixtures/wpt/service-workers/cache-storage/cross-partition.https.tentative.html
new file mode 100644
index 000000000000..1cfc2569088e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/cross-partition.https.tentative.html
@@ -0,0 +1,269 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<!-- Pull in executor_path needed by newPopup / newIframe -->
+<script src="/html/cross-origin-embedder-policy/credentialless/resources/common.js"></script>
+<!-- Pull in importScript / newPopup / newIframe -->
+<script src="/html/anonymous-iframe/resources/common.js"></script>
+<body>
+<script>
+
+const cache_exists_js = (cache_name, response_queue_name) => `
+  try {
+    const exists = await self.caches.has("${cache_name}");
+    if (exists) {
+      await send("${response_queue_name}", "true");
+    } else {
+      await send("${response_queue_name}", "false");
+    }
+  } catch {
+    await send("${response_queue_name}", "exception");
+  }
+`;
+
+const add_iframe_js = (iframe_origin, response_queue_uuid) => `
+  const importScript = ${importScript};
+  await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                   "/resources/common.js");
+  await importScript("/html/anonymous-iframe/resources/common.js");
+  await importScript("/common/utils.js");
+  await send("${response_queue_uuid}", newIframe("${iframe_origin}"));
+`;
+
+const same_site_origin = get_host_info().HTTPS_ORIGIN;
+const cross_site_origin = get_host_info().HTTPS_NOTSAMESITE_ORIGIN;
+
+async function create_test_iframes(t, response_queue_uuid) {
+
+  // Create a same-origin iframe in a cross-site popup.
+  const not_same_site_popup_uuid = newPopup(t, cross_site_origin);
+  await send(not_same_site_popup_uuid,
+       add_iframe_js(same_site_origin, response_queue_uuid));
+  const iframe_1_uuid = await receive(response_queue_uuid);
+
+  // Create a same-origin iframe in a same-site popup.
+  const same_origin_popup_uuid = newPopup(t, same_site_origin);
+  await send(same_origin_popup_uuid,
+       add_iframe_js(same_site_origin, response_queue_uuid));
+  const iframe_2_uuid = await receive(response_queue_uuid);
+
+  return [iframe_1_uuid, iframe_2_uuid];
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(iframe_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site iframe");
+      }
+
+      await send(iframe_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site iframe");
+      }
+
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition iframe");
+
+const newWorker = (origin) => {
+  const worker_token = token();
+  const worker_url = origin + executor_worker_path + `&uuid=${worker_token}`;
+  const worker = new Worker(worker_url);
+  return worker_token;
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const create_worker_js = (origin) => `
+        const importScript = ${importScript};
+        await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                         "/resources/common.js");
+        await importScript("/html/anonymous-iframe/resources/common.js");
+        await importScript("/common/utils.js");
+        const newWorker = ${newWorker};
+        await send("${response_queue_uuid}", newWorker("${origin}"));
+      `;
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create a dedicated worker in the cross-top-level-site iframe.
+      await send(iframe_1_uuid, create_worker_js(same_site_origin));
+      const worker_1_uuid = await receive(response_queue_uuid);
+
+      // Create a dedicated worker in the same-top-level-site iframe.
+      await send(iframe_2_uuid, create_worker_js(same_site_origin));
+      const worker_2_uuid = await receive(response_queue_uuid);
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(worker_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site worker");
+      }
+
+      await send(worker_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site worker");
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition dedicated worker");
+
+const newSharedWorker = (origin) => {
+  const worker_token = token();
+  const worker_url = origin + executor_worker_path + `&uuid=${worker_token}`;
+  const worker = new SharedWorker(worker_url, worker_token);
+  return worker_token;
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const create_worker_js = (origin) => `
+        const importScript = ${importScript};
+        await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                         "/resources/common.js");
+        await importScript("/html/anonymous-iframe/resources/common.js");
+        await importScript("/common/utils.js");
+        const newSharedWorker = ${newSharedWorker};
+        await send("${response_queue_uuid}", newSharedWorker("${origin}"));
+      `;
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create a shared worker in the cross-top-level-site iframe.
+      await send(iframe_1_uuid, create_worker_js(same_site_origin));
+      const worker_1_uuid = await receive(response_queue_uuid);
+
+      // Create a shared worker in the same-top-level-site iframe.
+      await send(iframe_2_uuid, create_worker_js(same_site_origin));
+      const worker_2_uuid = await receive(response_queue_uuid);
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(worker_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site worker");
+      }
+
+      await send(worker_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site worker");
+      }
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition shared worker");
+
+const newServiceWorker = async (origin) => {
+  const worker_token = token();
+  const worker_url = origin + executor_service_worker_path +
+                     `&uuid=${worker_token}`;
+  const worker_url_path = executor_service_worker_path.substring(0,
+                              executor_service_worker_path.lastIndexOf('/'));
+  const scope = worker_url_path + "/not-used/";
+  const reg = await navigator.serviceWorker.register(worker_url,
+                                                     {'scope': scope});
+  return worker_token;
+}
+
+promise_test(t => {
+  return new Promise(async (resolve, reject) => {
+    try {
+      const response_queue_uuid = token();
+
+      const create_worker_js = (origin) => `
+        const importScript = ${importScript};
+        await importScript("/html/cross-origin-embedder-policy/credentialless" +
+                         "/resources/common.js");
+        await importScript("/html/anonymous-iframe/resources/common.js");
+        await importScript("/common/utils.js");
+        const newServiceWorker = ${newServiceWorker};
+        await send("${response_queue_uuid}", await newServiceWorker("${origin}"));
+      `;
+
+      const [iframe_1_uuid, iframe_2_uuid] =
+        await create_test_iframes(t, response_queue_uuid);
+
+      // Create a service worker in the same-top-level-site iframe.
+      await send(iframe_2_uuid, create_worker_js(same_site_origin));
+      const worker_2_uuid = await receive(response_queue_uuid);
+
+      t.add_cleanup(() =>
+        send(worker_2_uuid, "self.registration.unregister();"));
+
+      const cache_name = token();
+      await self.caches.open(cache_name);
+      t.add_cleanup(() => self.caches.delete(cache_name));
+
+      await send(worker_2_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "true") {
+        reject("Cache not visible in same-top-level-site worker");
+      }
+
+      // Create a service worker in the cross-top-level-site iframe. Note that
+      // if service workers are unpartitioned then this new service worker would
+      // replace the one created above. This is why we wait to create the second
+      // service worker until after we are done with the first one.
+      await send(iframe_1_uuid, create_worker_js(same_site_origin));
+      const worker_1_uuid = await receive(response_queue_uuid);
+
+      t.add_cleanup(() =>
+        send(worker_1_uuid, "self.registration.unregister();"));
+
+      await send(worker_1_uuid,
+           cache_exists_js(cache_name, response_queue_uuid));
+      if (await receive(response_queue_uuid) !== "false") {
+        reject("Cache visible in not-same-top-level-site worker");
+      }
+
+      resolve();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}, "CacheStorage caches shouldn't be shared with a cross-partition service worker");
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/blank.html b/test/fixtures/wpt/service-workers/cache-storage/resources/blank.html
new file mode 100644
index 000000000000..a3c3a4689a62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/blank.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/cache-keys-attributes-for-service-worker.js b/test/fixtures/wpt/service-workers/cache-storage/resources/cache-keys-attributes-for-service-worker.js
new file mode 100644
index 000000000000..ee574d2cb77a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/cache-keys-attributes-for-service-worker.js
@@ -0,0 +1,22 @@
+self.addEventListener('fetch', (event) => {
+    const params = new URL(event.request.url).searchParams;
+    if (params.has('ignore')) {
+      return;
+    }
+    if (!params.has('name')) {
+      event.respondWith(Promise.reject(TypeError('No name is provided.')));
+      return;
+    }
+
+    event.respondWith(Promise.resolve().then(async () => {
+        const name = params.get('name');
+        await caches.delete('foo');
+        const cache = await caches.open('foo');
+        await cache.put(event.request, new Response('hello'));
+        const keys = await cache.keys();
+
+        const original = event.request[name];
+        const stored = keys[0][name];
+        return new Response(`original: ${original}, stored: ${stored}`);
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/common-worker.js b/test/fixtures/wpt/service-workers/cache-storage/resources/common-worker.js
new file mode 100644
index 000000000000..d0e8544b56c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/common-worker.js
@@ -0,0 +1,15 @@
+self.onmessage = function(e) {
+    var cache_name = e.data.name;
+
+    self.caches.open(cache_name)
+        .then(function(cache) {
+            return Promise.all([
+                cache.put('https://example.com/a', new Response('a')),
+                cache.put('https://example.com/b', new Response('b')),
+                cache.put('https://example.com/c', new Response('c'))
+            ]);
+        })
+        .then(function() {
+            self.postMessage('ok');
+        });
+};
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-iframe.html b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-iframe.html
new file mode 100644
index 000000000000..00702df9e5b1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-iframe.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Controlled frame for Cache API test with credentials</title>
+<script>
+
+function xhr(url, username, password) {
+  return new Promise(function(resolve, reject) {
+    var xhr = new XMLHttpRequest(), async = true;
+    xhr.open('GET', url, async, username, password);
+    xhr.send();
+    xhr.onreadystatechange = function() {
+      if (xhr.readyState !== XMLHttpRequest.DONE)
+        return;
+      if (xhr.status === 200) {
+        resolve(xhr.responseText);
+      } else {
+        reject(new Error(xhr.statusText));
+      }
+    };
+  });
+}
+
+window.onmessage = function(e) {
+  Promise.all(e.data.map(function(item) {
+    return xhr(item.name, item.username, item.password);
+  }))
+    .then(function() {
+      navigator.serviceWorker.controller.postMessage('keys');
+      navigator.serviceWorker.onmessage = function(e) {
+        window.parent.postMessage(e.data, '*');
+      };
+    });
+};
+
+</script>
+<body>
+Hello? Yes, this is iframe.
+</body>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-worker.js b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-worker.js
new file mode 100644
index 000000000000..43965b5fe4c9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/credentials-worker.js
@@ -0,0 +1,59 @@
+var cache_name = 'credentials';
+
+function assert_equals(actual, expected, message) {
+  if (!Object.is(actual, expected))
+    throw Error(message + ': expected: ' + expected + ', actual: ' + actual);
+}
+
+self.onfetch = function(e) {
+  if (!/\.txt$/.test(e.request.url)) return;
+  var content = e.request.url;
+  var cache;
+  e.respondWith(
+    self.caches.open(cache_name)
+      .then(function(result) {
+        cache = result;
+        return cache.put(e.request, new Response(content));
+      })
+
+      .then(function() { return cache.match(e.request); })
+      .then(function(result) { return result.text(); })
+      .then(function(text) {
+        assert_equals(text, content, 'Cache.match() body should match');
+      })
+
+      .then(function() { return cache.matchAll(e.request); })
+      .then(function(results) {
+        assert_equals(results.length, 1, 'Should have one response');
+        return results[0].text();
+      })
+      .then(function(text) {
+        assert_equals(text, content, 'Cache.matchAll() body should match');
+      })
+
+      .then(function() { return self.caches.match(e.request); })
+      .then(function(result) { return result.text(); })
+      .then(function(text) {
+        assert_equals(text, content, 'CacheStorage.match() body should match');
+      })
+
+     .then(function() {
+        return new Response('dummy');
+      })
+  );
+};
+
+self.onmessage = function(e) {
+  if (e.data === 'keys') {
+    self.caches.open(cache_name)
+      .then(function(cache) { return cache.keys(); })
+      .then(function(requests) {
+        var urls = requests.map(function(request) { return request.url; });
+        self.clients.matchAll().then(function(clients) {
+          clients.forEach(function(client) {
+            client.postMessage(urls);
+          });
+        });
+      });
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/iframe.html b/test/fixtures/wpt/service-workers/cache-storage/resources/iframe.html
new file mode 100644
index 000000000000..a2f1e502bb39
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/iframe.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>ok</title>
+<script>
+window.onmessage = function(e) {
+    var id = e.data.id;
+    try {
+        var name = 'checkallowed';
+        self.caches.open(name).then(function (cache) {
+            self.caches.delete(name);
+            window.parent.postMessage({id: id, result: 'allowed'}, '*');
+        }).catch(function(e) {
+            window.parent.postMessage({id: id, result: 'denied', name: e.name, message: e.message}, '*');
+        });
+    } catch (e) {
+        window.parent.postMessage({id: id, result: 'unexpecteddenied', name: e.name, message: e.message}, '*');
+    }
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/simple.txt b/test/fixtures/wpt/service-workers/cache-storage/resources/simple.txt
new file mode 100644
index 000000000000..9e3cb91fb9b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/simple.txt
@@ -0,0 +1 @@
+a simple text file
diff --git a/test/fixtures/wpt/service-workers/cache-storage/resources/test-helpers.js b/test/fixtures/wpt/service-workers/cache-storage/resources/test-helpers.js
new file mode 100644
index 000000000000..050ac0b54245
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/resources/test-helpers.js
@@ -0,0 +1,272 @@
+(function() {
+  var next_cache_index = 1;
+
+  // Returns a promise that resolves to a newly created Cache object. The
+  // returned Cache will be destroyed when |test| completes.
+  function create_temporary_cache(test) {
+    var uniquifier = String(++next_cache_index);
+    var cache_name = self.location.pathname + '/' + uniquifier;
+
+    test.add_cleanup(function() {
+        self.caches.delete(cache_name);
+      });
+
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        });
+  }
+
+  self.create_temporary_cache = create_temporary_cache;
+})();
+
+// Runs |test_function| with a temporary unique Cache passed in as the only
+// argument. The function is run as a part of Promise chain owned by
+// promise_test(). As such, it is expected to behave in a manner identical (with
+// the exception of the argument) to a function passed into promise_test().
+//
+// E.g.:
+//    cache_test(function(cache) {
+//      // Do something with |cache|, which is a Cache object.
+//    }, "Some Cache test");
+function cache_test(test_function, description) {
+  promise_test(function(test) {
+      return create_temporary_cache(test)
+        .then(function(cache) { return test_function(cache, test); });
+    }, description);
+}
+
+// A set of Request/Response pairs to be used with prepopulated_cache_test().
+var simple_entries = [
+  {
+    name: 'a',
+    request: new Request('http://example.com/a'),
+    response: new Response('')
+  },
+
+  {
+    name: 'b',
+    request: new Request('http://example.com/b'),
+    response: new Response('')
+  },
+
+  {
+    name: 'a_with_query',
+    request: new Request('http://example.com/a?q=r'),
+    response: new Response('')
+  },
+
+  {
+    name: 'A',
+    request: new Request('http://example.com/A'),
+    response: new Response('')
+  },
+
+  {
+    name: 'a_https',
+    request: new Request('https://example.com/a'),
+    response: new Response('')
+  },
+
+  {
+    name: 'a_org',
+    request: new Request('http://example.org/a'),
+    response: new Response('')
+  },
+
+  {
+    name: 'cat',
+    request: new Request('http://example.com/cat'),
+    response: new Response('')
+  },
+
+  {
+    name: 'catmandu',
+    request: new Request('http://example.com/catmandu'),
+    response: new Response('')
+  },
+
+  {
+    name: 'cat_num_lives',
+    request: new Request('http://example.com/cat?lives=9'),
+    response: new Response('')
+  },
+
+  {
+    name: 'cat_in_the_hat',
+    request: new Request('http://example.com/cat/in/the/hat'),
+    response: new Response('')
+  },
+
+  {
+    name: 'non_2xx_response',
+    request: new Request('http://example.com/non2xx'),
+    response: new Response('', {status: 404, statusText: 'nope'})
+  },
+
+  {
+    name: 'error_response',
+    request: new Request('http://example.com/error'),
+    response: Response.error()
+  },
+];
+
+// A set of Request/Response pairs to be used with prepopulated_cache_test().
+// These contain a mix of test cases that use Vary headers.
+var vary_entries = [
+  {
+    name: 'vary_cookie_is_cookie',
+    request: new Request('http://example.com/c',
+                         {headers: {'Cookies': 'is-for-cookie'}}),
+    response: new Response('',
+                           {headers: {'Vary': 'Cookies'}})
+  },
+
+  {
+    name: 'vary_cookie_is_good',
+    request: new Request('http://example.com/c',
+                         {headers: {'Cookies': 'is-good-enough-for-me'}}),
+    response: new Response('',
+                           {headers: {'Vary': 'Cookies'}})
+  },
+
+  {
+    name: 'vary_cookie_absent',
+    request: new Request('http://example.com/c'),
+    response: new Response('',
+                           {headers: {'Vary': 'Cookies'}})
+  }
+];
+
+// Run |test_function| with a Cache object and a map of entries. Prior to the
+// call, the Cache is populated by cache entries from |entries|. The latter is
+// expected to be an Object mapping arbitrary keys to objects of the form
+// {request: <Request object>, response: <Response object>}. Entries are
+// serially added to the cache in the order specified.
+//
+// |test_function| should return a Promise that can be used with promise_test.
+function prepopulated_cache_test(entries, test_function, description) {
+  cache_test(function(cache) {
+      var p = Promise.resolve();
+      var hash = {};
+      entries.forEach(function(entry) {
+          hash[entry.name] = entry;
+          p = p.then(function() {
+              return cache.put(entry.request.clone(), entry.response.clone())
+                  .catch(function(e) {
+                      assert_unreached(
+                          'Test setup failed for entry ' + entry.name + ': ' + e
+                      );
+                  });
+          });
+      });
+      return p
+        .then(function() {
+            assert_equals(Object.keys(hash).length, entries.length);
+        })
+        .then(function() {
+            return test_function(cache, hash);
+        });
+    }, description);
+}
+
+// Helper for testing with Headers objects. Compares Headers instances
+// by serializing |expected| and |actual| to arrays and comparing.
+function assert_header_equals(actual, expected, description) {
+    assert_class_string(actual, "Headers", description);
+    var header;
+    var actual_headers = [];
+    var expected_headers = [];
+    for (header of actual)
+        actual_headers.push(header[0] + ": " + header[1]);
+    for (header of expected)
+        expected_headers.push(header[0] + ": " + header[1]);
+    assert_array_equals(actual_headers, expected_headers,
+                        description + " Headers differ.");
+}
+
+// Helper for testing with Response objects. Compares simple
+// attributes defined on the interfaces, as well as the headers. It
+// does not compare the response bodies.
+function assert_response_equals(actual, expected, description) {
+    assert_class_string(actual, "Response", description);
+    ["type", "url", "status", "ok", "statusText"].forEach(function(attribute) {
+        assert_equals(actual[attribute], expected[attribute],
+                      description + " Attributes differ: " + attribute + ".");
+    });
+    assert_header_equals(actual.headers, expected.headers, description);
+}
+
+// Assert that the two arrays |actual| and |expected| contain the same
+// set of Responses as determined by assert_response_equals. The order
+// is not significant.
+//
+// |expected| is assumed to not contain any duplicates.
+function assert_response_array_equivalent(actual, expected, description) {
+    assert_true(Array.isArray(actual), description);
+    assert_equals(actual.length, expected.length, description);
+    expected.forEach(function(expected_element) {
+        // assert_response_in_array treats the first argument as being
+        // 'actual', and the second as being 'expected array'. We are
+        // switching them around because we want to be resilient
+        // against the |actual| array containing duplicates.
+        assert_response_in_array(expected_element, actual, description);
+    });
+}
+
+// Asserts that two arrays |actual| and |expected| contain the same
+// set of Responses as determined by assert_response_equals(). The
+// corresponding elements must occupy corresponding indices in their
+// respective arrays.
+function assert_response_array_equals(actual, expected, description) {
+    assert_true(Array.isArray(actual), description);
+    assert_equals(actual.length, expected.length, description);
+    actual.forEach(function(value, index) {
+        assert_response_equals(value, expected[index],
+                               description + " : object[" + index + "]");
+    });
+}
+
+// Equivalent to assert_in_array, but uses assert_response_equals.
+function assert_response_in_array(actual, expected_array, description) {
+    assert_true(expected_array.some(function(element) {
+        try {
+            assert_response_equals(actual, element);
+            return true;
+        } catch (e) {
+            return false;
+        }
+    }), description);
+}
+
+// Helper for testing with Request objects. Compares simple
+// attributes defined on the interfaces, as well as the headers.
+function assert_request_equals(actual, expected, description) {
+    assert_class_string(actual, "Request", description);
+    ["url"].forEach(function(attribute) {
+        assert_equals(actual[attribute], expected[attribute],
+                      description + " Attributes differ: " + attribute + ".");
+    });
+    assert_header_equals(actual.headers, expected.headers, description);
+}
+
+// Asserts that two arrays |actual| and |expected| contain the same
+// set of Requests as determined by assert_request_equals(). The
+// corresponding elements must occupy corresponding indices in their
+// respective arrays.
+function assert_request_array_equals(actual, expected, description) {
+    assert_true(Array.isArray(actual), description);
+    assert_equals(actual.length, expected.length, description);
+    actual.forEach(function(value, index) {
+        assert_request_equals(value, expected[index],
+                              description + " : object[" + index + "]");
+    });
+}
+
+// Deletes all caches, returning a promise indicating success.
+function delete_all_caches() {
+  return self.caches.keys()
+    .then(function(keys) {
+      return Promise.all(keys.map(self.caches.delete.bind(self.caches)));
+    });
+}
diff --git a/test/fixtures/wpt/service-workers/cache-storage/sandboxed-iframes.https.html b/test/fixtures/wpt/service-workers/cache-storage/sandboxed-iframes.https.html
new file mode 100644
index 000000000000..098fa89daf44
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/cache-storage/sandboxed-iframes.https.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<title>Cache Storage: Verify access in sandboxed iframes</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-storage">
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+function load_iframe(src, sandbox) {
+    return new Promise(function(resolve, reject) {
+        var iframe = document.createElement('iframe');
+        iframe.onload = function() { resolve(iframe); };
+
+        iframe.sandbox = sandbox;
+        iframe.src = src;
+
+        document.documentElement.appendChild(iframe);
+    });
+}
+
+function wait_for_message(id) {
+    return new Promise(function(resolve) {
+        self.addEventListener('message', function listener(e) {
+            if (e.data.id === id) {
+                resolve(e.data);
+                self.removeEventListener('message', listener);
+            }
+        });
+    });
+}
+
+var counter = 0;
+
+promise_test(function(t) {
+    return load_iframe('./resources/iframe.html',
+                       'allow-scripts allow-same-origin')
+        .then(function(iframe) {
+            var id = ++counter;
+            iframe.contentWindow.postMessage({id: id}, '*');
+            return wait_for_message(id);
+        })
+        .then(function(message) {
+            assert_equals(
+                message.result, 'allowed',
+                'Access should be allowed if sandbox has allow-same-origin');
+        });
+}, 'Sandboxed iframe with allow-same-origin is allowed access');
+
+promise_test(function(t) {
+    return load_iframe('./resources/iframe.html',
+                       'allow-scripts')
+        .then(function(iframe) {
+            var id = ++counter;
+            iframe.contentWindow.postMessage({id: id}, '*');
+            return wait_for_message(id);
+        })
+        .then(function(message) {
+            assert_equals(
+                message.result, 'denied',
+                'Access should be denied if sandbox lacks allow-same-origin');
+            assert_equals(message.name, 'SecurityError',
+                          'Failure should be a SecurityError');
+        });
+}, 'Sandboxed iframe without allow-same-origin is denied access');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/idlharness.https.any.js b/test/fixtures/wpt/service-workers/idlharness.https.any.js
new file mode 100644
index 000000000000..8db5d4d10ff7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/idlharness.https.any.js
@@ -0,0 +1,53 @@
+// META: global=window,worker
+// META: script=/resources/WebIDLParser.js
+// META: script=/resources/idlharness.js
+// META: script=cache-storage/resources/test-helpers.js
+// META: script=service-worker/resources/test-helpers.sub.js
+// META: timeout=long
+
+// https://w3c.github.io/ServiceWorker
+
+idl_test(
+  ['service-workers'],
+  ['dom', 'html'],
+  async (idl_array, t) => {
+    self.cacheInstance = await create_temporary_cache(t);
+
+    idl_array.add_objects({
+      CacheStorage: ['caches'],
+      Cache: ['self.cacheInstance'],
+      ServiceWorkerContainer: ['navigator.serviceWorker']
+    });
+
+    // TODO: Add ServiceWorker and ServiceWorkerRegistration instances for the
+    // other worker scopes.
+    if (self.GLOBAL.isWindow()) {
+      idl_array.add_objects({
+        ServiceWorkerRegistration: ['registrationInstance'],
+        ServiceWorker: ['registrationInstance.installing']
+      });
+
+      const scope = 'service-worker/resources/scope/idlharness';
+      const registration = await service_worker_unregister_and_register(
+          t, 'service-worker/resources/empty-worker.js', scope);
+      t.add_cleanup(() => registration.unregister());
+
+      self.registrationInstance = registration;
+    } else if (self.ServiceWorkerGlobalScope) {
+      // self.ServiceWorkerGlobalScope should only be defined for the
+      // ServiceWorker scope, which allows us to detect and test the interfaces
+      // exposed only for ServiceWorker.
+      idl_array.add_objects({
+        Clients: ['clients'],
+        ExtendableEvent: ['new ExtendableEvent("type")'],
+        FetchEvent: ['new FetchEvent("type", { request: new Request("") })'],
+        ServiceWorkerGlobalScope: ['self'],
+        ServiceWorkerRegistration: ['registration'],
+        ServiceWorker: ['serviceWorker'],
+        // TODO: Test instances of Client and WindowClient, e.g.
+        // Client: ['self.clientInstance'],
+        // WindowClient: ['self.windowClientInstance']
+      });
+    }
+  }
+);
diff --git a/test/fixtures/wpt/service-workers/service-worker/Service-Worker-Allowed-header.https.html b/test/fixtures/wpt/service-workers/service-worker/Service-Worker-Allowed-header.https.html
new file mode 100644
index 000000000000..6f44bb17e7da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/Service-Worker-Allowed-header.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<title>Service Worker: Service-Worker-Allowed header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+const host_info = get_host_info();
+
+// Returns a URL for a service worker script whose Service-Worker-Allowed
+// header value is set to |allowed_path|. If |origin| is specified, that origin
+// is used.
+function build_script_url(allowed_path, origin) {
+  const script = 'resources/empty-worker.js';
+  const url = origin ? `${origin}${base_path()}${script}` : script;
+  return `${url}?pipe=header(Service-Worker-Allowed,${allowed_path})`;
+}
+
+// register_test is a promise_test that registers a service worker.
+function register_test(script, scope, description) {
+  promise_test(async t => {
+    t.add_cleanup(() => {
+      return service_worker_unregister(t, scope);
+    });
+
+    const registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    assert_true(registration instanceof ServiceWorkerRegistration, 'registered');
+    assert_equals(registration.scope, normalizeURL(scope));
+  }, description);
+}
+
+// register_fail_test is like register_test but expects a SecurityError.
+function register_fail_test(script, scope, description) {
+  promise_test(async t => {
+    t.add_cleanup(() => {
+      return service_worker_unregister(t, scope);
+    });
+
+    await service_worker_unregister(t, scope);
+    await promise_rejects_dom(t,
+                          'SecurityError',
+                          navigator.serviceWorker.register(script, {scope}));
+  }, description);
+}
+
+register_test(
+    build_script_url('/allowed-path'),
+    '/allowed-path',
+    'Registering within Service-Worker-Allowed path');
+
+register_test(
+    build_script_url(new URL('/allowed-path', document.location)),
+    '/allowed-path',
+    'Registering within Service-Worker-Allowed path (absolute URL)');
+
+register_test(
+    build_script_url('../allowed-path-with-parent'),
+    'allowed-path-with-parent',
+    'Registering within Service-Worker-Allowed path with parent reference');
+
+register_fail_test(
+    build_script_url('../allowed-path'),
+    '/disallowed-path',
+    'Registering outside Service-Worker-Allowed path'),
+
+register_fail_test(
+    build_script_url('../allowed-path-with-parent'),
+    '/allowed-path-with-parent',
+    'Registering outside Service-Worker-Allowed path with parent reference');
+
+register_fail_test(
+    build_script_url(host_info.HTTPS_REMOTE_ORIGIN + '/'),
+    'resources/this-scope-is-normally-allowed',
+    'Service-Worker-Allowed is cross-origin to script, registering on a normally allowed scope');
+
+register_fail_test(
+    build_script_url(host_info.HTTPS_REMOTE_ORIGIN + '/'),
+    '/this-scope-is-normally-disallowed',
+    'Service-Worker-Allowed is cross-origin to script, registering on a normally disallowed scope');
+
+register_fail_test(
+    build_script_url(host_info.HTTPS_REMOTE_ORIGIN + '/cross-origin/',
+                     host_info.HTTPS_REMOTE_ORIGIN),
+    '/cross-origin/',
+    'Service-Worker-Allowed is cross-origin to page, same-origin to script');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/WEB_FEATURES.yml
new file mode 100644
index 000000000000..41cd63e4cb42
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- isSecureContext*: [is-secure-context]
+- "*": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html
new file mode 100644
index 000000000000..3e3cc8b2b089
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: close operation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+
+service_worker_test(
+  'resources/close-worker.js', 'ServiceWorkerGlobalScope: close operation');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event-worker.js
new file mode 100644
index 000000000000..525bc96e763e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event-worker.js
@@ -0,0 +1,2 @@
+self.onmessageerror = e => { e.source.postMessage("received error event"); };
+self.onmessage = e => { e.source.postMessage("received message event"); };
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event.https.html
new file mode 100644
index 000000000000..0a35cc7c39cf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/error-message-event.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Service Worker GlobalScope onerror event</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+</head>
+<body>
+<canvas id=canvas></canvas>
+<script>
+var scope = "resources";
+var registration;
+var frame;
+
+var url1 = "/WebKit/service-workers/resources/response-full-of-headers.py";
+var url2 = get_host_info().HTTPS_REMOTE_ORIGIN + url1;
+
+async function registerServiceWorker(scope)
+{
+    const registration = await navigator.serviceWorker.register("error-message-event-worker.js", { scope : scope });
+    let activeWorker = registration.active;
+    if (activeWorker)
+        return registration;
+    activeWorker = registration.installing;
+    return new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve(registration);
+        });
+    });
+}
+
+promise_test(async (test) => {
+    registration = await registerServiceWorker(scope);
+
+    const stream = canvas.captureStream();
+    const track = stream.getVideoTracks()[0];
+    // MediaStreamTrack is not defined in service worker contexts.
+    registration.active.postMessage({ track }, [track]);
+
+    const result = await new Promise(resolve => navigator.serviceWorker.onmessage = e => resolve(e.data));
+    assert_equals(result, "received error event");
+}, "Verify error event is received");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event-constructor.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event-constructor.https.html
new file mode 100644
index 000000000000..525245fe9ece
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event-constructor.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: ExtendableMessageEvent Constructor</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+service_worker_test(
+    'resources/extendable-message-event-constructor-worker.js', document.title
+  );
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html
new file mode 100644
index 000000000000..89efd7a4a615
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html
@@ -0,0 +1,226 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: ExtendableMessageEvent</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script src='./resources/extendable-message-event-utils.js'></script>
+<script>
+promise_test(function(t) {
+    var script = 'resources/extendable-message-event-worker.js';
+    var scope = 'resources/scope/extendable-message-event-from-toplevel';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage =
+                  function(event) { resolve(event.data); }
+            });
+          var channel = new MessageChannel;
+          registration.active.postMessage('', [channel.port1]);
+          return saw_message;
+        })
+      .then(function(results) {
+          var expected = {
+            constructor: { name: 'ExtendableMessageEvent' },
+            origin: location.origin,
+            lastEventId: '',
+            source: {
+                constructor: { name: 'WindowClient' },
+                frameType: 'top-level',
+                url: location.href,
+                visibilityState: 'visible',
+                focused: true
+            },
+            ports: [ { constructor: { name: 'MessagePort' } } ]
+          };
+          ExtendableMessageEventUtils.assert_equals(results, expected);
+        });
+  }, 'Post an extendable message from a top-level client');
+
+promise_test(function(t) {
+    var script = 'resources/extendable-message-event-worker.js';
+    var scope = 'resources/scope/extendable-message-event-from-nested';
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          add_completion_callback(function() { frame.remove(); });
+          var saw_message = new Promise(function(resolve) {
+              frame.contentWindow.navigator.serviceWorker.onmessage =
+                  function(event) { resolve(event.data); }
+            });
+          f.contentWindow.navigator.serviceWorker.controller.postMessage('');
+          return saw_message;
+        })
+      .then(function(results) {
+          var expected = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'WindowClient' },
+                  url: frame.contentWindow.location.href,
+                  frameType: 'nested',
+                  visibilityState: 'visible',
+                  focused: false
+              },
+              ports: []
+            };
+          ExtendableMessageEventUtils.assert_equals(results, expected);
+        });
+  }, 'Post an extendable message from a nested client');
+
+promise_test(function(t) {
+    var script = 'resources/extendable-message-event-loopback-worker.js';
+    var scope = 'resources/scope/extendable-message-event-loopback';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var results = [];
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = function(event) {
+                switch (event.data.type) {
+                  case 'record':
+                    results.push(event.data.results);
+                    break;
+                  case 'finish':
+                    resolve(results);
+                    break;
+                }
+              };
+            });
+          registration.active.postMessage({type: 'start'});
+          return saw_message;
+        })
+      .then(function(results) {
+          assert_equals(results.length, 2);
+
+          var expected_trial_1 = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script),
+                  state: 'activated'
+              },
+              ports: []
+          };
+          assert_equals(results[0].trial, 1);
+          ExtendableMessageEventUtils.assert_equals(
+              results[0].event, expected_trial_1
+          );
+
+          var expected_trial_2 = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script),
+                  state: 'activated'
+              },
+              ports: [],
+          };
+          assert_equals(results[1].trial, 2);
+          ExtendableMessageEventUtils.assert_equals(
+              results[1].event, expected_trial_2
+          );
+        });
+  }, 'Post loopback extendable messages');
+
+promise_test(function(t) {
+    var script1 = 'resources/extendable-message-event-ping-worker.js';
+    var script2 = 'resources/extendable-message-event-pong-worker.js';
+    var scope = 'resources/scope/extendable-message-event-pingpong';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          // A controlled frame is necessary for keeping a waiting worker.
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          add_completion_callback(function() { frame.remove(); });
+          return navigator.serviceWorker.register(script2, {scope: scope});
+        })
+      .then(function(r) {
+          return wait_for_state(t, r.installing, 'installed');
+        })
+      .then(function() {
+          var results = [];
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = function(event) {
+                switch (event.data.type) {
+                  case 'record':
+                    results.push(event.data.results);
+                    break;
+                  case 'finish':
+                    resolve(results);
+                    break;
+                }
+              };
+            });
+          registration.active.postMessage({type: 'start'});
+          return saw_message;
+        })
+      .then(function(results) {
+          assert_equals(results.length, 2);
+
+          var expected_ping = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script1),
+                  state: 'activated'
+              },
+              ports: []
+          };
+          assert_equals(results[0].pingOrPong, 'ping');
+          ExtendableMessageEventUtils.assert_equals(
+              results[0].event, expected_ping
+          );
+
+          var expected_pong = {
+              constructor: { name: 'ExtendableMessageEvent' },
+              origin: location.origin,
+              lastEventId: '',
+              source: {
+                  constructor: { name: 'ServiceWorker' },
+                  scriptURL: normalizeURL(script2),
+                  state: 'installed'
+              },
+              ports: []
+          };
+          assert_equals(results[1].pingOrPong, 'pong');
+          ExtendableMessageEventUtils.assert_equals(
+              results[1].event, expected_pong
+          );
+        });
+  }, 'Post extendable messages among service workers');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/fetch-on-the-right-interface.https.any.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/fetch-on-the-right-interface.https.any.js
new file mode 100644
index 000000000000..5ca5f65680c9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/fetch-on-the-right-interface.https.any.js
@@ -0,0 +1,14 @@
+// META: title=fetch method on the right interface
+// META: global=serviceworker
+
+test(function() {
+    assert_false(self.hasOwnProperty('fetch'), 'ServiceWorkerGlobalScope ' +
+        'instance should not have "fetch" method as its property.');
+    assert_inherits(self, 'fetch', 'ServiceWorkerGlobalScope should ' +
+        'inherit "fetch" method.');
+    assert_own_property(Object.getPrototypeOf(Object.getPrototypeOf(self)), 'fetch',
+        'WorkerGlobalScope should have "fetch" propery in its prototype.');
+    assert_equals(self.fetch, Object.getPrototypeOf(Object.getPrototypeOf(self)).fetch,
+        'ServiceWorkerGlobalScope.fetch should be the same as ' +
+        'WorkerGlobalScope.fetch.');
+}, 'Fetch method on the right interface');
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.https.html
new file mode 100644
index 000000000000..399820dd2c31
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.https.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Service Worker: isSecureContext</title>
+</head>
+<body>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(async (t) => {
+    var url = 'isSecureContext.serviceworker.js';
+    var scope = 'empty.html';
+    var frame_sw, sw_registration;
+
+    await service_worker_unregister(t, scope);
+    var f = await with_iframe(scope);
+    t.add_cleanup(function() {
+        f.remove();
+    });
+    frame_sw = f.contentWindow.navigator.serviceWorker;
+    var registration = await navigator.serviceWorker.register(url, {scope: scope});
+    sw_registration = registration;
+    await wait_for_state(t, registration.installing, 'activated');
+    fetch_tests_from_worker(sw_registration.active);
+}, 'Setting up tests');
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.serviceworker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.serviceworker.js
new file mode 100644
index 000000000000..5033594e34ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/isSecureContext.serviceworker.js
@@ -0,0 +1,5 @@
+importScripts("/resources/testharness.js");
+
+test(() => {
+    assert_true(self.isSecureContext, true);
+}, "isSecureContext");
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports-worker.js
new file mode 100644
index 000000000000..78cd0d86c010
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports-worker.js
@@ -0,0 +1,3 @@
+self.onmessage = e => {
+    e.source.postMessage(e.ports === e.ports ? "same ports array" : "different ports array");
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports.https.html
new file mode 100644
index 000000000000..a0eac39e9b35
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/message-event-ports.https.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Service Worker GlobalScope onerror event</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<canvas id=canvas></canvas>
+<script>
+var registration;
+
+async function registerServiceWorker()
+{
+    const registration = await navigator.serviceWorker.register("message-event-ports-worker.js", { scope : "." });
+    let activeWorker = registration.active;
+    if (activeWorker)
+        return registration;
+    activeWorker = registration.installing;
+    return new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve(registration);
+        });
+    });
+}
+
+promise_test(async (test) => {
+    registration = await registerServiceWorker();
+
+    registration.active.postMessage("test");
+    let result = await new Promise(resolve => navigator.serviceWorker.onmessage = e => resolve(e.data));
+    assert_equals(result, "same ports array", "empty array");
+
+    const channel = new MessageChannel();;
+    const port = channel.port1;
+    registration.active.postMessage({ port }, [port]);
+    result = await new Promise(resolve => navigator.serviceWorker.onmessage = e => resolve(e.data));
+    assert_equals(result, "same ports array", "not empty array");
+}, "Verify MessageEvent.ports getter returns the same object");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/postmessage.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/postmessage.https.html
new file mode 100644
index 000000000000..99dedebf2e56
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/postmessage.https.html
@@ -0,0 +1,83 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: postMessage</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/postmessage-loopback-worker.js';
+    var scope = 'resources/scope/postmessage-loopback';
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(event) {
+                resolve(event.data);
+              };
+            });
+          registration.active.postMessage({port: channel.port2},
+                                          [channel.port2]);
+          return saw_message;
+        })
+      .then(function(result) {
+          assert_equals(result, 'OK');
+        });
+  }, 'Post loopback messages');
+
+promise_test(function(t) {
+    var script1 = 'resources/postmessage-ping-worker.js';
+    var script2 = 'resources/postmessage-pong-worker.js';
+    var scope = 'resources/scope/postmessage-pingpong';
+    var registration;
+    var frame;
+
+    return service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          // A controlled frame is necessary for keeping a waiting worker.
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(script2, {scope: scope});
+        })
+      .then(function(r) {
+          return wait_for_state(t, r.installing, 'installed');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(event) {
+                resolve(event.data);
+              };
+            });
+          registration.active.postMessage({port: channel.port2},
+                                          [channel.port2]);
+          return saw_message;
+        })
+      .then(function(result) {
+          assert_equals(result, 'OK');
+          frame.remove();
+        });
+  }, 'Post messages among service workers');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html
new file mode 100644
index 000000000000..aa3c74a13bb2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: registration</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/registration-attribute-worker.js';
+    var scope = 'resources/scope/registration-attribute';
+    var registration;
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(reg) {
+          registration = reg;
+          add_result_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(frame) {
+          var expected_events_seen = [
+            'updatefound',
+            'install',
+            'statechange(installed)',
+            'statechange(activating)',
+            'activate',
+            'statechange(activated)',
+            'fetch',
+          ];
+
+          assert_equals(
+              frame.contentDocument.body.textContent,
+              expected_events_seen.toString(),
+              'Service Worker should respond to fetch');
+          frame.remove();
+          return registration.unregister();
+        });
+  }, 'Verify registration attributes on ServiceWorkerGlobalScope');
+
+promise_test(function(t) {
+    var script = 'resources/registration-attribute-worker.js';
+    var newer_script = 'resources/registration-attribute-newer-worker.js';
+    var scope = 'resources/scope/registration-attribute';
+    var newer_worker;
+    var registration;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(reg) {
+          registration = reg;
+          add_result_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return navigator.serviceWorker.register(newer_script, {scope: scope});
+        })
+      .then(function(reg) {
+          assert_equals(reg, registration);
+          newer_worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var channel = new MessageChannel;
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) { resolve(e.data); };
+            });
+          newer_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function(results) {
+          var script_url = normalizeURL(script);
+          var newer_script_url = normalizeURL(newer_script);
+          var expectations = [
+            'evaluate',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + script_url,
+            'updatefound',
+            '  installing: ' + newer_script_url,
+            '  waiting: empty',
+            '  active: ' + script_url,
+            'install',
+            '  installing: ' + newer_script_url,
+            '  waiting: empty',
+            '  active: ' + script_url,
+            'statechange(installed)',
+            '  installing: empty',
+            '  waiting: ' + newer_script_url,
+            '  active: ' + script_url,
+            'statechange(activating)',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + newer_script_url,
+            'activate',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + newer_script_url,
+            'statechange(activated)',
+            '  installing: empty',
+            '  waiting: empty',
+            '  active: ' + newer_script_url,
+          ];
+          assert_array_equals(results, expectations);
+          return registration.unregister();
+        });
+  }, 'Verify registration attributes on ServiceWorkerGlobalScope of the ' +
+     'newer worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/close-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/close-worker.js
new file mode 100644
index 000000000000..41a8bc069af8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/close-worker.js
@@ -0,0 +1,5 @@
+importScripts('../../resources/worker-testharness.js');
+
+test(function() {
+  assert_false('close' in self);
+}, 'ServiceWorkerGlobalScope close operation');
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/error-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/error-worker.js
new file mode 100644
index 000000000000..f6838ffb3947
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/error-worker.js
@@ -0,0 +1,12 @@
+var source;
+
+self.addEventListener('message', function(e) {
+  source = e.source;
+  throw 'testError';
+});
+
+self.addEventListener('error', function(e) {
+  source.postMessage({
+    error: e.error, filename: e.filename, message: e.message, lineno: e.lineno,
+    colno: e.colno});
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-constructor-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-constructor-worker.js
new file mode 100644
index 000000000000..42da5825c56d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-constructor-worker.js
@@ -0,0 +1,197 @@
+importScripts('/resources/testharness.js');
+
+const TEST_OBJECT = { wanwan: 123 };
+const CHANNEL1 = new MessageChannel();
+const CHANNEL2 = new MessageChannel();
+const PORTS = [CHANNEL1.port1, CHANNEL1.port2, CHANNEL2.port1];
+function createEvent(initializer) {
+  if (initializer === undefined)
+    return new ExtendableMessageEvent('type');
+  return new ExtendableMessageEvent('type', initializer);
+}
+
+// These test cases are mostly copied from the following file in the Chromium
+// project (as of commit 848ad70823991e0f12b437d789943a4ab24d65bb):
+// third_party/WebKit/LayoutTests/fast/events/constructors/message-event-constructor.html
+
+test(function() {
+  assert_false(createEvent().bubbles);
+  assert_false(createEvent().cancelable);
+  assert_equals(createEvent().data, null);
+  assert_equals(createEvent().origin, '');
+  assert_equals(createEvent().lastEventId, '');
+  assert_equals(createEvent().source, null);
+  assert_array_equals(createEvent().ports, []);
+}, 'no initializer specified');
+
+test(function() {
+  assert_false(createEvent({ bubbles: false }).bubbles);
+  assert_true(createEvent({ bubbles: true }).bubbles);
+}, '`bubbles` is specified');
+
+test(function() {
+  assert_false(createEvent({ cancelable: false }).cancelable);
+  assert_true(createEvent({ cancelable: true }).cancelable);
+}, '`cancelable` is specified');
+
+test(function() {
+  assert_equals(createEvent({ data: TEST_OBJECT }).data, TEST_OBJECT);
+  assert_equals(createEvent({ data: undefined }).data, null);
+  assert_equals(createEvent({ data: null }).data, null);
+  assert_equals(createEvent({ data: false }).data, false);
+  assert_equals(createEvent({ data: true }).data, true);
+  assert_equals(createEvent({ data: '' }).data, '');
+  assert_equals(createEvent({ data: 'chocolate' }).data, 'chocolate');
+  assert_equals(createEvent({ data: 12345 }).data, 12345);
+  assert_equals(createEvent({ data: 18446744073709551615 }).data,
+                            18446744073709552000);
+  assert_equals(createEvent({ data: NaN }).data, NaN);
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  assert_false(
+      createEvent({ data: {
+          valueOf: function() { return TEST_OBJECT; } } }).data ==
+      TEST_OBJECT);
+  assert_equals(createEvent({ get data(){ return 123; } }).data, 123);
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get data() { throw thrown; } }); });
+}, '`data` is specified');
+
+test(function() {
+  assert_equals(createEvent({ origin: 'melancholy' }).origin, 'melancholy');
+  assert_equals(createEvent({ origin: '' }).origin, '');
+  assert_equals(createEvent({ origin: null }).origin, 'null');
+  assert_equals(createEvent({ origin: false }).origin, 'false');
+  assert_equals(createEvent({ origin: true }).origin, 'true');
+  assert_equals(createEvent({ origin: 12345 }).origin, '12345');
+  assert_equals(
+      createEvent({ origin: 18446744073709551615 }).origin,
+      '18446744073709552000');
+  assert_equals(createEvent({ origin: NaN }).origin, 'NaN');
+  assert_equals(createEvent({ origin: [] }).origin, '');
+  assert_equals(createEvent({ origin: [1, 2, 3] }).origin, '1,2,3');
+  assert_equals(
+      createEvent({ origin: { melancholy: 12345 } }).origin,
+      '[object Object]');
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  assert_equals(
+      createEvent({ origin: {
+          valueOf: function() { return 'melancholy'; } } }).origin,
+      '[object Object]');
+  assert_equals(
+      createEvent({ get origin() { return 123; } }).origin, '123');
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get origin() { throw thrown; } }); });
+}, '`origin` is specified');
+
+test(function() {
+  assert_equals(
+      createEvent({ lastEventId: 'melancholy' }).lastEventId, 'melancholy');
+  assert_equals(createEvent({ lastEventId: '' }).lastEventId, '');
+  assert_equals(createEvent({ lastEventId: null }).lastEventId, 'null');
+  assert_equals(createEvent({ lastEventId: false }).lastEventId, 'false');
+  assert_equals(createEvent({ lastEventId: true }).lastEventId, 'true');
+  assert_equals(createEvent({ lastEventId: 12345 }).lastEventId, '12345');
+  assert_equals(
+      createEvent({ lastEventId: 18446744073709551615 }).lastEventId,
+      '18446744073709552000');
+  assert_equals(createEvent({ lastEventId: NaN }).lastEventId, 'NaN');
+  assert_equals(createEvent({ lastEventId: [] }).lastEventId, '');
+  assert_equals(
+      createEvent({ lastEventId: [1, 2, 3] }).lastEventId, '1,2,3');
+  assert_equals(
+      createEvent({ lastEventId: { melancholy: 12345 } }).lastEventId,
+      '[object Object]');
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  assert_equals(
+      createEvent({ lastEventId: {
+          valueOf: function() { return 'melancholy'; } } }).lastEventId,
+      '[object Object]');
+  assert_equals(
+      createEvent({ get lastEventId() { return 123; } }).lastEventId,
+      '123');
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get lastEventId() { throw thrown; } }); });
+}, '`lastEventId` is specified');
+
+test(function() {
+  assert_equals(createEvent({ source: CHANNEL1.port1 }).source, CHANNEL1.port1);
+  assert_equals(
+      createEvent({ source: self.registration.active }).source,
+      self.registration.active);
+  assert_equals(
+      createEvent({ source: CHANNEL1.port1 }).source, CHANNEL1.port1);
+  assert_throws_js(
+      TypeError, function() { createEvent({ source: this }); },
+      'source should be Client or ServiceWorker or MessagePort');
+}, '`source` is specified');
+
+test(function() {
+  // Valid message ports.
+  var passed_ports = createEvent({ ports: PORTS}).ports;
+  assert_equals(passed_ports[0], CHANNEL1.port1);
+  assert_equals(passed_ports[1], CHANNEL1.port2);
+  assert_equals(passed_ports[2], CHANNEL2.port1);
+  assert_array_equals(createEvent({ ports: [] }).ports, []);
+  assert_array_equals(createEvent({ ports: undefined }).ports, []);
+
+  // Invalid message ports.
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: [1, 2, 3] }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: TEST_OBJECT }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: null }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: this }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: false }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: true }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: '' }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: 'chocolate' }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: 12345 }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: 18446744073709551615 }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ ports: NaN }); });
+  assert_throws_js(TypeError,
+      function() { createEvent({ get ports() { return 123; } }); });
+  let thrown = { name: 'Error' };
+  assert_throws_exactly(thrown, function() {
+      createEvent({ get ports() { throw thrown; } }); });
+  // Note that valueOf() is not called, when the left hand side is
+  // evaluated.
+  var valueOf = function() { return PORTS; };
+  assert_throws_js(TypeError, function() {
+      createEvent({ ports: { valueOf: valueOf } }); });
+}, '`ports` is specified');
+
+test(function() {
+  var initializers = {
+      bubbles: true,
+      cancelable: true,
+      data: TEST_OBJECT,
+      origin: 'wonderful',
+      lastEventId: 'excellent',
+      source: CHANNEL1.port1,
+      ports: PORTS
+  };
+  assert_equals(createEvent(initializers).bubbles, true);
+  assert_equals(createEvent(initializers).cancelable, true);
+  assert_equals(createEvent(initializers).data, TEST_OBJECT);
+  assert_equals(createEvent(initializers).origin, 'wonderful');
+  assert_equals(createEvent(initializers).lastEventId, 'excellent');
+  assert_equals(createEvent(initializers).source, CHANNEL1.port1);
+  assert_equals(createEvent(initializers).ports[0], PORTS[0]);
+  assert_equals(createEvent(initializers).ports[1], PORTS[1]);
+  assert_equals(createEvent(initializers).ports[2], PORTS[2]);
+}, 'all initial values are specified');
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-loopback-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-loopback-worker.js
new file mode 100644
index 000000000000..13cae88d800d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-loopback-worker.js
@@ -0,0 +1,36 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    switch (event.data.type) {
+      case 'start':
+        self.registration.active.postMessage(
+            {type: '1st', client_id: event.source.id});
+        break;
+      case '1st':
+        // 1st loopback message via ServiceWorkerRegistration.active.
+        var results = {
+            trial: 1,
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.source.postMessage({type: '2nd', client_id: client_id});
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+              }));
+        break;
+      case '2nd':
+        // 2nd loopback message via ExtendableMessageEvent.source.
+        var results = {
+            trial: 2,
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+                client.postMessage({type: 'finish'});
+              }));
+        break;
+      }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-ping-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-ping-worker.js
new file mode 100644
index 000000000000..d07b22959cc0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-ping-worker.js
@@ -0,0 +1,23 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    switch (event.data.type) {
+      case 'start':
+        // Send a ping message to another service worker.
+        self.registration.waiting.postMessage(
+            {type: 'ping', client_id: event.source.id});
+        break;
+      case 'pong':
+        var results = {
+            pingOrPong: 'pong',
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+                client.postMessage({type: 'finish'});
+              }));
+        break;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-pong-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-pong-worker.js
new file mode 100644
index 000000000000..5e9669e83c4b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-pong-worker.js
@@ -0,0 +1,18 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    switch (event.data.type) {
+      case 'ping':
+        var results = {
+            pingOrPong: 'ping',
+            event: ExtendableMessageEventUtils.serialize(event)
+        };
+        var client_id = event.data.client_id;
+        event.waitUntil(clients.get(client_id)
+            .then(function(client) {
+                client.postMessage({type: 'record', results: results});
+                event.source.postMessage({type: 'pong', client_id: client_id});
+              }));
+        break;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-utils.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-utils.js
new file mode 100644
index 000000000000..d6a3b483f539
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-utils.js
@@ -0,0 +1,78 @@
+var ExtendableMessageEventUtils = {};
+
+// Create a representation of a given ExtendableMessageEvent that is suitable
+// for transmission via the `postMessage` API.
+ExtendableMessageEventUtils.serialize = function(event) {
+  var ports = event.ports.map(function(port) {
+        return { constructor: { name: port.constructor.name } };
+    });
+  return {
+    constructor: {
+      name: event.constructor.name
+    },
+    origin: event.origin,
+    lastEventId: event.lastEventId,
+    source: {
+      constructor: {
+        name: event.source.constructor.name
+      },
+      url: event.source.url,
+      frameType: event.source.frameType,
+      visibilityState: event.source.visibilityState,
+      focused: event.source.focused
+    },
+    ports: ports
+  };
+};
+
+// Compare the actual and expected values of an ExtendableMessageEvent that has
+// been transformed using the `serialize` function defined in this file.
+ExtendableMessageEventUtils.assert_equals = function(actual, expected) {
+  assert_equals(
+    actual.constructor.name, expected.constructor.name, 'event constructor'
+  );
+  assert_equals(actual.origin, expected.origin, 'event `origin` property');
+  assert_equals(
+    actual.lastEventId,
+    expected.lastEventId,
+    'event `lastEventId` property'
+  );
+
+  assert_equals(
+    actual.source.constructor.name,
+    expected.source.constructor.name,
+    'event `source` property constructor'
+  );
+  assert_equals(
+    actual.source.url, expected.source.url, 'event `source` property `url`'
+  );
+  assert_equals(
+    actual.source.frameType,
+    expected.source.frameType,
+    'event `source` property `frameType`'
+  );
+  assert_equals(
+    actual.source.visibilityState,
+    expected.source.visibilityState,
+    'event `source` property `visibilityState`'
+  );
+  assert_equals(
+    actual.source.focused,
+    expected.source.focused,
+    'event `source` property `focused`'
+  );
+
+  assert_equals(
+    actual.ports.length,
+    expected.ports.length,
+    'event `ports` property length'
+  );
+
+  for (var idx = 0; idx < expected.ports.length; ++idx) {
+    assert_equals(
+      actual.ports[idx].constructor.name,
+      expected.ports[idx].constructor.name,
+      'MessagePort #' + idx + ' constructor'
+    );
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-worker.js
new file mode 100644
index 000000000000..f5e7647e3e76
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/extendable-message-event-worker.js
@@ -0,0 +1,5 @@
+importScripts('./extendable-message-event-utils.js');
+
+self.addEventListener('message', function(event) {
+    event.source.postMessage(ExtendableMessageEventUtils.serialize(event));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-loopback-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-loopback-worker.js
new file mode 100644
index 000000000000..083e9aa2a85d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-loopback-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('message', function(event) {
+    if ('port' in event.data) {
+      var port = event.data.port;
+
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(event) {
+        if ('pong' in event.data)
+          port.postMessage(event.data.pong);
+      };
+      self.registration.active.postMessage({ping: channel.port2},
+                                           [channel.port2]);
+    } else if ('ping' in event.data) {
+      event.data.ping.postMessage({pong: 'OK'});
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-ping-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-ping-worker.js
new file mode 100644
index 000000000000..ebb1eccce2da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-ping-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('message', function(event) {
+    if ('port' in event.data) {
+      var port = event.data.port;
+
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(event) {
+        if ('pong' in event.data)
+          port.postMessage(event.data.pong);
+      };
+
+      // Send a ping message to another service worker.
+      self.registration.waiting.postMessage({ping: channel.port2},
+                                            [channel.port2]);
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-pong-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-pong-worker.js
new file mode 100644
index 000000000000..4a0d90b6182f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/postmessage-pong-worker.js
@@ -0,0 +1,4 @@
+self.addEventListener('message', function(event) {
+    if ('ping' in event.data)
+      event.data.ping.postMessage({pong: 'OK'});
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-newer-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-newer-worker.js
new file mode 100644
index 000000000000..44f3e2e8e9bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-newer-worker.js
@@ -0,0 +1,33 @@
+// TODO(nhiroki): stop using global states because service workers can be killed
+// at any point. Instead, we could post a message to the page on each event via
+// Client object (http://crbug.com/558244).
+var results = [];
+
+function stringify(worker) {
+  return worker ? worker.scriptURL : 'empty';
+}
+
+function record(event_name) {
+  results.push(event_name);
+  results.push('  installing: ' + stringify(self.registration.installing));
+  results.push('  waiting: ' + stringify(self.registration.waiting));
+  results.push('  active: ' + stringify(self.registration.active));
+}
+
+record('evaluate');
+
+self.registration.addEventListener('updatefound', function() {
+    record('updatefound');
+    var worker = self.registration.installing;
+    self.registration.installing.addEventListener('statechange', function() {
+        record('statechange(' + worker.state + ')');
+      });
+  });
+
+self.addEventListener('install', function(e) { record('install'); });
+
+self.addEventListener('activate', function(e) { record('activate'); });
+
+self.addEventListener('message', function(e) {
+    e.data.port.postMessage(results);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-worker.js
new file mode 100644
index 000000000000..315f43759324
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/registration-attribute-worker.js
@@ -0,0 +1,139 @@
+importScripts('../../resources/test-helpers.sub.js');
+importScripts('../../resources/worker-testharness.js');
+
+// TODO(nhiroki): stop using global states because service workers can be killed
+// at any point. Instead, we could post a message to the page on each event via
+// Client object (http://crbug.com/558244).
+var events_seen = [];
+
+// TODO(nhiroki): Move these assertions to registration-attribute.html because
+// an assertion failure on the worker is not shown on the result page and
+// handled as timeout. See registration-attribute-newer-worker.js for example.
+
+assert_equals(
+  self.registration.scope,
+  normalizeURL('scope/registration-attribute'),
+  'On worker script evaluation, registration attribute should be set');
+assert_equals(
+  self.registration.installing,
+  null,
+  'On worker script evaluation, installing worker should be null');
+assert_equals(
+  self.registration.waiting,
+  null,
+  'On worker script evaluation, waiting worker should be null');
+assert_equals(
+  self.registration.active,
+  null,
+  'On worker script evaluation, active worker should be null');
+
+self.registration.addEventListener('updatefound', function() {
+    events_seen.push('updatefound');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On updatefound event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On updatefound event, installing worker should be set');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On updatefound event, waiting worker should be null');
+    assert_equals(
+      self.registration.active,
+      null,
+      'On updatefound event, active worker should be null');
+
+    assert_equals(
+      self.registration.installing.state,
+      'installing',
+      'On updatefound event, worker should be in the installing state');
+
+    var worker = self.registration.installing;
+    self.registration.installing.addEventListener('statechange', function() {
+        events_seen.push('statechange(' + worker.state + ')');
+      });
+  });
+
+self.addEventListener('install', function(e) {
+    events_seen.push('install');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On install event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On install event, installing worker should be set');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On install event, waiting worker should be null');
+    assert_equals(
+      self.registration.active,
+      null,
+      'On install event, active worker should be null');
+
+    assert_equals(
+      self.registration.installing.state,
+      'installing',
+      'On install event, worker should be in the installing state');
+  });
+
+self.addEventListener('activate', function(e) {
+    events_seen.push('activate');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On activate event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing,
+      null,
+      'On activate event, installing worker should be null');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On activate event, waiting worker should be null');
+    assert_equals(
+      self.registration.active.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On activate event, active worker should be set');
+
+    assert_equals(
+      self.registration.active.state,
+      'activating',
+      'On activate event, worker should be in the activating state');
+  });
+
+self.addEventListener('fetch', function(e) {
+    events_seen.push('fetch');
+
+    assert_equals(
+      self.registration.scope,
+      normalizeURL('scope/registration-attribute'),
+      'On fetch event, registration attribute should be set');
+    assert_equals(
+      self.registration.installing,
+      null,
+      'On fetch event, installing worker should be null');
+    assert_equals(
+      self.registration.waiting,
+      null,
+      'On fetch event, waiting worker should be null');
+    assert_equals(
+      self.registration.active.scriptURL,
+      normalizeURL('registration-attribute-worker.js'),
+      'On fetch event, active worker should be set');
+
+    assert_equals(
+      self.registration.active.state,
+      'activated',
+      'On fetch event, worker should be in the activated state');
+
+    e.respondWith(new Response(events_seen));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-controlling-worker.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-controlling-worker.html
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-worker.js
new file mode 100644
index 000000000000..6da397dd1526
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/unregister-worker.js
@@ -0,0 +1,25 @@
+function matchQuery(query) {
+  return self.location.href.indexOf(query) != -1;
+}
+
+if (matchQuery('?evaluation'))
+  self.registration.unregister();
+
+self.addEventListener('install', function(e) {
+    if (matchQuery('?install')) {
+      // Don't do waitUntil(unregister()) as that would deadlock as specified.
+      self.registration.unregister();
+    }
+  });
+
+self.addEventListener('activate', function(e) {
+    if (matchQuery('?activate'))
+      e.waitUntil(self.registration.unregister());
+  });
+
+self.addEventListener('message', function(e) {
+    e.waitUntil(self.registration.unregister()
+      .then(function(result) {
+          e.data.port.postMessage({result: result});
+        }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/update-worker.js b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/update-worker.js
new file mode 100644
index 000000000000..8be8a1ffebe0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/resources/update-worker.js
@@ -0,0 +1,22 @@
+var events_seen = [];
+
+self.registration.addEventListener('updatefound', function() {
+    events_seen.push('updatefound');
+  });
+
+self.addEventListener('activate', function(e) {
+    events_seen.push('activate');
+  });
+
+self.addEventListener('fetch', function(e) {
+    events_seen.push('fetch');
+    e.respondWith(new Response(events_seen));
+  });
+
+self.addEventListener('message', function(e) {
+    events_seen.push('message');
+    self.registration.update();
+  });
+
+// update() during the script evaluation should be ignored.
+self.registration.update();
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/service-worker-error-event.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/service-worker-error-event.https.html
new file mode 100644
index 000000000000..988f5466b9e1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/service-worker-error-event.https.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: Error event error message</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+promise_test(t => {
+    var script = 'resources/error-worker.js';
+    var scope = 'resources/scope/service-worker-error-event';
+    var error_name = 'testError'
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          var worker = registration.installing;
+          add_completion_callback(() => { registration.unregister(); });
+          return new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = resolve;
+              worker.postMessage('');
+            });
+        })
+      .then(e => {
+          assert_equals(e.data.error, error_name, 'error type');
+          assert_greater_than(
+            e.data.message.indexOf(error_name), -1, 'error message');
+          assert_greater_than(
+            e.data.filename.indexOf(script), -1, 'filename');
+          assert_equals(e.data.lineno, 5, 'error line number');
+          assert_equals(e.data.colno, 3, 'error column number');
+        });
+  }, 'Error handlers inside serviceworker should see the attributes of ' +
+     'ErrorEvent');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html
new file mode 100644
index 000000000000..1a124d727687
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html
@@ -0,0 +1,139 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: unregister</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js?evaluation';
+    var scope = 'resources/scope/unregister-on-script-evaluation';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+        });
+  }, 'Unregister on script evaluation');
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js?install';
+    var scope = 'resources/scope/unregister-on-install-event';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+        });
+  }, 'Unregister on installing event');
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js?activate';
+    var scope = 'resources/scope/unregister-on-activate-event';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+        });
+  }, 'Unregister on activate event');
+
+promise_test(function(t) {
+    var script = 'resources/unregister-worker.js';
+    var scope = 'resources/unregister-controlling-worker.html';
+
+    var controller;
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          controller = frame.contentWindow.navigator.serviceWorker.controller;
+
+          assert_equals(
+            controller.scriptURL,
+            normalizeURL(script),
+            'Service worker should control a new document')
+
+          // Wait for the completion of unregister() on the worker.
+          var channel = new MessageChannel();
+          var promise = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_true(e.data.result,
+                              'unregister() should successfully finish');
+                  resolve();
+                });
+            });
+          controller.postMessage({port: channel.port2}, [channel.port2]);
+          return promise;
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            undefined,
+            'After unregister(), the registration should not found');
+          assert_equals(
+            frame.contentWindow.navigator.serviceWorker.controller,
+            controller,
+            'After unregister(), the worker should still control the document');
+          return with_iframe(scope);
+        })
+      .then(function(new_frame) {
+          assert_equals(
+            new_frame.contentWindow.navigator.serviceWorker.controller,
+            null,
+            'After unregister(), the worker should not control a new document');
+
+          frame.remove();
+          new_frame.remove();
+        })
+  }, 'Unregister controlling service worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html
new file mode 100644
index 000000000000..a7dde2233972
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>ServiceWorkerGlobalScope: update</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../resources/test-helpers.sub.js'></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/update-worker.py';
+    var scope = 'resources/scope/update';
+    var registration;
+    var frame1;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame1 = f;
+          registration.active.postMessage('update');
+          return wait_for_update(t, registration);
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(frame2) {
+          var expected_events_seen = [
+            'updatefound',  // by register().
+            'activate',
+            'fetch',
+            'message',
+            'updatefound',  // by update() in the message handler.
+            'fetch',
+          ];
+          assert_equals(
+              frame2.contentDocument.body.textContent,
+              expected_events_seen.toString(),
+              'events seen by the worker');
+          frame1.remove();
+          frame2.remove();
+        });
+  }, 'Update a registration on ServiceWorkerGlobalScope');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..d729f2cd79b2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- registration-script-module.https.html: [js-modules-service-workers]
+- update-registration-with-type.https.html: [js-modules-service-workers]
+- "*": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/about-blank-replacement.https.html b/test/fixtures/wpt/service-workers/service-worker/about-blank-replacement.https.html
new file mode 100644
index 000000000000..b6efe3ec5620
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/about-blank-replacement.https.html
@@ -0,0 +1,181 @@
+<!DOCTYPE html>
+<title>Service Worker: about:blank replacement handling</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This test attempts to verify various initial about:blank document
+// creation is accurately reflected via the Clients API.  The goal is
+// for Clients API to reflect what the browser actually does and not
+// to make special cases for the API.
+//
+// If your browser does not create an about:blank document in certain
+// cases then please just mark the test expected fail for now.  The
+// reuse of globals from about:blank documents to the final load document
+// has particularly bad interop at the moment.  Hopefully we can evolve
+// tests like this to eventually align browsers.
+
+const worker = 'resources/about-blank-replacement-worker.js';
+
+// Helper routine that creates an iframe that internally has some kind
+// of nested window.  The nested window could be another iframe or
+// it could be a popup window.
+function createFrameWithNestedWindow(url) {
+  return new Promise((resolve, reject) => {
+    let frame = document.createElement('iframe');
+    frame.src = url;
+    document.body.appendChild(frame);
+
+    window.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type !== 'NESTED_LOADED') {
+        return;
+      }
+      window.removeEventListener('message', onMsg);
+      if (evt.data.result && evt.data.result.startsWith('failure:')) {
+        reject(evt.data.result);
+        return;
+      }
+      resolve(frame);
+    });
+  });
+}
+
+// Helper routine to request the given worker find the client with
+// the specified URL using the clients.matchAll() API.
+function getClientIdByURL(worker, url) {
+  return new Promise(resolve => {
+    navigator.serviceWorker.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type !== 'GET_CLIENT_ID') {
+        return;
+      }
+      navigator.serviceWorker.removeEventListener('message', onMsg);
+      resolve(evt.data.result);
+    });
+    worker.postMessage({ type: 'GET_CLIENT_ID', url: url.toString() });
+  });
+}
+
+async function doAsyncTest(t, scope) {
+  let reg = await service_worker_unregister_and_register(t, worker, scope);
+
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Load the scope as a frame.  We expect this in turn to have a nested
+  // iframe.  The service worker will intercept the load of the nested
+  // iframe and populate its body with the client ID of the initial
+  // about:blank document it sees via clients.matchAll().
+  let frame = await createFrameWithNestedWindow(scope);
+  let initialResult = frame.contentWindow.nested().document.body.textContent;
+  assert_false(initialResult.startsWith('failure:'), `result: ${initialResult}`);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+                frame.contentWindow.nested().navigator.serviceWorker.controller.scriptURL,
+                'nested about:blank should have same controlling service worker');
+
+  // Next, ask the service worker to find the final client ID for the fully
+  // loaded nested frame.
+  let nestedURL = new URL(frame.contentWindow.nested().location);
+  let finalResult = await getClientIdByURL(reg.active, nestedURL);
+  assert_false(finalResult.startsWith('failure:'), `result: ${finalResult}`);
+
+  // If the nested frame doesn't have a URL to load, then there is no fetch
+  // event and the body should be empty.  We can't verify the final client ID
+  // against anything.
+  if (nestedURL.href === 'about:blank' ||
+      nestedURL.href === 'about:srcdoc') {
+    assert_equals('', initialResult, 'about:blank text content should be blank');
+  }
+
+  // If the nested URL is not about:blank, though, then the fetch event handler
+  // should have populated the body with the client id of the initial about:blank.
+  // Verify the final client id matches.
+  else {
+    assert_equals(initialResult, finalResult, 'client ID values should match');
+  }
+
+  frame.remove();
+}
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is simply loaded normally.
+  await doAsyncTest(t, 'resources/about-blank-replacement-frame.py');
+}, 'Initial about:blank is controlled, exposed to clients.matchAll(), and ' +
+   'matches final Client.');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is modified immediately by
+  // its parent.  In this case we add a message listener so the service
+  // worker can ping the client to verify its existence.  This ping-pong
+  // check is performed during the initial load and when verifying the
+  // final loaded client.
+  await doAsyncTest(t, 'resources/about-blank-replacement-ping-frame.py');
+}, 'Initial about:blank modified by parent is controlled, exposed to ' +
+   'clients.matchAll(), and matches final Client.');
+
+promise_test(async function(t) {
+  // Execute a test where the nested window is a popup window instead of
+  // an iframe.  This should behave the same as the simple iframe case.
+  await doAsyncTest(t, 'resources/about-blank-replacement-popup-frame.py');
+}, 'Popup initial about:blank is controlled, exposed to clients.matchAll(), and ' +
+   'matches final Client.');
+
+promise_test(async function(t) {
+  const scope = 'resources/about-blank-replacement-uncontrolled-nested-frame.html';
+
+  let reg = await service_worker_unregister_and_register(t, worker, scope);
+
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Load the scope as a frame.  We expect this in turn to have a nested
+  // iframe.  Unlike the other tests in this file the nested iframe URL
+  // is not covered by a service worker scope.  It should end up as
+  // uncontrolled even though its initial about:blank is controlled.
+  let frame = await createFrameWithNestedWindow(scope);
+  let nested = frame.contentWindow.nested();
+  let initialResult = nested.document.body.textContent;
+
+  // The nested iframe should not have been intercepted by the service
+  // worker.  The empty.html nested frame has "hello world" for its body.
+  assert_equals(initialResult.trim(), 'hello world', `result: ${initialResult}`);
+
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller, null,
+                'outer frame should be controlled');
+
+  assert_equals(nested.navigator.serviceWorker.controller, null,
+                'nested frame should not be controlled');
+
+  frame.remove();
+}, 'Initial about:blank is controlled, exposed to clients.matchAll(), and ' +
+   'final Client is not controlled by a service worker.');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is an iframe without a src
+  // attribute.  This simple nested about:blank should still inherit the
+  // controller and be visible to clients.matchAll().
+  await doAsyncTest(t, 'resources/about-blank-replacement-blank-nested-frame.html');
+}, 'Simple about:blank is controlled and is exposed to clients.matchAll().');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is an iframe using a non-empty
+  // srcdoc containing only a tag pair so its textContent is still empty.
+  // This nested iframe should still inherit the controller and be visible
+  // to clients.matchAll().
+  await doAsyncTest(t, 'resources/about-blank-replacement-srcdoc-nested-frame.html');
+}, 'Nested about:srcdoc is controlled and is exposed to clients.matchAll().');
+
+promise_test(async function(t) {
+  // Execute a test where the nested frame is dynamically added without a src
+  // attribute.  This simple nested about:blank should still inherit the
+  // controller and be visible to clients.matchAll().
+  await doAsyncTest(t, 'resources/about-blank-replacement-blank-dynamic-nested-frame.html');
+}, 'Dynamic about:blank is controlled and is exposed to clients.matchAll().');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html b/test/fixtures/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html
new file mode 100644
index 000000000000..016a52c13c82
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Service Worker: registration events</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+  var script = 'resources/empty-worker.js';
+  var scope = 'resources/blank.html';
+  var registration;
+
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(function(registration) {
+        t.add_cleanup(function() {
+            return service_worker_unregister(t, scope);
+          });
+
+        var sw = registration.installing;
+
+        return new Promise(t.step_func(function(resolve) {
+          sw.onstatechange = t.step_func(function() {
+            if (sw.state === 'installed') {
+              assert_equals(registration.active, null,
+                            'installed event should be fired before activating service worker');
+              resolve();
+            }
+          });
+        }));
+      })
+    .catch(unreached_rejection(t));
+  }, 'installed event should be fired before activating service worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/activation-after-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/activation-after-registration.https.html
new file mode 100644
index 000000000000..29f97e3e3f4c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/activation-after-registration.https.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Service Worker: Activation occurs after registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/blank.html';
+    var registration;
+
+    return service_worker_unregister_and_register(
+        t, 'resources/empty-worker.js', scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          assert_equals(
+              r.installing.state,
+              'installing',
+              'worker should be in the "installing" state upon registration');
+          return wait_for_state(t, r.installing, 'activated');
+        });
+}, 'activation occurs after registration');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/activation.https.html b/test/fixtures/wpt/service-workers/service-worker/activation.https.html
new file mode 100644
index 000000000000..278454d3383e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/activation.https.html
@@ -0,0 +1,168 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>service worker: activation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// Returns {registration, iframe}, where |registration| has an active and
+// waiting worker. The active worker controls |iframe| and has an inflight
+// message event that can be finished by calling
+// |registration.active.postMessage('go')|.
+function setup_activation_test(t, scope, worker_url) {
+  var registration;
+  var iframe;
+  return navigator.serviceWorker.getRegistration(scope)
+    .then(r => {
+        if (r)
+          return r.unregister();
+      })
+    .then(() => {
+        // Create an in-scope iframe. Do this prior to registration to avoid
+        // racing between an update triggered by navigation and the update()
+        // call below.
+        return with_iframe(scope);
+      })
+    .then(f => {
+        iframe = f;
+        // Create an active worker.
+        return navigator.serviceWorker.register(worker_url, { scope: scope });
+      })
+    .then(r => {
+        registration = r;
+        add_result_callback(() => registration.unregister());
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(() => {
+        // Check that the frame was claimed.
+        assert_not_equals(
+            iframe.contentWindow.navigator.serviceWorker.controller, null);
+        // Create an in-flight request.
+        registration.active.postMessage('wait');
+        // Now there is both a controllee and an in-flight request.
+        // Initiate an update.
+        return registration.update();
+      })
+    .then(() => {
+        // Wait for a waiting worker.
+        return wait_for_state(t, registration.installing, 'installed');
+      })
+    .then(() => {
+        return wait_for_activation_on_sample_scope(t, self);
+      })
+    .then(() => {
+        assert_not_equals(registration.waiting, null);
+        assert_not_equals(registration.active, null);
+        return Promise.resolve({registration: registration, iframe: iframe});
+      });
+}
+promise_test(t => {
+    var scope = 'resources/no-controllee';
+    var worker_url = 'resources/mint-new-worker.py';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Finish the in-flight request.
+          registration.active.postMessage('go');
+          return wait_for_activation_on_sample_scope(t, self);
+        })
+      .then(() => {
+          // The new worker is still waiting. Remove the frame and it should
+          // activate.
+          new_worker = registration.waiting;
+          assert_equals(new_worker.state, 'installed');
+          var reached_active = wait_for_state(t, new_worker, 'activating');
+          iframe.remove();
+          return reached_active;
+        })
+      .then(() => {
+          assert_equals(new_worker, registration.active);
+        });
+  }, 'loss of controllees triggers activation');
+promise_test(t => {
+    var scope = 'resources/no-request';
+    var worker_url = 'resources/mint-new-worker.py';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Remove the iframe.
+          iframe.remove();
+          return new Promise(resolve => setTimeout(resolve, 0));
+        })
+      .then(() => {
+          // Finish the request.
+          new_worker = registration.waiting;
+          var reached_active = wait_for_state(t, new_worker, 'activating');
+          registration.active.postMessage('go');
+          return reached_active;
+        })
+      .then(() => {
+          assert_equals(registration.active, new_worker);
+        });
+  }, 'finishing a request triggers activation');
+promise_test(t => {
+    var scope = 'resources/skip-waiting';
+    var worker_url = 'resources/mint-new-worker.py?skip-waiting';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Finish the request. The iframe does not need to be removed because
+          // skipWaiting() was called.
+          new_worker = registration.waiting;
+          var reached_active = wait_for_state(t, new_worker, 'activating');
+          registration.active.postMessage('go');
+          return reached_active;
+        })
+      .then(() => {
+          assert_equals(registration.active, new_worker);
+          // Remove the iframe.
+          iframe.remove();
+        });
+  }, 'skipWaiting bypasses no controllee requirement');
+
+// This test is not really about activation, but otherwise is very
+// similar to the other tests here.
+promise_test(t => {
+    var scope = 'resources/unregister';
+    var worker_url = 'resources/mint-new-worker.py';
+    var registration;
+    var iframe;
+    var new_worker;
+    return setup_activation_test(t, scope, worker_url)
+      .then(result => {
+          registration = result.registration;
+          iframe = result.iframe;
+          // Remove the iframe.
+          iframe.remove();
+          return registration.unregister();
+        })
+      .then(() => {
+          // The unregister operation should wait for the active worker to
+          // finish processing its events before clearing the registration.
+          new_worker = registration.waiting;
+          var reached_redundant = wait_for_state(t, new_worker, 'redundant');
+          registration.active.postMessage('go');
+          return reached_redundant;
+        })
+      .then(() => {
+          assert_equals(registration.installing, null);
+          assert_equals(registration.waiting, null);
+          assert_equals(registration.active, null);
+        });
+  }, 'finishing a request triggers unregister');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/active.https.html b/test/fixtures/wpt/service-workers/service-worker/active.https.html
new file mode 100644
index 000000000000..350a34b802f7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/active.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.active</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/empty-worker.js';
+const SCOPE = 'resources/blank.html';
+
+// "active" is set
+promise_test(async t => {
+
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  const frame = await with_iframe(SCOPE);
+  const registration =
+      await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  await wait_for_state(t, registration.installing, 'activating');
+  const container = frame.contentWindow.navigator.serviceWorker;
+  assert_equals(container.controller, null, 'controller');
+  assert_equals(registration.active.state, 'activating',
+                'registration.active');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.installing, null, 'registration.installing');
+
+  // FIXME: Add a test for a frame created after installation.
+  // Should the existing frame ("frame") block activation?
+}, 'active is set');
+
+// Tests that the ServiceWorker objects returned from active attribute getter
+// that represent the same service worker are the same objects.
+promise_test(async t => {
+  const registration1 =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const registration2 = await navigator.serviceWorker.getRegistration(SCOPE);
+  assert_equals(registration1.active, registration2.active,
+                'ServiceWorkerRegistration.active should return the same ' +
+                'object');
+  await registration1.unregister();
+}, 'The ServiceWorker objects returned from active attribute getter that ' +
+   'represent the same service worker are the same objects');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/add-routes.https.html b/test/fixtures/wpt/service-workers/service-worker/add-routes.https.html
new file mode 100644
index 000000000000..fbab7cdedfa3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/add-routes.https.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: addRoutes() executes in installing</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/static-router-helpers.sub.js"></script>
+<script>
+
+promise_test(async t => {
+  const script = 'resources/add-routes.js';
+  const scope = 'resources/blank.html';
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+  const sw = reg.active;
+  const addRoutesError = await get_info_from_worker(sw);
+
+  assert_equals(addRoutesError.install, null,
+    'addRoutes() should execute successfully in installing');
+  assert_true(addRoutesError.activate instanceof Error,
+    'addRoutes() should throw outside of installing');
+
+}, 'addRoutes() will not be executed outside of installing');
+
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-affect-other-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-affect-other-registration.https.html
new file mode 100644
index 000000000000..52555ac271b5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-affect-other-registration.https.html
@@ -0,0 +1,136 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Service Worker: claim() should affect other registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+  var frame;
+
+  var init_scope = 'resources/blank.html?affect-other';
+  var init_worker_url = 'resources/empty.js';
+  var init_registration;
+  var init_workers = [undefined, undefined];
+
+  var claim_scope = 'resources/blank.html?affect-other-registration';
+  var claim_worker_url = 'resources/claim-worker.js';
+  var claim_registration;
+  var claim_worker;
+
+  return Promise.resolve()
+    // Register the first service worker to init_scope.
+    .then(() => navigator.serviceWorker.register(init_worker_url + '?v1',
+                                                 {scope: init_scope}))
+    .then(r => {
+      init_registration = r;
+      init_workers[0] = r.installing;
+      return Promise.resolve()
+        .then(() => wait_for_state(t, init_workers[0], 'activated'))
+        .then(() => assert_array_equals([init_registration.active,
+                                         init_registration.waiting,
+                                         init_registration.installing],
+                                        [init_workers[0],
+                                         null,
+                                         null],
+                                        'Wrong workers.'));
+    })
+
+    // Create an iframe as the client of the first service worker of init_scope.
+    .then(() => with_iframe(claim_scope))
+    .then(f => frame = f)
+
+    // Check the controller.
+    .then(() => frame.contentWindow.navigator.serviceWorker.getRegistration(
+                  normalizeURL(init_scope)))
+    .then(r => assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                             r.active,
+                             '.controller should belong to init_scope.'))
+
+    // Register the second service worker to init_scope.
+    .then(() => navigator.serviceWorker.register(init_worker_url + '?v2',
+                                                 {scope: init_scope}))
+    .then(r => {
+      assert_equals(r, init_registration, 'Should be the same registration');
+      init_workers[1] = r.installing;
+      return Promise.resolve()
+        .then(() => wait_for_state(t, init_workers[1], 'installed'))
+        .then(() => assert_array_equals([init_registration.active,
+                                         init_registration.waiting,
+                                         init_registration.installing],
+                                        [init_workers[0],
+                                         init_workers[1],
+                                         null],
+                                        'Wrong workers.'));
+    })
+
+    // Register a service worker to claim_scope.
+    .then(() => navigator.serviceWorker.register(claim_worker_url,
+                                                 {scope: claim_scope}))
+    .then(r => {
+      claim_registration = r;
+      claim_worker = r.installing;
+      return wait_for_state(t, claim_worker, 'activated')
+    })
+
+    // Let claim_worker claim the created iframe.
+    .then(function() {
+      var channel = new MessageChannel();
+      var saw_message = new Promise(function(resolve) {
+        channel.port1.onmessage = t.step_func(function(e) {
+          assert_equals(e.data, 'PASS',
+                        'Worker call to claim() should fulfill.');
+          resolve();
+        });
+      });
+
+      claim_worker.postMessage({port: channel.port2}, [channel.port2]);
+      return saw_message;
+    })
+
+    // Check the controller.
+    .then(() => frame.contentWindow.navigator.serviceWorker.getRegistration(
+                  normalizeURL(claim_scope)))
+    .then(r => assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                             r.active,
+                             '.controller should belong to claim_scope.'))
+
+    // Check the status of created registrations and service workers.
+    .then(() => wait_for_state(t, init_workers[1], 'activated'))
+    .then(() => {
+      assert_array_equals([claim_registration.active,
+                           claim_registration.waiting,
+                           claim_registration.installing],
+                          [claim_worker,
+                           null,
+                           null],
+                          'claim_worker should be the only worker.')
+
+      assert_array_equals([init_registration.active,
+                           init_registration.waiting,
+                           init_registration.installing],
+                          [init_workers[1],
+                           null,
+                           null],
+                          'The waiting sw should become the active worker.')
+
+      assert_array_equals([init_workers[0].state,
+                           init_workers[1].state,
+                           claim_worker.state],
+                          ['redundant',
+                           'activated',
+                           'activated'],
+                          'Wrong worker states.');
+    })
+
+    // Cleanup and finish testing.
+    .then(() => frame.remove())
+    .then(() => Promise.all([
+      init_registration.unregister(),
+      claim_registration.unregister()
+    ]))
+    .then(() => t.done());
+}, 'claim() should affect the originally controlling registration.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-fetch.https.html
new file mode 100644
index 000000000000..ae0082df06bf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-fetch.https.html
@@ -0,0 +1,90 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+async function tryFetch(fetchFunc, path) {
+  let response;
+  try {
+   response = await fetchFunc(path);
+  } catch (err) {
+    throw (`fetch() threw: ${err}`);
+  }
+
+  let responseText;
+  try {
+   responseText = await response.text();
+  } catch (err) {
+   throw (`text() threw: ${err}`);
+  }
+
+  return responseText;
+}
+
+promise_test(async function(t) {
+  const scope = 'resources/';
+  const script = 'resources/claim-worker.js';
+  const resource = 'simple.txt';
+
+  // Create the test frame.
+  const frame = await with_iframe('resources/blank.html');
+  t.add_cleanup(() => frame.remove());
+
+  // Check the controller and test with fetch.
+  assert_equals(frame.contentWindow.navigator.controller, undefined,
+                'Should have no controller.');
+  let response;
+  try {
+    response = await tryFetch(frame.contentWindow.fetch, resource);
+  } catch (err) {
+    assert_unreached(`uncontrolled fetch failed: ${err}`);
+  }
+  assert_equals(response, 'a simple text file\n',
+                'fetch() should not be intercepted.');
+
+  // Register a service worker.
+  const registration =
+    await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+
+  // Register a controllerchange event to wait until the controller is updated
+  // and check if the frame is controlled by a service worker.
+  const controllerChanged = new Promise((resolve) => {
+    frame.contentWindow.navigator.serviceWorker.oncontrollerchange = () => {
+      resolve(frame.contentWindow.navigator.serviceWorker.controller);
+    };
+  });
+
+  // Tell the service worker to claim the iframe.
+  const sawMessage = new Promise((resolve) => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = t.step_func((event) => {
+      resolve(event.data);
+    });
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+  const data = await sawMessage;
+  assert_equals(data, 'PASS', 'Worker call to claim() should fulfill.');
+
+  // Check if the controller is updated after claim() and test with fetch.
+  const controller = await controllerChanged;
+  assert_true(controller instanceof frame.contentWindow.ServiceWorker,
+              'iframe should be controlled.');
+  try {
+    response = await tryFetch(frame.contentWindow.fetch, resource);
+  } catch (err) {
+    assert_unreached(`controlled fetch failed: ${err}`);
+  }
+  assert_equals(response, 'Intercepted!',
+                'fetch() should be intercepted.');
+}, 'fetch() should be intercepted after the client is claimed.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-not-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-not-using-registration.https.html
new file mode 100644
index 000000000000..fd61d05ba4ea
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-not-using-registration.https.html
@@ -0,0 +1,131 @@
+<!DOCTYPE html>
+<title>Service Worker: claim client not using registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(function(t) {
+    var init_scope = 'resources/blank.html?not-using-init';
+    var claim_scope = 'resources/blank.html?not-using';
+    var init_worker_url = 'resources/empty.js';
+    var claim_worker_url = 'resources/claim-worker.js';
+    var claim_worker, claim_registration, frame1, frame2;
+    return service_worker_unregister_and_register(
+        t, init_worker_url, init_scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, init_scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return Promise.all(
+              [with_iframe(init_scope), with_iframe(claim_scope)]);
+        })
+      .then(function(frames) {
+          frame1 = frames[0];
+          frame2 = frames[1];
+          assert_equals(
+              frame1.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(init_worker_url),
+              'Frame1 controller should not be null');
+          assert_equals(
+              frame2.contentWindow.navigator.serviceWorker.controller, null,
+              'Frame2 controller should be null');
+          return navigator.serviceWorker.register(claim_worker_url,
+                                                  {scope: claim_scope});
+        })
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, claim_scope);
+            });
+
+          claim_worker = registration.installing;
+          claim_registration = registration;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var saw_controllerchanged = new Promise(function(resolve) {
+              frame2.contentWindow.navigator.serviceWorker.oncontrollerchange =
+                  function() { resolve(); }
+            });
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'PASS',
+                                'Worker call to claim() should fulfill.');
+                  resolve();
+                });
+            });
+          claim_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return Promise.all([saw_controllerchanged, saw_message]);
+        })
+      .then(function() {
+          assert_equals(
+              frame1.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(init_worker_url),
+              'Frame1 should not be influenced');
+          assert_equals(
+              frame2.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(claim_worker_url),
+              'Frame2 should be controlled by the new registration');
+          frame1.remove();
+          frame2.remove();
+          return claim_registration.unregister();
+        });
+  }, 'Test claim client which is not using registration');
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?longer-matched';
+    var claim_scope = 'resources/blank.html?longer';
+    var claim_worker_url = 'resources/claim-worker.js';
+    var installing_worker_url = 'resources/empty-worker.js';
+    var frame, claim_worker;
+    return with_iframe(scope)
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(
+              claim_worker_url, {scope: claim_scope});
+        })
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, claim_scope);
+            });
+
+          claim_worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return navigator.serviceWorker.register(
+              installing_worker_url, {scope: scope});
+        })
+      .then(function() {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'PASS',
+                                'Worker call to claim() should fulfill.');
+                  resolve();
+                });
+            });
+          claim_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function() {
+          assert_equals(
+              frame.contentWindow.navigator.serviceWorker.controller, null,
+              'Frame should not be claimed when a longer-matched ' +
+              'registration exists');
+          frame.remove();
+        });
+  }, 'Test claim client when there\'s a longer-matched registration not ' +
+     'already used by the page');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html
new file mode 100644
index 000000000000..f5f44886baa2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html
@@ -0,0 +1,71 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(function(t) {
+  var frame;
+  var resource = 'simple.txt';
+
+  var worker;
+  var scope = 'resources/';
+  var script = 'resources/claim-worker.js';
+
+  return Promise.resolve()
+    // Create the test iframe with a shared worker.
+    .then(() => with_iframe('resources/claim-shared-worker-fetch-iframe.html'))
+    .then(f => frame = f)
+
+    // Check the controller and test with fetch in the shared worker.
+    .then(() => assert_equals(frame.contentWindow.navigator.controller,
+                              undefined,
+                              'Should have no controller.'))
+    .then(() => frame.contentWindow.fetch_in_shared_worker(resource))
+    .then(response_text => assert_equals(response_text,
+                                         'a simple text file\n',
+                                         'fetch() should not be intercepted.'))
+    // Register a service worker.
+    .then(() => service_worker_unregister_and_register(t, script, scope))
+    .then(r => {
+        t.add_cleanup(() => service_worker_unregister(t, scope));
+
+        worker = r.installing;
+
+        return wait_for_state(t, worker, 'activated')
+      })
+    // Let the service worker claim the iframe and the shared worker.
+    .then(() => {
+      var channel = new MessageChannel();
+      var saw_message = new Promise(function(resolve) {
+        channel.port1.onmessage = t.step_func(function(e) {
+          assert_equals(e.data, 'PASS',
+                        'Worker call to claim() should fulfill.');
+          resolve();
+        });
+      });
+      worker.postMessage({port: channel.port2}, [channel.port2]);
+      return saw_message;
+    })
+
+    // Check the controller and test with fetch in the shared worker.
+    .then(() => frame.contentWindow.navigator.serviceWorker.getRegistration(scope))
+    .then(r => assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                             r.active,
+                             'Test iframe should be claimed.'))
+    // TODO(horo): Check the SharedWorker's navigator.seviceWorker.controller.
+    .then(() => frame.contentWindow.fetch_in_shared_worker(resource))
+    .then(response_text =>
+          assert_equals(response_text,
+                        'Intercepted!',
+                        'fetch() in the shared worker should be intercepted.'))
+
+    // Cleanup this testcase.
+    .then(() => frame.remove());
+}, 'fetch() in SharedWorker should be intercepted after the client is claimed.')
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-using-registration.https.html
new file mode 100644
index 000000000000..a02f8e9ca6f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-using-registration.https.html
@@ -0,0 +1,103 @@
+<!DOCTYPE html>
+<title>Service Worker: claim client using registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var scope = 'resources/';
+    var frame_url = 'resources/blank.html?using-different-registration';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/claim-worker.js';
+    var worker, sw_registration, frame;
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(frame_url);
+        })
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(url2, {scope: frame_url});
+        })
+      .then(function(registration) {
+          worker = registration.installing;
+          sw_registration = registration;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var saw_controllerchanged = new Promise(function(resolve) {
+              frame.contentWindow.navigator.serviceWorker.oncontrollerchange =
+                  function() { resolve(); }
+            });
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'PASS',
+                                'Worker call to claim() should fulfill.');
+                  resolve();
+                });
+            });
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          return Promise.all([saw_controllerchanged, saw_message]);
+        })
+      .then(function() {
+          assert_equals(
+              frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+              normalizeURL(url2),
+              'Frame1 controller scriptURL should be changed to url2');
+          frame.remove();
+          return sw_registration.unregister();
+        });
+  }, 'Test worker claims client which is using another registration');
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?using-same-registration';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/claim-worker.js';
+    var frame, worker;
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(registration) {
+          worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = t.step_func(function(e) {
+                  assert_equals(e.data, 'FAIL: exception: InvalidStateError',
+                                'Worker call to claim() should reject with ' +
+                                'InvalidStateError');
+                  resolve();
+                });
+            });
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Test for the waiting worker claims a client which is using the ' +
+     'same registration');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-with-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-with-redirect.https.html
new file mode 100644
index 000000000000..fd89cb9b00a1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-with-redirect.https.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<title>Service Worker: Claim() when update happens after redirect</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+var BASE_URL = host_info['HTTPS_ORIGIN'] + base_path();
+var OTHER_BASE_URL = host_info['HTTPS_REMOTE_ORIGIN'] + base_path();
+
+var WORKER_URL = OTHER_BASE_URL + 'resources/update-claim-worker.py'
+var SCOPE_URL = OTHER_BASE_URL + 'resources/redirect.py'
+var OTHER_IFRAME_URL = OTHER_BASE_URL +
+                       'resources/claim-with-redirect-iframe.html';
+
+// Different origin from the registration
+var REDIRECT_TO_URL = BASE_URL +
+                      'resources/claim-with-redirect-iframe.html?redirected';
+
+var REGISTER_IFRAME_URL = OTHER_IFRAME_URL + '?register=' +
+                          encodeURIComponent(WORKER_URL) + '&' +
+                          'scope=' + encodeURIComponent(SCOPE_URL);
+var REDIRECT_IFRAME_URL = SCOPE_URL + '?Redirect=' +
+                          encodeURIComponent(REDIRECT_TO_URL);
+var UPDATE_IFRAME_URL = OTHER_IFRAME_URL + '?update=' +
+                        encodeURIComponent(SCOPE_URL);
+var UNREGISTER_IFRAME_URL = OTHER_IFRAME_URL + '?unregister=' +
+                            encodeURIComponent(SCOPE_URL);
+
+var waiting_resolver = undefined;
+
+addEventListener('message', e => {
+    if (waiting_resolver !== undefined) {
+      waiting_resolver(e.data);
+    }
+  });
+
+function assert_with_iframe(url, expected_message) {
+  return new Promise(resolve => {
+        waiting_resolver = resolve;
+        with_iframe(url);
+      })
+    .then(data => assert_equals(data.message, expected_message));
+}
+
+// This test checks behavior when browser got a redirect header from in-scope
+// page and navigated to out-of-scope page which has a different origin from any
+// registrations.
+promise_test(t => {
+  return assert_with_iframe(REGISTER_IFRAME_URL, 'registered')
+    .then(() => assert_with_iframe(REDIRECT_IFRAME_URL, 'redirected'))
+    .then(() => assert_with_iframe(UPDATE_IFRAME_URL, 'updated'))
+    .then(() => assert_with_iframe(UNREGISTER_IFRAME_URL, 'unregistered'));
+  }, 'Claim works after redirection to another origin');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/claim-worker-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/claim-worker-fetch.https.html
new file mode 100644
index 000000000000..7cb26c742b97
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/claim-worker-fetch.https.html
@@ -0,0 +1,83 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test((t) => {
+  return runTest(t, 'resources/claim-worker-fetch-iframe.html');
+}, 'fetch() in Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/claim-nested-worker-fetch-iframe.html');
+}, 'fetch() in nested Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/claim-blob-url-worker-fetch-iframe.html');
+}, 'fetch() in blob URL Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-workers.html');
+}, 'fetch() in nested blob URL Worker created from a blob URL Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-worker-created-from-blob-url-worker.html');
+}, 'fetch() in nested Worker created from a blob URL Worker should be intercepted after the client is claimed.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-worker-created-from-worker.html');
+}, 'fetch() in nested blob URL Worker created from a Worker should be intercepted after the client is claimed.');
+
+async function runTest(t, iframe_url) {
+  const resource = 'simple.txt';
+  const scope = 'resources/';
+  const script = 'resources/claim-worker.js';
+
+  // Create the test iframe with a dedicated worker.
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+
+  // Check the controller and test with fetch in the worker.
+  assert_equals(frame.contentWindow.navigator.controller,
+                undefined, 'Should have no controller.');
+  {
+    const response_text = await frame.contentWindow.fetch_in_worker(resource);
+    assert_equals(response_text, 'a simple text file\n',
+                  'fetch() should not be intercepted.');
+  }
+
+  // Register a service worker.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Let the service worker claim the iframe and the worker.
+  const channel = new MessageChannel();
+  const saw_message = new Promise(function(resolve) {
+    channel.port1.onmessage = t.step_func(function(e) {
+      assert_equals(e.data, 'PASS', 'Worker call to claim() should fulfill.');
+      resolve();
+    });
+  });
+  reg.active.postMessage({port: channel.port2}, [channel.port2]);
+  await saw_message;
+
+  // Check the controller and test with fetch in the worker.
+  const reg2 =
+    await frame.contentWindow.navigator.serviceWorker.getRegistration(scope);
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                reg2.active, 'Test iframe should be claimed.');
+
+  {
+    // TODO(horo): Check the worker's navigator.seviceWorker.controller.
+    const response_text = await frame.contentWindow.fetch_in_worker(resource);
+    assert_equals(response_text, 'Intercepted!',
+                  'fetch() in the worker should be intercepted.');
+  }
+}
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-id.https.html b/test/fixtures/wpt/service-workers/service-worker/client-id.https.html
new file mode 100644
index 000000000000..b93b34189999
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-id.https.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<title>Service Worker: Client.id</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/blank.html?client-id';
+var frame1, frame2;
+
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/client-id-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope + '#1'); })
+      .then(function(f) {
+          frame1 = f;
+          // To be sure Clients.matchAll() iterates in the same order.
+          f.focus();
+          return with_iframe(scope + '#2');
+        })
+      .then(function(f) {
+          frame2 = f;
+          var channel = new MessageChannel();
+
+          return new Promise(function(resolve, reject) {
+              channel.port1.onmessage = resolve;
+              channel.port1.onmessageerror = reject;
+              f.contentWindow.navigator.serviceWorker.controller.postMessage(
+                  {port:channel.port2}, [channel.port2]);
+            });
+        })
+      .then(on_message);
+  }, 'Client.id returns the client\'s ID.');
+
+function on_message(e) {
+  // The result of two sequential clients.matchAll() calls in the SW.
+  // 1st matchAll() results in e.data[0], e.data[1].
+  // 2nd matchAll() results in e.data[2], e.data[3].
+  assert_equals(e.data.length, 4);
+  // All should be string values.
+  assert_equals(typeof e.data[0], 'string');
+  assert_equals(typeof e.data[1], 'string');
+  assert_equals(typeof e.data[2], 'string');
+  assert_equals(typeof e.data[3], 'string');
+  // Different clients should have different ids.
+  assert_not_equals(e.data[0], e.data[1]);
+  assert_not_equals(e.data[2], e.data[3]);
+  // Same clients should have an identical id.
+  assert_equals(e.data[0], e.data[2]);
+  assert_equals(e.data[1], e.data[3]);
+  frame1.remove();
+  frame2.remove();
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-navigate.https.html b/test/fixtures/wpt/service-workers/service-worker/client-navigate.https.html
new file mode 100644
index 000000000000..f40a08635cfd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-navigate.https.html
@@ -0,0 +1,107 @@
+<!doctype html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<title>Service Worker: WindowClient.navigate</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+  function wait_for_message(msg) {
+    return new Promise(function(resolve, reject) {
+      var get_message_data = function get_message_data(e) {
+        window.removeEventListener("message", get_message_data);
+        resolve(e.data);
+      }
+      window.addEventListener("message", get_message_data, false);
+    });
+  }
+
+  function run_test(controller, clientId, test) {
+    return new Promise(function(resolve, reject) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(e) {
+        resolve(e.data);
+      };
+      var message = {
+        port: channel.port2,
+        test: test,
+        clientId: clientId,
+      };
+      controller.postMessage(
+        message, [channel.port2]);
+    });
+  }
+
+  async function with_controlled_iframe_and_url(t, name, f) {
+    const SCRIPT = "resources/client-navigate-worker.js";
+    const SCOPE = "resources/client-navigate-frame.html";
+
+    // Register service worker and wait for it to become activated
+    const registration = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    t.add_cleanup(() => registration.unregister());
+    const worker = registration.installing;
+    await wait_for_state(t, worker, 'activated');
+
+    // Create child iframe and make sure we register a listener for the message
+    // it sends before it's created
+    const client_id_promise = wait_for_message();
+    const iframe = await with_iframe(SCOPE);
+    t.add_cleanup(() => iframe.remove());
+    const { id } = await client_id_promise;
+
+    // Run the test in the service worker and fetch it
+    const { result, url } = await run_test(worker, id, name);
+    fetch_tests_from_worker(worker);
+    assert_equals(result, name);
+
+    // Hand over the iframe and URL from the service worker to the callback
+    await f(iframe, url);
+  }
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_success', async (iframe, url) => {
+      assert_equals(
+        url, new URL("resources/client-navigated-frame.html",
+                      location).toString());
+      assert_equals(
+        iframe.contentWindow.location.href,
+        new URL("resources/client-navigated-frame.html",
+                location).toString());
+    });
+  }, "Frame location should update on successful navigation");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_redirect', async (iframe, url) => {
+      assert_equals(url, "");
+      assert_throws_dom("SecurityError", function() { return iframe.contentWindow.location.href });
+    });
+  }, "Frame location should not be accessible after redirect");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_cross_origin', async (iframe, url) => {
+      assert_equals(url, "");
+      assert_throws_dom("SecurityError", function() { return iframe.contentWindow.location.href });
+    });
+  }, "Frame location should not be accessible after cross-origin navigation");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_about_blank', async (iframe, url) => {
+      assert_equals(
+          iframe.contentWindow.location.href,
+          new URL("resources/client-navigate-frame.html",
+                  location).toString());
+      iframe.contentWindow.document.body.style = "background-color: green"
+    });
+  }, "Frame location should not update on failed about:blank navigation");
+
+  promise_test(function(t) {
+    return with_controlled_iframe_and_url(t, 'test_client_navigate_mixed_content', async (iframe, url) => {
+      assert_equals(
+          iframe.contentWindow.location.href,
+          new URL("resources/client-navigate-frame.html",
+                  location).toString());
+      iframe.contentWindow.document.body.style = "background-color: green"
+    });
+  }, "Frame location should not update on failed mixed-content navigation");
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-url-creation-url.https.html b/test/fixtures/wpt/service-workers/service-worker/client-url-creation-url.https.html
new file mode 100644
index 000000000000..ba597d893d34
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-url-creation-url.https.html
@@ -0,0 +1,129 @@
+<!DOCTYPE html>
+<title>Service Worker: Client.url is Window creation URL tests</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// These tests all validate that the Service Worker's Client.url property is
+// correct for different types of Window client navigations.
+// All test cases involve an iframe navigating in some manner and then
+// the service worker validating that the Client.url property is correct.
+
+// Waits for and returns the next postMessage from `frame` to this window.
+function wait_for_message_from_frame(frame) {
+  return new Promise(resolve => {
+    const message_handler = e => {
+      if (e.source === frame.contentWindow) {
+        frame.removeEventListener('message', message_handler);
+        resolve(e.data);
+      }
+    };
+    window.addEventListener('message', message_handler);
+  });
+}
+
+// Returns a promise to get a client URL under the ServiceWorker's
+// (client-url-creation-url-sw.js) control. `target` should be an active
+// ServiceWorker to post message.  We expect it to send back the client URL
+// via the given channel.
+function post_message_and_wait_for_response(
+    target, data) {
+  return new Promise(resolve => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => {
+      resolve(e.data);
+    };
+    target.postMessage(
+        {message: data, port: channel.port2},
+        [channel.port2]);
+  });
+}
+
+const SCOPE = 'resources/client-url-creation-url';
+const IFRAME_URL = SCOPE + '-iframe.html?step=1';
+
+// The test helper function implements a test case by
+// using an iframe to navigate in various ways described by `navigation_kinds`
+// and then validates the ServiceWorker Client.url property of the iframe
+// against the provided `expected_client_url`.
+// `navigation_kinds` is an array of strings each of which is one of the
+// navigation actions supported by client-url-creation-url-iframe.html.
+async function test_client_url_helper(
+    t, navigation_kinds, expected_client_url) {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/client-url-creation-url-sw.js', SCOPE);
+  t.add_cleanup(_ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(IFRAME_URL);
+  t.add_cleanup(_ => frame.remove());
+  const message = await wait_for_message_from_frame(frame);
+  assert_equals(message, 'done', 'iframe loaded successfully');
+
+  for (let navigation_kind_idx = 0;
+      navigation_kind_idx < navigation_kinds.length;
+      ++navigation_kind_idx) {
+    const navigation_kind = navigation_kinds[navigation_kind_idx];
+
+    frame.contentWindow.postMessage(navigation_kind);
+    const result = await wait_for_message_from_frame(frame);
+    assert_equals(result, 'done', 'iframe navigation successfully completed');
+  }
+
+  const actual_client_url = await post_message_and_wait_for_response(
+      registration.active, "get_client_url");
+
+  assert_equals(
+      actual_client_url, expected_client_url, 'Client.url should match');
+}
+
+const EXPECTED_URL_STEP_1 = new URL(
+    './resources/client-url-creation-url-iframe.html?step=1', location).href;
+const EXPECTED_URL_STEP_2 = new URL(
+    './resources/client-url-creation-url-iframe.html?step=2', location).href;
+
+// Tests that perform navigations that don't create a new document
+promise_test(async t => {
+  await test_client_url_helper(t, [], EXPECTED_URL_STEP_1);
+}, 'No navigation creation URL is same as window URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['fragment'], EXPECTED_URL_STEP_1);
+}, 'Fragment only navigation doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['pushstate'], EXPECTED_URL_STEP_1);
+}, 'Pushstate doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['replacestate'], EXPECTED_URL_STEP_1);
+}, 'Replacestate doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(
+      t, ['pushstate', 'pushstate', 'back-within-same-document'], EXPECTED_URL_STEP_1);
+}, 'Going back over pushstate to other pushstate via back');
+
+// Tests that perform navigations that create new document(s)
+promise_test(async t => {
+  await test_client_url_helper(t, ['query'], EXPECTED_URL_STEP_2);
+}, 'Query navigation changes creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['reload'], EXPECTED_URL_STEP_1);
+}, 'Reloading doesn\'t change creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(t, ['pushstate', 'reload'], EXPECTED_URL_STEP_2);
+}, 'Reloading pushstate URL changes creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(
+      t, ['query', 'pushstate', 'back-within-same-document'], EXPECTED_URL_STEP_2);
+}, 'Going back over pushstate to creation URL');
+
+promise_test(async t => {
+  await test_client_url_helper(
+      t, ['query', 'query', 'back-cross-document'], EXPECTED_URL_STEP_2);
+}, 'Going back to new document changes creation URL');
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/client-url-of-blob-url-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/client-url-of-blob-url-worker.https.html
new file mode 100644
index 000000000000..97a2fcf98f29
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/client-url-of-blob-url-worker.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<title>Service Worker: client.url of a worker created from a blob URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+const SCRIPT = 'resources/client-url-of-blob-url-worker.js';
+const SCOPE = 'resources/client-url-of-blob-url-worker.html';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const frame = await with_iframe(SCOPE);
+  t.add_cleanup(_ => frame.remove());
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                    null, 'frame should be controlled');
+
+  const response = await frame.contentWindow.createAndFetchFromBlobWorker();
+
+  assert_not_equals(response.result, 'one worker client should exist',
+                    'worker client should exist');
+  assert_equals(response.result, response.expected,
+                'client.url and worker location href should be the same');
+
+}, 'Client.url of a blob URL worker should be a blob URL.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get-client-types.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get-client-types.https.html
new file mode 100644
index 000000000000..63e3e51b3202
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get-client-types.https.html
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.get with window and worker clients</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/clients-get-client-types';
+var frame_url = scope + '-frame.html';
+var shared_worker_url = scope + '-shared-worker.js';
+var worker_url = scope + '-worker.js';
+var client_ids = [];
+var registration;
+var frame;
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-get-worker.js', scope)
+      .then(function(r) {
+          registration = r;
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(frame_url);
+        })
+      .then(function(f) {
+          frame = f;
+          add_completion_callback(function() { frame.remove(); });
+          frame.focus();
+          return wait_for_clientId();
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          return new Promise(function(resolve) {
+              var w = new SharedWorker(shared_worker_url);
+              w.port.onmessage = function(e) {
+                resolve(e.data.clientId);
+              };
+            });
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          var channel = new MessageChannel();
+          var w = new Worker(worker_url);
+          w.postMessage({cmd:'GetClientId', port:channel.port2},
+              [channel.port2]);
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) {
+                resolve(e.data.clientId);
+              };
+            });
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          var channel = new MessageChannel();
+          frame.contentWindow.postMessage('StartWorker', '*', [channel.port2]);
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) {
+                resolve(e.data.clientId);
+              };
+            });
+        })
+      .then(function(client_id) {
+          client_ids.push(client_id);
+          var saw_message = new Promise(function(resolve) {
+              navigator.serviceWorker.onmessage = resolve;
+            });
+          registration.active.postMessage({clientIds: client_ids});
+          return saw_message;
+        })
+      .then(function(e) {
+          assert_equals(e.data.length, expected.length);
+          // We use these assert_not_equals because assert_array_equals doesn't
+          // print the error description when passed an undefined value.
+          assert_not_equals(e.data[0], undefined,
+              'Window client should not be undefined');
+          assert_array_equals(e.data[0], expected[0], 'Window client');
+          assert_not_equals(e.data[1], undefined,
+              'Shared worker client should not be undefined');
+          assert_array_equals(e.data[1], expected[1], 'Shared worker client');
+          assert_not_equals(e.data[2], undefined,
+              'Worker(Started by main frame) client should not be undefined');
+          assert_array_equals(e.data[2], expected[2],
+              'Worker(Started by main frame) client');
+          assert_not_equals(e.data[3], undefined,
+              'Worker(Started by sub frame) client should not be undefined');
+          assert_array_equals(e.data[3], expected[3],
+              'Worker(Started by sub frame) client');
+        });
+  }, 'Test Clients.get() with window and worker clients');
+
+function wait_for_clientId() {
+  return new Promise(function(resolve) {
+      function get_client_id(e) {
+        window.removeEventListener('message', get_client_id);
+        resolve(e.data.clientId);
+      }
+      window.addEventListener('message', get_client_id, false);
+    });
+}
+
+var expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, normalizeURL(scope) + '-frame.html', 'window', 'nested'],
+    [undefined, undefined, normalizeURL(scope) + '-shared-worker.js', 'sharedworker', 'none'],
+    [undefined, undefined, normalizeURL(scope) + '-worker.js', 'worker', 'none'],
+    [undefined, undefined, normalizeURL(scope) + '-frame-worker.js', 'worker', 'none']
+];
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get-cross-origin.https.html
new file mode 100644
index 000000000000..1e4acfb286c6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get-cross-origin.https.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.get across origins</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+
+var scope = 'resources/clients-get-frame.html';
+var other_origin_iframe = host_info['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                          'resources/clients-get-cross-origin-frame.html';
+// The ID of a client from the same origin as us.
+var my_origin_client_id;
+// This test asserts the behavior of the Client API in cases where the client
+// belongs to a foreign origin. It does this by creating an iframe with a
+// foreign origin which connects to a server worker in the current origin.
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-get-worker.js', scope)
+      .then(function(registration) {
+          add_completion_callback(function() { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      // Create a same-origin client and use it to populate |my_origin_client_id|.
+      .then(function(frame1) {
+          add_completion_callback(function() { frame1.remove(); });
+          return new Promise(function(resolve, reject) {
+            function get_client_id(e) {
+              window.removeEventListener('message', get_client_id);
+              resolve(e.data.clientId);
+            }
+            window.addEventListener('message', get_client_id, false);
+          });
+        })
+      // Create a cross-origin client. We'll communicate with this client to
+      // test the cross-origin service worker's behavior.
+      .then(function(client_id) {
+          my_origin_client_id = client_id;
+          return with_iframe(other_origin_iframe);
+        })
+      // Post the 'getClientId' message to the cross-origin client. The client
+      // will then ask its service worker to look up |my_origin_client_id| via
+      // Clients#get. Since this client ID is for a different origin, we expect
+      // the client to not be found.
+      .then(function(frame2) {
+          add_completion_callback(function() { frame2.remove(); });
+
+          frame2.contentWindow.postMessage(
+            {clientId: my_origin_client_id, type: 'getClientId'},
+            host_info['HTTPS_REMOTE_ORIGIN']
+          );
+
+          return new Promise(function(resolve) {
+              window.addEventListener('message', function(e) {
+                  if (e.data && e.data.type === 'clientId') {
+                    resolve(e.data.value);
+                  }
+                });
+            });
+        })
+      .then(function(client_id) {
+          assert_equals(client_id, undefined, 'iframe client ID');
+        });
+  }, 'Test Clients.get() cross origin');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get-resultingClientId.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get-resultingClientId.https.html
new file mode 100644
index 000000000000..3419cf14b523
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get-resultingClientId.https.html
@@ -0,0 +1,177 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test clients.get(resultingClientId)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = "resources/";
+let worker;
+
+// Setup. Keep this as the first promise_test.
+promise_test(async (t) => {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/get-resultingClientId-worker.js',
+      scope);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+}, 'global setup');
+
+// Sends |command| to the worker and returns a promise that resolves to its
+// response. There should only be one inflight command at a time.
+async function sendCommand(command) {
+  const saw_message = new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+  worker.postMessage(command);
+  return saw_message;
+}
+
+// Wrapper for 'startTest' command. Tells the worker a test is starting,
+// so it resets state and keeps itself alive until 'finishTest'.
+async function startTest(t) {
+  const result = await sendCommand({command: 'startTest'});
+  assert_equals(result, 'ok', 'startTest');
+
+  t.add_cleanup(async () => {
+    return finishTest();
+  });
+}
+
+// Wrapper for 'finishTest' command.
+async function finishTest() {
+  const result = await sendCommand({command: 'finishTest'});
+  assert_equals(result, 'ok', 'finishTest');
+}
+
+// Wrapper for 'getResultingClient' command. Tells the worker to return
+// clients.get(event.resultingClientId) for the navigation that occurs
+// during this test.
+//
+// The return value describes how clients.get() settled. It also includes
+// |queriedId| which is the id passed to clients.get() (the resultingClientId
+// in this case).
+//
+// Example value:
+// {
+//   queriedId: 'abc',
+//   promiseState: fulfilled,
+//   promiseValue: client,
+//   client: {
+//     id: 'abc',
+//     url: '//example.com/client'
+//   }
+// }
+async function getResultingClient() {
+  return sendCommand({command: 'getResultingClient'});
+}
+
+// Wrapper for 'getClient' command. Tells the worker to return
+// clients.get(|id|). The return value is as in the getResultingClient()
+// documentation.
+async function getClient(id) {
+  return sendCommand({command: 'getClient', id: id});
+}
+
+// Navigates to |url|. Returns the result of clients.get() on the
+// resultingClientId.
+async function navigateAndGetResultingClient(t, url) {
+  const resultPromise = getResultingClient();
+  const frame = await with_iframe(url);
+  t.add_cleanup(() => {
+    frame.remove();
+  });
+  const result = await resultPromise;
+  const resultingClientId = result.queriedId;
+
+  // First test clients.get(event.resultingClientId) inside the fetch event. The
+  // behavior of this is subtle due to the use of iframes and about:blank
+  // replacement. The spec probably requires that it resolve to the original
+  // about:blank client, and that later that client should be discarded after
+  // load if the load was to another origin. Implementations might differ. For
+  // now, this test just asserts that the promise resolves. See
+  // https://github.com/w3c/ServiceWorker/issues/1385.
+  assert_equals(result.promiseState, 'fulfilled',
+                'get(event.resultingClientId) in the fetch event should fulfill');
+
+  // Test clients.get() on the previous resultingClientId again. By this
+  // time the load finished, so it's more straightforward how this promise
+  // should settle. Return the result of this promise.
+  return await getClient(resultingClientId);
+}
+
+// Test get(resultingClientId) in the basic same-origin case.
+promise_test(async (t) => {
+  await startTest(t);
+
+  const url = new URL('resources/empty.html', window.location);
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'client', 'promiseValue');
+  assert_equals(result.client.url, url.href, 'client.url',);
+  assert_equals(result.client.id, result.queriedId, 'client.id');
+}, 'get(resultingClientId) for same-origin document');
+
+// Test get(resultingClientId) when the response redirects to another origin.
+promise_test(async (t) => {
+  await startTest(t);
+
+  // Navigate to a URL that redirects to another origin.
+  const base_url = new URL('.', window.location);
+  const host_info = get_host_info();
+  const other_origin_url = new URL(base_url.pathname + 'resources/empty.html',
+                                   host_info['HTTPS_REMOTE_ORIGIN']);
+  const url = new URL('resources/empty.html', window.location);
+  const pipe = `status(302)|header(Location, ${other_origin_url})`;
+  url.searchParams.set('pipe', pipe);
+
+  // The original reserved client should have been discarded on cross-origin
+  // redirect.
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'undefinedValue', 'promiseValue');
+}, 'get(resultingClientId) on cross-origin redirect');
+
+// Test get(resultingClientId) when the document is sandboxed to a unique
+// origin using a CSP HTTP response header.
+promise_test(async (t) => {
+  await startTest(t);
+
+  // Navigate to a URL that has CSP sandboxing set in the HTTP response header.
+  const url = new URL('resources/empty.html', window.location);
+  const pipe = 'header(Content-Security-Policy, sandbox)';
+  url.searchParams.set('pipe', pipe);
+
+  // The original reserved client should have been discarded upon loading
+  // the sandboxed document.
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'undefinedValue', 'promiseValue');
+}, 'get(resultingClientId) for document sandboxed by CSP header');
+
+// Test get(resultingClientId) when the document is sandboxed with
+// allow-same-origin.
+promise_test(async (t) => {
+  await startTest(t);
+
+  // Navigate to a URL that has CSP sandboxing set in the HTTP response header.
+  const url = new URL('resources/empty.html', window.location);
+  const pipe = 'header(Content-Security-Policy, sandbox allow-same-origin)';
+  url.searchParams.set('pipe', pipe);
+
+  // The client should be the original reserved client, as it's same-origin.
+  const result = await navigateAndGetResultingClient(t, url);
+  assert_equals(result.promiseState, 'fulfilled', 'promiseState');
+  assert_equals(result.promiseValue, 'client', 'promiseValue');
+  assert_equals(result.client.url, url.href, 'client.url',);
+  assert_equals(result.client.id, result.queriedId, 'client.id');
+}, 'get(resultingClientId) for document sandboxed by CSP header with allow-same-origin');
+
+// Cleanup. Keep this as the last promise_test.
+promise_test(async (t) => {
+  return service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-get.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-get.https.html
new file mode 100644
index 000000000000..4cfbf595cade
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-get.https.html
@@ -0,0 +1,154 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.get</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_clientId() {
+  return new Promise(function(resolve, reject) {
+    window.onmessage = e => {
+      resolve(e.data.clientId);
+    };
+  });
+}
+
+promise_test(async t => {
+  // Register service worker.
+  const scope = 'resources/clients-get-frame.html';
+  const client_ids = [];
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/clients-get-worker.js', scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Prepare for test cases.
+  // Case 1: frame1 which is focused.
+  const frame1 = await with_iframe(scope + '#1');
+  t.add_cleanup(() => frame1.remove());
+  frame1.focus();
+  client_ids.push(await wait_for_clientId());
+  // Case 2: frame2 which is not focused.
+  const frame2 = await with_iframe(scope + '#2');
+  t.add_cleanup(() =>  frame2.remove());
+  client_ids.push(await wait_for_clientId());
+  // Case 3: invalid id.
+  client_ids.push('invalid-id');
+
+  // Call clients.get() for each id on the service worker.
+  const message_event = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = resolve;
+    registration.active.postMessage({clientIds: client_ids});
+  });
+
+  const expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, normalizeURL(scope) + '#1', 'window', 'nested'],
+    ['visible', false, normalizeURL(scope) + '#2', 'window', 'nested'],
+    undefined
+  ];
+  assert_equals(message_event.data.length, 3);
+  assert_array_equals(message_event.data[0], expected[0]);
+  assert_array_equals(message_event.data[1], expected[1]);
+  assert_equals(message_event.data[2], expected[2]);
+}, 'Test Clients.get()');
+
+promise_test(async t => {
+  // Register service worker.
+  const scope = 'resources/simple.html';
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/clients-get-resultingClientId-worker.js', scope)
+  t.add_cleanup(() =>  registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const worker = registration.active;
+
+  // Load frame within the scope.
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+  frame.focus();
+
+  // Get resulting client id.
+  const resultingClientId = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      if (e.data.msg == 'getResultingClientId') {
+        resolve(e.data.resultingClientId);
+      }
+    };
+    worker.postMessage({msg: 'getResultingClientId'});
+  });
+
+  // Query service worker for clients.get(resultingClientId).
+  const isResultingClientUndefined = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      if (e.data.msg == 'getIsResultingClientUndefined') {
+        resolve(e.data.isResultingClientUndefined);
+      }
+    };
+    worker.postMessage({msg: 'getIsResultingClientUndefined',
+                        resultingClientId});
+  });
+
+  assert_false(
+    isResultingClientUndefined,
+    'Clients.get(FetchEvent.resultingClientId) resolved with a Client');
+}, 'Test successful Clients.get(FetchEvent.resultingClientId)');
+
+promise_test(async t => {
+  // Register service worker.
+  const scope = 'resources/simple.html?fail';
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/clients-get-resultingClientId-worker.js', scope);
+  t.add_cleanup(() =>  registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Load frame, and destroy it while loading.
+  const worker = registration.active;
+  let frame = document.createElement('iframe');
+  frame.src = scope;
+  t.add_cleanup(() => {
+    if (frame) {
+      frame.remove();
+    }
+  });
+
+  await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      // The service worker posts a message to remove the iframe during fetch
+      // event.
+      if (e.data.msg == 'destroyResultingClient') {
+        frame.remove();
+        frame = null;
+        worker.postMessage({msg: 'resultingClientDestroyed'});
+        resolve();
+      }
+    };
+    document.body.appendChild(frame);
+  });
+
+  resultingDestroyedClientId = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      // The worker sends a message back when it receives the message
+      // 'resultingClientDestroyed' with the resultingClientId.
+      if (e.data.msg == 'resultingClientDestroyedAck') {
+        assert_equals(frame, null, 'Frame should be destroyed at this point.');
+        resolve(e.data.resultingDestroyedClientId);
+      }
+    };
+  });
+
+  // Query service worker for clients.get(resultingDestroyedClientId).
+  const isResultingClientUndefined = await new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      if (e.data.msg == 'getIsResultingClientUndefined') {
+        resolve(e.data.isResultingClientUndefined);
+      }
+    };
+    worker.postMessage({msg: 'getIsResultingClientUndefined',
+                        resultingClientId: resultingDestroyedClientId });
+  });
+
+  assert_true(
+    isResultingClientUndefined,
+    'Clients.get(FetchEvent.resultingClientId) resolved with `undefined`');
+}, 'Test unsuccessful Clients.get(FetchEvent.resultingClientId)');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-blob-url-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-blob-url-worker.https.html
new file mode 100644
index 000000000000..c29bac8b894a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-blob-url-worker.https.html
@@ -0,0 +1,85 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with a blob URL worker client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const SCRIPT = 'resources/clients-matchall-worker.js';
+
+promise_test(async (t) => {
+  const scope = 'resources/clients-matchall-blob-url-worker.html';
+
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, scope);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const frame = await with_iframe(scope);
+  t.add_cleanup(_ => frame.remove());
+
+  {
+    const message = await frame.contentWindow.waitForWorker();
+    assert_equals(message.data, 'Worker is ready.',
+                  'Worker should reply to the message.');
+  }
+
+  const channel = new MessageChannel();
+  const message = await new Promise(resolve => {
+    channel.port1.onmessage = resolve;
+    frame.contentWindow.navigator.serviceWorker.controller.postMessage(
+      {port: channel.port2, options: {type: 'worker'}}, [channel.port2]);
+  });
+
+  checkMessageEvent(message);
+
+}, 'Test Clients.matchAll() with a blob URL worker client.');
+
+promise_test(async (t) => {
+  const scope = 'resources/blank.html';
+
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, scope);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const workerScript = `
+    self.onmessage = (e) => {
+      self.postMessage("Worker is ready.");
+    };
+  `;
+  const blob = new Blob([workerScript], { type: 'text/javascript' });
+  const blobUrl = URL.createObjectURL(blob);
+  const worker = new Worker(blobUrl);
+
+  {
+    const message = await new Promise(resolve => {
+      worker.onmessage = resolve;
+      worker.postMessage("Ping to worker.");
+    });
+    assert_equals(message.data, 'Worker is ready.',
+                  'Worker should reply to the message.');
+  }
+
+  const channel = new MessageChannel();
+  const message = await new Promise(resolve => {
+    channel.port1.onmessage = resolve;
+    reg.active.postMessage(
+      {port: channel.port2,
+       options: {includeUncontrolled: true, type: 'worker'}},
+      [channel.port2]
+    );
+  });
+
+  checkMessageEvent(message);
+
+}, 'Test Clients.matchAll() with an uncontrolled blob URL worker client.');
+
+function checkMessageEvent(e) {
+  assert_equals(e.data.length, 1);
+
+  const workerClient = e.data[0];
+  assert_equals(workerClient[0], undefined); // visibilityState
+  assert_equals(workerClient[1], undefined); // focused
+  assert_true(workerClient[2].includes('blob:')); // url
+  assert_equals(workerClient[3], 'worker'); // type
+  assert_equals(workerClient[4], 'none'); // frameType
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-client-types.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-client-types.https.html
new file mode 100644
index 000000000000..54f182b6202c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-client-types.https.html
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with various clientTypes</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/clients-matchall-client-types';
+const iframe_url = scope + '-iframe.html';
+const shared_worker_url = scope + '-shared-worker.js';
+const dedicated_worker_url = scope + '-dedicated-worker.js';
+
+/* visibilityState, focused, url, type, frameType */
+const expected_only_window = [
+    ['visible', true, new URL(iframe_url, location).href, 'window', 'nested']
+];
+const expected_only_shared_worker = [
+    [undefined, undefined, new URL(shared_worker_url, location).href, 'sharedworker', 'none']
+];
+const expected_only_dedicated_worker = [
+    [undefined, undefined, new URL(dedicated_worker_url, location).href, 'worker', 'none']
+];
+
+// These are explicitly sorted by URL in the service worker script.
+const expected_all_clients = [
+    expected_only_dedicated_worker[0],
+    expected_only_window[0],
+    expected_only_shared_worker[0],
+];
+
+async function test_matchall(frame, expected, query_options) {
+  // Make sure the frame gets focus.
+  frame.focus();
+  const data = await new Promise(resolve => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => resolve(e.data);
+    frame.contentWindow.navigator.serviceWorker.controller.postMessage(
+        {port:channel.port2, options:query_options},
+        [channel.port2]);
+  });
+
+  if (typeof data === 'string') {
+    throw new Error(data);
+  }
+
+  assert_equals(data.length, expected.length, 'result count');
+
+  for (let i = 0; i < data.length; ++i) {
+    assert_array_equals(data[i], expected[i]);
+  }
+}
+
+promise_test(async t => {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/clients-matchall-worker.js', scope);
+  t.add_cleanup(_ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+  await test_matchall(frame, expected_only_window, {});
+  await test_matchall(frame, expected_only_window, {type:'window'});
+}, 'Verify matchAll() with window client type');
+
+promise_test(async t => {
+  const registration = await service_worker_unregister_and_register(
+      t, 'resources/clients-matchall-worker.js', scope);
+  t.add_cleanup(_ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+
+  // Set up worker clients.
+  const shared_worker = await new Promise((resolve, reject) => {
+    const w = new SharedWorker(shared_worker_url);
+    w.onerror = e => reject(e.message);
+    w.port.onmessage = _ => resolve(w);
+  });
+  const dedicated_worker = await new Promise((resolve, reject) => {
+    const w = new Worker(dedicated_worker_url);
+    w.onerror = e => reject(e.message);
+    w.onmessage = _ => resolve(w);
+    w.postMessage('Start');
+  });
+
+  await test_matchall(frame, expected_only_window, {});
+  await test_matchall(frame, expected_only_window, {type:'window'});
+  await test_matchall(frame, expected_only_shared_worker,
+                      {type:'sharedworker'});
+  await test_matchall(frame, expected_only_dedicated_worker, {type:'worker'});
+  await test_matchall(frame, expected_all_clients, {type:'all'});
+}, 'Verify matchAll() with {window, sharedworker, worker} client types');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html
new file mode 100644
index 000000000000..a61c8af70196
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with exact controller</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/blank.html?clients-matchAll';
+let frames = [];
+
+function checkWorkerClients(worker, expected) {
+  return new Promise((resolve, reject) => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = evt => {
+      try {
+        assert_equals(evt.data.length, expected.length);
+        for (let i = 0; i < expected.length; ++i) {
+          assert_array_equals(evt.data[i], expected[i]);
+        }
+        resolve();
+      } catch (e) {
+        reject(e);
+      }
+    };
+
+    worker.postMessage({port:channel.port2}, [channel.port2]);
+  });
+}
+
+let expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', false, new URL(scope + '#2', location).toString(), 'window', 'nested']
+];
+
+promise_test(t => {
+    let script = 'resources/clients-matchall-worker.js';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          t.add_cleanup(() => service_worker_unregister(t, scope));
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => with_iframe(scope + '#1') )
+      .then(frame1 => {
+          frames.push(frame1);
+          frame1.focus();
+          return with_iframe(scope + '#2');
+        })
+      .then(frame2 => {
+          frames.push(frame2);
+          return navigator.serviceWorker.register(script + '?updated', { scope: scope });
+        })
+      .then(registration => {
+          return wait_for_state(t, registration.installing, 'installed')
+            .then(_ => registration);
+        })
+      .then(registration => {
+          return Promise.all([
+            checkWorkerClients(registration.waiting, []),
+            checkWorkerClients(registration.active, expected),
+          ]);
+        })
+      .then(_ => {
+          frames.forEach(f => f.remove() );
+        });
+}, 'Test Clients.matchAll() with exact controller');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-frozen.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-frozen.https.html
new file mode 100644
index 000000000000..479c28a60f2e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-frozen.https.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/clients-frame-freeze.html';
+var windows = [];
+var expected_window_1 =
+    {visibilityState: 'visible', focused: false, lifecycleState: "frozen", url: new URL(scope + '#1', location).toString(), type: 'window', frameType: 'top-level'};
+var expected_window_2 =
+    {visibilityState: 'visible', focused: false, lifecycleState: "active", url: new URL(scope + '#2', location).toString(), type: 'window', frameType: 'top-level'};
+function with_window(url, name) {
+  return new Promise(function(resolve) {
+    var child = window.open(url, name);
+    window.onmessage = () => {resolve(child)};
+  });
+}
+
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-matchall-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_window(scope + '#1', 'Child 1'); })
+      .then(function(window1) {
+          windows.push(window1);
+          return with_window(scope + '#2', 'Child 2');
+        })
+      .then(function(window2) {
+          windows.push(window2);
+          return new Promise(function(resolve) {
+              window.onmessage = resolve;
+              windows[0].postMessage('freeze');
+            });
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+              windows[1].navigator.serviceWorker.controller.postMessage(
+                  {port:channel.port2, includeLifecycleState: true}, [channel.port2]);
+            });
+        })
+      .then(function(e) {
+          assert_equals(e.data.length, 2);
+          // No specific order is required, so support inversion.
+          if (e.data[0][3] == new URL(scope + '#2', location)) {
+            assert_object_equals(e.data[0], expected_window_2);
+            assert_object_equals(e.data[1], expected_window_1);
+          } else {
+            assert_object_equals(e.data[0], expected_window_1);
+            assert_object_equals(e.data[1], expected_window_2);
+          }
+      });
+}, 'Test Clients.matchAll()');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html
new file mode 100644
index 000000000000..9f34e5709eb3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll with includeUncontrolled</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function test_matchall(service_worker, expected, query_options) {
+  expected.sort((a, b) => a[2] > b[2] ? 1 : -1);
+  return new Promise((resolve, reject) => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => {
+      const data = e.data.filter(info => {
+        return info[2].indexOf('clients-matchall') > -1;
+      });
+      data.sort((a, b) => a[2] > b[2] ? 1 : -1);
+      assert_equals(data.length, expected.length);
+      for (let i = 0; i < data.length; i++)
+        assert_array_equals(data[i], expected[i]);
+      resolve();
+    };
+    service_worker.postMessage({port:channel.port2, options:query_options},
+                               [channel.port2]);
+  });
+}
+
+// Run clients.matchAll without and with includeUncontrolled=true.
+// (We want to run the two tests sequentially in the same promise_test
+// so that we can use the same set of iframes without intefering each other.
+promise_test(async t => {
+  // |base_url| is out-of-scope.
+  const base_url = 'resources/blank.html?clients-matchall';
+  const scope = base_url + '-includeUncontrolled';
+
+  const registration =
+      await service_worker_unregister_and_register(
+          t, 'resources/clients-matchall-worker.js', scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  const service_worker = registration.installing;
+  await wait_for_state(t, service_worker, 'activated');
+
+  // Creates 3 iframes, 2 for in-scope and 1 for out-of-scope.
+  let frames = [];
+  frames.push(await with_iframe(base_url));
+  frames.push(await with_iframe(scope + '#1'));
+  frames.push(await with_iframe(scope + '#2'));
+
+  // Make sure we have focus for '#2' frame and its parent window.
+  frames[2].focus();
+  frames[2].contentWindow.focus();
+
+  const expected_without_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', false, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', true, new URL(scope + '#2', location).toString(), 'window', 'nested']
+  ];
+  const expected_with_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, location.href, 'window', 'top-level'],
+    ['visible', false, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', true, new URL(scope + '#2', location).toString(), 'window', 'nested'],
+    ['visible', false, new URL(base_url, location).toString(), 'window', 'nested']
+  ];
+
+  await test_matchall(service_worker, expected_without_include_uncontrolled);
+  await test_matchall(service_worker, expected_with_include_uncontrolled,
+                      { includeUncontrolled: true });
+}, 'Verify matchAll() with windows respect includeUncontrolled');
+
+// TODO: Add tests for clients.matchAll for dedicated workers.
+
+async function create_shared_worker(script_url) {
+  const shared_worker = new SharedWorker(script_url);
+  const msgEvent = await new Promise(r => shared_worker.port.onmessage = r);
+  assert_equals(msgEvent.data, 'started');
+  return shared_worker;
+}
+
+// Run clients.matchAll for shared workers without and with
+// includeUncontrolled=true.
+promise_test(async t => {
+  const script_url = 'resources/clients-matchall-client-types-shared-worker.js';
+  const uncontrolled_script_url =
+      new URL(script_url + '?uncontrolled', location).toString();
+  const controlled_script_url =
+      new URL(script_url + '?controlled', location).toString();
+
+  // Start a shared worker that is not controlled by a service worker.
+  const uncontrolled_shared_worker =
+      await create_shared_worker(uncontrolled_script_url);
+
+  // Register a service worker.
+  const registration =
+      await service_worker_unregister_and_register(
+          t, 'resources/clients-matchall-worker.js', script_url);
+  t.add_cleanup(() => service_worker_unregister(t, script_url));
+  const service_worker = registration.installing;
+  await wait_for_state(t, service_worker, 'activated');
+
+  // Start another shared worker controlled by the service worker.
+  await create_shared_worker(controlled_script_url);
+
+  const expected_without_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    [undefined, undefined, controlled_script_url, 'sharedworker', 'none'],
+  ];
+  const expected_with_include_uncontrolled = [
+    // visibilityState, focused, url, type, frameType
+    [undefined, undefined, controlled_script_url, 'sharedworker', 'none'],
+    [undefined, undefined, uncontrolled_script_url, 'sharedworker', 'none'],
+  ];
+
+  await test_matchall(service_worker, expected_without_include_uncontrolled,
+                      { type: 'sharedworker' });
+  await test_matchall(service_worker, expected_with_include_uncontrolled,
+                      { includeUncontrolled: true, type: 'sharedworker' });
+}, 'Verify matchAll() with shared workers respect includeUncontrolled');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-on-evaluation.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-on-evaluation.https.html
new file mode 100644
index 000000000000..8705f85b5684
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-on-evaluation.https.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll on script evaluation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var script = 'resources/clients-matchall-on-evaluation-worker.js';
+    var scope = 'resources/blank.html?clients-matchAll-on-evaluation';
+
+    var saw_message = new Promise(function(resolve) {
+        navigator.serviceWorker.onmessage = function(e) {
+            assert_equals(e.data, 'matched');
+            resolve();
+          };
+      });
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          add_completion_callback(function() { registration.unregister(); });
+          return saw_message;
+        });
+  }, 'Test Clients.matchAll() on script evaluation');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall-order.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-order.https.html
new file mode 100644
index 000000000000..ec650f2264df
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall-order.https.html
@@ -0,0 +1,427 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll ordering</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+// Utility function for URLs this test will open.
+function makeURL(name, num, type) {
+  let u = new URL('resources/empty.html', location);
+  u.searchParams.set('name', name);
+  if (num !== undefined) {
+    u.searchParams.set('q', num);
+  }
+  if (type === 'nested') {
+    u.searchParams.set('nested', true);
+  }
+  return u.href;
+}
+
+// Non-test URLs that will be open during each test.  The harness URLs
+// are from the WPT harness.  The "extra" URL is a final window opened
+// by the test.
+const EXTRA_URL = makeURL('extra');
+const TEST_HARNESS_URL = location.href;
+const TOP_HARNESS_URL = new URL('/testharness_runner.html', location).href;
+
+// Utility function to open an iframe in the target parent window.  We
+// can't just use with_iframe() because it does not support a configurable
+// parent window.
+function openFrame(parentWindow, url) {
+  return new Promise(resolve => {
+    let frame = parentWindow.document.createElement('iframe');
+    frame.src = url;
+    parentWindow.document.body.appendChild(frame);
+
+    frame.contentWindow.addEventListener('load', evt => {
+      resolve(frame);
+    }, { once: true });
+  });
+}
+
+// Utility function to open a window and wait for it to load.  The
+// window may optionally have a nested iframe as well.  Returns
+// a result like `{ top: <frame ref> nested: <nested frame ref if present> }`.
+function openFrameConfig(opts) {
+  let url = new URL(opts.url, location.href);
+  return openFrame(window, url.href).then(top => {
+    if (!opts.withNested) {
+      return { top: top };
+    }
+
+    url.searchParams.set('nested', true);
+    return openFrame(top.contentWindow, url.href).then(nested => {
+      return { top: top, nested: nested };
+    });
+  });
+}
+
+// Utility function that takes a list of configurations and opens the
+// corresponding windows in sequence.  An array of results is returned.
+function openFrameConfigList(optList) {
+  let resultList = [];
+  function openNextWindow(optList, nextWindow) {
+    if (nextWindow >= optList.length) {
+      return resultList;
+    }
+    return openFrameConfig(optList[nextWindow]).then(result => {
+      resultList.push(result);
+      return openNextWindow(optList, nextWindow + 1);
+    });
+  }
+  return openNextWindow(optList, 0);
+}
+
+// Utility function that focuses the given entry in window result list.
+function executeFocus(frameResultList, opts) {
+  return new Promise(resolve => {
+    let w = frameResultList[opts.index][opts.type];
+    let target = w.contentWindow ? w.contentWindow : w;
+    target.addEventListener('focus', evt => {
+      resolve();
+    }, { once: true });
+    target.focus();
+  });
+}
+
+// Utility function that performs a list of focus commands in sequence
+// based on the window result list.
+function executeFocusList(frameResultList, optList) {
+  function executeNextCommand(frameResultList, optList, nextCommand) {
+    if (nextCommand >= optList.length) {
+      return;
+    }
+    return executeFocus(frameResultList, optList[nextCommand]).then(_ => {
+      return executeNextCommand(frameResultList, optList, nextCommand + 1);
+    });
+  }
+  return executeNextCommand(frameResultList, optList, 0);
+}
+
+// Perform a `clients.matchAll()` in the service worker with the given
+// options dictionary.
+function doMatchAll(worker, options) {
+  return new Promise(resolve => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = evt => {
+      resolve(evt.data);
+    };
+    worker.postMessage({ port: channel.port2, options: options, disableSort: true },
+                       [channel.port2]);
+  });
+}
+
+// Function that performs a single test case.  It takes a configuration object
+// describing the windows to open, how to focus them, the matchAll options,
+// and the resulting expectations.  See the test cases for examples of how to
+// use this.
+function matchAllOrderTest(t, opts) {
+  let script = 'resources/clients-matchall-worker.js';
+  let worker;
+  let frameResultList;
+  let extraWindowResult;
+  return service_worker_unregister_and_register(t, script, opts.scope).then(swr => {
+    t.add_cleanup(() => service_worker_unregister(t, opts.scope));
+
+    worker = swr.installing;
+    return wait_for_state(t, worker, 'activated');
+  }).then(_ => {
+    return openFrameConfigList(opts.frameConfigList);
+  }).then(results => {
+    frameResultList = results;
+    return openFrameConfig({ url: EXTRA_URL });
+  }).then(result => {
+    extraWindowResult = result;
+    return executeFocusList(frameResultList, opts.focusConfigList);
+  }).then(_ => {
+    return doMatchAll(worker, opts.matchAllOptions);
+  }).then(data => {
+    assert_equals(data.length, opts.expected.length);
+    for (let i = 0; i < data.length; ++i) {
+      assert_equals(data[i][2], opts.expected[i], 'expected URL index ' + i);
+    }
+  }).then(_ => {
+    frameResultList.forEach(result => result.top.remove());
+    extraWindowResult.top.remove();
+  }).catch(e => {
+    if (frameResultList) {
+      frameResultList.forEach(result => result.top.remove());
+    }
+    if (extraWindowResult) {
+      extraWindowResult.top.remove();
+    }
+    throw(e);
+  });
+}
+
+// ----------
+// Test cases
+// ----------
+
+promise_test(t => {
+  let name = 'no-focus-controlled-windows';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      // no focus commands
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns non-focused controlled windows in creation order.');
+
+promise_test(t => {
+  let name = 'focus-controlled-windows-1';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 0, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 2, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      makeURL(name, 2),
+      makeURL(name, 1),
+      makeURL(name, 0),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns controlled windows in focus order.  Case 1.');
+
+promise_test(t => {
+  let name = 'focus-controlled-windows-2';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 2, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 0, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns controlled windows in focus order.  Case 2.');
+
+promise_test(t => {
+  let name = 'no-focus-uncontrolled-windows';
+  let opts = {
+    scope: makeURL(name + '-outofscope'),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      // no focus commands
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: true
+    },
+
+    expected: [
+      // The harness windows have been focused, so appear first
+      TEST_HARNESS_URL,
+      TOP_HARNESS_URL,
+
+      // Test frames have not been focused, so appear in creation order
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+      EXTRA_URL,
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns non-focused uncontrolled windows in creation order.');
+
+promise_test(t => {
+  let name = 'focus-uncontrolled-windows-1';
+  let opts = {
+    scope: makeURL(name + '-outofscope'),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 0, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 2, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: true
+    },
+
+    expected: [
+      // The test harness window is a parent of all test frames.  It will
+      // always have the same focus time or later as its frames.  So it
+      // appears first.
+      TEST_HARNESS_URL,
+
+      makeURL(name, 2),
+      makeURL(name, 1),
+      makeURL(name, 0),
+
+      // The overall harness has been focused
+      TOP_HARNESS_URL,
+
+      // The extra frame was never focused
+      EXTRA_URL,
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns uncontrolled windows in focus order.  Case 1.');
+
+promise_test(t => {
+  let name = 'focus-uncontrolled-windows-2';
+  let opts = {
+    scope: makeURL(name + '-outofscope'),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: false },
+      { url: makeURL(name, 1), withNested: false },
+      { url: makeURL(name, 2), withNested: false },
+    ],
+
+    focusConfigList: [
+      { index: 2, type: 'top' },
+      { index: 1, type: 'top' },
+      { index: 0, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: true
+    },
+
+    expected: [
+      // The test harness window is a parent of all test frames.  It will
+      // always have the same focus time or later as its frames.  So it
+      // appears first.
+      TEST_HARNESS_URL,
+
+      makeURL(name, 0),
+      makeURL(name, 1),
+      makeURL(name, 2),
+
+      // The overall harness has been focused
+      TOP_HARNESS_URL,
+
+      // The extra frame was never focused
+      EXTRA_URL,
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns uncontrolled windows in focus order.  Case 2.');
+
+promise_test(t => {
+  let name = 'focus-controlled-nested-windows';
+  let opts = {
+    scope: makeURL(name),
+
+    frameConfigList: [
+      { url: makeURL(name, 0), withNested: true },
+      { url: makeURL(name, 1), withNested: true },
+      { url: makeURL(name, 2), withNested: true },
+    ],
+
+    focusConfigList: [
+      { index: 0, type: 'top' },
+
+      // Note, some browsers don't let programmatic focus of a frame unless
+      // an ancestor window is already focused.  So focus the window and
+      // then the frame.
+      { index: 1, type: 'top' },
+      { index: 1, type: 'nested' },
+
+      { index: 2, type: 'top' },
+    ],
+
+    matchAllOptions: {
+      includeUncontrolled: false
+    },
+
+    expected: [
+      // Focus order for window 2, but not its frame.  We only focused
+      // the window.
+      makeURL(name, 2),
+
+      // Window 1 is next via focus order, but the window is always
+      // shown first here.  The window gets its last focus time updated
+      // when the frame is focused.  Since the times match between the
+      // two it falls back to creation order.  The window was created
+      // before the frame.  This behavior is being discussed in:
+      // https://github.com/w3c/ServiceWorker/issues/1080
+      makeURL(name, 1),
+      makeURL(name, 1, 'nested'),
+
+      // Focus order for window 0, but not its frame.  We only focused
+      // the window.
+      makeURL(name, 0),
+
+      // Creation order of the frames since they are not focused by
+      // default when they are created.
+      makeURL(name, 0, 'nested'),
+      makeURL(name, 2, 'nested'),
+    ],
+  };
+
+  return matchAllOrderTest(t, opts);
+}, 'Clients.matchAll() returns controlled windows and frames in focus order.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/clients-matchall.https.html b/test/fixtures/wpt/service-workers/service-worker/clients-matchall.https.html
new file mode 100644
index 000000000000..ce44f1924d54
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/clients-matchall.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>Service Worker: Clients.matchAll</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var scope = 'resources/blank.html?clients-matchAll';
+var frames = [];
+promise_test(function(t) {
+    return service_worker_unregister_and_register(
+        t, 'resources/clients-matchall-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope + '#1'); })
+      .then(function(frame1) {
+          frames.push(frame1);
+          frame1.focus();
+          return with_iframe(scope + '#2');
+        })
+      .then(function(frame2) {
+          frames.push(frame2);
+          var channel = new MessageChannel();
+
+          return new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+              frame2.contentWindow.navigator.serviceWorker.controller.postMessage(
+                  {port:channel.port2}, [channel.port2]);
+            });
+        })
+      .then(onMessage);
+}, 'Test Clients.matchAll()');
+
+var expected = [
+    // visibilityState, focused, url, type, frameType
+    ['visible', true, new URL(scope + '#1', location).toString(), 'window', 'nested'],
+    ['visible', false, new URL(scope + '#2', location).toString(), 'window', 'nested']
+];
+
+function onMessage(e) {
+  assert_equals(e.data.length, 2);
+  assert_array_equals(e.data[0], expected[0]);
+  assert_array_equals(e.data[1], expected[1]);
+  frames.forEach(function(f) { f.remove(); });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controlled-dedicatedworker-postMessage.https.html b/test/fixtures/wpt/service-workers/service-worker/controlled-dedicatedworker-postMessage.https.html
new file mode 100644
index 000000000000..5ef91dd1b11c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controlled-dedicatedworker-postMessage.https.html
@@ -0,0 +1,45 @@
+<html>
+<head>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+promise_test(async (test) => {
+    const registration = await navigator.serviceWorker.register("postMessage-client-worker.js", { scope : 'resources' });
+    activeWorker = registration.active;
+    if (activeWorker)
+        return;
+
+    activeWorker = registration.installing;
+    await new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve();
+        });
+    });
+}, "Register service worker");
+
+promise_test(async (test) => {
+    const worker = new Worker('resources/controlled-worker-postMessage.js');
+    const event = await new Promise((resolve, reject) => {
+       test.step_timeout(() => reject("test timed out"), 3000);
+       worker.onmessage = resolve;
+    });
+    assert_equals(event.data, 0);
+}, "Verify dedicated worker gets messages if setting event listener early");
+
+promise_test(async (test) => {
+    const worker = new Worker('resources/controlled-worker-late-postMessage.js?repeatMessages');
+    const event = await new Promise((resolve, reject) => {
+       test.step_timeout(() => reject("test timed out"), 3000);
+       worker.onmessage = resolve;
+    });
+    assert_not_equals(event.data, "No message received");
+    assert_true(event.data > 0);
+}, "Verify dedicated worker does not get all messages if not setting event listener early");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controlled-iframe-postMessage.https.html b/test/fixtures/wpt/service-workers/service-worker/controlled-iframe-postMessage.https.html
new file mode 100644
index 000000000000..c3f390a5a455
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controlled-iframe-postMessage.https.html
@@ -0,0 +1,68 @@
+<html>
+<head>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+promise_test(async (test) => {
+    const registration = await navigator.serviceWorker.register("postMessage-client-worker.js", { scope : 'resources' });
+    activeWorker = registration.active;
+    if (activeWorker)
+        return;
+
+    activeWorker = registration.installing;
+    await new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve();
+        });
+    });
+}, "Register service worker");
+
+function with_iframe(test, url) {
+    return new Promise(function(resolve, reject) {
+        test.step_timeout(() => reject("with_iframe timed out"), 2000);
+        var frame = document.createElement('iframe');
+        frame.className = 'test-iframe';
+        frame.src = url;
+        frame.onload = function() { resolve(frame); };
+        document.body.appendChild(frame);
+    });
+}
+
+promise_test(async (test) => {
+    const frame = await with_iframe(test, 'resources/controlled-frame-postMessage.html');
+    let counter = 0;
+    while (counter++ < 100 && frame.contentWindow.messageData == undefined)
+       await new Promise(resolve => test.step_timeout(resolve, 50));
+    assert_equals(frame.contentWindow.messageData, 0);
+    frame.remove();
+}, "Verify frame gets early messages if setting synchronously message event listener");
+
+promise_test(async (test) => {
+    const frame = await with_iframe(test, 'resources/controlled-frame-postMessage.html?repeatMessages');
+    let counter = 0;
+    while (counter++ < 100 && frame.contentWindow.messageData == undefined)
+       await new Promise(resolve => test.step_timeout(resolve, 50));
+    assert_not_equals(frame.contentWindow.messageData, 0);
+    frame.remove();
+}, "Verify frame does not get all messages if not setting event listener early");
+
+promise_test(async (test) => {
+    const frame = await with_iframe(test, 'resources/controlled-frame-postMessage.html?repeatMessages&listener');
+    let counter = 0;
+    while (counter++ < 100 && frame.contentWindow.messageData.length < 5)
+       await new Promise(resolve => test.step_timeout(resolve, 50));
+
+    assert_less_than(counter, 100);
+    data = frame.contentWindow.messageData;
+    for (let cptr = 1; cptr < data.length; cptr++)
+        assert_true(data[cptr - 1] < data[cptr]);
+    frame.remove();
+}, "Verify frame does get messages in order");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-on-disconnect.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-on-disconnect.https.html
new file mode 100644
index 000000000000..f23dfe71bac5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-on-disconnect.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: Controller on load</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var url = 'resources/empty-worker.js';
+    var scope = 'resources/blank.html';
+    var registration;
+    var controller;
+    var frame;
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(swr) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = swr;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope)
+        })
+      .then(function(f) {
+          frame = f;
+          var w = frame.contentWindow;
+          var swc = w.navigator.serviceWorker;
+          assert_true(swc.controller instanceof w.ServiceWorker,
+                      'controller should be a ServiceWorker object');
+
+          frame.remove();
+
+          assert_equals(swc.controller, null,
+                        'disconnected frame should not be controlled');
+        });
+}, 'controller is cleared on disconnected window');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-on-load.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-on-load.https.html
new file mode 100644
index 000000000000..e4c5e5f81f81
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-on-load.https.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<title>Service Worker: Controller on load</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var url = 'resources/empty-worker.js';
+    var scope = 'resources/blank.html';
+    var registration;
+    var controller;
+    var frame;
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(swr) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = swr;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          var w = frame.contentWindow;
+          controller = w.navigator.serviceWorker.controller;
+          assert_true(controller instanceof w.ServiceWorker,
+                      'controller should be a ServiceWorker object');
+          assert_equals(controller.scriptURL, normalizeURL(url));
+
+          // objects from different windows should not be equal
+          assert_not_equals(controller, registration.active);
+
+          return w.navigator.serviceWorker.getRegistration();
+        })
+      .then(function(frameRegistration) {
+          // SW objects from same window should be equal
+          assert_equals(frameRegistration.active, controller);
+          frame.remove();
+        });
+}, 'controller is set for a controlled document');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-on-reload.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-on-reload.https.html
new file mode 100644
index 000000000000..2e966d425788
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-on-reload.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Controller on reload</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function(t) {
+    const iframe_scope = 'blank.html';
+    const scope = 'resources/' + iframe_scope;
+    var frame;
+    var registration;
+    var controller;
+    return service_worker_unregister(t, scope)
+      .then(function() {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return frame.contentWindow.navigator.serviceWorker.register(
+              'empty-worker.js', {scope: iframe_scope});
+        })
+      .then(function(swr) {
+          registration = swr;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var w = frame.contentWindow;
+          assert_equals(w.navigator.serviceWorker.controller, null,
+                        'controller should be null until the document is ' +
+                        'reloaded');
+          return new Promise(function(resolve) {
+              frame.onload = function() { resolve(); }
+              w.location.reload();
+            });
+        })
+      .then(function() {
+          var w = frame.contentWindow;
+          controller = w.navigator.serviceWorker.controller;
+          assert_true(controller instanceof w.ServiceWorker,
+                      'controller should be a ServiceWorker object upon reload');
+
+          // objects from separate windows should not be equal
+          assert_not_equals(controller, registration.active);
+
+          return w.navigator.serviceWorker.getRegistration(iframe_scope);
+        })
+      .then(function(frameRegistration) {
+          assert_equals(frameRegistration.active, controller);
+          frame.remove();
+        });
+  }, 'controller is set upon reload after registration');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/controller-with-no-fetch-event-handler.https.html b/test/fixtures/wpt/service-workers/service-worker/controller-with-no-fetch-event-handler.https.html
new file mode 100644
index 000000000000..d947139c9e21
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/controller-with-no-fetch-event-handler.https.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: controller without a fetch event handler</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+let registration;
+let frame;
+const host_info = get_host_info();
+const remote_base_url =
+    new URL(`${host_info.HTTPS_REMOTE_ORIGIN}${base_path()}resources/`);
+
+promise_test(async t => {
+  const script = 'resources/empty.js'
+  const scope = 'resources/';
+
+  promise_test(async t => {
+    if (frame)
+      frame.remove();
+
+    if (registration)
+      await registration.unregister();
+  }, 'cleanup global state');
+
+  registration = await
+      service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+  frame = await with_iframe(scope + 'blank.html');
+}, 'global setup');
+
+promise_test(async t => {
+    const url = new URL('cors-approved.txt', remote_base_url);
+    const response = await frame.contentWindow.fetch(url, {mode:'no-cors'});
+    const text = await response.text();
+    assert_equals(text, '');
+}, 'cross-origin request, no-cors mode');
+
+
+promise_test(async t => {
+    const url = new URL('cors-denied.txt', remote_base_url);
+    const response = frame.contentWindow.fetch(url);
+    await promise_rejects_js(t, frame.contentWindow.TypeError, response);
+}, 'cross-origin request, cors denied');
+
+promise_test(async t => {
+    const url = new URL('cors-approved.txt', remote_base_url);
+    response = await frame.contentWindow.fetch(url);
+    let text = await response.text();
+    text = text.trim();
+    assert_equals(text, 'plaintext');
+}, 'cross-origin request, cors approved');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/credentials.https.html b/test/fixtures/wpt/service-workers/service-worker/credentials.https.html
new file mode 100644
index 000000000000..0a90dc2897c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/credentials.https.html
@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Credentials for service worker scripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// Check if the service worker's script has appropriate credentials for a new
+// worker and byte-for-byte checking.
+
+const SCOPE = 'resources/in-scope';
+const COOKIE_NAME = `service-worker-credentials-${Math.random()}`;
+
+promise_test(async t => {
+  // Set-Cookies for path=/.
+  await fetch(
+      `/cookies/resources/set-cookie.py?name=${COOKIE_NAME}&path=%2F`);
+}, 'Set cookies as initialization');
+
+async function get_cookies(worker) {
+  worker.postMessage('get cookie');
+  const message = await new Promise(resolve =>
+      navigator.serviceWorker.addEventListener('message', resolve));
+  return message.data;
+}
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+      t, `resources/echo-cookie-worker.py?key=${key}`, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], '1', 'new worker has credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], '1',
+                'updated worker has credentials');
+}, 'Main script should have credentials');
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+      t, `resources/import-echo-cookie-worker.js?key=${key}`, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], '1', 'new worker has credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], '1',
+                'updated worker has credentials');
+}, 'Imported script should have credentials');
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+      t, `resources/import-echo-cookie-worker-module.py?key=${key}`, SCOPE, {type: 'module'});
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], undefined, 'new module worker should not have credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], undefined,
+                'updated worker should not have credentials');
+}, 'Module with an imported statement should not have credentials');
+
+promise_test(async t => {
+  const key = token();
+  const registration = await service_worker_unregister_and_register(
+t, `resources/echo-cookie-worker.py?key=${key}`, SCOPE, {type: 'module'});
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+
+  const cookies = await get_cookies(worker);
+  assert_equals(cookies[COOKIE_NAME], undefined, 'new module worker should not have credentials');
+
+  await registration.update();
+  const updated_worker = registration.installing;
+  const updated_cookies = await get_cookies(updated_worker);
+  assert_equals(updated_cookies[COOKIE_NAME], undefined,
+                'updated worker should not have credentials');
+}, 'Script with service worker served as modules should not have credentials');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/css-sw-same-origin-substitution.https.html b/test/fixtures/wpt/service-workers/service-worker/css-sw-same-origin-substitution.https.html
new file mode 100644
index 000000000000..3a79c07f95c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/css-sw-same-origin-substitution.https.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>Service Worker: a same-origin response substituted for a cross-origin CSS request must not taint the stylesheet</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Regression test for the canvas/CSS over-taint: when a service worker serves a
+// SAME-ORIGIN response to a CROSS-ORIGIN request, the resulting stylesheet is
+// same-origin and its rules must be readable.
+promise_test(async t => {
+  const SCOPE = 'resources/css-sw-same-origin-substitution-iframe.sub.html';
+  const SCRIPT = 'resources/css-sw-same-origin-substitution-worker.js';
+  const registration =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(SCOPE);
+  t.add_cleanup(() => frame.remove());
+
+  assert_equals(frame.contentDocument.styleSheets.length, 1,
+                'the substituted stylesheet should have loaded');
+  const sheet = frame.contentDocument.styleSheets[0];
+  // Accessing cssRules throws SecurityError if the sheet is (over-)tainted.
+  assert_greater_than(
+      sheet.cssRules.length, 0,
+      'a same-origin response substituted by the service worker for a ' +
+      'cross-origin request must be readable (not over-tainted)');
+}, 'SW same-origin substitution for a cross-origin CSS request must not taint ' +
+   'the stylesheet');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/data-iframe.html b/test/fixtures/wpt/service-workers/service-worker/data-iframe.html
new file mode 100644
index 000000000000..d767d574345b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/data-iframe.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>Service Workers in data iframes</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body></body>
+<script>
+'use strict';
+
+promise_test(t => {
+  const url = encodeURI(`data:text/html,<!DOCTYPE html>
+  <script>
+    parent.postMessage({ isDefined: 'serviceWorker' in navigator }, '*');
+  </` + `script>`);
+  var p = new Promise((resolve, reject) => {
+    window.addEventListener('message', event => {
+      resolve(event.data.isDefined);
+    });
+  });
+  with_iframe(url);
+  return p.then(isDefined => {
+    assert_false(isDefined, 'navigator.serviceWorker should not be defined in iframe');
+  });
+}, 'navigator.serviceWorker is not available in a data: iframe');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/data-transfer-files.https.html b/test/fixtures/wpt/service-workers/service-worker/data-transfer-files.https.html
new file mode 100644
index 000000000000..c503a28f965b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/data-transfer-files.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Post a file in a navigation controlled by a service worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<iframe id=testframe name=testframe></iframe>
+<form id=testform method=post action="/html/semantics/forms/form-submission-0/resources/file-submission.py" target=testframe enctype="multipart/form-data">
+<input name=testinput id=testinput type=file>
+</form>
+<script>
+// Test that DataTransfer with a File entry works when posted to a
+// service worker that falls back to network. Regression test for
+// https://crbug.com/944145.
+promise_test(async (t) => {
+  const scope = '/html/semantics/forms/form-submission-0/resources/';
+  const header = `pipe=header(Service-Worker-Allowed,${scope})`;
+  const script = `resources/fetch-event-network-fallback-worker.js?${header}`;
+
+  const registration = await service_worker_unregister_and_register(
+      t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const dataTransfer = new DataTransfer();
+  dataTransfer.items.add(new File(['foobar'], 'name'));
+  assert_equals(1, dataTransfer.files.length);
+
+  testinput.files = dataTransfer.files;
+  testform.submit();
+
+  const data = await new Promise(resolve => {
+    onmessage = e => {
+      if (e.source !== testframe) return;
+      resolve(e.data);
+    };
+  });
+  assert_equals(data, "foobar");
+}, 'Posting a File in a navigation handled by a service worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/dedicated-worker-service-worker-interception.https.html b/test/fixtures/wpt/service-workers/service-worker/dedicated-worker-service-worker-interception.https.html
new file mode 100644
index 000000000000..2144f4827121
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/dedicated-worker-service-worker-interception.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: ServiceWorker interception</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+// Note that Chrome cannot pass these tests because of https://crbug.com/731599.
+
+function service_worker_interception_test(url, description) {
+  promise_test(async t => {
+    // Register a service worker whose scope includes |url|.
+    const kServiceWorkerScriptURL =
+        'resources/service-worker-interception-service-worker.js';
+    const registration = await service_worker_unregister_and_register(
+        t, kServiceWorkerScriptURL, url);
+    add_result_callback(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Start a dedicated worker for |url|. The top-level script request and any
+    // module imports should be intercepted by the service worker.
+    const worker = new Worker(url, { type: 'module' });
+    const msg_event = await new Promise(resolve => worker.onmessage = resolve);
+    assert_equals(msg_event.data, 'LOADED_FROM_SERVICE_WORKER');
+  }, description);
+}
+
+service_worker_interception_test(
+    'resources/service-worker-interception-network-worker.js',
+    'Top-level module loading should be intercepted by a service worker.');
+
+service_worker_interception_test(
+    'resources/service-worker-interception-static-import-worker.js',
+    'Static import should be intercepted by a service worker.');
+
+service_worker_interception_test(
+    'resources/service-worker-interception-dynamic-import-worker.js',
+    'Dynamic import should be intercepted by a service worker.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/detached-context.https.html b/test/fixtures/wpt/service-workers/service-worker/detached-context.https.html
new file mode 100644
index 000000000000..ce8e4cc8400c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/detached-context.https.html
@@ -0,0 +1,124 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service WorkerRegistration from a removed iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+</body>
+<script>
+// NOTE: This file tests corner case behavior that might not be defined in the
+// spec. See https://github.com/w3c/ServiceWorker/issues/1221
+
+promise_test(t => {
+    const url = 'resources/blank.html';
+    const scope_for_iframe = 'removed-registration'
+    const scope_for_main = 'resources/' + scope_for_iframe;
+    const script = 'resources/empty-worker.js';
+    let frame;
+    let resolvedCount = 0;
+
+    return service_worker_unregister(t, scope_for_main)
+      .then(() => {
+          return with_iframe(url);
+        })
+      .then(f => {
+          frame = f;
+          return navigator.serviceWorker.register(script,
+                                                  {scope: scope_for_main});
+        })
+      .then(r => {
+          add_completion_callback(() => { r.unregister(); });
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(() => {
+          return frame.contentWindow.navigator.serviceWorker.getRegistration(
+            scope_for_iframe);
+        })
+      .then(r => {
+          frame.remove();
+          assert_equals(r.installing, null);
+          assert_equals(r.waiting, null);
+          assert_equals(r.active.state, 'activated');
+          assert_equals(r.scope, normalizeURL(scope_for_main));
+          r.onupdatefound = () => { /* empty */ };
+
+          // We want to verify that unregister() and update() do not
+          // resolve on a detached registration.  We can't check for
+          // an explicit rejection, though, because not all browsers
+          // fire rejection callbacks on detached promises.  Instead
+          // we wait for a sample scope to install, activate, and
+          // unregister before declaring that the promises did not
+          // resolve.
+          r.unregister().then(() => resolvedCount += 1,
+                              () => {});
+          r.update().then(() => resolvedCount += 1,
+                          () => {});
+          return wait_for_activation_on_sample_scope(t, window);
+        })
+      .then(() => {
+          assert_equals(resolvedCount, 0,
+                        'methods called on a detached registration should not resolve');
+          frame.remove();
+        })
+  }, 'accessing a ServiceWorkerRegistration from a removed iframe');
+
+promise_test(t => {
+    const script = 'resources/empty-worker.js';
+    const scope = 'resources/scope/serviceworker-from-detached';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(() => { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => { return with_iframe(scope); })
+      .then(frame => {
+          const worker = frame.contentWindow.navigator.serviceWorker.controller;
+          const ctor = frame.contentWindow.DOMException;
+          frame.remove();
+          assert_equals(worker.scriptURL, normalizeURL(script));
+          assert_equals(worker.state, 'activated');
+          worker.onstatechange = () => { /* empty */ };
+          assert_throws_dom(
+              'InvalidStateError',
+               ctor,
+              () => { worker.postMessage(''); },
+              'postMessage on a detached client should throw an exception.');
+        });
+  }, 'accessing a ServiceWorker object from a removed iframe');
+
+promise_test(t => {
+    const iframe = document.createElement('iframe');
+    iframe.src = 'resources/blank.html';
+    document.body.appendChild(iframe);
+    const f = iframe.contentWindow.Function;
+    function get_navigator() {
+      return f('return navigator')();
+    }
+    return new Promise(resolve => {
+        assert_equals(iframe.contentWindow.navigator, get_navigator());
+        iframe.src = 'resources/blank.html?navigate-to-new-url';
+        iframe.onload = resolve;
+      }).then(function() {
+        assert_not_equals(get_navigator().serviceWorker, null);
+        assert_equals(
+            get_navigator().serviceWorker,
+            iframe.contentWindow.navigator.serviceWorker);
+        iframe.remove();
+      });
+  }, 'accessing navigator.serviceWorker on a detached iframe');
+
+test(t => {
+    const iframe = document.createElement('iframe');
+    iframe.src = 'resources/blank.html';
+    document.body.appendChild(iframe);
+    const f = iframe.contentWindow.Function;
+    function get_navigator() {
+      return f('return navigator')();
+    }
+    assert_not_equals(get_navigator().serviceWorker, null);
+    iframe.remove();
+    assert_not_equals(get_navigator().serviceWorker, null);
+  }, 'accessing navigator on a removed frame');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/detached-register-crash.https.html b/test/fixtures/wpt/service-workers/service-worker/detached-register-crash.https.html
new file mode 100644
index 000000000000..2785142a3cf4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/detached-register-crash.https.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Assures navigator.serviceWorker.register() doesn't crash when rejecting being called in a detached frame</title>
+<link rel="author" href="mailto:caseq@chromium.org">
+<link rel="help" href="http://crbug.com/398910931">
+<body>
+<iframe></iframe>
+<script>
+const frame = document.getElementsByTagName("iframe")[0];
+const container = frame.contentWindow.navigator.serviceWorker;
+frame.remove();
+container.register("data:,");
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/embed-and-object-are-not-intercepted.https.html b/test/fixtures/wpt/service-workers/service-worker/embed-and-object-are-not-intercepted.https.html
new file mode 100644
index 000000000000..581dbeca9772
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/embed-and-object-are-not-intercepted.https.html
@@ -0,0 +1,104 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>embed and object are not intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+let registration;
+
+const kScript = 'resources/embed-and-object-are-not-intercepted-worker.js';
+const kScope = 'resources/';
+
+promise_test(t => {
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+  }, 'initialize global state');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/embed-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'requests for EMBED elements of embedded HTML content should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/object-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'requests for OBJECT elements of embedded HTML content should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/embed-image-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request was not intercepted');
+        });
+  }, 'requests for EMBED elements of an image should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/object-image-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request was not intercepted');
+        });
+  }, 'requests for OBJECT elements of an image should not be intercepted by service workers');
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/object-navigation-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'post-load navigation of OBJECT elements should not be intercepted by service workers');
+
+
+promise_test(t => {
+    let frame;
+    return with_iframe('resources/embed-navigation-is-not-intercepted-iframe.html')
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.test_promise;
+        })
+      .then(result => {
+          assert_equals(result, 'request for embedded content was not intercepted');
+        });
+  }, 'post-load navigation of EMBED elements should not be intercepted by service workers');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html b/test/fixtures/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html
new file mode 100644
index 000000000000..04e98266b4f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+function sync_message(worker, message, transfer) {
+  let wait = new Promise((res, rej) => {
+    navigator.serviceWorker.addEventListener('message', function(e) {
+        if (e.data === 'ACK') {
+          res();
+        } else {
+          rej();
+        }
+      });
+    });
+  worker.postMessage(message, transfer);
+  return wait;
+}
+
+function runTest(test, step, testBody) {
+  var scope = './resources/' + step;
+  var script = 'resources/extendable-event-async-waituntil.js?' + scope;
+  return service_worker_unregister_and_register(test, script, scope)
+    .then(function(registration) {
+        test.add_cleanup(function() {
+            return service_worker_unregister(test, scope);
+          });
+
+        let worker = registration.installing;
+        var channel = new MessageChannel();
+        var saw_message = new Promise(function(resolve) {
+          channel.port1.onmessage = function(e) { resolve(e.data); }
+        });
+
+        return wait_for_state(test, worker, 'activated')
+          .then(function() {
+              return sync_message(worker, { step: 'init', port: channel.port2 },
+                [channel.port2]);
+            })
+          .then(function() { return testBody(worker); })
+          .then(function() { return saw_message; })
+          .then(function(output) {
+              assert_equals(output.result, output.expected);
+            })
+          .then(function() { return sync_message(worker, { step: 'done' }); });
+      });
+}
+
+function msg_event_test(scope, test) {
+  var testBody = function(worker) {
+    return sync_message(worker, { step: scope });
+  };
+  return runTest(test, scope, testBody);
+}
+
+promise_test(msg_event_test.bind(this, 'no-current-extension-different-task'),
+  'Test calling waitUntil in a task at the end of the event handler without an existing extension throws');
+
+promise_test(msg_event_test.bind(this, 'no-current-extension-different-microtask'),
+  'Test calling waitUntil in a microtask at the end of the event handler without an existing extension suceeds');
+
+promise_test(msg_event_test.bind(this, 'current-extension-different-task'),
+  'Test calling waitUntil in a different task an existing extension succeeds');
+
+promise_test(msg_event_test.bind(this, 'during-event-dispatch-current-extension-expired-same-microtask-turn'),
+  'Test calling waitUntil at the end of an existing extension promise handler succeeds (event is still being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'during-event-dispatch-current-extension-expired-same-microtask-turn-extra'),
+  'Test calling waitUntil in a microtask at the end of an existing extension promise handler succeeds (event is still being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'after-event-dispatch-current-extension-expired-same-microtask-turn'),
+  'Test calling waitUntil in an existing extension promise handler succeeds (event is not being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'after-event-dispatch-current-extension-expired-same-microtask-turn-extra'),
+  'Test calling waitUntil in a microtask at the end of an existing extension promise handler throws (event is not being dispatched)');
+
+promise_test(msg_event_test.bind(this, 'current-extension-expired-different-task'),
+  'Test calling waitUntil after the current extension expired in a different task fails');
+
+promise_test(msg_event_test.bind(this, 'script-extendable-event'),
+  'Test calling waitUntil on a script constructed ExtendableEvent throws exception');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/pending-respondwith-async-waituntil');
+    }
+    return runTest(t, 'pending-respondwith-async-waituntil', testBody);
+  }, 'Test calling waitUntil asynchronously with pending respondWith promise.');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/during-event-dispatch-respondwith-microtask-sync-waituntil');
+    }
+    return runTest(t, 'during-event-dispatch-respondwith-microtask-sync-waituntil', testBody);
+  }, 'Test calling waitUntil synchronously inside microtask of respondWith promise (event is being dispatched).');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/during-event-dispatch-respondwith-microtask-async-waituntil');
+    }
+    return runTest(t, 'during-event-dispatch-respondwith-microtask-async-waituntil', testBody);
+  }, 'Test calling waitUntil asynchronously inside microtask of respondWith promise (event is being dispatched).');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/after-event-dispatch-respondwith-microtask-sync-waituntil');
+    }
+    return runTest(t, 'after-event-dispatch-respondwith-microtask-sync-waituntil', testBody);
+  }, 'Test calling waitUntil synchronously inside microtask of respondWith promise (event is not being dispatched).');
+
+promise_test(function(t) {
+    var testBody = function(worker) {
+      return with_iframe('./resources/after-event-dispatch-respondwith-microtask-async-waituntil');
+    }
+    return runTest(t, 'after-event-dispatch-respondwith-microtask-async-waituntil', testBody);
+  }, 'Test calling waitUntil asynchronously inside microtask of respondWith promise (event is not being dispatched).');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/extendable-event-waituntil.https.html b/test/fixtures/wpt/service-workers/service-worker/extendable-event-waituntil.https.html
new file mode 100644
index 000000000000..33b4eac5c185
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/extendable-event-waituntil.https.html
@@ -0,0 +1,140 @@
+<!DOCTYPE html>
+<title>ExtendableEvent: waitUntil</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function runTest(test, scope, onRegister) {
+  var script = 'resources/extendable-event-waituntil.js?' + scope;
+  return service_worker_unregister_and_register(test, script, scope)
+    .then(function(registration) {
+        test.add_cleanup(function() {
+            return service_worker_unregister(test, scope);
+          });
+
+        return onRegister(registration.installing);
+      });
+}
+
+// Sends a SYN to the worker and asynchronously listens for an ACK; sets
+// |obj.synced| to true once ack'd.
+function syncWorker(worker, obj) {
+  var channel = new MessageChannel();
+  worker.postMessage({port: channel.port2}, [channel.port2]);
+  return new Promise(function(resolve) {
+      channel.port1.onmessage = resolve;
+    }).then(function(e) {
+      var message = e.data;
+      assert_equals(message, 'SYNC',
+                    'Should receive sync message from worker.');
+      obj.synced = true;
+      channel.port1.postMessage('ACK');
+    });
+}
+
+promise_test(function(t) {
+    // Passing scope as the test switch for worker script.
+    var scope = 'resources/install-fulfilled';
+    var onRegister = function(worker) {
+        var obj = {};
+
+        return Promise.all([
+            syncWorker(worker, obj),
+            wait_for_state(t, worker, 'installed')
+          ]).then(function() {
+              assert_true(
+                obj.synced,
+                'state should be "installed" after the waitUntil promise ' +
+                    'for "oninstall" is fulfilled.');
+              service_worker_unregister_and_done(t, scope);
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test install event waitUntil fulfilled');
+
+promise_test(function(t) {
+    var scope = 'resources/install-multiple-fulfilled';
+    var onRegister = function(worker) {
+        var obj1 = {};
+        var obj2 = {};
+
+        return Promise.all([
+            syncWorker(worker, obj1),
+            syncWorker(worker, obj2),
+            wait_for_state(t, worker, 'installed')
+          ]).then(function() {
+              assert_true(
+                obj1.synced && obj2.synced,
+                'state should be "installed" after all waitUntil promises ' +
+                    'for "oninstall" are fulfilled.');
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test ExtendableEvent multiple waitUntil fulfilled.');
+
+promise_test(function(t) {
+    var scope = 'resources/install-reject-precedence';
+    var onRegister = function(worker) {
+        var obj1 = {};
+        var obj2 = {};
+
+        return Promise.all([
+            syncWorker(worker, obj1)
+              .then(function() {
+                  syncWorker(worker, obj2);
+                }),
+            wait_for_state(t, worker, 'redundant')
+          ]).then(function() {
+              assert_true(
+                obj1.synced,
+                'The "redundant" state was entered after the first "extend ' +
+                  'lifetime promise" resolved.'
+              );
+              assert_true(
+                obj2.synced,
+                'The "redundant" state was entered after the third "extend ' +
+                  'lifetime promise" resolved.'
+              );
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test ExtendableEvent waitUntil reject precedence.');
+
+promise_test(function(t) {
+    var scope = 'resources/activate-fulfilled';
+    var onRegister = function(worker) {
+        var obj = {};
+        return wait_for_state(t, worker, 'activating')
+          .then(function() {
+              return Promise.all([
+                syncWorker(worker, obj),
+                wait_for_state(t, worker, 'activated')
+              ]);
+            })
+          .then(function() {
+              assert_true(
+                obj.synced,
+                'state should be "activated" after the waitUntil promise ' +
+                    'for "onactivate" is fulfilled.');
+            });
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test activate event waitUntil fulfilled');
+
+promise_test(function(t) {
+    var scope = 'resources/install-rejected';
+    var onRegister = function(worker) {
+        return wait_for_state(t, worker, 'redundant');
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test install event waitUntil rejected');
+
+promise_test(function(t) {
+    var scope = 'resources/activate-rejected';
+    var onRegister = function(worker) {
+        return wait_for_state(t, worker, 'activated');
+      };
+    return runTest(t, scope, onRegister);
+  }, 'Test activate event waitUntil rejected.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-audio-tainting.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-audio-tainting.https.html
new file mode 100644
index 000000000000..9821759bc7b3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-audio-tainting.https.html
@@ -0,0 +1,47 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+promise_test(async (t) => {
+    const SCOPE = 'resources/empty.html';
+    const SCRIPT = 'resources/fetch-rewrite-worker.js';
+    const host_info = get_host_info();
+    const REMOTE_ORIGIN = host_info.HTTPS_REMOTE_ORIGIN;
+
+    const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, reg.installing, 'activated');
+    const frame = await with_iframe(SCOPE);
+
+    const doc = frame.contentDocument;
+    const win = frame.contentWindow;
+
+    const context = new win.AudioContext();
+    try {
+      context.suspend();
+      const audio = doc.createElement('audio');
+      audio.autoplay = true;
+      const source = context.createMediaElementSource(audio);
+      const spn = context.createScriptProcessor(16384, 1, 1);
+      source.connect(spn).connect(context.destination);
+      const url = `${REMOTE_ORIGIN}/webaudio/resources/sin_440Hz_-6dBFS_1s.wav`;
+      audio.src = '/test?url=' + encodeURIComponent(url);
+      doc.body.appendChild(audio);
+
+      await new Promise((resolve) => {
+        audio.addEventListener('playing', resolve);
+      });
+      await context.resume();
+      const event = await new Promise((resolve) => {
+        spn.addEventListener('audioprocess', resolve);
+      });
+      const data = event.inputBuffer.getChannelData(0);
+      for (const e of data) {
+        assert_equals(e, 0);
+      }
+    } finally {
+      context.close();
+    }
+  }, 'Verify CORS XHR of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-double-write.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-double-write.https.html
new file mode 100644
index 000000000000..dab2153baa6f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-double-write.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<meta charset="utf-8">
+<title>canvas tainting when written twice</title>
+<script>
+function loadImage(doc, url) {
+  return new Promise((resolve, reject) => {
+    const image = doc.createElement('img');
+    image.onload = () => { resolve(image); }
+    image.onerror = () => { reject('failed to load: ' + url); };
+    image.src = url;
+  });
+}
+
+// Tests that a canvas is tainted after it's written to with both a clear image
+// and opaque image from the same URL. A bad implementation might cache the
+// info of the clear image and assume the opaque image is also clear because
+// it's from the same URL. See https://crbug.com/907047 for details.
+promise_test(async (t) => {
+  // Set up a service worker and a controlled iframe.
+  const script = 'resources/fetch-canvas-tainting-double-write-worker.js';
+  const scope = 'resources/fetch-canvas-tainting-double-write-iframe.html';
+  const registration = await service_worker_unregister_and_register(
+      t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  // Load the same cross-origin image URL through the controlled iframe and
+  // this uncontrolled frame. The service worker responds with a same-origin
+  // image for the controlled iframe, so it is cleartext.
+  const imagePath = base_path() + 'resources/fetch-access-control.py?PNGIMAGE';
+  const imageUrl = get_host_info()['HTTPS_REMOTE_ORIGIN'] + imagePath;
+  const clearImage = await loadImage(iframe.contentDocument, imageUrl);
+  const opaqueImage = await loadImage(document, imageUrl);
+
+  // Set up a canvas for testing tainting.
+  const canvas = document.createElement('canvas');
+  const context = canvas.getContext('2d');
+  canvas.width = clearImage.width;
+  canvas.height = clearImage.height;
+
+  // The clear image and the opaque image have the same src URL. But...
+
+  // ... the clear image doesn't taint the canvas.
+  context.drawImage(clearImage, 0, 0);
+  assert_true(canvas.toDataURL().length > 0);
+
+  // ... the opaque image taints the canvas.
+  context.drawImage(opaqueImage, 0, 0);
+  assert_throws_dom('SecurityError', () => { canvas.toDataURL(); });
+}, 'canvas is tainted after writing both a non-opaque image and an opaque image from the same URL');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
new file mode 100644
index 000000000000..213238112257
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched image using cached responses</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?PNGIMAGE',
+  cache: true
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
new file mode 100644
index 000000000000..57dc7d98caa2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched image</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?PNGIMAGE',
+  cache: false
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
new file mode 100644
index 000000000000..c37e8e562448
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched video using cache responses</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?VIDEO',
+  cache: true
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
new file mode 100644
index 000000000000..0ee41e96f298
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
@@ -0,0 +1,115 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Canvas tainting due to video whose responses are fetched via a service worker including range requests</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body>
+<script>
+// These tests try to test canvas tainting due to a <video> element. The video
+// src URL is same-origin as the page, but the response is fetched via a service
+// worker that does tricky things like returning opaque responses from another
+// origin. Furthermore, this tests range requests so there are multiple
+// responses.
+//
+// We test range requests by having the server return 206 Partial Content to the
+// first request (which doesn't necessarily have a "Range" header or one with a
+// byte range). Then the <video> element automatically makes ranged requests
+// (the "Range" HTTP request header specifies a byte range). The server responds
+// to these with 206 Partial Content for the given range.
+let unique = 0; // See https://bugzilla.mozilla.org/show_bug.cgi?id=1129121
+function range_request_test(script, expected, description,
+                            {remote_origin_src} = {}) {
+  promise_test(t => {
+      let frame;
+      let registration;
+      add_result_callback(() => {
+          if (frame) frame.remove();
+          if (registration) registration.unregister();
+        });
+
+      const scope = 'resources/fetch-canvas-tainting-iframe.html';
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(r => {
+            registration = r;
+            return wait_for_state(t, registration.installing, 'activated');
+          })
+        .then(() => {
+            return with_iframe(scope);
+          })
+        .then(f => {
+            frame = f;
+            // Add "?PartialContent&VIDEO" to get a video resource from the
+            // server using range requests.
+            let video_url =
+              'fetch-access-control.py?PartialContent&VIDEO=' + unique++;
+            if (remote_origin_src) {
+              video_url = get_host_info().HTTPS_REMOTE_ORIGIN +
+                base_path() + 'resources/' + video_url;
+            }
+            return frame.contentWindow.create_test_case_promise(video_url);
+          })
+        .then(result => {
+            assert_equals(result, expected);
+          });
+    }, description);
+}
+
+// We want to consider a number of scenarios:
+// (1) Range responses come from a single origin, the same-origin as the page.
+//     The canvas should not be tainted.
+range_request_test(
+  'resources/fetch-event-network-fallback-worker.js',
+  'NOT_TAINTED',
+  'range responses from single origin (same-origin)');
+
+// (2) Range responses come from a single origin, cross-origin from the page
+//     (and without CORS sharing). This is not possible to test, since service
+//     worker can't make a request with a "Range" HTTP header in no-cors mode.
+
+// (3) Range responses come from multiple origins. The first response comes from
+//     cross-origin (and without CORS sharing, so is opaque). Subsequent
+//     responses come from same-origin. This should result in a load error, as regardless of canvas
+//     loading range requests from multiple opaque origins can reveal information across those origins.
+range_request_test(
+  'resources/range-request-to-different-origins-worker.js',
+  'LOAD_ERROR',
+  'range responses from multiple origins (cross-origin first)');
+
+// (4) Range responses come from multiple origins. The first response comes from
+//     same-origin. Subsequent responses come from cross-origin (and without
+//     CORS sharing). Like (2) this is not possible since the service worker
+//     cannot make range requests cross-origin.
+
+// (5) Range responses come from a single origin, with a mix of opaque and
+//     non-opaque responses. The first request uses 'no-cors' mode to
+//     receive an opaque response, and subsequent range requests use 'cors'
+//     to receive non-opaque responses. The canvas should be tainted.
+range_request_test(
+  'resources/range-request-with-different-cors-modes-worker.js',
+  'TAINTED',
+  'range responses from single origin with both opaque and non-opaque responses');
+
+// (6) Range responses come from a single origin, with a mix of opaque and
+//     non-opaque responses. The first request uses 'cors' mode to
+//     receive an non-opaque response, and subsequent range requests use
+//     'no-cors' to receive non-opaque responses. Like (2) this is not possible.
+
+// (7) The first Range response is synthesized using the Response constructor.
+//     Subsequent responses are same-origin, not handled by the service worker.
+range_request_test(
+  'resources/range-request-with-synth-head-worker.js',
+  'NOT_TAINTED',
+  'synth and same-origin fallback range responses');
+
+// (8) The first Range response is synthesized using the Response constructor.
+//     Subsequent responses are cross-origin, not handled by the service worker,
+//     no-cors and opaque.
+range_request_test(
+  'resources/range-request-with-synth-head-worker.js',
+  'LOAD_ERROR',
+  'synth and cross-origin fallback range responses',
+  {remote_origin_src: true});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
new file mode 100644
index 000000000000..e8c23a2edd63
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched video</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script src="resources/fetch-canvas-tainting-tests.js"></script>
+<body>
+<script>
+do_canvas_tainting_tests({
+  resource_path: base_path() + 'resources/fetch-access-control.py?VIDEO',
+  cache: false
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-cors-exposed-header-names.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-exposed-header-names.https.html
new file mode 100644
index 000000000000..317b02175f2f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-exposed-header-names.https.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<title>Service Worker: CORS-exposed header names should be transferred correctly</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(async function(t) {
+    const SCOPE = 'resources/simple.html';
+    const SCRIPT = 'resources/fetch-cors-exposed-header-names-worker.js';
+    const host_info = get_host_info();
+
+    const URL = get_host_info().HTTPS_REMOTE_ORIGIN +
+      '/service-workers/service-worker/resources/simple.txt?pipe=' +
+      'header(access-control-allow-origin,*)|' +
+      'header(access-control-expose-headers,*)|' +
+      'header(foo,bar)|' +
+      'header(set-cookie,X)';
+
+    const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, reg.installing, 'activated');
+    const frame = await with_iframe(SCOPE);
+
+    const response = await frame.contentWindow.fetch(URL);
+    const headers = response.headers;
+    assert_equals(headers.get('foo'), 'bar');
+    assert_equals(headers.get('set-cookie'), null);
+    assert_equals(headers.get('access-control-expose-headers'), '*');
+  }, 'CORS-exposed header names for a response from sw');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-cors-xhr.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-xhr.https.html
new file mode 100644
index 000000000000..f8ff445673bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-cors-xhr.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>Service Worker: CORS XHR of fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-cors-xhr-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var host_info = get_host_info();
+
+    return login_https(t)
+      .then(function() {
+          return service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+        })
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          return new Promise(function(resolve, reject) {
+              var channel = new MessageChannel();
+              channel.port1.onmessage = (event) => {
+                  if (event.data === 'done') {
+                    resolve();
+                    return;
+                  }
+                  test(() => {
+                    assert_true(event.data.result);
+                  }, event.data.testName);
+              };
+              frame.contentWindow.postMessage({},
+                                              host_info['HTTPS_ORIGIN'],
+                                              [channel.port2]);
+            });
+        });
+  }, 'Verify CORS XHR of fetch() in a Service Worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-csp.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-csp.https.html
new file mode 100644
index 000000000000..9e7b242b69aa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-csp.https.html
@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP control of fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+
+function assert_resolves(promise, description) {
+  return promise.catch(function(reason) {
+      throw new Error(description + ' - ' + reason.message);
+  });
+}
+
+function assert_rejects(promise, description) {
+  return promise.then(
+      function() { throw new Error(description); },
+      function() {});
+}
+
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-csp-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var host_info = get_host_info();
+    var IMAGE_PATH =
+        base_path() + 'resources/fetch-access-control.py?PNGIMAGE';
+    var IMAGE_URL = host_info['HTTPS_ORIGIN'] + IMAGE_PATH;
+    var REMOTE_IMAGE_URL = host_info['HTTPS_REMOTE_ORIGIN'] + IMAGE_PATH;
+    var REDIRECT_URL =
+        host_info['HTTPS_ORIGIN'] + base_path() + 'resources/redirect.py';
+    var frame;
+
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(
+              SCOPE + '?' +
+              encodeURIComponent('img-src ' + host_info['HTTPS_ORIGIN'] +
+                                 '; script-src \'unsafe-inline\''));
+        })
+      .then(function(f) {
+          frame = f;
+          return assert_resolves(
+              frame.contentWindow.load_image(IMAGE_URL),
+              'Allowed scope image resource should be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.load_image(REMOTE_IMAGE_URL),
+              'Disallowed scope image resource should not be loaded.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(IMAGE_URL)),
+              'Allowed scope image resource which was fetched via SW should ' +
+              'be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.load_image(
+                  // The request for REMOTE_IMAGE_URL will be fetched in SW.
+                  './sample?mode=no-cors&url=' +
+                  encodeURIComponent(REMOTE_IMAGE_URL)),
+              'Disallowed scope image resource which was fetched via SW ' +
+              'should not be loaded.');
+        })
+      .then(function() {
+          frame.remove();
+          return with_iframe(
+              SCOPE + '?' +
+              encodeURIComponent(
+                  'img-src ' + REDIRECT_URL +
+                  '; script-src \'unsafe-inline\''));
+        })
+      .then(function(f) {
+          frame = f;
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // Set 'ignore' not to call respondWith() in the SW.
+                  REDIRECT_URL + '?ignore&Redirect=' +
+                  encodeURIComponent(IMAGE_URL)),
+              'When the request was redirected, CSP match algorithm should ' +
+              'ignore the path component of the URL.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // This request will be fetched via SW and redirected by
+                  // redirect.php.
+                  REDIRECT_URL + '?Redirect=' + encodeURIComponent(IMAGE_URL)),
+              'When the request was redirected via SW, CSP match algorithm ' +
+              'should ignore the path component of the URL.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.load_image(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  REDIRECT_URL + '?url=' + encodeURIComponent(IMAGE_URL)),
+              'When the request was fetched via SW, CSP match algorithm ' +
+              'should ignore the path component of the URL.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.fetch(IMAGE_URL + "&fetch1", { mode: 'no-cors'}),
+              'Allowed scope fetch resource should be loaded.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.fetch(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(IMAGE_URL + '&fetch2'), { mode: 'no-cors'}),
+              'Allowed scope fetch resource which was fetched via SW should be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.fetch(REMOTE_IMAGE_URL + "&fetch3", { mode: 'no-cors'}),
+              'Disallowed scope fetch resource should not be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.fetch(
+                  // The request for REMOTE_IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(REMOTE_IMAGE_URL + '&fetch4'), { mode: 'no-cors'}),
+              'Disallowed scope fetch resource which was fetched via SW should not be loaded.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify CSP control of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-error.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-error.https.html
new file mode 100644
index 000000000000..e9fdf5743120
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-error.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+const scope = "./resources/in-scope";
+
+promise_test(async (test) => {
+    const registration = await service_worker_unregister_and_register(
+        test, "./resources/fetch-error-worker.js", scope);
+    promise_test(async () => registration.unregister(),
+                 "Unregister service worker");
+    await wait_for_state(test, registration.installing, 'activated');
+}, "Setup service worker");
+
+promise_test(async (test) => {
+    const iframe = await with_iframe(scope);
+    test.add_cleanup(() => iframe.remove());
+    const response = await iframe.contentWindow.fetch("fetch-error-test");
+    return promise_rejects_js(test, iframe.contentWindow.TypeError,
+                              response.text(), 'text() should reject');
+}, "Make sure a load that makes progress does not time out");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-add-async.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-add-async.https.html
new file mode 100644
index 000000000000..ac13e4f41675
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-add-async.https.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch event added asynchronously doesn't throw</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+service_worker_test(
+  'resources/fetch-event-add-async-worker.js');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html
new file mode 100644
index 000000000000..4812d8a91551
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.waiting</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(function(t) {
+    var scope =
+        'resources/fetch-event-after-navigation-within-page-iframe.html' +
+        '?hashchange';
+    var worker = 'resources/simple-intercept-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.contentWindow.location.hash = 'foo';
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.remove();
+        })
+  }, 'Service Worker should respond to fetch event after the hash changes');
+
+promise_test(function(t) {
+    var scope =
+        'resources/fetch-event-after-navigation-within-page-iframe.html' +
+        '?pushState';
+    var worker = 'resources/simple-intercept-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.contentWindow.history.pushState('', '', 'bar');
+          return frame.contentWindow.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker');
+          frame.remove();
+        })
+  }, 'Service Worker should respond to fetch event after the pushState');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-async-respond-with.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-async-respond-with.https.html
new file mode 100644
index 000000000000..d9147f85494c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-async-respond-with.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html>
+<title>respondWith cannot be called asynchronously</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// This file has tests that call respondWith() asynchronously.
+
+let frame;
+let worker;
+const script = 'resources/fetch-event-async-respond-with-worker.js';
+const scope = 'resources/simple.html';
+
+// Global setup: this must be the first promise_test.
+promise_test(async (t) => {
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+  frame = await with_iframe(scope);
+}, 'global setup');
+
+// Waits for a single message from the service worker and then removes the
+// message handler. Not safe for concurrent use.
+function wait_for_message() {
+  return new Promise((resolve) => {
+    const handler = (event) => {
+      navigator.serviceWorker.removeEventListener('message', handler);
+      resolve(event.data);
+    };
+    navigator.serviceWorker.addEventListener('message', handler);
+  });
+}
+
+// Does one test case. It fetches |url|. The service worker gets a fetch event
+// for |url| and attempts to call respondWith() asynchronously. It reports back
+// to the test whether an exception was thrown.
+async function do_test(url) {
+  // Send a message to tell the worker a new test case is starting.
+  const message = wait_for_message();
+  worker.postMessage('initializeMessageHandler');
+  const response = await message;
+  assert_equals(response, 'messageHandlerInitialized');
+
+  // Start a fetch.
+  const fetchPromise = frame.contentWindow.fetch(url);
+
+  // Receive the test result from the service worker.
+  const result = wait_for_message();
+  await fetchPromise.then(()=> {}, () => {});
+  return result;
+};
+
+promise_test(async (t) => {
+  const result = await do_test('respondWith-in-task');
+  assert_true(result.didThrow, 'should throw');
+  assert_equals(result.error, 'InvalidStateError');
+}, 'respondWith in a task throws InvalidStateError');
+
+promise_test(async (t) => {
+  const result = await do_test('respondWith-in-microtask');
+  assert_equals(result.didThrow, false, 'should not throw');
+}, 'respondWith in a microtask does not throw');
+
+// Global cleanup: the final promise_test.
+promise_test(async (t) => {
+  if (frame)
+    frame.remove();
+  await service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-handled.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-handled.https.html
new file mode 100644
index 000000000000..08b88ce3773d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-handled.https.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<html>
+<title>Service Worker: FetchEvent.handled</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+let frame = null;
+let worker = null;
+const script = 'resources/fetch-event-handled-worker.js';
+const scope = 'resources/simple.html';
+const channel = new MessageChannel();
+
+// Wait for a message from the service worker and removes the message handler.
+function wait_for_message_from_worker() {
+  return new Promise((resolve) => channel.port2.onmessage = (event) => resolve(event.data));
+}
+
+// Global setup: this must be the first promise_test.
+promise_test(async (t) => {
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  worker = registration.installing;
+  if (!worker)
+      worker = registration.active;
+  worker.postMessage({port:channel.port1}, [channel.port1]);
+  await wait_for_state(t, worker, 'activated');
+}, 'global setup');
+
+promise_test(async (t) => {
+  const promise = with_iframe(scope);
+  const message = await wait_for_message_from_worker();
+  frame = await promise;
+  assert_equals(message, 'RESOLVED');
+}, 'FetchEvent.handled should resolve when respondWith() is not called for a' +
+    ' navigation request');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch('sample.txt?respondWith-not-called');
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'RESOLVED');
+}, 'FetchEvent.handled should resolve when respondWith() is not called for a' +
+    ' sub-resource request');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-not-called-and-event-canceled').catch((e) => {});
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'REJECTED');
+}, 'FetchEvent.handled should reject when respondWith() is not called and the' +
+    ' event is canceled');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-called-and-promise-resolved');
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'RESOLVED');
+}, 'FetchEvent.handled should resolve when the promise provided' +
+    ' to respondWith() is resolved');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-called-and-promise-resolved-to-invalid-response')
+      .catch((e) => {});
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'REJECTED');
+}, 'FetchEvent.handled should reject when the promise provided' +
+    ' to respondWith() is resolved to an invalid response');
+
+promise_test(async (t) => {
+  frame.contentWindow.fetch(
+      'sample.txt?respondWith-called-and-promise-rejected').catch((e) => {});
+  const message = await wait_for_message_from_worker();
+  assert_equals(message, 'REJECTED');
+}, 'FetchEvent.handled should reject when the promise provided to' +
+    ' respondWith() is rejected');
+
+// Global cleanup: the final promise_test.
+promise_test(async (t) => {
+  if (frame)
+    frame.remove();
+  await service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html
new file mode 100644
index 000000000000..3cf5922f396a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<p>Click <a href="resources/install-worker.html?isHistoryNavigation&amp;script=fetch-event-test-worker.js">this link</a>.
+   Once you see &quot;method = GET,...&quot; in the page, go to another page, and then go back to the page using the Backward button.
+   You should see &quot;method = GET, isHistoryNavigation = true&quot;.
+</p>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html
new file mode 100644
index 000000000000..401939b3cb2d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<p>Click <a href="resources/install-worker.html?isHistoryNavigation&amp;script=fetch-event-test-worker.js">this link</a>.
+   Once you see &quot;method = GET,...&quot; in the page, go back to this page using the Backward button, and then go to the second page using the Forward button.
+   You should see &quot;method = GET, isHistoryNavigation = true&quot;.
+</p>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-iframe-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-iframe-navigation-manual.https.html
new file mode 100644
index 000000000000..cf1feccf6e44
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-iframe-navigation-manual.https.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const worker = 'resources/fetch-event-test-worker.js';
+
+promise_test(async (t) => {
+  const scope = 'resources/simple.html?isReloadNavigation';
+
+  const reg = await service_worker_unregister_and_register(t, worker, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+  const frame = await with_iframe(scope);
+  assert_equals(frame.contentDocument.body.textContent,
+                'method = GET, isReloadNavigation = false');
+  await new Promise((resolve) => {
+    frame.addEventListener('load', resolve);
+    frame.contentDocument.body.innerText =
+      'Reload this frame manually!';
+  });
+  assert_equals(frame.contentDocument.body.textContent,
+      'method = GET, isReloadNavigation = true');
+  frame.remove();
+  await reg.unregister();
+}, 'FetchEvent#request.isReloadNavigation is true for manual reload.');
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html
new file mode 100644
index 000000000000..a349f07c36c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+<p>Click <a href="resources/install-worker.html?isReloadNavigation&script=fetch-event-test-worker.js">this link</a>.
+   Once you see &quot;method = GET,...&quot; in the page, reload the page.
+   You will see &quot;method = GET, isReloadNavigation = true&quot;.
+</p>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-network-error.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-network-error.https.html
new file mode 100644
index 000000000000..fea2ad1e3c26
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-network-error.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch event network error</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var resolve_test_done;
+
+var test_done_promise = new Promise(function(resolve) {
+    resolve_test_done = resolve;
+  });
+
+// Called by the child frame.
+function notify_test_done(result) {
+  resolve_test_done(result);
+}
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-event-network-error-controllee-iframe.html';
+    var script = 'resources/fetch-event-network-error-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return test_done_promise;
+        })
+      .then(function(result) {
+          frame.remove();
+          assert_equals(result, 'PASS');
+        });
+  }, 'Rejecting the fetch event or using preventDefault() causes a network ' +
+     'error');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-redirect.https.html
new file mode 100644
index 000000000000..522928475702
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-redirect.https.html
@@ -0,0 +1,1038 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch Event Redirect Handling</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// ------------------------
+// Utilities for testing non-navigation requests that are intercepted with
+// a redirect.
+
+const host_info = get_host_info();
+const kScript = 'resources/fetch-rewrite-worker.js';
+const kScope = host_info['HTTPS_ORIGIN'] + base_path() +
+               'resources/blank.html?fetch-event-redirect';
+let frame;
+
+function redirect_fetch_test(t, test) {
+  const hostKeySuffix = test['url_credentials'] ? '_WITH_CREDS' : '';
+  const successPath = base_path() + 'resources/success.py';
+
+  let acaOrigin = '';
+  let host = host_info['HTTPS_ORIGIN' + hostKeySuffix];
+  if (test['redirect_dest'] === 'no-cors') {
+    host = host_info['HTTPS_REMOTE_ORIGIN' + hostKeySuffix]
+  } else if (test['redirect_dest'] === 'cors') {
+    acaOrigin = '?ACAOrigin=' + encodeURIComponent(host_info['HTTPS_ORIGIN']);
+    host = host_info['HTTPS_REMOTE_ORIGIN' + hostKeySuffix]
+  }
+
+  const dest = '?Redirect=' + encodeURIComponent(host + successPath + acaOrigin);
+  const expectedTypeParam =
+      test['expected_type']
+          ? '&expected_type=' + test['expected_type']
+          : '';
+  const expectedRedirectedParam =
+      test['expected_redirected']
+          ? '&expected_redirected=' + test['expected_redirected']
+          : '';
+  const url = '/' + test.name +
+            '?url=' + encodeURIComponent('redirect.py' + dest) +
+            expectedTypeParam + expectedRedirectedParam
+  const request = new Request(url, test.request_init);
+
+  if (test.should_reject) {
+    return promise_rejects_js(
+      t,
+      frame.contentWindow.TypeError,
+      frame.contentWindow.fetch(request),
+      'Must fail to fetch: url=' + url);
+  }
+  return frame.contentWindow.fetch(request).then((response) => {
+      assert_equals(response.type, test.expected_type,
+                    'response.type');
+      assert_equals(response.redirected, test.expected_redirected,
+                    'response.redirected');
+      if (response.type === 'opaque' || response.type === 'opaqueredirect') {
+        return;
+      }
+      return response.json().then((json) => {
+        assert_equals(json.result, 'success', 'JSON result must be "success".');
+      });
+    });
+}
+
+// Set up the service worker and the frame.
+promise_test(t => {
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          return with_iframe(kScope);
+        })
+      .then(f => {
+          frame = f;
+          add_completion_callback(() => { f.remove(); });
+        });
+  }, 'initialize global state');
+
+// ------------------------
+// Test every combination of:
+//  - RequestMode (same-origin, cors, no-cors)
+//  - RequestRedirect (manual, follow, error)
+//  - redirect destination origin (same-origin, cors, no-cors)
+//  - redirect destination credentials (no user/pass, user/pass)
+//
+// TODO: add navigation requests
+// TODO: add redirects to data URI and verify same-origin data-URL flag behavior
+// TODO: add test where original redirect URI is cross-origin
+// TODO: verify final method is correct for 301, 302, and 303
+// TODO: verify CORS redirect results in all further redirects being
+//       considered cross origin
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'same-origin without credentials should succeed opaqueredirect ' +
+   'interception and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'no-cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'same-origin without credentials should succeed opaqueredirect ' +
+   'interception and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'no-cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'same-origin without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'no-cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'cors without credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'same-origin with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'no-cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-cors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, cors mode Request redirected to ' +
+   'cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'same-origin with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'no-cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-sameorigin-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, same-origin mode Request redirected to ' +
+   'cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'same-origin with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'no-cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-manual-nocors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaqueredirect',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'manual',
+      mode: 'no-cors'
+    },
+    // This should succeed because its redirecting from same-origin to
+    // cross-origin.  Since the same-origin URL provides the location
+    // header the manual redirect mode should result in an opaqueredirect
+    // response.
+    should_reject: false
+  });
+}, 'Non-navigation, manual redirect, no-cors mode Request redirected to ' +
+   'cors with credentials should succeed opaqueredirect interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'same-origin without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    // should reject because CORS requests require CORS headers on cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'cors',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'cors without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'same-origin without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'same-origin without credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'no-cors without credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'cors without credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'same-origin with credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    // should reject because CORS requests require CORS headers on cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-cors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'cors'
+    },
+    // should reject because CORS requests do not allow user/pass entries in
+    // cross-origin URLs
+    // NOTE: https://github.com/whatwg/fetch/issues/112
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, cors mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'same-origin with credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-sameorigin-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'same-origin'
+    },
+    // should reject because same-origin requests cannot load cross-origin
+    // resources
+    should_reject: true
+  });
+}, 'Non-navigation, follow redirect, same-origin mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    expected_type: 'basic',
+    expected_redirected: true,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'same-origin with credentials should succeed interception ' +
+   'and response should be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'no-cors with credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-follow-nocors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    expected_type: 'opaque',
+    expected_redirected: false,
+    request_init: {
+      redirect: 'follow',
+      mode: 'no-cors'
+    },
+    should_reject: false
+  });
+}, 'Non-navigation, follow redirect, no-cors mode Request redirected to ' +
+   'cors with credentials should succeed interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'same-origin without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'same-origin without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-sameorigin-nocreds',
+    redirect_dest: 'same-origin',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'same-origin without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-nocors-nocreds',
+    redirect_dest: 'no-cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'no-cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-cors-nocreds',
+    redirect_dest: 'cors',
+    url_credentials: false,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'cors without credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'same-origin with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-cors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, cors mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'same-origin with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-sameorigin-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'same-origin'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, same-origin mode Request redirected to ' +
+   'cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-sameorigin-creds',
+    redirect_dest: 'same-origin',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'same-origin with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-nocors-creds',
+    redirect_dest: 'no-cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'no-cors with credentials should fail interception ' +
+   'and response should not be redirected');
+
+promise_test(function(t) {
+  return redirect_fetch_test(t, {
+    name: 'nonav-error-nocors-redirects-to-cors-creds',
+    redirect_dest: 'cors',
+    url_credentials: true,
+    request_init: {
+      redirect: 'error',
+      mode: 'no-cors'
+    },
+    // should reject because requests with 'error' RequestRedirect cannot be
+    // redirected.
+    should_reject: true
+  });
+}, 'Non-navigation, error redirect, no-cors mode Request redirected to ' +
+   'cors with credentials should fail interception and response should not ' +
+   'be redirected');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html
new file mode 100644
index 000000000000..af4b20a9a4a7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html
@@ -0,0 +1,274 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker = 'resources/fetch-event-test-worker.js';
+
+function do_test(referrer, value, expected, name)
+{
+    test(() => {
+          assert_equals(value, expected);
+    }, name + (referrer ? " - Custom Referrer" : " - Default Referrer"));
+}
+
+function run_referrer_policy_tests(frame, referrer, href, origin) {
+    return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                     {method: "GET", referrer: referrer})
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer URL when a member of RequestInit is present');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {method: "GET", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with no referrer when a member of RequestInit is present with an HTTP request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer with ""');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with no referrer with ""');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: origin',
+            'Service Worker should respond to fetch with the referrer origin with "origin" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: origin',
+            'Service Worker should respond to fetch with the referrer origin with "origin" and a cross origin request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer URL with "origin-when-cross-origin" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer origin with "origin-when-cross-origin" and a cross origin request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "no-referrer-when-downgrade", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: no-referrer-when-downgrade',
+            'Service Worker should respond to fetch with no referrer with "no-referrer-when-downgrade" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "no-referrer-when-downgrade", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: no-referrer-when-downgrade',
+            'Service Worker should respond to fetch with no referrer with "no-referrer-when-downgrade" and an HTTP request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url, {referrerPolicy: "unsafe-url", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: unsafe-url',
+            'Service Worker should respond to fetch with no referrer with "unsafe-url"');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "no-referrer", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: no-referrer',
+            'Service Worker should respond to fetch with no referrer URL with "no-referrer"');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "same-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: same-origin',
+            'Service Worker should respond to fetch with referrer URL with "same-origin" and a same origin request');
+          var http_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "same-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: same-origin',
+            'Service Worker should respond to fetch with no referrer with "same-origin" and cross origin request');
+          var http_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: strict-origin',
+            'Service Worker should respond to fetch with the referrer origin  with "strict-origin" and a HTTPS cross origin request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "strict-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: strict-origin',
+            'Service Worker should respond to fetch with the referrer origin with "strict-origin" and a same origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin',
+            'Service Worker should respond to fetch with no referrer with "strict-origin" and a HTTP request');
+          return frame.contentWindow.fetch('resources/simple.html?referrerFull',
+                                           {referrerPolicy: "strict-origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + href + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer URL with "strict-origin-when-cross-origin" and a same origin request');
+          var http_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: ' + origin + '/' + '\n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with the referrer origin with "strict-origin-when-cross-origin" and a HTTPS cross origin request');
+          var http_url = get_host_info()['HTTP_ORIGIN'] + base_path() +
+                         '/resources/simple.html?referrerFull';
+          return frame.contentWindow.fetch(http_url,
+                                           {referrerPolicy: "strict-origin-when-cross-origin", referrer: referrer});
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          do_test(referrer,
+            response_text,
+            'Referrer: \n' +
+            'ReferrerPolicy: strict-origin-when-cross-origin',
+            'Service Worker should respond to fetch with no referrer with "strict-origin-when-cross-origin" and a HTTP request');
+        });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/simple.html?referrerPolicy';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          test(() => {
+            assert_equals(frame.contentDocument.body.textContent, 'ReferrerPolicy: strict-origin-when-cross-origin');
+          }, 'Service Worker should respond to fetch with the default referrer policy');
+          // First, run the referrer policy tests without passing a referrer in RequestInit.
+          return run_referrer_policy_tests(frame, undefined, frame.contentDocument.location.href,
+                                           frame.contentDocument.location.origin);
+        })
+      .then(function() {
+          // Now, run the referrer policy tests while passing a referrer in RequestInit.
+          var referrer = get_host_info()['HTTPS_ORIGIN'] + base_path() + 'resources/fake-referrer';
+          return run_referrer_policy_tests(frame, 'fake-referrer', referrer,
+                                           frame.contentDocument.location.origin);
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Service Worker responds to fetch event with the referrer policy');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-argument.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-argument.https.html
new file mode 100644
index 000000000000..05e22105243f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-argument.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent.respondWith() argument type test.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var resolve_test_done;
+
+var test_done_promise = new Promise(function(resolve) {
+    resolve_test_done = resolve;
+  });
+
+// Called by the child frame.
+function notify_test_done(result) {
+  resolve_test_done(result);
+}
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-event-respond-with-argument-iframe.html';
+    var script = 'resources/fetch-event-respond-with-argument-worker.js';
+    var frame;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          return test_done_promise;
+        })
+      .then(function(result) {
+          frame.remove();
+          assert_equals(result, 'PASS');
+        });
+  }, 'respondWith() takes either a Response or a promise that resolves ' +
+     'with a Response. Other values should raise a network error.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-body-loaded-in-chunk.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-body-loaded-in-chunk.https.html
new file mode 100644
index 000000000000..932f9030c51c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-body-loaded-in-chunk.https.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a response whose body is being loaded from the network by chunks</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER = 'resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js';
+const SCOPE = 'resources/fetch-event-respond-with-body-loaded-in-chunk-iframe.html';
+
+promise_test(async t => {
+    var reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    let iframe = await with_iframe(SCOPE);
+    t.add_cleanup(() => iframe.remove());
+
+    let response = await iframe.contentWindow.fetch('body-in-chunk');
+    assert_equals(await response.text(), 'TEST_TRICKLE\nTEST_TRICKLE\nTEST_TRICKLE\nTEST_TRICKLE\n');
+}, 'Respond by chunks with a Response being loaded');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-custom-response.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-custom-response.https.html
new file mode 100644
index 000000000000..645a29c9b4f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-custom-response.https.html
@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a new Response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-custom-response-worker.js';
+const SCOPE =
+  'resources/blank.html';
+
+// Register a service worker, then create an iframe at url.
+function iframeTest(url, callback, name) {
+  return promise_test(async t => {
+    const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    const iframe = await with_iframe(url);
+    const iwin = iframe.contentWindow;
+    t.add_cleanup(() => iframe.remove());
+    await callback(t, iwin);
+  }, name);
+}
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=string');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a string');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=blob');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a blob');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=buffer');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a buffer');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=buffer-view');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a buffer-view');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=form-data');
+  const data = await response.formData();
+  assert_equals(data.get('result'), 'PASS');
+}, 'Subresource built from form-data');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?type=search-params');
+  assert_equals(await response.text(), 'result=PASS');
+}, 'Subresource built from search-params');
+
+// As above, but navigations
+
+iframeTest(SCOPE + '?type=string', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a string');
+
+iframeTest(SCOPE + '?type=blob', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a blob');
+
+iframeTest(SCOPE + '?type=buffer', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a buffer');
+
+iframeTest(SCOPE + '?type=buffer-view', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Navigation resource built from a buffer-view');
+
+// Note: not testing form data for a navigation as the boundary header is lost.
+
+iframeTest(SCOPE + '?type=search-params', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'result=PASS');
+}, 'Navigation resource built from search-params');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-partial-stream.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-partial-stream.https.html
new file mode 100644
index 000000000000..505cef297268
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-partial-stream.https.html
@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith streams data to an intercepted fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-partial-stream-worker.js';
+const SCOPE =
+  'resources/fetch-event-respond-with-partial-stream-iframe.html';
+
+promise_test(async t => {
+  let reg = await service_worker_unregister_and_register(t, WORKER, SCOPE)
+  add_completion_callback(() => reg.unregister());
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let frame = await with_iframe(SCOPE);
+  t.add_cleanup(_ => frame.remove());
+
+  let response = await frame.contentWindow.fetch('partial-stream.txt');
+
+  let reader = response.body.getReader();
+
+  let encoder = new TextEncoder();
+  let decoder = new TextDecoder();
+
+  let expected = 'partial-stream-content';
+  let encodedExpected = encoder.encode(expected);
+  let received = '';
+  let encodedReceivedLength = 0;
+
+  // Accumulate response data from the service worker.  We do this as a loop
+  // to allow the browser the flexibility of rebuffering if it chooses.  We
+  // do expect to get the partial data within the test timeout period, though.
+  // The spec is a bit vague at the moment about this, but it seems reasonable
+  // that the browser should not stall the response stream when the service
+  // worker has only written a partial result, but not closed the stream.
+  while (encodedReceivedLength < encodedExpected.length) {
+    let chunk = await reader.read();
+    assert_false(chunk.done, 'partial body stream should not be closed yet');
+
+    encodedReceivedLength += chunk.value.length;
+    received += decoder.decode(chunk.value);
+  }
+
+  // Note, the spec may allow some re-buffering between the service worker
+  // and the outer intercepted fetch.  We could relax this exact chunk value
+  // match if necessary.  The goal, though, is to ensure the outer fetch is
+  // not completely blocked until the service worker body is closed.
+  assert_equals(received, expected,
+                'should receive partial content through service worker interception');
+
+  reg.active.postMessage('done');
+
+  await reader.closed;
+
+  }, 'respondWith() streams data to an intercepted fetch()');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream-chunk.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream-chunk.https.html
new file mode 100644
index 000000000000..4544a9e08f56
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream-chunk.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a response built from a ReadableStream</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER = 'resources/fetch-event-respond-with-readable-stream-chunk-worker.js';
+const SCOPE = 'resources/fetch-event-respond-with-readable-stream-chunk-iframe.html';
+
+promise_test(async t => {
+    var reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    let iframe = await with_iframe(SCOPE);
+    t.add_cleanup(() => iframe.remove());
+
+    let response = await iframe.contentWindow.fetch('body-stream');
+    assert_equals(await response.text(), 'chunk #1 chunk #2 chunk #3 chunk #4');
+}, 'Respond by chunks with a Response built from a ReadableStream');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream.https.html
new file mode 100644
index 000000000000..4651258e6ab2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-readable-stream.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with a response built from a ReadableStream</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-readable-stream-worker.js';
+const SCOPE =
+  'resources/blank.html';
+
+// Register a service worker, then create an iframe at url.
+function iframeTest(url, callback, name) {
+  return promise_test(async t => {
+    const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+    add_completion_callback(() => reg.unregister());
+    await wait_for_state(t, reg.installing, 'activated');
+    const iframe = await with_iframe(url);
+    const iwin = iframe.contentWindow;
+    t.add_cleanup(() => iframe.remove());
+    await callback(t, iwin);
+  }, name);
+}
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?stream');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a ReadableStream');
+
+iframeTest(SCOPE + '?stream', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Main resource built from a ReadableStream');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?stream&delay');
+  assert_equals(await response.text(), 'PASS');
+}, 'Subresource built from a ReadableStream - delayed');
+
+iframeTest(SCOPE + '?stream&delay', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS');
+}, 'Main resource built from a ReadableStream - delayed');
+
+iframeTest(SCOPE, async (t, iwin) => {
+  const response = await iwin.fetch('?stream&use-fetch-stream');
+  assert_equals(await response.text(), 'PASS\n');
+}, 'Subresource built from a ReadableStream - fetch stream');
+
+iframeTest(SCOPE + '?stream&use-fetch-stream', (t, iwin) => {
+  assert_equals(iwin.document.body.textContent, 'PASS\n');
+}, 'Main resource built from a ReadableStream - fetch stream');
+
+for (const enqueue of [true, false]) {
+  const withStream = enqueue ? 'with nonempty stream' : 'with empty stream';
+  iframeTest(SCOPE, async (t, iwin) => {
+    const id = token();
+    let response = await iwin.fetch(`?stream&observe-cancel&id=${id}&enqueue=${enqueue}`);
+    response.body.cancel();
+
+    // Wait for a while to avoid a race between the cancel handling and the
+    // second fetch request.
+    await new Promise(r => step_timeout(r, 10));
+
+    response = await iwin.fetch(`?stream&query-cancel&id=${id}`);
+    assert_equals(await response.text(), 'cancelled');
+  }, `Cancellation in the page should be observable in the service worker ${withStream}`);
+
+  iframeTest(SCOPE, async (t, iwin) => {
+    const id = token();
+    const controller = new AbortController();
+    let response = await iwin.fetch(`?stream&observe-cancel&id=${id}&enqueue=${enqueue}`, {
+      signal: controller.signal
+    });
+    controller.abort();
+
+    // Wait for a while to avoid a race between the cancel handling and the
+    // second fetch request.
+    await new Promise(r => step_timeout(r, 10));
+
+    response = await iwin.fetch(`?stream&query-cancel&id=${id}`);
+    assert_equals(await response.text(), 'cancelled');
+  }, `Abort in the page should be observable in the service worker ${withStream}`);
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-response-body-with-invalid-chunk.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-response-body-with-invalid-chunk.https.html
new file mode 100644
index 000000000000..2a44811461a6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-response-body-with-invalid-chunk.https.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respondWith with response body having invalid chunks</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const WORKER =
+  'resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js';
+const SCOPE =
+  'resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html';
+
+// Called by the iframe when it has the reader promise we should watch.
+var set_reader_promise;
+let reader_promise = new Promise(resolve => set_reader_promise = resolve);
+
+var set_fetch_promise;
+let fetch_promise = new Promise(resolve => set_fetch_promise = resolve);
+
+// This test creates an controlled iframe that makes a fetch request. The
+// service worker returns a response with a body stream containing an invalid
+// chunk.
+promise_test(async t => {
+    // Start off the process.
+    let errorConstructor;
+    await service_worker_unregister_and_register(t, WORKER, SCOPE)
+      .then(reg => {
+           add_completion_callback(() => reg.unregister());
+           return wait_for_state(t, reg.installing, 'activated');
+         })
+      .then(() => with_iframe(SCOPE))
+      .then(frame => {
+          t.add_cleanup(() => frame.remove())
+          errorConstructor = frame.contentWindow.TypeError;
+        });
+
+    await promise_rejects_js(t, errorConstructor, reader_promise,
+                             "read() should be rejected");
+    // Fetch should complete properly, because the reader error is caught in
+    // the subframe.  That is, there should be no errors _other_ than the
+    // reader!
+    return fetch_promise;
+  }, 'Response with a ReadableStream having non-Uint8Array chunks should be transferred as errored');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-stops-propagation.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-stops-propagation.https.html
new file mode 100644
index 000000000000..31fd616b6d6f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-respond-with-stops-propagation.https.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var script =
+        'resources/fetch-event-respond-with-stops-propagation-worker.js';
+    var scope = 'resources/simple.html';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          t.add_cleanup(function() { frame.remove(); });
+          var channel = new MessageChannel();
+          var saw_message = new Promise(function(resolve) {
+              channel.port1.onmessage = function(e) { resolve(e.data); }
+            });
+          var worker = frame.contentWindow.navigator.serviceWorker.controller;
+
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          return saw_message;
+        })
+      .then(function(message) {
+          assert_equals(message, 'PASS');
+        })
+  }, 'respondWith() invokes stopImmediatePropagation()');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-throws-after-respond-with.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-throws-after-respond-with.https.html
new file mode 100644
index 000000000000..d98fb22ff423
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-throws-after-respond-with.https.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title></title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-event-throws-after-respond-with-iframe.html';
+    var workerscript = 'resources/respond-then-throw-worker.js';
+    var iframe;
+    return service_worker_unregister_and_register(t, workerscript, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated')
+            .then(() => reg.active);
+        })
+      .then(function(worker) {
+          var channel = new MessageChannel();
+          channel.port1.onmessage = function(e) {
+              assert_equals(e.data, 'SYNC', ' Should receive sync message.');
+              channel.port1.postMessage('ACK');
+            }
+          worker.postMessage({port: channel.port2}, [channel.port2]);
+          // The iframe will only be loaded after the sync is completed.
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+        assert_true(frame.contentDocument.body.innerHTML.includes("intercepted"));
+      })
+  }, 'Fetch event handler throws after a successful respondWith()');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw-manual.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw-manual.https.html
new file mode 100644
index 000000000000..15a2e95bd39d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw-manual.https.html
@@ -0,0 +1,122 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const worker = 'resources/fetch-event-within-sw-worker.js';
+
+function wait(ms) {
+  return new Promise(r => setTimeout(r, ms));
+}
+
+function reset() {
+  for (const iframe of [...document.querySelectorAll('.test-iframe')]) {
+    iframe.remove();
+  }
+  return navigator.serviceWorker.getRegistrations().then(registrations => {
+    return Promise.all(registrations.map(r => r.unregister()));
+  }).then(() => caches.keys()).then(cacheKeys => {
+    return Promise.all(cacheKeys.map(c => caches.delete(c)));
+  });
+}
+
+add_completion_callback(reset);
+
+function regReady(reg) {
+  return new Promise((resolve, reject) => {
+    if (reg.active) {
+      resolve();
+      return;
+    }
+    const nextWorker = reg.waiting || reg.installing;
+
+    nextWorker.addEventListener('statechange', () => {
+      if (nextWorker.state == 'redundant') {
+        reject(Error(`Service worker failed to install`));
+        return;
+      }
+      if (nextWorker.state == 'activated') {
+        resolve();
+      }
+    });
+  });
+}
+
+function getCookies() {
+  return new Map(
+    document.cookie
+      .split(/;/g)
+      .map(c => c.trim().split('=').map(s => s.trim()))
+  );
+}
+
+function registerSwAndOpenFrame() {
+  return reset().then(() => navigator.serviceWorker.register(worker, {scope: 'resources/'}))
+    .then(reg => regReady(reg))
+    .then(() => with_iframe('resources/simple.html'));
+}
+
+function raceBroadcastAndCookie(channel, cookie) {
+  const initialCookie = getCookies().get(cookie);
+  let done = false;
+
+  return Promise.race([
+    new Promise(resolve => {
+      const bc = new BroadcastChannel(channel);
+      bc.onmessage = () => {
+        bc.close();
+        resolve('broadcast');
+      };
+    }),
+    (function checkCookie() {
+      // Stop polling if the broadcast channel won
+      if (done == true) return;
+      if (getCookies().get(cookie) != initialCookie) return 'cookie';
+
+      return wait(200).then(checkCookie);
+    }())
+  ]).then(val => {
+    done = true;
+    return val;
+  });
+}
+
+promise_test(() => {
+  return Notification.requestPermission().then(permission => {
+    if (permission != "granted") {
+      throw Error('You must allow notifications for this origin before running this test.');
+    }
+    return registerSwAndOpenFrame();
+  }).then(iframe => {
+    return Promise.resolve().then(() => {
+      // In this test, the service worker will ping the 'icon-request' channel
+      // if it intercepts a request for 'notification_icon.py'. If the request
+      // reaches the server it sets the 'notification' cookie to the value given
+      // in the URL. "raceBroadcastAndCookie" monitors both and returns which
+      // happens first.
+      const race = raceBroadcastAndCookie('icon-request', 'notification');
+      const notification = new iframe.contentWindow.Notification('test', {
+        icon: `notification_icon.py?set-cookie-notification=${Math.random()}`
+      });
+      notification.close();
+
+      return race.then(winner => {
+        assert_equals(winner, 'broadcast', 'The service worker intercepted the from-window notification icon request');
+      });
+    }).then(() => {
+      // Similar race to above, but this time the service worker requests the
+      // notification.
+      const race = raceBroadcastAndCookie('icon-request', 'notification');
+      iframe.contentWindow.fetch(`show-notification?set-cookie-notification=${Math.random()}`);
+
+      return race.then(winner => {
+        assert_equals(winner, 'broadcast', 'The service worker intercepted the from-service-worker notification icon request');
+      });
+    })
+  });
+}, `Notification requests intercepted both from window and SW`);
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw.https.html
new file mode 100644
index 000000000000..0b52b18305fa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event-within-sw.https.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+const worker = 'resources/fetch-event-within-sw-worker.js';
+
+async function registerSwAndOpenFrame(t) {
+  const registration = await navigator.serviceWorker.register(
+      worker, { scope: 'resources/' });
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe('resources/simple.html');
+  t.add_cleanup(() => frame.remove());
+  return frame;
+}
+
+async function deleteCaches() {
+  const cacheKeys = await caches.keys();
+  await Promise.all(cacheKeys.map(c => caches.delete(c)));
+}
+
+promise_test(async t => {
+  t.add_cleanup(deleteCaches);
+
+  const iframe = await registerSwAndOpenFrame(t);
+  const fetchText =
+      await iframe.contentWindow.fetch('sample.txt').then(r => r.text());
+
+  const cache = await iframe.contentWindow.caches.open('test');
+  await cache.add('sample.txt');
+
+  const response = await cache.match('sample.txt');
+  const cacheText = await (response ? response.text() : 'cache match failed');
+  assert_equals(fetchText, 'intercepted', 'fetch intercepted');
+  assert_equals(cacheText, 'intercepted', 'cache.add intercepted');
+}, 'Service worker intercepts requests from window');
+
+promise_test(async t => {
+  const iframe = await registerSwAndOpenFrame(t);
+  const [fetchText, cacheText] = await Promise.all([
+    iframe.contentWindow.fetch('sample.txt-inner-fetch').then(r => r.text()),
+    iframe.contentWindow.fetch('sample.txt-inner-cache').then(r => r.text())
+  ]);
+  assert_equals(fetchText, 'Hello world\n', 'fetch within SW not intercepted');
+  assert_equals(cacheText, 'Hello world\n',
+                'cache.add within SW not intercepted');
+}, 'Service worker does not intercept fetch/cache requests within service ' +
+   'worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.h2.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.h2.html
new file mode 100644
index 000000000000..5cd381ec98db
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.h2.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const worker = 'resources/fetch-event-test-worker.js';
+
+const method = 'POST';
+const duplex = 'half';
+
+function createBody(t) {
+  const rs = new ReadableStream({start(c) {
+    c.enqueue('i a');
+    c.enqueue('m the request');
+    step_timeout(t.step_func(() => {
+      c.enqueue(' body');
+      c.close();
+    }, 10));
+  }});
+  return rs.pipeThrough(new TextEncoderStream());
+}
+
+promise_test(async t => {
+  const scope = 'resources/';
+  const registration =
+    await service_worker_unregister_and_register(t, worker, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // This will happen after all other tests
+  promise_test(t => {
+    return registration.unregister();
+  }, 'restore global state');
+}, 'global setup');
+
+// Test that the service worker can read FetchEvent#body when it is made from
+// a ReadableStream. It responds with request body it read.
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  const response = await frame.contentWindow.fetch('simple.html?request-body', {
+    method, body, duplex});
+  assert_equals(response.status, 200, 'status');
+  const text = await response.text();
+  assert_equals(text, 'i am the request body', 'body');
+}, 'The streaming request body is readable in the service worker.');
+
+// Network fallback
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  // Add "?ignore" so that the service worker falls back to
+  // echo-content.h2.py.
+  const echo_url = '/fetch/api/resources/echo-content.h2.py?ignore';
+  const response =
+    await frame.contentWindow.fetch(echo_url, { method, body, duplex});
+  assert_equals(response.status, 200, 'status');
+  const text = await response.text();
+  assert_equals(text, 'i am the request body', 'body');
+}, 'Network fallback for streaming upload.');
+
+// When the streaming body is used in the service worker, network fallback
+// fails.
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  const echo_url = '/fetch/api/resources/echo-content.h2.py?use-and-ignore';
+  const w = frame.contentWindow;
+  await promise_rejects_js(t, w.TypeError, w.fetch(echo_url, {
+    method, body, duplex}));
+}, 'When the streaming request body is used, network fallback fails.');
+
+// When the streaming body is used by clone() in the service worker, network
+// fallback succeeds.
+promise_test(async t => {
+  const body = createBody(t);
+  // Set page_url to "?ignore" so the service worker falls back to network
+  // for the main resource request, and add a suffix to avoid colliding
+  // with other tests.
+  const page_url = `resources/simple.html?ignore&id=${token()}`;
+  const frame = await with_iframe(page_url);
+  t.add_cleanup(() => { frame.remove(); });
+  // Add "?clone-and-ignore" so that the service worker falls back to
+  // echo-content.h2.py.
+  const echo_url = '/fetch/api/resources/echo-content.h2.py?clone-and-ignore';
+  const response = await frame.contentWindow.fetch(echo_url, {
+    method, body, duplex});
+  assert_equals(response.status, 200, 'status');
+  const text = await response.text();
+  assert_equals(text, 'i am the request body', 'body');
+}, 'Running clone() in the service worker does not prevent network fallback.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.html
new file mode 100644
index 000000000000..2edb5b0e032a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-event.https.html
@@ -0,0 +1,1000 @@
+<!DOCTYPE html>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/utils.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker = 'resources/fetch-event-test-worker.js';
+function wait(ms) {
+    return new Promise(resolve => step_timeout(resolve, ms));
+}
+
+promise_test(async t => {
+    const scope = 'resources/';
+    const registration =
+        await service_worker_unregister_and_register(t, worker, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // This will happen after all other tests
+    promise_test(t => {
+        return registration.unregister();
+      }, 'restore global state');
+  }, 'global setup');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?headers';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          const headers = JSON.parse(frame.contentDocument.body.textContent);
+          const header_names = {};
+          for (const [name, value] of headers) {
+            header_names[name] = true;
+          }
+
+          assert_true(
+            header_names.hasOwnProperty('accept'),
+            'request includes "Accept" header as inserted by Fetch'
+          );
+        });
+  }, 'Service Worker headers in the request of a fetch event');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?string';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Test string',
+            'Service Worker should respond to fetch with a test string');
+          assert_equals(
+            frame.contentDocument.contentType,
+            'text/plain',
+            'The content type of the response created with a string should be text/plain');
+          assert_equals(
+            frame.contentDocument.characterSet,
+            'UTF-8',
+            'The character set of the response created with a string should be UTF-8');
+        });
+  }, 'Service Worker responds to fetch event with string');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?string';
+    var frame;
+    return with_iframe(page_url)
+      .then(function(f) {
+        frame = f;
+        t.add_cleanup(() => { frame.remove(); });
+        return frame.contentWindow.fetch(page_url + "#foo")
+      })
+      .then(function(response) { return response.text() })
+      .then(function(text) {
+          assert_equals(
+            text,
+            'Test string',
+            'Service Worker should respond to fetch with a test string');
+        });
+  }, 'Service Worker responds to fetch event using request fragment with string');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?blob';
+    return with_iframe(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Test blob',
+            'Service Worker should respond to fetch with a test string');
+        });
+  }, 'Service Worker responds to fetch event with blob body');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?referrer';
+      return with_iframe(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Referrer: ' + document.location.href,
+            'Service Worker should respond to fetch with the referrer URL');
+        });
+  }, 'Service Worker responds to fetch event with the referrer URL');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?clientId';
+    var frame;
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Client ID Not Found',
+            'Service Worker should respond to fetch with a client id');
+          return frame.contentWindow.fetch('resources/other.html?clientId');
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          assert_equals(
+            response_text.substr(0, 15),
+            'Client ID Found',
+            'Service Worker should respond to fetch with an existing client id');
+        });
+  }, 'Service Worker responds to fetch event with an existing client id');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?resultingClientId';
+    const expected_found = 'Resulting Client ID Found';
+    const expected_not_found = 'Resulting Client ID Not Found';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent.substr(0, expected_found.length),
+            expected_found,
+            'Service Worker should respond with an existing resulting client id for non-subresource requests');
+          return frame.contentWindow.fetch('resources/other.html?resultingClientId');
+        })
+      .then(function(response) { return response.text(); })
+      .then(function(response_text) {
+          assert_equals(
+            response_text.substr(0),
+            expected_not_found,
+            'Service Worker should respond with an empty resulting client id for subresource requests');
+        });
+  }, 'Service Worker responds to fetch event with the correct resulting client id');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?ignore';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'Here\'s a simple html file.\n',
+                        'Response should come from fallback to native fetch');
+        });
+  }, 'Service Worker does not respond to fetch event');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?null';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        '',
+                        'Response should be the empty string');
+        });
+  }, 'Service Worker responds to fetch event with null response body');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?fetch';
+    return with_iframe(page_url)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'Here\'s an other html file.\n',
+                        'Response should come from fetched other file');
+        });
+  }, 'Service Worker fetches other file in fetch event');
+
+// Creates a form and an iframe and does a form submission that navigates the
+// frame to |action_url|. Returns the frame after navigation.
+function submit_form(action_url) {
+  return new Promise(resolve => {
+      const frame = document.createElement('iframe');
+      frame.name = 'post-frame';
+      document.body.appendChild(frame);
+      const form = document.createElement('form');
+      form.target = frame.name;
+      form.action = action_url;
+      form.method = 'post';
+      const input1 = document.createElement('input');
+      input1.type = 'text';
+      input1.value = 'testValue1';
+      input1.name = 'testName1'
+      form.appendChild(input1);
+      const input2 = document.createElement('input');
+      input2.type = 'text';
+      input2.value = 'testValue2';
+      input2.name = 'testName2'
+      form.appendChild(input2);
+      document.body.appendChild(form);
+      frame.onload = function() {
+        form.remove();
+        resolve(frame);
+      };
+      form.submit();
+    });
+}
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?form-post';
+    return submit_form(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'POST:application/x-www-form-urlencoded:' +
+                        'testName1=testValue1&testName2=testValue2');
+        });
+  }, 'Service Worker responds to fetch event with POST form');
+
+promise_test(t => {
+    // Add '?ignore' so the service worker falls back to network.
+    const page_url = 'resources/echo-content.py?ignore';
+    return submit_form(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentDocument.body.textContent,
+                        'testName1=testValue1&testName2=testValue2');
+        });
+  }, 'Service Worker falls back to network in fetch event with POST form');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?multiple-respond-with';
+    return with_iframe(page_url)
+      .then(frame => {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            '(0)(1)[InvalidStateError](2)[InvalidStateError]',
+            'Multiple calls of respondWith must throw InvalidStateErrors.');
+        });
+  }, 'Multiple calls of respondWith must throw InvalidStateErrors');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?used-check';
+    var first_frame;
+    return with_iframe(page_url)
+      .then(function(frame) {
+          assert_equals(frame.contentDocument.body.textContent,
+                        'Here\'s an other html file.\n',
+                        'Response should come from fetched other file');
+          first_frame = frame;
+          t.add_cleanup(() => { first_frame.remove(); });
+          return with_iframe(page_url);
+        })
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          // When we access to the page_url in the second time, the content of the
+          // response is generated inside the ServiceWorker. The body contains
+          // the value of bodyUsed of the first response which is already
+          // consumed by FetchEvent.respondWith method.
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'bodyUsed: true',
+            'event.respondWith must set the used flag.');
+        });
+  }, 'Service Worker event.respondWith must set the used flag');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?fragment-check';
+    var fragment = '#/some/fragment';
+    var first_frame;
+    return with_iframe(page_url + fragment)
+      .then(function(frame) {
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Fragment Found :' + fragment,
+            'Service worker should expose URL fragments in request.');
+        });
+  }, 'Service Worker should expose FetchEvent URL fragments.');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?cache';
+    var frame;
+    var cacheTypes = [
+      undefined, 'default', 'no-store', 'reload', 'no-cache', 'force-cache', 'only-if-cached'
+    ];
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          assert_equals(frame.contentWindow.document.body.textContent, 'default');
+          var tests = cacheTypes.map(function(type) {
+            return new Promise(function(resolve, reject) {
+                var init = {cache: type};
+                if (type === 'only-if-cached') {
+                  // For privacy reasons, for the time being, only-if-cached
+                  // requires the mode to be same-origin.
+                  init.mode = 'same-origin';
+                }
+                return frame.contentWindow.fetch(page_url + '=' + type, init)
+                  .then(function(response) { return response.text(); })
+                  .then(function(response_text) {
+                      var expected = (type === undefined) ? 'default' : type;
+                      assert_equals(response_text, expected,
+                                    'Service Worker should respond to fetch with the correct type');
+                    })
+                  .then(resolve)
+                  .catch(reject);
+              });
+          });
+          return Promise.all(tests);
+        })
+      .then(function() {
+          return new Promise(function(resolve, reject) {
+            frame.addEventListener('load', function onLoad() {
+              frame.removeEventListener('load', onLoad);
+              try {
+                assert_equals(frame.contentWindow.document.body.textContent,
+                              'no-cache');
+                resolve();
+              } catch (e) {
+                reject(e);
+              }
+            });
+            frame.contentWindow.location.reload();
+          });
+        });
+  }, 'Service Worker responds to fetch event with the correct cache types');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?eventsource';
+    var frame;
+
+    function test_eventsource(opts) {
+      return new Promise(function(resolve, reject) {
+        var eventSource = new frame.contentWindow.EventSource(page_url, opts);
+        eventSource.addEventListener('message', function(msg) {
+          eventSource.close();
+          try {
+            var data = JSON.parse(msg.data);
+            assert_equals(data.mode, 'cors',
+                          'EventSource should make CORS requests.');
+            assert_equals(data.cache, 'no-store',
+                          'EventSource should bypass the http cache.');
+            var expectedCredentials = opts.withCredentials ? 'include'
+                                                           : 'same-origin';
+            assert_equals(data.credentials, expectedCredentials,
+                          'EventSource should pass correct credentials mode.');
+            resolve();
+          } catch (e) {
+            reject(e);
+          }
+        });
+        eventSource.addEventListener('error', function(e) {
+          eventSource.close();
+          reject('The EventSource fired an error event.');
+        });
+      });
+    }
+
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return test_eventsource({ withCredentials: false });
+        })
+      .then(function() {
+          return test_eventsource({ withCredentials: true });
+        });
+  }, 'Service Worker should intercept EventSource');
+
+promise_test(t => {
+    const page_url = 'resources/simple.html?integrity';
+    var frame;
+    var integrity_metadata = 'gs0nqru8KbsrIt5YToQqS9fYao4GQJXtcId610g7cCU=';
+
+    return with_iframe(page_url)
+      .then(function(f) {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          // A request has associated integrity metadata (a string).
+          // Unless stated otherwise, it is the empty string.
+          assert_equals(
+            frame.contentDocument.body.textContent, '');
+
+          return frame.contentWindow.fetch(page_url, {'integrity': integrity_metadata});
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(response_text, integrity_metadata, 'integrity');
+        });
+  }, 'Service Worker responds to fetch event with the correct integrity_metadata');
+
+// Test that the service worker can read FetchEvent#body when it is a string.
+// It responds with request body it read.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/simple.html?ignore-for-request-body-string';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          return frame.contentWindow.fetch('simple.html?request-body', {
+              method: 'POST',
+              body: 'i am the request body'
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(response_text, 'i am the request body');
+        });
+  }, 'FetchEvent#body is a string');
+
+// Test that the service worker can read FetchEvent#body when it is made from
+// a ReadableStream. It responds with request body it read.
+promise_test(async t => {
+    const rs = new ReadableStream({start(c) {
+      c.enqueue('i a');
+      c.enqueue('m the request');
+      step_timeout(t.step_func(() => {
+        c.enqueue(' body');
+        c.close();
+      }, 10));
+    }});
+
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = `resources/simple.html?ignore&id=${token()}`;
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    const res = await frame.contentWindow.fetch('simple.html?request-body', {
+      method: 'POST',
+      body: rs.pipeThrough(new TextEncoderStream()),
+      duplex: 'half',
+    });
+    assert_equals(await res.text(), 'i am the request body');
+  }, 'FetchEvent#body is a ReadableStream');
+
+// Test that the request body is sent to network upon network fallback,
+// for a string body.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          // Add "?ignore" so the service worker falls back to echo-content.py.
+          const echo_url = '/fetch/api/resources/echo-content.py?ignore';
+          return frame.contentWindow.fetch(echo_url, {
+              method: 'POST',
+              body: 'i am the request body'
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(
+              response_text,
+              'i am the request body',
+              'the network fallback request should include the request body');
+        });
+  }, 'FetchEvent#body is a string and is passed to network fallback');
+
+// Test that the request body is sent to network upon network fallback,
+// for a ReadableStream body.
+promise_test(async t => {
+    const rs = new ReadableStream({start(c) {
+      c.enqueue('i a');
+      c.enqueue('m the request');
+      t.step_timeout(t.step_func(() => {
+        c.enqueue(' body');
+        c.close();
+      }, 10));
+    }});
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?ignore" so the service worker falls back to echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?ignore';
+    const w = frame.contentWindow;
+    await promise_rejects_js(t, w.TypeError,  w.fetch(echo_url, {
+        method: 'POST',
+        body: rs
+    }));
+  }, 'FetchEvent#body is a none Uint8Array ReadableStream and is passed to a service worker');
+
+// Test that the request body is sent to network upon network fallback even when
+// the request body is used in the service worker, for a string body.
+promise_test(async t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?use-and-ignore" so the service worker falls back to echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?use-and-ignore';
+    const response = await frame.contentWindow.fetch(echo_url, {
+        method: 'POST',
+        body: 'i am the request body'
+    });
+    const text = await response.text();
+    assert_equals(
+        text,
+        'i am the request body',
+        'the network fallback request should include the request body');
+  }, 'FetchEvent#body is a string, used and passed to network fallback');
+
+// Test that the request body is sent to network upon network fallback even when
+// the request body is used by clone() in the service worker, for a string body.
+promise_test(async t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?clone-and-ignore" so the service worker falls back to
+    // echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?clone-and-ignore';
+    const response = await frame.contentWindow.fetch(echo_url, {
+        method: 'POST',
+        body: 'i am the request body'
+    });
+    const text = await response.text();
+    assert_equals(
+        text,
+        'i am the request body',
+        'the network fallback request should include the request body');
+  }, 'FetchEvent#body is a string, cloned and passed to network fallback');
+
+// Test that the service worker can read FetchEvent#body when it is a blob.
+// It responds with request body it read.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/simple.html?ignore-for-request-body-blob';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          const blob = new Blob(['it\'s me the blob', ' ', 'and more blob!']);
+          return frame.contentWindow.fetch('simple.html?request-body', {
+              method: 'POST',
+              body: blob
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(response_text, 'it\'s me the blob and more blob!');
+        });
+  }, 'FetchEvent#body is a blob');
+
+// Test that the request body is sent to network upon network fallback,
+// for a blob body.
+promise_test(t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/simple.html?ignore-for-request-body-fallback-blob';
+    let frame;
+
+    return with_iframe(page_url)
+      .then(f => {
+          frame = f;
+          t.add_cleanup(() => { frame.remove(); });
+          const blob = new Blob(['it\'s me the blob', ' ', 'and more blob!']);
+          // Add "?ignore" so the service worker falls back to echo-content.py.
+          const echo_url = '/fetch/api/resources/echo-content.py?ignore';
+          return frame.contentWindow.fetch(echo_url, {
+              method: 'POST',
+              body: blob
+            });
+        })
+      .then(response => {
+          return response.text();
+        })
+      .then(response_text => {
+          assert_equals(
+              response_text,
+              'it\'s me the blob and more blob!',
+              'the network fallback request should include the request body');
+        });
+  }, 'FetchEvent#body is a blob and is passed to network fallback');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?keepalive';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, 'false');
+    const response = await frame.contentWindow.fetch(page_url, {keepalive: true});
+    const text = await response.text();
+    assert_equals(text, 'true');
+  }, 'Service Worker responds to fetch event with the correct keepalive value');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.location.reload();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = true');
+  }, 'FetchEvent#request.isReloadNavigation is true (location.reload())');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(0);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = true');
+  }, 'FetchEvent#request.isReloadNavigation is true (history.go(0))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      const form = frame.contentDocument.createElement('form');
+      form.method = 'POST';
+      form.name = 'form';
+      form.action = new Request(page_url).url;
+      frame.contentDocument.body.appendChild(form);
+      form.submit();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.location.reload();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isReloadNavigation = true');
+  }, 'FetchEvent#request.isReloadNavigation is true (POST + location.reload())');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isReloadNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    let frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(0);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isReloadNavigation = true');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+  }, 'FetchEvent#request.isReloadNavigation is true (with history traversal)');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(-1))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(1))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame =  await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(0);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+  }, 'FetchEvent#request.isHistoryNavigation is false (with history.go(0))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.location.reload();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+  }, 'FetchEvent#request.isHistoryNavigation is false (with location.reload)');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const oneAnotherUrl = new Request('resources/simple.html?ignore2').url;
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = oneAnotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-2);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(-2))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const oneAnotherUrl = new Request('resources/simple.html?ignore2').url;
+    const frame = await with_iframe(anotherUrl);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = oneAnotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = page_url;
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-2);
+    });
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(2);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (with history.go(2))');
+
+promise_test(async (t) => {
+    const page_url = 'resources/simple.html?isHistoryNavigation';
+    const anotherUrl = new Request('resources/simple.html?ignore').url;
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = GET, isHistoryNavigation = false');
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      const form = frame.contentDocument.createElement('form');
+      form.method = 'POST';
+      form.name = 'form';
+      form.action = new Request(page_url).url;
+      frame.contentDocument.body.appendChild(form);
+      form.submit();
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isHistoryNavigation = false');
+    // Use step_timeout(0) to ensure the history entry is created for Blink
+    // and WebKit. See https://bugs.webkit.org/show_bug.cgi?id=42861.
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.src = anotherUrl;
+    });
+    assert_equals(frame.contentDocument.body.textContent, "Here's a simple html file.\n");
+    await wait(0);
+    await new Promise((resolve) => {
+      frame.addEventListener('load', resolve);
+      frame.contentWindow.history.go(-1);
+    });
+    assert_equals(frame.contentDocument.body.textContent,
+                  'method = POST, isHistoryNavigation = true');
+  }, 'FetchEvent#request.isHistoryNavigation is true (POST + history.go(-1))');
+
+// When service worker responds with a Response, no XHR upload progress
+// events are delivered.
+promise_test(async t => {
+    const page_url = 'resources/simple.html?ignore-for-request-body-string';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+
+    const xhr = new frame.contentWindow.XMLHttpRequest();
+    xhr.open('POST', 'simple.html?request-body');
+    xhr.upload.addEventListener('progress', t.unreached_func('progress'));
+    xhr.upload.addEventListener('error', t.unreached_func('error'));
+    xhr.upload.addEventListener('abort', t.unreached_func('abort'));
+    xhr.upload.addEventListener('timeout', t.unreached_func('timeout'));
+    xhr.upload.addEventListener('load', t.unreached_func('load'));
+    xhr.upload.addEventListener('loadend', t.unreached_func('loadend'));
+    xhr.send('i am the request body');
+
+    await new Promise((resolve) => xhr.addEventListener('load', resolve));
+  }, 'XHR upload progress events for response coming from SW');
+
+// Upload progress events should be delivered for the network fallback case.
+promise_test(async t => {
+    const page_url = 'resources/simple.html?ignore-for-request-body-string';
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+
+    let progress = false;
+    let load = false;
+    let loadend = false;
+
+    const xhr = new frame.contentWindow.XMLHttpRequest();
+    xhr.open('POST', '/fetch/api/resources/echo-content.py?ignore');
+    xhr.upload.addEventListener('progress', () => progress = true);
+    xhr.upload.addEventListener('error', t.unreached_func('error'));
+    xhr.upload.addEventListener('abort', t.unreached_func('abort'));
+    xhr.upload.addEventListener('timeout', t.unreached_func('timeout'));
+    xhr.upload.addEventListener('load', () => load = true);
+    xhr.upload.addEventListener('loadend', () => loadend = true);
+    xhr.send('i am the request body');
+
+    await new Promise((resolve) => xhr.addEventListener('load', resolve));
+    assert_true(progress, 'progress');
+    assert_true(load, 'load');
+    assert_true(loadend, 'loadend');
+  }, 'XHR upload progress events for network fallback');
+
+promise_test(async t => {
+    // Set page_url to "?ignore" so the service worker falls back to network
+    // for the main resource request, and add a suffix to avoid colliding
+    // with other tests.
+    const page_url = 'resources/?ignore-for-request-body-fallback-string';
+
+    const frame = await with_iframe(page_url);
+    t.add_cleanup(() => { frame.remove(); });
+    // Add "?clone-and-ignore" so the service worker falls back to
+    // echo-content.py.
+    const echo_url = '/fetch/api/resources/echo-content.py?status=421';
+    const response = await frame.contentWindow.fetch(echo_url, {
+        method: 'POST',
+        body: 'text body'
+    });
+    assert_equals(response.status, 421);
+    const text = await response.text();
+    assert_equals(
+        text,
+        'text body. Request was sent 1 times.',
+        'the network fallback request should include the request body');
+  }, 'Fetch with POST with text on sw 421 response should not be retried.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-frame-resource.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-frame-resource.https.html
new file mode 100644
index 000000000000..0d8e38d8b84c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-frame-resource.https.html
@@ -0,0 +1,238 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch for the frame loading.</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker = 'resources/fetch-rewrite-worker.js';
+var path = base_path() + 'resources/fetch-access-control.py';
+var host_info = get_host_info();
+
+function getLoadedObject(t, win, contentFunc, closeFunc) {
+  return new Promise(function(resolve) {
+      function done(contentString) {
+        var result = null;
+        // fetch-access-control.py returns a string like "report( <json> )".
+        // Eval the returned string with a report functionto get the json
+        // object.
+        try {
+          function report(obj) { result = obj };
+          eval(contentString);
+        } catch(e) {
+          // just resolve null if we get unexpected page content
+        }
+        closeFunc(win);
+        resolve(result);
+      }
+
+      // We can't catch the network error on window. So we use the timer.
+      var timeout = t.step_timeout(function() {
+          // Failure pages are considered cross-origin in some browsers.  This
+          // means you cannot even .resolve() the window because the check for
+          // the .then property will throw.  Instead, treat cross-origin
+          // failure pages as the empty string which will fail to parse as the
+          // expected json result.
+          var content = '';
+          try {
+            content = contentFunc(win);
+          } catch(e) {
+            // use default empty string for cross-domain window
+          }
+          done(content);
+        // TODO(https://github.com/w3c/ServiceWorker/issues/1194): adjust timeout.
+        // 10,000 ms was set when `setTimeout()` was used here, which can be too large.
+        }, 10000);
+
+      win.onload = function() {
+          clearTimeout(timeout);
+          let content = '';
+          try {
+            content = contentFunc(win);
+          } catch(e) {
+            // use default empty string for cross-domain window (see above)
+          }
+          done(content);
+        };
+    });
+}
+
+function getLoadedFrameAsObject(t, frame) {
+  return getLoadedObject(t, frame, function(f) {
+      return f.contentDocument.body.textContent;
+    }, function(f) {
+      f.parentNode.removeChild(f);
+    });
+}
+
+function getLoadedWindowAsObject(t, win) {
+  return getLoadedObject(t, win, function(w) {
+      return w.document.body.textContent
+    }, function(w) {
+      w.close();
+    });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/frame-basic';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          frame = document.createElement('iframe');
+          frame.src =
+            scope + '?url=' +
+            encodeURIComponent(host_info['HTTPS_ORIGIN'] + path);
+          document.body.appendChild(frame);
+          return getLoadedFrameAsObject(t, frame);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'Basic type response could be loaded in the iframe.');
+          frame.remove();
+        });
+  }, 'Basic type response could be loaded in the iframe.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/frame-cors';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          frame = document.createElement('iframe');
+          frame.src =
+            scope + '?mode=cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path +
+                               '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+                               '&ACACredentials=true');
+          document.body.appendChild(frame);
+          return getLoadedFrameAsObject(t, frame);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'CORS type response could be loaded in the iframe.');
+          frame.remove();
+        });
+  }, 'CORS type response could be loaded in the iframe.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/frame-opaque';
+    var frame;
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          frame = document.createElement('iframe');
+          frame.src =
+            scope + '?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path);
+          document.body.appendChild(frame);
+          return getLoadedFrameAsObject(t, frame);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            null,
+            'Opaque type response could not be loaded in the iframe.');
+          frame.remove();
+        });
+  }, 'Opaque type response could not be loaded in the iframe.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/window-basic';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          var win = window.open(
+            scope + '?url=' +
+            encodeURIComponent(host_info['HTTPS_ORIGIN'] + path));
+          return getLoadedWindowAsObject(t, win);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'Basic type response could be loaded in the new window.');
+        });
+  }, 'Basic type response could be loaded in the new window.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/window-cors';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          var win = window.open(
+            scope + '?mode=cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path +
+                               '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+                               '&ACACredentials=true'));
+          return getLoadedWindowAsObject(t, win);
+        })
+      .then(function(result) {
+          assert_equals(
+            result.jsonpResult,
+            'success',
+            'CORS type response could be loaded in the new window.');
+        });
+  }, 'CORS type response could be loaded in the new window.');
+
+promise_test(function(t) {
+    var scope = 'resources/fetch-frame-resource/window-opaque';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          var win = window.open(
+            scope + '?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + path));
+          return getLoadedWindowAsObject(t, win);
+        })
+      .then(function(result) {
+          assert_equals(
+            result,
+            null,
+            'Opaque type response could not be loaded in the new window.');
+        });
+  }, 'Opaque type response could not be loaded in the new window.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-header-visibility.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-header-visibility.https.html
new file mode 100644
index 000000000000..1f4813c4f8e6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-header-visibility.https.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<title>Service Worker: Visibility of headers during fetch.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+  var worker = 'resources/fetch-rewrite-worker.js';
+  var path = base_path() + 'resources/fetch-access-control.py';
+  var host_info = get_host_info();
+  var frame;
+
+  promise_test(function(t) {
+    var scope = 'resources/fetch-header-visibility-iframe.html';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+        t.add_cleanup(function() {
+            return service_worker_unregister(t, scope);
+          });
+
+        return wait_for_state(t, reg.installing, 'activated');
+      })
+      .then(function() {
+        frame = document.createElement('iframe');
+        frame.src = scope;
+        document.body.appendChild(frame);
+
+        // Resolve a promise when we recieve 2 success messages
+        return new Promise(function(resolve, reject) {
+          var remaining = 4;
+          function onMessage(e) {
+            if (e.data == 'PASS') {
+              remaining--;
+              if (remaining == 0) {
+                resolve();
+              } else {
+                return;
+              }
+            } else {
+              reject(e.data);
+            }
+
+            window.removeEventListener('message', onMessage);
+          }
+          window.addEventListener('message', onMessage);
+        });
+      })
+      .then(function(result) {
+        frame.remove();
+      });
+  }, 'Visibility of defaulted headers during interception');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html
new file mode 100644
index 000000000000..0e8fa93b32c0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Service Worker: Mixed content of fetch()</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body></body>
+<script>
+async_test(function(t) {
+    var host_info = get_host_info();
+    window.addEventListener('message', t.step_func(on_message), false);
+    with_iframe(
+      host_info['HTTPS_ORIGIN'] + base_path() +
+      'resources/fetch-mixed-content-iframe.html?target=inscope');
+    function on_message(e) {
+      assert_equals(e.data.results, 'finish');
+      t.done();
+    }
+  }, 'Verify Mixed content of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html
new file mode 100644
index 000000000000..391dc5d2c19a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Service Worker: Mixed content of fetch()</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body></body>
+<script>
+async_test(function(t) {
+    var host_info = get_host_info();
+    window.addEventListener('message', t.step_func(on_message), false);
+    with_iframe(
+      host_info['HTTPS_ORIGIN'] + base_path() +
+      'resources/fetch-mixed-content-iframe.html?target=outscope');
+    function on_message(e) {
+      assert_equals(e.data.results, 'finish');
+      t.done();
+    }
+  }, 'Verify Mixed content of fetch() in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel-worker.js b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel-worker.js
new file mode 100644
index 000000000000..0a45a02880f2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel-worker.js
@@ -0,0 +1,14 @@
+async function cancelBodyTest(event)
+{
+    await new Promise(resolve => setTimeout(resolve, 100));
+    event.request.body.cancel("service worker cancelled body");
+    await new Promise(resolve => setTimeout(resolve, 100));
+    return new Response("PASS");
+}
+
+self.addEventListener("fetch", (event) => {
+    if (!event.request.url.includes("cancel-body-test"))
+        return;
+
+    event.respondWith(cancelBodyTest(event));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel.https.html
new file mode 100644
index 000000000000..f06633c78442
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-body-cancel.https.html
@@ -0,0 +1,56 @@
+<html>
+<head>
+<title>Service Worker cancelling a fetch upload stream body</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+</head>
+<body>
+<script>
+var scope = "resources";
+var activeWorker;
+
+promise_test(async (test) => {
+    var registration = await navigator.serviceWorker.register("fetch-request-body-cancel-worker.js", { scope : scope });
+    activeWorker = registration.active;
+    if (activeWorker)
+        return;
+    activeWorker = registration.installing;
+    return new Promise(resolve => {
+        activeWorker.addEventListener('statechange', () => {
+            if (activeWorker.state === "activated")
+                resolve();
+        });
+    });
+}, "Setup worker");
+
+promise_test(async (test) => {
+    const iframe = await with_iframe("resources/empty.html");
+
+    const cancelPromise = new Promise((resolve, reject) => {
+        test.step_timeout(() => reject("cancel timed out"), 3000);
+        var stream = new ReadableStream({
+            start: controller => {
+                controller.enqueue(new Uint8Array([1, 2, 3]));
+            },
+            cancel: reason => {
+                resolve(reason);
+            }
+        });
+
+        var options = { method: "POST", body: stream, duplex: "half" };
+        test.fetchPromise = iframe.contentWindow.fetch("cancel-body-test", options);
+    });
+    const response = await test.fetchPromise;
+    assert_true(response.ok, "fetch should succeed even though the request stream was cancelled");
+    const text = await response.text();
+    assert_equals(text, "PASS");
+
+    iframe.remove();
+
+    // FIXME: We should be able to validate cancelPromise value.
+    await cancelPromise;
+}, "Service worker cancelling event.request.body should cancel the page's upload stream");
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-base-url.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-base-url.https.html
new file mode 100644
index 000000000000..467a66cee464
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-base-url.https.html
@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<title>Service Worker: CSS's base URL must be the response URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+const SCOPE = 'resources/fetch-request-css-base-url-iframe.html';
+const SCRIPT = 'resources/fetch-request-css-base-url-worker.js';
+let worker;
+
+var signalMessage;
+function getNextMessage() {
+  return new Promise(resolve => { signalMessage = resolve; });
+}
+
+promise_test(async (t) => {
+  const registration = await service_worker_unregister_and_register(
+      t, SCRIPT, SCOPE);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+}, 'global setup');
+
+// Creates a test concerning the base URL of a stylesheet. It loads a
+// stylesheet from a controlled page. The stylesheet makes a subresource
+// request for an image. The service worker messages back the details of the
+// image request in order to test the base URL.
+//
+// The request URL for the stylesheet is under "resources/request-url-path/".
+// The service worker may respond in a way such that the response URL is
+// different to the request URL.
+function base_url_test(params) {
+  promise_test(async (t) => {
+    let frame;
+    t.add_cleanup(() => {
+      if (frame)
+        frame.remove();
+    });
+
+    // Ask the service worker to message this page once it gets the request
+    // for the image.
+    let channel = new MessageChannel();
+    const sawPong = getNextMessage();
+    channel.port1.onmessage = (event) => {
+      signalMessage(event.data);
+    };
+    worker.postMessage({port:channel.port2},[channel.port2]);
+
+    // It sends a pong back immediately. This ping/pong protocol helps deflake
+    // the test for browsers where message/fetch ordering isn't guaranteed.
+    assert_equals('pong', await sawPong);
+
+    // Load the frame which will load the stylesheet that makes the image
+    // request.
+    const sawResult = getNextMessage();
+    frame = await with_iframe(params.framePath);
+    const result = await sawResult;
+
+    // Test the image request.
+    const base = new URL('.', document.location).href;
+    assert_equals(result.url,
+                  base + params.expectImageRequestPath,
+                  'request');
+    assert_equals(result.referrer,
+                  base + params.expectImageRequestReferrer,
+                  'referrer');
+  }, params.description);
+}
+
+const cssFile = 'fetch-request-css-base-url-style.css';
+
+base_url_test({
+  framePath: SCOPE + '?fetch',
+  expectImageRequestPath: 'resources/sample.png',
+  expectImageRequestReferrer: `resources/${cssFile}?fetch`,
+  description: 'base URL when service worker does respondWith(fetch(responseUrl)).'});
+
+base_url_test({
+  framePath: SCOPE + '?newResponse',
+  expectImageRequestPath: 'resources/request-url-path/sample.png',
+  expectImageRequestReferrer: `resources/request-url-path/${cssFile}?newResponse`,
+  description: 'base URL when service worker does respondWith(new Response()).'});
+
+// Cleanup step: this must be the last promise_test.
+promise_test(async (t) => {
+  return service_worker_unregister(t, SCOPE);
+}, 'cleanup global state');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-cross-origin.https.html
new file mode 100644
index 000000000000..d9c1c7f5df2c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-cross-origin.https.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>Service Worker: Cross-origin CSS files fetched via SW.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+function getElementColorInFrame(frame, id) {
+  var element = frame.contentDocument.getElementById(id);
+  var style = frame.contentWindow.getComputedStyle(element, '');
+  return style['color'];
+}
+
+promise_test(async t => {
+  var SCOPE =
+      'resources/fetch-request-css-cross-origin';
+  var SCRIPT =
+      'resources/fetch-request-css-cross-origin-worker.js';
+  let registration = await service_worker_unregister_and_register(
+    t, SCRIPT, SCOPE);
+  promise_test(async t => {
+    await registration.unregister();
+  }, 'cleanup global state');
+
+  await wait_for_state(t, registration.installing, 'activated');
+}, 'setup global state');
+
+promise_test(async t => {
+  const EXPECTED_COLOR = 'rgb(0, 0, 255)';
+  const PAGE =
+      'resources/fetch-request-css-cross-origin-mime-check-iframe.html';
+
+  const f = await with_iframe(PAGE);
+  t.add_cleanup(() => {f.remove(); });
+  assert_equals(
+      getElementColorInFrame(f, 'crossOriginCss'),
+      EXPECTED_COLOR,
+      'The color must be overridden by cross origin CSS.');
+  assert_equals(
+      getElementColorInFrame(f, 'crossOriginHtml'),
+      EXPECTED_COLOR,
+      'The color must not be overridden by cross origin non CSS file.');
+  assert_equals(
+      getElementColorInFrame(f, 'sameOriginCss'),
+      EXPECTED_COLOR,
+      'The color must be overridden by same origin CSS.');
+  assert_equals(
+      getElementColorInFrame(f, 'sameOriginHtml'),
+      EXPECTED_COLOR,
+      'The color must be overridden by same origin non CSS file.');
+  assert_equals(
+      getElementColorInFrame(f, 'synthetic'),
+      EXPECTED_COLOR,
+      'The color must be overridden by synthetic CSS.');
+}, 'MIME checking of CSS resources fetched via service worker when Content-Type is not set.');
+
+promise_test(async t => {
+  const PAGE =
+      'resources/fetch-request-css-cross-origin-read-contents.html';
+
+  const f = await with_iframe(PAGE);
+  t.add_cleanup(() => {f.remove(); });
+  assert_throws_dom('SecurityError', f.contentWindow.DOMException, () => {
+    f.contentDocument.styleSheets[0].cssRules[0].cssText;
+  });
+  assert_equals(
+    f.contentDocument.styleSheets[1].cssRules[0].cssText,
+    '#crossOriginCss { color: blue; }',
+    'cross-origin CORS approved response');
+  assert_equals(
+    f.contentDocument.styleSheets[2].cssRules[0].cssText,
+    '#sameOriginCss { color: blue; }',
+    'same-origin response');
+  assert_equals(
+    f.contentDocument.styleSheets[3].cssRules[0].cssText,
+    '#synthetic { color: blue; }',
+    'service worker generated response');
+  }, 'Same-origin policy for access to CSS resources fetched via service worker');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-images.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-images.https.html
new file mode 100644
index 000000000000..586dea26135f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-css-images.https.html
@@ -0,0 +1,214 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent for css image</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+var SCOPE = 'resources/fetch-request-resources-iframe.https.html';
+var SCRIPT = 'resources/fetch-request-resources-worker.js';
+var host_info = get_host_info();
+var LOCAL_URL =
+  host_info['HTTPS_ORIGIN'] + base_path() + 'resources/sample?test';
+var REMOTE_URL =
+  host_info['HTTPS_REMOTE_ORIGIN'] + base_path() + 'resources/sample?test';
+
+function css_image_test(expected_results, frame, url, type,
+                        expected_mode, expected_credentials) {
+  expected_results[url] = {
+      url: url,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      message: 'CSSImage load (url:' + url + ' type:' + type + ')'
+    };
+  return frame.contentWindow.load_css_image(url, type);
+}
+
+function css_image_set_test(expected_results, frame, url, type,
+                            expected_mode, expected_credentials) {
+  expected_results[url] = {
+      url: url,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      message: 'CSSImageSet load (url:' + url + ' type:' + type + ')'
+    };
+  return frame.contentWindow.load_css_image_set(url, type);
+}
+
+function waitForWorker(worker) {
+  return new Promise(function(resolve) {
+    var channel = new MessageChannel();
+    channel.port1.addEventListener('message', function(msg) {
+      if (msg.data.ready) {
+        resolve(channel);
+      }
+    });
+    channel.port1.start();
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+}
+
+function create_message_promise(channel, expected_results, worker, scope) {
+  return new Promise(function(resolve) {
+    channel.port1.addEventListener('message', function(msg) {
+      var result = msg.data;
+      if (!expected_results[result.url]) {
+        return;
+      }
+      resolve(result);
+    });
+  }).then(function(result) {
+      var expected = expected_results[result.url];
+      assert_equals(
+          result.mode, expected.mode,
+          'mode of ' + expected.message +  ' must be ' +
+          expected.mode + '.');
+      assert_equals(
+          result.credentials, expected.credentials,
+          'credentials of ' + expected.message +  ' must be ' +
+          expected.credentials + '.');
+      delete expected_results[result.url];
+    });
+}
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img=backgroundImage";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_test(expected_results, frame, LOCAL_URL + Date.now(),
+                         'backgroundImage', 'no-cors', 'include');
+          css_image_test(expected_results, frame, REMOTE_URL + Date.now(),
+                        'backgroundImage', 'no-cors', 'include');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+        });
+  }, 'Verify FetchEvent for css image (backgroundImage).');
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img=shapeOutside";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_test(expected_results, frame, LOCAL_URL + Date.now(),
+                         'shapeOutside', 'cors', 'same-origin');
+          css_image_test(expected_results, frame, REMOTE_URL + Date.now(),
+                         'shapeOutside', 'cors', 'same-origin');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+      });
+  }, 'Verify FetchEvent for css image (shapeOutside).');
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img_set=backgroundImage";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();;
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_set_test(expected_results, frame, LOCAL_URL + Date.now(),
+                            'backgroundImage', 'no-cors', 'include');
+          css_image_set_test(expected_results, frame, REMOTE_URL + Date.now(),
+                            'backgroundImage', 'no-cors', 'include');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+      });
+  }, 'Verify FetchEvent for css image-set (backgroundImage).');
+
+promise_test(function(t) {
+    var scope = SCOPE + "?img_set=shapeOutside";
+    var expected_results = {};
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          return waitForWorker(worker);
+        })
+      .then(function(channel) {
+          css_image_set_test(expected_results, frame, LOCAL_URL + Date.now(),
+                             'shapeOutside', 'cors', 'same-origin');
+          css_image_set_test(expected_results, frame, REMOTE_URL + Date.now(),
+                            'shapeOutside', 'cors', 'same-origin');
+
+          return Promise.all([
+              create_message_promise(channel, expected_results, worker, scope),
+              create_message_promise(channel, expected_results, worker, scope)
+            ]);
+        });
+  }, 'Verify FetchEvent for css image-set (shapeOutside).');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-fallback.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-fallback.https.html
new file mode 100644
index 000000000000..a29f31d127bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-fallback.https.html
@@ -0,0 +1,282 @@
+<!DOCTYPE html>
+<title>Service Worker: the fallback behavior of FetchEvent</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function get_fetched_urls(worker) {
+  return new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(msg) { resolve(msg); };
+      worker.postMessage({port: channel.port2}, [channel.port2]);
+    });
+}
+
+function check_urls(worker, expected_requests) {
+  return get_fetched_urls(worker)
+    .then(function(msg) {
+        var requests = msg.data.requests;
+        assert_object_equals(requests, expected_requests);
+    });
+}
+
+var path = new URL(".", window.location).pathname;
+var SCOPE = 'resources/fetch-request-fallback-iframe.html';
+var SCRIPT = 'resources/fetch-request-fallback-worker.js';
+var host_info = get_host_info();
+var BASE_URL = host_info['HTTPS_ORIGIN'] +
+               path + 'resources/fetch-access-control.py?';
+var BASE_PNG_URL = BASE_URL + 'PNGIMAGE&';
+var OTHER_BASE_URL = host_info['HTTPS_REMOTE_ORIGIN'] +
+                     path + 'resources/fetch-access-control.py?';
+var OTHER_BASE_PNG_URL = OTHER_BASE_URL + 'PNGIMAGE&';
+var REDIRECT_URL = host_info['HTTPS_ORIGIN'] +
+                   path + 'resources/redirect.py?Redirect=';
+var register;
+
+promise_test(function(t) {
+  var registration;
+  var worker;
+
+  register = service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+    .then(function(r) {
+        registration = r;
+        worker = registration.installing;
+        return wait_for_state(t, worker, 'activated');
+      })
+    .then(function() { return with_iframe(SCOPE); })
+    .then(function(frame) {
+        // This test should not be considered complete until after the service
+        // worker has been unregistered. Currently, `testharness.js` does not
+        // support asynchronous global "tear down" logic, so this must be
+        // expressed using a dedicated `promise_test`. Because the other
+        // sub-tests in this file are declared synchronously, this test will be
+        // the final test executed.
+        promise_test(function(t) {
+            t.add_cleanup(function() {
+                frame.remove();
+              });
+            return registration.unregister();
+          }, 'restore global state');
+
+        return {frame: frame, worker: worker};
+      });
+
+    return register;
+  }, 'initialize global state');
+
+function promise_frame_test(body, desc) {
+  promise_test(function(test) {
+      return register.then(function(result) {
+          return body(test, result.frame, result.worker);
+        });
+    }, desc);
+}
+
+promise_frame_test(function(t, frame, worker) {
+      return check_urls(
+          worker,
+          [{
+            url: host_info['HTTPS_ORIGIN'] + path + SCOPE,
+            mode: 'navigate'
+          }]);
+  }, 'The SW must intercept the request for a main resource.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.xhr(BASE_URL)
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: BASE_URL, mode: 'cors' }]);
+        });
+  }, 'The SW must intercept the request of same origin XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.xhr(OTHER_BASE_URL),
+        'SW fallbacked CORS-unsupported other origin XHR should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_URL, mode: 'cors' }]);
+        });
+  }, 'The SW must intercept the request of CORS-unsupported other origin XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.xhr(OTHER_BASE_URL + 'ACAOrigin=*')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_URL + 'ACAOrigin=*', mode: 'cors' }]);
+        })
+  }, 'The SW must intercept the request of CORS-supported other origin XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.xhr(
+                  REDIRECT_URL + encodeURIComponent(BASE_URL))
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(BASE_URL),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request of redirected XHR.');
+
+promise_frame_test(function(t, frame, worker) {
+    return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.xhr(
+          REDIRECT_URL + encodeURIComponent(OTHER_BASE_URL)),
+        'SW fallbacked XHR which is redirected to CORS-unsupported ' +
+          'other origin should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(OTHER_BASE_URL),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for XHR which is' +
+     ' redirected to CORS-unsupported other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.xhr(
+                  REDIRECT_URL +
+                  encodeURIComponent(OTHER_BASE_URL + 'ACAOrigin=*'))
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL +
+                     encodeURIComponent(OTHER_BASE_URL + 'ACAOrigin=*'),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for XHR which is ' +
+     'redirected to CORS-supported other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(BASE_PNG_URL, '')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: BASE_PNG_URL, mode: 'no-cors' }]);
+        });
+  }, 'The SW must intercept the request for image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(OTHER_BASE_PNG_URL, '')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_PNG_URL, mode: 'no-cors' }]);
+        });
+  }, 'The SW must intercept the request for other origin image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.load_image(OTHER_BASE_PNG_URL, 'anonymous'),
+        'SW fallbacked CORS-unsupported other origin image request ' +
+          'should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_PNG_URL, mode: 'cors' }]);
+        })
+  }, 'The SW must intercept the request for CORS-unsupported other ' +
+     'origin image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(
+                  OTHER_BASE_PNG_URL + 'ACAOrigin=*', 'anonymous')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{ url: OTHER_BASE_PNG_URL + 'ACAOrigin=*', mode: 'cors' }]);
+        });
+  }, 'The SW must intercept the request for CORS-supported other ' +
+     'origin image.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(
+                  REDIRECT_URL + encodeURIComponent(BASE_PNG_URL), '')
+      .catch(function() {
+          assert_unreached(
+              'SW fallbacked redirected image request should succeed.');
+        })
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(BASE_PNG_URL),
+                mode: 'no-cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for redirected ' +
+     'image resource.');
+
+promise_frame_test(function(t, frame, worker) {
+  return frame.contentWindow.load_image(
+                  REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL), '')
+      .catch(function() {
+          assert_unreached(
+              'SW fallbacked image request which is redirected to ' +
+              'other origin should succeed.');
+        })
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL),
+                mode: 'no-cors'
+              }]);
+        })
+  }, 'The SW must intercept only the first request for image ' +
+     'resource which is redirected to other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+  return promise_rejects_js(
+        t,
+        frame.contentWindow.Error,
+        frame.contentWindow.load_image(
+            REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL),
+            'anonymous'),
+        'SW fallbacked image request which is redirected to ' +
+          'CORS-unsupported other origin should fail.')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL + encodeURIComponent(OTHER_BASE_PNG_URL),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for image ' +
+     'resource which is redirected to CORS-unsupported other origin.');
+
+promise_frame_test(function(t, frame, worker) {
+    return frame.contentWindow.load_image(
+        REDIRECT_URL +
+          encodeURIComponent(OTHER_BASE_PNG_URL + 'ACAOrigin=*'),
+        'anonymous')
+      .then(function() {
+          return check_urls(
+              worker,
+              [{
+                url: REDIRECT_URL +
+                     encodeURIComponent(OTHER_BASE_PNG_URL + 'ACAOrigin=*'),
+                mode: 'cors'
+              }]);
+        });
+  }, 'The SW must intercept only the first request for image ' +
+     'resource which is redirected to CORS-supported other origin.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-no-freshness-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-no-freshness-headers.https.html
new file mode 100644
index 000000000000..03b7d357610a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-no-freshness-headers.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<title>Service Worker: the headers of FetchEvent shouldn't contain freshness headers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-request-no-freshness-headers-iframe.html';
+    var SCRIPT = 'resources/fetch-request-no-freshness-headers-worker.js';
+    var worker;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          return new Promise(function(resolve) {
+              frame.onload = function() {
+                  resolve(frame);
+                };
+              frame.contentWindow.location.reload();
+            });
+        })
+      .then(function(frame) {
+          return new Promise(function(resolve) {
+              var channel = new MessageChannel();
+              channel.port1.onmessage = t.step_func(function(msg) {
+                  frame.remove();
+                  resolve(msg);
+                });
+              worker.postMessage(
+                {port: channel.port2}, [channel.port2]);
+            });
+        })
+      .then(function(msg) {
+          var freshness_headers = {
+            'if-none-match': true,
+            'if-modified-since': true
+          };
+          msg.data.requests.forEach(function(request) {
+              request.headers.forEach(function(header) {
+                  assert_false(
+                      !!freshness_headers[header[0]],
+                      header[0] + ' header must not be set in the ' +
+                      'FetchEvent\'s request. (url = ' + request.url + ')');
+                });
+            })
+        });
+  }, 'The headers of FetchEvent shouldn\'t contain freshness headers.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-redirect.https.html
new file mode 100644
index 000000000000..5ce015b421fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-redirect.https.html
@@ -0,0 +1,385 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent for resources</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/common/media.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var test_scope = ""
+function assert_resolves(promise, description) {
+    return promise.then(
+        () => test(() => {}, description + " - " + test_scope),
+        (e) => test(() => { throw e; }, description + " - " + test_scope)
+    );
+}
+
+function assert_rejects(promise, description) {
+    return promise.then(
+        () => test(() => { assert_unreached(); }, description + " - " + test_scope),
+        () => test(() => {}, description + " - " + test_scope)
+    );
+}
+
+function iframe_test(url, timeout_enabled) {
+  return new Promise(function(resolve, reject) {
+      var frame = document.createElement('iframe');
+      frame.src = url;
+      if (timeout_enabled) {
+        // We can't catch the network error on iframe. So we use the timer for
+        // failure detection.
+        var timer = setTimeout(function() {
+            reject(new Error('iframe load timeout'));
+            frame.remove();
+          }, 10000);
+      }
+      frame.onload = function() {
+        if (timeout_enabled)
+          clearTimeout(timer);
+        try {
+          if (frame.contentDocument.body.textContent == 'Hello world\n')
+            resolve();
+          else
+            reject(new Error('content mismatch'));
+        } catch (e) {
+          // Chrome treats iframes that failed to load due to a network error as
+          // having a different origin, so accessing contentDocument throws an
+          // error. Other browsers might have different behavior.
+          reject(new Error(e));
+        }
+        frame.remove();
+      };
+      document.body.appendChild(frame);
+    });
+}
+
+promise_test(function(t) {
+    test_scope = "default";
+
+    var SCOPE = 'resources/fetch-request-redirect-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var REDIRECT_URL = base_path() + 'resources/redirect.py?Redirect=';
+    var IMAGE_URL = base_path() + 'resources/square.png';
+    var AUDIO_URL = getAudioURI("/media/sound_5");
+    var XHR_URL = base_path() + 'resources/simple.txt';
+    var HTML_URL = base_path() + 'resources/sample.html';
+
+    var REDIRECT_TO_IMAGE_URL = REDIRECT_URL + encodeURIComponent(IMAGE_URL);
+    var REDIRECT_TO_AUDIO_URL = REDIRECT_URL + encodeURIComponent(AUDIO_URL);
+    var REDIRECT_TO_XHR_URL = REDIRECT_URL + encodeURIComponent(XHR_URL);
+    var REDIRECT_TO_HTML_URL = REDIRECT_URL + encodeURIComponent(HTML_URL);
+
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(() => service_worker_unregister(t, SCOPE));
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(async function(f) {
+            frame = f;
+            // XMLHttpRequest tests.
+            await assert_resolves(frame.contentWindow.xhr(XHR_URL),
+                            'Normal XHR should succeed.');
+            await assert_resolves(frame.contentWindow.xhr(REDIRECT_TO_XHR_URL),
+                            'Redirected XHR should succeed.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&redirect-mode=follow'),
+                'Redirected XHR with Request.redirect=follow should succeed.');
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&redirect-mode=error'),
+                'Redirected XHR with Request.redirect=error should fail.');
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&redirect-mode=manual'),
+                'Redirected XHR with Request.redirect=manual should fail.');
+
+            // Image loading tests.
+            await assert_resolves(frame.contentWindow.load_image(IMAGE_URL),
+                            'Normal image resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_image(REDIRECT_TO_IMAGE_URL),
+                'Redirected image resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_IMAGE_URL) +
+                    '&redirect-mode=follow'),
+                'Loading redirected image with Request.redirect=follow should' +
+                ' succeed.');
+            await assert_rejects(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_IMAGE_URL) +
+                    '&redirect-mode=error'),
+                'Loading redirected image with Request.redirect=error should ' +
+                'fail.');
+            await assert_rejects(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_IMAGE_URL) +
+                    '&redirect-mode=manual'),
+                'Loading redirected image with Request.redirect=manual should' +
+                ' fail.');
+
+            // Audio loading tests.
+            await assert_resolves(frame.contentWindow.load_audio(AUDIO_URL),
+                            'Normal audio resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_audio(REDIRECT_TO_AUDIO_URL),
+                'Redirected audio resource should be loaded.');
+            await assert_resolves(
+                frame.contentWindow.load_audio(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_AUDIO_URL) +
+                    '&redirect-mode=follow'),
+                'Loading redirected audio with Request.redirect=follow should' +
+                ' succeed.');
+            await assert_rejects(
+                frame.contentWindow.load_audio(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_AUDIO_URL) +
+                    '&redirect-mode=error'),
+                'Loading redirected audio with Request.redirect=error should ' +
+                'fail.');
+            await assert_rejects(
+                frame.contentWindow.load_audio(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_AUDIO_URL) +
+                    '&redirect-mode=manual'),
+                'Loading redirected audio with Request.redirect=manual should' +
+                ' fail.');
+
+            // Iframe tests.
+            await assert_resolves(iframe_test(HTML_URL),
+                            'Normal iframe loading should succeed.');
+            await assert_resolves(
+                iframe_test(REDIRECT_TO_HTML_URL),
+                'Normal redirected iframe loading should succeed.');
+            await assert_rejects(
+                iframe_test(SCOPE + '?url=' +
+                            encodeURIComponent(REDIRECT_TO_HTML_URL) +
+                            '&redirect-mode=follow',
+                            true /* timeout_enabled */),
+                'Redirected iframe loading with Request.redirect=follow should'+
+                ' fail.');
+            await assert_rejects(
+                iframe_test(SCOPE + '?url=' +
+                            encodeURIComponent(REDIRECT_TO_HTML_URL) +
+                            '&redirect-mode=error',
+                            true /* timeout_enabled */),
+                'Redirected iframe loading with Request.redirect=error should '+
+                'fail.');
+            await assert_resolves(
+                iframe_test(SCOPE + '?url=' +
+                            encodeURIComponent(REDIRECT_TO_HTML_URL) +
+                            '&redirect-mode=manual',
+                            true /* timeout_enabled */),
+                'Redirected iframe loading with Request.redirect=manual should'+
+                ' succeed.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify redirect mode of Fetch API and ServiceWorker FetchEvent.');
+
+// test for reponse.redirected
+promise_test(function(t) {
+    test_scope = "redirected";
+
+    var SCOPE = 'resources/fetch-request-redirect-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var REDIRECT_URL = base_path() + 'resources/redirect.py?Redirect=';
+    var XHR_URL = base_path() + 'resources/simple.txt';
+    var IMAGE_URL = base_path() + 'resources/square.png';
+
+    var REDIRECT_TO_XHR_URL = REDIRECT_URL + encodeURIComponent(XHR_URL);
+
+    var host_info = get_host_info();
+
+    var CROSS_ORIGIN_URL = host_info['HTTPS_REMOTE_ORIGIN'] + IMAGE_URL;
+
+    var REDIRECT_TO_CROSS_ORIGIN = REDIRECT_URL +
+      encodeURIComponent(CROSS_ORIGIN_URL + '?ACAOrigin=*');
+
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(() => service_worker_unregister(t, SCOPE));
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(async function(f) {
+          frame = f;
+            // XMLHttpRequest tests.
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true'),
+                'Redirected XHR should be resolved and response should be ' +
+                'redirected.');
+
+            // tests for request's mode = cors
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&mode=cors' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected even with CORS mode.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true'),
+                'Redirected XHR should be resolved and response.redirected ' +
+                'should be redirected with CORS mode.');
+
+            // tests for request's mode = no-cors
+            // The response.redirect should be false since we will not add
+            // redirected url list when redirect-mode is not follow.
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=manual' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=false'),
+                'Redirected XHR should be reject and response should be ' +
+                'redirected with NO-CORS mode and redirect-mode=manual.');
+
+            // tests for redirecting to a cors
+            await assert_resolves(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_CROSS_ORIGIN) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true'),
+                'Redirected CORS image should be reject and response should ' +
+                'not be redirected with NO-CORS mode.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify redirected of Response(Fetch API) and ServiceWorker FetchEvent.');
+
+// test for reponse.redirected after cached
+promise_test(function(t) {
+    test_scope = "cache";
+
+    var SCOPE = 'resources/fetch-request-redirect-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var REDIRECT_URL = base_path() + 'resources/redirect.py?Redirect=';
+    var XHR_URL = base_path() + 'resources/simple.txt';
+    var IMAGE_URL = base_path() + 'resources/square.png';
+
+    var REDIRECT_TO_XHR_URL = REDIRECT_URL + encodeURIComponent(XHR_URL);
+
+    var host_info = get_host_info();
+
+    var CROSS_ORIGIN_URL = host_info['HTTPS_REMOTE_ORIGIN'] + IMAGE_URL;
+
+    var REDIRECT_TO_CROSS_ORIGIN = REDIRECT_URL +
+      encodeURIComponent(CROSS_ORIGIN_URL + '?ACAOrigin=*');
+
+    var worker;
+    var frame;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(() => service_worker_unregister(t, SCOPE));
+
+          worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(async function(f) {
+          frame = f;
+            // XMLHttpRequest tests.
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Redirected XHR should be resolved and response should be ' +
+                'redirected.');
+
+            // tests for request's mode = cors
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(XHR_URL) +
+                    '&mode=cors' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Normal XHR should be resolved and response should not be ' +
+                'redirected even with CORS mode.');
+            await assert_resolves(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=true' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Redirected XHR should be resolved and response.redirected ' +
+                'should be redirected with CORS mode.');
+
+            // tests for request's mode = no-cors
+            // The response.redirect should be false since we will not add
+            // redirected url list when redirect-mode is not follow.
+            await assert_rejects(
+                frame.contentWindow.xhr(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_XHR_URL) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=manual' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=false' +
+                    '&cache'),
+                'Redirected XHR should be reject and response should be ' +
+                'redirected with NO-CORS mode and redirect-mode=manual.');
+
+            // tests for redirecting to a cors
+            await assert_resolves(
+                frame.contentWindow.load_image(
+                    './?url=' + encodeURIComponent(REDIRECT_TO_CROSS_ORIGIN) +
+                    '&mode=no-cors' +
+                    '&redirect-mode=follow' +
+                    '&expected_redirected=false' +
+                    '&expected_resolves=true' +
+                    '&cache'),
+                'Redirected CORS image should be reject and response should ' +
+                'not be redirected with NO-CORS mode.');
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Verify redirected of Response(Fetch API), Cache API and ServiceWorker ' +
+     'FetchEvent.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-resources.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-resources.https.html
new file mode 100644
index 000000000000..9524e6d4749b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-resources.https.html
@@ -0,0 +1,375 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent for resources</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+let url_count = 0;
+const expected_results = {};
+
+function add_promise_to_test(url)
+{
+  const expected = expected_results[url];
+  return new Promise((resolve) => {
+    expected.resolve = resolve;
+  });
+}
+
+function image_test(frame, url, cross_origin, expected_mode,
+                    expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      cross_origin: cross_origin,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'image',
+      message: `Image load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_image(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+function script_test(frame, url, cross_origin, expected_mode,
+                     expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      cross_origin: cross_origin,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'script',
+      message: `Script load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_script(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+function css_test(frame, url, cross_origin, expected_mode,
+                  expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      cross_origin: cross_origin,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'style',
+      message: `CSS load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_css(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+function font_face_test(frame, url, expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'font',
+      message: `FontFace load (url: ${actual_url})`
+    };
+  frame.contentWindow.load_font(actual_url);
+  return add_promise_to_test(actual_url);
+}
+
+function script_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'no-cors',
+      credentials: 'include',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Script load (url:${actual_url})`
+    };
+  frame.contentWindow.load_script_with_integrity(actual_url, integrity, /*type=*/null);
+  return add_promise_to_test(actual_url);
+}
+
+function module_script_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + "_module";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.load_script_with_integrity(actual_url, integrity, "module");
+  return add_promise_to_test(actual_url);
+}
+
+function modulepreload_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + "_modulepreload";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.load_modulepreload_with_integrity(actual_url, integrity);
+  return add_promise_to_test(actual_url);
+}
+
+function import_module_integrity_test(frame, url, expected_integrity) {
+  const actual_url = url + "_moduleimport";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.import_modulescript(actual_url);
+  return add_promise_to_test(actual_url);
+}
+
+function import_dynamic_module_integrity_test(frame, url, expected_integrity) {
+  const actual_url = url + "_moduleimportdynamic";
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'cors',
+      credentials: 'same-origin',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'script',
+      message: `Module Script load (url:${actual_url})`
+    };
+  frame.contentWindow.import_dynamic_modulescript(actual_url);
+  return add_promise_to_test(actual_url);
+}
+
+function css_integrity_test(frame, url, integrity, expected_integrity) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      url: actual_url,
+      mode: 'no-cors',
+      credentials: 'include',
+      redirect: 'follow',
+      integrity: expected_integrity,
+      destination: 'style',
+      message: `CSS load (url:${actual_url})`
+    };
+  frame.contentWindow.load_css_with_integrity(actual_url, integrity);
+  return add_promise_to_test(actual_url);
+}
+
+function fetch_test(frame, url, mode, credentials,
+                    expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: '',
+      message: `fetch (url:${actual_url} mode:${mode} ` +
+               `credentials:${credentials})`
+    };
+  frame.contentWindow.fetch(
+      new Request(actual_url, {mode: mode, credentials: credentials}));
+  return add_promise_to_test(actual_url);
+}
+
+function audio_test(frame, url, cross_origin,
+                    expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'audio',
+      message: `Audio load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_audio(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+
+function video_test(frame, url, cross_origin,
+                    expected_mode, expected_credentials) {
+  const actual_url = url + (++url_count);
+  expected_results[actual_url] = {
+      mode: expected_mode,
+      credentials: expected_credentials,
+      redirect: 'follow',
+      integrity: '',
+      destination: 'video',
+      message: `Video load (url:${actual_url} cross_origin:${cross_origin})`
+    };
+  frame.contentWindow.load_video(actual_url, cross_origin);
+  return add_promise_to_test(actual_url);
+}
+
+promise_test(async t => {
+  const SCOPE = 'resources/fetch-request-resources-iframe.https.html';
+  const SCRIPT = 'resources/fetch-request-resources-worker.js';
+  const host_info = get_host_info();
+  const LOCAL_URL =
+      host_info['HTTPS_ORIGIN'] + base_path() + 'resources/sample?test';
+  const REMOTE_URL =
+      host_info['HTTPS_REMOTE_ORIGIN'] + base_path() + 'resources/sample?test';
+
+  const registration =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(() => registration.unregister());
+  const worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+
+  await new Promise((resolve, reject) => {
+    const channel = new MessageChannel();
+    channel.port1.onmessage = t.step_func(msg => {
+      if (msg.data.ready) {
+        resolve();
+        return;
+      }
+      const result = msg.data;
+      const expected = expected_results[result.url];
+      if (!expected) {
+        return;
+      }
+      test(() => {
+        assert_equals(
+            result.mode, expected.mode,
+            `mode of must be ${expected.mode}.`);
+        assert_equals(
+            result.credentials, expected.credentials,
+            `credentials of ${expected.message} must be ` +
+            `${expected.credentials}.`);
+        assert_equals(
+            result.redirect, expected.redirect,
+            `redirect mode of ${expected.message} must be ` +
+            `${expected.redirect}.`);
+        assert_equals(
+            result.integrity, expected.integrity,
+            `integrity of ${expected.message} must be ` +
+            `${expected.integrity}.`);
+        assert_equals(
+            result.destination, expected.destination,
+            `destination of ${expected.message} must be ` +
+            `${expected.destination}.`);
+      }, expected.message);
+      expected.resolve();
+      delete expected_results[result.url];
+    });
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+
+  const f = await with_iframe(SCOPE);
+  t.add_cleanup(() => f.remove());
+
+  await image_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await image_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await css_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await css_test(f, REMOTE_URL, '', 'no-cors', 'include');
+
+  await image_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await image_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await image_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await image_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await image_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await script_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await script_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await script_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await script_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await script_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await script_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await css_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await css_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await css_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await css_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await css_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await css_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await font_face_test(f, LOCAL_URL, 'cors', 'same-origin');
+  await font_face_test(f, REMOTE_URL, 'cors', 'same-origin');
+
+  await script_integrity_test(f, LOCAL_URL, '     ', '     ');
+  await script_integrity_test(
+      f, LOCAL_URL,
+      'This is not a valid integrity because it has no dashes',
+      'This is not a valid integrity because it has no dashes');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-', 'sha256-');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-foo?123', 'sha256-foo?123');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-foo sha384-abc ',
+                              'sha256-foo sha384-abc ');
+  await script_integrity_test(f, LOCAL_URL, 'sha256-foo sha256-abc',
+                              'sha256-foo sha256-abc');
+  await module_script_integrity_test(f, LOCAL_URL,
+                                     null,
+                                     'sha384-foobar');
+
+  await modulepreload_integrity_test(f, LOCAL_URL,
+                                     null,
+                                     'sha384-foobar');
+
+  await import_module_integrity_test(f, LOCAL_URL,
+                                     'sha384-foobar');
+
+  await import_dynamic_module_integrity_test(f, LOCAL_URL,
+                                     'sha384-foobar');
+
+  await css_integrity_test(f, LOCAL_URL, '     ', '     ');
+  await css_integrity_test(
+      f, LOCAL_URL,
+      'This is not a valid integrity because it has no dashes',
+      'This is not a valid integrity because it has no dashes');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-', 'sha256-');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-foo?123', 'sha256-foo?123');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-foo sha384-abc ',
+                           'sha256-foo sha384-abc ');
+  await css_integrity_test(f, LOCAL_URL, 'sha256-foo sha256-abc',
+                           'sha256-foo sha256-abc');
+
+  await fetch_test(f, LOCAL_URL, 'same-origin', 'omit', 'same-origin', 'omit');
+  await fetch_test(f, LOCAL_URL, 'same-origin', 'same-origin',
+                   'same-origin', 'same-origin');
+  await fetch_test(f, LOCAL_URL, 'same-origin', 'include',
+                   'same-origin', 'include');
+  await fetch_test(f, LOCAL_URL, 'no-cors', 'omit', 'no-cors', 'omit');
+  await fetch_test(f, LOCAL_URL, 'no-cors', 'same-origin',
+                   'no-cors', 'same-origin');
+  await fetch_test(f, LOCAL_URL, 'no-cors', 'include', 'no-cors', 'include');
+  await fetch_test(f, LOCAL_URL, 'cors', 'omit', 'cors', 'omit');
+  await fetch_test(f, LOCAL_URL, 'cors', 'same-origin', 'cors', 'same-origin');
+  await fetch_test(f, LOCAL_URL, 'cors', 'include', 'cors', 'include');
+  await fetch_test(f, REMOTE_URL, 'no-cors', 'omit', 'no-cors', 'omit');
+  await fetch_test(f, REMOTE_URL, 'no-cors', 'same-origin', 'no-cors', 'same-origin');
+  await fetch_test(f, REMOTE_URL, 'no-cors', 'include', 'no-cors', 'include');
+  await fetch_test(f, REMOTE_URL, 'cors', 'omit', 'cors', 'omit');
+  await fetch_test(f, REMOTE_URL, 'cors', 'same-origin', 'cors', 'same-origin');
+  await fetch_test(f, REMOTE_URL, 'cors', 'include', 'cors', 'include');
+
+  await audio_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await audio_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await audio_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await audio_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await audio_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await audio_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+
+  await video_test(f, LOCAL_URL, '', 'no-cors', 'include');
+  await video_test(f, LOCAL_URL, 'anonymous', 'cors', 'same-origin');
+  await video_test(f, LOCAL_URL, 'use-credentials', 'cors', 'include');
+  await video_test(f, REMOTE_URL, '', 'no-cors', 'include');
+  await video_test(f, REMOTE_URL, 'anonymous', 'cors', 'same-origin');
+  await video_test(f, REMOTE_URL, 'use-credentials', 'cors', 'include');
+}, 'Verify FetchEvent for resources.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-error.https.window.js b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-error.https.window.js
new file mode 100644
index 000000000000..e6c021392866
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-error.https.window.js
@@ -0,0 +1,19 @@
+// META: script=resources/test-helpers.sub.js
+
+"use strict";
+
+promise_test(async t => {
+  const url = "resources/fetch-request-xhr-sync-error-worker.js";
+  const scope = "resources/fetch-request-xhr-sync-iframe.html";
+
+  const registration = await service_worker_unregister_and_register(t, url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  assert_throws_dom("NetworkError", frame.contentWindow.DOMException, () => frame.contentWindow.performSyncXHR("non-existent-stream-1.txt"));
+  assert_throws_dom("NetworkError", frame.contentWindow.DOMException, () => frame.contentWindow.performSyncXHR("non-existent-stream-2.txt"));
+  assert_throws_dom("NetworkError", frame.contentWindow.DOMException, () => frame.contentWindow.performSyncXHR("non-existent-stream-3.txt"));
+}, "Verify synchronous XMLHttpRequest always throws a NetworkError for ReadableStream errors");
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html
new file mode 100644
index 000000000000..9f18096aa29b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>Service Worker: Synchronous XHR on Worker is intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test((t) => {
+    const url = 'resources/fetch-request-xhr-sync-on-worker-worker.js';
+    const scope = 'resources/fetch-request-xhr-sync-on-worker-scope/';
+    const non_existent_file = 'non-existent-file.txt';
+
+    // In Chromium, the service worker scope matching for workers is based on
+    // the URL of the parent HTML. So this test creates an iframe which is
+    // controlled by the service worker first, and creates a worker from the
+    // iframe.
+    return service_worker_unregister_and_register(t, url, scope)
+      .then((registration) => {
+          t.add_cleanup(() => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => { return with_iframe(scope + 'iframe_page'); })
+      .then((frame) => {
+          t.add_cleanup(() => frame.remove());
+          return frame.contentWindow.performSyncXHROnWorker(non_existent_file);
+        })
+      .then((result) => {
+          assert_equals(
+              result.status,
+              200,
+              'HTTP response status code for intercepted request'
+            );
+          assert_equals(
+            result.responseText,
+              'Response from service worker',
+              'HTTP response text for intercepted request'
+            );
+        });
+  }, 'Verify SyncXHR on Worker is intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync.https.html
new file mode 100644
index 000000000000..ec27fb898343
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr-sync.https.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<title>Service Worker: Synchronous XHR is intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var url = 'resources/fetch-request-xhr-sync-worker.js';
+    var scope = 'resources/fetch-request-xhr-sync-iframe.html';
+    var non_existent_file = 'non-existent-file.txt';
+
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return registration.unregister();
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          return new Promise(function(resolve, reject) {
+              t.step_timeout(function() {
+                  var xhr;
+                  try {
+                    xhr = frame.contentWindow.performSyncXHR(non_existent_file);
+                    resolve(xhr);
+                  } catch (err) {
+                    reject(err);
+                  }
+                }, 0);
+            })
+        })
+      .then(function(xhr) {
+          assert_equals(
+              xhr.status,
+              200,
+              'HTTP response status code for intercepted request'
+            );
+          assert_equals(
+              xhr.responseText,
+              'Response from service worker',
+              'HTTP response text for intercepted request'
+            );
+        });
+  }, 'Verify SyncXHR is intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr.https.html
new file mode 100644
index 000000000000..37a457393b05
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-request-xhr.https.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<title>Service Worker: the body of FetchEvent using XMLHttpRequest</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe-sub"></script>
+<script>
+let frame;
+
+// Set up the service worker and the frame.
+promise_test(t => {
+    const kScope = 'resources/fetch-request-xhr-iframe.https.html';
+    const kScript = 'resources/fetch-request-xhr-worker.js';
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          return with_iframe(kScope);
+        })
+      .then(f => {
+          frame = f;
+          add_completion_callback(() => { f.remove(); });
+        });
+  }, 'initialize global state');
+
+// Run the tests.
+promise_test(t => {
+    return frame.contentWindow.get_header_test();
+  }, 'event.request has the expected headers for same-origin GET.');
+
+promise_test(t => {
+    return frame.contentWindow.post_header_test();
+  }, 'event.request has the expected headers for same-origin POST.');
+
+promise_test(t => {
+    return frame.contentWindow.cross_origin_get_header_test();
+  }, 'event.request has the expected headers for cross-origin GET.');
+
+promise_test(t => {
+    return frame.contentWindow.cross_origin_post_header_test();
+  }, 'event.request has the expected headers for cross-origin POST.');
+
+promise_test(t => {
+    return frame.contentWindow.string_test();
+  }, 'FetchEvent#request.body contains XHR request data (string)');
+
+promise_test(t => {
+    return frame.contentWindow.blob_test();
+  }, 'FetchEvent#request.body contains XHR request data (blob)');
+
+promise_test(t => {
+    return frame.contentWindow.custom_method_test();
+  }, 'FetchEvent#request.method is set to XHR method');
+
+promise_test(t => {
+    return frame.contentWindow.options_method_test();
+  }, 'XHR using OPTIONS method');
+
+promise_test(t => {
+    return frame.contentWindow.form_data_test();
+  }, 'XHR with form data');
+
+promise_test(t => {
+    return frame.contentWindow.mode_credentials_test();
+  }, 'XHR with mode/credentials set');
+
+promise_test(t => {
+    return frame.contentWindow.data_url_test();
+  }, 'XHR to data URL');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-response-taint.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-response-taint.https.html
new file mode 100644
index 000000000000..8e190f48506c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-response-taint.https.html
@@ -0,0 +1,223 @@
+<!DOCTYPE html>
+<title>Service Worker: Tainting of responses fetched via SW.</title>
+<!-- This test makes a large number of requests sequentially. -->
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+var BASE_ORIGIN = host_info.HTTPS_ORIGIN;
+var OTHER_ORIGIN = host_info.HTTPS_REMOTE_ORIGIN;
+var BASE_URL = BASE_ORIGIN + base_path() +
+               'resources/fetch-access-control.py?';
+var OTHER_BASE_URL = OTHER_ORIGIN + base_path() +
+                     'resources/fetch-access-control.py?';
+
+function frame_fetch(frame, url, mode, credentials) {
+  var foreignPromise = frame.contentWindow.fetch(
+      new Request(url, {mode: mode, credentials: credentials}))
+
+  // Event loops should be shared between contexts of similar origin, not all
+  // browsers adhere to this expectation at the time of this writing. Incorrect
+  // behavior in this regard can interfere with test execution when the
+  // provided iframe is removed from the document.
+  //
+  // WPT maintains a test dedicated the expected treatment of event loops, so
+  // the following workaround is acceptable in this context.
+  return Promise.resolve(foreignPromise);
+}
+
+var login_and_register;
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-response-taint-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var registration;
+
+    login_and_register = login_https(t, host_info.HTTPS_ORIGIN, host_info.HTTPS_REMOTE_ORIGIN)
+      .then(function() {
+          return service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+        })
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(f) {
+          // This test should not be considered complete until after the
+          // service worker has been unregistered. Currently, `testharness.js`
+          // does not support asynchronous global "tear down" logic, so this
+          // must be expressed using a dedicated `promise_test`. Because the
+          // other sub-tests in this file are declared synchronously, this
+          // test will be the final test executed.
+          promise_test(function(t) {
+              f.remove();
+              return registration.unregister();
+            }, 'restore global state');
+
+          return f;
+        });
+    return login_and_register;
+  }, 'initialize global state');
+
+function ng_test(url, mode, credentials) {
+  promise_test(function(t) {
+      return login_and_register
+        .then(function(frame) {
+            var fetchRequest = frame_fetch(frame, url, mode, credentials);
+            return promise_rejects_js(t, frame.contentWindow.TypeError, fetchRequest);
+          });
+    }, 'url:\"' + url + '\" mode:\"' + mode +
+       '\" credentials:\"' + credentials + '\" should fail.');
+}
+
+function ok_test(url, mode, credentials, expected_type, expected_username) {
+  promise_test(function() {
+      return login_and_register.then(function(frame) {
+            return frame_fetch(frame, url, mode, credentials)
+          })
+        .then(function(res) {
+            assert_equals(res.type, expected_type, 'response type');
+            return res.text();
+          })
+        .then(function(text) {
+            if (expected_type == 'opaque') {
+              assert_equals(text, '');
+            } else {
+              return new Promise(function(resolve) {
+                    var report = resolve;
+                    // text must contain report() call.
+                    eval(text);
+                  })
+                .then(function(result) {
+                    assert_equals(result.username, expected_username);
+                  });
+            }
+          });
+    }, 'fetching url:\"' + url + '\" mode:\"' + mode +
+                        '\" credentials:\"' + credentials + '\" should ' +
+                        'succeed.');
+}
+
+function build_rewrite_url(origin, url, mode, credentials) {
+  return origin + '/?url=' + encodeURIComponent(url) + '&mode=' + mode +
+      '&credentials=' + credentials + '&';
+}
+
+function for_each_origin_mode_credentials(callback) {
+  [BASE_ORIGIN, OTHER_ORIGIN].forEach(function(origin) {
+      ['same-origin', 'no-cors', 'cors'].forEach(function(mode) {
+          ['omit', 'same-origin', 'include'].forEach(function(credentials) {
+              callback(origin, mode, credentials);
+            });
+        });
+    });
+}
+
+ok_test(BASE_URL, 'same-origin', 'omit', 'basic', 'undefined');
+ok_test(BASE_URL, 'same-origin', 'same-origin', 'basic', 'username2s');
+ok_test(BASE_URL, 'same-origin', 'include', 'basic', 'username2s');
+ok_test(BASE_URL, 'no-cors', 'omit', 'basic', 'undefined');
+ok_test(BASE_URL, 'no-cors', 'same-origin', 'basic', 'username2s');
+ok_test(BASE_URL, 'no-cors', 'include', 'basic', 'username2s');
+ok_test(BASE_URL, 'cors', 'omit', 'basic', 'undefined');
+ok_test(BASE_URL, 'cors', 'same-origin', 'basic', 'username2s');
+ok_test(BASE_URL, 'cors', 'include', 'basic', 'username2s');
+ng_test(OTHER_BASE_URL, 'same-origin', 'omit');
+ng_test(OTHER_BASE_URL, 'same-origin', 'same-origin');
+ng_test(OTHER_BASE_URL, 'same-origin', 'include');
+ok_test(OTHER_BASE_URL, 'no-cors', 'omit', 'opaque');
+ok_test(OTHER_BASE_URL, 'no-cors', 'same-origin', 'opaque');
+ok_test(OTHER_BASE_URL, 'no-cors', 'include', 'opaque');
+ng_test(OTHER_BASE_URL, 'cors', 'omit');
+ng_test(OTHER_BASE_URL, 'cors', 'same-origin');
+ng_test(OTHER_BASE_URL, 'cors', 'include');
+ok_test(OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'omit', 'cors', 'undefined');
+ok_test(OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'same-origin', 'cors',
+        'undefined');
+ng_test(OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'include');
+ok_test(OTHER_BASE_URL + 'ACAOrigin=' + BASE_ORIGIN + '&ACACredentials=true',
+        'cors', 'include', 'cors', 'username1s')
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, BASE_URL, 'same-origin', 'omit');
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else {
+    // The response type from the SW should be basic
+    ok_test(url, mode, credentials, 'basic', 'undefined');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, BASE_URL, 'same-origin', 'same-origin');
+
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else {
+    // The response type from the SW should be basic.
+    ok_test(url, mode, credentials, 'basic', 'username2s');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, OTHER_BASE_URL, 'same-origin', 'omit');
+  // The response from the SW should be an error.
+  ng_test(url, mode, credentials);
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, OTHER_BASE_URL, 'no-cors', 'omit');
+
+  // SW can respond only to no-cors requests.
+  if (mode != 'no-cors') {
+    ng_test(url, mode, credentials);
+  } else {
+    // The response type from the SW should be opaque.
+    ok_test(url, mode, credentials, 'opaque');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin, OTHER_BASE_URL + 'ACAOrigin=*', 'cors', 'omit');
+
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else if (origin == BASE_ORIGIN && mode == 'same-origin') {
+    // Cors type response to a same-origin mode request should fail
+    ng_test(url, mode, credentials);
+  } else {
+    // The response from the SW should be cors.
+    ok_test(url, mode, credentials, 'cors', 'undefined');
+  }
+});
+
+for_each_origin_mode_credentials(function(origin, mode, credentials) {
+  var url = build_rewrite_url(
+      origin,
+      OTHER_BASE_URL + 'ACAOrigin=' + BASE_ORIGIN +
+      '&ACACredentials=true',
+      'cors', 'include');
+  // Fetch to the other origin with same-origin mode should fail.
+  if (origin == OTHER_ORIGIN && mode == 'same-origin') {
+    ng_test(url, mode, credentials);
+  } else if (origin == BASE_ORIGIN && mode == 'same-origin') {
+    // Cors type response to a same-origin mode request should fail
+    ng_test(url, mode, credentials);
+  } else {
+    // The response from the SW should be cors.
+    ok_test(url, mode, credentials, 'cors', 'username1s');
+  }
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-response-xhr.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-response-xhr.https.html
new file mode 100644
index 000000000000..891eb029422b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-response-xhr.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>Service Worker: the response of FetchEvent using XMLHttpRequest</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/fetch-response-xhr-iframe.https.html';
+    var SCRIPT = 'resources/fetch-response-xhr-worker.js';
+    var host_info = get_host_info();
+
+    window.addEventListener('message', t.step_func(on_message), false);
+    function on_message(e) {
+      assert_equals(e.data.results, 'foo, bar');
+      e.source.postMessage('ACK', host_info['HTTPS_ORIGIN']);
+    }
+
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          var channel;
+
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          channel = new MessageChannel();
+          var onPortMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage('START',
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+
+          return onPortMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-waits-for-activate.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-waits-for-activate.https.html
new file mode 100644
index 000000000000..7c888450f0d5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-waits-for-activate.https.html
@@ -0,0 +1,128 @@
+<!DOCTYPE html>
+<title>Service Worker: Fetch Event Waits for Activate Event</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const worker_url = 'resources/fetch-waits-for-activate-worker.js';
+const normalized_worker_url = normalizeURL(worker_url);
+const worker_scope = 'resources/fetch-waits-for-activate/';
+
+// Resolves with the Service Worker's registration once it's reached the
+// "activating" state. (The Service Worker should remain "activating" until
+// explicitly told advance to the "activated" state).
+async function registerAndWaitForActivating(t) {
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, worker_scope);
+  t.add_cleanup(() => service_worker_unregister(t, worker_scope));
+
+  await wait_for_state(t, registration.installing, 'activating');
+
+  return registration;
+}
+
+// Attempts to ensure that the "Handle Fetch" algorithm has reached the step
+//
+//   "If activeWorker’s state is "activating", wait for activeWorker’s state to
+//    become "activated"."
+//
+// by waiting for some time to pass.
+//
+// WARNING: whether the algorithm has reached that step isn't directly
+// observable, so this is best effort and can race. Note that this can only
+// result in false positives (where the algorithm hasn't reached that step yet
+// and any functional events haven't actually been handled by the Service
+// Worker).
+async function ensureFunctionalEventsAreWaiting(registration) {
+  await (new Promise(resolve => { setTimeout(resolve, 1000); }));
+
+  assert_equals(registration.active.scriptURL, normalized_worker_url,
+                'active worker should be present');
+  assert_equals(registration.active.state, 'activating',
+                'active worker should be in activating state');
+}
+
+promise_test(async t => {
+  const registration = await registerAndWaitForActivating(t);
+
+  let frame = null;
+  t.add_cleanup(() => {
+    if (frame) {
+      frame.remove();
+    }
+  });
+
+  // This should block until we message the worker to tell it to complete
+  // the activate event.
+  const frameLoadPromise = with_iframe(worker_scope).then(function(f) {
+    frame = f;
+  });
+
+  await ensureFunctionalEventsAreWaiting(registration);
+  assert_equals(frame, null, 'frame should not be loaded');
+
+  registration.active.postMessage('ACTIVATE');
+
+  await frameLoadPromise;
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+                normalized_worker_url,
+                'frame should now be loaded and controlled');
+  assert_equals(registration.active.state, 'activated',
+                'active worker should be in activated state');
+}, 'Navigation fetch events should wait for the activate event to complete.');
+
+promise_test(async t => {
+  const frame = await with_iframe(worker_scope);
+  t.add_cleanup(() => { frame.remove(); });
+
+  const registration = await registerAndWaitForActivating(t);
+
+  // Make the Service Worker control the frame so the frame can perform an
+  // intercepted fetch.
+  await (new Promise(resolve => {
+    navigator.serviceWorker.onmessage = e => {
+      assert_equals(
+        frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+        normalized_worker_url, 'frame should be controlled');
+      resolve();
+    };
+
+    registration.active.postMessage('CLAIM');
+  }));
+
+  const fetch_url = `${worker_scope}non/existent/path`;
+  const expected_fetch_result = 'Hello world';
+  let fetch_promise_settled = false;
+
+  // This should block until we message the worker to tell it to complete
+  // the activate event.
+  const fetchPromise = frame.contentWindow.fetch(fetch_url, {
+    method: 'POST',
+    body: expected_fetch_result,
+  }).then(response => {
+    fetch_promise_settled = true;
+    return response;
+  });
+
+  await ensureFunctionalEventsAreWaiting(registration);
+  assert_false(fetch_promise_settled,
+               "fetch()-ing a Service Worker-controlled scope shouldn't have " +
+               "settled yet");
+
+  registration.active.postMessage('ACTIVATE');
+
+  const response = await fetchPromise;
+  assert_equals(await response.text(), expected_fetch_result,
+                "Service Worker should have responded to request to" +
+                fetch_url)
+  assert_equals(registration.active.state, 'activated',
+                'active worker should be in activated state');
+}, 'Subresource fetch events should wait for the activate event to complete.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/fetch-with-body.https.html b/test/fixtures/wpt/service-workers/service-worker/fetch-with-body.https.html
new file mode 100644
index 000000000000..21ded3f32725
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/fetch-with-body.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const SCRIPT = 'resources/fetch-with-body-worker.js';
+const SCOPE = 'resources/blank.html';
+
+let frame, registration;
+
+promise_test(async t => {
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  registration = await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  await wait_for_state(t, registration.installing, 'activating');
+  frame = await with_iframe(SCOPE);
+
+  const request1 = new Request("resources/fetch-with-body-worker.py", {
+    method: "GET",
+  });
+
+  const response1 = await frame.contentWindow.fetch(request1);
+  assert_false(response1.ok);
+
+  const request2 = new Request("resources/fetch-with-body-worker.py", {
+    method: "POST",
+    body: "BODY",
+    headers: { "Content-Type": "text/ascii" },
+  });
+
+  const response2 = await frame.contentWindow.fetch(request2);
+  assert_true(response2.ok);
+}, 'Validate body is preserved');
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/getregistration.https.html b/test/fixtures/wpt/service-workers/service-worker/getregistration.https.html
new file mode 100644
index 000000000000..634c2efa1246
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/getregistration.https.html
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+async_test(function(t) {
+    var documentURL = 'no-such-worker';
+    navigator.serviceWorker.getRegistration(documentURL)
+      .then(function(value) {
+          assert_equals(value, undefined,
+                        'getRegistration should resolve with undefined');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'getRegistration');
+
+promise_test(function(t) {
+    var scope = 'resources/scope/getregistration/normal';
+    var registration;
+    return service_worker_unregister_and_register(t, 'resources/empty-worker.js',
+                                                  scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(value) {
+          assert_equals(
+              value, registration,
+              'getRegistration should resolve to the same registration object');
+        });
+  }, 'Register then getRegistration');
+
+promise_test(function(t) {
+    var scope = 'resources/scope/getregistration/url-with-fragment';
+    var documentURL = scope + '#ref';
+    var registration;
+    return service_worker_unregister_and_register(t, 'resources/empty-worker.js',
+                                                  scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return navigator.serviceWorker.getRegistration(documentURL);
+        })
+      .then(function(value) {
+          assert_equals(
+              value, registration,
+              'getRegistration should resolve to the same registration object');
+        });
+  }, 'Register then getRegistration with a URL having a fragment');
+
+async_test(function(t) {
+    var documentURL = 'http://example.com/';
+    navigator.serviceWorker.getRegistration(documentURL)
+      .then(function() {
+          assert_unreached(
+              'getRegistration with an out of origin URL should fail');
+      }, function(reason) {
+          assert_equals(
+              reason.name, 'SecurityError',
+              'getRegistration with an out of origin URL should fail');
+          t.done();
+      })
+      .catch(unreached_rejection(t));
+  }, 'getRegistration with a cross origin URL');
+
+async_test(function(t) {
+    var scope = 'resources/scope/getregistration/register-unregister';
+    service_worker_unregister_and_register(t, 'resources/empty-worker.js',
+                                           scope)
+      .then(function(registration) {
+          return registration.unregister();
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(value) {
+          assert_equals(value, undefined,
+                        'getRegistration should resolve with undefined');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then Unregister then getRegistration');
+
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/getregistration/register-unregister';
+  const registration = await service_worker_unregister_and_register(
+    t, 'resources/empty-worker.js', scope
+  );
+
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const frameNav = frame.contentWindow.navigator;
+  await registration.unregister();
+  const value = await frameNav.serviceWorker.getRegistration(scope);
+
+  assert_equals(value, undefined, 'getRegistration should resolve with undefined');
+}, 'Register then Unregister then getRegistration in controlled iframe');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/getregistrations.https.html b/test/fixtures/wpt/service-workers/service-worker/getregistrations.https.html
new file mode 100644
index 000000000000..3a9b9a23317b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/getregistrations.https.html
@@ -0,0 +1,134 @@
+<!DOCTYPE html>
+<title>Service Worker: getRegistrations()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+// Purge the existing registrations for the origin.
+// getRegistrations() is used in order to avoid adding additional complexity
+// e.g. adding an internal function.
+promise_test(async () => {
+  const registrations = await navigator.serviceWorker.getRegistrations();
+  await Promise.all(registrations.map(r => r.unregister()));
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, [],
+      'getRegistrations should resolve with an empty array.');
+}, 'registrations are not returned following unregister');
+
+promise_test(async t => {
+  const scope = 'resources/scope/getregistrations/normal';
+  const script = 'resources/empty-worker.js';
+  const registrations = [
+      await service_worker_unregister_and_register(t, script, scope)];
+  t.add_cleanup(() => registrations[0].unregister());
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(value, registrations,
+      'getRegistrations should resolve with an array of registrations');
+}, 'Register then getRegistrations');
+
+promise_test(async t => {
+  const scope1 = 'resources/scope/getregistrations/scope1';
+  const scope2 = 'resources/scope/getregistrations/scope2';
+  const scope3 = 'resources/scope/getregistrations/scope12';
+
+  const script = 'resources/empty-worker.js';
+  t.add_cleanup(() => service_worker_unregister(t, scope1));
+  t.add_cleanup(() => service_worker_unregister(t, scope2));
+  t.add_cleanup(() => service_worker_unregister(t, scope3));
+
+  const registrations = [
+      await service_worker_unregister_and_register(t, script, scope1),
+      await service_worker_unregister_and_register(t, script, scope2),
+      await service_worker_unregister_and_register(t, script, scope3),
+  ];
+
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(value, registrations);
+}, 'Register multiple times then getRegistrations');
+
+promise_test(async t => {
+  const scope = 'resources/scope/getregistrations/register-unregister';
+  const script = 'resources/empty-worker.js';
+  const registration = await service_worker_unregister_and_register(t, script, scope);
+  await registration.unregister();
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, [], 'getRegistrations should resolve with an empty array.');
+}, 'Register then Unregister then getRegistrations');
+
+promise_test(async t => {
+  const scope = 'resources/scope/getregistrations/register-unregister-controlled';
+  const script = 'resources/empty-worker.js';
+  const registration = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Create a frame controlled by the service worker and unregister the
+  // worker.
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+  await registration.unregister();
+
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, [],
+      'getRegistrations should resolve with an empty array.');
+  assert_equals(registration.installing, null);
+  assert_equals(registration.waiting, null);
+  assert_equals(registration.active.state, 'activated');
+}, 'Register then Unregister with controlled frame then getRegistrations');
+
+promise_test(async t => {
+  const host_info = get_host_info();
+  // Rewrite the url to point to remote origin.
+  const frame_same_origin_url = new URL("resources/frame-for-getregistrations.html", window.location);
+  const frame_url = host_info['HTTPS_REMOTE_ORIGIN'] + frame_same_origin_url.pathname;
+  const scope = 'resources/scope-for-getregistrations';
+  const script = 'resources/empty-worker.js';
+
+  // Loads an iframe and waits for 'ready' message from it to resolve promise.
+  // Caller is responsible for removing frame.
+  function with_iframe_ready(url) {
+      return new Promise(resolve => {
+          const frame = document.createElement('iframe');
+          frame.src = url;
+          window.addEventListener('message', function onMessage(e) {
+            window.removeEventListener('message', onMessage);
+            if (e.data == 'ready') {
+              resolve(frame);
+            }
+          });
+          document.body.appendChild(frame);
+      });
+  }
+
+  // We need this special frame loading function because the frame is going
+  // to register it's own service worker and there is the possibility that that
+  // register() finishes after the register() for the same domain later in the
+  // test. So we have to wait until the cross origin register() is done, and not
+  // just until the frame loads.
+  const frame = await with_iframe_ready(frame_url);
+  t.add_cleanup(async () => {
+    // Wait until the cross-origin worker is unregistered.
+    let resolve;
+    const channel = new MessageChannel();
+    channel.port1.onmessage = e => {
+      if (e.data == 'unregistered')
+        resolve();
+    };
+    frame.contentWindow.postMessage('unregister', '*', [channel.port2]);
+    await new Promise(r => { resolve = r; });
+
+    frame.remove();
+  });
+
+  const registrations = [
+    await service_worker_unregister_and_register(t, script, scope)];
+  t.add_cleanup(() => registrations[0].unregister());
+  const value = await navigator.serviceWorker.getRegistrations();
+  assert_array_equals(
+      value, registrations,
+      'getRegistrations should only return same origin registrations.');
+}, 'getRegistrations promise resolves only with same origin registrations.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/global-serviceworker.https.any.js b/test/fixtures/wpt/service-workers/service-worker/global-serviceworker.https.any.js
new file mode 100644
index 000000000000..19d77847c426
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/global-serviceworker.https.any.js
@@ -0,0 +1,53 @@
+// META: title=serviceWorker on service worker global
+// META: global=serviceworker
+
+test(() => {
+  assert_equals(registration.installing, null, 'registration.installing');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.active, null, 'registration.active');
+  assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+  assert_equals(serviceWorker.state, 'parsed', 'serviceWorker.state');
+  assert_readonly(self, 'serviceWorker', `self.serviceWorker is read only`);
+}, 'First run');
+
+// Cache this for later tests.
+const initialServiceWorker = self.serviceWorker;
+
+async_test((t) => {
+  assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+  serviceWorker.postMessage({ messageTest: true });
+
+  // The rest of the test runs once this receives the above message.
+  addEventListener('message', t.step_func((event) => {
+    // Ignore unrelated messages.
+    if (!event.data.messageTest) return;
+    assert_equals(event.source, serviceWorker, 'event.source');
+    t.done();
+  }));
+}, 'Can post message to self during startup');
+
+// The test is registered now so there isn't a race condition when collecting tests, but the asserts
+// don't happen until the 'install' event fires.
+async_test((t) => {
+  addEventListener('install', t.step_func_done(() => {
+    assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+    assert_equals(serviceWorker, initialServiceWorker, `self.serviceWorker hasn't changed`);
+    assert_equals(registration.installing, serviceWorker, 'registration.installing');
+    assert_equals(registration.waiting, null, 'registration.waiting');
+    assert_equals(registration.active, null, 'registration.active');
+    assert_equals(serviceWorker.state, 'installing', 'serviceWorker.state');
+  }));
+}, 'During install');
+
+// The test is registered now so there isn't a race condition when collecting tests, but the asserts
+// don't happen until the 'activate' event fires.
+async_test((t) => {
+  addEventListener('activate', t.step_func_done(() => {
+    assert_true('serviceWorker' in self, 'self.serviceWorker exists');
+    assert_equals(serviceWorker, initialServiceWorker, `self.serviceWorker hasn't changed`);
+    assert_equals(registration.installing, null, 'registration.installing');
+    assert_equals(registration.waiting, null, 'registration.waiting');
+    assert_equals(registration.active, serviceWorker, 'registration.active');
+    assert_equals(serviceWorker.state, 'activating', 'serviceWorker.state');
+  }));
+}, 'During activate');
diff --git a/test/fixtures/wpt/service-workers/service-worker/historical.https.any.js b/test/fixtures/wpt/service-workers/service-worker/historical.https.any.js
new file mode 100644
index 000000000000..20b3ddfbf7b8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/historical.https.any.js
@@ -0,0 +1,5 @@
+// META: global=serviceworker
+
+test((t) => {
+  assert_false('targetClientId' in FetchEvent.prototype)
+}, 'targetClientId should not be on FetchEvent');
diff --git a/test/fixtures/wpt/service-workers/service-worker/http-to-https-redirect-and-register.https.html b/test/fixtures/wpt/service-workers/service-worker/http-to-https-redirect-and-register.https.html
new file mode 100644
index 000000000000..5626237dcccb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/http-to-https-redirect-and-register.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>register on a secure page after redirect from an non-secure url</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+var host_info = get_host_info();
+
+// Loads a non-secure url in a new window, which redirects to |target_url|.
+// That page then registers a service worker, and messages back with the result.
+// Returns a promise that resolves with the result.
+function redirect_and_register(target_url) {
+  var redirect_url = host_info.HTTP_REMOTE_ORIGIN + base_path() +
+    'resources/redirect.py?Redirect=';
+  var child = window.open(redirect_url + encodeURIComponent(target_url));
+  return new Promise(resolve => {
+        window.addEventListener('message', e => resolve(e.data));
+      })
+    .then(function(result) {
+        child.close();
+        return result;
+      });
+}
+
+promise_test(function(t) {
+  var target_url = window.location.origin + base_path() +
+      'resources/http-to-https-redirect-and-register-iframe.html';
+
+    return redirect_and_register(target_url)
+      .then(result => {
+          assert_equals(result, 'OK');
+        });
+  }, 'register on a secure page after redirect from an non-secure url');
+
+promise_test(function(t) {
+    var target_url = host_info.HTTP_REMOTE_ORIGIN + base_path() +
+      'resources/http-to-https-redirect-and-register-iframe.html';
+
+    return redirect_and_register(target_url)
+      .then(result => {
+          assert_equals(result, 'FAIL: navigator.serviceWorker is undefined');
+        });
+  }, 'register on a non-secure page after redirect from an non-secure url');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/immutable-prototype-serviceworker.https.html b/test/fixtures/wpt/service-workers/service-worker/immutable-prototype-serviceworker.https.html
new file mode 100644
index 000000000000..e63f6b348a86
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/immutable-prototype-serviceworker.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+'use strict';
+
+let expected = ['immutable', 'immutable', 'immutable', 'immutable', 'immutable'];
+
+promise_test(t =>
+  navigator.serviceWorker.register('resources/immutable-prototype-serviceworker.js', {scope: './resources/'})
+      .then(registration => {
+    let worker = registration.installing || registration.waiting || registration.active;
+    let channel = new MessageChannel()
+    worker.postMessage(channel.port2, [channel.port2]);
+    let resolve;
+    let promise = new Promise(r => resolve = r);
+    channel.port1.onmessage = resolve;
+    return promise.then(result => assert_array_equals(expected, result.data));
+  }),
+'worker prototype chain should be immutable');
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-cross-origin.https.html
new file mode 100644
index 000000000000..773708a9fbce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-cross-origin.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: cross-origin</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async t => {
+    const scope = 'resources/import-scripts-cross-origin';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-cross-origin-worker.sub.js', { scope: scope });
+    t.add_cleanup(_ => reg.unregister());
+    assert_not_equals(reg.installing, null, 'worker is installing');
+  }, 'importScripts() supports cross-origin requests');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-data-url.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-data-url.https.html
new file mode 100644
index 000000000000..f0922193dd01
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-data-url.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: data: URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async t => {
+    const scope = 'resources/import-scripts-data-url';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-data-url-worker.js', { scope: scope });
+    t.add_cleanup(_ => reg.unregister());
+    assert_not_equals(reg.installing, null, 'worker is installing');
+  }, 'importScripts() supports data URLs');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-mime-types.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-mime-types.https.html
new file mode 100644
index 000000000000..1679831d0f2b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-mime-types.https.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: MIME types</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+/**
+ * Test that a Service Worker's importScript() only accepts valid MIME types.
+ */
+let serviceWorker = null;
+
+promise_test(async t => {
+  const scope = 'resources/import-scripts-mime-types';
+  const registration = await service_worker_unregister_and_register(t,
+    'resources/import-scripts-mime-types-worker.js', scope);
+
+  add_completion_callback(() => { registration.unregister(); });
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  serviceWorker = registration.active;
+}, 'Global setup');
+
+promise_test(async t => {
+  await fetch_tests_from_worker(serviceWorker);
+}, 'Fetch importScripts tests from service worker')
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-redirect.https.html
new file mode 100644
index 000000000000..07ea49439eba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-redirect.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: redirect</title>
+<script src="/common/utils.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async t => {
+    const scope = 'resources/import-scripts-redirect';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-redirect-worker.js', { scope: scope });
+    assert_not_equals(reg.installing, null, 'worker is installing');
+    await reg.unregister();
+  }, 'importScripts() supports redirects');
+
+promise_test(async t => {
+    const scope = 'resources/import-scripts-redirect';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      'resources/import-scripts-redirect-worker.js', { scope: scope });
+    assert_not_equals(reg.installing, null, 'before update');
+    await wait_for_state(t, reg.installing, 'activated');
+    await Promise.all([
+      wait_for_update(t, reg),
+      reg.update()
+    ]);
+    assert_not_equals(reg.installing, null, 'after update');
+    await reg.unregister();
+  },
+  "an imported script redirects, and the body changes during the update check");
+
+promise_test(async t => {
+    const key = token();
+    const scope = 'resources/import-scripts-redirect';
+    await service_worker_unregister(t, scope);
+    let reg = await navigator.serviceWorker.register(
+      `resources/import-scripts-redirect-on-second-time-worker.js?Key=${key}`,
+      { scope });
+    t.add_cleanup(() => reg.unregister());
+
+    assert_not_equals(reg.installing, null, 'before update');
+    await wait_for_state(t, reg.installing, 'activated');
+    await Promise.all([
+      wait_for_update(t, reg),
+      reg.update()
+    ]);
+    assert_not_equals(reg.installing, null, 'after update');
+  },
+  "an imported script doesn't redirect initially, then redirects during " +
+  "the update check and the body changes");
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-resource-map.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-resource-map.https.html
new file mode 100644
index 000000000000..4742bd012683
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-resource-map.https.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<title>Tests for importScripts: script resource map</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+  <script>
+    // This test registers a worker that imports a script multiple times. The
+    // script should be stored on the first import and thereafter that stored
+    // script should be loaded. The worker asserts that the stored script was
+    // loaded; if the assert fails then registration fails.
+
+    promise_test(async t => {
+      const SCOPE = "resources/import-scripts-resource-map";
+      const SCRIPT = "resources/import-scripts-resource-map-worker.js";
+      await service_worker_unregister(t, SCOPE);
+      const registration = await navigator.serviceWorker.register(SCRIPT, {
+        scope: SCOPE
+      });
+      await registration.unregister();
+    }, "import the same script URL multiple times");
+
+    promise_test(async t => {
+      const SCOPE = "resources/import-scripts-diff-resource-map";
+      const SCRIPT = "resources/import-scripts-diff-resource-map-worker.js";
+      await service_worker_unregister(t, SCOPE);
+      const registration = await navigator.serviceWorker.register(SCRIPT, {
+        scope: SCOPE
+      });
+      await registration.unregister();
+    }, "call importScripts() with multiple arguments");
+  </script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/import-scripts-updated-flag.https.html b/test/fixtures/wpt/service-workers/service-worker/import-scripts-updated-flag.https.html
new file mode 100644
index 000000000000..09b4496aa0ec
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/import-scripts-updated-flag.https.html
@@ -0,0 +1,83 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: import scripts updated flag</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This test registers a worker that calls importScripts at various stages of
+// service worker lifetime. The sub-tests trigger subsequent `importScript`
+// invocations via the `message` event.
+
+var register;
+
+function post_and_wait_for_reply(worker, message) {
+  return new Promise(resolve => {
+      navigator.serviceWorker.onmessage = e => { resolve(e.data); };
+      worker.postMessage(message);
+    });
+}
+
+promise_test(function(t) {
+    const scope = 'resources/import-scripts-updated-flag';
+    let registration;
+
+    register = service_worker_unregister_and_register(
+        t, 'resources/import-scripts-updated-flag-worker.js', scope)
+      .then(r => {
+          registration = r;
+          add_completion_callback(() => { registration.unregister(); });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          // This test should not be considered complete until after the
+          // service worker has been unregistered. Currently, `testharness.js`
+          // does not support asynchronous global "tear down" logic, so this
+          // must be expressed using a dedicated `promise_test`. Because the
+          // other sub-tests in this file are declared synchronously, this test
+          // will be the final test executed.
+          promise_test(function(t) {
+              return registration.unregister();
+            });
+
+          return registration.active;
+        });
+
+    return register;
+  }, 'initialize global state');
+
+promise_test(t => {
+    return register
+      .then(function(worker) {
+          return post_and_wait_for_reply(worker, 'root-and-message');
+        })
+      .then(result => {
+          assert_equals(result.error, null);
+          assert_equals(result.value, 'root-and-message');
+        });
+  }, 'import script previously imported at worker evaluation time');
+
+promise_test(t => {
+    return register
+      .then(function(worker) {
+          return post_and_wait_for_reply(worker, 'install-and-message');
+        })
+      .then(result => {
+          assert_equals(result.error, null);
+          assert_equals(result.value, 'install-and-message');
+        });
+  }, 'import script previously imported at worker install time');
+
+promise_test(t => {
+    return register
+      .then(function(worker) {
+          return post_and_wait_for_reply(worker, 'message');
+        })
+      .then(result => {
+          assert_equals(result.error, 'NetworkError');
+          assert_equals(result.value, null);
+        });
+  }, 'import script not previously imported');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/indexeddb.https.html b/test/fixtures/wpt/service-workers/service-worker/indexeddb.https.html
new file mode 100644
index 000000000000..be9be4968f7b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/indexeddb.https.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<title>Service Worker: Indexed DB</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function readDB() {
+  return new Promise(function(resolve, reject) {
+      var openRequest = indexedDB.open('db');
+
+      openRequest.onerror = reject;
+      openRequest.onsuccess = function() {
+          var db = openRequest.result;
+          var tx = db.transaction('store');
+          var store = tx.objectStore('store');
+          var getRequest = store.get('key');
+
+          getRequest.onerror = function() {
+              db.close();
+              reject(getRequest.error);
+            };
+          getRequest.onsuccess = function() {
+              db.close();
+              resolve(getRequest.result);
+            };
+        };
+    });
+}
+
+function send(worker, action) {
+  return new Promise(function(resolve, reject) {
+      var messageChannel = new MessageChannel();
+      messageChannel.port1.onmessage = function(event) {
+          if (event.data.type === 'error') {
+            reject(event.data.reason);
+          }
+
+          resolve();
+        };
+
+      worker.postMessage(
+        {action: action, port: messageChannel.port2},
+        [messageChannel.port2]);
+    });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html';
+
+    return service_worker_unregister_and_register(
+        t, 'resources/indexeddb-worker.js', scope)
+      .then(function(registration) {
+          var worker = registration.installing;
+
+          promise_test(function() {
+              return registration.unregister();
+            }, 'clean up: registration');
+
+          return send(worker, 'create')
+            .then(function() {
+                promise_test(function() {
+                  return new Promise(function(resolve, reject) {
+                        var delete_request = indexedDB.deleteDatabase('db');
+
+                        delete_request.onsuccess = resolve;
+                        delete_request.onerror = reject;
+                      });
+                    }, 'clean up: database');
+              })
+            .then(readDB)
+            .then(function(value) {
+                assert_equals(
+                  value, 'value',
+                  'The get() result should match what the worker put().');
+              });
+        });
+  }, 'Verify Indexed DB operation in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/install-event-type.https.html b/test/fixtures/wpt/service-workers/service-worker/install-event-type.https.html
new file mode 100644
index 000000000000..7e74af85c3ae
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/install-event-type.https.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_install_event(worker) {
+  return new Promise(function(resolve) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'installed')
+            resolve(true);
+          else if (worker.state == 'redundant')
+            resolve(false);
+        });
+    });
+}
+
+promise_test(function(t) {
+      var script = 'resources/install-event-type-worker.js';
+      var scope = 'resources/install-event-type';
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(function(registration) {
+            return wait_for_install_event(registration.installing);
+          })
+        .then(function(did_install) {
+           assert_true(did_install, 'The worker was installed');
+          })
+    }, 'install event type');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/installing.https.html b/test/fixtures/wpt/service-workers/service-worker/installing.https.html
new file mode 100644
index 000000000000..0f257b6aba4f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/installing.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.installing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/empty-worker.js';
+const SCOPE = 'resources/blank.html';
+
+// "installing" is set
+promise_test(async t => {
+
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  const frame = await with_iframe(SCOPE);
+  const registration =
+      await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  const container = frame.contentWindow.navigator.serviceWorker;
+  assert_equals(container.controller, null, 'controller');
+  assert_equals(registration.active, null, 'registration.active');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.installing.scriptURL, normalizeURL(SCRIPT),
+                'registration.installing.scriptURL');
+  // FIXME: Add a test for a frame created after installation.
+  // Should the existing frame ("frame") block activation?
+}, 'installing is set');
+
+// Tests that The ServiceWorker objects returned from installing attribute getter
+// that represent the same service worker are the same objects.
+promise_test(async t => {
+  const registration1 =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const registration2 = await navigator.serviceWorker.getRegistration(SCOPE);
+  assert_equals(registration1.installing, registration2.installing,
+                'ServiceWorkerRegistration.installing should return the ' +
+                'same object');
+  await registration1.unregister();
+}, 'The ServiceWorker objects returned from installing attribute getter that ' +
+   'represent the same service worker are the same objects');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/intercepted-referrer.https.html b/test/fixtures/wpt/service-workers/service-worker/intercepted-referrer.https.html
new file mode 100644
index 000000000000..72d789451390
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/intercepted-referrer.https.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Service Worker intercepted navigation preserves document.referrer</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+
+<body>
+<h1>Service Worker intercepted navigation preserves document.referrer</h1>
+<script>
+promise_test(async t => {
+  // Scope where the SW will control navigations.
+  // This lives under the same directory as the SW script below.
+  const scope = 'resources/referrer-scope/';
+
+  // Ensure a clean registration, then register the SW.
+  const reg = await service_worker_unregister_and_register(
+      t, 'resources/intercepted-referrer-sw.js', scope);
+
+  // Wait for activation (handles fresh or already-active cases).
+  const worker = reg.installing || reg.waiting || reg.active;
+  await wait_for_state(t, worker, 'activated');
+
+  // We’ll get one message back from the intercepted document.
+  const messagePromise = new Promise(resolve => {
+    window.addEventListener('message', e => resolve(e.data), { once: true });
+  });
+
+  // Create a navigation under the SW’s scope. The SW will synthesize the page.
+  const iframe = document.createElement('iframe');
+  t.add_cleanup(() => iframe.remove());
+  iframe.src = scope + 'navigated.html';
+  document.body.append(iframe);
+
+  const data = await messagePromise;
+
+  // Basic sanity from the child payload.
+  assert_equals(data && data.source, 'sw-intercepted', 'Child payload is from SW response');
+
+  // document.referrer should be the full URL of this test page (same-origin default policy).
+  // WPT servers send same-origin requests with full referrer (default "strict-origin-when-cross-origin").
+  const expectedReferrer = location.href;
+
+  assert_equals(data.referrer, expectedReferrer,
+    'document.referrer inside the SW-synthesized document equals the parent test page URL');
+
+  // Clean up: unregister the SW.
+  t.add_cleanup(() => reg.unregister());
+}, 'document.referrer for a navigation intercepted by a Service Worker is unchanged and matches the parent URL');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/interface-requirements-sw.https.html b/test/fixtures/wpt/service-workers/service-worker/interface-requirements-sw.https.html
new file mode 100644
index 000000000000..eef868c889f0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/interface-requirements-sw.https.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<title>Service Worker Global Scope Interfaces</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+// interface-requirements-worker.sub.js checks additional interface
+// requirements, on top of the basic IDL that is validated in
+// service-workers/idlharness.any.js
+service_worker_test(
+  'resources/interface-requirements-worker.sub.js',
+  'Interfaces and attributes in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/invalid-blobtype.https.html b/test/fixtures/wpt/service-workers/service-worker/invalid-blobtype.https.html
new file mode 100644
index 000000000000..1c5920fb0391
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/invalid-blobtype.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: respondWith with header value containing a null byte</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/invalid-blobtype-iframe.https.html';
+    var SCRIPT = 'resources/invalid-blobtype-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var channel = new MessageChannel();
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/invalid-header.https.html b/test/fixtures/wpt/service-workers/service-worker/invalid-header.https.html
new file mode 100644
index 000000000000..1bc976979046
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/invalid-header.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title>Service Worker: respondWith with header value containing a null byte</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/invalid-header-iframe.https.html';
+    var SCRIPT = 'resources/invalid-header-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var channel = new MessageChannel();
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/iso-latin1-header.https.html b/test/fixtures/wpt/service-workers/service-worker/iso-latin1-header.https.html
new file mode 100644
index 000000000000..c27a5f48a5b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/iso-latin1-header.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: respondWith with header value containing an ISO Latin 1 (ISO-8859-1 Character Set) string</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/iso-latin1-header-iframe.html';
+    var SCRIPT = 'resources/iso-latin1-header-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          var channel = new MessageChannel();
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the response of FetchEvent using XMLHttpRequest');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/local-url-inherit-controller.https.html b/test/fixtures/wpt/service-workers/service-worker/local-url-inherit-controller.https.html
new file mode 100644
index 000000000000..867e1b006d65
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/local-url-inherit-controller.https.html
@@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<title>Service Worker: local URL windows and workers inherit controller</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/local-url-inherit-controller-worker.js';
+const SCOPE = 'resources/local-url-inherit-controller-frame.html';
+
+async function doAsyncTest(t, opts) {
+  let name = `${opts.scheme}-${opts.child}-${opts.check}`;
+  let scope = SCOPE + '?name=' + name;
+  let reg = await service_worker_unregister_and_register(t, SCRIPT, scope);
+  add_completion_callback(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let frame = await with_iframe(scope);
+  add_completion_callback(_ => frame.remove());
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller, null,
+                    'frame should be controlled');
+
+  let result = await frame.contentWindow.checkChildController(opts);
+  result = result.data;
+
+  let expect = 'unexpected';
+  if (opts.check === 'controller') {
+    expect = opts.expect === 'inherit'
+               ? frame.contentWindow.navigator.serviceWorker.controller.scriptURL
+               : null;
+  } else if (opts.check === 'fetch') {
+    // The service worker FetchEvent handler will provide an "intercepted"
+    // body.  If the local URL ends up with an opaque origin and is not
+    // intercepted then it will get an opaque Response.  In that case it
+    // should see an empty string body.
+    expect = opts.expect === 'intercept' ? 'intercepted' : '';
+  }
+
+  assert_equals(result, expect,
+                `${opts.scheme} URL ${opts.child} should ${opts.expect} ${opts.check}`);
+}
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'iframe',
+    check: 'controller',
+    expect: 'inherit',
+  });
+}, 'Same-origin blob URL iframe should inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'iframe',
+    check: 'fetch',
+    expect: 'intercept',
+  });
+}, 'Same-origin blob URL iframe should intercept fetch().');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'worker',
+    check: 'controller',
+    expect: 'inherit',
+  });
+}, 'Same-origin blob URL worker should inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'worker',
+    check: 'fetch',
+    expect: 'intercept',
+  });
+}, 'Same-origin blob URL worker should intercept fetch().');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'sharedworker',
+    check: 'controller',
+    expect: 'inherit',
+  });
+}, 'Same-origin blob URL sharedworker should inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'blob',
+    child: 'sharedworker',
+    check: 'fetch',
+    expect: 'intercept',
+  });
+}, 'Same-origin blob URL sharedworker should intercept fetch().');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'data',
+    child: 'iframe',
+    check: 'fetch',
+    expect: 'not intercept',
+  });
+}, 'Data URL iframe should not intercept fetch().');
+
+promise_test(function(t) {
+  // Data URLs should result in an opaque origin and should probably not
+  // have access to a cross-origin service worker.  See:
+  //
+  // https://github.com/w3c/ServiceWorker/issues/1262
+  //
+  return doAsyncTest(t, {
+    scheme: 'data',
+    child: 'worker',
+    check: 'controller',
+    expect: 'not inherit',
+  });
+}, 'Data URL worker should not inherit service worker controller.');
+
+promise_test(function(t) {
+  return doAsyncTest(t, {
+    scheme: 'data',
+    child: 'worker',
+    check: 'fetch',
+    expect: 'not intercept',
+  });
+}, 'Data URL worker should not intercept fetch().');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/mime-sniffing.https.html b/test/fixtures/wpt/service-workers/service-worker/mime-sniffing.https.html
new file mode 100644
index 000000000000..8175bcdf8779
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/mime-sniffing.https.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<title>Service Worker: MIME sniffing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    const SCOPE = 'resources/blank.html?mime-sniffing';
+    const SCRIPT = 'resources/mime-sniffing-worker.js';
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(registration => {
+          add_completion_callback(() => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => with_iframe(SCOPE))
+      .then(frame => {
+          add_completion_callback(() => frame.remove());
+          assert_equals(frame.contentWindow.document.body.innerText, 'test');
+          const h1 = frame.contentWindow.document.getElementById('testid');
+          assert_equals(h1.innerText,'test');
+        });
+  }, 'The response from service worker should be correctly MIME siniffed.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/multi-globals/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/current.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/current.https.html
new file mode 100644
index 000000000000..82a48d409901
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/current.https.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Current page used as a test helper</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/test-sw.js
new file mode 100644
index 000000000000..e673292f2c0c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/current/test-sw.js
@@ -0,0 +1 @@
+// Service worker for current/
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/incumbent.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/incumbent.https.html
new file mode 100644
index 000000000000..4585f15b0f45
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/incumbent.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Incumbent page used as a test helper</title>
+
+<iframe src="../current/current.https.html" id="c"></iframe>
+<iframe src="../relevant/relevant.https.html" id="r"></iframe>
+
+<script>
+'use strict';
+
+const current = document.querySelector('#c').contentWindow;
+const relevant = document.querySelector('#r').contentWindow;
+
+window.testRegister = options => {
+    return current.navigator.serviceWorker.register.call(relevant.navigator.serviceWorker, 'test-sw.js', options);
+};
+
+window.testGetRegistration = () => {
+    return current.navigator.serviceWorker.getRegistration.call(relevant.navigator.serviceWorker, 'test-sw.js');
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/test-sw.js
new file mode 100644
index 000000000000..e2a0e93b5839
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/incumbent/test-sw.js
@@ -0,0 +1 @@
+// Service worker for incumbent/
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/relevant.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/relevant.https.html
new file mode 100644
index 000000000000..44f42eda493c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/relevant.https.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Relevant page used as a test helper</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/test-sw.js
new file mode 100644
index 000000000000..ff44cdf0867b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/relevant/test-sw.js
@@ -0,0 +1 @@
+// Service worker for relevant/
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/test-sw.js b/test/fixtures/wpt/service-workers/service-worker/multi-globals/test-sw.js
new file mode 100644
index 000000000000..ce3c940eced8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/test-sw.js
@@ -0,0 +1 @@
+// Service worker for /
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/multi-globals/url-parsing.https.html b/test/fixtures/wpt/service-workers/service-worker/multi-globals/url-parsing.https.html
new file mode 100644
index 000000000000..b9dfe3634353
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multi-globals/url-parsing.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<title>register()/getRegistration() URL parsing, with multiple globals in play</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/spec/service_worker/index.html#service-worker-container-register-method">
+<link rel="help" href="https://w3c.github.io/ServiceWorker/spec/service_worker/index.html#service-worker-container-getregistration-method">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<script src="/resources/testharness.js"></script>
+<script src="../resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+
+<!-- This is the entry global -->
+
+<iframe src="incumbent/incumbent.https.html"></iframe>
+
+<script>
+'use strict';
+
+const loadPromise = new Promise(resolve => {
+    window.addEventListener('load', () => resolve());
+});
+
+promise_test(t => {
+    let registration;
+
+    return loadPromise.then(() => {
+        return frames[0].testRegister();
+    }).then(r => {
+        registration = r;
+        return wait_for_state(t, registration.installing, 'activated');
+    }).then(_ => {
+        assert_equals(registration.active.scriptURL, normalizeURL('relevant/test-sw.js'), 'the script URL should be parsed against the relevant global');
+        assert_equals(registration.scope, normalizeURL('relevant/'), 'the default scope URL should be parsed against the parsed script URL');
+
+        return registration.unregister();
+    });
+}, 'register should use the relevant global of the object it was called on to resolve the script URL and the default scope URL');
+
+promise_test(t => {
+    let registration;
+
+    return loadPromise.then(() => {
+        return frames[0].testRegister({ scope: 'scope' });
+    }).then(r => {
+        registration = r;
+        return wait_for_state(t, registration.installing, 'activated');
+    }).then(_ => {
+        assert_equals(registration.active.scriptURL, normalizeURL('relevant/test-sw.js'), 'the script URL should be parsed against the relevant global');
+        assert_equals(registration.scope, normalizeURL('relevant/scope'), 'the given scope URL should be parsed against the relevant global');
+
+        return registration.unregister();
+    });
+}, 'register should use the relevant global of the object it was called on to resolve the script URL and the given scope URL');
+
+promise_test(t => {
+    let registration;
+
+    return loadPromise.then(() => {
+        return navigator.serviceWorker.register(normalizeURL('relevant/test-sw.js'));
+    }).then(r => {
+        registration = r;
+        return frames[0].testGetRegistration();
+    })
+    .then(gottenRegistration => {
+        assert_not_equals(registration, null, 'the registration should not be null');
+        assert_not_equals(gottenRegistration, null, 'the registration from the other frame should not be null');
+        assert_equals(gottenRegistration.scope, registration.scope,
+            'the retrieved registration\'s scope should be equal to the original\'s scope');
+
+        return registration.unregister();
+    });
+}, 'getRegistration should use the relevant global of the object it was called on to resolve the script URL');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multipart-image.https.html b/test/fixtures/wpt/service-workers/service-worker/multipart-image.https.html
new file mode 100644
index 000000000000..00c20d25f90a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multipart-image.https.html
@@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<title>Tests for cross-origin multipart image returned by service worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+// This tests loading a multipart image via service worker. The service worker responds with
+// an opaque or a non-opaque response. The content of opaque response should not be readable.
+
+const script = 'resources/multipart-image-worker.js';
+const scope = 'resources/multipart-image-iframe.html';
+let frame;
+
+function check_image_data(data) {
+    assert_equals(data[0], 255);
+    assert_equals(data[1], 0);
+    assert_equals(data[2], 0);
+    assert_equals(data[3], 255);
+}
+
+promise_test(t => {
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          promise_test(() => {
+              if (frame) {
+                  frame.remove();
+              }
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => with_iframe(scope))
+      .then(f => {
+          frame = f;
+      });
+  }, 'initialize global state');
+
+promise_test(t => {
+    return frame.contentWindow.load_multipart_image('same-origin-multipart-image')
+      .then(img => frame.contentWindow.get_image_data(img))
+      .then(img_data => {
+          check_image_data(img_data.data);
+      });
+  }, 'same-origin multipart image via SW should be readable');
+
+promise_test(t => {
+    return frame.contentWindow.load_multipart_image('cross-origin-multipart-image-with-cors-approved')
+      .then(img => frame.contentWindow.get_image_data(img))
+      .then(img_data => {
+          check_image_data(img_data.data);
+      });
+  }, 'cross-origin multipart image via SW with approved CORS should be readable');
+
+promise_test(t => {
+    return frame.contentWindow.load_multipart_image('cross-origin-multipart-image-with-no-cors')
+      .then(img => {
+        assert_throws_dom('SecurityError', frame.contentWindow.DOMException,
+                          () => frame.contentWindow.get_image_data(img));
+      });
+  }, 'cross-origin multipart image with no-cors via SW should not be readable');
+
+promise_test(t => {
+    const promise = frame.contentWindow.load_multipart_image('cross-origin-multipart-image-with-cors-rejected');
+    return promise_rejects_dom(t, 'NetworkError', frame.contentWindow.DOMException, promise);
+  }, 'cross-origin multipart image via SW with rejected CORS should fail to load');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multiple-register.https.html b/test/fixtures/wpt/service-workers/service-worker/multiple-register.https.html
new file mode 100644
index 000000000000..752e132fc13a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multiple-register.https.html
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var worker_url = 'resources/empty-worker.js';
+
+async_test(function(t) {
+  var scope = 'resources/scope/subsequent-register-from-same-window';
+  var registration;
+
+  service_worker_unregister_and_register(t, worker_url, scope)
+    .then(function(r) {
+        registration = r;
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(function() {
+        return navigator.serviceWorker.register(worker_url, { scope: scope });
+      })
+    .then(function(new_registration) {
+        assert_equals(new_registration, registration,
+                      'register should resolve to the same registration');
+        assert_equals(new_registration.active, registration.active,
+                      'register should resolve to the same worker');
+        assert_equals(new_registration.active.state, 'activated',
+                      'the worker should be in state "activated"');
+        return registration.unregister();
+      })
+    .then(function() { t.done(); })
+    .catch(unreached_rejection(t));
+}, 'Subsequent registrations resolve to the same registration object');
+
+async_test(function(t) {
+  var scope = 'resources/scope/subsequent-register-from-different-iframe';
+  var frame;
+  var registration;
+
+  service_worker_unregister_and_register(t, worker_url, scope)
+    .then(function(r) {
+        registration = r;
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(function() { return with_iframe('resources/404.py'); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            'empty-worker.js',
+            { scope: 'scope/subsequent-register-from-different-iframe' });
+      })
+    .then(function(new_registration) {
+        assert_not_equals(
+          registration, new_registration,
+          'register should resolve to a different registration');
+        assert_equals(
+          registration.scope, new_registration.scope,
+          'registrations should have the same scope');
+
+        assert_equals(
+          registration.installing, null,
+          'installing worker should be null');
+        assert_equals(
+          new_registration.installing, null,
+          'installing worker should be null');
+        assert_equals(
+          registration.waiting, null,
+          'waiting worker should be null')
+        assert_equals(
+          new_registration.waiting, null,
+          'waiting worker should be null')
+
+        assert_not_equals(
+          registration.active, new_registration.active,
+          'registration should have a different active worker');
+        assert_equals(
+          registration.active.scriptURL,
+          new_registration.active.scriptURL,
+          'active workers should have the same script URL');
+        assert_equals(
+          registration.active.state,
+          new_registration.active.state,
+          'active workers should be in the same state');
+
+        frame.remove();
+        return registration.unregister();
+      })
+    .then(function() { t.done(); })
+    .catch(unreached_rejection(t));
+}, 'Subsequent registrations from a different iframe resolve to the ' +
+       'different registration object but they refer to the same ' +
+       'registration and workers');
+
+async_test(function(t) {
+  var scope = 'resources/scope/concurrent-register';
+
+  service_worker_unregister(t, scope)
+    .then(function() {
+        var promises = [];
+        for (var i = 0; i < 10; ++i) {
+          promises.push(navigator.serviceWorker.register(worker_url,
+                                                         { scope: scope }));
+        }
+        return Promise.all(promises);
+      })
+    .then(function(registrations) {
+        registrations.forEach(function(registration) {
+            assert_equals(registration, registrations[0],
+                          'register should resolve to the same registration');
+          });
+        return registrations[0].unregister();
+      })
+    .then(function() { t.done(); })
+    .catch(unreached_rejection(t));
+}, 'Concurrent registrations resolve to the same registration object');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/multiple-update.https.html b/test/fixtures/wpt/service-workers/service-worker/multiple-update.https.html
new file mode 100644
index 000000000000..6a83f73a054f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/multiple-update.https.html
@@ -0,0 +1,94 @@
+<!DOCTYPE html>
+<!-- In Bug 1217367, we will try to merge update events for same registration
+     if possible. This testcase is used to make sure the optimization algorithm
+     doesn't go wrong. -->
+<title>Service Worker: Trigger multiple updates</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var script = 'resources/update-nocookie-worker.py';
+    var scope = 'resources/scope/update';
+    var expected_url = normalizeURL(script);
+    var registration;
+
+    return service_worker_unregister_and_register(t, expected_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          // Test single update works before triggering multiple update events
+          return Promise.all([registration.update(),
+                              wait_for_update(t, registration)]);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should still be null after update resolves.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing should be null after installing.');
+          if (registration.waiting) {
+            assert_equals(registration.waiting.scriptURL, expected_url,
+                          'waiting should be set after installing.');
+            assert_equals(registration.active.scriptURL, expected_url,
+                          'active should still exist after installing.');
+            return wait_for_state(t, registration.waiting, 'activated');
+          }
+        })
+      .then(function() {
+          // Test triggering multiple update events at the same time.
+          var promiseList = [];
+          const burstUpdateCount = 10;
+          for (var i = 0; i < burstUpdateCount; i++) {
+            promiseList.push(registration.update());
+          }
+          promiseList.push(wait_for_update(t, registration));
+          return Promise.all(promiseList);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should still be null after update resolves.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing should be null after installing.');
+          if (registration.waiting) {
+            assert_equals(registration.waiting.scriptURL, expected_url,
+                          'waiting should be set after installing.');
+            assert_equals(registration.active.scriptURL, expected_url,
+                          'active should still exist after installing.');
+            return wait_for_state(t, registration.waiting, 'activated');
+          }
+        })
+      .then(function() {
+          // Test update still works after handling update event burst.
+          return Promise.all([registration.update(),
+                              wait_for_update(t, registration)]);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should be null after activated.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+        });
+  }, 'Trigger multiple updates.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigate-window.https.html b/test/fixtures/wpt/service-workers/service-worker/navigate-window.https.html
new file mode 100644
index 000000000000..46d32a48a0ad
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigate-window.https.html
@@ -0,0 +1,151 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigate a Window</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+var BASE_URL = host_info['HTTPS_ORIGIN'] + base_path();
+
+function wait_for_message(msg) {
+  return new Promise(function(resolve, reject) {
+    window.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type === msg) {
+        resolve();
+      }
+    });
+  });
+}
+
+function with_window(url) {
+  var win = window.open(url);
+  return wait_for_message('LOADED').then(_ => win);
+}
+
+function navigate_window(win, url) {
+  win.location = url;
+  return wait_for_message('LOADED').then(_ => win);
+}
+
+function reload_window(win) {
+  win.location.reload();
+  return wait_for_message('LOADED').then(_ => win);
+}
+
+function go_back(win) {
+  win.history.back();
+  return wait_for_message('PAGESHOW').then(_ => win);
+}
+
+function go_forward(win) {
+  win.history.forward();
+  return wait_for_message('PAGESHOW').then(_ => win);
+}
+
+function get_clients(win, sw, opts) {
+  return new Promise((resolve, reject) => {
+    win.navigator.serviceWorker.addEventListener('message', function onMsg(evt) {
+      win.navigator.serviceWorker.removeEventListener('message', onMsg);
+      if (evt.data.type === 'success') {
+        resolve(evt.data.detail);
+      } else {
+        reject(evt.data.detail);
+      }
+    });
+    sw.postMessage({ type: 'GET_CLIENTS', opts: (opts || {}) });
+  });
+}
+
+function compare_urls(a, b) {
+  return a.url < b.url ? -1 : b.url < a.url ? 1 : 0;
+}
+
+function validate_window(win, url, opts) {
+  return win.navigator.serviceWorker.getRegistration(url)
+    .then(reg => {
+        // In order to compare service worker instances we need to
+        // make sure the DOM object is owned by the same global; the
+        // opened window in this case.
+        assert_equals(win.navigator.serviceWorker.controller, reg.active,
+                      'window should be controlled by service worker');
+        return get_clients(win, reg.active, opts);
+      })
+    .then(resultList => {
+        // We should always see our controlled window.
+        var expected = [
+          { url: url, frameType: 'auxiliary' }
+        ];
+        // If we are including uncontrolled windows, then we might see the
+        // test window itself and the test harness.
+        if (opts.includeUncontrolled) {
+          expected.push({ url: BASE_URL + 'navigate-window.https.html',
+                          frameType: 'auxiliary' });
+          expected.push({
+            url: host_info['HTTPS_ORIGIN'] + '/testharness_runner.html',
+            frameType: 'top-level' });
+        }
+
+        assert_equals(resultList.length, expected.length,
+                      'expected number of clients');
+
+        expected.sort(compare_urls);
+        resultList.sort(compare_urls);
+
+        for (var i = 0; i < resultList.length; ++i) {
+          assert_equals(resultList[i].url, expected[i].url,
+                        'client should have expected url');
+          assert_equals(resultList[i].frameType, expected[i].frameType,
+                        'client should have expected frame type');
+        }
+        return win;
+      })
+}
+
+promise_test(function(t) {
+    var worker = BASE_URL + 'resources/navigate-window-worker.js';
+    var scope = BASE_URL + 'resources/loaded.html?navigate-window-controlled';
+    var url1 = scope + '&q=1';
+    var url2 = scope + '&q=2';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(reg => wait_for_state(t, reg.installing, 'activated') )
+      .then(___ => with_window(url1))
+      .then(win => validate_window(win, url1, { includeUncontrolled: false }))
+      .then(win => navigate_window(win, url2))
+      .then(win => validate_window(win, url2, { includeUncontrolled: false }))
+      .then(win => go_back(win))
+      .then(win => validate_window(win, url1, { includeUncontrolled: false }))
+      .then(win => go_forward(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: false }))
+      .then(win => reload_window(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: false }))
+      .then(win => win.close())
+      .catch(unreached_rejection(t))
+      .then(___ => service_worker_unregister(t, scope))
+  }, 'Clients.matchAll() should not show an old window as controlled after ' +
+     'it navigates.');
+
+promise_test(function(t) {
+    var worker = BASE_URL + 'resources/navigate-window-worker.js';
+    var scope = BASE_URL + 'resources/loaded.html?navigate-window-uncontrolled';
+    var url1 = scope + '&q=1';
+    var url2 = scope + '&q=2';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(reg => wait_for_state(t, reg.installing, 'activated') )
+      .then(___ => with_window(url1))
+      .then(win => validate_window(win, url1, { includeUncontrolled: true }))
+      .then(win => navigate_window(win, url2))
+      .then(win => validate_window(win, url2, { includeUncontrolled: true }))
+      .then(win => go_back(win))
+      .then(win => validate_window(win, url1, { includeUncontrolled: true }))
+      .then(win => go_forward(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: true }))
+      .then(win => reload_window(win))
+      .then(win => validate_window(win, url2, { includeUncontrolled: true }))
+      .then(win => win.close())
+      .catch(unreached_rejection(t))
+      .then(___ => service_worker_unregister(t, scope))
+  }, 'Clients.matchAll() should not show an old window after it navigates.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-headers.https.html
new file mode 100644
index 000000000000..a4b52035e221
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-headers.https.html
@@ -0,0 +1,819 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Navigation Post Request Origin Header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const script = new URL('./resources/fetch-rewrite-worker.js', self.location);
+const base = './resources/navigation-headers-server.py';
+const scope = base + '?with-sw';
+let registration;
+
+async function post_and_get_headers(t, form_host, method, swaction,
+                                    redirect_hosts=[]) {
+  if (swaction === 'navpreload') {
+    assert_true('navigationPreload' in registration,
+                'navigation preload must be supported');
+  }
+  let target_string;
+  if (swaction === 'no-sw') {
+    target_string = base + '?no-sw';
+  } else if (swaction === 'fallback') {
+    target_string = `${scope}&ignore`;
+  } else {
+    target_string = `${scope}&${swaction}`;
+  }
+  let target = new URL(target_string, self.location);
+
+  for (let i = redirect_hosts.length - 1; i >= 0; --i) {
+    const redirect_url = new URL('./resources/redirect.py', self.location);
+    redirect_url.hostname = redirect_hosts[i];
+    redirect_url.search = `?Status=307&Redirect=${encodeURIComponent(target)}`;
+    target = redirect_url;
+  }
+
+  let popup_url_path;
+  if (method === 'GET') {
+    popup_url_path = './resources/location-setter.html';
+  } else if (method === 'POST') {
+    popup_url_path = './resources/form-poster.html';
+  }
+
+  const popup_url = new URL(popup_url_path, self.location);
+  popup_url.hostname = form_host;
+  popup_url.search = `?target=${encodeURIComponent(target.href)}`;
+
+  const message_promise = new Promise(resolve => {
+    self.addEventListener('message', evt => {
+      resolve(evt.data);
+    });
+  });
+
+  const frame = await with_iframe(popup_url);
+  t.add_cleanup(() => frame.remove());
+
+  return await message_promise;
+}
+
+const SAME_ORIGIN = new URL(self.location.origin);
+const SAME_SITE = new URL(get_host_info().HTTPS_REMOTE_ORIGIN);
+const CROSS_SITE = new URL(get_host_info().HTTPS_NOTSAMESITE_ORIGIN);
+
+promise_test(async t => {
+  registration = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+  if (registration.navigationPreload)
+    await registration.navigationPreload.enable();
+}, 'Setup service worker');
+
+//
+// Origin and referer headers
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'GET Navigation, same-origin with navpreload service worker sets correct ' +
+   'origin and referer headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'GET Navigation, same-origin with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result.origin, SAME_SITE.origin, 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'POST Navigation, same-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result.origin, SAME_SITE.origin, 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'POST Navigation, same-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result.origin, SAME_SITE.origin, 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'POST Navigation, same-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, SAME_SITE.href, 'referer header');
+}, 'GET Navigation, same-site with navpreload service worker sets correct ' +
+   'origin and referer headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'GET Navigation, same-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result.origin, CROSS_SITE.origin, 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'POST Navigation, cross-site with no service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result.origin, CROSS_SITE.origin, 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'POST Navigation, cross-site with passthrough service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result.origin, CROSS_SITE.origin, 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'POST Navigation, cross-site with fallback service worker sets correct ' +
+   'origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, CROSS_SITE.href, 'referer header');
+}, 'GET Navigation, cross-site with navpreload service worker sets correct ' +
+   'origin and referer headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result.origin, 'not set', 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'GET Navigation, cross-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, cross-site with service worker that changes the ' +
+   'request sets correct origin and referer headers.');
+
+//
+// Origin and referer header tests using redirects
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw', [SAME_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and no service worker ' +
+   'sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough', [SAME_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and passthrough service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback', [SAME_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and fallback service ' +
+   'worker sets correct origin and referer headers.');
+
+// There is no navpreload case because it does not work with POST requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request', [SAME_SITE.hostname]);
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with same-site redirect and change-request service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and no service worker ' +
+   'sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and passthrough service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and fallback service ' +
+   'worker sets correct origin and referer headers.');
+
+// There is no navpreload case because it does not work with POST requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request', [CROSS_SITE.hostname]);
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect and change-request service ' +
+   'worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw', [CROSS_SITE.hostname,
+                                                      SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and no service worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough', [CROSS_SITE.hostname,
+                                                            SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and passthrough service worker sets correct origin and referer headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback', [CROSS_SITE.hostname,
+                                                         SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, 'null', 'origin header');
+  assert_equals(result.referer, SAME_ORIGIN.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and fallback service worker sets correct origin and referer headers.');
+
+// There is no navpreload case because it does not work with POST requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request', [CROSS_SITE.hostname,
+                                                               SAME_ORIGIN.hostname]);
+  assert_equals(result.origin, SAME_ORIGIN.origin, 'origin header');
+  assert_equals(result.referer, script.href, 'referer header');
+}, 'POST Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and change-request service worker sets correct origin and referer headers.');
+
+//
+// Sec-Fetch-* Headers (separated since not all browsers implement them)
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with navpreload service worker sets correct ' +
+   'sec-fetch headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-origin with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with navpreload service worker sets correct ' +
+   'sec-fetch headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, same-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'no-sw');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with no service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'passthrough');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with passthrough service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'fallback');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with fallback service worker sets correct ' +
+   'sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'navpreload');
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with navpreload service worker sets correct ' +
+   'sec-fetch headers.');
+
+// There is no POST test for navpreload since the feature only supports GET
+// requests.
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'GET',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, cross-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, CROSS_SITE.hostname, 'POST',
+                                            'change-request');
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'POST Navigation, cross-site with service worker that changes the ' +
+   'request sets correct sec-fetch headers.');
+
+//
+// Sec-Fetch-* header tests using redirects
+//
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and no service worker ' +
+   'sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and passthrough service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and fallback service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and navpreload service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request', [SAME_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with same-site redirect and change-request service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and no service worker ' +
+   'sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and passthrough service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and fallback service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and navpreload service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request', [CROSS_SITE.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect and change-request service ' +
+   'worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'no-sw', [CROSS_SITE.hostname,
+                                                      SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and no service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'passthrough', [CROSS_SITE.hostname,
+                                                            SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and passthrough service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'fallback', [CROSS_SITE.hostname,
+                                                         SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and fallback service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'navpreload', [CROSS_SITE.hostname,
+                                                           SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'cross-site', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'navigate', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'iframe', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and navpreload service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  const result = await post_and_get_headers(t, SAME_ORIGIN.hostname, 'GET',
+                                            'change-request', [CROSS_SITE.hostname,
+                                                               SAME_ORIGIN.hostname]);
+  assert_equals(result['sec-fetch-site'], 'same-origin', 'sec-fetch-site header');
+  assert_equals(result['sec-fetch-mode'], 'same-origin', 'sec-fetch-mode header');
+  assert_equals(result['sec-fetch-dest'], 'empty', 'sec-fetch-dest header');
+}, 'GET Navigation, same-origin with cross-site redirect, same-origin redirect, ' +
+   'and change-request service worker sets correct sec-fetch headers.');
+
+promise_test(async t => {
+  await registration.unregister();
+}, 'Cleanup service worker');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html
new file mode 100644
index 000000000000..ec74282ac330
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload with chunked encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/broken-chunked-encoding-worker.js';
+    var scope = 'resources/broken-chunked-encoding-scope.asis';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'PASS: preloadResponse resolved');
+        });
+  }, 'FetchEvent#preloadResponse resolves even if the body is sent with broken chunked encoding.');
+
+promise_test(t => {
+    var script = 'resources/broken-chunked-encoding-worker.js';
+    var scope = 'resources/chunked-encoding-scope.py?use_broken_body';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'PASS: preloadResponse resolved');
+        });
+  }, 'FetchEvent#preloadResponse resolves even if the body is sent with broken chunked encoding with some delays');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/chunked-encoding.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/chunked-encoding.https.html
new file mode 100644
index 000000000000..830ce32cea5a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/chunked-encoding.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload with chunked encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/chunked-encoding-worker.js';
+    var scope = 'resources/chunked-encoding-scope.py';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            '0123456789');
+        });
+  }, 'Navigation Preload must work with chunked encoding.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/content-encoding.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/content-encoding.https.html
new file mode 100644
index 000000000000..d6135d95c880
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/content-encoding.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload with content encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/content-encoding-worker.js';
+    var scope = 'resources/content-encoding-scope.py';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            'Hello World');
+        });
+  }, 'Navigation Preload must work with content encoding.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/empty-preload-response-body.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/empty-preload-response-body.https.html
new file mode 100644
index 000000000000..7e8aacdd36a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/empty-preload-response-body.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload empty response body</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/empty-preload-response-body-worker.js';
+    var scope = 'resources/empty-preload-response-body-scope.html';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          assert_equals(
+            frame.contentDocument.body.textContent,
+            '[]');
+        });
+  }, 'Navigation Preload empty response body.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/get-state.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/get-state.https.html
new file mode 100644
index 000000000000..08e2f4976c59
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/get-state.https.html
@@ -0,0 +1,217 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>NavigationPreloadManager.getState</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="resources/helpers.js"></script>
+<body>
+<script>
+function post_and_wait_for_reply(worker, message) {
+  return new Promise(resolve => {
+      navigator.serviceWorker.onmessage = e => { resolve(e.data); };
+      worker.postMessage(message);
+    });
+}
+
+promise_test(t => {
+  const scope = '../resources/get-state';
+  const script = '../resources/empty-worker.js';
+  var np;
+
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(r => {
+        np = r.navigationPreload;
+        add_completion_callback(() => r.unregister());
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(() => np.getState())
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'true', 'default state');
+        return np.enable();
+      })
+    .then(result => {
+        assert_equals(result, undefined,
+                      'enable() should resolve to undefined');
+        return np.getState();
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, true, 'true',
+                                        'state after enable()');
+        return np.disable();
+      })
+    .then(result => {
+        assert_equals(result, undefined,
+                      'disable() should resolve to undefined');
+        return np.getState();
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'true',
+                                        'state after disable()');
+        return np.setHeaderValue('dreams that cannot be');
+      })
+    .then(result => {
+        assert_equals(result, undefined,
+                      'setHeaderValue() should resolve to undefined');
+        return np.getState();
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'dreams that cannot be',
+                                        'state after setHeaderValue()');
+        return np.setHeaderValue('').then(() => np.getState());
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, '',
+                                        'after setHeaderValue to empty string');
+        return np.setHeaderValue(null).then(() => np.getState());
+      })
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'null',
+                                        'after setHeaderValue to null');
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('what\uDC00\uD800this'),
+            'setHeaderValue() should throw if passed surrogates');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('zer\0o'),
+            'setHeaderValue() should throw if passed \\0');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('\rcarriage'),
+            'setHeaderValue() should throw if passed \\r');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue('newline\n'),
+            'setHeaderValue() should throw if passed \\n');
+      })
+    .then(() => {
+        return promise_rejects_js(t,
+            TypeError,
+            np.setHeaderValue(),
+            'setHeaderValue() should throw if passed undefined');
+      })
+    .then(() => np.enable().then(() => np.getState()))
+    .then(state => {
+        expect_navigation_preload_state(state, true, 'null',
+                                        'enable() should not change header');
+      });
+  }, 'getState');
+
+// This test sends commands to a worker to call enable()/disable()/getState().
+// It checks the results from the worker and verifies that they match the
+// navigation preload state accessible from the page.
+promise_test(t => {
+  const scope = 'resources/get-state-worker';
+  const script = 'resources/get-state-worker.js';
+  var worker;
+  var registration;
+
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(r => {
+        registration = r;
+        add_completion_callback(() => registration.unregister());
+        worker = registration.installing;
+        return wait_for_state(t, worker, 'activated');
+      })
+    .then(() => {
+        // Call getState().
+        return post_and_wait_for_reply(worker, 'getState');
+      })
+    .then(data => {
+        return Promise.all([data, registration.navigationPreload.getState()]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(states[0], false, 'true',
+                                        'default state (from worker)');
+        expect_navigation_preload_state(states[1], false, 'true',
+                                        'default state (from page)');
+        // Call enable() and then getState().
+        return post_and_wait_for_reply(worker, 'enable');
+      })
+    .then(data => {
+        assert_equals(data, undefined, 'enable() should resolve to undefined');
+        return Promise.all([
+            post_and_wait_for_reply(worker, 'getState'),
+            registration.navigationPreload.getState()
+          ]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(states[0], true, 'true',
+                                        'state after enable() (from worker)');
+        expect_navigation_preload_state(states[1], true, 'true',
+                                        'state after enable() (from page)');
+        // Call disable() and then getState().
+        return post_and_wait_for_reply(worker, 'disable');
+      })
+    .then(data => {
+        assert_equals(data, undefined,
+                      '.disable() should resolve to undefined');
+        return Promise.all([
+            post_and_wait_for_reply(worker, 'getState'),
+            registration.navigationPreload.getState()
+          ]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(states[0], false, 'true',
+                                        'state after disable() (from worker)');
+        expect_navigation_preload_state(states[1], false, 'true',
+                                        'state after disable() (from page)');
+        return post_and_wait_for_reply(worker, 'setHeaderValue');
+      })
+    .then(data => {
+        assert_equals(data, undefined,
+                      '.setHeaderValue() should resolve to undefined');
+        return Promise.all([
+            post_and_wait_for_reply(worker, 'getState'),
+            registration.navigationPreload.getState()]);
+      })
+    .then(states => {
+        expect_navigation_preload_state(
+            states[0], false, 'insightful',
+            'state after setHeaderValue() (from worker)');
+        expect_navigation_preload_state(
+            states[1], false, 'insightful',
+            'state after setHeaderValue() (from page)');
+      });
+  }, 'getState from a worker');
+
+// This tests navigation preload API when there is no active worker. It calls
+// the API from the main page and then from the worker itself.
+promise_test(t => {
+  const scope = 'resources/wait-for-activate-worker';
+  const script = 'resources/wait-for-activate-worker.js';
+  var registration;
+  var np;
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(r => {
+        registration = r;
+        np = registration.navigationPreload;
+        add_completion_callback(() => registration.unregister());
+        return Promise.all([
+            promise_rejects_dom(
+                t, 'InvalidStateError', np.enable(),
+                'enable should reject if there is no active worker'),
+            promise_rejects_dom(
+                t, 'InvalidStateError', np.disable(),
+                'disable should reject if there is no active worker'),
+            promise_rejects_dom(
+                t, 'InvalidStateError', np.setHeaderValue('umm'),
+                'setHeaderValue should reject if there is no active worker')]);
+      })
+    .then(() => np.getState())
+    .then(state => {
+        expect_navigation_preload_state(state, false, 'true',
+                                        'state before activation');
+        return post_and_wait_for_reply(registration.installing, 'ping');
+      })
+    .then(result => assert_equals(result, 'PASS'));
+  }, 'no active worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/navigationPreload.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/navigationPreload.https.html
new file mode 100644
index 000000000000..392e5c14dc8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/navigationPreload.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>ServiceWorker: navigator.serviceWorker.navigationPreload</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="resources/helpers.js"></script>
+<script>
+promise_test(async t => {
+  const SCRIPT = '../resources/empty-worker.js';
+  const SCOPE = '../resources/navigationpreload';
+  const registration =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const navigationPreload = registration.navigationPreload;
+  assert_true(navigationPreload instanceof NavigationPreloadManager,
+              'ServiceWorkerRegistration.navigationPreload');
+  await registration.unregister();
+}, "The navigationPreload attribute must return service worker " +
+    "registration's NavigationPreloadManager object.");
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/redirect.https.html
new file mode 100644
index 000000000000..5970f053e369
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/redirect.https.html
@@ -0,0 +1,93 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload redirect response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+
+function check_opaqueredirect(response_info, scope) {
+  assert_equals(response_info.type, 'opaqueredirect');
+  assert_equals(response_info.url, '' + new URL(scope, location));
+  assert_equals(response_info.status, 0);
+  assert_equals(response_info.ok, false);
+  assert_equals(response_info.statusText, '');
+  assert_equals(response_info.headers.length, 0);
+}
+
+function redirect_response_test(t, scope, expected_body, expected_urls) {
+  var script = 'resources/redirect-worker.js';
+  var registration;
+  var message_resolvers = [];
+  function wait_for_message(count) {
+    var promises = [];
+    message_resolvers = [];
+    for (var i = 0; i < count; ++i) {
+      promises.push(new Promise(resolve => message_resolvers.push(resolve)));
+    }
+    return promises;
+  }
+  function on_message(e) {
+    var resolve = message_resolvers.shift();
+    if (resolve)
+      resolve(e.data);
+  }
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(reg => {
+        registration = reg;
+        add_completion_callback(_ => registration.unregister());
+        var worker = registration.installing;
+        return wait_for_state(t, worker, 'activated');
+      })
+    .then(_ => with_iframe(scope + '&base'))
+    .then(frame => {
+        assert_equals(frame.contentDocument.body.textContent, 'OK');
+        frame.contentWindow.navigator.serviceWorker.onmessage = on_message;
+        return Promise.all(wait_for_message(expected_urls.length)
+                               .concat(with_iframe(scope)));
+      })
+    .then(results => {
+      var frame = results[expected_urls.length];
+      assert_equals(frame.contentDocument.body.textContent, expected_body);
+      for (var i = 0; i < expected_urls.length; ++i) {
+        check_opaqueredirect(results[i], expected_urls[i]);
+      }
+      frame.remove();
+      return registration.unregister();
+    });
+}
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=normal',
+        'redirected\n',
+        ['resources/redirect-scope.py?type=normal']);
+  }, 'Navigation Preload redirect response.');
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=no-location',
+        '',
+        ['resources/redirect-scope.py?type=no-location']);
+  }, 'Navigation Preload no-location redirect response.');
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=no-location-with-body',
+        'BODY',
+        ['resources/redirect-scope.py?type=no-location-with-body']);
+  }, 'Navigation Preload no-location redirect response with body.');
+
+promise_test(t => {
+    return redirect_response_test(
+        t,
+        'resources/redirect-scope.py?type=redirect-to-scope',
+        'redirected\n',
+        ['resources/redirect-scope.py?type=redirect-to-scope',
+         'resources/redirect-scope.py?type=redirect-to-scope2',
+         'resources/redirect-scope.py?type=redirect-to-scope3',]);
+  }, 'Navigation Preload redirect to the same scope.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/request-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/request-headers.https.html
new file mode 100644
index 000000000000..09642010218a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/request-headers.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload request headers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/request-headers-worker.js';
+    var scope = 'resources/request-headers-scope.py';
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(_ => registration.unregister());
+          var worker = registration.installing;
+          return wait_for_state(t, worker, 'activated');
+        })
+      .then(_ => with_iframe(scope))
+      .then(frame => {
+          var headers = JSON.parse(frame.contentDocument.body.textContent);
+          assert_true(
+            'SERVICE-WORKER-NAVIGATION-PRELOAD' in headers,
+            'The Navigation Preload request must specify a ' +
+            '"Service-Worker-Navigation-Preload" header.');
+          assert_array_equals(
+            headers['SERVICE-WORKER-NAVIGATION-PRELOAD'],
+            ['hello'],
+            'The Navigation Preload request must specify the correct value ' +
+            'for the "Service-Worker-Navigation-Preload" header.');
+          assert_true(
+            'UPGRADE-INSECURE-REQUESTS' in headers,
+            'The Navigation Preload request must specify an ' +
+            '"Upgrade-Insecure-Requests" header.');
+          assert_array_equals(
+            headers['UPGRADE-INSECURE-REQUESTS'],
+            ['1'],
+            'The Navigation Preload request must specify the correct value ' +
+            'for the "Upgrade-Insecure-Requests" header.');
+        });
+  }, 'Navigation Preload request headers.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resource-timing.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resource-timing.https.html
new file mode 100644
index 000000000000..468a1f51e857
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resource-timing.https.html
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload Resource Timing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script>
+
+function check_timing_entry(entry, url, decodedBodySize, encodedBodySize) {
+  assert_equals(entry.name, url, 'The entry name of '+ url);
+
+  assert_equals(
+    entry.entryType, 'resource',
+    'The entryType of preload response timing entry must be "resource' +
+    '" :' + url);
+  assert_equals(
+    entry.initiatorType, 'navigation',
+    'The initiatorType of preload response timing entry must be ' +
+    '"navigation":' + url);
+
+  // If the server returns the redirect response, |decodedBodySize| is null and
+  // |entry.decodedBodySize| should be 0. Otherwise |entry.decodedBodySize| must
+  // same as |decodedBodySize|
+  assert_equals(
+    entry.decodedBodySize, Number(decodedBodySize),
+    'decodedBodySize must same as the decoded size in the server:' + url);
+
+  // If the server returns the redirect response, |encodedBodySize| is null and
+  // |entry.encodedBodySize| should be 0. Otherwise |entry.encodedBodySize| must
+  // same as |encodedBodySize|
+  assert_equals(
+    entry.encodedBodySize, Number(encodedBodySize),
+    'encodedBodySize must same as the encoded size in the server:' + url);
+
+  assert_greater_than(
+    entry.transferSize, entry.decodedBodySize,
+    'transferSize must greater then encodedBodySize.');
+
+  assert_greater_than(entry.startTime, 0, 'startTime of ' + url);
+  assert_greater_than_equal(entry.fetchStart, entry.startTime,
+                            'fetchStart >= startTime of ' + url);
+  assert_greater_than_equal(entry.domainLookupStart, entry.fetchStart,
+                            'domainLookupStart >= fetchStart of ' + url);
+  assert_greater_than_equal(entry.domainLookupEnd, entry.domainLookupStart,
+                            'domainLookupEnd >= domainLookupStart of ' + url);
+  assert_greater_than_equal(entry.connectStart, entry.domainLookupEnd,
+                            'connectStart >= domainLookupEnd of ' + url);
+  assert_greater_than_equal(entry.connectEnd, entry.connectStart,
+                            'connectEnd >= connectStart of ' + url);
+  assert_greater_than_equal(entry.requestStart, entry.connectEnd,
+                            'requestStart >= connectEnd of ' + url);
+  assert_greater_than_equal(entry.responseStart, entry.requestStart,
+                            'domainLookupStart >= requestStart of ' + url);
+  assert_greater_than_equal(entry.responseEnd, entry.responseStart,
+                            'responseEnd >= responseStart of ' + url);
+  assert_greater_than(entry.duration, 0, 'duration of ' + url);
+}
+
+promise_test(t => {
+    var script = 'resources/resource-timing-worker.js';
+    var scope = 'resources/resource-timing-scope.py';
+    var registration;
+    var frames = [];
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(reg => {
+          registration = reg;
+          add_completion_callback(_ => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => with_iframe(scope + '?type=normal'))
+      .then(frame => {
+          frames.push(frame);
+          return with_iframe(scope + '?type=redirect');
+        })
+      .then(frame => {
+          frames.push(frame);
+          frames.forEach(frame => {
+            var result = JSON.parse(frame.contentDocument.body.textContent);
+            assert_equals(
+              result.timingEntries.length, 1,
+              'performance.getEntriesByName() must returns one ' +
+              'PerformanceResourceTiming entry for the navigation preload.');
+            var entry = result.timingEntries[0];
+            check_timing_entry(entry, frame.src, result.decodedBodySize,
+                               result.encodedBodySize);
+            frame.remove();
+          });
+          return registration.unregister();
+        });
+  }, 'Navigation Preload Resource Timing.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-scope.asis b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-scope.asis
new file mode 100644
index 000000000000..2a719536fb89
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-scope.asis
@@ -0,0 +1,6 @@
+HTTP/1.1 200 OK
+Content-type: text/html; charset=UTF-8
+Transfer-encoding: chunked
+
+hello
+world
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-worker.js
new file mode 100644
index 000000000000..7a453e4055f0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/broken-chunked-encoding-worker.js
@@ -0,0 +1,11 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse
+      .then(
+        _ => new Response('PASS: preloadResponse resolved'),
+        _ => new Response('FAIL: preloadResponse rejected')));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/chunked-encoding-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/chunked-encoding-worker.js
new file mode 100644
index 000000000000..f30e5ed274dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/chunked-encoding-worker.js
@@ -0,0 +1,8 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/content-encoding-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/content-encoding-worker.js
new file mode 100644
index 000000000000..f30e5ed274dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/content-encoding-worker.js
@@ -0,0 +1,8 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-scope.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-scope.html
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-worker.js
new file mode 100644
index 000000000000..48c14b7916f3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/empty-preload-response-body-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(
+      event.preloadResponse
+        .then(res => res.text())
+        .then(text => {
+            return new Response(
+                '<body>[' + text + ']</body>',
+                {headers: [['content-type', 'text/html']]});
+          }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/get-state-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/get-state-worker.js
new file mode 100644
index 000000000000..a14ffb4faaad
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/get-state-worker.js
@@ -0,0 +1,21 @@
+// This worker listens for commands from the page and messages back
+// the result.
+
+function handle(message) {
+  const np = self.registration.navigationPreload;
+  switch (message) {
+    case 'getState':
+      return np.getState();
+    case 'enable':
+      return np.enable();
+    case 'disable':
+      return np.disable();
+    case 'setHeaderValue':
+      return np.setHeaderValue('insightful');
+  }
+  return Promise.reject('bad message');
+}
+
+self.addEventListener('message', e => {
+    e.waitUntil(handle(e.data).then(result => e.source.postMessage(result)));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/helpers.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/helpers.js
new file mode 100644
index 000000000000..86f0c0916ec9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/helpers.js
@@ -0,0 +1,5 @@
+function expect_navigation_preload_state(state, enabled, header, desc) {
+  assert_equals(Object.keys(state).length, 2, desc + ': # of keys');
+  assert_equals(state.enabled, enabled, desc + ': enabled');
+  assert_equals(state.headerValue, header, desc + ': header');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/navigation-preload-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/navigation-preload-worker.js
new file mode 100644
index 000000000000..6e1ab232907f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/navigation-preload-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('fetch', event => {
+  event.respondWith(event.preloadResponse);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-redirected.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-redirected.html
new file mode 100644
index 000000000000..f9bfce5e8953
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-redirected.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body>redirected</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-worker.js
new file mode 100644
index 000000000000..1b55f2ef0d98
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/redirect-worker.js
@@ -0,0 +1,35 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+function get_response_info(r) {
+  var info = {
+    type: r.type,
+    url: r.url,
+    status: r.status,
+    ok: r.ok,
+    statusText: r.statusText,
+    headers: []
+  };
+  r.headers.forEach((value, name) => { info.headers.push([value, name]); });
+  return info;
+}
+
+function post_to_page(data) {
+  return self.clients.matchAll()
+    .then(clients => clients.forEach(client => client.postMessage(data)));
+}
+
+self.addEventListener('fetch', event => {
+    event.respondWith(
+      event.preloadResponse
+        .then(
+          res => {
+            if (res.url.includes("base")) {
+              return res;
+            }
+            return post_to_page(get_response_info(res)).then(_ => res);
+          },
+          err => new Response(err.toString())));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/request-headers-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/request-headers-worker.js
new file mode 100644
index 000000000000..1006cf27913a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/request-headers-worker.js
@@ -0,0 +1,10 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        Promise.all[
+            self.registration.navigationPreload.enable(),
+            self.registration.navigationPreload.setHeaderValue('hello')]);
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js
new file mode 100644
index 000000000000..fac0d8de2a73
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js
@@ -0,0 +1,37 @@
+async function wait_for_performance_entries(url) {
+  let entries = performance.getEntriesByName(url);
+  if (entries.length > 0) {
+    return entries;
+  }
+  return new Promise((resolve) => {
+    new PerformanceObserver((list) => {
+      const entries = list.getEntriesByName(url);
+      if (entries.length > 0) {
+        resolve(entries);
+      }
+    }).observe({ entryTypes: ['resource'] });
+  });
+}
+
+self.addEventListener('activate', event => {
+    event.waitUntil(self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    let headers;
+    event.respondWith(
+      event.preloadResponse
+          .then(response => {
+            headers = response.headers;
+            return response.text()
+          })
+          .then(_ => wait_for_performance_entries(event.request.url))
+          .then(entries =>
+            new Response(
+              JSON.stringify({
+                decodedBodySize: headers.get('X-Decoded-Body-Size'),
+                encodedBodySize: headers.get('X-Encoded-Body-Size'),
+                timingEntries: entries
+              }),
+              {headers: {'Content-Type': 'text/html'}})));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-iframe.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-iframe.html
new file mode 100644
index 000000000000..a28b61261e82
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-iframe.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body>samesite</body>
+<script>
+onmessage = (e) => {
+  if (e.data === "GetBody") {
+    parent.postMessage("samesite", '*');
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-sw-helper.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-sw-helper.html
new file mode 100644
index 000000000000..51fdc9ec74bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-sw-helper.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload Same Site SW registrator</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/test-helpers.sub.js"></script>
+<script>
+
+/**
+ *  This is a helper file to register/unregister service worker in a same-site
+ *  iframe.
+ **/
+
+async function messageToParent(msg) {
+  parent.postMessage(msg, '*');
+}
+
+onmessage = async (e) => {
+  // t is a , but the helper function needs a test object.
+  let t = {
+    step_func: (func) => func,
+  };
+  if (e.data === "Register") {
+    let reg = await service_worker_unregister_and_register(t, "samesite-worker.js", ".");
+    let worker = reg.installing;
+    await wait_for_state(t, worker, 'activated');
+    await messageToParent("SW Registered");
+  } else if (e.data == "Unregister") {
+    await service_worker_unregister(t, ".");
+    await messageToParent("SW Unregistered");
+  }
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-worker.js
new file mode 100644
index 000000000000..f30e5ed274dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/samesite-worker.js
@@ -0,0 +1,8 @@
+self.addEventListener('activate', event => {
+    event.waitUntil(
+        self.registration.navigationPreload.enable());
+  });
+
+self.addEventListener('fetch', event => {
+    event.respondWith(event.preloadResponse);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/wait-for-activate-worker.js b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/wait-for-activate-worker.js
new file mode 100644
index 000000000000..87791d2e487d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/resources/wait-for-activate-worker.js
@@ -0,0 +1,40 @@
+// This worker remains in the installing phase so that the
+// navigation preload API can be tested when there is no
+// active worker.
+importScripts('/resources/testharness.js');
+importScripts('helpers.js');
+
+function expect_rejection(promise) {
+  return promise.then(
+      () => { return Promise.reject('unexpected fulfillment'); },
+      err => { assert_equals('InvalidStateError', err.name); });
+}
+
+function test_before_activation() {
+  const np = self.registration.navigationPreload;
+  return expect_rejection(np.enable())
+      .then(() => expect_rejection(np.disable()))
+      .then(() => expect_rejection(np.setHeaderValue('hi')))
+      .then(() => np.getState())
+      .then(state => expect_navigation_preload_state(
+          state, false, 'true', 'state should be the default'))
+      .then(() => 'PASS')
+      .catch(err => 'FAIL: ' + err);
+}
+
+var resolve_done_promise;
+var done_promise = new Promise(resolve => { resolve_done_promise = resolve; });
+
+// Run the test once the page messages this worker.
+self.addEventListener('message', e => {
+    e.waitUntil(test_before_activation()
+        .then(result => {
+            e.source.postMessage(result);
+            resolve_done_promise();
+          }));
+  });
+
+// Don't become the active worker until the test is done.
+self.addEventListener('install', e => {
+    e.waitUntil(done_promise);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-cookies.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-cookies.https.html
new file mode 100644
index 000000000000..a860d9545662
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-cookies.https.html
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>Navigation Preload: SameSite cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const scope = 'resources/cookie.py';
+const script = 'resources/navigation-preload-worker.js';
+
+async function drop_cookie(t, same_site, cookie) {
+    const frame = await with_iframe(scope + '?same-site=' + same_site + '&cookie-name=' + cookie + '&drop=1');
+    t.add_cleanup(() => frame.remove());
+}
+
+async function same_site_cookies_test(t, same_site, cookie) {
+  // Remove the cookie before the first visit.
+  await drop_cookie(t, same_site, cookie);
+
+  {
+    const frame = await with_iframe(scope + '?same-site=' + same_site + '&cookie-name=' + cookie + '&drop=0');
+    t.add_cleanup(() => frame.remove());
+    // The body will be 0 because this is the first visit.
+    assert_equals(frame.contentDocument.body.textContent, '0', 'first visit');
+  }
+
+  {
+    const frame = await with_iframe(scope + '?same-site=' + same_site + '&cookie-name=' + cookie + '&drop=0');
+    t.add_cleanup(() => frame.remove());
+    // The body will be 1 because this is the second visit.
+    assert_equals(frame.contentDocument.body.textContent, '1', 'second visit');
+  }
+
+  // Remove the cookie after the test.
+  t.add_cleanup(() => drop_cookie(t, same_site, cookie));
+}
+
+promise_test(async t => {
+  const registration =
+    await service_worker_unregister_and_register(t, script, scope);
+  promise_test(t => registration.unregister(), 'Unregister a service worker.');
+
+  await wait_for_state(t, registration.installing, 'activated');
+  await registration.navigationPreload.enable();
+}, 'Set up a service worker for navigation preload tests.');
+
+promise_test(async t => {
+  await same_site_cookies_test(t, 'None', 'cookie-key-none');
+}, 'Navigation Preload for same site cookies (None).');
+
+promise_test(async t => {
+  await same_site_cookies_test(t, 'Strict', 'cookie-key-strict');
+}, 'Navigation Preload for same site cookies (Strict).');
+
+promise_test(async t => {
+  await same_site_cookies_test(t, 'Lax', 'cookie-key-lax');
+}, 'Navigation Preload for same site cookies (Lax).');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-iframe.https.html
new file mode 100644
index 000000000000..633da9926a8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-preload/samesite-iframe.https.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Navigation Preload for same site iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<body></body>
+<script>
+
+const SAME_SITE = get_host_info().HTTPS_REMOTE_ORIGIN;
+const RESOURCES_DIR = "/service-workers/service-worker/navigation-preload/resources/";
+
+/**
+ * This test is used for testing the NavigationPreload works in a same site iframe.
+ * The test scenario is
+ * 1. Create a same site iframe to register service worker and wait for it be activated
+ * 2. Create a same site iframe which be intercepted by the service worker.
+ * 3. Once the iframe is loaded, service worker should set the page through the preload response.
+ *    And checking if the iframe's body content is expected.
+ * 4. Unregister the service worker.
+ * 5. remove created iframes.
+ */
+
+promise_test(async (t) => {
+    let resolver;
+    let checkValue = false;
+    window.onmessage = (e) => {
+      if (checkValue) {
+        assert_equals(e.data, "samesite");
+        checkValue = false;
+      }
+      resolver();
+    };
+
+    let helperIframe = document.createElement("iframe");
+    helperIframe.src = SAME_SITE + RESOURCES_DIR + "samesite-sw-helper.html";
+    document.body.appendChild(helperIframe);
+
+    await new Promise(resolve => {
+      resolver = resolve;
+      helperIframe.onload = async () => {
+        helperIframe.contentWindow.postMessage("Register", '*');
+     }
+    });
+
+    let sameSiteIframe = document.createElement("iframe");
+    sameSiteIframe.src = SAME_SITE + RESOURCES_DIR + "samesite-iframe.html";
+    document.body.appendChild(sameSiteIframe);
+    await new Promise(resolve => {
+      resolver = resolve;
+      sameSiteIframe.onload = async() => {
+        checkValue = true;
+        sameSiteIframe.contentWindow.postMessage("GetBody", '*')
+      }
+    });
+
+    await new Promise(resolve => {
+      resolver = resolve;
+      helperIframe.contentWindow.postMessage("Unregister", '*')
+    });
+
+    helperIframe.remove();
+    sameSiteIframe.remove();
+  });
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-body.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-body.https.html
new file mode 100644
index 000000000000..0441c610b179
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-body.https.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigation redirection must clear body</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<meta charset="utf-8">
+<body>
+<form id="test-form" method="POST" style="display: none;">
+  <input type="submit" id="submit-button" />
+</form>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/navigation-redirect-body.py';
+    var script = 'resources/navigation-redirect-body-worker.js';
+    var registration;
+    var frame = document.createElement('frame');
+    var form = document.getElementById('test-form');
+    var submit_button = document.getElementById('submit-button');
+
+    frame.src = 'about:blank';
+    frame.name = 'target_frame';
+    frame.id = 'frame';
+    document.body.appendChild(frame);
+    t.add_cleanup(function() { document.body.removeChild(frame); });
+
+    form.action = scope;
+    form.target = 'target_frame';
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          var frame_load_promise = new Promise(function(resolve) {
+              frame.addEventListener('load', function() {
+                  resolve(frame.contentWindow.document.body.innerText);
+                }, false);
+            });
+          submit_button.click();
+          return frame_load_promise;
+        })
+      .then(function(text) {
+          var request_uri = decodeURIComponent(text);
+          assert_equals(
+              request_uri,
+              '/service-workers/service-worker/resources/navigation-redirect-body.py?redirect');
+          return registration.unregister();
+        });
+  }, 'Navigation redirection must clear body');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-resolution.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-resolution.https.html
new file mode 100644
index 000000000000..59e1cafec348
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-resolution.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigation Redirect Resolution</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+function make_absolute(url) {
+  return new URL(url, location).toString();
+}
+
+const script = 'resources/fetch-rewrite-worker.js';
+
+function redirect_result_test(scope, expected_url, description) {
+  promise_test(async t => {
+    const registration = await service_worker_unregister_and_register(
+          t, script, scope);
+      t.add_cleanup(() => {
+        return service_worker_unregister(t, scope);
+      })
+      await wait_for_state(t, registration.installing, 'activated');
+
+      // The navigation to |scope| will be resolved by a fetch to |redirect_url|
+      // which returns a relative Location header. If it is resolved relative to
+      // |scope|, the result will be navigate-redirect-resolution/blank.html. If
+      // relative to |redirect_url|, it will be resources/blank.html. The latter
+      // is correct.
+      const iframe = await with_iframe(scope);
+      t.add_cleanup(() => { iframe.remove(); });
+      assert_equals(iframe.contentWindow.location.href,
+                    make_absolute(expected_url));
+  }, description);
+}
+
+// |redirect_url| serves a relative redirect to resources/blank.html.
+const redirect_url = 'resources/redirect.py?Redirect=blank.html';
+
+// |scope_base| does not exist but will be replaced with a fetch of
+// |redirect_url| by fetch-rewrite-worker.js.
+const scope_base = 'resources/subdir/navigation-redirect-resolution?' +
+    'redirect-mode=manual&url=' +
+    encodeURIComponent(make_absolute(redirect_url));
+
+// When the Service Worker forwards the result of |redirect_url| as an
+// opaqueredirect response, the redirect uses the response's URL list as the
+// base URL, not the request.
+redirect_result_test(scope_base, 'resources/blank.html',
+                     'test relative opaqueredirect');
+
+// The response's base URL should be preserved across CacheStorage and clone.
+redirect_result_test(scope_base + '&cache=1', 'resources/blank.html',
+                     'test relative opaqueredirect with CacheStorage');
+redirect_result_test(scope_base + '&clone=1', 'resources/blank.html',
+                     'test relative opaqueredirect with clone');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-to-http.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-to-http.https.html
new file mode 100644
index 000000000000..d4d2788c5891
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect-to-http.https.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>Service Worker: Service Worker can receive HTTP opaqueredirect response.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<meta charset="utf-8">
+<body></body>
+<script>
+async_test(function(t) {
+    var frame_src = get_host_info()['HTTPS_ORIGIN'] + base_path() +
+      'resources/navigation-redirect-to-http-iframe.html';
+    function on_message(e) {
+      assert_equals(e.data.results, 'OK');
+      t.done();
+    }
+
+    window.addEventListener('message', t.step_func(on_message), false);
+
+    with_iframe(frame_src)
+      .then(function(frame) {
+           t.add_cleanup(function() { frame.remove(); });
+         });
+  }, 'Verify Service Worker can receive HTTP opaqueredirect response.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect.https.html
new file mode 100644
index 000000000000..a87de5693163
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-redirect.https.html
@@ -0,0 +1,846 @@
+<!DOCTYPE html>
+<title>Service Worker: Navigation redirection</title>
+<meta name="timeout" content="long">
+<!-- default variant tests document.location and intercepted URLs -->
+<meta name="variant" content="?default">
+<!-- client variant tests the Clients API (resultingClientId and Client.url) -->
+<meta name="variant" content="?client">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const host_info = get_host_info();
+
+// This test registers three Service Workers at SCOPE1, SCOPE2 and
+// OTHER_ORIGIN_SCOPE. And checks the redirected page's URL and the requests
+// which are intercepted by Service Worker while loading redirect page.
+const BASE_URL = host_info['HTTPS_ORIGIN'] + base_path();
+const OTHER_BASE_URL = host_info['HTTPS_REMOTE_ORIGIN'] + base_path();
+
+const SCOPE1 = BASE_URL + 'resources/navigation-redirect-scope1.py?';
+const SCOPE2 = BASE_URL + 'resources/navigation-redirect-scope2.py?';
+const OUT_SCOPE = BASE_URL + 'resources/navigation-redirect-out-scope.py?';
+const SCRIPT = 'resources/redirect-worker.js';
+
+const OTHER_ORIGIN_IFRAME_URL =
+      OTHER_BASE_URL + 'resources/navigation-redirect-other-origin.html';
+const OTHER_ORIGIN_SCOPE =
+      OTHER_BASE_URL + 'resources/navigation-redirect-scope1.py?';
+const OTHER_ORIGIN_OUT_SCOPE =
+      OTHER_BASE_URL + 'resources/navigation-redirect-out-scope.py?';
+
+let registrations;
+let workers;
+let other_origin_frame;
+let message_resolvers = {};
+let next_message_id = 0;
+
+promise_test(async t  => {
+  // In this frame we register a service worker at OTHER_ORIGIN_SCOPE.
+  // And will use this frame to communicate with the worker.
+  other_origin_frame = await with_iframe(OTHER_ORIGIN_IFRAME_URL);
+
+  // Register same-origin service workers.
+  registrations = await Promise.all([
+      service_worker_unregister_and_register(t, SCRIPT, SCOPE1),
+      service_worker_unregister_and_register(t, SCRIPT, SCOPE2)]);
+
+  // Wait for all workers to activate.
+  workers = registrations.map(get_effective_worker);
+  return Promise.all([
+      wait_for_state(t, workers[0], 'activated'),
+      wait_for_state(t, workers[1], 'activated'),
+      // This promise will resolve when |wait_for_worker_promise|
+      // in OTHER_ORIGIN_IFRAME_URL resolves.
+      send_to_iframe(other_origin_frame, {command: 'wait_for_worker'})]);
+}, 'initialize global state');
+
+function get_effective_worker(registration) {
+  if (registration.active)
+    return registration.active;
+  if (registration.waiting)
+    return registration.waiting;
+  if (registration.installing)
+    return registration.installing;
+}
+
+async function check_all_intercepted_urls(expected_urls) {
+  const urls = [];
+  urls.push(await get_intercepted_urls(workers[0]));
+  urls.push(await get_intercepted_urls(workers[1]));
+  // Gets the request URLs which are intercepted by OTHER_ORIGIN_SCOPE's
+  // SW. This promise will resolve when get_request_infos() in
+  // OTHER_ORIGIN_IFRAME_URL resolves.
+  const request_infos = await send_to_iframe(other_origin_frame,
+                                             {command: 'get_request_infos'});
+  urls.push(request_infos.map(info => { return info.url; }));
+
+  assert_object_equals(urls, expected_urls, 'Intercepted URLs should match.');
+}
+
+// Checks |clients| returned from a worker. Only the client matching
+// |expected_final_client_tag| should be found. Returns true if a client was
+// found. Note that the final client is not necessarily found by this worker,
+// if the client is cross-origin.
+//
+// |clients| is an object like:
+// {x: {found: true, id: id1, url: url1}, b: {found: false}}
+function check_clients(clients,
+                       expected_id,
+                       expected_url,
+                       expected_final_client_tag,
+                       worker_name) {
+  let found = false;
+  Object.keys(clients).forEach(key => {
+    const info = clients[key];
+    if (info.found) {
+      assert_true(!!expected_final_client_tag,
+                  `${worker_name} client tag exists`);
+      assert_equals(key, expected_final_client_tag,
+                    `${worker_name} client tag matches`);
+      assert_equals(info.id, expected_id, `${worker_name} client id`);
+      assert_equals(info.url, expected_url, `${worker_name} client url`);
+      found = true;
+    }
+  });
+  return found;
+}
+
+function check_resulting_client_ids(infos, expected_infos, actual_ids, worker) {
+  assert_equals(infos.length, expected_infos.length,
+                `request length for ${worker}`);
+  for (var i = 0; i < infos.length; i++) {
+    const tag = expected_infos[i].resultingClientIdTag;
+    const url = expected_infos[i].url;
+    const actual_id = infos[i].resultingClientId;
+    const expected_id = actual_ids[tag];
+    assert_equals(typeof(actual_id), 'string',
+                  `resultingClientId for ${url} request to ${worker}`);
+    if (expected_id) {
+      assert_equals(actual_id, expected_id,
+                    `resultingClientId for ${url} request to ${worker}`);
+    } else {
+      actual_ids[tag] = actual_id;
+    }
+  }
+}
+
+// Creates an iframe and navigates to |url|, which is expected to start a chain
+// of redirects.
+// - |expected_last_url| is the expected window.location after the
+//   navigation.
+//
+// - |expected_request_infos| is the expected requests that the service workers
+//   were dispatched fetch events for. The format is:
+//   [
+//     [
+//       // Requests received by workers[0].
+//       {url: url1, resultingClientIdTag: 'a'},
+//       {url: url2, resultingClientIdTag: 'a'}
+//     ],
+//     [
+//       // Requests received by workers[1].
+//       {url: url3, resultingClientIdTag: 'a'}
+//     ],
+//     [
+//       // Requests received by the cross-origin worker.
+//       {url: url4, resultingClientIdTag: 'x'}
+//       {url: url5, resultingClientIdTag: 'x'}
+//     ]
+//   ]
+//   Here, |url| is |event.request.url| and |resultingClientIdTag| represents
+//   |event.resultingClientId|. Since the actual client ids are not known
+//   beforehand, the expectation isn't the literal expected value, but all equal
+//   tags must map to the same actual id.
+//
+// - |expected_final_client_tag| is the resultingClientIdTag that is
+//   expected to map to the created client's id. This is null if there
+//   is no such tag, which can happen when the final request was a cross-origin
+//   redirect to out-scope, so no worker received a fetch event whose
+//   resultingClientId is the id of the resulting client.
+//
+// In the example above:
+// - workers[0] receives two requests with the same resultingClientId.
+// - workers[1] receives one request also with that resultingClientId.
+// - The cross-origin worker receives two requests with the same
+//   resultingClientId which differs from the previous one.
+// - Assuming |expected_final_client_tag| is 'x', then the created
+//   client has the id seen by the cross-origin worker above.
+function redirect_test(url,
+                       expected_last_url,
+                       expected_request_infos,
+                       expected_final_client_tag,
+                       test_name) {
+  promise_test(async t => {
+    const frame = await with_iframe(url);
+    t.add_cleanup(() => { frame.remove(); });
+
+    // Switch on variant.
+    if (document.location.search == '?client') {
+      return client_variant_test(url, expected_last_url, expected_request_infos,
+                                 expected_final_client_tag, test_name);
+    }
+
+    return default_variant_test(url, expected_last_url, expected_request_infos,
+                                frame, test_name);
+  }, test_name);
+}
+
+// The default variant tests the request interception chain and
+// resulting document.location.
+async function default_variant_test(url,
+                                    expected_last_url,
+                                    expected_request_infos,
+                                    frame,
+                                    test_name) {
+  const expected_intercepted_urls = expected_request_infos.map(
+      requests_for_worker => {
+    return requests_for_worker.map(info => {
+      return info.url;
+    });
+  });
+  await check_all_intercepted_urls(expected_intercepted_urls);
+  const last_url = await send_to_iframe(frame, 'getLocation');
+  assert_equals(last_url, expected_last_url, 'Last URL should match.');
+}
+
+// The "client" variant tests the Clients API using resultingClientId.
+async function client_variant_test(url,
+                                   expected_last_url,
+                                   expected_request_infos,
+                                   expected_final_client_tag,
+                                   test_name) {
+  // Request infos is an array like:
+  // [
+  //   [{url: url1, resultingClientIdTag: tag1}],
+  //   [{url: url2, resultingClientIdTag: tag2}],
+  //   [{url: url3: resultingClientIdTag: tag3}]
+  // ]
+  const requestInfos = await get_all_request_infos();
+
+  // We check the actual infos against the expected ones, and learn the
+  // actual ids as we go.
+  const actual_ids = {};
+  check_resulting_client_ids(requestInfos[0],
+                             expected_request_infos[0],
+                             actual_ids,
+                             'worker0');
+  check_resulting_client_ids(requestInfos[1],
+                             expected_request_infos[1],
+                             actual_ids,
+                             'worker1');
+  check_resulting_client_ids(requestInfos[2],
+                             expected_request_infos[2],
+                             actual_ids,
+                             'crossOriginWorker');
+
+  // Now |actual_ids| maps tag to actual id:
+  // {x: id1, b: id2, c: id3}
+  // Ask each worker to try to resolve the actual ids to clients.
+  // Only |expected_final_client_tag| should resolve to a client.
+  const client_infos = await get_all_clients(actual_ids);
+
+  // Client infos is an object like:
+  // {
+  //   worker0: {x: {found: true, id: id1, url: url1}, b: {found: false}},
+  //   worker1: {x: {found: true, id: id1, url: url1}},
+  //   crossOriginWorker: {x: {found: false}}, {b: {found: false}}
+  // }
+  //
+  // Now check each client info. check_clients() verifies each info: only
+  // |expected_final_client_tag| should ever be found and the found client
+  // should have the expected url and id. A wrinkle is that not all workers
+  // will find the client, if they are cross-origin to the client. This
+  // means check_clients() trivially passes if no clients are found. So
+  // additionally check that at least one worker found the client (|found|),
+  // if that was expected (|expect_found|).
+  let found = false;
+  const expect_found = !!expected_final_client_tag;
+  const expected_id = actual_ids[expected_final_client_tag];
+  found = check_clients(client_infos.worker0,
+                        expected_id,
+                        expected_last_url,
+                        expected_final_client_tag,
+                        'worker0');
+  found = check_clients(client_infos.worker1,
+                        expected_id,
+                        expected_last_url,
+                        expected_final_client_tag,
+                        'worker1') || found;
+  found = check_clients(client_infos.crossOriginWorker,
+                        expected_id,
+                        expected_last_url,
+                        expected_final_client_tag,
+                        'crossOriginWorker') || found;
+  assert_equals(found, expect_found, 'client found');
+
+  if (!expect_found) {
+    // TODO(falken): Ask the other origin frame if it has a client of the
+    // expected URL.
+  }
+}
+
+window.addEventListener('message', on_message, false);
+
+function on_message(e) {
+  if (e.origin != host_info['HTTPS_REMOTE_ORIGIN'] &&
+      e.origin != host_info['HTTPS_ORIGIN'] ) {
+    console.error('invalid origin: ' + e.origin);
+    return;
+  }
+  var resolve = message_resolvers[e.data.id];
+  delete message_resolvers[e.data.id];
+  resolve(e.data.result);
+}
+
+function send_to_iframe(frame, message) {
+  var message_id = next_message_id++;
+  return new Promise(resolve => {
+    message_resolvers[message_id] = resolve;
+    frame.contentWindow.postMessage(
+        {id: message_id, message},
+        '*');
+  });
+}
+
+async function get_all_clients(actual_ids) {
+  const client_infos = {};
+  client_infos['worker0'] = await get_clients(workers[0], actual_ids);
+  client_infos['worker1'] = await get_clients(workers[1], actual_ids);
+  client_infos['crossOriginWorker'] =
+      await send_to_iframe(other_origin_frame,
+                           {command: 'get_clients', actual_ids});
+  return client_infos;
+}
+
+function get_clients(worker, actual_ids) {
+  return new Promise(resolve => {
+    var channel = new MessageChannel();
+    channel.port1.onmessage = (msg) => {
+      resolve(msg.data.clients);
+    };
+    worker.postMessage({command: 'getClients', actual_ids, port: channel.port2},
+                       [channel.port2]);
+  });
+}
+
+// Returns an array of the URLs that |worker| received fetch events for:
+//   [url1, url2]
+async function get_intercepted_urls(worker) {
+  const infos = await get_request_infos(worker);
+  return infos.map(info => { return info.url; });
+}
+
+// Returns the requests that |worker| received fetch events for. The return
+// value is an array of format:
+// [
+//   {url: url1, resultingClientId: id},
+//   {url: url2, resultingClientId: id}
+// ]
+function get_request_infos(worker) {
+  return new Promise(resolve => {
+    var channel = new MessageChannel();
+    channel.port1.onmessage = (msg) => {
+      resolve(msg.data.requestInfos);
+    };
+    worker.postMessage({command: 'getRequestInfos', port: channel.port2},
+                       [channel.port2]);
+  });
+}
+
+// Returns an array of the requests the workers received fetch events for:
+// [
+//   // Requests from workers[0].
+//   [
+//     {url: url1, resultingClientIdTag: tag1},
+//     {url: url2, resultingClientIdTag: tag1}
+//   ],
+//
+//   // Requests from workers[1].
+//   [{url: url3, resultingClientIdTag: tag2}],
+//
+//   // Requests from the cross-origin worker.
+//   []
+// ]
+async function get_all_request_infos()  {
+  const request_infos = [];
+  request_infos.push(await get_request_infos(workers[0]));
+  request_infos.push(await get_request_infos(workers[1]));
+  request_infos.push(await send_to_iframe(other_origin_frame,
+                                          {command: 'get_request_infos'}));
+  return request_infos;
+}
+
+let url;
+let url1;
+let url2;
+
+// Normal redirect (from out-scope to in-scope).
+url = SCOPE1;
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(url),
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Normal redirect to same-origin scope.');
+
+
+url = SCOPE1 + '#ref';
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(SCOPE1) + '#ref',
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Normal redirect to same-origin scope with a hash fragment.');
+
+url = SCOPE1 + '#ref2';
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(url) + '#ref',
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Normal redirect to same-origin scope with different hash fragments.');
+
+url = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    OUT_SCOPE + 'url=' + encodeURIComponent(url),
+    url,
+    [[], [], [{url, resultingClientIdTag: 'x'}]],
+    'x',
+    'Normal redirect to other-origin scope.');
+
+// SW fallbacked redirect. SW doesn't handle the fetch request.
+url = SCOPE1 + 'url=' + encodeURIComponent(OUT_SCOPE);
+redirect_test(
+    url,
+    OUT_SCOPE,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-fallbacked redirect to same-origin out-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin same-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE1) + '#ref';
+url2 = SCOPE1 + '#ref';
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin same-scope with a hash fragment.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE1 + '#ref2') + '#ref';
+url2 = SCOPE1 + '#ref2';
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin same-scope with different hash ' +
+    'fragments.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'SW-fallbacked redirect to same-origin other-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'SW-fallbacked redirect to other-origin out-scope.');
+
+url1 = SCOPE1 + 'url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'SW-fallbacked redirect to other-origin in-scope.');
+
+
+url3 = SCOPE1;
+url2 = OTHER_ORIGIN_SCOPE + 'url=' + encodeURIComponent(url3);
+url1 = SCOPE1 + 'url=' + encodeURIComponent(url2);
+redirect_test(
+    url1,
+    url3,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'a'},
+        {url: url3, resultingClientIdTag: 'x'}
+      ],
+      [],
+      [{url: url2, resultingClientIdTag: 'b'}]
+    ],
+    'x',
+    'SW-fallbacked redirect to other-origin and back to same-origin.');
+
+// SW generated redirect.
+// SW: event.respondWith(Response.redirect(params['url']));
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OUT_SCOPE);
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-generated redirect to same-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OUT_SCOPE) + '#ref';
+url2 = OUT_SCOPE + '#ref';
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-generated redirect to same-origin out-scope with a hash fragment.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OUT_SCOPE + '#ref2') + '#ref';
+url2 = OUT_SCOPE + '#ref2';
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-generated redirect to same-origin out-scope with different hash ' +
+    'fragments.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-generated redirect to same-origin same-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'SW-generated redirect to same-origin other-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'SW-generated redirect to other-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=gen&url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'SW-generated redirect to other-origin in-scope.');
+
+
+// SW fetched redirect.
+// SW: event.respondWith(fetch(event.request));
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(OUT_SCOPE)
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'SW-fetched redirect to same-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fetched redirect to same-origin same-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'SW-fetched redirect to same-origin other-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'SW-fetched redirect to other-origin out-scope.');
+
+url1 = SCOPE1 + 'sw=fetch&url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'SW-fetched redirect to other-origin in-scope.');
+
+
+// SW responds with a fetch from a different url.
+// SW: event.respondWith(fetch(params['url']));
+url2 = SCOPE1;
+url1 = SCOPE1 + 'sw=fetch-url&url=' + encodeURIComponent(url2);
+redirect_test(
+    url1,
+    url1,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'SW-fetched response from different URL, same-origin same-scope.');
+
+
+// Opaque redirect.
+// SW: event.respondWith(fetch(
+//         new Request(event.request.url, {redirect: 'manual'})));
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(OUT_SCOPE);
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Redirect to same-origin out-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'Redirect to same-origin same-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'Redirect to same-origin other-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'Redirect to other-origin out-scope with opaque redirect response.');
+
+url1 = SCOPE1 + 'sw=manual&url=' + encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}]
+    ],
+    'x',
+    'Redirect to other-origin in-scope with opaque redirect response.');
+
+url= SCOPE1 + 'sw=manual&noLocationRedirect';
+redirect_test(
+    url, url, [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'No location redirect response.');
+
+
+// Opaque redirect passed through Cache.
+// SW responds with an opaque redirectresponse from the Cache API.
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' + encodeURIComponent(OUT_SCOPE);
+url2 = OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'Redirect to same-origin out-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' + encodeURIComponent(SCOPE1);
+url2 = SCOPE1;
+redirect_test(
+    url1,
+    url2,
+    [
+      [
+        {url: url1, resultingClientIdTag: 'x'},
+        {url: url2, resultingClientIdTag: 'x'}
+      ],
+      [],
+      []
+    ],
+    'x',
+    'Redirect to same-origin same-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' + encodeURIComponent(SCOPE2);
+url2 = SCOPE2;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'x'}],
+      [{url: url2, resultingClientIdTag: 'x'}],
+      []
+    ],
+    'x',
+    'Redirect to same-origin other-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' +
+       encodeURIComponent(OTHER_ORIGIN_OUT_SCOPE);
+url2 = OTHER_ORIGIN_OUT_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [[{url: url1, resultingClientIdTag: 'a'}], [], []],
+    null,
+    'Redirect to other-origin out-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url1 = SCOPE1 + 'sw=manualThroughCache&url=' +
+       encodeURIComponent(OTHER_ORIGIN_SCOPE);
+url2 = OTHER_ORIGIN_SCOPE;
+redirect_test(
+    url1,
+    url2,
+    [
+      [{url: url1, resultingClientIdTag: 'a'}],
+      [],
+      [{url: url2, resultingClientIdTag: 'x'}],
+    ],
+    'x',
+    'Redirect to other-origin in-scope with opaque redirect response which ' +
+    'is passed through Cache.');
+
+url = SCOPE1 + 'sw=manualThroughCache&noLocationRedirect';
+redirect_test(
+    url,
+    url,
+    [[{url, resultingClientIdTag: 'x'}], [], []],
+    'x',
+    'No location redirect response via Cache.');
+
+// Clean up the test environment. This promise_test() needs to be the last one.
+promise_test(async t => {
+  registrations.forEach(async registration => {
+    if (registration)
+      await registration.unregister();
+  });
+  await send_to_iframe(other_origin_frame, {command: 'unregister'});
+  other_origin_frame.remove();
+}, 'clean up global state');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-sets-cookie.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-sets-cookie.https.html
new file mode 100644
index 000000000000..7f6c756f5572
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-sets-cookie.https.html
@@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Navigation setting cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const scopepath = '/cookies/resources/setSameSite.py?with-sw';
+
+async function unregister_service_worker(origin) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/unregister-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-UNREGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function register_service_worker(origin) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/register-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-REGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function clear_cookies(origin) {
+  let target_url = origin + '/cookies/samesite/resources/puppet.html';
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('READY');
+    w.postMessage({ type: 'drop' }, '*');
+    await wait_for_message('drop-complete');
+  } finally {
+    w.close();
+  }
+}
+
+// The following tests are adapted from /cookies/samesite/setcookie-navigation.https.html
+
+// Asserts that cookies are present or not present (according to `expectation`)
+// in the cookie string `cookies` with the correct names and value.
+function assert_cookies_present(cookies, value, expected_cookie_names, expectation) {
+  for (name of expected_cookie_names) {
+    let re = new RegExp("(?:^|; )" + name + "=" + value + "(?:$|;)");
+    let assertion = expectation ? assert_true : assert_false;
+    assertion(re.test(cookies), "`" + name + "=" + value + "` in cookies");
+  }
+}
+
+// Navigate from ORIGIN to |origin_to|, expecting the navigation to set SameSite
+// cookies on |origin_to|.
+function navigate_test(method, origin_to, query, title) {
+  promise_test(async function(t) {
+    // The cookies don't need to be cleared on each run because |value| is
+    // a new random value on each run, so on each run we are overwriting and
+    // checking for a cookie with a different random value.
+    let value = query + "&" + Math.random();
+    let url_from = SECURE_ORIGIN + "/cookies/samesite/resources/navigate.html"
+    let url_to = origin_to + "/cookies/resources/setSameSite.py?" + value;
+    var w = window.open(url_from);
+    await wait_for_message('READY', SECURE_ORIGIN);
+    assert_equals(SECURE_ORIGIN, window.origin);
+    assert_equals(SECURE_ORIGIN, w.origin);
+    let command = (method === "POST") ? "post-form" : "navigate";
+    w.postMessage({ type: command, url: url_to }, "*");
+    let message = await wait_for_message('COOKIES_SET', origin_to);
+    let samesite_cookie_names = ['samesite_strict', 'samesite_lax', 'samesite_none', 'samesite_unspecified'];
+    assert_cookies_present(message.data.cookies, value, samesite_cookie_names, true);
+    w.close();
+  }, title);
+}
+
+promise_test(async t => {
+  await register_service_worker(SECURE_ORIGIN);
+  await register_service_worker(SECURE_CROSS_SITE_ORIGIN);
+}, 'Setup service workers');
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw&ignore",
+              "Same-site top-level navigation with fallback service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw&ignore",
+              "Cross-site top-level navigation with fallback service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_ORIGIN, "with-sw&ignore",
+              "Same-site top-level POST with fallback service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "with-sw&ignore",
+              "Cross-site top-level with fallback service worker POST should be able to set SameSite=* cookies.");
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw",
+              "Same-site top-level navigation with passthrough service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw",
+              "Cross-site top-level navigation with passthrough service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_ORIGIN, "with-sw",
+              "Same-site top-level POST with passthrough service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "with-sw",
+              "Cross-site top-level with passthrough service worker POST should be able to set SameSite=* cookies.");
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw&navpreload",
+              "Same-site top-level navigation with navpreload service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw&navpreload",
+              "Cross-site top-level navigation with navpreload service worker should be able to set SameSite=* cookies.");
+// navpreload not supported with POST method
+
+navigate_test("GET", SECURE_ORIGIN, "with-sw&change-request",
+              "Same-site top-level navigation with change-request service worker should be able to set SameSite=* cookies.");
+navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "with-sw&change-request",
+              "Cross-site top-level navigation with change-request service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_ORIGIN, "with-sw&change-request",
+              "Same-site top-level POST with change-request service worker should be able to set SameSite=* cookies.");
+navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "with-sw&change-request",
+              "Cross-site top-level with change-request service worker POST should be able to set SameSite=* cookies.");
+
+promise_test(async t => {
+  await unregister_service_worker(SECURE_ORIGIN);
+  await unregister_service_worker(SECURE_CROSS_SITE_ORIGIN);
+  await clear_cookies(SECURE_ORIGIN);
+  await clear_cookies(SECURE_CROSS_SITE_ORIGIN);
+}, 'Cleanup service workers');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-timing-extended.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-extended.https.html
new file mode 100644
index 000000000000..acb02c6fe1f5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-extended.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+const timingEventOrder = [
+    'startTime',
+    'workerStart',
+    'fetchStart',
+    'requestStart',
+    'responseStart',
+    'responseEnd',
+];
+
+function navigate_in_frame(frame, url) {
+    frame.contentWindow.location = url;
+    return new Promise((resolve) => {
+        frame.addEventListener('load', () => {
+            const timing = frame.contentWindow.performance.getEntriesByType('navigation')[0];
+            const {timeOrigin} = frame.contentWindow.performance;
+            resolve({
+                workerStart: timing.workerStart + timeOrigin,
+                fetchStart: timing.fetchStart + timeOrigin
+            })
+        });
+    });
+}
+
+const worker_url = 'resources/navigation-timing-worker-extended.js';
+
+promise_test(async (t) => {
+    const scope = 'resources/timings/dummy.html';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activating');
+    const frame = await with_iframe('resources/empty.html');
+    t.add_cleanup(() => frame.remove());
+
+    const [timingFromEntry, timingFromWorker] = await Promise.all([
+        navigate_in_frame(frame, scope),
+        new Promise(resolve => {
+            window.addEventListener('message', m => {
+                resolve(m.data)
+            })
+        })])
+
+    assert_greater_than(timingFromWorker.activateWorkerEnd, timingFromEntry.workerStart,
+        'workerStart marking should not wait for worker activation to finish');
+    assert_greater_than(timingFromEntry.fetchStart, timingFromWorker.activateWorkerEnd,
+        'fetchStart should be marked once the worker is activated');
+    assert_greater_than(timingFromWorker.handleFetchEvent, timingFromEntry.fetchStart,
+        'fetchStart should be marked before the Fetch event handler is called');
+}, 'Service worker controlled navigation timing');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-timing-sizes.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-sizes.https.html
new file mode 100644
index 000000000000..e726a31f1706
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-timing-sizes.https.html
@@ -0,0 +1,113 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker Navigation Timing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<body>
+  <script>
+
+    promise_test(async t => {
+      var script = 'resources/pass-through-worker.js';
+      var scope = 'resources/blank.html';
+
+      const registration = await service_worker_unregister_and_register(t, script, scope);
+      t.add_cleanup(() => registration.unregister());
+      await wait_for_state(t, registration.installing, 'activated');
+
+      const iframe = await with_iframe(scope);
+
+      // Sanity, to check that we actually loaded the document.
+      assert_equals(iframe.contentWindow.document.title, "Empty doc");
+      t.add_cleanup(() => iframe.remove());
+      const navigationEntry = iframe.contentWindow.performance.getEntriesByType("navigation")[0];
+
+      const main_page_resource_timing = performance.getEntriesByType("resource").filter(
+        e => e.name.includes('blank'))[0];
+
+      assert_greater_than(navigationEntry.encodedBodySize, 0,
+        'Navigation timing should have encodedBodySize larger than 0.');
+
+      assert_equals(navigationEntry.decodedBodySize, navigationEntry.encodedBodySize,
+        'Navigation timing\'s decodedBodySize and encodedBodySize should be equal.');
+
+      assert_greater_than(main_page_resource_timing.encodedBodySize, 0,
+        'Corresponding resource timing emitted on parent page should have decodedBodySize larger than 0.');
+
+      assert_equals(main_page_resource_timing.encodedBodySize, main_page_resource_timing.decodedBodySize,
+        'Corresponding resource timing emitted on parent page should have equal\
+        decodedBodySize and encodedBodySize.');
+
+    }, 'Body sizes in a regular pass-through');
+
+    promise_test(async t => {
+      var script = 'resources/pass-through-worker.js';
+      var scope = 'resources/simple.txt';
+
+      const registration = await service_worker_unregister_and_register(t, script, scope);
+      t.add_cleanup(() => registration.unregister());
+      await wait_for_state(t, registration.installing, 'activated');
+
+      const iframe = await with_iframe(scope);
+
+      // Sanity, to check that we actually loaded the text file.
+      assert_equals(iframe.contentWindow.document.body.textContent, "a simple text file\n");
+      t.add_cleanup(() => iframe.remove());
+      const navigationEntry = iframe.contentWindow.performance.getEntriesByType("navigation")[0];
+
+      const main_page_resource_timing = performance.getEntriesByType("resource").filter(
+        e => e.name.includes('blank'))[0];
+
+      assert_greater_than(navigationEntry.encodedBodySize, 0,
+        'Navigation timing should have encodedBodySize larger than 0.');
+
+      assert_equals(navigationEntry.decodedBodySize, navigationEntry.encodedBodySize,
+        'Navigation timing\'s decodedBodySize and encodedBodySize should be equal.');
+
+      assert_greater_than(main_page_resource_timing.encodedBodySize, 0,
+        'Corresponding resource timing emitted on parent page should have decodedBodySize larger than 0.');
+
+      assert_equals(main_page_resource_timing.encodedBodySize, main_page_resource_timing.decodedBodySize,
+        'Corresponding resource timing emitted on parent page should have equal\
+        decodedBodySize and encodedBodySize.');
+
+    }, 'Body sizes in a pass-through with non html content');
+
+    promise_test(async t => {
+      var script = 'resources/pass-through-worker.js';
+      var scope = 'resources/blank.html';
+
+      const registration = await service_worker_unregister_and_register(t, script, scope);
+      t.add_cleanup(() => registration.unregister());
+      await wait_for_state(t, registration.installing, 'activated');
+
+      const iframe = await with_iframe(scope + "?pipe=gzip");
+      // Sanity, to check that we actually loaded the document.
+      assert_equals(iframe.contentWindow.document.title, "Empty doc");
+      t.add_cleanup(() => iframe.remove());
+
+      const navigationEntry = iframe.contentWindow.performance.getEntriesByType("navigation")[0];
+
+      const main_page_resource_timing = performance.getEntriesByType("resource").filter(
+        e => e.name.includes('blank'))[0];
+
+      assert_greater_than(navigationEntry.decodedBodySize, 0,
+        'Navigation timing should have decodedBodySize larger than 0.');
+
+      // The response body that comes from a service worker respondWith promise
+      // should have identical encoded and decoded body sizes, regardless of what
+      // the service worker itself saw, according to the spec.
+      assert_equals(navigationEntry.encodedBodySize, navigationEntry.decodedBodySize,
+        'Navigation timing should have equal decodedBodySize and encodedBodySize.');
+
+      assert_greater_than(main_page_resource_timing.decodedBodySize, 0,
+        'Corresponding resource timing emitted on parent page should have decodedBodySize larger than 0.');
+
+      assert_equals(main_page_resource_timing.encodedBodySize, navigationEntry.decodedBodySize,
+        'Corresponding resource timing emitted on parent page should have equal decodedBodySize and \
+        encodedBodySize.');
+
+    }, 'Body sizes in a regular pass-through with gzip');
+  </script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/navigation-timing.https.html b/test/fixtures/wpt/service-workers/service-worker/navigation-timing.https.html
new file mode 100644
index 000000000000..75cab40458c6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/navigation-timing.https.html
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+
+<script>
+const timingEventOrder = [
+    'startTime',
+    'workerStart',
+    'fetchStart',
+    'requestStart',
+    'responseStart',
+    'responseEnd',
+];
+
+function verify(timing) {
+    for (let i = 0; i < timingEventOrder.length - 1; i++) {
+        assert_true(timing[timingEventOrder[i]] <= timing[timingEventOrder[i + 1]],
+                `Expected ${timingEventOrder[i]} <= ${timingEventOrder[i + 1]}`);
+    }
+}
+
+function navigate_in_frame(frame, url) {
+    frame.contentWindow.location = url;
+    return new Promise((resolve) => {
+        frame.addEventListener('load', () => {
+            const timing = frame.contentWindow.performance.getEntriesByType('navigation')[0];
+            resolve(timing);
+        });
+    });
+}
+
+const worker_url = 'resources/navigation-timing-worker.js';
+
+promise_test(async (t) => {
+    const scope = 'resources/empty.html';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+
+    const timing = await navigate_in_frame(frame, scope);
+    assert_greater_than(timing.workerStart, 0);
+    verify(timing);
+}, 'Service worker controlled navigation timing');
+
+promise_test(async (t) => {
+    const scope = 'resources/empty.html?network-fallback';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+
+    const timing = await navigate_in_frame(frame, scope);
+    assert_greater_than(timing.workerStart, 0);
+    verify(timing);
+}, 'Service worker controlled navigation timing network fallback');
+
+promise_test(async (t) => {
+    const scope = 'resources/redirect.py?Redirect=empty.html';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+
+    const timing = await navigate_in_frame(frame, scope);
+    verify(timing);
+    // Additional checks for redirected navigation.
+    assert_true(timing.redirectStart <= timing.redirectEnd,
+        'Expected redirectStart <= redirectEnd');
+    assert_true(timing.redirectEnd <= timing.fetchStart,
+        'Expected redirectEnd <= fetchStart');
+}, 'Service worker controlled navigation timing redirect');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/nested-blob-url-workers.https.html b/test/fixtures/wpt/service-workers/service-worker/nested-blob-url-workers.https.html
new file mode 100644
index 000000000000..7269cbb701fa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/nested-blob-url-workers.https.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Service Worker: nested blob URL worker clients</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/simple-intercept-worker.js';
+const SCOPE = 'resources/';
+const RESOURCE = 'resources/simple.txt';
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-workers.html');
+}, 'Nested blob URL workers should be intercepted by a service worker.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-worker-created-from-blob-url-worker.html');
+}, 'Nested worker created from a blob URL worker should be intercepted by a service worker.');
+
+promise_test((t) => {
+  return runTest(t, 'resources/nested-blob-url-worker-created-from-worker.html');
+}, 'Nested blob URL worker created from a worker should be intercepted by a service worker.');
+
+async function runTest(t, iframe_url) {
+  const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  t.add_cleanup(_ => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const frame = await with_iframe(iframe_url);
+  t.add_cleanup(_ => frame.remove());
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                    null, 'frame should be controlled');
+
+  const response_text = await frame.contentWindow.fetch_in_worker(RESOURCE);
+  assert_equals(response_text, 'intercepted by service worker',
+                'fetch() should be intercepted.');
+}
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/next-hop-protocol.https.html b/test/fixtures/wpt/service-workers/service-worker/next-hop-protocol.https.html
new file mode 100644
index 000000000000..0805db9e24db
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/next-hop-protocol.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Verify nextHopProtocol is set correctly</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+async function getNextHopProtocol(frame, url) {
+  let final_url = new URL(url, self.location).href;
+  await frame.contentWindow.fetch(final_url).then(r => r.text());
+  let entryList = frame.contentWindow.performance.getEntriesByName(final_url);
+  let entry = entryList[entryList.length - 1];
+  return entry.nextHopProtocol;
+}
+
+async function runTest(t, base_url, expected_protocol) {
+  const scope = 'resources/empty.html?next-hop-protocol';
+  const script = 'resources/fetch-rewrite-worker.js';
+  let frame;
+
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(async _ => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  frame = await with_iframe(scope);
+  t.add_cleanup(_ => frame.remove());
+
+  assert_equals(await getNextHopProtocol(frame, `${base_url}?generate-png`),
+                '', 'nextHopProtocol is not set on synthetic response');
+  assert_equals(await getNextHopProtocol(frame, `${base_url}?ignore`),
+                expected_protocol, 'nextHopProtocol is set on fallback');
+  assert_equals(await getNextHopProtocol(frame, `${base_url}`),
+                '', 'nextHopProtocol is not set on pass-through');
+  assert_equals(await getNextHopProtocol(frame, `${base_url}?cache`),
+                '', 'nextHopProtocol is not set on cached response');
+}
+
+promise_test(async (t) => {
+  return runTest(t, 'resources/empty.js', 'http/1.1');
+}, 'nextHopProtocol reports H1 correctly when routed via a service worker.');
+
+// This may be expected to fail if the WPT infrastructure does not fully
+// support H2 protocol testing yet.
+promise_test(async (t) => {
+  return runTest(t, 'resources/empty.h2.js', 'h2');
+}, 'nextHopProtocol reports H2 correctly when routed via a service worker.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import-in-module.any.js b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import-in-module.any.js
new file mode 100644
index 000000000000..f7c2ef37b8b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import-in-module.any.js
@@ -0,0 +1,7 @@
+// META: global=serviceworker-module
+
+// This is imported to ensure import('./basic-module-2.js') fails even if
+// it has been previously statically imported.
+import './resources/basic-module-2.js';
+
+import './resources/no-dynamic-import.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import.any.js b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import.any.js
new file mode 100644
index 000000000000..25b370b7094b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/no-dynamic-import.any.js
@@ -0,0 +1,3 @@
+// META: global=serviceworker
+
+importScripts('resources/no-dynamic-import.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/onactivate-script-error.https.html b/test/fixtures/wpt/service-workers/service-worker/onactivate-script-error.https.html
new file mode 100644
index 000000000000..f5e80bb9a456
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/onactivate-script-error.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_install(worker) {
+  return new Promise(function(resolve, reject) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'installed')
+            resolve();
+          else if (worker.state == 'redundant')
+            reject();
+        });
+    });
+}
+
+function wait_for_activate(worker) {
+  return new Promise(function(resolve, reject) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'activated')
+            resolve();
+          else if (worker.state == 'redundant')
+            reject();
+        });
+    });
+}
+
+function make_test(name, script) {
+  promise_test(function(t) {
+      var scope = script;
+      var registration;
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(function(r) {
+            registration = r;
+
+            t.add_cleanup(function() {
+                return r.unregister();
+              });
+
+            return wait_for_install(registration.installing);
+          })
+        .then(function() {
+            // Activate should succeed regardless of script errors.
+            return wait_for_activate(registration.waiting);
+          });
+    }, name);
+}
+
+[
+  {
+    name: 'activate handler throws an error',
+    script: 'resources/onactivate-throw-error-worker.js',
+  },
+  {
+    name: 'activate handler throws an error, error handler does not cancel',
+    script: 'resources/onactivate-throw-error-with-empty-onerror-worker.js',
+  },
+  {
+    name: 'activate handler dispatches an event that throws an error',
+    script: 'resources/onactivate-throw-error-from-nested-event-worker.js',
+  },
+  {
+    name: 'activate handler throws an error that is cancelled',
+    script: 'resources/onactivate-throw-error-then-cancel-worker.js',
+  },
+  {
+    name: 'activate handler throws an error and prevents default',
+    script: 'resources/onactivate-throw-error-then-prevent-default-worker.js',
+  }
+].forEach(function(test_case) {
+    make_test(test_case.name, test_case.script);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/oninstall-script-error.https.html b/test/fixtures/wpt/service-workers/service-worker/oninstall-script-error.https.html
new file mode 100644
index 000000000000..fe7f6e901206
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/oninstall-script-error.https.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function wait_for_install_event(worker) {
+  return new Promise(function(resolve) {
+      worker.addEventListener('statechange', function(event) {
+          if (worker.state == 'installed')
+            resolve(true);
+          else if (worker.state == 'redundant')
+            resolve(false);
+        });
+    });
+}
+
+function make_test(name, script, expect_install) {
+  promise_test(function(t) {
+      var scope = script;
+      return service_worker_unregister_and_register(t, script, scope)
+        .then(function(registration) {
+            return wait_for_install_event(registration.installing);
+          })
+        .then(function(did_install) {
+            assert_equals(did_install, expect_install,
+                          'The worker was installed');
+          })
+    }, name);
+}
+
+[
+  {
+    name: 'install handler throws an error',
+    script: 'resources/oninstall-throw-error-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler throws an error, error handler does not cancel',
+    script: 'resources/oninstall-throw-error-with-empty-onerror-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler dispatches an event that throws an error',
+    script: 'resources/oninstall-throw-error-from-nested-event-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler throws an error in the waitUntil',
+    script: 'resources/oninstall-waituntil-throw-error-worker.js',
+    expect_install: false
+  },
+
+  // The following two cases test what happens when the ServiceWorkerGlobalScope
+  // 'error' event handler cancels the resulting error event.  Since the
+  // original 'install' event handler through, the installation should still
+  // be stopped in this case.  See:
+  // https://github.com/slightlyoff/ServiceWorker/issues/778
+  {
+    name: 'install handler throws an error that is cancelled',
+    script: 'resources/oninstall-throw-error-then-cancel-worker.js',
+    expect_install: true
+  },
+  {
+    name: 'install handler throws an error and prevents default',
+    script: 'resources/oninstall-throw-error-then-prevent-default-worker.js',
+    expect_install: true
+  }
+].forEach(function(test_case) {
+    make_test(test_case.name, test_case.script, test_case.expect_install);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/opaque-response-preloaded.https.html b/test/fixtures/wpt/service-workers/service-worker/opaque-response-preloaded.https.html
new file mode 100644
index 000000000000..417aa4ebec83
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/opaque-response-preloaded.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Opaque responses should not be reused for XHRs</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const WORKER =
+  'resources/opaque-response-preloaded-worker.js';
+
+var done;
+
+// These test that the browser does not inappropriately use a cached opaque
+// response for a request that is not no-cors. The test opens a controlled
+// iframe that uses link rel=preload to issue a same-origin no-cors request.
+// The service worker responds to the request with an opaque response. Then the
+// iframe does an XHR (not no-cors) to that URL again. The request should fail.
+promise_test(t => {
+    const SCOPE =
+      'resources/opaque-response-being-preloaded-xhr.html';
+    const promise = new Promise(resolve => done = resolve);
+
+    return service_worker_unregister_and_register(t, WORKER, SCOPE)
+      .then(reg => {
+           add_completion_callback(() => reg.unregister());
+           return wait_for_state(t, reg.installing, 'activated');
+         })
+      .then(() => with_iframe(SCOPE))
+      .then(frame => t.add_cleanup(() => frame.remove() ))
+      .then(() => promise)
+      .then(result => assert_equals(result, 'PASS'));
+  }, 'Opaque responses should not be reused for XHRs, loading case');
+
+promise_test(t => {
+    const SCOPE =
+      'resources/opaque-response-preloaded-xhr.html';
+    const promise = new Promise(resolve => done = resolve);
+
+    return service_worker_unregister_and_register(t, WORKER, SCOPE)
+      .then(reg => {
+           add_completion_callback(() => reg.unregister());
+           return wait_for_state(t, reg.installing, 'activated');
+         })
+      .then(() => with_iframe(SCOPE))
+      .then(frame => t.add_cleanup(() => frame.remove() ))
+      .then(() => promise)
+      .then(result => assert_equals(result, 'PASS'));
+  }, 'Opaque responses should not be reused for XHRs, done case');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/opaque-script.https.html b/test/fixtures/wpt/service-workers/service-worker/opaque-script.https.html
new file mode 100644
index 000000000000..7d2121855dfa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/opaque-script.https.html
@@ -0,0 +1,71 @@
+<!doctype html>
+<title>Cache Storage: verify scripts loaded from cache_storage are marked opaque</title>
+<link rel="help" href="https://w3c.github.io/ServiceWorker/#cache-interface">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+'use strict';
+
+const SW_URL = 'resources/opaque-script-sw.js';
+const BASE_SCOPE = './resources/opaque-script-frame.html';
+const SAME_ORIGIN_BASE = new URL('./resources/', self.location.href).href;
+const CROSS_ORIGIN_BASE = new URL('./resources/',
+    get_host_info().HTTPS_REMOTE_ORIGIN + base_path()).href;
+
+function wait_for_error() {
+  return new Promise(resolve => {
+    self.addEventListener('message', function messageHandler(evt) {
+      if (evt.data.type !== 'ErrorEvent')
+        return;
+      self.removeEventListener('message', messageHandler);
+      resolve(evt.data.msg);
+    });
+  });
+}
+
+// Load an iframe that dynamically adds a script tag that is
+// same/cross origin and large/small.  It then calls a function
+// defined in that loaded script that throws an unhandled error.
+// The resulting message exposed in the global onerror handler
+// is reported back from this function.  Opaque cross origin
+// scripts should not expose the details of the uncaught exception.
+async function get_error_message(t, mode, size) {
+  const script_base = mode === 'same-origin' ? SAME_ORIGIN_BASE
+                                             : CROSS_ORIGIN_BASE;
+  const script = script_base + `opaque-script-${size}.js`;
+  const scope = BASE_SCOPE + `?script=${script}`;
+  const reg = await service_worker_unregister_and_register(t, SW_URL, scope);
+  t.add_cleanup(_ => reg.unregister());
+  assert_true(!!reg.installing);
+  await wait_for_state(t, reg.installing, 'activated');
+  const error_promise = wait_for_error();
+  const f = await with_iframe(scope);
+  t.add_cleanup(_ => f.remove());
+  const error = await error_promise;
+  return error;
+}
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'same-origin', 'small');
+  assert_true(error.includes('Intentional error'));
+}, 'Verify small same-origin cache_storage scripts are not opaque.');
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'same-origin', 'large');
+  assert_true(error.includes('Intentional error'));
+}, 'Verify large same-origin cache_storage scripts are not opaque.');
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'cross-origin', 'small');
+  assert_false(error.includes('Intentional error'));
+}, 'Verify small cross-origin cache_storage scripts are opaque.');
+
+promise_test(async t => {
+  const error = await get_error_message(t, 'cross-origin', 'large');
+  assert_false(error.includes('Intentional error'));
+}, 'Verify large cross-origin cache_storage scripts are opaque.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-claim.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-claim.tentative.https.html
new file mode 100644
index 000000000000..1f42c528e0b3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-claim.tentative.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+This test creates a iframe in a first-party context and then registers a
+service worker (such that the iframe client is unclaimed).
+A third-party iframe is then created which has its SW call clients.claim()
+and then the test checks that the 1p iframe was not claimed int he process.
+Finally the test has its SW call clients.claim() and confirms the 1p iframe is
+claimed.
+
+<script>
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js';
+  const scope = './resources/partitioned-';
+
+  // Add a 1p iframe.
+  const wait_frame_url = new URL(
+    './resources/partitioned-service-worker-iframe-claim.html?1p-mode',
+    self.location);
+
+  const frame = await with_iframe(wait_frame_url, false);
+  t.add_cleanup(async () => {
+    frame.remove();
+  });
+
+  // Add service worker to this 1P context.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Register the message listener.
+  self.addEventListener('message', messageEventHandler);
+
+  // Now we need to create a third-party iframe whose SW will claim it and then
+  // the iframe will postMessage that its serviceWorker.controller state has
+  // changed.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-iframe-claim.html?3p-mode',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  // Create the 3p window (which will in turn create the iframe with the SW)
+  // and await on its data.
+  const frame_3p_data = await loadAndReturnSwData(t, third_party_iframe_url,
+    'window');
+  assert_equals(frame_3p_data.status, "success",
+     "3p iframe was successfully claimed");
+
+  // Confirm that the 1p iframe wasn't claimed at the same time.
+  const controller_1p_iframe = makeMessagePromise();
+  frame.contentWindow.postMessage({type: "get-controller"});
+  const controller_1p_iframe_data = await controller_1p_iframe;
+  assert_equals(controller_1p_iframe_data.controller, null,
+     "Test iframe client isn't claimed yet.");
+
+
+  // Tell the SW to claim.
+  const claimed_1p_iframe = makeMessagePromise();
+  reg.active.postMessage({type: "claim"});
+  const claimed_1p_iframe_data = await claimed_1p_iframe;
+
+  assert_equals(claimed_1p_iframe_data.status, "success",
+     "iframe client was successfully claimed.");
+
+}, "ServiceWorker's clients.claim() is partitioned");
+</script>
+
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-cookies.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-cookies.tentative.https.html
new file mode 100644
index 000000000000..7a8bd3f5cf85
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-cookies.tentative.https.html
@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-cookies-test-helpers.js"></script>
+</head>
+
+<!--
+  This test exercises partitioned service workers' interaction with partitioned
+  cookies. Partitioned service workers should only be able to interact with
+  partitioned cookies whose partition key matches the worker's partition.
+-->
+
+<body>
+<script>
+
+promise_test(async t => {
+  const script = './resources/partitioned-cookies-sw.js'
+  const scope = './resources/partitioned-cookies-'
+  const absolute_scope = new URL(scope, window.location).href;
+
+  // Set a Partitioned cookie.
+  document.cookie =
+      '__Host-partitioned=123; Secure; Path=/; SameSite=None; Partitioned;';
+  assert_true(document.cookie.includes('__Host-partitioned=123'));
+
+  // Set an unpartitioned cookie.
+  document.cookie = 'unpartitioned=456; Secure; Path=/; SameSite=None;';
+  assert_true(document.cookie.includes('unpartitioned=456'));
+
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+  t.add_cleanup(() => reg.unregister());
+
+  const next_message = worker_message_generator();
+
+  const retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  // It's possible that other tests have left behind other service workers.
+  // This steps filters those other SWs out.
+  const filtered_registrations =
+    retrieved_registrations.filter(reg => reg.scope == absolute_scope);
+
+  // First test that the worker script started correctly and message passing
+  // is enabed.
+  filtered_registrations[0].active.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  // Test that the partitioned cookie is available to this worker via HTTP.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_true(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via HTTP');
+
+  // Test that the partitioned cookie is available to this worker via
+  // CookieStore API.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_js'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_true(
+      msg3.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via JS');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via JS');
+
+  // Test that the partitioned cookie is not available to this worker in HTTP
+  // requests from importScripts.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_import'});
+  const msg4 = await next_message();
+  assert_true(msg4.ok, 'Get cookies');
+  assert_true(
+      msg4.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via importScripts');
+  assert_true(
+      msg4.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via importScripts');
+
+  const popup = window.open(
+      new URL(
+          `./resources/partitioned-cookies-3p-window.html?origin=${
+              encodeURIComponent(self.location.origin)}`,
+          get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname));
+  await fetch_tests_from_window(popup);
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-getRegistrations.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-getRegistrations.tentative.https.html
new file mode 100644
index 000000000000..7c4d4f1e028b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-getRegistrations.tentative.https.html
@@ -0,0 +1,99 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+This test loads a SW in a first-party context and gets the SW's (randomly)
+generated ID. It does the same thing for the SW but in a third-party context
+and then confirms that the IDs are different.
+
+<script>
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+  const absoluteScope = new URL(scope, window.location).href;
+
+  // Add service worker to this 1P context.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Register the message listener.
+  self.addEventListener('message', messageEventHandler);
+
+  // Open an iframe that will create a promise within the SW.
+  // The query param is there to track which request the service worker is
+  // handling.
+  //
+  // This promise is necessary to prevent the service worker from being
+  // shutdown during the test which would cause a new ID to be generated
+  // and thus invalidate the test.
+  const wait_frame_url = new URL(
+    './resources/partitioned-waitUntilResolved.fakehtml?From1pFrame',
+    self.location);
+
+  // We don't really need the data the SW sent us from this request
+  // but we can use the ID to confirm the SW wasn't shut down during the
+  // test.
+  const wait_frame_1p_data = await loadAndReturnSwData(t, wait_frame_url,
+                                                       'iframe');
+
+  // Now we need to create a third-party iframe that will send us its SW's
+  // ID.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-third-party-iframe-getRegistrations.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  // Create the 3p window (which will in turn create the iframe with the SW)
+  // and await on its data.
+  const frame_3p_ID = await loadAndReturnSwData(t, third_party_iframe_url,
+    'window');
+
+  // Now get this frame's SW's ID.
+  const frame_1p_ID_promise = makeMessagePromise();
+
+  const retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  // It's possible that other tests have left behind other service workers.
+  // This steps filters those other SWs out.
+  const filtered_registrations =
+    retrieved_registrations.filter(reg => reg.scope == absoluteScope);
+
+  // Register a listener on the service worker container and then forward to
+  // the self event listener so we can reuse the existing message promise
+  // function.
+  navigator.serviceWorker.addEventListener('message', evt => {
+    self.postMessage(evt.data, '*');
+  });
+
+  filtered_registrations[0].active.postMessage({type: "get-id"});
+
+  const  frame_1p_ID = await frame_1p_ID_promise;
+
+  // First check that the SW didn't shutdown during the run of the test.
+  // (Note: We're not using assert_equals because random values make it
+  // difficult to use a test expectations file.)
+  assert_true(wait_frame_1p_data.ID === frame_1p_ID.ID,
+    "1p SW didn't shutdown");
+  // Now check that the 1p and 3p IDs differ.
+  assert_false(frame_1p_ID.ID === frame_3p_ID.ID,
+    "1p SW ID matches 3p SW ID");
+
+  // Finally, for clean up, resolve the SW's promise so it stops waiting.
+  const resolve_frame_url = new URL(
+    './resources/partitioned-resolve.fakehtml?From1pFrame', self.location);
+
+  // We don't care about the data.
+  await loadAndReturnSwData(t, resolve_frame_url, 'iframe');
+
+}, "ServiceWorker's getRegistrations() is partitioned");
+
+
+</script>
+
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned-matchAll.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned-matchAll.tentative.https.html
new file mode 100644
index 000000000000..46beec819c8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned-matchAll.tentative.https.html
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+This test loads a SW in a first-party context and gets has the SW send
+its list of clients from client.matchAll(). It does the same thing for the
+SW in a third-party context as well and confirms that each SW see's the correct
+clients and that they don't see eachother's clients.
+
+<script>
+promise_test(async t => {
+
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+
+  // Add service worker to this 1P context.
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Register the message listener.
+  self.addEventListener('message', messageEventHandler);
+
+  // Create a third-party iframe that will send us its SW's clients.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-third-party-iframe-matchAll.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  const {urls_list: frame_3p_urls_list} = await loadAndReturnSwData(t,
+    third_party_iframe_url, 'window');
+
+  // Register a listener on the service worker container and then forward to
+  // the self event listener so we can reuse the existing message promise
+  // function.
+  navigator.serviceWorker.addEventListener('message', evt => {
+    self.postMessage(evt.data, '*');
+  });
+
+  const frame_1p_data_promise = makeMessagePromise();
+
+  reg.active.postMessage({type: "get-match-all"});
+
+  const {urls_list: frame_1p_urls_list} = await frame_1p_data_promise;
+
+  // If partitioning is working, the 1p and 3p SWs should only see a single
+  // client.
+  assert_equals(frame_3p_urls_list.length, 1);
+  assert_equals(frame_1p_urls_list.length, 1);
+  // Confirm that the expected URL was seen by each.
+  assert_equals(frame_3p_urls_list[0], third_party_iframe_url.toString(),
+    "3p SW has the correct client url.");
+  assert_equals(frame_1p_urls_list[0], window.location.href,
+    "1P SW has the correct client url.");
+}, "ServiceWorker's matchAll() is partitioned");
+
+
+</script>
+
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/partitioned.tentative.https.html b/test/fixtures/wpt/service-workers/service-worker/partitioned.tentative.https.html
new file mode 100644
index 000000000000..17a375f9c732
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/partitioned.tentative.https.html
@@ -0,0 +1,188 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<title>Service Worker: Partitioned Service Workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/partitioned-utils.js"></script>
+
+<body>
+  <!-- Debugging text for both test cases -->
+  The 3p iframe's postMessage:
+  <p id="iframe_response">No message received</p>
+
+  The nested iframe's postMessage:
+  <p id="nested_iframe_response">No message received</p>
+
+<script>
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+
+  // Add service worker to this 1P context. wait_for_state() and
+  // service_worker_unregister_and_register() are helper functions
+  // for creating test ServiceWorkers defined in:
+  // service-workers/service-worker/resources/test-helpers.sub.js
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Registers the message listener with messageEventHandler(), defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js
+  self.addEventListener('message', messageEventHandler);
+
+  // Open an iframe that will create a promise within the SW.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `waitUntilResolved.fakehtml`: URL scope that creates the promise.
+  // `?From1pFrame`: query param that tracks which request the service worker is
+  // handling.
+  const wait_frame_url = new URL(
+    './resources/partitioned-waitUntilResolved.fakehtml?From1pFrame',
+    self.location);
+
+  // Loads a child iframe with wait_frame_url as the content and returns
+  // a promise for the data messaged from the loaded iframe.
+  // loadAndReturnSwData() defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js:
+  const wait_frame_1p_data = await loadAndReturnSwData(t, wait_frame_url,
+                                                       'iframe');
+  assert_equals(wait_frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+
+  // Now create a 3p iframe that will try to resolve the SW in a 3p context.
+  const third_party_iframe_url = new URL(
+    './resources/partitioned-service-worker-third-party-iframe.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+
+  // loadAndReturnSwData() creates a HTTPS_NOTSAMESITE_ORIGIN or 3p `window`
+  // element which embeds an iframe with the ServiceWorker and returns
+  // a promise of the data messaged from that frame.
+  const frame_3p_data = await loadAndReturnSwData(t, third_party_iframe_url, 'window');
+  assert_equals(frame_3p_data.source, 'From3pFrame',
+    'The data for the 3p frame came from the wrong source');
+
+  // Print some debug info to the main frame.
+  document.getElementById("iframe_response").innerHTML =
+      "3p iframe's has_pending: " + frame_3p_data.has_pending + " source: " +
+      frame_3p_data.source + ". ";
+
+  // Now do the same for the 1p iframe.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `resolve.fakehtml`: URL scope that resolves the promise.
+  const resolve_frame_url = new URL(
+    './resources/partitioned-resolve.fakehtml?From1pFrame', self.location);
+
+  const frame_1p_data = await loadAndReturnSwData(t, resolve_frame_url,
+                                                  'iframe');
+  assert_equals(frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+  // Both the 1p frames should have been serviced by the same service worker ID.
+  // If this isn't the case then that means the SW could have been deactivated
+  // which invalidates the test.
+  assert_equals(frame_1p_data.ID, wait_frame_1p_data.ID,
+    'The 1p frames were serviced by different service workers.');
+
+  document.getElementById("iframe_response").innerHTML +=
+    "1p iframe's has_pending: " + frame_1p_data.has_pending + " source: " +
+    frame_1p_data.source;
+
+  // If partitioning is working correctly then only the 1p iframe should see
+  // (and resolve) its SW's promise. Additionally the two frames should see
+  // different IDs.
+  assert_true(frame_1p_data.has_pending,
+      'The 1p iframe saw a pending promise in the service worker.');
+  assert_false(frame_3p_data.has_pending,
+    'The 3p iframe saw a pending promise in the service worker.');
+  assert_not_equals(frame_1p_data.ID, frame_3p_data.ID,
+    'The frames were serviced by the same service worker thread.');
+}, 'Services workers under different top-level sites are partitioned.');
+
+// Optional Test: Checking for partitioned ServiceWorkers in an A->B->A
+// (nested-iframes with cross-site ancestor) scenario.
+promise_test(async t => {
+  const script = './resources/partitioned-storage-sw.js'
+  const scope = './resources/partitioned-'
+
+  // Add service worker to this 1P context. wait_for_state() and
+  // service_worker_unregister_and_register() are helper functions
+  // for creating test ServiceWorkers defined in:
+  // service-workers/service-worker/resources/test-helpers.sub.js
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Registers the message listener with messageEventHandler(), defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js
+  self.addEventListener('message', messageEventHandler);
+
+  // Open an iframe that will create a promise within the SW.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `waitUntilResolved.fakehtml`: URL scope that creates the promise.
+  // `?From1pFrame`: query param that tracks which request the service worker is
+  // handling.
+  const wait_frame_url = new URL(
+    './resources/partitioned-waitUntilResolved.fakehtml?From1pFrame',
+    self.location);
+
+  // Load a child iframe with wait_frame_url as the content.
+  // loadAndReturnSwData() defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js:
+  const wait_frame_1p_data = await loadAndReturnSwData(t, wait_frame_url,
+                                                       'iframe');
+  assert_equals(wait_frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+
+  // Now create a set of nested iframes in the configuration A1->B->A2
+  // where B is cross-site and A2 is same-site to this top-level
+  // site (A1). The innermost iframe of the nested iframes (A2) will
+  // create an additional iframe to finally resolve the ServiceWorker.
+  const nested_iframe_url = new URL(
+    './resources/partitioned-service-worker-nested-iframe-parent.html',
+    get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname);
+
+  // Create the nested iframes (which will in turn create the iframe
+  // with the ServiceWorker) and await on receiving its data.
+  const nested_iframe_data = await loadAndReturnSwData(t, nested_iframe_url, 'iframe');
+  assert_equals(nested_iframe_data.source, 'FromNestedFrame',
+    'The data for the nested iframe frame came from the wrong source');
+
+  // Print some debug info to the main frame.
+  document.getElementById("nested_iframe_response").innerHTML =
+      "Nested iframe's has_pending: " + nested_iframe_data.has_pending + " source: " +
+      nested_iframe_data.source + ". ";
+
+  // Now do the same for the 1p iframe.
+  // Defined in service-workers/service-worker/resources/partitioned-storage-sw.js:
+  // `resolve.fakehtml`: URL scope that resolves the promise.
+  const resolve_frame_url = new URL(
+    './resources/partitioned-resolve.fakehtml?From1pFrame', self.location);
+
+  const frame_1p_data = await loadAndReturnSwData(t, resolve_frame_url,
+                                                  'iframe');
+  assert_equals(frame_1p_data.source, 'From1pFrame',
+    'The data for the 1p frame came from the wrong source');
+  // Both the 1p frames should have been serviced by the same service worker ID.
+  // If this isn't the case then that means the SW could have been deactivated
+  // which invalidates the test.
+  assert_equals(frame_1p_data.ID, wait_frame_1p_data.ID,
+    'The 1p frames were serviced by different service workers.');
+
+  document.getElementById("nested_iframe_response").innerHTML +=
+    "1p iframe's has_pending: " + frame_1p_data.has_pending + " source: " +
+    frame_1p_data.source;
+
+  // If partitioning is working correctly then only the 1p iframe should see
+  // (and resolve) its SW's promise. Additionally, the innermost iframe of
+  // the nested iframes (A2 in the configuration A1->B->A2) should have a
+  // different service worker ID than the 1p (A1) frame.
+  assert_true(frame_1p_data.has_pending,
+      'The 1p iframe saw a pending promise in the service worker.');
+  assert_false(nested_iframe_data.has_pending,
+    'The 3p iframe saw a pending promise in the service worker.');
+  assert_not_equals(frame_1p_data.ID, nested_iframe_data.ID,
+    'The frames were serviced by the same service worker thread.');
+}, 'Services workers with cross-site ancestors are partitioned.');
+
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/performance-timeline.https.html b/test/fixtures/wpt/service-workers/service-worker/performance-timeline.https.html
new file mode 100644
index 000000000000..e56e6fe416ff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/performance-timeline.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+service_worker_test(
+    'resources/performance-timeline-worker.js',
+    'Test Performance Timeline API in Service Worker');
+
+// The purpose of this test is to verify that service worker overhead
+// is included in the Performance API's timing information.
+promise_test(t => {
+  let script = 'resources/empty-but-slow-worker.js';
+  let scope = 'resources/sample.txt?slow-sw-timing';
+  let url = new URL(scope, window.location).href;
+  let slowURL = url + '&slow';
+  let frame;
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(reg => {
+        t.add_cleanup(() => service_worker_unregister(t, scope));
+
+        return wait_for_state(t, reg.installing, 'activated');
+      })
+    .then(_ => with_iframe(scope))
+    .then(f => {
+      frame = f;
+      return frame.contentWindow.fetch(url).then(r => r && r.text());
+    })
+    .then(_ => {
+      return frame.contentWindow.fetch(slowURL).then(r => r && r.text());
+    })
+    .then(_ => {
+      function elapsed(u) {
+        let entry = frame.contentWindow.performance.getEntriesByName(u);
+        return entry[0] ? entry[0].duration : undefined;
+      }
+      let urlTime = elapsed(url);
+      let slowURLTime = elapsed(slowURL);
+      // Verify the request slowed by the service worker is indeed measured
+      // to be slower.  Note, we compare to smaller delay instead of the exact
+      // delay amount to avoid making the test racy under automation.
+      assert_greater_than(slowURLTime, urlTime + 1000,
+                  'Slow service worker request should measure increased delay.');
+      frame.remove();
+    })
+}, 'empty service worker fetch event included in performance timings');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postMessage-client-worker.js b/test/fixtures/wpt/service-workers/service-worker/postMessage-client-worker.js
new file mode 100644
index 000000000000..64d944d2b546
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postMessage-client-worker.js
@@ -0,0 +1,23 @@
+async function doTest(e)
+{
+    if (e.resultingClientId) {
+        const promise = new Promise(async resolve => {
+            let counter = 0;
+            const client = await self.clients.get(e.resultingClientId);
+            if (client)
+                client.postMessage(counter++);
+            if (e.request.url.includes("repeatMessage")) {
+                setInterval(() => {
+                    if (client)
+                        client.postMessage(counter++);
+                }, 100);
+            }
+            setTimeout(() => {
+                resolve(fetch(e.request));
+            }, 1000);
+        });
+        e.respondWith(promise);
+    }
+}
+
+self.addEventListener("fetch", e => e.waitUntil(doTest(e)));
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-blob-url.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-blob-url.https.html
new file mode 100644
index 000000000000..16fddd57b835
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-blob-url.https.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage Blob URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    let script = 'resources/postmessage-blob-url.js';
+    let scope = 'resources/blank.html';
+    let registration;
+    let blobText = 'Blob text';
+    let blob;
+    let blobUrl;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          add_completion_callback(() => r.unregister());
+          registration = r;
+          let worker = registration.installing;
+          blob = new Blob([blobText]);
+          blobUrl = URL.createObjectURL(blob);
+          return new Promise(resolve => {
+            navigator.serviceWorker.onmessage = e => { resolve(e.data); }
+            worker.postMessage(blobUrl);
+          });
+        })
+      .then(response => {
+          assert_equals(response, 'Worker reply:' + blobText);
+          URL.revokeObjectURL(blobUrl);
+          return registration.unregister();
+        });
+  }, 'postMessage Blob URL to a ServiceWorker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-from-waiting-serviceworker.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-from-waiting-serviceworker.https.html
new file mode 100644
index 000000000000..117def9eb2a6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-from-waiting-serviceworker.https.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage from waiting serviceworker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+function echo(worker, data) {
+  return new Promise(resolve => {
+    navigator.serviceWorker.addEventListener('message', function onMsg(evt) {
+      navigator.serviceWorker.removeEventListener('message', onMsg);
+      resolve(evt);
+    });
+    worker.postMessage(data);
+  });
+}
+
+promise_test(t => {
+  let script = 'resources/echo-message-to-source-worker.js';
+  let scope = 'resources/client-postmessage-from-wait-serviceworker';
+  let registration;
+  let frame;
+  return service_worker_unregister_and_register(t, script, scope)
+    .then(swr => {
+      t.add_cleanup(() => service_worker_unregister(t, scope));
+
+      registration = swr;
+      return wait_for_state(t, registration.installing, 'activated');
+    }).then(_ => {
+      return with_iframe(scope);
+    }).then(f => {
+      frame = f;
+      return navigator.serviceWorker.register(script + '?update', { scope: scope })
+    }).then(swr => {
+      assert_equals(swr, registration, 'should be same registration');
+      return wait_for_state(t, registration.installing, 'installed');
+    }).then(_ => {
+      return echo(registration.waiting, 'waiting');
+    }).then(evt => {
+      assert_equals(evt.source, registration.waiting,
+                    'message event source should be correct');
+      return echo(registration.active, 'active');
+    }).then(evt => {
+      assert_equals(evt.source, registration.active,
+                    'message event source should be correct');
+      frame.remove();
+    });
+}, 'Client.postMessage() from waiting serviceworker.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-msgport-to-client.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-msgport-to-client.https.html
new file mode 100644
index 000000000000..29c056080c79
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-msgport-to-client.https.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage via MessagePort to Client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/postmessage-msgport-to-client-worker.js';
+    var scope = 'resources/blank.html';
+    var port;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(registration => {
+          add_completion_callback(() => registration.unregister());
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => with_iframe(scope))
+      .then(frame => {
+          t.add_cleanup(() => frame.remove());
+          return new Promise(resolve => {
+              var w = frame.contentWindow;
+              w.navigator.serviceWorker.onmessage = resolve;
+              w.navigator.serviceWorker.controller.postMessage('ping');
+            });
+        })
+      .then(e => {
+          port = e.ports[0];
+          port.postMessage({value: 1});
+          port.postMessage({value: 2});
+          port.postMessage({done: true});
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data.ack, 'Acking value: 1');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data.ack, 'Acking value: 2');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => { assert_true(e.data.done, 'done'); });
+  }, 'postMessage MessagePorts from ServiceWorker to Client');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client-message-queue.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client-message-queue.https.html
new file mode 100644
index 000000000000..83e5f4540d14
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client-message-queue.https.html
@@ -0,0 +1,212 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage to Client (message queue)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// This function creates a message listener that captures all messages
+// sent to this window and matches them with corresponding requests.
+// This frees test code from having to use clunky constructs just to
+// avoid race conditions, since the relative order of message and
+// request arrival doesn't matter.
+function create_message_listener(t) {
+    const listener = {
+        messages: new Set(),
+        requests: new Set(),
+        waitFor: function(predicate) {
+            for (const event of this.messages) {
+                // If a message satisfying the predicate has already
+                // arrived, it gets matched to this request.
+                if (predicate(event)) {
+                    this.messages.delete(event);
+                    return Promise.resolve(event);
+                }
+            }
+
+            // If no match was found, the request is stored and a
+            // promise is returned.
+            const request = { predicate };
+            const promise = new Promise(resolve => request.resolve = resolve);
+            this.requests.add(request);
+            return promise;
+        }
+    };
+    window.onmessage = t.step_func(event => {
+        for (const request of listener.requests) {
+            // If the new message matches a stored request's
+            // predicate, the request's promise is resolved with this
+            // message.
+            if (request.predicate(event)) {
+                listener.requests.delete(request);
+                request.resolve(event);
+                return;
+            }
+        };
+
+        // No outstanding request for this message, store it in case
+        // it's requested later.
+        listener.messages.add(event);
+    });
+    return listener;
+}
+
+async function service_worker_register_and_activate(t, script, scope) {
+    const registration = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => registration.unregister());
+    const worker = registration.installing;
+    await wait_for_state(t, worker, 'activated');
+    return worker;
+}
+
+// Add an iframe (parent) whose document contains a nested iframe
+// (child), then set the child's src attribute to child_url and return
+// its Window (without waiting for it to finish loading).
+async function with_nested_iframes(t, child_url) {
+    const parent = await with_iframe('resources/nested-iframe-parent.html?role=parent');
+    t.add_cleanup(() => parent.remove());
+    const child = parent.contentWindow.document.getElementById('child');
+    child.setAttribute('src', child_url);
+    return child.contentWindow;
+}
+
+// Returns a predicate matching a fetch message with the specified
+// key.
+function fetch_message(key) {
+    return event => event.data.type === 'fetch' && event.data.key === key;
+}
+
+// Returns a predicate matching a ping message with the specified
+// payload.
+function ping_message(data) {
+    return event => event.data.type === 'ping' && event.data.data === data;
+}
+
+// A client message queue test is a testharness.js test with some
+// additional setup:
+// 1. A listener (see create_message_listener)
+// 2. An active service worker
+// 3. Two nested iframes
+// 4. A state transition function that controls the order of events
+//    during the test
+function client_message_queue_test(url, test_function, description) {
+    promise_test(async t => {
+        t.listener = create_message_listener(t);
+
+        const script = 'resources/stalling-service-worker.js';
+        const scope = 'resources/';
+        t.service_worker = await service_worker_register_and_activate(t, script, scope);
+
+        // We create two nested iframes such that both are controlled by
+        // the newly installed service worker.
+        const child_url = url + '?role=child';
+        t.frame = await with_nested_iframes(t, child_url);
+
+        t.state_transition = async function(from, to, scripts) {
+            // A state transition begins with the child's parser
+            // fetching a script due to a <script> tag. The request
+            // arrives at the service worker, which notifies the
+            // parent, which in turn notifies the test. Note that the
+            // event loop keeps spinning while the parser is waiting.
+            const request = await this.listener.waitFor(fetch_message(to));
+
+            // The test instructs the service worker to send two ping
+            // messages through the Client interface: first to the
+            // child, then to the parent.
+            this.service_worker.postMessage(from);
+
+            // When the parent receives the ping message, it forwards
+            // it to the test. Assuming that messages to both child
+            // and parent are mapped to the same task queue (this is
+            // not [yet] required by the spec), receiving this message
+            // guarantees that the child has already dispatched its
+            // message if it was allowed to do so.
+            await this.listener.waitFor(ping_message(from));
+
+            // Finally, reply to the service worker's fetch
+            // notification with the script it should use as the fetch
+            // request's response. This is a defensive mechanism that
+            // ensures the child's parser really is blocked until the
+            // test is ready to continue.
+            request.ports[0].postMessage([`state = '${to}';`].concat(scripts));
+        };
+
+        await test_function(t);
+    }, description);
+}
+
+function client_message_queue_enable_test(
+    install_script,
+    start_script,
+    earliest_dispatch,
+    description)
+{
+    function assert_state_less_than_equal(state1, state2, explanation) {
+        const states = ['init', 'install', 'start', 'finish', 'loaded'];
+        const index1 = states.indexOf(state1);
+        const index2 = states.indexOf(state2);
+        if (index1 > index2)
+          assert_unreached(explanation);
+    }
+
+    client_message_queue_test('enable-client-message-queue.html', async t => {
+        // While parsing the child's document, the child transitions
+        // from the 'init' state all the way to the 'finish' state.
+        // Once parsing is finished it would enter the final 'loaded'
+        // state. All but the last transition require assitance from
+        // the test.
+        await t.state_transition('init', 'install', [install_script]);
+        await t.state_transition('install', 'start', [start_script]);
+        await t.state_transition('start', 'finish', []);
+
+        // Wait for all messages to get dispatched on the child's
+        // ServiceWorkerContainer and then verify that each message
+        // was dispatched after |earliest_dispatch|.
+        const report = await t.frame.report;
+        ['init', 'install', 'start'].forEach(state => {
+            const explanation = `Message sent in state '${state}' was dispatched in '${report[state]}', should be dispatched no earlier than '${earliest_dispatch}'`;
+            assert_state_less_than_equal(earliest_dispatch,
+                                         report[state],
+                                         explanation);
+        });
+    }, description);
+}
+
+const empty_script = ``;
+
+const add_event_listener =
+    `navigator.serviceWorker.addEventListener('message', handle_message);`;
+
+const set_onmessage = `navigator.serviceWorker.onmessage = handle_message;`;
+
+const start_messages = `navigator.serviceWorker.startMessages();`;
+
+client_message_queue_enable_test(add_event_listener, empty_script, 'loaded',
+    'Messages from ServiceWorker to Client only received after DOMContentLoaded event.');
+
+client_message_queue_enable_test(add_event_listener, start_messages, 'start',
+    'Messages from ServiceWorker to Client only received after calling startMessages().');
+
+client_message_queue_enable_test(set_onmessage, empty_script, 'install',
+    'Messages from ServiceWorker to Client only received after setting onmessage.');
+
+const resolve_manual_promise = `resolve_manual_promise();`
+
+async function test_microtasks_when_client_message_queue_enabled(t, scripts) {
+    await t.state_transition('init', 'start', scripts.concat([resolve_manual_promise]));
+    let result = await t.frame.result;
+    assert_equals(result[0], 'microtask', 'The microtask was executed first.');
+    assert_equals(result[1], 'message', 'The message was dispatched.');
+}
+
+client_message_queue_test('message-vs-microtask.html', t => {
+    return test_microtasks_when_client_message_queue_enabled(t, [
+        add_event_listener,
+        start_messages,
+    ]);
+}, 'Microtasks run before dispatching messages after calling startMessages().');
+
+client_message_queue_test('message-vs-microtask.html', t => {
+    return test_microtasks_when_client_message_queue_enabled(t, [set_onmessage]);
+}, 'Microtasks run before dispatching messages after setting onmessage.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client.https.html
new file mode 100644
index 000000000000..f834a4bffe20
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage-to-client.https.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage to Client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(async t => {
+  const script = 'resources/postmessage-to-client-worker.js';
+  const scope = 'resources/blank.html';
+
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+  const w = frame.contentWindow;
+
+  w.navigator.serviceWorker.controller.postMessage('ping');
+  let e = await new Promise(r => w.navigator.serviceWorker.onmessage = r);
+
+  assert_equals(e.constructor, w.MessageEvent,
+                'message events should use MessageEvent interface.');
+  assert_equals(e.type, 'message', 'type should be "message".');
+  assert_false(e.bubbles, 'message events should not bubble.');
+  assert_false(e.cancelable, 'message events should not be cancelable.');
+  assert_equals(e.origin, location.origin,
+                'origin of message should be origin of Service Worker.');
+  assert_equals(e.lastEventId, '',
+                'lastEventId should be an empty string.');
+  assert_equals(e.source.constructor, w.ServiceWorker,
+                'source should use ServiceWorker interface.');
+  assert_equals(e.source, w.navigator.serviceWorker.controller,
+                'source should be the service worker that sent the message.');
+  assert_equals(e.ports.length, 0, 'ports should be an empty array.');
+  assert_equals(e.data, 'Sending message via clients');
+
+  e = await new Promise(r => w.navigator.serviceWorker.onmessage = r);
+  assert_equals(e.data, 'quit');
+}, 'postMessage from ServiceWorker to Client.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/postmessage.https.html b/test/fixtures/wpt/service-workers/service-worker/postmessage.https.html
new file mode 100644
index 000000000000..7abb3022f91a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/postmessage.https.html
@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<title>Service Worker: postMessage</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    var script = 'resources/postmessage-worker.js';
+    var scope = 'resources/blank.html';
+    var registration;
+    var worker;
+    var port;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+          registration = r;
+          worker = registration.installing;
+
+          var messageChannel = new MessageChannel();
+          port = messageChannel.port1;
+          return new Promise(resolve => {
+              port.onmessage = resolve;
+              worker.postMessage({port: messageChannel.port2},
+                                 [messageChannel.port2]);
+              worker.postMessage({value: 1});
+              worker.postMessage({value: 2});
+              worker.postMessage({done: true});
+            });
+        })
+      .then(e => {
+          assert_equals(e.data, 'Acking value: 1');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data, 'Acking value: 2');
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          assert_equals(e.data, 'quit');
+          return registration.unregister(scope);
+        });
+  }, 'postMessage to a ServiceWorker (and back via MessagePort)');
+
+promise_test(t => {
+    var script = 'resources/postmessage-transferables-worker.js';
+    var scope = 'resources/blank.html';
+    var sw = navigator.serviceWorker;
+
+    var message = 'Hello, world!';
+    var text_encoder = new TextEncoder;
+    var text_decoder = new TextDecoder;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+
+          var ab = text_encoder.encode(message);
+          assert_equals(ab.byteLength, message.length);
+          r.installing.postMessage(ab, [ab.buffer]);
+          assert_equals(text_decoder.decode(ab), '');
+          assert_equals(ab.byteLength, 0);
+
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the transferred array buffer.
+          assert_equals(e.data.content, message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the array buffer sent back from
+          // ServiceWorker via Client.postMessage.
+          assert_equals(text_decoder.decode(e.data), message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify that the array buffer on ServiceWorker is neutered.
+          assert_equals(e.data.content, '');
+          assert_equals(e.data.byteLength, 0);
+        });
+  }, 'postMessage a transferable ArrayBuffer between ServiceWorker and Client');
+
+promise_test(t => {
+    var script = 'resources/postmessage-transferables-worker.js';
+    var scope = 'resources/blank.html';
+    var message = 'Hello, world!';
+    var text_encoder = new TextEncoder;
+    var text_decoder = new TextDecoder;
+    var port;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+
+          var channel = new MessageChannel;
+          port = channel.port1;
+          r.installing.postMessage(undefined, [channel.port2]);
+
+          var ab = text_encoder.encode(message);
+          assert_equals(ab.byteLength, message.length);
+          port.postMessage(ab, [ab.buffer]);
+          assert_equals(text_decoder.decode(ab), '');
+          assert_equals(ab.byteLength, 0);
+
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the transferred array buffer.
+          assert_equals(e.data.content, message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the array buffer sent back from
+          // ServiceWorker via Client.postMessage.
+          assert_equals(text_decoder.decode(e.data), message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { port.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify that the array buffer on ServiceWorker is neutered.
+          assert_equals(e.data.content, '');
+          assert_equals(e.data.byteLength, 0);
+        });
+  }, 'postMessage a transferable ArrayBuffer between ServiceWorker and Client' +
+     ' over MessagePort');
+
+  promise_test(t => {
+    var script = 'resources/postmessage-dictionary-transferables-worker.js';
+    var scope = 'resources/blank.html';
+    var sw = navigator.serviceWorker;
+
+    var message = 'Hello, world!';
+    var text_encoder = new TextEncoder;
+    var text_decoder = new TextDecoder;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(r => {
+          t.add_cleanup(() => r.unregister());
+
+          var ab = text_encoder.encode(message);
+          assert_equals(ab.byteLength, message.length);
+          r.installing.postMessage(ab, {transfer: [ab.buffer]});
+          assert_equals(text_decoder.decode(ab), '');
+          assert_equals(ab.byteLength, 0);
+
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the transferred array buffer.
+          assert_equals(e.data.content, message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify the integrity of the array buffer sent back from
+          // ServiceWorker via Client.postMessage.
+          assert_equals(text_decoder.decode(e.data), message);
+          assert_equals(e.data.byteLength, message.length);
+          return new Promise(resolve => { sw.onmessage = resolve; });
+        })
+      .then(e => {
+          // Verify that the array buffer on ServiceWorker is neutered.
+          assert_equals(e.data.content, '');
+          assert_equals(e.data.byteLength, 0);
+        });
+  }, 'postMessage with dictionary a transferable ArrayBuffer between ServiceWorker and Client');
+
+  promise_test(async t => {
+    const firstScript = 'resources/postmessage-echo-worker.js?one';
+    const secondScript = 'resources/postmessage-echo-worker.js?two';
+    const scope = 'resources/';
+
+    const registration = await service_worker_unregister_and_register(t, firstScript, scope);
+    t.add_cleanup(() => registration.unregister());
+    const firstWorker = registration.installing;
+
+    const messagePromise = new Promise(resolve => {
+      navigator.serviceWorker.addEventListener('message', (event) => {
+        resolve(event.data);
+      }, {once: true});
+    });
+
+    await wait_for_state(t, firstWorker, 'activated');
+    await navigator.serviceWorker.register(secondScript, {scope});
+    const secondWorker = registration.installing;
+    await wait_for_state(t, firstWorker, 'redundant');
+
+    // postMessage() to a redundant worker should be dropped silently.
+    // Historically, this threw an exception.
+    firstWorker.postMessage('firstWorker');
+
+    // To test somewhat that it was not received, send a message to another
+    // worker and check that we get a reply for that one.
+    secondWorker.postMessage('secondWorker');
+    const data = await messagePromise;
+    assert_equals(data, 'secondWorker');
+  }, 'postMessage to a redundant worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/ready.https.window.js b/test/fixtures/wpt/service-workers/service-worker/ready.https.window.js
new file mode 100644
index 000000000000..6c4e270682c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/ready.https.window.js
@@ -0,0 +1,223 @@
+// META: title=Service Worker: navigator.serviceWorker.ready
+// META: script=resources/test-helpers.sub.js
+
+test(() => {
+  assert_equals(
+    navigator.serviceWorker.ready,
+    navigator.serviceWorker.ready,
+    'repeated access to ready without intervening registrations should return the same Promise object'
+  );
+}, 'ready returns the same Promise object');
+
+promise_test(async t => {
+  const frame = await with_iframe('resources/blank.html?uncontrolled');
+  t.add_cleanup(() => frame.remove());
+
+  const promise = frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    Object.getPrototypeOf(promise),
+    frame.contentWindow.Promise.prototype,
+    'the Promise should be in the context of the related document'
+  );
+}, 'ready returns a Promise object in the context of the related document');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const scope = 'resources/blank.html?ready-controlled';
+  const expectedURL = normalizeURL(url);
+  const registration = await service_worker_unregister_and_register(t, url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const readyReg = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(readyReg.installing, null, 'installing should be null');
+  assert_equals(readyReg.waiting, null, 'waiting should be null');
+  assert_equals(readyReg.active.scriptURL, expectedURL, 'active after ready should not be null');
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller,
+    readyReg.active,
+    'the controller should be the active worker'
+  );
+  assert_in_array(
+    readyReg.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved when the registration has an active worker'
+  );
+}, 'ready on a controlled document');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const scope = 'resources/blank.html?ready-potential-controlled';
+  const expected_url = normalizeURL(url);
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const registration = await navigator.serviceWorker.register(url, { scope });
+  t.add_cleanup(() => registration.unregister());
+
+  const readyReg = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(readyReg.installing, null, 'installing should be null');
+  assert_equals(readyReg.waiting, null, 'waiting should be null.')
+  assert_equals(readyReg.active.scriptURL, expected_url, 'active after ready should not be null');
+  assert_in_array(
+    readyReg.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved when the registration has an active worker'
+  );
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller,
+    null,
+    'uncontrolled document should not have a controller'
+  );
+}, 'ready on a potential controlled document');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const scope = 'resources/blank.html?ready-installing';
+
+  await service_worker_unregister(t, scope);
+
+  const frame = await with_iframe(scope);
+  const promise = frame.contentWindow.navigator.serviceWorker.ready;
+  navigator.serviceWorker.register(url, { scope });
+  const registration = await promise;
+
+  t.add_cleanup(async () => {
+    await registration.unregister();
+    frame.remove();
+  });
+
+  assert_equals(registration.installing, null, 'installing should be null');
+  assert_equals(registration.waiting, null, 'waiting should be null');
+  assert_not_equals(registration.active, null, 'active after ready should not be null');
+  assert_in_array(
+    registration.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved when the registration has an active worker'
+  );
+}, 'ready on an iframe whose parent registers a new service worker');
+
+promise_test(async t => {
+  const scope = 'resources/register-iframe.html';
+  const frame = await with_iframe(scope);
+
+  const registration = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  t.add_cleanup(async () => {
+    await registration.unregister();
+    frame.remove();
+  });
+
+  assert_equals(registration.installing, null, 'installing should be null');
+  assert_equals(registration.waiting, null, 'waiting should be null');
+  assert_not_equals(registration.active, null, 'active after ready should not be null');
+  assert_in_array(
+    registration.active.state,
+    ['activating', 'activated'],
+    '.ready should be resolved with "active worker"'
+  );
+ }, 'ready on an iframe that installs a new service worker');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const matchedScope = 'resources/blank.html?ready-after-match';
+  const longerMatchedScope = 'resources/blank.html?ready-after-match-longer';
+
+  await service_worker_unregister(t, matchedScope);
+  await service_worker_unregister(t, longerMatchedScope);
+
+  const frame = await with_iframe(longerMatchedScope);
+  const registration = await navigator.serviceWorker.register(url, { scope: matchedScope });
+
+  t.add_cleanup(async () => {
+    await registration.unregister();
+    frame.remove();
+  });
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const longerRegistration = await navigator.serviceWorker.register(url, { scope: longerMatchedScope });
+
+  t.add_cleanup(() => longerRegistration.unregister());
+
+  const readyReg = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    readyReg.scope,
+    normalizeURL(longerMatchedScope),
+    'longer matched registration should be returned'
+  );
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller,
+    null,
+    'controller should be null'
+  );
+}, 'ready after a longer matched registration registered');
+
+promise_test(async t => {
+  const url = 'resources/empty-worker.js';
+  const matchedScope = 'resources/blank.html?ready-after-resolve';
+  const longerMatchedScope = 'resources/blank.html?ready-after-resolve-longer';
+  const registration = await service_worker_unregister_and_register(t, url, matchedScope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(longerMatchedScope);
+  t.add_cleanup(() => frame.remove());
+
+  const readyReg1 = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    readyReg1.scope,
+    normalizeURL(matchedScope),
+    'matched registration should be returned'
+  );
+
+  const longerReg = await navigator.serviceWorker.register(url, { scope: longerMatchedScope });
+  t.add_cleanup(() => longerReg.unregister());
+
+  const readyReg2 = await frame.contentWindow.navigator.serviceWorker.ready;
+
+  assert_equals(
+    readyReg2.scope,
+    normalizeURL(matchedScope),
+    'ready should only be resolved once'
+  );
+}, 'access ready after it has been resolved');
+
+promise_test(async t => {
+  const url1 = 'resources/empty-worker.js';
+  const url2 = url1 + '?2';
+  const matchedScope = 'resources/blank.html?ready-after-unregister';
+  const reg1 = await service_worker_unregister_and_register(t, url1, matchedScope);
+  t.add_cleanup(() => reg1.unregister());
+
+  await wait_for_state(t, reg1.installing, 'activating');
+
+  const frame = await with_iframe(matchedScope);
+  t.add_cleanup(() => frame.remove());
+
+  await reg1.unregister();
+
+  // Ready promise should be pending, waiting for a new registration to arrive
+  const readyPromise = frame.contentWindow.navigator.serviceWorker.ready;
+
+  const reg2 = await navigator.serviceWorker.register(url2, { scope: matchedScope });
+  t.add_cleanup(() => reg2.unregister());
+
+  const readyReg = await readyPromise;
+
+  // Wait for registration update, since it comes from another global, the states are racy.
+  await wait_for_state(t, reg2.installing || reg2.waiting || reg2.active, 'activated');
+
+  assert_equals(readyReg.active.scriptURL, reg2.active.scriptURL, 'Resolves with the second registration');
+  assert_not_equals(reg1, reg2, 'Registrations should be different');
+}, 'resolve ready after unregistering');
diff --git a/test/fixtures/wpt/service-workers/service-worker/redirected-response.https.html b/test/fixtures/wpt/service-workers/service-worker/redirected-response.https.html
new file mode 100644
index 000000000000..71b35d0e1205
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/redirected-response.https.html
@@ -0,0 +1,471 @@
+<!DOCTYPE html>
+<title>Service Worker: Redirected response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests redirect behavior. It calls fetch_method(url, fetch_option) and tests
+// the resulting response against the expected values. It also adds the
+// response to |cache| and checks the cached response matches the expected
+// values.
+//
+// |options|: a dictionary of parameters for the test
+// |options.url|: the URL to fetch
+// |options.fetch_option|: the options passed to |fetch_method|
+// |options.fetch_method|: the method used to fetch. Useful for testing an
+//                         iframe's fetch() vs. this page's fetch().
+// |options.expected_type|: The value of response.type
+// |options.expected_redirected|: The value of response.redirected
+// |options.expected_intercepted_urls|: The list of intercepted request URLs.
+function redirected_test(options) {
+  return options.fetch_method.call(null, options.url, options.fetch_option).then(response => {
+        let cloned_response = response.clone();
+        assert_equals(
+            response.type, options.expected_type,
+            'The response type of response must match. URL: ' + options.url);
+        assert_equals(
+            cloned_response.type, options.expected_type,
+            'The response type of cloned response must match. URL: ' + options.url);
+        assert_equals(
+            response.redirected, options.expected_redirected,
+            'The redirected flag of response must match. URL: ' + options.url);
+        assert_equals(
+            cloned_response.redirected, options.expected_redirected,
+            'The redirected flag of cloned response must match. URL: ' + options.url);
+        if (options.expected_response_url) {
+            assert_equals(
+                cloned_response.url, options.expected_response_url,
+                'The URL does not meet expectation. URL: ' + options.url);
+        }
+        return cache.put(options.url, response);
+      })
+    .then(_ => cache.match(options.url))
+    .then(response => {
+        assert_equals(
+            response.type, options.expected_type,
+            'The response type of response in CacheStorage must match. ' +
+            'URL: ' + options.url);
+        assert_equals(
+            response.redirected, options.expected_redirected,
+            'The redirected flag of response in CacheStorage must match. ' +
+            'URL: ' + options.url);
+        return check_intercepted_urls(options.expected_intercepted_urls);
+      });
+}
+
+async function take_intercepted_urls() {
+  const message = new Promise((resolve) => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = msg => { resolve(msg.data.requestInfos); };
+    worker.postMessage({command: 'getRequestInfos', port: channel.port2},
+                       [channel.port2]);
+  });
+  const request_infos = await message;
+  return request_infos.map(info => { return info.url; });
+}
+
+function check_intercepted_urls(expected_urls) {
+  return take_intercepted_urls().then((urls) => {
+      assert_object_equals(urls, expected_urls, 'Intercepted URLs matching.');
+    });
+}
+
+function setup_and_clean() {
+  // To prevent interference from previous tests, take the intercepted URLs from
+  // the service worker.
+  return setup.then(() => take_intercepted_urls());
+}
+
+
+let host_info = get_host_info();
+const REDIRECT_URL = host_info['HTTPS_ORIGIN'] + base_path() +
+                     'resources/redirect.py?Redirect=';
+const TARGET_URL = host_info['HTTPS_ORIGIN'] + base_path() +
+                   'resources/simple.txt?';
+const REDIRECT_TO_TARGET_URL = REDIRECT_URL + encodeURIComponent(TARGET_URL);
+let frame;
+let cache;
+let setup;
+let worker;
+
+promise_test(t => {
+    const SCOPE = 'resources/blank.html?redirected-response';
+    const SCRIPT = 'resources/redirect-worker.js';
+    const CACHE_NAME = 'service-workers/service-worker/redirected-response';
+    setup = service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(registration => {
+          promise_test(
+              () => registration.unregister(),
+              'restore global state (service worker registration)');
+          worker = registration.installing;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(_ => self.caches.open(CACHE_NAME))
+      .then(c => {
+          cache = c;
+          promise_test(
+            () => self.caches.delete(CACHE_NAME),
+            'restore global state (caches)');
+          return with_iframe(SCOPE);
+        })
+      .then(f => {
+          frame = f;
+          add_completion_callback(() => f.remove());
+          return check_intercepted_urls(
+              [host_info['HTTPS_ORIGIN'] + base_path() + SCOPE]);
+        });
+      return setup;
+  }, 'initialize global state (service worker registration and caches)');
+
+// ===============================================================
+// Tests for requests that are out-of-scope of the service worker.
+// ===============================================================
+promise_test(t => setup_and_clean()
+  .then(() => redirected_test({url: TARGET_URL,
+                               fetch_option: {},
+                               fetch_method: self.fetch,
+                               expected_type: 'basic',
+                               expected_redirected: false,
+                               expected_intercepted_urls: []})),
+  'mode: "follow", non-intercepted request, no server redirect');
+
+promise_test(t => setup_and_clean()
+  .then(() => redirected_test({url: REDIRECT_TO_TARGET_URL,
+                               fetch_option: {},
+                               fetch_method: self.fetch,
+                               expected_type: 'basic',
+                               expected_redirected: true,
+                               expected_intercepted_urls: []})),
+  'mode: "follow", non-intercepted request');
+
+promise_test(t => setup_and_clean()
+  .then(() => redirected_test({url: REDIRECT_TO_TARGET_URL + '&manual',
+                               fetch_option: {redirect: 'manual'},
+                               fetch_method: self.fetch,
+                               expected_type: 'opaqueredirect',
+                               expected_redirected: false,
+                               expected_intercepted_urls: []})),
+  'mode: "manual", non-intercepted request');
+
+promise_test(t => setup_and_clean()
+    .then(() => promise_rejects_js(
+                   t, TypeError,
+                   self.fetch(REDIRECT_TO_TARGET_URL + '&error',
+                              {redirect:'error'}),
+                   'The redirect response from the server should be treated as' +
+                   ' an error when the redirect flag of request was \'error\'.'))
+    .then(() => check_intercepted_urls([])),
+  'mode: "error", non-intercepted request');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = TARGET_URL + '&sw=fetch';
+      return redirected_test({url: url,
+                              fetch_option: {},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "follow", no mode change, no server redirect');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a redirected response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=follow&sw=fetch';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "follow", no mode change');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=error&sw=follow';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The redirected response from the service worker should be ' +
+          'treated as an error when the redirect flag of request was ' +
+          '\'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", mode change: "follow"');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=manual&sw=follow';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'manual'}),
+          'The redirected response from the service worker should be ' +
+          'treated as an error when the redirect flag of request was ' +
+          '\'manual\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "manual", mode change: "follow"');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns an opaqueredirect response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=follow&sw=manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'follow'}),
+          'The opaqueredirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'follow\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "follow", mode change: "manual"');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=error&sw=manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The opaqueredirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", mode change: "manual"');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = REDIRECT_TO_TARGET_URL +
+                  '&original-redirect-mode=manual&sw=manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]});
+    }),
+  'mode: "manual", no mode change');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=follow&sw=gen';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: [url, TARGET_URL]})
+    }),
+  'mode: "follow", generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=error&sw=gen';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The generated redirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=manual&sw=gen';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "manual", generated redirect response');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response manually with the Response
+// constructor.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=follow&sw=gen-manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: [url, TARGET_URL]})
+    }),
+  'mode: "follow", manually-generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=error&sw=gen-manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The generated redirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", manually-generated redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=' + encodeURIComponent(TARGET_URL) +
+                  '&original-redirect-mode=manual&sw=gen-manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "manual", manually-generated redirect response');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response with a relative location header.
+// Generated responses do not have URLs, so this should fail to resolve.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=blank.html' +
+                  '&original-redirect-mode=follow&sw=gen-manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'follow'}),
+          'Following the generated redirect response from the service worker '+
+          'should result fail.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "follow", generated relative redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=blank.html' +
+                  '&original-redirect-mode=error&sw=gen-manual';
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(url, {redirect: 'error'}),
+          'The generated redirect response from the service worker should ' +
+          'be treated as an error when the redirect flag of request was' +
+          ' \'error\'.')
+        .then(() => check_intercepted_urls([url]));
+    }),
+  'mode: "error", generated relative redirect response');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() +
+                  'sample?url=blank.html' +
+                  '&original-redirect-mode=manual&sw=gen-manual';
+      return redirected_test({url: url,
+                              fetch_option: {redirect: 'manual'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'opaqueredirect',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url]})
+    }),
+  'mode: "manual", generated relative redirect response');
+
+// =======================================================
+// Tests for requests that are in-scope of the service worker. The service
+// worker returns a generated redirect response. And the fetch follows the
+// redirection multiple times.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      // The Fetch spec says: "If request’s redirect count is twenty, return a
+      // network error." https://fetch.spec.whatwg.org/#http-redirect-fetch
+      // So fetch can follow the redirect response 20 times.
+      let urls = [TARGET_URL];
+      for (let i = 0; i < 20; ++i) {
+        urls.unshift(host_info['HTTPS_ORIGIN'] + '/sample?sw=gen&url=' +
+                    encodeURIComponent(urls[0]));
+
+      }
+      return redirected_test({url: urls[0],
+                              fetch_option: {redirect: 'follow'},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: true,
+                              expected_intercepted_urls: urls})
+    }),
+  'Fetch should follow the redirect response 20 times');
+
+promise_test(t => setup_and_clean()
+    .then(() => {
+      let urls = [TARGET_URL];
+      // The Fetch spec says: "If request’s redirect count is twenty, return a
+      // network error." https://fetch.spec.whatwg.org/#http-redirect-fetch
+      // So fetch can't follow the redirect response 21 times.
+      for (let i = 0; i < 21; ++i) {
+        urls.unshift(host_info['HTTPS_ORIGIN'] + '/sample?sw=gen&url=' +
+                    encodeURIComponent(urls[0]));
+
+      }
+      return promise_rejects_js(
+          t, frame.contentWindow.TypeError,
+          frame.contentWindow.fetch(urls[0], {redirect: 'follow'}),
+          'Fetch should not follow the redirect response 21 times.')
+        .then(() => {
+          urls.pop();
+          return check_intercepted_urls(urls)
+        });
+    }),
+  'Fetch should not follow the redirect response 21 times.');
+
+// =======================================================
+// A test for verifying the url of a service-worker-redirected request is
+// propagated to the outer response.
+// =======================================================
+promise_test(t => setup_and_clean()
+    .then(() => {
+      const url = host_info['HTTPS_ORIGIN'] + base_path() + 'sample?url=' +
+                  encodeURIComponent(TARGET_URL) +'&sw=fetch-url';
+      return redirected_test({url: url,
+                              fetch_option: {},
+                              fetch_method: frame.contentWindow.fetch,
+                              expected_type: 'basic',
+                              expected_redirected: false,
+                              expected_intercepted_urls: [url],
+                              expected_response_url: TARGET_URL});
+    }),
+  'The URL for the service worker redirected request should be propagated to ' +
+  'response.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/referer.https.html b/test/fixtures/wpt/service-workers/service-worker/referer.https.html
new file mode 100644
index 000000000000..0957e4c53301
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/referer.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: check referer of fetch()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+promise_test(function(t) {
+    var SCOPE = 'resources/referer-iframe.html';
+    var SCRIPT = 'resources/fetch-rewrite-worker.js';
+    var host_info = get_host_info();
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, SCOPE);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(SCOPE); })
+      .then(function(frame) {
+          var channel = new MessageChannel();
+          t.add_cleanup(function() {
+              frame.remove();
+            });
+
+          var onMsg = new Promise(function(resolve) {
+              channel.port1.onmessage = resolve;
+            });
+
+          frame.contentWindow.postMessage({},
+                                          host_info['HTTPS_ORIGIN'],
+                                          [channel.port2]);
+          return onMsg;
+        })
+      .then(function(e) {
+          assert_equals(e.data.results, 'finish');
+        });
+  }, 'Verify the referer');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/referrer-policy-header.https.html b/test/fixtures/wpt/service-workers/service-worker/referrer-policy-header.https.html
new file mode 100644
index 000000000000..784343e6d8f1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/referrer-policy-header.https.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>Service Worker: check referer of fetch() with Referrer Policy</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+const SCOPE = 'resources/referrer-policy-iframe.html';
+const SCRIPT = 'resources/fetch-rewrite-worker-referrer-policy.js';
+
+promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, registration.installing, 'activated');
+    t.add_cleanup(() => registration.unregister(),
+                 'Remove registration as a cleanup');
+
+    const full_scope_url = new URL(SCOPE, location.href);
+    const redirect_to = `${full_scope_url.href}?ignore=true`;
+    const frame = await with_iframe(
+        `${SCOPE}?pipe=status(302)|header(Location,${redirect_to})|` +
+        'header(Referrer-Policy,origin)');
+    assert_equals(frame.contentDocument.referrer,
+                  full_scope_url.origin + '/');
+    t.add_cleanup(() => frame.remove());
+}, 'Referrer for a main resource redirected with referrer-policy (origin) ' +
+   'should only have origin.');
+
+promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, SCRIPT, SCOPE, `{type: 'module'}`);
+    await wait_for_state(t, registration.installing, 'activated');
+    t.add_cleanup(() => registration.unregister(),
+                 'Remove registration as a cleanup');
+
+    const full_scope_url = new URL(SCOPE, location.href);
+    const redirect_to = `${full_scope_url.href}?ignore=true`;
+    const frame = await with_iframe(
+        `${SCOPE}?pipe=status(302)|header(Location,${redirect_to})|` +
+        'header(Referrer-Policy,origin)');
+    assert_equals(frame.contentDocument.referrer,
+                  full_scope_url.origin + '/');
+    t.add_cleanup(() => frame.remove());
+}, 'Referrer for a main resource redirected with a module script with referrer-policy (origin) ' +
+   'should only have origin.');
+
+promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+    await wait_for_state(t, registration.installing, 'activated');
+    t.add_cleanup(() => registration.unregister(),
+                 'Remove registration as a cleanup');
+
+    const host_info = get_host_info();
+    const frame = await with_iframe(SCOPE);
+    const channel = new MessageChannel();
+    t.add_cleanup(() => frame.remove());
+    const e = await new Promise(resolve => {
+        channel.port1.onmessage = resolve;
+        frame.contentWindow.postMessage(
+            {}, host_info['HTTPS_ORIGIN'], [channel.port2]);
+    });
+    assert_equals(e.data.results, 'finish');
+}, 'Referrer for fetch requests initiated from a service worker with ' +
+   'referrer-policy (origin) should only have origin.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/referrer-toplevel-script-fetch.https.html b/test/fixtures/wpt/service-workers/service-worker/referrer-toplevel-script-fetch.https.html
new file mode 100644
index 000000000000..65c60a11db20
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/referrer-toplevel-script-fetch.https.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<title>Service Worker: check referrer of top-level script fetch</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+
+async function get_toplevel_script_headers(worker) {
+  worker.postMessage("getHeaders");
+  return new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+}
+
+promise_test(async (t) => {
+  const script = "resources/test-request-headers-worker.py";
+  const scope = "resources/blank.html";
+  const host_info = get_host_info();
+
+  const registration = await service_worker_unregister_and_register(
+    t, script, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, registration.installing, "activated");
+
+  const expected_referrer = host_info["HTTPS_ORIGIN"] + location.pathname;
+
+  // Check referrer for register().
+  const register_headers = await get_toplevel_script_headers(registration.active);
+  assert_equals(register_headers["referer"], expected_referrer, "referrer of register()");
+
+  // Check referrer for update().
+  await registration.update();
+  await wait_for_state(t, registration.installing, "installed");
+  const update_headers = await get_toplevel_script_headers(registration.waiting);
+  assert_equals(update_headers["referer"], expected_referrer, "referrer of update()");
+}, "Referrer of the top-level script fetch should be the document URL");
+
+promise_test(async (t) => {
+  const script = "resources/test-request-headers-worker.py";
+  const scope = "resources/blank.html";
+  const host_info = get_host_info();
+
+  const registration = await service_worker_unregister_and_register(
+    t, script, scope, {type: 'module'});
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, registration.installing, "activated");
+
+  const expected_referrer = host_info["HTTPS_ORIGIN"] + location.pathname;
+
+  // Check referrer for register().
+  const register_headers = await get_toplevel_script_headers(registration.active);
+  assert_equals(register_headers["referer"], expected_referrer, "referrer of register()");
+
+  // Check referrer for update().
+  await registration.update();
+  await wait_for_state(t, registration.installing, "installed");
+  const update_headers = await get_toplevel_script_headers(registration.waiting);
+  assert_equals(update_headers["referer"], expected_referrer, "referrer of update()");
+}, "Referrer of the module script fetch should be the document URL");
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-closed-window.https.html b/test/fixtures/wpt/service-workers/service-worker/register-closed-window.https.html
new file mode 100644
index 000000000000..9c1b639bb757
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-closed-window.https.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<title>Service Worker: Register() on Closed Window</title>
+<meta name=timeout content=long>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+var host_info = get_host_info();
+var frameURL = host_info['HTTPS_ORIGIN'] + base_path() +
+               'resources/register-closed-window-iframe.html';
+
+async_test(function(t) {
+  var frame;
+  with_iframe(frameURL).then(function(f) {
+    frame = f;
+    return new Promise(function(resolve) {
+      window.addEventListener('message', function messageHandler(evt) {
+        window.removeEventListener('message', messageHandler);
+        resolve(evt.data);
+      });
+      frame.contentWindow.postMessage('START', '*');
+    });
+  }).then(function(result) {
+    assert_equals(result, 'OK', 'frame should complete without crashing');
+    frame.remove();
+    t.done();
+  }).catch(unreached_rejection(t));
+}, 'Call register() on ServiceWorkerContainer owned by closed window.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-default-scope.https.html b/test/fixtures/wpt/service-workers/service-worker/register-default-scope.https.html
new file mode 100644
index 000000000000..1d86548eb5ee
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-default-scope.https.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>register() and scope</title>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/empty-worker.js';
+    var script_url = new URL(script, location.href);
+    var expected_scope = new URL('./', script_url).href;
+    return service_worker_unregister(t, expected_scope)
+      .then(function() {
+        return navigator.serviceWorker.register('resources/empty-worker.js');
+      }).then(function(registration) {
+        assert_equals(registration.scope, expected_scope,
+                      'The default scope should be URL("./", script_url)');
+        return registration.unregister();
+      }).then(function() {
+        t.done();
+      });
+  }, 'default scope');
+
+promise_test(function(t) {
+    // This script must be different than the 'default scope' test, or else
+    // the scopes will collide.
+    var script = 'resources/empty.js';
+    var script_url = new URL(script, location.href);
+    var expected_scope = new URL('./', script_url).href;
+    return service_worker_unregister(t, expected_scope)
+      .then(function() {
+        return navigator.serviceWorker.register('resources/empty.js',
+                                                { scope: undefined });
+      }).then(function(registration) {
+        assert_equals(registration.scope, expected_scope,
+                      'The default scope should be URL("./", script_url)');
+        return registration.unregister();
+      }).then(function() {
+        t.done();
+      });
+  }, 'undefined scope');
+
+promise_test(function(t) {
+    var script = 'resources/simple-fetch-worker.js';
+    var script_url = new URL(script, location.href);
+    var expected_scope = new URL('./', script_url).href;
+    return service_worker_unregister(t, expected_scope)
+      .then(function() {
+        return navigator.serviceWorker.register('resources/empty.js',
+                                                { scope: null });
+      })
+      .then(
+        function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, registration.scope);
+            });
+
+          assert_unreached('register should fail');
+        },
+        function(error) {
+          assert_equals(error.name, 'SecurityError',
+                        'passing a null scope should be interpreted as ' +
+                        'scope="null" which violates the path restriction');
+          t.done();
+        });
+  }, 'null scope');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html b/test/fixtures/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html
new file mode 100644
index 000000000000..6eb00f3071a2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html
@@ -0,0 +1,233 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var script1 = normalizeURL('resources/empty-worker.js');
+var script2 = normalizeURL('resources/empty-worker.js?new');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-new-script-concurrently';
+    var register_promise1;
+    var register_promise2;
+
+    service_worker_unregister(t, scope)
+      .then(function() {
+          register_promise1 = navigator.serviceWorker.register(script1,
+                                                               {scope: scope});
+          register_promise2 = navigator.serviceWorker.register(script2,
+                                                               {scope: scope});
+          return register_promise1;
+        })
+      .then(function(registration) {
+          assert_equals(registration.installing.scriptURL, script1,
+                        'on first register, first script should be installing');
+          assert_equals(registration.waiting, null,
+                        'on first register, waiting should be null');
+          assert_equals(registration.active, null,
+                        'on first register, active should be null');
+          return register_promise2;
+        })
+      .then(function(registration) {
+          assert_equals(
+              registration.installing.scriptURL, script2,
+              'on second register, second script should be installing');
+          // Spec allows racing: the first register may have finished
+          // or the second one could have terminated the installing worker.
+          assert_true(registration.waiting == null ||
+                      registration.waiting.scriptURL == script1,
+                      'on second register, .waiting should be null or the ' +
+                      'first script');
+          assert_true(registration.active == null ||
+                      (registration.waiting == null &&
+                       registration.active.scriptURL == script1),
+                      'on second register, .active should be null or the ' +
+                      'first script');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register different scripts concurrently');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-then-register-new-script';
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on activated, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on activated, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on activated, the first script should be active');
+          return navigator.serviceWorker.register(script2, {scope:scope});
+        })
+      .then(function(r) {
+          registration = r;
+          assert_equals(registration.installing.scriptURL, script2,
+                        'on second register, the second script should be ' +
+                        'installing');
+          assert_equals(registration.waiting, null,
+                        'on second register, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on second register, the first script should be ' +
+                        'active');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on installed, installing should be null');
+          assert_equals(registration.waiting.scriptURL, script2,
+                        'on installed, the second script should be waiting');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on installed, the first script should be active');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then register new script URL');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-then-register-new-script-404';
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on activated, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on activated, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on activated, the first script should be active');
+          return navigator.serviceWorker.register('this-will-404.js',
+                                                  {scope:scope});
+        })
+      .then(
+        function() { assert_unreached('register should reject'); },
+        function(error) {
+          assert_equals(registration.installing, null,
+                        'on rejected, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on rejected, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on rejected, the first script should be active');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then register new script URL that 404s');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-then-register-new-script-reject-install';
+    var reject_script = normalizeURL('resources/reject-install-worker.js');
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on activated, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on activated, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on activated, the first script should be active');
+          return navigator.serviceWorker.register(reject_script, {scope:scope});
+        })
+      .then(function(r) {
+          registration = r;
+          assert_equals(registration.installing.scriptURL, reject_script,
+                        'on update, the second script should be installing');
+          assert_equals(registration.waiting, null,
+                        'on update, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on update, the first script should be active');
+          return wait_for_state(t, registration.installing, 'redundant');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'on redundant, installing should be null');
+          assert_equals(registration.waiting, null,
+                        'on redundant, waiting should be null');
+          assert_equals(registration.active.scriptURL, script1,
+                        'on redundant, the first script should be active');
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then register new script that does not install');
+
+async_test(function(t) {
+    var scope = 'resources/scope/register-new-script-controller';
+    var iframe;
+    var registration;
+
+    service_worker_unregister_and_register(t, script1, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          iframe = frame;
+          return navigator.serviceWorker.register(script2, { scope: scope })
+        })
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          var sw_container = iframe.contentWindow.navigator.serviceWorker;
+          assert_equals(sw_container.controller.scriptURL, script1,
+                        'the old version should control the old doc');
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          var sw_container = frame.contentWindow.navigator.serviceWorker;
+          assert_equals(sw_container.controller.scriptURL, script1,
+                        'the old version should control a new doc');
+          var onactivated_promise = wait_for_state(t,
+                                                   registration.waiting,
+                                                   'activated');
+          frame.remove();
+          iframe.remove();
+          return onactivated_promise;
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          var sw_container = frame.contentWindow.navigator.serviceWorker;
+          assert_equals(sw_container.controller.scriptURL, script2,
+                        'the new version should control a new doc');
+          frame.remove();
+          return registration.unregister();
+        })
+      .then(function() {
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register same-scope new script url effect on controller');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html
new file mode 100644
index 000000000000..0920b5cb223d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>Service Worker: Register wait-forever-in-install-worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var bad_script = 'resources/wait-forever-in-install-worker.js';
+    var good_script = 'resources/empty-worker.js';
+    var scope = 'resources/wait-forever-in-install-worker';
+    var other_scope = 'resources/wait-forever-in-install-worker-other';
+    var registration;
+    var registerPromise;
+
+    return navigator.serviceWorker.register(bad_script, {scope: scope})
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          assert_equals(registration.installing.scriptURL,
+                        normalizeURL(bad_script));
+
+          // This register job should not start until the first
+          // register for the same scope completes.
+          registerPromise =
+            navigator.serviceWorker.register(good_script, {scope: scope});
+
+          // In order to test that the above register does not complete
+          // we will perform a register() on a different scope.  The
+          // assumption here is that the previous register call would
+          // have completed in the same timeframe if it was able to do
+          // so.
+          return navigator.serviceWorker.register(good_script,
+                                                  {scope: other_scope});
+        })
+      .then(function(swr) {
+          return swr.unregister();
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL,
+                        normalizeURL(bad_script));
+          registration.installing.postMessage('STOP_WAITING');
+          return registerPromise;
+        })
+      .then(function(swr) {
+          assert_equals(registration.installing.scriptURL,
+                        normalizeURL(good_script));
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+  }, 'register worker that calls waitUntil with a promise that never ' +
+     'resolves in oninstall');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-basic.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-basic.https.html
new file mode 100644
index 000000000000..759b4244a269
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-basic.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (basic)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const script = 'resources/registration-worker.js';
+
+promise_test(async (t) => {
+  const scope = 'resources/registration/normal';
+  const registration = await navigator.serviceWorker.register(script, {scope});
+  t.add_cleanup(() => registration.unregister());
+  assert_true(
+    registration instanceof ServiceWorkerRegistration,
+    'Successfully registered.');
+}, 'Registering normal scope');
+
+promise_test(async (t) => {
+  const scope = 'resources/registration/scope-with-fragment#ref';
+  const registration = await navigator.serviceWorker.register(script, {scope});
+  t.add_cleanup(() => registration.unregister());
+  assert_true(
+    registration instanceof ServiceWorkerRegistration,
+    'Successfully registered.');
+  assert_equals(
+    registration.scope,
+    normalizeURL('resources/registration/scope-with-fragment'),
+    'A fragment should be removed from scope');
+}, 'Registering scope with fragment');
+
+promise_test(async (t) => {
+  const scope = 'resources/';
+  const registration = await navigator.serviceWorker.register(script, {scope})
+  t.add_cleanup(() => registration.unregister());
+  assert_true(
+    registration instanceof ServiceWorkerRegistration,
+    'Successfully registered.');
+}, 'Registering same scope as the script directory');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-end-to-end.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-end-to-end.https.html
new file mode 100644
index 000000000000..1af4582d3874
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-end-to-end.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<title>Service Worker: registration end-to-end</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var t = async_test('Registration: end-to-end');
+t.step(function() {
+
+    var scope = 'resources/in-scope/';
+    var serviceWorkerStates = [];
+    var lastServiceWorkerState = '';
+    var receivedMessageFromPort = '';
+
+    assert_true(navigator.serviceWorker instanceof ServiceWorkerContainer);
+    assert_equals(typeof navigator.serviceWorker.register, 'function');
+    assert_equals(typeof navigator.serviceWorker.getRegistration, 'function');
+
+    service_worker_unregister_and_register(
+        t, 'resources/end-to-end-worker.js', scope)
+      .then(onRegister)
+      .catch(unreached_rejection(t));
+
+    function sendMessagePort(worker, from) {
+        var messageChannel = new MessageChannel();
+        worker.postMessage({from:from, port:messageChannel.port2}, [messageChannel.port2]);
+        return messageChannel.port1;
+    }
+
+    function onRegister(registration) {
+        var sw = registration.installing;
+        serviceWorkerStates.push(sw.state);
+        lastServiceWorkerState = sw.state;
+
+        var sawMessage = new Promise(t.step_func(function(resolve) {
+            sendMessagePort(sw, 'registering doc').onmessage = t.step_func(function (e) {
+                receivedMessageFromPort = e.data;
+                resolve();
+            });
+        }));
+
+        var sawActive = new Promise(t.step_func(function(resolve) {
+            sw.onstatechange = t.step_func(function() {
+                serviceWorkerStates.push(sw.state);
+
+                switch (sw.state) {
+                case 'installed':
+                    assert_equals(lastServiceWorkerState, 'installing');
+                    break;
+                case 'activating':
+                    assert_equals(lastServiceWorkerState, 'installed');
+                    break;
+                case 'activated':
+                    assert_equals(lastServiceWorkerState, 'activating');
+                    break;
+                default:
+                    // We won't see 'redundant' because onstatechange is
+                    // overwritten before calling unregister.
+                    assert_unreached('Unexpected state: ' + sw.state);
+                }
+
+                lastServiceWorkerState = sw.state;
+                if (sw.state === 'activated')
+                    resolve();
+            });
+        }));
+
+        Promise.all([sawMessage, sawActive]).then(t.step_func(function() {
+            assert_array_equals(serviceWorkerStates,
+                                ['installing', 'installed', 'activating', 'activated'],
+                                'Service worker should pass through all states');
+
+            assert_equals(receivedMessageFromPort, 'Ack for: registering doc');
+
+            var sawRedundant = new Promise(t.step_func(function(resolve) {
+                sw.onstatechange = t.step_func(function() {
+                    assert_equals(sw.state, 'redundant');
+                    resolve();
+                });
+            }));
+            registration.unregister();
+            sawRedundant.then(t.step_func(function() {
+                t.done();
+            }));
+        }));
+    }
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-events.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-events.https.html
new file mode 100644
index 000000000000..5bcfd66846bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-events.https.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<title>Service Worker: registration events</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/in-scope/';
+    return service_worker_unregister_and_register(
+        t, 'resources/events-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+          });
+
+          return onRegister(registration.installing);
+        });
+
+    function sendMessagePort(worker, from) {
+        var messageChannel = new MessageChannel();
+        worker.postMessage({from:from, port:messageChannel.port2}, [messageChannel.port2]);
+        return messageChannel.port1;
+    }
+
+    function onRegister(sw) {
+        return new Promise(function(resolve) {
+            sw.onstatechange = function() {
+                if (sw.state === 'activated')
+                    resolve();
+            };
+        }).then(function() {
+            return new Promise(function(resolve) {
+                sendMessagePort(sw, 'registering doc').onmessage = resolve;
+            });
+        }).then(function(e) {
+                assert_array_equals(e.data.events,
+                                    ['install', 'activate'],
+                                   'Worker should see install then activate events');
+        });
+    }
+}, 'Registration: events');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-iframe.https.html
new file mode 100644
index 000000000000..ae39ddfea3e5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-iframe.https.html
@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Registration for iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// Set script url and scope url relative to the iframe's document's url. Assert
+// the implementation parses the urls against the iframe's document's url.
+async_test(function(t) {
+  const url = 'resources/blank.html';
+  const iframe_scope = 'registration-with-valid-scope';
+  const scope = normalizeURL('resources/' + iframe_scope);
+  const iframe_script = 'empty-worker.js';
+  const script = normalizeURL('resources/' + iframe_script);
+  var frame;
+  var registration;
+
+  service_worker_unregister(t, scope)
+    .then(function() { return with_iframe(url); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            iframe_script,
+            { scope: iframe_scope });
+      })
+    .then(function(r) {
+        registration = r;
+        return wait_for_state(t, r.installing, 'activated');
+      })
+    .then(function() {
+        assert_equals(registration.scope, scope,
+                      'registration\'s scope must be parsed against the ' +
+                      '"relevant global object"');
+        assert_equals(registration.active.scriptURL, script,
+                      'worker\'s scriptURL must be parsed against the ' +
+                      '"relevant global object"');
+        return registration.unregister();
+      })
+    .then(function() {
+        frame.remove();
+        t.done();
+      })
+    .catch(unreached_rejection(t));
+  }, 'register method should use the "relevant global object" to parse its ' +
+     'scriptURL and scope - normal case');
+
+// Set script url and scope url relative to the parent frame's document's url.
+// Assert the implementation throws a TypeError exception.
+async_test(function(t) {
+  const url = 'resources/blank.html';
+  const iframe_scope = 'resources/registration-with-scope-to-non-existing-url';
+  const scope = normalizeURL('resources/' + iframe_scope);
+  const script = 'resources/empty-worker.js';
+  var frame;
+  var registration;
+
+  service_worker_unregister(t, scope)
+    .then(function() { return with_iframe(url); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            script,
+            { scope: iframe_scope });
+      })
+    .then(
+      function() {
+        assert_unreached('register() should reject');
+      },
+      function(e) {
+        assert_equals(e.name, 'TypeError',
+                      'register method with scriptURL and scope parsed to ' +
+                      'nonexistent location should reject with TypeError');
+        frame.remove();
+        t.done();
+      })
+    .catch(unreached_rejection(t));
+  }, 'register method should use the "relevant global object" to parse its ' +
+     'scriptURL and scope - error case');
+
+// Set the scope url to a non-subdirectory of the script url. Assert the
+// implementation throws a SecurityError exception.
+async_test(function(t) {
+  const url = 'resources/blank.html';
+  const scope = 'registration-with-disallowed-scope';
+  const iframe_scope = '../' + scope;
+  const script = 'empty-worker.js';
+  var frame;
+  var registration;
+
+  service_worker_unregister(t, scope)
+    .then(function() { return with_iframe(url); })
+    .then(function(f) {
+        frame = f;
+        return frame.contentWindow.navigator.serviceWorker.register(
+            script,
+            { scope: iframe_scope });
+      })
+    .then(
+      function() {
+        assert_unreached('register() should reject');
+      },
+      function(e) {
+        assert_equals(e.name, 'SecurityError',
+                      'The scope set to a non-subdirectory of the scriptURL ' +
+                      'should reject with SecurityError');
+        frame.remove();
+        t.done();
+      })
+    .catch(unreached_rejection(t));
+  }, 'A scope url should start with the given script url');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-mime-types.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-mime-types.https.html
new file mode 100644
index 000000000000..3a21aac5c75c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-mime-types.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (MIME types)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-mime-types.js"></script>
+<script>
+registration_tests_mime_types((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-schedule-job.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-schedule-job.https.html
new file mode 100644
index 000000000000..25d758ee8f0e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-schedule-job.https.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name=timeout content=long>
+<title>Service Worker: Schedule Job algorithm</title>
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests for https://w3c.github.io/ServiceWorker/#schedule-job-algorithm
+// Non-equivalent register jobs should not be coalesced.
+const scope = 'resources/';
+const script1 = 'resources/empty.js';
+const script2 = 'resources/empty.js?change';
+
+async function cleanup() {
+  const registration = await navigator.serviceWorker.getRegistration(scope);
+  if (registration)
+    await registration.unregister();
+}
+
+function absolute_url(url) {
+  return new URL(url, self.location).toString();
+}
+
+// Test that a change to `script` starts a new register job.
+promise_test(async t => {
+  await cleanup();
+  t.add_cleanup(cleanup);
+
+  // Make a registration.
+  const registration = await
+      navigator.serviceWorker.register(script1, {scope});
+
+  // Schedule two more register jobs.
+  navigator.serviceWorker.register(script1, {scope});
+  await navigator.serviceWorker.register(script2, {scope});
+
+  // The jobs should not have been coalesced.
+  const worker = get_newest_worker(registration);
+  assert_equals(worker.scriptURL, absolute_url(script2));
+}, 'different scriptURL');
+
+// Test that a change to `updateViaCache` starts a new register job.
+promise_test(async t => {
+  await cleanup();
+  t.add_cleanup(cleanup);
+
+  // Check defaults.
+  const registration = await
+      navigator.serviceWorker.register(script1, {scope});
+  assert_equals(registration.updateViaCache, 'imports');
+
+  // Schedule two more register jobs.
+  navigator.serviceWorker.register(script1, {scope});
+  await navigator.serviceWorker.register(script1, {scope,
+      updateViaCache: 'none'});
+
+  // The jobs should not have been coalesced.
+  assert_equals(registration.updateViaCache, 'none');
+}, 'different updateViaCache');
+
+// Test that a change to `type` starts a new register job.
+promise_test(async t => {
+  await cleanup();
+  t.add_cleanup(cleanup);
+
+  const scriptForTypeCheck = 'resources/type-check-worker.js';
+  // Check defaults.
+  const registration = await
+      navigator.serviceWorker.register(scriptForTypeCheck, {scope});
+
+  let worker_type = await new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    // The jobs should not have been coalesced. get_newest_worker() helps the
+    // test fail with stable output on browers that incorrectly coalesce
+    // register jobs, since then sometimes registration is not a new worker as
+    // expected.
+    const worker = get_newest_worker(registration);
+    // The argument of postMessage doesn't matter for this case.
+    worker.postMessage('');
+  });
+
+  assert_equals(worker_type, 'classic');
+
+  // Schedule two more register jobs.
+  navigator.serviceWorker.register(scriptForTypeCheck, {scope});
+  await navigator.serviceWorker.register(scriptForTypeCheck, {scope, type: 'module'});
+
+  worker_type = await new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    // The jobs should not have been coalesced. get_newest_worker() helps the
+    // test fail with stable output on browers that incorrectly coalesce
+    // register jobs, since then sometimes registration is not a new worker as
+    // expected.
+    const worker = get_newest_worker(registration);
+    // The argument of postMessage doesn't matter for this case.
+    worker.postMessage('');
+  });
+
+  assert_equals(worker_type, 'module');
+}, 'different type');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-scope-module-static-import.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-scope-module-static-import.https.html
new file mode 100644
index 000000000000..5c75295aed1c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-scope-module-static-import.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>Service Worker: Static imports from module top-level scripts shouldn't be affected by the service worker script path restriction</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// https://w3c.github.io/ServiceWorker/#path-restriction
+// is applied to top-level scripts in
+// https://w3c.github.io/ServiceWorker/#update-algorithm
+// but not to submodules imported from top-level scripts.
+async function runTest(t, script, scope) {
+  const script_url = new URL(script, location.href);
+  await service_worker_unregister(t, scope);
+  const registration = await
+      navigator.serviceWorker.register(script, {type: 'module'});
+  t.add_cleanup(_ => registration.unregister());
+  const msg = await new Promise(resolve => {
+    registration.installing.postMessage('ping');
+    navigator.serviceWorker.onmessage = resolve;
+  });
+  assert_equals(msg.data, 'pong');
+}
+
+promise_test(async t => {
+    await runTest(t,
+        'resources/scope2/imported-module-script.js',
+        'resources/scope2/');
+  }, 'imported-module-script.js works when used as top-level');
+
+promise_test(async t => {
+    await runTest(t,
+        'resources/scope1/module-worker-importing-scope2.js',
+        'resources/scope1/');
+  }, 'static imports to outside path restriction should be allowed');
+
+promise_test(async t => {
+    await runTest(t,
+       'resources/scope1/module-worker-importing-redirect-to-scope2.js',
+       'resources/scope1/');
+  }, 'static imports redirecting to outside path restriction should be allowed');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-scope.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-scope.https.html
new file mode 100644
index 000000000000..141875f5847c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-scope.https.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (scope)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-scope.js"></script>
+<script>
+registration_tests_scope((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-script-module.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-script-module.https.html
new file mode 100644
index 000000000000..9e39a1f75b27
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-script-module.https.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (module script)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-script.js"></script>
+<script>
+registration_tests_script(
+    (script, options) => navigator.serviceWorker.register(
+        script,
+        Object.assign({type: 'module'}, options)),
+    'module');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-script-url.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-script-url.https.html
new file mode 100644
index 000000000000..bda61adb0027
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-script-url.https.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (scriptURL)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-script-url.js"></script>
+<script>
+registration_tests_script_url((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-script.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-script.https.html
new file mode 100644
index 000000000000..f1e51fd265e2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-script.https.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (script)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-script.js"></script>
+<script>
+registration_tests_script(
+    (script, options) => navigator.serviceWorker.register(script, options),
+    'classic'
+);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-security-error.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-security-error.https.html
new file mode 100644
index 000000000000..860c2d22ea93
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-security-error.https.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration (SecurityError)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/registration-tests-security-error.js"></script>
+<script>
+registration_tests_security_error((script, options) => navigator.serviceWorker.register(script, options));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-service-worker-attributes.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-service-worker-attributes.https.html
new file mode 100644
index 000000000000..f7b52d5ddced
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-service-worker-attributes.https.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+promise_test(function(t) {
+    var scope = 'resources/scope/installing-waiting-active-after-registration';
+    var worker_url = 'resources/empty-worker.js';
+    var expected_url = normalizeURL(worker_url);
+    var newest_worker;
+    var registration;
+
+    return service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return r.unregister();
+            });
+          registration = r;
+          newest_worker = registration.installing;
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'installing before updatefound');
+          assert_equals(registration.waiting, null,
+                        'waiting before updatefound');
+          assert_equals(registration.active, null,
+                        'active before updatefound');
+          return wait_for_update(t, registration);
+        })
+      .then(function() {
+          assert_equals(registration.installing, newest_worker,
+                        'installing after updatefound');
+          assert_equals(registration.waiting, null,
+                        'waiting after updatefound');
+          assert_equals(registration.active, null,
+                        'active after updatefound');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing after installed');
+          assert_equals(registration.waiting, newest_worker,
+                        'waiting after installed');
+          assert_equals(registration.active, null,
+                        'active after installed');
+          return wait_for_state(t, registration.waiting, 'activated');
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing after activated');
+          assert_equals(registration.waiting, null,
+                        'waiting after activated');
+          assert_equals(registration.active, newest_worker,
+                        'active after activated');
+          return Promise.all([
+              wait_for_state(t, registration.active, 'redundant'),
+              registration.unregister()
+            ]);
+        })
+      .then(function() {
+          assert_equals(registration.installing, null,
+                        'installing after redundant');
+          assert_equals(registration.waiting, null,
+                        'waiting after redundant');
+          // According to spec, Clear Registration runs Update State which is
+          // immediately followed by setting active to null, which means by the
+          // time the event loop turns and the Promise for statechange is
+          // resolved, this will be gone.
+          assert_equals(registration.active, null,
+                        'active should be null after redundant');
+        });
+  }, 'installing/waiting/active after registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/registration-updateviacache.https.html b/test/fixtures/wpt/service-workers/service-worker/registration-updateviacache.https.html
new file mode 100644
index 000000000000..b2f6bbc6f849
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/registration-updateviacache.https.html
@@ -0,0 +1,204 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration-updateViaCache</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+  const UPDATE_VIA_CACHE_VALUES = [undefined, 'imports', 'all', 'none'];
+  const SCRIPT_URL = 'resources/update-max-aged-worker.py';
+  const SCOPE = 'resources/blank.html';
+
+  async function cleanup() {
+    const reg = await navigator.serviceWorker.getRegistration(SCOPE);
+    if (!reg) return;
+    if (reg.scope == new URL(SCOPE, location).href) {
+      return reg.unregister();
+    };
+  }
+
+  function getScriptTimes(sw, testName) {
+    return new Promise(resolve => {
+      navigator.serviceWorker.addEventListener('message', function listener(event) {
+        if (event.data.test !== testName) return;
+        navigator.serviceWorker.removeEventListener('message', listener);
+        resolve({
+          mainTime: event.data.mainTime,
+          importTime: event.data.importTime
+        });
+      });
+
+      sw.postMessage('');
+    });
+  }
+
+  // Test creating registrations & triggering an update.
+  for (const updateViaCache of UPDATE_VIA_CACHE_VALUES) {
+    const testName = `register-with-updateViaCache-${updateViaCache}`;
+
+    promise_test(async t => {
+      await cleanup();
+
+      const opts = {scope: SCOPE};
+
+      if (updateViaCache) opts.updateViaCache = updateViaCache;
+
+      const reg = await navigator.serviceWorker.register(
+        `${SCRIPT_URL}?test=${testName}`,
+        opts
+      );
+
+      assert_equals(reg.updateViaCache, updateViaCache || 'imports', "reg.updateViaCache");
+
+      const sw = reg.installing || reg.waiting || reg.active;
+      await wait_for_state(t, sw, 'activated');
+      const values = await getScriptTimes(sw, testName);
+      await reg.update();
+
+      if (updateViaCache == 'all') {
+        assert_equals(reg.installing, null, "No new service worker");
+      }
+      else {
+        const newWorker = reg.installing;
+        assert_true(!!newWorker, "New worker installing");
+        const newValues = await getScriptTimes(newWorker, testName);
+
+        if (!updateViaCache || updateViaCache == 'imports') {
+          assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+          assert_equals(values.importTime, newValues.importTime, "Imported script should be the same");
+        }
+        else if (updateViaCache == 'none') {
+          assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+          assert_not_equals(values.importTime, newValues.importTime, "Imported script should have updated");
+        }
+        else {
+          // We should have handled all of the possible values for updateViaCache.
+          // If this runs, something's gone very wrong.
+          throw Error(`Unexpected updateViaCache value: ${updateViaCache}`);
+        }
+      }
+
+      await cleanup();
+    }, testName);
+  }
+
+  // Test changing the updateViaCache value of an existing registration.
+  for (const updateViaCache1 of UPDATE_VIA_CACHE_VALUES) {
+    for (const updateViaCache2 of UPDATE_VIA_CACHE_VALUES) {
+      const testName = `register-with-updateViaCache-${updateViaCache1}-then-${updateViaCache2}`;
+
+      promise_test(async t => {
+        await cleanup();
+
+        const fullScriptUrl = `${SCRIPT_URL}?test=${testName}`;
+        let opts = {scope: SCOPE};
+        if (updateViaCache1) opts.updateViaCache = updateViaCache1;
+
+        const reg = await navigator.serviceWorker.register(fullScriptUrl, opts);
+
+        const sw = reg.installing;
+        await wait_for_state(t, sw, 'activated');
+        const values = await getScriptTimes(sw, testName);
+
+        const frame = await with_iframe(SCOPE);
+        const reg_in_frame = await frame.contentWindow.navigator.serviceWorker.getRegistration(normalizeURL(SCOPE));
+        assert_equals(reg_in_frame.updateViaCache, updateViaCache1 || 'imports', "reg_in_frame.updateViaCache");
+
+        opts = {scope: SCOPE};
+        if (updateViaCache2) opts.updateViaCache = updateViaCache2;
+
+        await navigator.serviceWorker.register(fullScriptUrl, opts);
+
+        const expected_updateViaCache = updateViaCache2 || 'imports';
+
+        assert_equals(reg.updateViaCache, expected_updateViaCache, "reg.updateViaCache updated");
+        // If the update happens via the cache, the scripts will come back byte-identical.
+        // We bypass the byte-identical check if the script URL has changed, but not if
+        // only the updateViaCache value has changed.
+        if (updateViaCache2 == 'all') {
+          assert_equals(reg.installing, null, "No new service worker");
+        }
+        // If there's no change to the updateViaCache value, register should be a no-op.
+        // The default value should behave as 'imports'.
+        else if ((updateViaCache1 || 'imports') == (updateViaCache2 || 'imports')) {
+          assert_equals(reg.installing, null, "No new service worker");
+        }
+        else {
+          const newWorker = reg.installing;
+          assert_true(!!newWorker, "New worker installing");
+          const newValues = await getScriptTimes(newWorker, testName);
+
+          if (!updateViaCache2 || updateViaCache2 == 'imports') {
+            assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+            assert_equals(values.importTime, newValues.importTime, "Imported script should be the same");
+          }
+          else if (updateViaCache2 == 'none') {
+            assert_not_equals(values.mainTime, newValues.mainTime, "Main script should have updated");
+            assert_not_equals(values.importTime, newValues.importTime, "Imported script should have updated");
+          }
+          else {
+            // We should have handled all of the possible values for updateViaCache2.
+            // If this runs, something's gone very wrong.
+            throw Error(`Unexpected updateViaCache value: ${updateViaCache}`);
+          }
+        }
+
+        // Wait for all registration related tasks on |frame| to complete.
+        await wait_for_activation_on_sample_scope(t, frame.contentWindow);
+        // The updateViaCache change should have been propagated to all
+        // corresponding JS registration objects.
+        assert_equals(reg_in_frame.updateViaCache, expected_updateViaCache, "reg_in_frame.updateViaCache updated");
+        frame.remove();
+
+        await cleanup();
+      }, testName);
+    }
+  }
+
+  // Test accessing updateViaCache of an unregistered registration.
+  for (const updateViaCache of UPDATE_VIA_CACHE_VALUES) {
+    const testName = `access-updateViaCache-after-unregister-${updateViaCache}`;
+
+    promise_test(async t => {
+      await cleanup();
+
+      const opts = {scope: SCOPE};
+
+      if (updateViaCache) opts.updateViaCache = updateViaCache;
+
+      const reg = await navigator.serviceWorker.register(
+        `${SCRIPT_URL}?test=${testName}`,
+        opts
+      );
+
+      const expected_updateViaCache = updateViaCache || 'imports';
+      assert_equals(reg.updateViaCache, expected_updateViaCache, "reg.updateViaCache");
+
+      await reg.unregister();
+
+      // Keep the original value.
+      assert_equals(reg.updateViaCache, expected_updateViaCache, "reg.updateViaCache");
+
+      await cleanup();
+    }, testName);
+  }
+
+  promise_test(async t => {
+    await cleanup();
+    t.add_cleanup(cleanup);
+
+    const registration = await navigator.serviceWorker.register(
+        'resources/empty.js',
+        {scope: SCOPE});
+    assert_equals(registration.updateViaCache, 'imports',
+                  'before update attempt');
+
+    const fail = navigator.serviceWorker.register(
+        'resources/malformed-worker.py?parse-error',
+        {scope: SCOPE, updateViaCache: 'none'});
+    await promise_rejects_js(t, TypeError, fail);
+    assert_equals(registration.updateViaCache, 'imports',
+                  'after update attempt');
+  }, 'updateViaCache is not updated if register() rejects');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/rejections.https.html b/test/fixtures/wpt/service-workers/service-worker/rejections.https.html
new file mode 100644
index 000000000000..8002ad9a81b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/rejections.https.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Service Worker: Rejection Types</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+(function() {
+    var t = async_test('Rejections are DOMExceptions');
+    t.step(function() {
+
+        navigator.serviceWorker.register('http://example.com').then(
+            t.step_func(function() { assert_unreached('Registration should fail'); }),
+            t.step_func(function(reason) {
+                assert_true(reason instanceof DOMException);
+                assert_true(reason instanceof Error);
+                t.done();
+            }));
+    });
+}());
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/request-end-to-end.https.html b/test/fixtures/wpt/service-workers/service-worker/request-end-to-end.https.html
new file mode 100644
index 000000000000..82475eabc4ab
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/request-end-to-end.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent.request passed to onfetch</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(t => {
+    var url = 'resources/request-end-to-end-worker.js';
+    var scope = 'resources/blank.html';
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(r => {
+          add_completion_callback(() => { r.unregister(); });
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(() => { return with_iframe(scope); })
+      .then(frame => {
+          add_completion_callback(() => { frame.remove(); });
+
+          var result = JSON.parse(frame.contentDocument.body.textContent);
+          assert_equals(result.url, frame.src, 'request.url');
+          assert_equals(result.method, 'GET', 'request.method');
+          assert_equals(result.referrer, location.href, 'request.referrer');
+          assert_equals(result.mode, 'navigate', 'request.mode');
+          assert_equals(result.request_construct_error, '',
+                        'Constructing a Request with a Request whose mode ' +
+                        'is navigate and non-empty RequestInit must not throw a ' +
+                        'TypeError.')
+          assert_equals(result.credentials, 'include', 'request.credentials');
+          assert_equals(result.redirect, 'manual', 'request.redirect');
+          assert_equals(result.append_header_error, 'TypeError',
+                        'Appending a new header to the request must throw a ' +
+                        'TypeError.')
+
+          // `assert_equals()` is not used here to create a stable failure
+          // baseline, because the User-Agent header would be version-dependent
+          // if set.
+          assert_true(result.headers['user-agent'] === undefined,
+                      'Default User-Agent header should not be passed to ' +
+                      'onfetch event.')
+        });
+  }, 'Test FetchEvent.request passed to onfetch');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing-bodySize.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing-bodySize.https.html
new file mode 100644
index 000000000000..5c2b1eba8c81
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing-bodySize.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<script src="/common/utils.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const {REMOTE_ORIGIN} = get_host_info();
+
+/*
+  This test does the following:
+  - Loads a service worker
+  - Loads an iframe in the service worker's scope
+  - The service worker tries to fetch a resource which is either:
+    - constructed inside the service worker
+    - fetched from a different URL ny the service worker
+    - Streamed from a differend URL by the service worker
+    - Passes through
+  - By default the RT entry should have encoded/decoded body size. except for
+    the case where the response is an opaque pass-through.
+*/
+function test_scenario({tao, mode, name}) {
+    promise_test(async (t) => {
+        const uid = token();
+        const worker_url = `resources/fetch-response.js?uid=${uid}`;
+        const scope = `resources/fetch-response.html?uid=${uid}`;
+        const iframe = document.createElement('iframe');
+        const path = name === "passthrough" ? `element-timing/resources/TAOImage.py?origin=*&tao=${
+            tao === "pass" ? "wildcard" : "none"})}` : name;
+
+        iframe.src = `${scope}&path=${encodeURIComponent(
+            `${mode === "same-origin" ? "" : REMOTE_ORIGIN}/${path}`)}&mode=${mode}`;
+        const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+        t.add_cleanup(() => registration.unregister());
+        t.add_cleanup(() => iframe.remove());
+        await wait_for_state(t, registration.installing, 'activated');
+        const waitForMessage = new Promise(resolve =>
+          window.addEventListener('message', ({data}) => resolve(data)));
+        document.body.appendChild(iframe);
+        const {buffer, entry} = await waitForMessage;
+        const expectPass = name !== "passthrough" || mode !== "no-cors";
+        assert_equals(buffer.byteLength, expectPass ? entry.decodedBodySize : 0);
+        assert_equals(buffer.byteLength, expectPass ? entry.encodedBodySize : 0);
+    }, `Response body size: ${name}, ${mode}, TAO ${tao}`);
+}
+for (const mode of ["cors", "no-cors", "same-origin"]) {
+  for (const tao of ["pass", "fail"])
+    for (const name of ['constructed', 'forward', 'stream', 'passthrough']) {
+      test_scenario({tao, mode, name});
+    }
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing-cross-origin.https.html
new file mode 100644
index 000000000000..9184a5933a8a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing-cross-origin.https.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8" />
+<title>This test validates Resource Timing for cross origin content fetched by Service Worker from an originally same-origin URL.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+</head>
+
+<body>
+<script>
+function test_sw_resource_timing({ mode }) {
+    promise_test(async t => {
+      const worker_url = `resources/worker-fetching-cross-origin.js?mode=${mode}`;
+      const scope = 'resources/iframe-with-image.html';
+      const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+      await wait_for_state(t, registration.installing, 'activated');
+      const frame = await with_iframe(scope);
+      const frame_performance = frame.contentWindow.performance;
+      // Check that there is one entry for which the timing allow check algorithm failed.
+      const entries = frame_performance.getEntriesByType('resource');
+      assert_equals(entries.length, 1);
+      const entry = entries[0];
+      assert_equals(entry.redirectStart, 0, 'redirectStart should be 0 in cross-origin request.');
+      assert_equals(entry.redirectEnd, 0, 'redirectEnd should be 0 in cross-origin request.');
+
+      assert_equals(entry.domainLookupStart, entry.fetchStart, 'domainLookupStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.domainLookupEnd, entry.fetchStart, 'domainLookupEnd and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.connectStart, entry.fetchStart, 'connectStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.connectEnd, entry.fetchStart, 'connectEnd and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.responseStart, entry.fetchStart, 'responseStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.secureConnectionStart, entry.fetchStart, 'secureConnectionStart and fetchStart should be the same in cross-origin request.');
+      assert_equals(entry.transferSize, 300, 'transferSize should be 300 in cross-origin request.');
+      frame.remove();
+      await registration.unregister();
+  }, `Test that timing allow check fails when service worker changes origin from same to cross origin (${mode}).`);
+}
+
+test_sw_resource_timing({ mode: "cors" });
+test_sw_resource_timing({ mode: "no-cors" });
+
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing-fetch-variants.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing-fetch-variants.https.html
new file mode 100644
index 000000000000..8d4f0be01a8a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing-fetch-variants.https.html
@@ -0,0 +1,121 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Test various interactions between fetch, service-workers and resource timing</title>
+<meta charset="utf-8" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<link rel="help" href="https://w3c.github.io/resource-timing/" >
+<!--
+    This test checks that the different properties in a PerformanceResourceTimingEntry
+    measure what they are supposed to measure according to spec.
+
+    It is achieved by generating programmatic delays and redirects inside a service worker,
+    and checking how the different metrics respond to the delays and redirects.
+
+    The deltas are not measured precisely, but rather relatively to the delay.
+    The delay needs to be long enough so that it's clear that what's measured is the test's
+    programmatic delay and not arbitrary system delays.
+-->
+</head>
+
+<body>
+<script>
+
+const delay = 200;
+const absolutePath = `${base_path()}/simple.txt`
+function toSequence({before, after, entry}) {
+    /*
+        The order of keys is the same as in this chart:
+        https://w3c.github.io/resource-timing/#attribute-descriptions
+    */
+    const keys = [
+        'startTime',
+        'redirectStart',
+        'redirectEnd',
+        'workerStart',
+        'fetchStart',
+        'connectStart',
+        'requestStart',
+        'responseStart',
+        'responseEnd'
+    ];
+
+    let cursor = before;
+    const step = value => {
+        // A zero/null value, reflect that in the sequence
+        if (!value)
+            return value;
+
+        // Value is the same as before
+        if (value === cursor)
+            return "same";
+
+        // Oops, value is in the wrong place
+        if (value < cursor)
+            return "back";
+
+        // Delta is greater than programmatic delay, this is where the delay is measured.
+        if ((value - cursor) >= delay)
+            return "delay";
+
+        // Some small delta, probably measuring an actual networking stack delay
+        return "tick";
+    }
+
+    const res = keys.map(key => {
+        const value = step(entry[key]);
+        if (entry[key])
+            cursor = entry[key];
+        return [key, value];
+    });
+
+    return Object.fromEntries([...res, ['after', step(after)]]);
+}
+async function testVariant(t, variant) {
+    const worker_url = 'resources/fetch-variants-worker.js';
+    const url = encodeURIComponent(`simple.txt?delay=${delay}&variant=${variant}`);
+    const scope = `resources/iframe-with-fetch-variants.html?url=${url}`;
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+    await wait_for_state(t, registration.installing, 'activated');
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+    const result = await new Promise(resolve => window.addEventListener('message', message => {
+        resolve(message.data);
+    }))
+
+    return toSequence(result);
+}
+
+promise_test(async t => {
+    const result = await testVariant(t, 'redirect');
+    assert_equals(result.redirectStart, 0);
+}, 'Redirects done from within a service-worker should not be exposed to client ResourceTiming');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'forward');
+    assert_equals(result.connectStart, 'same');
+}, 'Connection info from within a service-worker should not be exposed to client ResourceTiming');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'forward');
+    assert_not_equals(result.requestStart, 'back');
+}, 'requestStart should never be before fetchStart');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'delay-after-fetch');
+    const whereIsDelayMeasured = Object.entries(result).find(r => r[1] === 'delay')[0];
+    assert_equals(whereIsDelayMeasured, 'responseStart');
+}, 'Delay from within service-worker (after internal fetching) should be accessible through `responseStart`');
+
+promise_test(async t => {
+    const result = await testVariant(t, 'delay-before-fetch');
+    const whereIsDelayMeasured = Object.entries(result).find(r => r[1] === 'delay')[0];
+    assert_equals(whereIsDelayMeasured, 'responseStart');
+}, 'Delay from within service-worker (before internal fetching) should be measured before responseStart in the client ResourceTiming entry');
+</script>
+
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resource-timing.sub.https.html b/test/fixtures/wpt/service-workers/service-worker/resource-timing.sub.https.html
new file mode 100644
index 000000000000..e8328f3597ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resource-timing.sub.https.html
@@ -0,0 +1,150 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function resourceUrl(path) {
+  return "https://{{host}}:{{ports[https][0]}}" + base_path() + path;
+}
+
+function crossOriginUrl(path) {
+  return "https://{{hosts[alt][]}}:{{ports[https][0]}}" + base_path() + path;
+}
+
+// Verify existance of a PerformanceEntry and the order between the timings.
+//
+// |options| has these properties:
+// performance: Performance interface to verify existance of the entry.
+// resource: the path to the resource.
+// mode: 'cross-origin' to load the resource from third-party origin.
+// description: the description passed to each assertion.
+// should_no_performance_entry: no entry is expected to be recorded when it's
+//                              true.
+function verify(options) {
+  const url = options.mode === 'cross-origin' ? crossOriginUrl(options.resource)
+    : resourceUrl(options.resource);
+  const entryList = options.performance.getEntriesByName(url, 'resource');
+  if (options.should_no_performance_entry) {
+    // The performance timeline may not have an entry for a resource
+    // which failed to load.
+    assert_equals(entryList.length, 0, options.description);
+    return;
+  }
+
+  assert_equals(entryList.length, 1, options.description);
+  const entry = entryList[0];
+  assert_equals(entry.entryType, 'resource', options.description);
+
+  // workerStart is recorded between startTime and fetchStart.
+  assert_greater_than(entry.workerStart, 0, options.description);
+  assert_greater_than_equal(entry.workerStart, entry.startTime, options.description);
+  assert_less_than_equal(entry.workerStart, entry.fetchStart, options.description);
+
+  if (options.mode === 'cross-origin') {
+    assert_equals(entry.responseStart, 0, options.description);
+    assert_greater_than_equal(entry.responseEnd, entry.fetchStart, options.description);
+  } else {
+    assert_greater_than_equal(entry.responseStart, entry.fetchStart, options.description);
+    assert_greater_than_equal(entry.responseEnd, entry.responseStart, options.description);
+  }
+
+  // responseEnd follows fetchStart.
+  assert_greater_than(entry.responseEnd, entry.fetchStart, options.description);
+  // duration always has some value.
+  assert_greater_than(entry.duration, 0, options.description);
+
+  if (options.resource.indexOf('redirect.py') != -1) {
+    assert_less_than_equal(entry.workerStart, entry.redirectStart,
+      options.description);
+  } else {
+    assert_equals(entry.redirectStart, 0, options.description);
+  }
+}
+
+promise_test(async (t) => {
+  const worker_url = 'resources/resource-timing-worker.js';
+  const scope = 'resources/resource-timing-iframe.sub.html';
+
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  const performance = frame.contentWindow.performance;
+  verify({
+    performance: performance,
+    resource: 'resources/sample.js',
+    mode: 'same-origin',
+    description: 'Generated response',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/empty.js',
+    mode: 'same-origin',
+    description: 'Network fallback',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/redirect.py?Redirect=empty.js',
+    mode: 'same-origin',
+    description: 'Redirect',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/square.png',
+    mode: 'same-origin',
+    description: 'Network fallback image',
+  });
+  // Test that worker start is available on cross-origin no-cors
+  // subresources.
+  verify({
+    performance: performance,
+    resource: 'resources/square.png',
+    mode: 'cross-origin',
+    description: 'Network fallback cross-origin image',
+  });
+
+  // Tests for resouces which failed to load.
+  verify({
+    performance: performance,
+    resource: 'resources/missing.jpg',
+    mode: 'same-origin',
+    description: 'Network fallback load failure',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/missing.asis',  // ORB-compatible 404 response.
+    mode: 'cross-origin',
+    description: 'Network fallback cross-origin load failure (404 response)',
+  });
+  // Tests for respondWith(fetch()).
+  verify({
+    performance: performance,
+    resource: 'resources/missing.jpg?SWRespondsWithFetch',
+    mode: 'same-origin',
+    description: 'Resource in iframe, nonexistent but responded with fetch to another.',
+  });
+  verify({
+    performance: performance,
+    resource: 'resources/sample.txt?SWFetched',
+    mode: 'same-origin',
+    description: 'Resource fetched as response from missing.jpg?SWRespondsWithFetch.',
+    should_no_performance_entry: true,
+  });
+  // Test for a normal resource that is unaffected by the Service Worker.
+  verify({
+    performance: performance,
+    resource: 'resources/empty-worker.js',
+    mode: 'same-origin',
+    description: 'Resource untouched by the Service Worker.',
+  });
+}, 'Controlled resource loads');
+
+test(() => {
+  const url = resourceUrl('resources/test-helpers.sub.js');
+  const entry = window.performance.getEntriesByName(url, 'resource')[0];
+  assert_equals(entry.workerStart, 0, 'Non-controlled');
+}, 'Non-controlled resource loads');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-dynamic-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-dynamic-nested-frame.html
new file mode 100644
index 000000000000..1e0c6209bfc0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-dynamic-nested-frame.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+
+// dynamically add an about:blank iframe
+var f = document.createElement('iframe');
+f.onload = nestedLoaded;
+document.body.appendChild(f);
+
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return f.contentWindow;
+}
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-nested-frame.html
new file mode 100644
index 000000000000..16f7e7c60ffa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-blank-nested-frame.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return document.getElementById('nested').contentWindow;
+}
+
+// NOTE: Make sure not to touch the iframe directly here.  We want to
+//       test the case where the initial about:blank document is not
+//       directly accessed before load.
+</script>
+<iframe id="nested" onload="nestedLoaded()"></iframe>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-srcdoc-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-srcdoc-nested-frame.html
new file mode 100644
index 000000000000..0122a00aa432
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-srcdoc-nested-frame.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+</script>
+<iframe id="nested" srcdoc="<div></div>" onload="nestedLoaded()"></iframe>
+<script>
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return document.getElementById('nested').contentWindow;
+}
+
+// NOTE: Make sure not to touch the iframe directly here.  We want to
+//       test the case where the initial about:blank document is not
+//       directly accessed before load.
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-uncontrolled-nested-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-uncontrolled-nested-frame.html
new file mode 100644
index 000000000000..89509159a410
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-uncontrolled-nested-frame.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<body>
+<script>
+function nestedLoaded() {
+  parent.postMessage({ type: 'NESTED_LOADED' }, '*');
+}
+</script>
+<iframe src="empty.html?nested=true" id="nested" onload="nestedLoaded()"></iframe>
+<script>
+// Helper routine to make it slightly easier for our parent to find
+// the nested frame.
+function nested() {
+  return document.getElementById('nested').contentWindow;
+}
+
+// NOTE: Make sure not to touch the iframe directly here.  We want to
+//       test the case where the initial about:blank document is not
+//       directly accessed before load.
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-worker.js
new file mode 100644
index 000000000000..f43598e41c1a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/about-blank-replacement-worker.js
@@ -0,0 +1,95 @@
+// Helper routine to find a client that matches a particular URL.  Note, we
+// require that Client to be controlled to avoid false matches with other
+// about:blank windows the browser might have.  The initial about:blank should
+// inherit the controller from its parent.
+async function getClientByURL(url) {
+  let list = await clients.matchAll();
+  return list.find(client => client.url === url);
+}
+
+// Helper routine to perform a ping-pong with the given target client.  We
+// expect the Client to respond with its location URL.
+async function pingPong(target) {
+  function waitForPong() {
+    return new Promise(resolve => {
+      self.addEventListener('message', function onMessage(evt) {
+        if (evt.data.type === 'PONG') {
+          resolve(evt.data.location);
+        }
+      });
+    });
+  }
+
+  target.postMessage({ type: 'PING' })
+  return await waitForPong(target);
+}
+
+addEventListener('fetch', async evt => {
+  let url = new URL(evt.request.url);
+  if (!url.searchParams.get('nested')) {
+    return;
+  }
+
+  evt.respondWith(async function() {
+    // Find the initial about:blank document.
+    const client = await getClientByURL('about:blank');
+    if (!client) {
+      return new Response('failure: could not find about:blank client');
+    }
+
+    // If the nested frame is configured to support a ping-pong, then
+    // ping it now to verify its message listener exists.  We also
+    // verify the Client's idea of its own location URL while we are doing
+    // this.
+    if (url.searchParams.get('ping')) {
+      const loc = await pingPong(client);
+      if (loc !== 'about:blank') {
+        return new Response(`failure: got location {$loc}, expected about:blank`);
+      }
+    }
+
+    // Finally, allow the nested frame to complete loading.  We place the
+    // Client ID we found for the initial about:blank in the body.
+    return new Response(client.id);
+  }());
+});
+
+addEventListener('message', evt => {
+  if (evt.data.type !== 'GET_CLIENT_ID') {
+    return;
+  }
+
+  evt.waitUntil(async function() {
+    let url = new URL(evt.data.url);
+
+    // Find the given Client by its URL.
+    let client = await getClientByURL(evt.data.url);
+    if (!client) {
+      evt.source.postMessage({
+        type: 'GET_CLIENT_ID',
+        result: `failure: could not find ${evt.data.url} client`
+      });
+      return;
+    }
+
+    // If the Client supports a ping-pong, then do it now to verify
+    // the message listener exists and its location matches the
+    // Client object.
+    if (url.searchParams.get('ping')) {
+      let loc = await pingPong(client);
+      if (loc !== evt.data.url) {
+        evt.source.postMessage({
+          type: 'GET_CLIENT_ID',
+          result: `failure: got location ${loc}, expected ${evt.data.url}`
+        });
+        return;
+      }
+    }
+
+    // Finally, send the client ID back.
+    evt.source.postMessage({
+      type: 'GET_CLIENT_ID',
+      result: client.id
+    });
+  }());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/add-routes.js b/test/fixtures/wpt/service-workers/service-worker/resources/add-routes.js
new file mode 100644
index 000000000000..796acd19c12f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/add-routes.js
@@ -0,0 +1,37 @@
+let globalAddRoutes;
+let addRoutesError = {};
+
+self.addEventListener('install', event => {
+  globalAddRoutes = event.addRoutes.bind(event);
+  globalAddRoutes([
+    {
+      condition: { urlPattern: '/', runningStatus: 'not-running' },
+      source: 'network',
+    },
+  ])
+    .then(() => {
+      addRoutesError.install = null;
+  })
+    .catch(error => {
+      addRoutesError.install = error;
+    });
+});
+
+self.addEventListener('activate', event => {
+  globalAddRoutes([
+    {
+      condition: { urlPattern: '/', runningStatus: 'not-running' },
+      source: 'network',
+    },
+  ])
+    .then(() => {
+      addRoutesError.activate = null;
+    })
+    .catch(error => {
+      addRoutesError.activate = error;
+    });
+});
+
+self.addEventListener('message', event => {
+  event.ports[0].postMessage(addRoutesError);
+});
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.html b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.html
new file mode 100644
index 000000000000..f69b8de78256
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>WindowClient ancestorOrigins helper</title>
+<script>
+(async function() {
+  const registration =
+    await navigator.serviceWorker.register("ancestorOrigins.js", { scope: './' });
+
+  const worker =
+    registration.installing || registration.waiting || registration.active;
+
+  if (!worker) {
+    throw new Error("No service worker on registration");
+  }
+
+  if (worker.state !== "activated") {
+    await new Promise(resolve => {
+      worker.addEventListener("statechange", () => {
+        if (worker.state === "activated") {
+          resolve();
+        }
+      });
+    });
+  }
+
+  async function gimmeAncestorOrigins() {
+    worker.postMessage("gimme!");
+    const msgEvt = await new Promise(resolve => {
+      navigator.serviceWorker.addEventListener("message", resolve, { once: true });
+    });
+    return msgEvt.data;
+  }
+
+  const { ancestorOrigins, sameObject } = await gimmeAncestorOrigins();
+  const locationAO = Array.from(location.ancestorOrigins ?? []);
+
+  await registration.unregister();
+
+  parent.postMessage({ id: window.name, swAO: ancestorOrigins, sameObject, locationAO }, '*');
+})();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.js b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.js
new file mode 100644
index 000000000000..7e4bf018fc4e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/ancestorOrigins.js
@@ -0,0 +1,6 @@
+self.onmessage = (evt) => {
+  evt.source.postMessage({
+    ancestorOrigins: evt.source.ancestorOrigins,
+    sameObject: evt.source.ancestorOrigins === evt.source.ancestorOrigins
+  });
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/basic-module-2.js b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module-2.js
new file mode 100644
index 000000000000..189b1c87fee7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module-2.js
@@ -0,0 +1 @@
+export default 'hello again!';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/basic-module.js b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module.js
new file mode 100644
index 000000000000..789a89bc6308
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/basic-module.js
@@ -0,0 +1 @@
+export default 'hello!';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/blank.html b/test/fixtures/wpt/service-workers/service-worker/resources/blank.html
new file mode 100644
index 000000000000..a3c3a4689a62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/blank.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-blob-url-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-blob-url-worker-fetch-iframe.html
new file mode 100644
index 000000000000..12ae1a87258f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-blob-url-worker-fetch-iframe.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const workerScript =
+  `self.onmessage = async (e) => {
+    const url = new URL(e.data, '${baseLocation}').href;
+    const response = await fetch(url);
+    const text = await response.text();
+    self.postMessage(text);
+  };`;
+const blob = new Blob([workerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function fetch_in_worker(url) {
+  return new Promise((resolve) => {
+    worker.onmessage = (e) => resolve(e.data);
+    worker.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-iframe.html
new file mode 100644
index 000000000000..2fa15db61d9c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-iframe.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<script>
+// An iframe that starts a nested worker. Our parent frame (the test page) calls
+// fetch_in_worker() to ask the nested worker to perform a fetch to see whether
+// it's controlled by a service worker.
+var worker = new Worker('./claim-nested-worker-fetch-parent-worker.js');
+
+function fetch_in_worker(url) {
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-parent-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-parent-worker.js
new file mode 100644
index 000000000000..f5ff7c234b42
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-nested-worker-fetch-parent-worker.js
@@ -0,0 +1,12 @@
+try {
+  var worker = new Worker('./claim-worker-fetch-worker.js');
+
+  self.onmessage = (event) => {
+    worker.postMessage(event.data);
+  }
+  worker.onmessage = (event) => {
+    self.postMessage(event.data);
+  };
+} catch (e) {
+  self.postMessage("Fail: " + e.data);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-iframe.html
new file mode 100644
index 000000000000..ad865b848f8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-iframe.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<script>
+var worker = new SharedWorker('./claim-shared-worker-fetch-worker.js');
+
+function fetch_in_shared_worker(url) {
+  return new Promise((resolve) => {
+    worker.port.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.port.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-worker.js
new file mode 100644
index 000000000000..ddc8bea7af47
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-shared-worker-fetch-worker.js
@@ -0,0 +1,8 @@
+self.onconnect = (event) => {
+  var port = event.ports[0];
+  event.ports[0].onmessage = (evt) => {
+    fetch(evt.data)
+      .then(response => response.text())
+      .then(text => port.postMessage(text));
+  };
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-with-redirect-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-with-redirect-iframe.html
new file mode 100644
index 000000000000..4150d7e68574
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-with-redirect-iframe.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body>
+<script>
+var host_info = get_host_info();
+
+function send_result(result) {
+  window.parent.postMessage({message: result},
+                            host_info['HTTPS_ORIGIN']);
+}
+
+function executeTask(params) {
+  // Execute task for each parameter
+  if (params.has('register')) {
+    var worker_url = decodeURIComponent(params.get('register'));
+    var scope = decodeURIComponent(params.get('scope'));
+    navigator.serviceWorker.register(worker_url, {scope: scope})
+      .then(r => send_result('registered'));
+  } else if (params.has('redirected')) {
+    send_result('redirected');
+  } else if (params.has('update')) {
+    var scope = decodeURIComponent(params.get('update'));
+    navigator.serviceWorker.getRegistration(scope)
+      .then(r => r.update())
+      .then(() => send_result('updated'));
+  } else if (params.has('unregister')) {
+    var scope = decodeURIComponent(params.get('unregister'));
+    navigator.serviceWorker.getRegistration(scope)
+      .then(r => r.unregister())
+      .then(succeeded => {
+          if (succeeded) {
+            send_result('unregistered');
+          } else {
+            send_result('failure: unregister');
+          }
+        });
+  } else {
+    send_result('unknown parameter: ' + params.toString());
+  }
+}
+
+var params = new URLSearchParams(location.search.slice(1));
+executeTask(params);
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-iframe.html
new file mode 100644
index 000000000000..92c5d15def0f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-iframe.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<script>
+var worker = new Worker('./claim-worker-fetch-worker.js');
+
+function fetch_in_worker(url) {
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(url);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-worker.js
new file mode 100644
index 000000000000..7080181c85cb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker-fetch-worker.js
@@ -0,0 +1,5 @@
+self.onmessage = (event) => {
+  fetch(event.data)
+    .then(response => response.text())
+    .then(text => self.postMessage(text));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker.js
new file mode 100644
index 000000000000..18004079475e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/claim-worker.js
@@ -0,0 +1,19 @@
+self.addEventListener('message', function(event) {
+    self.clients.claim()
+      .then(function(result) {
+          if (result !== undefined) {
+              event.data.port.postMessage(
+                  'FAIL: claim() should be resolved with undefined');
+              return;
+          }
+          event.data.port.postMessage('PASS');
+        })
+      .catch(function(error) {
+          event.data.port.postMessage('FAIL: exception: ' + error.name);
+        });
+  });
+
+self.addEventListener('fetch', function(event) {
+    if (!/404/.test(event.request.url))
+      event.respondWith(new Response('Intercepted!'));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/classic-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/classic-worker.js
new file mode 100644
index 000000000000..36a32b1a1f84
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/classic-worker.js
@@ -0,0 +1 @@
+importScripts('./imported-classic-script.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-id-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-id-worker.js
new file mode 100644
index 000000000000..ec71b3458b72
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-id-worker.js
@@ -0,0 +1,27 @@
+self.onmessage = function(e) {
+  var port = e.data.port;
+  var message = [];
+
+  var promise = Promise.resolve()
+    .then(function() {
+        // 1st matchAll()
+        return self.clients.matchAll().then(function(clients) {
+            clients.forEach(function(client) {
+                message.push(client.id);
+              });
+          });
+      })
+    .then(function() {
+        // 2nd matchAll()
+        return self.clients.matchAll().then(function(clients) {
+            clients.forEach(function(client) {
+                message.push(client.id);
+              });
+          });
+      })
+    .then(function() {
+        // Send an array containing ids of clients from 1st and 2nd matchAll()
+        port.postMessage(message);
+      });
+  e.waitUntil(promise);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-frame.html
new file mode 100644
index 000000000000..7e186f8ee798
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-frame.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script>
+  fetch("clientId")
+    .then(function(response) {
+      return response.text();
+    })
+    .then(function(text) {
+      parent.postMessage({id: text}, "*");
+    });
+</script>
+<body style="background-color: red;"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-worker.js
new file mode 100644
index 000000000000..6101d5d8f92c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigate-worker.js
@@ -0,0 +1,92 @@
+importScripts("worker-testharness.js");
+importScripts("test-helpers.sub.js");
+importScripts("/common/get-host-info.sub.js")
+importScripts("testharness-helpers.js")
+
+setup({ explicit_done: true });
+
+self.onfetch = function(e) {
+  if (e.request.url.indexOf("client-navigate-frame.html") >= 0) {
+    return;
+  }
+  e.respondWith(new Response(e.clientId));
+};
+
+function pass(test, url) {
+  return { result: test,
+           url: url };
+}
+
+function fail(test, reason) {
+  return { result: "FAILED " + test + " " + reason }
+}
+
+self.onmessage = function(e) {
+  var port = e.data.port;
+  var test = e.data.test;
+  var clientId = e.data.clientId;
+  var clientUrl = "";
+  if (test === "test_client_navigate_success") {
+    promise_test(function(t) {
+      this.add_cleanup(() => port.postMessage(pass(test, clientUrl)));
+      return self.clients.get(clientId)
+                 .then(client => client.navigate("client-navigated-frame.html"))
+                 .then(client => {
+                   clientUrl = client.url;
+                   assert_true(client instanceof WindowClient);
+                 })
+                 .catch(unreached_rejection(t));
+    }, "Return value should be instance of WindowClient");
+    done();
+  } else if (test === "test_client_navigate_cross_origin") {
+    promise_test(function(t) {
+      this.add_cleanup(() => port.postMessage(pass(test, clientUrl)));
+      var path = new URL('client-navigated-frame.html', self.location.href).pathname;
+      var url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + path;
+      return self.clients.get(clientId)
+                 .then(client => client.navigate(url))
+                 .then(client => {
+                   clientUrl = (client && client.url) || "";
+                   assert_equals(client, null,
+                                 'cross-origin navigate resolves with null');
+                 })
+                 .catch(unreached_rejection(t));
+    }, "Navigating to different origin should resolve with null");
+    done();
+  } else if (test === "test_client_navigate_about_blank") {
+    promise_test(function(t) {
+      this.add_cleanup(function() { port.postMessage(pass(test, "")); });
+      return self.clients.get(clientId)
+                 .then(client => promise_rejects_js(t, TypeError, client.navigate("about:blank")))
+                 .catch(unreached_rejection(t));
+    }, "Navigating to about:blank should reject with TypeError");
+    done();
+  } else if (test === "test_client_navigate_mixed_content") {
+    promise_test(function(t) {
+      this.add_cleanup(function() { port.postMessage(pass(test, "")); });
+      var path = new URL('client-navigated-frame.html', self.location.href).pathname;
+      // Insecure URL should fail since the frame is owned by a secure parent
+      // and navigating to http:// would create a mixed-content violation.
+      var url = get_host_info()['HTTP_REMOTE_ORIGIN'] + path;
+      return self.clients.get(clientId)
+                 .then(client => promise_rejects_js(t, TypeError, client.navigate(url)))
+                 .catch(unreached_rejection(t));
+    }, "Navigating to mixed-content iframe should reject with TypeError");
+    done();
+  } else if (test === "test_client_navigate_redirect") {
+    var host_info = get_host_info();
+    var url = new URL(host_info['HTTPS_REMOTE_ORIGIN']).toString() +
+              new URL("client-navigated-frame.html", location).pathname.substring(1);
+    promise_test(function(t) {
+      this.add_cleanup(() => port.postMessage(pass(test, clientUrl)));
+      return self.clients.get(clientId)
+                 .then(client => client.navigate("redirect.py?Redirect=" + url))
+                 .then(client => {
+                   clientUrl = (client && client.url) || ""
+                   assert_equals(client, null);
+                 })
+                 .catch(unreached_rejection(t));
+    }, "Redirecting to another origin should resolve with null");
+    done();
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-navigated-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigated-frame.html
new file mode 100644
index 000000000000..307f7f9ac6ea
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-navigated-frame.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<body style="background-color: green;"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-iframe.html
new file mode 100644
index 000000000000..db2b9e5bbd91
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-iframe.html
@@ -0,0 +1,85 @@
+<!DOCTYPE html>
+<title>Service Worker: Client.url is Window creation URL iframe resource</title>
+<script>
+// This is the iframe resource for the Client.url Window creation URL test.
+// It supports the test page telling it to navigate in various ways, and then
+// the iframe will post back that its done.
+
+// Turn the next time an event is raised into a promise.
+function wait_for_next_event(event_target, event_name) {
+  return new Promise(resolve => {
+    const event_handler = event => {
+      event_target.removeEventListener(event_name, event_handler);
+      resolve(event);
+    };
+    event_target.addEventListener(event_name, event_handler);
+  });
+}
+
+// Perform the navigation step sent to the iframe by the test page.
+async function perform_navigation(navigation_kind) {
+  // This is true if the navigation results in a new document instance.
+  // For example, history.pushState() doesn't create a new document, but
+  // navigating to a URL with a different query does. We need to keep
+  // track of this so we can post a message back to the test page when the
+  // navigation completes without loading a new document.
+  let cross_document_navigation = false;
+
+  const query_params = new URLSearchParams(location.search.substring(1));
+  const step = parseInt(query_params.get('step'), 10);
+
+  const next_url = `?step=${step + 1}`;
+
+  if (navigation_kind === 'pushstate') {
+    history.pushState({}, '', next_url);
+  } else if (navigation_kind === 'replacestate') {
+    history.replaceState({}, '', next_url);
+  } else if (navigation_kind === 'back-within-same-document') {
+    history.back();
+  } else if (navigation_kind === 'fragment') {
+    location.href = '#fragment';
+    await wait_for_next_event(window, 'hashchange');
+  } else if (navigation_kind === 'back-cross-document') {
+    // Note there are two back navigation_kinds. Both call history.back(),
+    // but 'back-cross-document' is for when we go back to a different
+    // document instance and the new document will postMessage the parent
+    // that the navigation is done, and and 'back-within-same-document' is for
+    // when we go back but remain in the same document and so need to
+    // postMessage the parent that the navigation is done from this document.
+    history.back();
+    cross_document_navigation = true;
+  } else if (navigation_kind === 'query') {
+    location.href = next_url;
+    cross_document_navigation = true;
+  } else if (navigation_kind === 'reload') {
+    location.reload();
+    cross_document_navigation = true;
+  } else {
+    throw new Error('Unknown navigation kind: ' + navigation_kind);
+  }
+  return cross_document_navigation;
+}
+
+window.addEventListener('message', async message_event => {
+  try {
+    const navigation_kind = message_event.data;
+
+    // If its a cross document navigation, then we need to send the done
+    // message back to the test page when the navigation has started the
+    // new document.
+    const cross_document_navigation = await perform_navigation(navigation_kind);
+    if (!cross_document_navigation ) {
+      window.parent.postMessage('done');
+    }
+  } catch (error) {
+    window.parent.postMessage('error: ' + error.message);
+  }
+});
+
+// Navigation steps either result in a new document instance or not. The
+// iframe needs to post a message back to the test page when the navigation
+// completes regardless. If the navigation does create a new document, then
+// the following postMessage informs the test page that the cross document
+// navigation has completed.
+window.parent.postMessage('done');
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-sw.js
new file mode 100644
index 000000000000..013d9be4caeb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-creation-url-sw.js
@@ -0,0 +1,24 @@
+// This is a service worker script used by the client-url-creation-url test.
+// It exists only to look up the client URL of the test iframe and send it back
+// to the test page.
+addEventListener('message', message_event => {
+  const port = message_event.data.port;
+
+  const async_work = async () => {
+    try {
+      const clients = await self.clients.matchAll();
+
+      // In our test there should be exactly one client that is our test
+      // navigation iframe.
+      if (clients.length == 1) {
+        const client = clients[0];
+        port.postMessage(client.url);
+      } else {
+        port.postMessage(`error: expected 1 client, not ${clients.length}`);
+      }
+    } catch (error) {
+      port.postMessage(`error: ${error.message}`);
+    }
+  };
+  message_event.waitUntil(async_work());
+});
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.html
new file mode 100644
index 000000000000..00f6acede8eb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+// Return a URL of a client when it's successful.
+function createAndFetchFromBlobWorker() {
+  const fetchURL = new URL('get-worker-client-url.txt', window.location).href;
+  const workerScript =
+    `self.onmessage = async (e) => {
+      const response = await fetch(e.data.url);
+      const text = await response.text();
+      self.postMessage({"result": text, "expected": self.location.href});
+    };`;
+  const blob = new Blob([workerScript], { type: 'text/javascript' });
+  const blobUrl = URL.createObjectURL(blob);
+
+  const worker = new Worker(blobUrl);
+  return new Promise((resolve, reject) => {
+    worker.onmessage = e => resolve(e.data);
+    worker.onerror = e => reject(e.message);
+    worker.postMessage({"url": fetchURL});
+  });
+}
+
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.js
new file mode 100644
index 000000000000..fd754f8250da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/client-url-of-blob-url-worker.js
@@ -0,0 +1,10 @@
+addEventListener('fetch', e => {
+  if (e.request.url.includes('get-worker-client-url')) {
+    e.respondWith((async () => {
+      const clients = await self.clients.matchAll({type: 'worker'});
+      if (clients.length != 1)
+        return new Response('one worker client should exist');
+      return new Response(clients[0].url);
+    })());
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-frame-freeze.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-frame-freeze.html
new file mode 100644
index 000000000000..7468a660e908
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-frame-freeze.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script>
+  document.addEventListener('freeze', () => {
+      opener.postMessage('frozen', "*");
+  });
+
+  window.onmessage = (e) => {
+    if (e.data == 'freeze') {
+      test_driver.freeze();
+    }
+  };
+  opener.postMessage('loaded', '*');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame-worker.js
new file mode 100644
index 000000000000..0a1461b40e08
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame-worker.js
@@ -0,0 +1,11 @@
+onmessage = function(e) {
+  if (e.data.cmd == 'GetClientId') {
+    fetch('clientId')
+        .then(function(response) {
+          return response.text();
+        })
+        .then(function(text) {
+          e.data.port.postMessage({clientId: text});
+        });
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame.html
new file mode 100644
index 000000000000..4324e6d4054f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-frame.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<script>
+fetch('clientId')
+  .then(function(response) {
+      return response.text();
+    })
+  .then(function(text) {
+      parent.postMessage({clientId: text}, '*');
+    });
+
+onmessage = function(e) {
+  if (e.data == 'StartWorker') {
+    var w = new Worker('clients-get-client-types-frame-worker.js');
+    w.postMessage({cmd:'GetClientId', port:e.ports[0]}, [e.ports[0]]);
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-shared-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-shared-worker.js
new file mode 100644
index 000000000000..fadef970374b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-shared-worker.js
@@ -0,0 +1,10 @@
+onconnect = function(e) {
+  var port = e.ports[0];
+  fetch('clientId')
+    .then(function(response) {
+        return response.text();
+      })
+    .then(function(text) {
+        port.postMessage({clientId: text});
+      });
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-worker.js
new file mode 100644
index 000000000000..0a1461b40e08
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-client-types-worker.js
@@ -0,0 +1,11 @@
+onmessage = function(e) {
+  if (e.data.cmd == 'GetClientId') {
+    fetch('clientId')
+        .then(function(response) {
+          return response.text();
+        })
+        .then(function(text) {
+          e.data.port.postMessage({clientId: text});
+        });
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-cross-origin-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-cross-origin-frame.html
new file mode 100644
index 000000000000..e16bb1116dc8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-cross-origin-frame.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+var scope = 'blank.html?clients-get';
+var script = 'clients-get-worker.js';
+
+var registration;
+var worker;
+var wait_for_worker_promise = navigator.serviceWorker.getRegistration(scope)
+  .then(function(reg) {
+      if (reg)
+        return reg.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(script, {scope: scope});
+    })
+  .then(function(reg) {
+      registration = reg;
+      worker = reg.installing;
+      return new Promise(function(resolve) {
+          worker.addEventListener('statechange', function() {
+              if (worker.state == 'activated')
+                resolve();
+            });
+        });
+    });
+
+window.addEventListener('message', function(e) {
+  var cross_origin_client_ids = [];
+  cross_origin_client_ids.push(e.data.clientId);
+  wait_for_worker_promise
+    .then(function() {
+        return with_iframe(scope);
+      })
+    .then(function(iframe) {
+        add_completion_callback(function() { iframe.remove(); });
+        navigator.serviceWorker.onmessage = function(e) {
+          registration.unregister();
+          window.parent.postMessage(
+            { type: 'clientId', value: e.data }, host_info['HTTPS_ORIGIN']
+          );
+        };
+        registration.active.postMessage({clientIds: cross_origin_client_ids});
+      });
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-frame.html
new file mode 100644
index 000000000000..27143d4b99b0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-frame.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<script>
+
+  fetch("clientId")
+    .then(function(response) {
+        return response.text();
+      })
+    .then(function(text) {
+        parent.postMessage({clientId: text}, "*");
+      });
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-other-origin.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-other-origin.html
new file mode 100644
index 000000000000..6342fe04f404
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-other-origin.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+var SCOPE = 'blank.html?clients-get';
+var SCRIPT = 'clients-get-worker.js';
+
+var registration;
+var worker;
+var wait_for_worker_promise = navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(reg) {
+      if (reg)
+        return reg.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+    })
+  .then(function(reg) {
+      registration = reg;
+      worker = reg.installing;
+      return new Promise(function(resolve) {
+          worker.addEventListener('statechange', function() {
+              if (worker.state == 'activated')
+                resolve();
+            });
+        });
+    });
+
+function send_result(result) {
+  window.parent.postMessage(
+      {result: result},
+      host_info['HTTPS_ORIGIN']);
+}
+
+window.addEventListener("message", on_message, false);
+
+function on_message(e) {
+  if (e.origin != host_info['HTTPS_ORIGIN']) {
+    console.error('invalid origin: ' + e.origin);
+    return;
+  }
+  if (e.data.message == 'get_client_id') {
+    var otherOriginClientId = e.data.clientId;
+    wait_for_worker_promise
+      .then(function() {
+          return with_iframe(SCOPE);
+        })
+      .then(function(iframe) {
+          var channel = new MessageChannel();
+          channel.port1.onmessage = function(e) {
+            navigator.serviceWorker.getRegistration(SCOPE)
+              .then(function(reg) {
+                  reg.unregister();
+                  send_result(e.data);
+                });
+          };
+          iframe.contentWindow.navigator.serviceWorker.controller.postMessage(
+              {port:channel.port2, clientId: otherOriginClientId,
+               message: 'get_other_client_id'}, [channel.port2]);
+        })
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-resultingClientId-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-resultingClientId-worker.js
new file mode 100644
index 000000000000..5a46ff9cf440
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-resultingClientId-worker.js
@@ -0,0 +1,60 @@
+let savedPort = null;
+let savedResultingClientId = null;
+
+async function getTestingPage() {
+  const clientList = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+  for (let c of clientList) {
+    if (c.url.endsWith('clients-get.https.html')) {
+      c.focus();
+      return c;
+    }
+  }
+  return null;
+}
+
+async function destroyResultingClient(testingPage) {
+  const destroyedPromise = new Promise(resolve => {
+    self.addEventListener('message', e => {
+      if (e.data.msg == 'resultingClientDestroyed') {
+        resolve();
+      }
+    }, {once: true});
+  });
+  testingPage.postMessage({ msg: 'destroyResultingClient' });
+  return destroyedPromise;
+}
+
+self.addEventListener('fetch', async (e) => {
+  let { resultingClientId } = e;
+  savedResultingClientId = resultingClientId;
+
+  if (e.request.url.endsWith('simple.html?fail')) {
+    e.waitUntil((async () => {
+      const testingPage = await getTestingPage();
+      await destroyResultingClient(testingPage);
+      testingPage.postMessage({ msg: 'resultingClientDestroyedAck',
+                                resultingDestroyedClientId: savedResultingClientId });
+    })());
+    return;
+  }
+
+  e.respondWith(fetch(e.request));
+});
+
+self.addEventListener('message', (e) => {
+  let { msg, resultingClientId } = e.data;
+  e.waitUntil((async () => {
+    if (msg == 'getIsResultingClientUndefined') {
+      const client = await self.clients.get(resultingClientId);
+      let isUndefined = typeof client == 'undefined';
+      e.source.postMessage({ msg: 'getIsResultingClientUndefined',
+        isResultingClientUndefined: isUndefined });
+      return;
+    }
+    if (msg == 'getResultingClientId') {
+      e.source.postMessage({ msg: 'getResultingClientId',
+                             resultingClientId: savedResultingClientId });
+      return;
+    }
+  })());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-worker.js
new file mode 100644
index 000000000000..8effa56c98c9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-get-worker.js
@@ -0,0 +1,41 @@
+// This worker is designed to expose information about clients that is only available from Service Worker contexts.
+//
+// In the case of the `onfetch` handler, it provides the `clientId` property of
+// the `event` object. In the case of the `onmessage` handler, it provides the
+// Client instance attributes of the requested clients.
+self.onfetch = function(e) {
+  if (/\/clientId$/.test(e.request.url)) {
+    e.respondWith(new Response(e.clientId));
+    return;
+  }
+};
+
+self.onmessage = function(e) {
+  var client_ids = e.data.clientIds;
+  var message = [];
+
+  e.waitUntil(Promise.all(
+      client_ids.map(function(client_id) {
+          return self.clients.get(client_id);
+        }))
+      .then(function(clients) {
+          // No matching client for a given id or a matched client is off-origin
+          // from the service worker.
+          if (clients.length == 1 && clients[0] == undefined) {
+            e.source.postMessage(clients[0]);
+          } else {
+            clients.forEach(function(client) {
+                if (client instanceof Client) {
+                  message.push([client.visibilityState,
+                                client.focused,
+                                client.url,
+                                client.type,
+                                client.frameType]);
+                } else {
+                  message.push(client);
+                }
+              });
+            e.source.postMessage(message);
+          }
+        }));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-blob-url-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-blob-url-worker.html
new file mode 100644
index 000000000000..ee89a0d8b3ee
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-blob-url-worker.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<script>
+const workerScript = `
+  self.onmessage = (e) => {
+    self.postMessage("Worker is ready.");
+  };
+`;
+const blob = new Blob([workerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function waitForWorker() {
+  return new Promise(resolve => {
+    worker.onmessage = resolve;
+    worker.postMessage("Ping to worker.");
+  });
+}
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-dedicated-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-dedicated-worker.js
new file mode 100644
index 000000000000..5a3f04d33aaa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-dedicated-worker.js
@@ -0,0 +1,3 @@
+onmessage = function(e) {
+  postMessage(e.data);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html
new file mode 100644
index 000000000000..7607b035de31
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
+<!--
+  Change the page URL using the History API to ensure that ServiceWorkerClient
+  uses the creation URL.
+-->
+<body onload="history.pushState({}, 'title', 'url-modified-via-pushstate.html')">
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-shared-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-shared-worker.js
new file mode 100644
index 000000000000..1ae72fb89445
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-client-types-shared-worker.js
@@ -0,0 +1,4 @@
+onconnect = function(e) {
+  var port = e.ports[0];
+  port.postMessage('started');
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-on-evaluation-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-on-evaluation-worker.js
new file mode 100644
index 000000000000..f1559aca39b6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-on-evaluation-worker.js
@@ -0,0 +1,11 @@
+importScripts('test-helpers.sub.js');
+
+var page_url = normalizeURL('../clients-matchall-on-evaluation.https.html');
+
+self.clients.matchAll({includeUncontrolled: true})
+  .then(function(clients) {
+      clients.forEach(function(client) {
+          if (client.url == page_url)
+            client.postMessage('matched');
+        });
+    });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-worker.js
new file mode 100644
index 000000000000..13e111a2f914
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/clients-matchall-worker.js
@@ -0,0 +1,40 @@
+self.onmessage = function(e) {
+  var port = e.data.port;
+  var options = e.data.options;
+
+  e.waitUntil(self.clients.matchAll(options)
+    .then(function(clients) {
+        var message = [];
+        clients.forEach(function(client) {
+            var frame_type = client.frameType;
+            if (client.url.indexOf('clients-matchall-include-uncontrolled.https.html') > -1 &&
+                client.frameType == 'auxiliary') {
+              // The test tab might be opened using window.open() by the test framework.
+              // In that case, just pretend it's top-level!
+              frame_type = 'top-level';
+            }
+            if (e.data.includeLifecycleState) {
+              message.push({visibilityState: client.visibilityState,
+                            focused: client.focused,
+                            url: client.url,
+                            lifecycleState: client.lifecycleState,
+                            type: client.type,
+                            frameType: frame_type});
+            } else {
+              message.push([client.visibilityState,
+                            client.focused,
+                            client.url,
+                            client.type,
+                            frame_type]);
+            }
+          });
+        // Sort by url
+        if (!e.data.disableSort) {
+          message.sort(function(a, b) { return a[2] > b[2] ? 1 : -1; });
+        }
+        port.postMessage(message);
+      })
+    .catch(e => {
+        port.postMessage('clients.matchAll() rejected: ' + e);
+      }));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/controlled-frame-postMessage.html b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-frame-postMessage.html
new file mode 100644
index 000000000000..c4428e88a3da
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-frame-postMessage.html
@@ -0,0 +1,39 @@
+<html>
+<body>
+<script>
+var messageData;
+function registerMessage()
+{
+    navigator.serviceWorker.onmessage = (e) => {
+        if (window.messageData === undefined)
+            window.messageData = e.data;
+    }
+}
+
+function listenToMessages()
+{
+    messageData = [];
+    setTimeout(() => {
+        navigator.serviceWorker.addEventListener("message", (e) => {
+            messageData.push(e.data);
+        }, { once:true });
+    }, 500);
+    setTimeout(() => {
+        navigator.serviceWorker.onmessage = (e) => {
+            messageData.push(e.data);
+        };
+    }, 1000);
+}
+
+if (window.location.search === "?repeatMessages") {
+    setTimeout(() => {
+        registerMessage();
+    }, 500);
+} else if (window.location.search.includes("listener")) {
+    listenToMessages();
+} else {
+    registerMessage();
+}
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-late-postMessage.js b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-late-postMessage.js
new file mode 100644
index 000000000000..41d2db43b1fe
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-late-postMessage.js
@@ -0,0 +1,6 @@
+setTimeout(() => {
+    navigator.serviceWorker.onmessage = e => self.postMessage(e.data);
+}, 500);
+setTimeout(() => {
+    self.postMessage("No message received");
+}, 5000);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-postMessage.js b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-postMessage.js
new file mode 100644
index 000000000000..628dc65db11c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/controlled-worker-postMessage.js
@@ -0,0 +1,4 @@
+navigator.serviceWorker.onmessage = e => self.postMessage(e.data);
+setTimeout(() => {
+    self.postMessage("No message received");
+}, 5000);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt
new file mode 100644
index 000000000000..1cd89bb14d60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt
@@ -0,0 +1 @@
+plaintext
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt.headers b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt.headers
new file mode 100644
index 000000000000..f7985fd9bd52
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/cors-approved.txt.headers
@@ -0,0 +1,3 @@
+Content-Type: text/plain
+Access-Control-Allow-Origin: *
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/cors-denied.txt b/test/fixtures/wpt/service-workers/service-worker/resources/cors-denied.txt
new file mode 100644
index 000000000000..ff333bd97da4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/cors-denied.txt
@@ -0,0 +1,2 @@
+this file is served without Access-Control-Allow-Origin headers so it should not
+be readable from cross-origin.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/create-blob-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/create-blob-url-worker.js
new file mode 100644
index 000000000000..57e4882c24f7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/create-blob-url-worker.js
@@ -0,0 +1,22 @@
+const childWorkerScript = `
+  self.onmessage = async (e) => {
+    const response = await fetch(e.data);
+    const text = await response.text();
+    self.postMessage(text);
+  };
+`;
+const blob = new Blob([childWorkerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const childWorker = new Worker(blobUrl);
+
+// When a message comes from the parent frame, sends a resource url to the child
+// worker.
+self.onmessage = (e) => {
+  childWorker.postMessage(e.data);
+};
+
+// When a message comes from the child worker, sends a content of fetch() to the
+// parent frame.
+childWorker.onmessage = (e) => {
+  self.postMessage(e.data);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/create-out-of-scope-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/create-out-of-scope-worker.html
new file mode 100644
index 000000000000..b51c45175094
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/create-out-of-scope-worker.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<script>
+const workerUrl = '../out-of-scope/sample-synthesized-worker.js?dedicated';
+const worker = new Worker(workerUrl);
+const workerPromise = new Promise(resolve => {
+  worker.onmessage = e => {
+    // `e.data` is 'worker loading intercepted by service worker' when a worker
+    // is intercepted by a service worker.
+    resolve(e.data);
+  }
+  worker.onerror = _ => {
+    resolve('worker loading was not intercepted by service worker');
+  }
+});
+
+function getWorkerPromise() {
+  return workerPromise;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-iframe.sub.html b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-iframe.sub.html
new file mode 100644
index 000000000000..67e86e1ce6c3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-iframe.sub.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe: cross-origin CSS request, service worker substitutes a same-origin response</title>
+<!-- Cross-origin stylesheet request. The controlling service worker intercepts
+     it and responds with a fetch() of a same-origin stylesheet, so the content
+     is same-origin and cssRules must be readable. -->
+<link rel="stylesheet" type="text/css"
+      href="{{location[scheme]}}://{{hosts[alt][]}}:{{location[port]}}/service-workers/service-worker/resources/css-sw-substitute-marker.css">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-worker.js
new file mode 100644
index 000000000000..eab5c9ff268b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/css-sw-same-origin-substitution-worker.js
@@ -0,0 +1,14 @@
+importScripts('test-helpers.sub.js');
+
+const BASE_PATH = base_path();
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  // The iframe requests this cross-origin stylesheet; substitute a same-origin
+  // response (a real same-origin fetch => a cross-origin -> same-origin internal
+  // redirect on the page's channel).
+  if (url.pathname.endsWith('/css-sw-substitute-marker.css')) {
+    event.respondWith(fetch(
+        BASE_PATH + 'fetch-request-css-cross-origin-mime-check-same.css'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.css b/test/fixtures/wpt/service-workers/service-worker/resources/direct.css
new file mode 100644
index 000000000000..c812213f5307
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.css
@@ -0,0 +1,3 @@
+body {
+  width: 100%;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.html b/test/fixtures/wpt/service-workers/service-worker/resources/direct.html
new file mode 100644
index 000000000000..e98d70207afa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<title>Direct</title>
+<body>
+  Here's a direct html from network.
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.js b/test/fixtures/wpt/service-workers/service-worker/resources/direct.js
new file mode 100644
index 000000000000..ed6f0e5f980a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.js
@@ -0,0 +1 @@
+window.router_condition_request_destination_script = true;
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/direct.txt b/test/fixtures/wpt/service-workers/service-worker/resources/direct.txt
new file mode 100644
index 000000000000..f3d9861c137b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/direct.txt
@@ -0,0 +1 @@
+Network
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/echo-message-to-source-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/echo-message-to-source-worker.js
new file mode 100644
index 000000000000..bbbd35fb4f60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/echo-message-to-source-worker.js
@@ -0,0 +1,3 @@
+addEventListener('message', evt => {
+  evt.source.postMessage(evt.data);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-and-object-are-not-intercepted-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/embed-and-object-are-not-intercepted-worker.js
new file mode 100644
index 000000000000..ffcdb7512888
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-and-object-are-not-intercepted-worker.js
@@ -0,0 +1,14 @@
+// This worker intercepts a request for EMBED/OBJECT and responds with a
+// response that indicates that interception occurred. The tests expect
+// that interception does not occur.
+self.addEventListener('fetch', e => {
+    if (e.request.url.indexOf('embedded-content-from-server.html') != -1) {
+      e.respondWith(fetch('embedded-content-from-service-worker.html'));
+      return;
+    }
+
+    if (e.request.url.indexOf('green.png') != -1) {
+      e.respondWith(Promise.reject('network error to show interception occurred'));
+      return;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-image-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/embed-image-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..7b8b257203a2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-image-is-not-intercepted-iframe.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<embed type="image/png" src="/images/green.png"></embed>
+<script>
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    if (!navigator.serviceWorker.controller)
+      resolve('FAIL: this iframe is not controlled');
+
+    const elem = document.querySelector('embed');
+    elem.addEventListener('load', e => {
+        resolve('request was not intercepted');
+      });
+    elem.addEventListener('error', e => {
+        resolve('FAIL: request was intercepted');
+      });
+  });
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/embed-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..39149915cc57
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-is-not-intercepted-iframe.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The EMBED element will call this with the result about whether the EMBED
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+</script>
+
+<embed src="embedded-content-from-server.html"></embed>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embed-navigation-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/embed-navigation-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..5e86f67735f7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embed-navigation-is-not-intercepted-iframe.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The EMBED element will call this with the result about whether the EMBED
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+
+let el = document.createElement('embed');
+el.src = "/common/blank.html";
+el.addEventListener('load', _ => {
+  window[0].location = "/service-workers/service-worker/resources/embedded-content-from-server.html";
+}, { once: true });
+document.body.appendChild(el);
+</script>
+
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-server.html b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-server.html
new file mode 100644
index 000000000000..ff50a9c75269
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-server.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>embed for embed-and-object-are-not-intercepted test</title>
+<script>
+window.parent.report_result('request for embedded content was not intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-service-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-service-worker.html
new file mode 100644
index 000000000000..2e2b9236082d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/embedded-content-from-service-worker.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>embed for embed-and-object-are-not-intercepted test</title>
+<script>
+window.parent.report_result('request for embedded content was intercepted by service worker');
+</script>
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty-but-slow-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty-but-slow-worker.js
new file mode 100644
index 000000000000..92abac7a384d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/empty-but-slow-worker.js
@@ -0,0 +1,8 @@
+addEventListener('fetch', evt => {
+  if (evt.request.url.endsWith('slow')) {
+    // Performance.now() might be a bit better here, but Date.now() has
+    // better compat in workers right now.
+    let start = Date.now();
+    while(Date.now() - start < 2000);
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty-worker.js
new file mode 100644
index 000000000000..49ceb2648a93
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/empty-worker.js
@@ -0,0 +1 @@
+// Do nothing.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty.h2.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty.h2.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty.html b/test/fixtures/wpt/service-workers/service-worker/resources/empty.html
new file mode 100644
index 000000000000..6feb11946b80
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/empty.html
@@ -0,0 +1,6 @@
+<!doctype html>
+<html>
+<body>
+hello world
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/empty.js b/test/fixtures/wpt/service-workers/service-worker/resources/empty.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/enable-client-message-queue.html b/test/fixtures/wpt/service-workers/service-worker/resources/enable-client-message-queue.html
new file mode 100644
index 000000000000..512bd14bc67d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/enable-client-message-queue.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<script>
+  // The state variable is used by handle_message to record the time
+  // at which a message was handled. It's updated by the scripts
+  // loaded by the <script> tags at the bottom of the file as well as
+  // by the event listener added here.
+  var state = 'init';
+  addEventListener('DOMContentLoaded', () => state = 'loaded');
+
+  // We expect to get three ping messages from the service worker.
+  const expected = ['init', 'install', 'start'];
+  let promises = {};
+  let resolvers = {};
+  expected.forEach(name => {
+    promises[name] = new Promise(resolve => resolvers[name] = resolve);
+  });
+
+  // Once all messages have been dispatched, the state in which each
+  // of them was dispatched is recorded in the draft. At that point
+  // the draft becomes the final report.
+  var draft = {};
+  var report = Promise.all(Object.values(promises)).then(() => window.draft);
+
+  // This message handler is installed by the 'install' script.
+  function handle_message(event) {
+    const data = event.data.data;
+    draft[data] = state;
+    resolvers[data]();
+  }
+</script>
+
+<!--
+  The controlling service worker will delay the response to these
+  fetch requests until the test instructs it how to reply. Note that
+  the event loop keeps spinning while the parser is blocked.
+-->
+<script src="empty.js?key=install"></script>
+<script src="empty.js?key=start"></script>
+<script src="empty.js?key=finish"></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/end-to-end-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/end-to-end-worker.js
new file mode 100644
index 000000000000..d45a50556a93
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/end-to-end-worker.js
@@ -0,0 +1,7 @@
+onmessage = function(e) {
+  var message = e.data;
+  if (typeof message === 'object' && 'port' in message) {
+    var response = 'Ack for: ' + message.from;
+    message.port.postMessage(response);
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/events-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/events-worker.js
new file mode 100644
index 000000000000..80a2188677ba
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/events-worker.js
@@ -0,0 +1,12 @@
+var eventsSeen = [];
+
+function handler(event) { eventsSeen.push(event.type); }
+
+['activate', 'install'].forEach(function(type) {
+    self.addEventListener(type, handler);
+  });
+
+onmessage = function(e) {
+  var message = e.data;
+  message.port.postMessage({events: eventsSeen});
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-async-waituntil.js b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-async-waituntil.js
new file mode 100644
index 000000000000..8a975b0d2e9b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-async-waituntil.js
@@ -0,0 +1,210 @@
+// This worker calls waitUntil() and respondWith() asynchronously and
+// reports back to the test whether they threw.
+//
+// These test cases are confusing. Bear in mind that the event is active
+// (calling waitUntil() is allowed) if:
+// * The pending promise count is not 0, or
+// * The event dispatch flag is set.
+
+// Controlled by 'init'/'done' messages.
+var resolveLockPromise;
+var port;
+
+self.addEventListener('message', function(event) {
+    var waitPromise;
+    var resolveTestPromise;
+
+    switch (event.data.step) {
+      case 'init':
+        event.waitUntil(new Promise((res) => { resolveLockPromise = res; }));
+        port = event.data.port;
+        break;
+      case 'done':
+        resolveLockPromise();
+        break;
+
+      // Throws because waitUntil() is called in a task after event dispatch
+      // finishes.
+      case 'no-current-extension-different-task':
+        async_task_waituntil(event).then(reportResultExpecting('InvalidStateError'));
+        break;
+
+      // OK because waitUntil() is called in a microtask that runs after the
+      // event handler runs, while the event dispatch flag is still set.
+      case 'no-current-extension-different-microtask':
+        async_microtask_waituntil(event).then(reportResultExpecting('OK'));
+        break;
+
+      // OK because the second waitUntil() is called while the first waitUntil()
+      // promise is still pending.
+      case 'current-extension-different-task':
+        event.waitUntil(new Promise((res) => { resolveTestPromise = res; }));
+        async_task_waituntil(event).then(reportResultExpecting('OK')).then(resolveTestPromise);
+        break;
+
+      // OK because all promises involved resolve "immediately", so the second
+      // waitUntil() is called during the microtask checkpoint at the end of
+      // event dispatching, when the event dispatch flag is still set.
+      case 'during-event-dispatch-current-extension-expired-same-microtask-turn':
+        waitPromise = Promise.resolve();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return sync_waituntil(event); })
+          .then(reportResultExpecting('OK'))
+        break;
+
+      // OK for the same reason as above.
+      case 'during-event-dispatch-current-extension-expired-same-microtask-turn-extra':
+        waitPromise = Promise.resolve();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return async_microtask_waituntil(event); })
+          .then(reportResultExpecting('OK'))
+        break;
+
+
+      // OK because the pending promise count is decremented in a microtask
+      // queued upon fulfillment of the first waitUntil() promise, so the second
+      // waitUntil() is called while the pending promise count is still
+      // positive.
+      case 'after-event-dispatch-current-extension-expired-same-microtask-turn':
+        waitPromise = makeNewTaskPromise();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return sync_waituntil(event); })
+          .then(reportResultExpecting('OK'))
+        break;
+
+      // Throws because the second waitUntil() is called after the pending
+      // promise count was decremented to 0.
+      case 'after-event-dispatch-current-extension-expired-same-microtask-turn-extra':
+        waitPromise = makeNewTaskPromise();
+        event.waitUntil(waitPromise);
+        waitPromise.then(() => { return async_microtask_waituntil(event); })
+          .then(reportResultExpecting('InvalidStateError'))
+        break;
+
+      // Throws because the second waitUntil() is called in a new task, after
+      // first waitUntil() promise settled and the event dispatch flag is unset.
+      case 'current-extension-expired-different-task':
+        event.waitUntil(Promise.resolve());
+        async_task_waituntil(event).then(reportResultExpecting('InvalidStateError'));
+        break;
+
+      case 'script-extendable-event':
+        self.dispatchEvent(new ExtendableEvent('nontrustedevent'));
+        break;
+    }
+
+    event.source.postMessage('ACK');
+  });
+
+self.addEventListener('fetch', function(event) {
+  const path = new URL(event.request.url).pathname;
+  const step = path.substring(path.lastIndexOf('/') + 1);
+  let response;
+  switch (step) {
+    // OK because waitUntil() is called while the respondWith() promise is still
+    // unsettled, so the pending promise count is positive.
+    case 'pending-respondwith-async-waituntil':
+      var resolveFetch;
+      response = new Promise((res) => { resolveFetch = res; });
+      event.respondWith(response);
+      async_task_waituntil(event)
+        .then(reportResultExpecting('OK'))
+        .then(() => { resolveFetch(new Response('OK')); });
+      break;
+
+    // OK because all promises involved resolve "immediately", so waitUntil() is
+    // called during the microtask checkpoint at the end of event dispatching,
+    // when the event dispatch flag is still set.
+    case 'during-event-dispatch-respondwith-microtask-sync-waituntil':
+      response = Promise.resolve(new Response('RESP'));
+      event.respondWith(response);
+      response.then(() => { return sync_waituntil(event); })
+        .then(reportResultExpecting('OK'));
+      break;
+
+    // OK because all promises involved resolve "immediately", so waitUntil() is
+    // called during the microtask checkpoint at the end of event dispatching,
+    // when the event dispatch flag is still set.
+    case 'during-event-dispatch-respondwith-microtask-async-waituntil':
+      response = Promise.resolve(new Response('RESP'));
+      event.respondWith(response);
+      response.then(() => { return async_microtask_waituntil(event); })
+        .then(reportResultExpecting('OK'));
+      break;
+
+    // OK because the pending promise count is decremented in a microtask queued
+    // upon fulfillment of the respondWith() promise, so waitUntil() is called
+    // while the pending promise count is still positive.
+    case 'after-event-dispatch-respondwith-microtask-sync-waituntil':
+      response = makeNewTaskPromise().then(() => {return new Response('RESP');});
+      event.respondWith(response);
+      response.then(() => { return sync_waituntil(event); })
+        .then(reportResultExpecting('OK'));
+      break;
+
+
+    // Throws because waitUntil() is called after the pending promise count was
+    // decremented to 0.
+    case 'after-event-dispatch-respondwith-microtask-async-waituntil':
+      response = makeNewTaskPromise().then(() => {return new Response('RESP');});
+      event.respondWith(response);
+      response.then(() => { return async_microtask_waituntil(event); })
+        .then(reportResultExpecting('InvalidStateError'))
+      break;
+  }
+});
+
+self.addEventListener('nontrustedevent', function(event) {
+    sync_waituntil(event).then(reportResultExpecting('InvalidStateError'));
+  });
+
+function reportResultExpecting(expectedResult) {
+  return function (result) {
+    port.postMessage({result : result, expected: expectedResult});
+    return result;
+  };
+}
+
+function sync_waituntil(event) {
+  return new Promise((res, rej) => {
+    try {
+      event.waitUntil(Promise.resolve());
+      res('OK');
+    } catch (error) {
+      res(error.name);
+    }
+  });
+}
+
+function async_microtask_waituntil(event) {
+  return new Promise((res, rej) => {
+    Promise.resolve().then(() => {
+      try {
+        event.waitUntil(Promise.resolve());
+        res('OK');
+      } catch (error) {
+        res(error.name);
+      }
+    });
+  });
+}
+
+function async_task_waituntil(event) {
+  return new Promise((res, rej) => {
+    setTimeout(() => {
+      try {
+        event.waitUntil(Promise.resolve());
+        res('OK');
+      } catch (error) {
+        res(error.name);
+      }
+    }, 0);
+  });
+}
+
+// Returns a promise that settles in a separate task.
+function makeNewTaskPromise() {
+  return new Promise(resolve => {
+    setTimeout(resolve, 0);
+  });
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-waituntil.js b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-waituntil.js
new file mode 100644
index 000000000000..20a9eb023f62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/extendable-event-waituntil.js
@@ -0,0 +1,87 @@
+var pendingPorts = [];
+var portResolves = [];
+
+onmessage = function(e) {
+  var message = e.data;
+  if ('port' in message) {
+    var resolve = self.portResolves.shift();
+    if (resolve)
+      resolve(message.port);
+    else
+      self.pendingPorts.push(message.port);
+  }
+};
+
+function fulfillPromise() {
+  return new Promise(function(resolve) {
+      // Make sure the oninstall/onactivate callback returns first.
+      Promise.resolve().then(function() {
+          var port = self.pendingPorts.shift();
+          if (port)
+            resolve(port);
+          else
+            self.portResolves.push(resolve);
+        });
+    }).then(function(port) {
+        port.postMessage('SYNC');
+        return new Promise(function(resolve) {
+            port.onmessage = function(e) {
+              if (e.data == 'ACK')
+                resolve();
+            };
+          });
+      });
+}
+
+function rejectPromise() {
+  return new Promise(function(resolve, reject) {
+      // Make sure the oninstall/onactivate callback returns first.
+      Promise.resolve().then(reject);
+    });
+}
+
+function stripScopeName(url) {
+  return url.split('/').slice(-1)[0];
+}
+
+oninstall = function(e) {
+  switch (stripScopeName(self.location.href)) {
+    case 'install-fulfilled':
+      e.waitUntil(fulfillPromise());
+      break;
+    case 'install-rejected':
+      e.waitUntil(rejectPromise());
+      break;
+    case 'install-multiple-fulfilled':
+      e.waitUntil(fulfillPromise());
+      e.waitUntil(fulfillPromise());
+      break;
+    case 'install-reject-precedence':
+      // Three "extend lifetime promises" are needed to verify that the user
+      // agent waits for all promises to settle even in the event of rejection.
+      // The first promise is fulfilled on demand by the client, the second is
+      // immediately scheduled for rejection, and the third is fulfilled on
+      // demand by the client (but only after the first promise has been
+      // fulfilled).
+      //
+      // User agents which simply expose `Promise.all` semantics in this case
+      // (by entering the "redundant state" following the rejection of the
+      // second promise but prior to the fulfillment of the third) can be
+      // identified from the client context.
+      e.waitUntil(fulfillPromise());
+      e.waitUntil(rejectPromise());
+      e.waitUntil(fulfillPromise());
+      break;
+  }
+};
+
+onactivate = function(e) {
+  switch (stripScopeName(self.location.href)) {
+    case 'activate-fulfilled':
+      e.waitUntil(fulfillPromise());
+      break;
+    case 'activate-rejected':
+      e.waitUntil(rejectPromise());
+      break;
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fail-on-fetch-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fail-on-fetch-worker.js
new file mode 100644
index 000000000000..517f289fbc8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fail-on-fetch-worker.js
@@ -0,0 +1,5 @@
+importScripts('worker-testharness.js');
+
+this.addEventListener('fetch', function(event) {
+    event.respondWith(new Response('ERROR'));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-access-control-login.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-access-control-login.html
new file mode 100644
index 000000000000..ee296807ed14
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-access-control-login.html
@@ -0,0 +1,16 @@
+<script>
+// Set authentication info
+window.addEventListener("message", function(evt) {
+    var port = evt.ports[0];
+    document.cookie = 'cookie=' + evt.data.cookie;
+    var xhr = new XMLHttpRequest();
+    xhr.addEventListener('load', function() {
+        port.postMessage({msg: 'LOGIN FINISHED'});
+      }, false);
+    xhr.open('GET',
+             './fetch-access-control.py?Auth',
+             true,
+             evt.data.username, evt.data.password);
+    xhr.send();
+  }, false);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-double-write-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-double-write-worker.js
new file mode 100644
index 000000000000..17723dcdda2f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-double-write-worker.js
@@ -0,0 +1,7 @@
+self.addEventListener('fetch', (event) => {
+  url = new URL(event.request.url);
+  if (url.search == '?PNGIMAGE') {
+    localUrl = new URL(url.pathname + url.search, self.location);
+    event.respondWith(fetch(localUrl));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
new file mode 100644
index 000000000000..75d766c193a8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
@@ -0,0 +1,70 @@
+<html>
+<title>iframe for fetch canvas tainting test</title>
+<script>
+const NOT_TAINTED = 'NOT_TAINTED';
+const TAINTED = 'TAINTED';
+const LOAD_ERROR = 'LOAD_ERROR';
+
+// Creates an image/video element with src=|url| and an optional |cross_origin|
+// attibute. Tries to read from the image/video using a canvas element. Returns
+// NOT_TAINTED if it could be read, TAINTED if it could not be read, and
+// LOAD_ERROR if loading the image/video failed.
+function create_test_case_promise(url, cross_origin) {
+  return new Promise(resolve => {
+      if (url.indexOf('PNGIMAGE') != -1) {
+        const img = document.createElement('img');
+        if (cross_origin != '') {
+          img.crossOrigin = cross_origin;
+        }
+        img.onload = function() {
+          try {
+            const canvas = document.createElement('canvas');
+            canvas.width = 100;
+            canvas.height = 100;
+            const context = canvas.getContext('2d');
+            context.drawImage(img, 0, 0);
+            context.getImageData(0, 0, 100, 100);
+            resolve(NOT_TAINTED);
+          } catch (e) {
+            resolve(TAINTED);
+          }
+        };
+        img.onerror = function() {
+          resolve(LOAD_ERROR);
+        }
+        img.src = url;
+        return;
+      }
+
+      if (url.indexOf('VIDEO') != -1) {
+        const video = document.createElement('video');
+        video.autoplay = true;
+        video.muted = true;
+        if (cross_origin != '') {
+          video.crossOrigin = cross_origin;
+        }
+        video.onplay = function() {
+          try {
+            const canvas = document.createElement('canvas');
+            canvas.width = 100;
+            canvas.height = 100;
+            const context = canvas.getContext('2d');
+            context.drawImage(video, 0, 0);
+            context.getImageData(0, 0, 100, 100);
+            resolve(NOT_TAINTED);
+          } catch (e) {
+            resolve(TAINTED);
+          }
+        };
+        video.onerror = function() {
+          resolve(LOAD_ERROR);
+        }
+        video.src = url;
+        return;
+      }
+
+      resolve('unknown resource type');
+  });
+}
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
new file mode 100644
index 000000000000..2aada3669eff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
@@ -0,0 +1,241 @@
+// This is the main driver of the canvas tainting tests.
+const NOT_TAINTED = 'NOT_TAINTED';
+const TAINTED = 'TAINTED';
+const LOAD_ERROR = 'LOAD_ERROR';
+
+let frame;
+
+// Creates a single promise_test.
+function canvas_taint_test(url, cross_origin, expected_result) {
+  promise_test(t => {
+      return frame.contentWindow.create_test_case_promise(url, cross_origin)
+        .then(result => {
+          assert_equals(result, expected_result);
+        });
+    }, 'url "' + url + '" with crossOrigin "' + cross_origin + '" should be ' +
+           expected_result);
+}
+
+
+// Runs all the tests. The given |params| has these properties:
+// * |resource_path|: the relative path to the (image/video) resource to test.
+// * |cache|: when true, the service worker bounces responses into
+//   Cache Storage and back out before responding with them.
+function do_canvas_tainting_tests(params) {
+  const host_info = get_host_info();
+  let resource_path = params.resource_path;
+  if (params.cache)
+    resource_path += "&cache=true";
+  const resource_url = host_info['HTTPS_ORIGIN'] + resource_path;
+  const remote_resource_url = host_info['HTTPS_REMOTE_ORIGIN'] + resource_path;
+
+  // Set up the service worker and the frame.
+  promise_test(function(t) {
+      const SCOPE = 'resources/fetch-canvas-tainting-iframe.html';
+      const SCRIPT = 'resources/fetch-rewrite-worker.js';
+      const host_info = get_host_info();
+
+      // login_https() is needed because some test cases use credentials.
+      return login_https(t)
+        .then(function() {
+            return service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+          })
+        .then(function(registration) {
+            promise_test(() => {
+                if (frame)
+                  frame.remove();
+                return registration.unregister();
+              }, 'restore global state');
+
+            return wait_for_state(t, registration.installing, 'activated');
+          })
+        .then(function() { return with_iframe(SCOPE); })
+        .then(f => {
+            frame = f;
+          });
+    }, 'initialize global state');
+
+  // Reject tests. Add '&reject' so the service worker responds with a rejected promise.
+  // A load error is expected.
+  canvas_taint_test(resource_url + '&reject', '', LOAD_ERROR);
+  canvas_taint_test(resource_url + '&reject', 'anonymous', LOAD_ERROR);
+  canvas_taint_test(resource_url + '&reject', 'use-credentials', LOAD_ERROR);
+
+  // Fallback tests. Add '&ignore' so the service worker does not respond to the fetch
+  // request, and we fall back to network.
+  canvas_taint_test(resource_url + '&ignore', '', NOT_TAINTED);
+  canvas_taint_test(remote_resource_url + '&ignore', '', TAINTED);
+  canvas_taint_test(remote_resource_url + '&ignore', 'anonymous', LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+          '&ignore',
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(remote_resource_url + '&ignore', 'use-credentials', LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+          '&ignore',
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+          '&ACACredentials=true&ignore',
+      'use-credentials',
+      NOT_TAINTED);
+
+  // Credential tests (with fallback). Add '&Auth' so the server requires authentication.
+  // Furthermore, add '&ignore' so the service worker falls back to network.
+  canvas_taint_test(resource_url + '&Auth&ignore', '', NOT_TAINTED);
+  canvas_taint_test(remote_resource_url + '&Auth&ignore', '', TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ignore', 'anonymous', LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ignore',
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+      '&ignore',
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url + '&Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+      '&ACACredentials=true&ignore',
+      'use-credentials',
+      NOT_TAINTED);
+
+  // In the following tests, the service worker provides a response.
+  // Add '&url' so the service worker responds with fetch(url).
+  // Add '&mode' to configure the fetch request options.
+
+  // Basic response tests. Set &url to the original url.
+  canvas_taint_test(
+      resource_url + '&mode=same-origin&url=' + encodeURIComponent(resource_url),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=same-origin&url=' + encodeURIComponent(resource_url),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=same-origin&url=' + encodeURIComponent(resource_url),
+      'use-credentials',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=same-origin&url=' +
+          encodeURIComponent(resource_url),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=same-origin&url=' +
+          encodeURIComponent(resource_url),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=same-origin&url=' +
+          encodeURIComponent(resource_url),
+      'use-credentials',
+      NOT_TAINTED);
+
+  // Opaque response tests. Set &url to the cross-origin URL, and &mode to
+  // 'no-cors' so we expect an opaque response.
+  canvas_taint_test(
+      resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      '',
+      TAINTED);
+  canvas_taint_test(
+      resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'anonymous',
+      LOAD_ERROR);
+  canvas_taint_test(
+      resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'use-credentials',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      '',
+      TAINTED);
+  canvas_taint_test(
+      remote_resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'anonymous',
+      LOAD_ERROR);
+  canvas_taint_test(
+      remote_resource_url +
+          '&mode=no-cors&url=' + encodeURIComponent(remote_resource_url),
+      'use-credentials',
+      LOAD_ERROR);
+
+  // CORS response tests. Set &url to the cross-origin URL, and &mode
+  // to 'cors' to attempt a CORS request.
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      resource_url + '&mode=cors&credentials=same-origin&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      resource_url + '&mode=cors&url=' +
+          encodeURIComponent(
+              remote_resource_url +
+              '&ACACredentials=true&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&credentials=same-origin&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      '',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'anonymous',
+      NOT_TAINTED);
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(remote_resource_url +
+                             '&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      LOAD_ERROR); // We expect LOAD_ERROR since the server doesn't respond
+                   // with an Access-Control-Allow-Credentials header.
+  canvas_taint_test(
+      remote_resource_url + '&mode=cors&url=' +
+          encodeURIComponent(
+              remote_resource_url +
+              '&ACACredentials=true&ACAOrigin=' + host_info['HTTPS_ORIGIN']),
+      'use-credentials',
+      NOT_TAINTED);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-exposed-header-names-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-exposed-header-names-worker.js
new file mode 100644
index 000000000000..145952a22cf0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-exposed-header-names-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('fetch', (e) => {
+    e.respondWith(fetch(e.request));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-xhr-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-xhr-iframe.html
new file mode 100644
index 000000000000..d88c5103d35b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-cors-xhr-iframe.html
@@ -0,0 +1,170 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var path = base_path() + 'fetch-access-control.py';
+var host_info = get_host_info();
+var SUCCESS = 'SUCCESS';
+var FAIL = 'FAIL';
+
+function create_test_case_promise(url, with_credentials) {
+  return new Promise(function(resolve) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        if (xhr.status == 200) {
+          resolve(SUCCESS);
+        } else {
+          resolve("STATUS" + xhr.status);
+        }
+      }
+      xhr.onerror = function() {
+        resolve(FAIL);
+      }
+      xhr.responseType = 'text';
+      xhr.withCredentials = with_credentials;
+      xhr.open('GET', url, true);
+      xhr.send();
+    });
+}
+
+window.addEventListener('message', async (evt) => {
+    var port = evt.ports[0];
+    var url = host_info['HTTPS_ORIGIN'] + path;
+    var remote_url = host_info['HTTPS_REMOTE_ORIGIN'] + path;
+    var TEST_CASES = [
+      // Reject tests
+      [url + '?reject', false, FAIL],
+      [url + '?reject', true, FAIL],
+      [remote_url + '?reject', false, FAIL],
+      [remote_url + '?reject', true, FAIL],
+      // Event handler exception tests
+      [url + '?throw', false, SUCCESS],
+      [url + '?throw', true, SUCCESS],
+      [remote_url + '?throw', false, FAIL],
+      [remote_url + '?throw', true, FAIL],
+      // Reject(resolve-null) tests
+      [url + '?resolve-null', false, FAIL],
+      [url + '?resolve-null', true, FAIL],
+      [remote_url + '?resolve-null', false, FAIL],
+      [remote_url + '?resolve-null', true, FAIL],
+      // Fallback tests
+      [url + '?ignore', false, SUCCESS],
+      [url + '?ignore', true, SUCCESS],
+      [remote_url + '?ignore', false, FAIL, true],  // Executed in serial.
+      [remote_url + '?ignore', true, FAIL, true],  // Executed in serial.
+      [
+        remote_url + '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        false, SUCCESS
+      ],
+      [
+        remote_url + '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        true, FAIL, true  // Executed in serial.
+      ],
+      [
+        remote_url + '?ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+        '&ACACredentials=true&ignore',
+        true, SUCCESS
+      ],
+      // Credential test (fallback)
+      [url + '?Auth&ignore', false, SUCCESS],
+      [url + '?Auth&ignore', true, SUCCESS],
+      [remote_url + '?Auth&ignore', false, FAIL],
+      [remote_url + '?Auth&ignore', true, FAIL],
+      [
+        remote_url + '?Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        false, 'STATUS401'
+      ],
+      [
+        remote_url + '?Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] + '&ignore',
+        true, FAIL, true  // Executed in serial.
+      ],
+      [
+        remote_url + '?Auth&ACAOrigin=' + host_info['HTTPS_ORIGIN'] +
+        '&ACACredentials=true&ignore',
+        true, SUCCESS
+      ],
+      // Basic response
+      [
+        url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      [
+        url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      [
+        remote_url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      [
+        remote_url + '?mode=same-origin&url=' + encodeURIComponent(url),
+        false, SUCCESS
+      ],
+      // Opaque response
+      [
+        url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      [
+        url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      [
+        remote_url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      [
+        remote_url + '?mode=no-cors&url=' + encodeURIComponent(remote_url),
+        false, FAIL
+      ],
+      // CORS response
+      [
+        url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        false, SUCCESS
+      ],
+      [
+        url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        true, FAIL
+      ],
+      [
+        url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN'] +
+                           '&ACACredentials=true'),
+        true, SUCCESS
+      ],
+      [
+        remote_url + '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        false, SUCCESS
+      ],
+      [
+        remote_url +
+        '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN']),
+        true, FAIL
+      ],
+      [
+        remote_url +
+        '?mode=cors&url=' +
+        encodeURIComponent(remote_url + '?ACAOrigin=' +
+                           host_info['HTTPS_ORIGIN'] +
+                           '&ACACredentials=true'),
+        true, SUCCESS
+      ]
+    ];
+
+    let counter = 0;
+    for (let test of TEST_CASES) {
+      let result = await create_test_case_promise(test[0], test[1]);
+      let testName = 'test ' + (++counter) + ': ' + test[0] + ' with credentials ' + test[1] + ' must be ' + test[2];
+      port.postMessage({testName: testName, result: result === test[2]});
+    }
+    port.postMessage('done');
+  }, false);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html
new file mode 100644
index 000000000000..33bf0416d585
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html
@@ -0,0 +1,16 @@
+<script>
+var meta = document.createElement('meta');
+meta.setAttribute('http-equiv', 'Content-Security-Policy');
+meta.setAttribute('content', decodeURIComponent(location.search.substring(1)));
+document.head.appendChild(meta);
+
+function load_image(url) {
+  return new Promise(function(resolve, reject) {
+      var img = document.createElement('img');
+      document.body.appendChild(img);
+      img.onload = resolve;
+      img.onerror = reject;
+      img.src = url;
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers
new file mode 100644
index 000000000000..5a1c7b941aca
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers
@@ -0,0 +1 @@
+Content-Security-Policy: img-src https://{{host}}:{{ports[https][0]}}; connect-src 'unsafe-inline' 'self'
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-error-worker.js
new file mode 100644
index 000000000000..788252cf3b3b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-error-worker.js
@@ -0,0 +1,22 @@
+importScripts("/resources/testharness.js");
+
+function doTest(event)
+{
+    if (!event.request.url.includes("fetch-error-test"))
+        return;
+
+    let counter = 0;
+    const stream = new ReadableStream({ pull: controller => {
+        switch (++counter) {
+        case 1:
+            controller.enqueue(new Uint8Array([1]));
+            return;
+        default:
+            // We asynchronously error the stream so that there is ample time to resolve the fetch promise and call text() on the response.
+            step_timeout(() => controller.error("Sorry"), 50);
+        }
+    }});
+    event.respondWith(new Response(stream));
+}
+
+self.addEventListener("fetch", doTest);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-add-async-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-add-async-worker.js
new file mode 100644
index 000000000000..a5a44a57c99c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-add-async-worker.js
@@ -0,0 +1,6 @@
+importScripts('/resources/testharness.js');
+
+promise_test(async () => {
+  await new Promise(handler => { step_timeout(handler, 0); });
+  self.addEventListener('fetch', () => {});
+}, 'fetch event added asynchronously does not throw');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-after-navigation-within-page-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-after-navigation-within-page-iframe.html
new file mode 100644
index 000000000000..bf8a6d5ce51f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-after-navigation-within-page-iframe.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          if (request.status == 200)
+            resolve(request.response);
+          else
+            reject(new Error('fetch_url: ' + request.statusText + " : " + url));
+        });
+      request.addEventListener('error', function(event) {
+          reject(new Error('fetch_url encountered an error: ' + url));
+        });
+      request.addEventListener('abort', function(event) {
+          reject(new Error('fetch_url was aborted: ' + url));
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-async-respond-with-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-async-respond-with-worker.js
new file mode 100644
index 000000000000..dc3f1a1e9856
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-async-respond-with-worker.js
@@ -0,0 +1,66 @@
+// This worker attempts to call respondWith() asynchronously after the
+// fetch event handler finished. It reports back to the test whether
+// an exception was thrown.
+
+// These get reset at the start of a test case.
+let reportResult;
+
+// The test page sends a message to tell us that a new test case is starting.
+// We expect a fetch event after this.
+self.addEventListener('message', (event) => {
+  // Ensure tests run mutually exclusive.
+  if (reportResult) {
+    event.source.postMessage('testAlreadyRunning');
+    return;
+  }
+
+  const resultPromise = new Promise((resolve) => {
+    reportResult = resolve;
+    // Tell the client that everything is initialized and that it's safe to
+    // proceed with the test without relying on the order of events (which some
+    // browsers like Chrome may not guarantee).
+    event.source.postMessage('messageHandlerInitialized');
+  });
+
+  // Keep the worker alive until the test case finishes, and report
+  // back the result to the test page.
+  event.waitUntil(resultPromise.then(result => {
+    reportResult = null;
+    event.source.postMessage(result);
+  }));
+});
+
+// Calls respondWith() and reports back whether an exception occurred.
+function tryRespondWith(event) {
+  try {
+    event.respondWith(new Response());
+    reportResult({didThrow: false});
+  } catch (error) {
+    reportResult({didThrow: true, error: error.name});
+  }
+}
+
+function respondWithInTask(event) {
+  setTimeout(() => {
+    tryRespondWith(event);
+  }, 0);
+}
+
+function respondWithInMicrotask(event) {
+  Promise.resolve().then(() => {
+    tryRespondWith(event);
+  });
+}
+
+self.addEventListener('fetch', function(event) {
+  const path = new URL(event.request.url).pathname;
+  const test = path.substring(path.lastIndexOf('/') + 1);
+
+  // If this is a test case, try respondWith() and report back to the test page
+  // the result.
+  if (test == 'respondWith-in-task') {
+    respondWithInTask(event);
+  } else if (test == 'respondWith-in-microtask') {
+    respondWithInMicrotask(event);
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-helpers.js
new file mode 100644
index 000000000000..f9ad52daf81d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-helpers.js
@@ -0,0 +1,50 @@
+// Shared helpers for fetch-event-download-*.https.html tests.
+// crbug.com/40410035.
+
+function uniqueChannelId() {
+  return 'download-' + Math.random().toString(36).slice(2);
+}
+
+// Resolves with the first message posted to a BroadcastChannel of the given
+// id, or rejects via the test's timeout if none arrives.
+function nextChannelMessage(t, channelId) {
+  return new Promise((resolve) => {
+    const channel = new BroadcastChannel(channelId);
+    channel.addEventListener('message', (e) => {
+      channel.close();
+      resolve(e.data);
+    }, {once: true});
+    t.add_cleanup(() => channel.close());
+  });
+}
+
+// Resolves true if a message arrived within `timeoutMs`, false otherwise.
+function awaitChannelSilence(t, channelId, timeoutMs) {
+  return new Promise((resolve) => {
+    const channel = new BroadcastChannel(channelId);
+    let received = false;
+    channel.addEventListener('message', () => {
+      received = true;
+      channel.close();
+      resolve(true);
+    });
+    step_timeout(() => {
+      channel.close();
+      resolve(received);
+    }, timeoutMs);
+    t.add_cleanup(() => channel.close());
+  });
+}
+
+// Programmatically clicks an <a download> via testdriver so the click carries
+// transient activation; without it Chromium's download path may suppress the
+// fetch entirely.
+async function clickDownloadAnchor(t, href) {
+  const a = document.createElement('a');
+  a.href = href;
+  a.download = '';
+  a.textContent = 'download';
+  document.body.appendChild(a);
+  t.add_cleanup(() => a.remove());
+  await test_driver.click(a);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-worker.js
new file mode 100644
index 000000000000..38d0f56dc302
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-download-worker.js
@@ -0,0 +1,39 @@
+// Service worker for fetch-event-download-*.https.html.
+//
+// Echoes the FetchEvent it sees for download requests onto a BroadcastChannel
+// named after the channel ID embedded in the request URL's `?channel=` query
+// parameter, then optionally provides a response based on the `?mode=` param.
+//
+// Mode values:
+//   "respond" (default) — call event.respondWith(new Response("from-sw", ...)).
+//   "fallback"          — observe the event but do not call respondWith,
+//                         letting the request fall back to the network.
+
+self.addEventListener('fetch', (event) => {
+  const url = new URL(event.request.url);
+  const channelId = url.searchParams.get('channel');
+  if (!channelId) {
+    return;
+  }
+  const mode = url.searchParams.get('mode') || 'respond';
+
+  const channel = new BroadcastChannel(channelId);
+  channel.postMessage({
+    type: 'fetch',
+    url: event.request.url,
+    destination: event.request.destination,
+    method: event.request.method,
+    mode: event.request.mode,
+    referrer: event.request.referrer,
+    clientId: event.clientId,
+    resultingClientId: event.resultingClientId,
+  });
+
+  if (mode === 'fallback') {
+    return;
+  }
+
+  event.respondWith(new Response('from-sw', {
+    headers: {'content-type': 'text/plain'},
+  }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-handled-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-handled-worker.js
new file mode 100644
index 000000000000..53ee1493743d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-handled-worker.js
@@ -0,0 +1,37 @@
+// This worker reports back the final state of FetchEvent.handled (RESOLVED or
+// REJECTED) to the test.
+
+self.addEventListener('message', function(event) {
+  self.port = event.data.port;
+});
+
+self.addEventListener('fetch', function(event) {
+  try {
+    event.handled.then(() => {
+      self.port.postMessage('RESOLVED');
+    }, () => {
+      self.port.postMessage('REJECTED');
+    });
+  } catch (e) {
+    self.port.postMessage('FAILED');
+    return;
+  }
+
+  const search = new URL(event.request.url).search;
+  switch (search) {
+    case '?respondWith-not-called':
+      break;
+    case '?respondWith-not-called-and-event-canceled':
+      event.preventDefault();
+      break;
+    case '?respondWith-called-and-promise-resolved':
+      event.respondWith(Promise.resolve(new Response('body')));
+      break;
+    case '?respondWith-called-and-promise-resolved-to-invalid-response':
+      event.respondWith(Promise.resolve('invalid response'));
+      break;
+    case '?respondWith-called-and-promise-rejected':
+      event.respondWith(Promise.reject(new Error('respondWith rejected')));
+      break;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-controllee-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-controllee-iframe.html
new file mode 100644
index 000000000000..f6c1919bbcf6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-controllee-iframe.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          resolve();
+        });
+      request.addEventListener('error', function(event) {
+          reject();
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function make_test(testcase) {
+  var name = testcase.name;
+  return fetch_url(window.location.href + '?' + name)
+    .then(
+      function() {
+          if (testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected network error but loaded'));
+        },
+      function() {
+          if (!testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected to load but got network error'));
+        });
+}
+
+function run_tests() {
+  var tests = [
+    { name: 'prevent-default-and-respond-with', expect_load: true },
+    { name: 'prevent-default', expect_load: false },
+    { name: 'reject', expect_load: false },
+    { name: 'unused-body', expect_load: true },
+    { name: 'used-body', expect_load: false },
+    { name: 'unused-fetched-body', expect_load: true },
+    { name: 'used-fetched-body', expect_load: false },
+    { name: 'throw-exception', expect_load: true },
+  ].map(make_test);
+
+  Promise.all(tests)
+    .then(function() {
+        window.parent.notify_test_done('PASS');
+      })
+    .catch(function(error) {
+        window.parent.notify_test_done('FAIL: ' + error.message);
+      });
+}
+
+if (!navigator.serviceWorker.controller)
+  window.parent.notify_test_done('FAIL: no controller');
+else
+  run_tests();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-worker.js
new file mode 100644
index 000000000000..5bfe3a0bbd9c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-error-worker.js
@@ -0,0 +1,49 @@
+// Test that multiple fetch handlers do not confuse the implementation.
+self.addEventListener('fetch', function(event) {});
+
+self.addEventListener('fetch', function(event) {
+    var testcase = new URL(event.request.url).search;
+    switch (testcase) {
+    case '?reject':
+      event.respondWith(Promise.reject());
+      break;
+    case '?prevent-default':
+      event.preventDefault();
+      break;
+    case '?prevent-default-and-respond-with':
+      event.preventDefault();
+      break;
+    case '?unused-body':
+      event.respondWith(new Response('body'));
+      break;
+    case '?used-body':
+      var res = new Response('body');
+      res.text();
+      event.respondWith(res);
+      break;
+    case '?unused-fetched-body':
+      event.respondWith(fetch('other.html').then(function(res){
+          return res;
+        }));
+      break;
+    case '?used-fetched-body':
+      event.respondWith(fetch('other.html').then(function(res){
+          res.text();
+          return res;
+        }));
+      break;
+    case '?throw-exception':
+      throw('boom');
+      break;
+    }
+  });
+
+self.addEventListener('fetch', function(event) {});
+
+self.addEventListener('fetch', function(event) {
+    var testcase = new URL(event.request.url).search;
+    if (testcase == '?prevent-default-and-respond-with')
+      event.respondWith(new Response('responding!'));
+  });
+
+self.addEventListener('fetch', function(event) {});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-fallback-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-fallback-worker.js
new file mode 100644
index 000000000000..376bdbed05e1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-network-fallback-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('fetch', () => {
+  // Do nothing.
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-iframe.html
new file mode 100644
index 000000000000..0ebd1ca81537
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-iframe.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          resolve();
+        });
+      request.addEventListener('error', function(event) {
+          reject();
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function make_test(testcase) {
+  var name = testcase.name;
+  return fetch_url(window.location.href + '?' + name)
+    .then(
+      function() {
+          if (testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected network error but loaded'));
+        },
+      function() {
+          if (!testcase.expect_load)
+            return Promise.resolve();
+          return Promise.reject(new Error(
+              name + ': expected to load but got network error'));
+        });
+}
+
+function run_tests() {
+  var tests = [
+    { name: 'response-object', expect_load: true },
+    { name: 'response-promise-object', expect_load: true },
+    { name: 'other-value', expect_load: false },
+  ].map(make_test);
+
+  Promise.all(tests)
+    .then(function() {
+        window.parent.notify_test_done('PASS');
+      })
+    .catch(function(error) {
+        window.parent.notify_test_done('FAIL: ' + error.message);
+      });
+}
+
+if (!navigator.serviceWorker.controller)
+  window.parent.notify_test_done('FAIL: no controller');
+else
+  run_tests();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-worker.js
new file mode 100644
index 000000000000..712c4b73c9bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-argument-worker.js
@@ -0,0 +1,14 @@
+self.addEventListener('fetch', function(event) {
+    var testcase = new URL(event.request.url).search;
+    switch (testcase) {
+    case '?response-object':
+      event.respondWith(new Response('body'));
+      break;
+    case '?response-promise-object':
+      event.respondWith(Promise.resolve(new Response('body')));
+      break;
+    case '?other-value':
+      event.respondWith(new Object());
+      break;
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js
new file mode 100644
index 000000000000..d3ba8a8df2e7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-body-loaded-in-chunk-worker.js
@@ -0,0 +1,7 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/body-in-chunk$/))
+        return;
+    event.respondWith(fetch("../../../fetch/api/resources/trickle.py?count=4&delay=50"));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-custom-response-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-custom-response-worker.js
new file mode 100644
index 000000000000..ff24aed1282c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-custom-response-worker.js
@@ -0,0 +1,45 @@
+'use strict';
+
+addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  const type = url.searchParams.get('type');
+
+  if (!type) return;
+
+  if (type === 'string') {
+    event.respondWith(new Response('PASS'));
+  }
+  else if (type === 'blob') {
+    event.respondWith(
+      new Response(new Blob(['PASS']))
+    );
+  }
+  else if (type === 'buffer-view') {
+    const encoder = new TextEncoder();
+    event.respondWith(
+      new Response(encoder.encode('PASS'))
+    );
+  }
+  else if (type === 'buffer') {
+    const encoder = new TextEncoder();
+    event.respondWith(
+      new Response(encoder.encode('PASS').buffer)
+    );
+  }
+  else if (type === 'form-data') {
+    const body = new FormData();
+    body.set('result', 'PASS');
+    event.respondWith(
+      new Response(body)
+    );
+  }
+  else if (type === 'search-params') {
+    const body = new URLSearchParams();
+    body.set('result', 'PASS');
+    event.respondWith(
+      new Response(body, {
+        headers: { 'Content-Type': 'text/plain' }
+      })
+    );
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-partial-stream-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-partial-stream-worker.js
new file mode 100644
index 000000000000..b7307f29f57f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-partial-stream-worker.js
@@ -0,0 +1,28 @@
+let waitUntilResolve;
+
+let bodyController;
+
+self.addEventListener('message', evt => {
+  if (evt.data === 'done') {
+    bodyController.close();
+    waitUntilResolve();
+  }
+});
+
+self.addEventListener('fetch', evt => {
+  if (!evt.request.url.includes('partial-stream.txt')) {
+    return;
+  }
+
+  evt.waitUntil(new Promise(resolve => waitUntilResolve = resolve));
+
+  let body = new ReadableStream({
+    start: controller => {
+      let encoder = new TextEncoder();
+      controller.enqueue(encoder.encode('partial-stream-content'));
+      bodyController = controller;
+    },
+  });
+
+  evt.respondWith(new Response(body));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-chunk-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-chunk-worker.js
new file mode 100644
index 000000000000..f954e3a18a5e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-chunk-worker.js
@@ -0,0 +1,40 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/body-stream$/))
+        return;
+
+    var counter = 0;
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({ pull: controller => {
+        switch (++counter) {
+        case 1:
+            controller.enqueue(encoder.encode(''));
+            return;
+        case 2:
+            controller.enqueue(encoder.encode('chunk #1'));
+            return;
+        case 3:
+            controller.enqueue(encoder.encode(' '));
+            return;
+        case 4:
+            controller.enqueue(encoder.encode('chunk #2'));
+            return;
+        case 5:
+            controller.enqueue(encoder.encode(' '));
+            return;
+        case 6:
+            controller.enqueue(encoder.encode('chunk #3'));
+            return;
+        case 7:
+            controller.enqueue(encoder.encode(' '));
+            return;
+        case 8:
+            controller.enqueue(encoder.encode('chunk #4'));
+            return;
+        default:
+            controller.close();
+        }
+    }});
+    event.respondWith(new Response(stream));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-worker.js
new file mode 100644
index 000000000000..056351322c69
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-readable-stream-worker.js
@@ -0,0 +1,81 @@
+'use strict';
+importScripts("/resources/testharness.js");
+
+const map = new Map();
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  if (!url.searchParams.has('stream')) return;
+
+  if (url.searchParams.has('observe-cancel')) {
+    const id = url.searchParams.get('id');
+    if (id === undefined) {
+      event.respondWith(new Error('error'));
+      return;
+    }
+    event.waitUntil(new Promise(resolve => {
+      map.set(id, {label: 'pending', resolve});
+    }));
+
+    const stream = new ReadableStream({
+      pull(c) {
+        if (url.searchParams.get('enqueue') === 'true') {
+          url.searchParams.delete('enqueue');
+          c.enqueue(new Uint8Array([65]));
+        }
+      },
+      cancel() {
+        map.get(id).label = 'cancelled';
+      }
+    });
+    event.respondWith(new Response(stream));
+    return;
+  }
+
+  if (url.searchParams.has('query-cancel')) {
+    const id = url.searchParams.get('id');
+    if (id === undefined) {
+      event.respondWith(new Error('error'));
+      return;
+    }
+    const entry = map.get(id);
+    if (entry === undefined) {
+      event.respondWith(new Error('not found'));
+      return;
+    }
+    map.delete(id);
+    entry.resolve();
+    event.respondWith(new Response(entry.label));
+    return;
+  }
+
+  if (url.searchParams.has('use-fetch-stream')) {
+    event.respondWith(async function() {
+      const response = await fetch('pass.txt');
+      return new Response(response.body);
+    }());
+    return;
+  }
+
+  const delayEnqueue = url.searchParams.has('delay');
+
+  const stream = new ReadableStream({
+    start(controller) {
+      const encoder = new TextEncoder();
+
+      const populate = () => {
+        controller.enqueue(encoder.encode('PASS'));
+        controller.close();
+      }
+
+      if (delayEnqueue) {
+        step_timeout(populate, 16);
+      }
+      else {
+        populate();
+      }
+    }
+  });
+
+  event.respondWith(new Response(stream));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html
new file mode 100644
index 000000000000..d15454daa5be
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-iframe.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>respond-with-response-body-with-invalid-chunk</title>
+<body></body>
+<script>
+'use strict';
+
+parent.set_fetch_promise(fetch('body-stream-with-invalid-chunk').then(resp => {
+    const reader = resp.body.getReader();
+    const reader_promise = reader.read();
+    parent.set_reader_promise(reader_promise);
+    // Suppress our expected error.
+    return reader_promise.catch(() => {});
+  }));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js
new file mode 100644
index 000000000000..0254e24f94a2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js
@@ -0,0 +1,12 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/body-stream-with-invalid-chunk$/))
+      return;
+    const stream = new ReadableStream({start: controller => {
+        // The argument is intentionally a string, not a Uint8Array.
+        controller.enqueue('hello');
+      }});
+    const headers = { 'x-content-type-options': 'nosniff' };
+    event.respondWith(new Response(stream, { headers }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-stops-propagation-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-stops-propagation-worker.js
new file mode 100644
index 000000000000..18da049d69f4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-respond-with-stops-propagation-worker.js
@@ -0,0 +1,15 @@
+var result = null;
+
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage(result);
+  });
+
+self.addEventListener('fetch', function(event) {
+    if (!result)
+      result = 'PASS';
+    event.respondWith(new Response());
+  });
+
+self.addEventListener('fetch', function(event) {
+    result = 'FAIL: fetch event propagated';
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-test-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-test-worker.js
new file mode 100644
index 000000000000..813f79d1b07b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-test-worker.js
@@ -0,0 +1,224 @@
+function handleHeaders(event) {
+  const headers = Array.from(event.request.headers);
+  event.respondWith(new Response(JSON.stringify(headers)));
+}
+
+function handleString(event) {
+  event.respondWith(new Response('Test string'));
+}
+
+function handleBlob(event) {
+  event.respondWith(new Response(new Blob(['Test blob'])));
+}
+
+function handleReferrer(event) {
+  event.respondWith(new Response(new Blob(
+    ['Referrer: ' + event.request.referrer])));
+}
+
+function handleReferrerPolicy(event) {
+  event.respondWith(new Response(new Blob(
+    ['ReferrerPolicy: ' + event.request.referrerPolicy])));
+}
+
+function handleReferrerFull(event) {
+  event.respondWith(new Response(new Blob(
+    ['Referrer: ' + event.request.referrer + '\n' +
+     'ReferrerPolicy: ' + event.request.referrerPolicy])));
+}
+
+function handleClientId(event) {
+  var body;
+  if (event.clientId !== "") {
+    body = 'Client ID Found: ' + event.clientId;
+  } else {
+    body = 'Client ID Not Found';
+  }
+  event.respondWith(new Response(body));
+}
+
+function handleResultingClientId(event) {
+  var body;
+  if (event.resultingClientId !== "") {
+    body = 'Resulting Client ID Found: ' + event.resultingClientId;
+  } else {
+    body = 'Resulting Client ID Not Found';
+  }
+  event.respondWith(new Response(body));
+}
+
+function handleNullBody(event) {
+  event.respondWith(new Response());
+}
+
+function handleFetch(event) {
+  event.respondWith(fetch('other.html'));
+}
+
+function handleFormPost(event) {
+  event.respondWith(new Promise(function(resolve) {
+      event.request.text()
+        .then(function(result) {
+            resolve(new Response(event.request.method + ':' +
+                                 event.request.headers.get('Content-Type') + ':' +
+                                 result));
+          });
+    }));
+}
+
+function handleMultipleRespondWith(event) {
+  var logForMultipleRespondWith = '';
+  for (var i = 0; i < 3; ++i) {
+    logForMultipleRespondWith += '(' + i + ')';
+    try {
+      event.respondWith(new Promise(function(resolve) {
+        setTimeout(function() {
+          resolve(new Response(logForMultipleRespondWith));
+        }, 0);
+      }));
+    } catch (e) {
+      logForMultipleRespondWith += '[' + e.name + ']';
+    }
+  }
+}
+
+var lastResponseForUsedCheck = undefined;
+
+function handleUsedCheck(event) {
+  if (!lastResponseForUsedCheck) {
+    event.respondWith(fetch('other.html').then(function(response) {
+        lastResponseForUsedCheck = response;
+        return response;
+      }));
+  } else {
+    event.respondWith(new Response(
+        'bodyUsed: ' + lastResponseForUsedCheck.bodyUsed));
+  }
+}
+function handleFragmentCheck(event) {
+  var body;
+  if (event.request.url.indexOf('#') === -1) {
+    body = 'Fragment Not Found';
+  } else {
+    body = 'Fragment Found :' +
+           event.request.url.substring(event.request.url.indexOf('#'));
+  }
+  event.respondWith(new Response(body));
+}
+function handleCache(event) {
+  event.respondWith(new Response(event.request.cache));
+}
+function handleEventSource(event) {
+  if (event.request.mode === 'navigate') {
+    return;
+  }
+  var data = {
+    mode: event.request.mode,
+    cache: event.request.cache,
+    credentials: event.request.credentials
+  };
+  var body = 'data:' + JSON.stringify(data) + '\n\n';
+  event.respondWith(new Response(body, {
+      headers: { 'Content-Type': 'text/event-stream' }
+    }
+  ));
+}
+
+function handleIntegrity(event) {
+  event.respondWith(new Response(event.request.integrity));
+}
+
+function handleRequestBody(event) {
+  event.respondWith(event.request.text().then(text => {
+    return new Response(text);
+  }));
+}
+
+function handleKeepalive(event) {
+  event.respondWith(new Response(event.request.keepalive));
+}
+
+function handleIsReloadNavigation(event) {
+  const request = event.request;
+  const body =
+    `method = ${request.method}, ` +
+    `isReloadNavigation = ${request.isReloadNavigation}`;
+  event.respondWith(new Response(body));
+}
+
+function handleIsHistoryNavigation(event) {
+  const request = event.request;
+  const body =
+    `method = ${request.method}, ` +
+    `isHistoryNavigation = ${request.isHistoryNavigation}`;
+  event.respondWith(new Response(body));
+}
+
+function handleUseAndIgnore(event) {
+  const request = event.request;
+  request.text();
+  return;
+}
+
+function handleCloneAndIgnore(event) {
+  const request = event.request;
+  request.clone().text();
+  return;
+}
+
+var handle_status_count = 0;
+function handleStatus(event) {
+  handle_status_count++;
+  event.respondWith(async function() {
+    const res = await fetch(event.request);
+    const text = await res.text();
+    return new Response(`${text}. Request was sent ${handle_status_count} times.`,
+      {"status": new URL(event.request.url).searchParams.get("status")});
+  }());
+}
+
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    var handlers = [
+      { pattern: '?headers', fn: handleHeaders },
+      { pattern: '?string', fn: handleString },
+      { pattern: '?blob', fn: handleBlob },
+      { pattern: '?referrerFull', fn: handleReferrerFull },
+      { pattern: '?referrerPolicy', fn: handleReferrerPolicy },
+      { pattern: '?referrer', fn: handleReferrer },
+      { pattern: '?clientId', fn: handleClientId },
+      { pattern: '?resultingClientId', fn: handleResultingClientId },
+      { pattern: '?ignore', fn: function() {} },
+      { pattern: '?null', fn: handleNullBody },
+      { pattern: '?fetch', fn: handleFetch },
+      { pattern: '?form-post', fn: handleFormPost },
+      { pattern: '?multiple-respond-with', fn: handleMultipleRespondWith },
+      { pattern: '?used-check', fn: handleUsedCheck },
+      { pattern: '?fragment-check', fn: handleFragmentCheck },
+      { pattern: '?cache', fn: handleCache },
+      { pattern: '?eventsource', fn: handleEventSource },
+      { pattern: '?integrity', fn: handleIntegrity },
+      { pattern: '?request-body', fn: handleRequestBody },
+      { pattern: '?keepalive', fn: handleKeepalive },
+      { pattern: '?isReloadNavigation', fn: handleIsReloadNavigation },
+      { pattern: '?isHistoryNavigation', fn: handleIsHistoryNavigation },
+      { pattern: '?use-and-ignore', fn: handleUseAndIgnore },
+      { pattern: '?clone-and-ignore', fn: handleCloneAndIgnore },
+      { pattern: '?status', fn: handleStatus },
+    ];
+
+    var handler = null;
+    for (var i = 0; i < handlers.length; ++i) {
+      if (url.indexOf(handlers[i].pattern) != -1) {
+        handler = handlers[i];
+        break;
+      }
+    }
+
+    if (handler) {
+      handler.fn(event);
+    } else {
+      event.respondWith(new Response(new Blob(
+        ['Service Worker got an unexpected request: ' + url])));
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-within-sw-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-within-sw-worker.js
new file mode 100644
index 000000000000..5903bab968dc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-event-within-sw-worker.js
@@ -0,0 +1,48 @@
+skipWaiting();
+
+addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+
+  if (url.origin != location.origin) return;
+
+  if (url.pathname.endsWith('/sample.txt')) {
+    event.respondWith(new Response('intercepted'));
+    return;
+  }
+
+  if (url.pathname.endsWith('/sample.txt-inner-fetch')) {
+    event.respondWith(fetch('sample.txt'));
+    return;
+  }
+
+  if (url.pathname.endsWith('/sample.txt-inner-cache')) {
+    event.respondWith(
+      caches.open('test-inner-cache').then(cache =>
+        cache.add('sample.txt').then(() => cache.match('sample.txt'))
+      )
+    );
+    return;
+  }
+
+  if (url.pathname.endsWith('/show-notification')) {
+    // Copy the currect search string onto the icon url
+    const iconURL = new URL('notification_icon.py', location);
+    iconURL.search = url.search;
+
+    event.respondWith(
+      registration.showNotification('test', {
+        icon: iconURL
+      }).then(() => registration.getNotifications()).then(notifications => {
+        for (const n of notifications) n.close();
+        return new Response('done');
+      })
+    );
+    return;
+  }
+
+  if (url.pathname.endsWith('/notification_icon.py')) {
+    new BroadcastChannel('icon-request').postMessage('yay');
+    event.respondWith(new Response('done'));
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-header-visibility-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-header-visibility-iframe.html
new file mode 100644
index 000000000000..0d9ab6ff9045
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-header-visibility-iframe.html
@@ -0,0 +1,66 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+  var host_info = get_host_info();
+  var uri = document.location + '?check-ua-header';
+
+  var headers = new Headers();
+  headers.set('User-Agent', 'custom_ua');
+
+  // Check the custom UA case
+  fetch(uri, { headers: headers }).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text == 'custom_ua') {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('withUA FAIL - expected "custom_ua", got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('withUA FAIL - unexpected error: ' + err, '*');
+  });
+
+  // Check the default UA case
+  fetch(uri, {}).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text == 'NO_UA') {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('noUA FAIL - expected "NO_UA", got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('noUA FAIL - unexpected error: ' + err, '*');
+  });
+
+  var uri = document.location + '?check-accept-header';
+  var headers = new Headers();
+  headers.set('Accept', 'hmm');
+
+  // Check for custom accept header
+  fetch(uri, { headers: headers }).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text === headers.get('Accept')) {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('custom accept FAIL - expected ' + headers.get('Accept') +
+                         ' got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('custom accept FAIL - unexpected error: ' + err, '*');
+  });
+
+  // Check for default accept header
+  fetch(uri).then(function(response) {
+    return response.text();
+  }).then(function(text) {
+    if (text === '*/*') {
+      parent.postMessage('PASS', '*');
+    } else {
+      parent.postMessage('accept FAIL - expected */* got "' + text + '"', '*');
+    }
+  }).catch(function(err) {
+    parent.postMessage('accept FAIL - unexpected error: ' + err, '*');
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-inscope.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-inscope.html
new file mode 100644
index 000000000000..64a634e9db7b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-inscope.html
@@ -0,0 +1,71 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var image_path = base_path() + 'fetch-access-control.py?PNGIMAGE';
+var host_info = get_host_info();
+var results = '';
+
+function test1() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test2();
+  };
+  img.onerror = function() {
+    results += 'FAIL(1)';
+    test2();
+  };
+  img.src = './sample?url=' +
+            encodeURIComponent(host_info['HTTPS_ORIGIN'] + image_path);
+}
+
+function test2() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test3();
+  };
+  img.onerror = function() {
+    results += 'FAIL(2)';
+    test3();
+  };
+  img.src = './sample?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTPS_REMOTE_ORIGIN'] + image_path);
+}
+
+function test3() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(3)';
+    test4();
+  };
+  img.onerror = function() {
+    test4();
+  };
+  img.src = './sample?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTP_ORIGIN'] + image_path);
+}
+
+function test4() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(4)';
+    finish();
+  };
+  img.onerror = function() {
+    finish();
+  };
+  img.src = './sample?mode=no-cors&url=' +
+            encodeURIComponent(host_info['HTTP_REMOTE_ORIGIN'] + image_path);
+}
+
+function finish() {
+  results += 'finish';
+  window.parent.postMessage({results: results}, host_info['HTTPS_ORIGIN']);
+}
+</script>
+
+<body onload='test1();'>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-outscope.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-outscope.html
new file mode 100644
index 000000000000..be0b5c8f561d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-outscope.html
@@ -0,0 +1,80 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var image_path = base_path() + 'fetch-access-control.py?PNGIMAGE';
+var host_info = get_host_info();
+var results = '';
+
+function test1() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test2();
+  };
+  img.onerror = function() {
+    results += 'FAIL(1)';
+    test2();
+  };
+  img.src = host_info['HTTPS_ORIGIN'] + image_path;
+}
+
+function test2() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    test3();
+  };
+  img.onerror = function() {
+    results += 'FAIL(2)';
+    test3();
+  };
+  img.src = host_info['HTTPS_REMOTE_ORIGIN'] + image_path;
+}
+
+function test3() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(3)';
+    test4();
+  };
+  img.onerror = function() {
+    test4();
+  };
+  img.src = host_info['HTTP_ORIGIN'] + image_path;
+}
+
+function test4() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    results += 'FAIL(4)';
+    test5();
+  };
+  img.onerror = function() {
+    test5();
+  };
+  img.src = host_info['HTTP_REMOTE_ORIGIN'] + image_path;
+}
+
+function test5() {
+  var img = document.createElement('img');
+  document.body.appendChild(img);
+  img.onload = function() {
+    finish();
+  };
+  img.onerror = function() {
+    results += 'FAIL(5)';
+    finish();
+  };
+  img.src = './sample?generate-png';
+}
+
+function finish() {
+  results += 'finish';
+  window.parent.postMessage({results: results}, host_info['HTTPS_ORIGIN']);
+}
+</script>
+
+<body onload='test1();'>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe.html
new file mode 100644
index 000000000000..2831c381b5e4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-mixed-content-iframe.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var params = get_query_params(location.href);
+var SCOPE = 'fetch-mixed-content-iframe-inscope-to-' + params['target'] + '.html';
+var URL = 'fetch-rewrite-worker.js';
+var host_info = get_host_info();
+
+window.addEventListener('message', on_message, false);
+
+navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(registration) {
+      if (registration)
+        return registration.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(URL, {scope: SCOPE});
+    })
+  .then(function(registration) {
+      return new Promise(function(resolve) {
+          registration.addEventListener('updatefound', function() {
+              resolve(registration.installing);
+            });
+        });
+    })
+  .then(function(worker) {
+      worker.addEventListener('statechange', on_state_change);
+    })
+  .catch(function(reason) {
+      window.parent.postMessage({results: 'FAILURE: ' + reason.message},
+                                host_info['HTTPS_ORIGIN']);
+     });
+
+function on_state_change(event) {
+  if (event.target.state != 'activated')
+    return;
+  var frame = document.createElement('iframe');
+  frame.src = SCOPE;
+  document.body.appendChild(frame);
+}
+
+function on_message(e) {
+  navigator.serviceWorker.getRegistration(SCOPE)
+    .then(function(registration) {
+        if (registration)
+          return registration.unregister();
+      })
+    .then(function() {
+      window.parent.postMessage(e.data, host_info['HTTPS_ORIGIN']);
+    })
+    .catch(function(reason) {
+        window.parent.postMessage({results: 'FAILURE: ' + reason.message},
+                                  host_info['HTTPS_ORIGIN']);
+     });
+}
+
+function get_query_params(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-iframe.html
new file mode 100644
index 000000000000..504e10435642
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-iframe.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<title>iframe for css base url test</title>
+</head>
+<body>
+<script>
+// Load a stylesheet. Create it dynamically so we can construct the href URL
+// dynamically.
+const link = document.createElement('link');
+link.rel = 'stylesheet';
+link.type = 'text/css';
+// Add "request-url-path" to the path to help distinguish the request URL from
+// the response URL. Add |document.location.search| (chosen by the test main
+// page) to tell the service worker how to respond to the request.
+link.href = 'request-url-path/fetch-request-css-base-url-style.css' +
+    document.location.search;
+document.head.appendChild(link);
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-style.css b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-style.css
new file mode 100644
index 000000000000..f14fcaae7275
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-style.css
@@ -0,0 +1 @@
+body { background-image: url("./sample.png");}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-worker.js
new file mode 100644
index 000000000000..f3d6a73bdde8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-base-url-worker.js
@@ -0,0 +1,45 @@
+let source;
+let resolveDone;
+let done = new Promise(resolve => resolveDone = resolve);
+
+// The page messages this worker to ask for the result. Keep the worker alive
+// via waitUntil() until the result is sent.
+self.addEventListener('message', event => {
+  source = event.data.port;
+  source.postMessage('pong');
+  event.waitUntil(done);
+});
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+
+  // For the CSS file, respond in a way that may change the response URL,
+  // depending on |url.search|.
+  const cssPath = 'request-url-path/fetch-request-css-base-url-style.css';
+  if (url.pathname.indexOf(cssPath) != -1) {
+    // Respond with a different URL, deleting "request-url-path/".
+    if (url.search == '?fetch') {
+      event.respondWith(fetch('fetch-request-css-base-url-style.css?fetch'));
+    }
+    // Respond with new Response().
+    else if (url.search == '?newResponse') {
+      const styleString = 'body { background-image: url("./sample.png");}';
+      const headers = {'content-type': 'text/css'};
+      event.respondWith(new Response(styleString, headers));
+    }
+  }
+
+  // The image request indicates what the base URL of the CSS was. Message the
+  // result back to the test page.
+  else if (url.pathname.indexOf('sample.png') != -1) {
+    // For some reason |source| is undefined here when running the test manually
+    // in Firefox. The test author experimented with both using Client
+    // (event.source) and MessagePort to try to get the test to pass, but
+    // failed.
+    source.postMessage({
+      url: event.request.url,
+      referrer: event.request.referrer
+    });
+    resolveDone();
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.css b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.css
new file mode 100644
index 000000000000..9a7545d07021
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.css
@@ -0,0 +1 @@
+#crossOriginCss { color: blue; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.html
new file mode 100644
index 000000000000..3211f78084d7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-cross.html
@@ -0,0 +1 @@
+#crossOriginHtml { color: red; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-iframe.html
new file mode 100644
index 000000000000..9a4adedb84d4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-iframe.html
@@ -0,0 +1,17 @@
+<style type="text/css">
+#crossOriginCss { color: red; }
+#crossOriginHtml { color: blue; }
+#sameOriginCss { color: red; }
+#sameOriginHtml { color: red; }
+#synthetic { color: red; }
+</style>
+<link href="./cross-origin-css.css?mime=no" rel="stylesheet" type="text/css">
+<link href="./cross-origin-html.css?mime=no" rel="stylesheet" type="text/css">
+<link href="./fetch-request-css-cross-origin-mime-check-same.css" rel="stylesheet" type="text/css">
+<link href="./fetch-request-css-cross-origin-mime-check-same.html" rel="stylesheet" type="text/css">
+<link href="./synthetic.css?mime=no" rel="stylesheet" type="text/css">
+<h1 id=crossOriginCss>I should be blue</h1>
+<h1 id=crossOriginHtml>I should be blue</h1>
+<h1 id=sameOriginCss>I should be blue</h1>
+<h1 id=sameOriginHtml>I should be blue</h1>
+<h1 id=synthetic>I should be blue</h1>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.css b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.css
new file mode 100644
index 000000000000..55455bd5da58
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.css
@@ -0,0 +1 @@
+#sameOriginCss { color: blue; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.html
new file mode 100644
index 000000000000..6fad4b9ff048
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-mime-check-same.html
@@ -0,0 +1 @@
+#sameOriginHtml { color: blue; }
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-read-contents.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-read-contents.html
new file mode 100644
index 000000000000..c902366b023a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-read-contents.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe: cross-origin CSS via service worker</title>
+
+<!-- Service worker responds with a cross-origin opaque response. -->
+<link href="cross-origin-css.css" rel="stylesheet" type="text/css">
+
+<!-- Service worker responds with a cross-origin CORS approved response. -->
+<link href="cross-origin-css.css?cors" rel="stylesheet" type="text/css">
+
+<!-- Service worker falls back to network. This is a same-origin response. -->
+<link href="fetch-request-css-cross-origin-mime-check-same.css" rel="stylesheet" type="text/css">
+
+<!-- Service worker responds with a new Response() synthetic response. -->
+<link href="synthetic.css" rel="stylesheet" type="text/css">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-worker.js
new file mode 100644
index 000000000000..a71e91216c10
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-css-cross-origin-worker.js
@@ -0,0 +1,65 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+const HOST_INFO = get_host_info();
+const REMOTE_ORIGIN = HOST_INFO.HTTPS_REMOTE_ORIGIN;
+const BASE_PATH = base_path();
+const CSS_FILE = 'fetch-request-css-cross-origin-mime-check-cross.css';
+const HTML_FILE = 'fetch-request-css-cross-origin-mime-check-cross.html';
+
+function add_pipe_header(url_str, header) {
+  if (url_str.indexOf('?pipe=') == -1) {
+    url_str += '?pipe=';
+  } else {
+    url_str += '|';
+  }
+  url_str += `header${header}`;
+  return url_str;
+}
+
+self.addEventListener('fetch', function(event) {
+    const url = new URL(event.request.url);
+
+    const use_mime =
+        (url.searchParams.get('mime') != 'no');
+    const mime_header = '(Content-Type, text/css)';
+
+    const use_cors =
+        (url.searchParams.has('cors'));
+    const cors_header = '(Access-Control-Allow-Origin, *)';
+
+    const file = url.pathname.substring(url.pathname.lastIndexOf('/') + 1);
+
+    // Respond with a cross-origin CSS resource, using CORS if desired.
+    if (file == 'cross-origin-css.css') {
+      let fetch_url =  REMOTE_ORIGIN + BASE_PATH + CSS_FILE;
+      if (use_mime)
+        fetch_url = add_pipe_header(fetch_url, mime_header);
+      if (use_cors)
+        fetch_url = add_pipe_header(fetch_url, cors_header);
+      const mode = use_cors ? 'cors' : 'no-cors';
+      event.respondWith(fetch(fetch_url, {'mode': mode}));
+      return;
+    }
+
+    // Respond with a cross-origin CSS resource with an HTML name. This is only
+    // used in the MIME sniffing test, so MIME is never added.
+    if (file == 'cross-origin-html.css') {
+      const fetch_url = REMOTE_ORIGIN + BASE_PATH + HTML_FILE;
+      event.respondWith(fetch(fetch_url, {mode: 'no-cors'}));
+      return;
+    }
+
+    // Respond with synthetic CSS.
+    if (file == 'synthetic.css') {
+      let headers = {};
+      if (use_mime) {
+        headers['Content-Type'] = 'text/css';
+      }
+
+      event.respondWith(new Response("#synthetic { color: blue; }", {headers}));
+      return;
+    }
+
+    // Otherwise, fallback to network.
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-iframe.html
new file mode 100644
index 000000000000..d117d0f55ef3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-iframe.html
@@ -0,0 +1,32 @@
+<script>
+function xhr(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener(
+        'error',
+        function() { reject(new Error()); });
+      request.addEventListener(
+        'load',
+        function(event) { resolve(request.response); });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function load_image(url, cross_origin) {
+  return new Promise(function(resolve, reject) {
+      var img = document.createElement('img');
+      document.body.appendChild(img);
+      img.onload = function() {
+        resolve();
+      };
+      img.onerror = function() {
+        reject(new Error());
+      };
+      if (cross_origin != '') {
+        img.crossOrigin = cross_origin;
+      }
+      img.src = url;
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-worker.js
new file mode 100644
index 000000000000..3b028b24bde4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-fallback-worker.js
@@ -0,0 +1,13 @@
+var requests = [];
+
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage({requests: requests});
+    requests = [];
+  });
+
+self.addEventListener('fetch', function(event) {
+    requests.push({
+        url: event.request.url,
+        mode: event.request.mode
+      });
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-iframe.html
new file mode 100644
index 000000000000..07a084257a8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-iframe.html
@@ -0,0 +1,13 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script type="text/javascript">
+  var hostInfo = get_host_info();
+  var makeLink = function(id, url) {
+      var link = document.createElement('link');
+      link.rel = 'import'
+      link.id = id;
+      link.href = url;
+      document.documentElement.appendChild(link);
+    };
+  makeLink('same', hostInfo.HTTPS_ORIGIN + '/sample-dir/same.html');
+  makeLink('other', hostInfo.HTTPS_REMOTE_ORIGIN + '/sample-dir/other.html');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-worker.js
new file mode 100644
index 000000000000..110727bd52cf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-html-imports-worker.js
@@ -0,0 +1,30 @@
+importScripts('/common/get-host-info.sub.js');
+var host_info = get_host_info();
+
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample-dir') == -1) {
+      return;
+    }
+    var result = 'mode=' + event.request.mode +
+      ' credentials=' + event.request.credentials;
+    if (url == host_info.HTTPS_ORIGIN + '/sample-dir/same.html') {
+      event.respondWith(new Response(
+        result +
+        '<link id="same-same" rel="import" ' +
+        'href="' + host_info.HTTPS_ORIGIN + '/sample-dir/same-same.html">' +
+        '<link id="same-other" rel="import" ' +
+        ' href="' + host_info.HTTPS_REMOTE_ORIGIN +
+        '/sample-dir/same-other.html">'));
+    } else if (url == host_info.HTTPS_REMOTE_ORIGIN + '/sample-dir/other.html') {
+      event.respondWith(new Response(
+        result +
+        '<link id="other-same" rel="import" ' +
+        ' href="' + host_info.HTTPS_ORIGIN + '/sample-dir/other-same.html">' +
+        '<link id="other-other" rel="import" ' +
+        ' href="' + host_info.HTTPS_REMOTE_ORIGIN +
+        '/sample-dir/other-other.html">'));
+    } else {
+      event.respondWith(new Response(result));
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-iframe.html
new file mode 100644
index 000000000000..e6e9380ba622
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-iframe.html
@@ -0,0 +1 @@
+<script src="./fetch-request-no-freshness-headers-script.py"></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-worker.js
new file mode 100644
index 000000000000..2bd59d739225
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-no-freshness-headers-worker.js
@@ -0,0 +1,18 @@
+var requests = [];
+
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage({requests: requests});
+  });
+
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    var headers = [];
+    for (var header of event.request.headers) {
+      headers.push(header);
+    }
+    requests.push({
+        url: url,
+        headers: headers
+      });
+    event.respondWith(fetch(event.request));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-redirect-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-redirect-iframe.html
new file mode 100644
index 000000000000..ffd76bfc4990
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-redirect-iframe.html
@@ -0,0 +1,35 @@
+<script>
+function xhr(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener(
+        'error',
+        function(event) { reject(event); });
+      request.addEventListener(
+        'load',
+        function(event) { resolve(request.response); });
+      request.open('GET', url);
+      request.send();
+    });
+}
+
+function load_image(url) {
+  return new Promise(function(resolve, reject) {
+      var img = document.createElement('img');
+      document.body.appendChild(img);
+      img.onload = resolve;
+      img.onerror = reject;
+      img.src = url;
+    });
+}
+
+function load_audio(url) {
+  return new Promise(function(resolve, reject) {
+      var audio = document.createElement('audio');
+      document.body.appendChild(audio);
+      audio.oncanplay = resolve;
+      audio.onerror = reject;
+      audio.src = url;
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html
new file mode 100644
index 000000000000..37fc491134d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html
@@ -0,0 +1,126 @@
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script type="importmap">
+{
+  "integrity": {
+    "./sample?test_module": "sha384-foobar",
+    "./sample?test_modulepreload": "sha384-foobar",
+    "./sample?test_moduleimport": "sha384-foobar",
+    "./sample?test_moduleimportdynamic": "sha384-foobar"
+  }
+}
+</script>
+<script>
+
+function load_image(url, cross_origin) {
+  const img = document.createElement('img');
+  if (cross_origin != '') {
+    img.crossOrigin = cross_origin;
+  }
+  img.src = url;
+}
+
+function load_script(url, cross_origin) {
+  const script = document.createElement('script');
+  script.src = url;
+  if (cross_origin != '') {
+    script.crossOrigin = cross_origin;
+  }
+  document.body.appendChild(script);
+}
+
+function load_css(url, cross_origin) {
+  const link = document.createElement('link');
+  link.rel = 'stylesheet'
+  link.href = url;
+  link.type = 'text/css';
+  if (cross_origin != '') {
+    link.crossOrigin = cross_origin;
+  }
+  document.body.appendChild(link);
+}
+
+function load_font(url) {
+  const fontFace = new FontFace('test', 'url(' + url + ')');
+  fontFace.load();
+}
+
+function load_css_image(url, type) {
+  const div = document.createElement('div');
+  document.body.appendChild(div);
+  div.style[type] = 'url(' + url + ')';
+}
+
+function load_css_image_set(url, type) {
+  const div = document.createElement('div');
+  document.body.appendChild(div);
+  div.style[type] = 'image-set(url(' + url + ') 1x)';
+  if (!div.style[type]) {
+    div.style[type] = '-webkit-image-set(url(' + url + ') 1x)';
+  }
+}
+
+function load_script_with_integrity(url, integrity, type) {
+  const script = document.createElement('script');
+  if (type) {
+    script.type = type;
+  }
+  script.src = url;
+  if (integrity) {
+    script.integrity = integrity;
+  }
+  document.body.appendChild(script);
+}
+
+function import_modulescript(url) {
+  const script = document.createElement('script');
+  script.type = "module";
+  script.innerHTML = `import "${url}";`;
+  document.body.appendChild(script);
+}
+
+function import_dynamic_modulescript(url) {
+  const script = document.createElement('script');
+  script.type = "module";
+  script.innerHTML = `import("${url}");`;
+  document.body.appendChild(script);
+}
+
+function load_modulepreload_with_integrity(url, integrity) {
+  const link = document.createElement('link');
+  link.href = url;
+  if (integrity) {
+    link.integrity = integrity;
+  }
+  link.rel = "modulepreload";
+  document.body.appendChild(link);
+}
+
+function load_css_with_integrity(url, integrity) {
+  const link = document.createElement('link');
+  link.rel = 'stylesheet'
+  link.href = url;
+  link.type = 'text/css';
+  link.integrity = integrity;
+  document.body.appendChild(link);
+}
+
+function load_audio(url, cross_origin) {
+  const audio = document.createElement('audio');
+  if (cross_origin != '') {
+    audio.crossOrigin = cross_origin;
+  }
+  audio.src = url;
+  document.body.appendChild(audio);
+}
+
+function load_video(url, cross_origin) {
+  const video = document.createElement('video');
+  if (cross_origin != '') {
+    video.crossOrigin = cross_origin;
+  }
+  video.src = url;
+  document.body.appendChild(video);
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-worker.js
new file mode 100644
index 000000000000..983cccb8db78
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-resources-worker.js
@@ -0,0 +1,26 @@
+const requests = [];
+let port = undefined;
+
+self.onmessage = e => {
+  const message = e.data;
+  if ('port' in message) {
+    port = message.port;
+    port.postMessage({ready: true});
+  }
+};
+
+self.addEventListener('fetch', e => {
+  const url = e.request.url;
+  if (!url.includes('sample?test')) {
+    return;
+  }
+  port.postMessage({
+    url: url,
+    mode: e.request.mode,
+    redirect: e.request.redirect,
+    credentials: e.request.credentials,
+    integrity: e.request.integrity,
+    destination: e.request.destination
+  });
+  e.respondWith(Promise.reject());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-iframe.https.html
new file mode 100644
index 000000000000..b3ddec1a701b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-iframe.https.html
@@ -0,0 +1,208 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+var host_info = get_host_info();
+
+function get_boundary(headers) {
+  var reg = new RegExp('multipart\/form-data; boundary=(.*)');
+  for (var i = 0; i < headers.length; ++i) {
+    if (headers[i][0] != 'content-type') {
+      continue;
+    }
+    var regResult = reg.exec(headers[i][1]);
+    if (!regResult) {
+      continue;
+    }
+    return regResult[1];
+  }
+  return '';
+}
+
+function xhr_send(url_base, method, data, with_credentials) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        resolve(JSON.parse(xhr.response));
+      };
+      xhr.onerror = function() {
+        reject('XHR should succeed.');
+      };
+      xhr.responseType = 'text';
+      if (with_credentials) {
+        xhr.withCredentials = true;
+      }
+      xhr.open(method, url_base + '/sample?test', true);
+      xhr.send(data);
+    });
+}
+
+function get_sorted_header_name_list(headers) {
+  var header_names = [];
+  var idx, name;
+
+  for (idx = 0; idx < headers.length; ++idx) {
+    name = headers[idx][0];
+    // The `Accept-Language` header is optional; its presence should not
+    // influence test results.
+    //
+    // > 4. If request’s header list does not contain `Accept-Language`, user
+    // >    agents should append `Accept-Language`/an appropriate value to
+    // >    request's header list.
+    //
+    // https://fetch.spec.whatwg.org/#fetching
+    if (name === 'accept-language') {
+      continue;
+    }
+
+    header_names.push(name);
+  }
+  header_names.sort();
+  return header_names;
+}
+
+function get_header_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'GET', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept"],
+          'event.request has the expected headers for same-origin GET.');
+      });
+}
+
+function post_header_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept", "content-type"],
+          'event.request has the expected headers for same-origin POST.');
+      });
+}
+
+function cross_origin_get_header_test() {
+  return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'GET', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept"],
+          'event.request has the expected headers for cross-origin GET.');
+      });
+}
+
+function cross_origin_post_header_test() {
+  return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'POST', '', false)
+    .then(function(response) {
+        assert_array_equals(
+          get_sorted_header_name_list(response.headers),
+          ["accept", "content-type"],
+          'event.request has the expected headers for cross-origin POST.');
+      });
+}
+
+function string_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', 'test string', false)
+    .then(function(response) {
+        assert_equals(response.method, 'POST');
+        assert_equals(response.body, 'test string');
+      });
+}
+
+function blob_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', new Blob(['test blob']),
+                  false)
+    .then(function(response) {
+        assert_equals(response.method, 'POST');
+        assert_equals(response.body, 'test blob');
+      });
+}
+
+function custom_method_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'XXX', 'test string xxx', false)
+    .then(function(response) {
+        assert_equals(response.method, 'XXX');
+        assert_equals(response.body, 'test string xxx');
+      });
+}
+
+function options_method_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'OPTIONS', 'test string xxx', false)
+    .then(function(response) {
+        assert_equals(response.method, 'OPTIONS');
+        assert_equals(response.body, 'test string xxx');
+      });
+}
+
+function form_data_test() {
+    var formData = new FormData();
+    formData.append('sample string', '1234567890');
+    formData.append('sample blob', new Blob(['blob content']));
+    formData.append('sample file', new File(['file content'], 'file.dat'));
+    return xhr_send(host_info['HTTPS_ORIGIN'], 'POST', formData, false)
+    .then(function(response) {
+        assert_equals(response.method, 'POST');
+        var boundary = get_boundary(response.headers);
+        var expected_body =
+          '--' + boundary + '\r\n' +
+          'Content-Disposition: form-data; name="sample string"\r\n' +
+          '\r\n' +
+          '1234567890\r\n' +
+          '--' + boundary + '\r\n' +
+          'Content-Disposition: form-data; name="sample blob"; ' +
+          'filename="blob"\r\n' +
+          'Content-Type: application/octet-stream\r\n' +
+          '\r\n' +
+          'blob content\r\n' +
+          '--' + boundary + '\r\n' +
+          'Content-Disposition: form-data; name="sample file"; ' +
+          'filename="file.dat"\r\n' +
+          'Content-Type: application/octet-stream\r\n' +
+          '\r\n' +
+          'file content\r\n' +
+          '--' + boundary + '--\r\n';
+        assert_equals(response.body, expected_body, "form data response content is as expected");
+      });
+}
+
+function mode_credentials_test() {
+  return xhr_send(host_info['HTTPS_ORIGIN'], 'GET', '', false)
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'same-origin');
+        return xhr_send(host_info['HTTPS_ORIGIN'], 'GET', '', true);
+      })
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'include');
+        return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'GET', '', false);
+      })
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'same-origin');
+        return xhr_send(host_info['HTTPS_REMOTE_ORIGIN'], 'GET', '', true);
+      })
+    .then(function(response){
+        assert_equals(response.mode, 'cors');
+        assert_equals(response.credentials, 'include');
+      });
+}
+
+function data_url_test() {
+  return new Promise(function(resolve, reject) {
+        var xhr = new XMLHttpRequest();
+        xhr.onload = function() {
+          resolve(xhr.response);
+        };
+        xhr.onerror = function() {
+          reject('XHR should succeed.');
+        };
+        xhr.responseType = 'text';
+        xhr.open('GET', 'data:text/html,Foobar', true);
+        xhr.send();
+      })
+    .then(function(data) {
+        assert_equals(data, 'Foobar');
+      });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-error-worker.js
new file mode 100644
index 000000000000..b8d3db99bcc8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-error-worker.js
@@ -0,0 +1,19 @@
+"use strict";
+
+self.onfetch = event => {
+  if (event.request.url.endsWith("non-existent-stream-1.txt")) {
+    const rs1 = new ReadableStream();
+    event.respondWith(new Response(rs1));
+    rs1.cancel(1);
+  } else if (event.request.url.endsWith("non-existent-stream-2.txt")) {
+    const rs2 = new ReadableStream({
+      start(controller) { controller.error(1) }
+    });
+    event.respondWith(new Response(rs2));
+  } else if (event.request.url.endsWith("non-existent-stream-3.txt")) {
+    const rs3 = new ReadableStream({
+      pull(controller) { controller.error(1) }
+    });
+    event.respondWith(new Response(rs3));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-iframe.html
new file mode 100644
index 000000000000..900762ffc6cc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-iframe.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Service Worker: Synchronous XHR is intercepted iframe</title>
+<script>
+'use strict';
+
+function performSyncXHR(url) {
+  var syncXhr = new XMLHttpRequest();
+  syncXhr.open('GET', url, false);
+  syncXhr.send();
+
+  return syncXhr;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-on-worker-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-on-worker-worker.js
new file mode 100644
index 000000000000..0d24ffc1f333
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-on-worker-worker.js
@@ -0,0 +1,41 @@
+'use strict';
+
+self.onfetch = function(event) {
+  if (event.request.url.indexOf('non-existent-file.txt') !== -1) {
+    event.respondWith(new Response('Response from service worker'));
+  } else if (event.request.url.indexOf('/iframe_page') !== -1) {
+    event.respondWith(new Response(
+        '<!DOCTYPE html>\n' +
+        '<script>\n' +
+        'function performSyncXHROnWorker(url) {\n' +
+        '  return new Promise((resolve) => {\n' +
+        '    var worker =\n' +
+        '        new Worker(\'./worker_script\');\n' +
+        '    worker.addEventListener(\'message\', (msg) => {\n' +
+        '      resolve(msg.data);\n' +
+        '    });\n' +
+        '    worker.postMessage({\n' +
+        '      url: url\n' +
+        '    });\n' +
+        '  });\n' +
+        '}\n' +
+        '</script>',
+        {
+          headers: [['content-type', 'text/html']]
+        }));
+  } else if (event.request.url.indexOf('/worker_script') !== -1) {
+    event.respondWith(new Response(
+        'self.onmessage = (msg) => {' +
+        '  const syncXhr = new XMLHttpRequest();' +
+        '  syncXhr.open(\'GET\', msg.data.url, false);' +
+        '  syncXhr.send();' +
+        '  self.postMessage({' +
+        '    status: syncXhr.status,' +
+        '    responseText: syncXhr.responseText' +
+        '  });' +
+        '}',
+        {
+          headers: [['content-type', 'application/javascript']]
+        }));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-worker.js
new file mode 100644
index 000000000000..070e572f4004
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-sync-worker.js
@@ -0,0 +1,7 @@
+'use strict';
+
+self.onfetch = function(event) {
+  if (event.request.url.indexOf('non-existent-file.txt') !== -1) {
+    event.respondWith(new Response('Response from service worker'));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-worker.js
new file mode 100644
index 000000000000..4e428374bc22
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-request-xhr-worker.js
@@ -0,0 +1,22 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        var headers = [];
+        for (var header of event.request.headers) {
+          headers.push(header);
+        }
+        event.request.text()
+          .then(function(result) {
+              resolve(new Response(JSON.stringify({
+                  method: event.request.method,
+                  mode: event.request.mode,
+                  credentials: event.request.credentials,
+                  headers: headers,
+                  body: result
+                })));
+            });
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-taint-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-taint-iframe.html
new file mode 100644
index 000000000000..5f09efe28dff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-taint-iframe.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-iframe.https.html
new file mode 100644
index 000000000000..c26eebee49d8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-iframe.https.html
@@ -0,0 +1,53 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js?pipe=sub"></script>
+<script>
+var host_info = get_host_info();
+
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        resolve(xhr);
+      };
+      xhr.onerror = function() {
+        reject('XHR should succeed.');
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+function coalesce_headers_test() {
+  return xhr_send('POST', 'test string')
+  .then(function(xhr) {
+      window.parent.postMessage({results: xhr.getResponseHeader('foo')},
+                                host_info['HTTPS_ORIGIN']);
+
+      return new Promise(function(resolve) {
+          window.addEventListener('message', function handle(evt) {
+              if (evt.data !== 'ACK') {
+                return;
+              }
+
+              window.removeEventListener('message', handle);
+              resolve();
+            });
+        });
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port;
+
+    if (evt.data !== 'START') {
+      return;
+    }
+
+    port = evt.ports[0];
+
+    coalesce_headers_test()
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-worker.js
new file mode 100644
index 000000000000..0301b12c18a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response-xhr-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        var headers = new Headers;
+        headers.append('foo', 'foo');
+        headers.append('foo', 'bar');
+        resolve(new Response('hello world', {'headers': headers}));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.html b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.html
new file mode 100644
index 000000000000..6d27cf19e56f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+
+<script>
+    const params  =new URLSearchParams(location.search);
+    const mode = params.get("mode") || "cors";
+    const path = params.get('path');
+    const bufferPromise =
+      new Promise(resolve =>
+        fetch(path, {mode})
+          .then(response => resolve(response.arrayBuffer()))
+          .catch(() => resolve(new Uint8Array())));
+
+    const entryPromise = new Promise(resolve => {
+      new PerformanceObserver(entries => {
+        const byName = entries.getEntriesByType("resource").find(e => e.name.includes(path));
+        if (byName)
+          resolve(byName);
+      }).observe({entryTypes: ["resource"]});
+    });
+
+    Promise.all([bufferPromise, entryPromise]).then(([buffer, entry]) => {
+      parent.postMessage({
+        buffer,
+        entry: entry.toJSON(),
+    }, '*');
+    });
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.js
new file mode 100644
index 000000000000..775efc0bbd20
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-response.js
@@ -0,0 +1,35 @@
+self.addEventListener('fetch', event => {
+    const path = event.request.url.match(/\/(?<name>[^\/]+)$/);
+    switch (path?.groups?.name) {
+        case 'constructed':
+            event.respondWith(new Response(new Uint8Array([1, 2, 3])));
+            break;
+        case 'forward':
+            event.respondWith(fetch('/common/text-plain.txt'));
+            break;
+        case 'stream':
+            event.respondWith((async() => {
+                const res = await fetch('/common/text-plain.txt');
+                const body = await res.body;
+                const reader = await body.getReader();
+                const stream = new ReadableStream({
+                    async start(controller) {
+                        while (true) {
+                            const {done, value} = await reader.read();
+                            if (done)
+                                break;
+
+                            controller.enqueue(value);
+                        }
+                        controller.close();
+                        reader.releaseLock();
+                    }
+                });
+                return new Response(stream);
+            })());
+            break;
+        default:
+          event.respondWith(fetch(event.request));
+          break;
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js
new file mode 100644
index 000000000000..64c99c95d86c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js
@@ -0,0 +1,4 @@
+// This script is intended to be served with the `Referrer-Policy` header as
+// defined in the corresponding `.headers` file.
+
+importScripts('fetch-rewrite-worker.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js.headers b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js.headers
new file mode 100644
index 000000000000..5ae4265418e3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker-referrer-policy.js.headers
@@ -0,0 +1,2 @@
+Content-Type: application/javascript
+Referrer-Policy: origin
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js
new file mode 100644
index 000000000000..20a80665270d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js
@@ -0,0 +1,166 @@
+// By default, this worker responds to fetch events with
+// respondWith(fetch(request)). Additionally, if the request has a &url
+// parameter, it fetches the provided URL instead. Because it forwards fetch
+// events to this other URL, it is called the "fetch rewrite" worker.
+//
+// The worker also looks for other params on the request to do more custom
+// behavior, like falling back to network or throwing an error.
+
+function get_query_params(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+
+function get_request_init(base, params) {
+  var init = {};
+  init['method'] = params['method'] || base['method'];
+  init['mode'] = params['mode'] || base['mode'];
+  if (init['mode'] == 'navigate') {
+    init['mode'] = 'same-origin';
+  }
+  init['credentials'] = params['credentials'] || base['credentials'];
+  init['redirect'] = params['redirect-mode'] || base['redirect'];
+  return init;
+}
+
+self.addEventListener('fetch', function(event) {
+    var params = get_query_params(event.request.url);
+    var init = get_request_init(event.request, params);
+    var url = params['url'];
+    if (params['ignore']) {
+      return;
+    }
+    if (params['throw']) {
+      throw new Error('boom');
+    }
+    if (params['reject']) {
+      event.respondWith(new Promise(function(resolve, reject) {
+          reject();
+        }));
+      return;
+    }
+    if (params['resolve-null']) {
+      event.respondWith(new Promise(function(resolve) {
+          resolve(null);
+        }));
+      return;
+    }
+    if (params['generate-png']) {
+      var binary = atob(
+          'iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAA' +
+          'RnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAAhSURBVDhPY3wro/Kf' +
+          'gQLABKXJBqMGjBoAAqMGDLwBDAwAEsoCTFWunmQAAAAASUVORK5CYII=');
+      var array = new Uint8Array(binary.length);
+      for(var i = 0; i < binary.length; i++) {
+        array[i] = binary.charCodeAt(i);
+      };
+      event.respondWith(new Response(new Blob([array], {type: 'image/png'})));
+      return;
+    }
+    if (params['check-ua-header']) {
+      var ua = event.request.headers.get('User-Agent');
+      if (ua) {
+        // We have a user agent!
+        event.respondWith(new Response(new Blob([ua])));
+      } else {
+        // We don't have a user-agent!
+        event.respondWith(new Response(new Blob(["NO_UA"])));
+      }
+      return;
+    }
+    if (params['check-accept-header']) {
+      var accept = event.request.headers.get('Accept');
+      if (accept) {
+        event.respondWith(new Response(accept));
+      } else {
+        event.respondWith(new Response('NO_ACCEPT'));
+      }
+      return;
+    }
+    event.respondWith(new Promise(function(resolve, reject) {
+        var request = event.request;
+        if (url) {
+          request = new Request(url, init);
+        } else if (params['change-request']) {
+          request = new Request(request, init);
+        }
+        const response_promise = params['navpreload'] ? event.preloadResponse
+                                                      : fetch(request);
+        response_promise.then(function(response) {
+          var expectedType = params['expected_type'];
+          if (expectedType && response.type !== expectedType) {
+            // Resolve a JSON object with a failure instead of rejecting
+            // in order to distinguish this from a NetworkError, which
+            // may be expected even if the type is correct.
+            resolve(new Response(JSON.stringify({
+              result: 'failure',
+              detail: 'got ' + response.type + ' Response.type instead of ' +
+                      expectedType
+            })));
+          }
+
+          var expectedRedirected = params['expected_redirected'];
+          if (typeof expectedRedirected !== 'undefined') {
+            var expected_redirected = (expectedRedirected === 'true');
+            if(response.redirected !== expected_redirected) {
+              // This is simply determining how to pass an error to the outer
+              // test case(fetch-request-redirect.https.html).
+              var execptedResolves = params['expected_resolves'];
+              if (execptedResolves === 'true') {
+                // Reject a JSON object with a failure since promise is expected
+                // to be resolved.
+                reject(new Response(JSON.stringify({
+                  result: 'failure',
+                  detail: 'got '+ response.redirected +
+                          ' Response.redirected instead of ' +
+                          expectedRedirected
+                })));
+              } else {
+                // Resolve a JSON object with a failure since promise is
+                // expected to be rejected.
+                resolve(new Response(JSON.stringify({
+                  result: 'failure',
+                  detail: 'got '+ response.redirected +
+                          ' Response.redirected instead of ' +
+                          expectedRedirected
+                })));
+              }
+            }
+          }
+
+          if (params['clone']) {
+            response = response.clone();
+          }
+
+          // |cache| means to bounce responses through Cache Storage and back.
+          if (params['cache']) {
+            var cacheName = "cached-fetches-" + performance.now() + "-" +
+                            event.request.url;
+            var cache;
+            var cachedResponse;
+            return self.caches.open(cacheName).then(function(opened) {
+              cache = opened;
+              return cache.put(request, response);
+            }).then(function() {
+              return cache.match(request);
+            }).then(function(cached) {
+              cachedResponse = cached;
+              return self.caches.delete(cacheName);
+            }).then(function() {
+               resolve(cachedResponse);
+            });
+          } else {
+            resolve(response);
+          }
+        }, reject)
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js.headers b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js.headers
new file mode 100644
index 000000000000..123053b38c66
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-rewrite-worker.js.headers
@@ -0,0 +1,2 @@
+Content-Type: text/javascript
+Service-Worker-Allowed: /
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-variants-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-variants-worker.js
new file mode 100644
index 000000000000..b950b9a18a6a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-variants-worker.js
@@ -0,0 +1,35 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+importScripts('/resources/testharness.js');
+
+const storedResponse = new Response(new Blob(['a simple text file']))
+const absolultePath = `${base_path()}/simple.txt`
+
+self.addEventListener('fetch', event => {
+    const search = new URLSearchParams(new URL(event.request.url).search.substr(1))
+    const variant = search.get('variant')
+    const delay = search.get('delay')
+    if (!variant)
+        return
+
+    switch (variant) {
+        case 'forward':
+            event.respondWith(fetch(event.request.url))
+            break
+        case 'redirect':
+            event.respondWith(fetch(`/xhr/resources/redirect.py?location=${base_path()}/simple.txt`))
+            break
+        case 'delay-before-fetch':
+            event.respondWith(
+                new Promise(resolve => {
+                    step_timeout(() => fetch(event.request.url).then(resolve), delay)
+            }))
+            break
+        case 'delay-after-fetch':
+            event.respondWith(new Promise(resolve => {
+                fetch(event.request.url)
+                    .then(response => step_timeout(() => resolve(response), delay))
+            }))
+            break
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-waits-for-activate-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-waits-for-activate-worker.js
new file mode 100644
index 000000000000..92a96ff88fb9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-waits-for-activate-worker.js
@@ -0,0 +1,31 @@
+var activatePromiseResolve;
+
+addEventListener('activate', function(evt) {
+  evt.waitUntil(new Promise(function(resolve) {
+    activatePromiseResolve = resolve;
+  }));
+});
+
+addEventListener('message', async function(evt) {
+  switch (evt.data) {
+    case 'CLAIM':
+      evt.waitUntil(new Promise(async resolve => {
+        await clients.claim();
+        evt.source.postMessage('CLAIMED');
+        resolve();
+      }));
+      break;
+    case 'ACTIVATE':
+      if (typeof activatePromiseResolve !== 'function') {
+        throw new Error('Not activating!');
+      }
+      activatePromiseResolve();
+      break;
+    default:
+      throw new Error('Unknown message!');
+  }
+});
+
+addEventListener('fetch', function(evt) {
+  evt.respondWith(new Response('Hello world'));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/fetch-with-body-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-with-body-worker.js
new file mode 100644
index 000000000000..bef899c1b000
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/fetch-with-body-worker.js
@@ -0,0 +1,4 @@
+self.addEventListener("fetch", (event) => {
+  event.request.body;
+  event.respondWith(fetch(event.request));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/form-poster.html b/test/fixtures/wpt/service-workers/service-worker/resources/form-poster.html
new file mode 100644
index 000000000000..cd11a30a5e85
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/form-poster.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<form method="POST" id="form"></form>
+<script>
+function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  const form = document.getElementById('form');
+  form.action = params.get('target');
+  form.submit();
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/frame-for-getregistrations.html b/test/fixtures/wpt/service-workers/service-worker/resources/frame-for-getregistrations.html
new file mode 100644
index 000000000000..7fc35f18914c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/frame-for-getregistrations.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>Service Worker: frame for getRegistrations()</title>
+<script>
+var scope = 'scope-for-getregistrations';
+var script = 'empty-worker.js';
+var registration;
+
+navigator.serviceWorker.register(script, { scope: scope })
+  .then(function(r) { registration = r; window.parent.postMessage('ready', '*'); })
+
+self.onmessage = function(e) {
+  if (e.data == 'unregister') {
+    registration.unregister()
+      .then(function() {
+          e.ports[0].postMessage('unregistered');
+        });
+  }
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/get-resultingClientId-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/get-resultingClientId-worker.js
new file mode 100644
index 000000000000..f0e6c7becab6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/get-resultingClientId-worker.js
@@ -0,0 +1,107 @@
+// This worker expects a fetch event for a navigation and messages back the
+// result of clients.get(event.resultingClientId).
+
+// Resolves when the test finishes.
+let testFinishPromise;
+let resolveTestFinishPromise;
+let rejectTestFinishPromise;
+
+// Resolves to clients.get(event.resultingClientId) from the fetch event.
+let getPromise;
+let resolveGetPromise;
+let rejectGetPromise;
+
+let resultingClientId;
+
+function startTest() {
+  testFinishPromise = new Promise((resolve, reject) => {
+    resolveTestFinishPromise = resolve;
+    rejectTestFinishPromise = reject;
+  });
+
+  getPromise = new Promise((resolve, reject) => {
+    resolveGetPromise = resolve;
+    rejectGetPromise = reject;
+  });
+}
+
+async function describeGetPromiseResult(promise) {
+  const result = {};
+
+  await promise.then(
+    (client) => {
+      result.promiseState = 'fulfilled';
+      if (client === undefined) {
+        result.promiseValue = 'undefinedValue';
+      } else if (client instanceof Client) {
+        result.promiseValue = 'client';
+        result.client = {
+          id:  client.id,
+          url: client.url
+        };
+      } else {
+        result.promiseValue = 'unknown';
+      }
+    },
+    (error) => {
+      result.promiseState = 'rejected';
+    });
+
+  return result;
+}
+
+async function handleGetResultingClient(event) {
+  // Note that this message can arrive before |resultingClientId| is populated.
+  const result = await describeGetPromiseResult(getPromise);
+  // |resultingClientId| must be populated by now.
+  result.queriedId = resultingClientId;
+  event.source.postMessage(result);
+};
+
+async function handleGetClient(event) {
+  const id = event.data.id;
+  const result = await describeGetPromiseResult(self.clients.get(id));
+  result.queriedId = id;
+  event.source.postMessage(result);
+};
+
+self.addEventListener('message', (event) => {
+  if (event.data.command == 'startTest') {
+    startTest();
+    event.waitUntil(testFinishPromise);
+    event.source.postMessage('ok');
+    return;
+  }
+
+  if (event.data.command == 'finishTest') {
+    resolveTestFinishPromise();
+    event.source.postMessage('ok');
+    return;
+  }
+
+  if (event.data.command == 'getResultingClient') {
+    event.waitUntil(handleGetResultingClient(event));
+    return;
+  }
+
+  if (event.data.command == 'getClient') {
+    event.waitUntil(handleGetClient(event));
+    return;
+  }
+});
+
+async function handleFetch(event) {
+  try {
+    resultingClientId = event.resultingClientId;
+    const client = await self.clients.get(resultingClientId);
+    resolveGetPromise(client);
+  } catch (error) {
+    rejectGetPromise(error);
+  }
+}
+
+self.addEventListener('fetch', (event) => {
+  if (event.request.mode != 'navigate')
+    return;
+  event.waitUntil(handleFetch(event));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/http-to-https-redirect-and-register-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/http-to-https-redirect-and-register-iframe.html
new file mode 100644
index 000000000000..bcab35364dff
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/http-to-https-redirect-and-register-iframe.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<title>register, unregister, and report result to opener</title>
+<body>
+<script>
+'use strict';
+
+if (!navigator.serviceWorker) {
+  window.opener.postMessage('FAIL: navigator.serviceWorker is undefined', '*');
+} else {
+  navigator.serviceWorker.register('empty-worker.js', {scope: 'scope-register'})
+    .then(
+      registration => {
+          registration.unregister().then(() => {
+              window.opener.postMessage('OK', '*');
+            });
+        },
+      error => {
+          window.opener.postMessage('FAIL: ' + error.name, '*');
+        })
+    .catch(error => {
+        window.opener.postMessage('ERROR: ' + error.name, '*');
+      });
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-fetch-variants.html b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-fetch-variants.html
new file mode 100644
index 000000000000..3a61d7bb890b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-fetch-variants.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<script>
+    const url = new URL(new URLSearchParams(location.search.substr(1)).get('url'), location.href);
+    const before = performance.now();
+    fetch(url)
+        .then(r => r.text())
+        .then(() =>
+            parent.postMessage({
+                before,
+                after: performance.now(),
+                entry: performance.getEntriesByName(url)[0].toJSON()
+            }));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-image.html b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-image.html
new file mode 100644
index 000000000000..ce78840cb283
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iframe-with-image.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img src="square">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/immutable-prototype-serviceworker.js b/test/fixtures/wpt/service-workers/service-worker/resources/immutable-prototype-serviceworker.js
new file mode 100644
index 000000000000..d8a94ad46bef
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/immutable-prototype-serviceworker.js
@@ -0,0 +1,19 @@
+function prototypeChain(global) {
+  let result = [];
+  while (global !== null) {
+    let thrown = false;
+    let next = Object.getPrototypeOf(global);
+    try {
+      Object.setPrototypeOf(global, {});
+      result.push('mutable');
+    } catch (e) {
+      result.push('immutable');
+    }
+    global = next;
+  }
+  return result;
+}
+
+self.onmessage = function(e) {
+  e.data.postMessage(prototypeChain(self));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-echo-cookie-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-echo-cookie-worker.js
new file mode 100644
index 000000000000..f5eac9508c9a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-echo-cookie-worker.js
@@ -0,0 +1 @@
+importScripts(`echo-cookie-worker.py${location.search}`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-relative.xsl b/test/fixtures/wpt/service-workers/service-worker/resources/import-relative.xsl
new file mode 100644
index 000000000000..063a62d03143
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-relative.xsl
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+    <xsl:import href="xslt-pass.xsl"/>
+</xsl:stylesheet>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update-plus-update-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update-plus-update-worker.js
new file mode 100644
index 000000000000..e9899d8e7274
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update-plus-update-worker.js
@@ -0,0 +1,8 @@
+// This worker imports a script that returns 200 on the first request and 404
+// on the second request, and a script that is updated every time when
+// requesting it.
+const params = new URLSearchParams(location.search);
+const key = params.get('Key');
+const additional_key = params.get('AdditionalKey');
+importScripts(`update-worker.py?Key=${key}&Mode=not_found`,
+              `update-worker.py?Key=${additional_key}&Mode=normal`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update.js
new file mode 100644
index 000000000000..b569346035ac
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404-after-update.js
@@ -0,0 +1,6 @@
+// This worker imports a script that returns 200 on the first request and 404
+// on the second request. The resulting body also changes each time it is
+// requested.
+const params = new URLSearchParams(location.search);
+const key = params.get('Key');
+importScripts(`update-worker.py?Key=${key}&Mode=not_found`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404.js
new file mode 100644
index 000000000000..19c7a4b8e561
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-404.js
@@ -0,0 +1 @@
+importScripts('404.py');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-cross-origin-worker.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-cross-origin-worker.sub.js
new file mode 100644
index 000000000000..b432854db8bc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-cross-origin-worker.sub.js
@@ -0,0 +1 @@
+importScripts('https://{{domains[www1]}}:{{ports[https][0]}}/service-workers/service-worker/resources/import-scripts-version.py');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-data-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-data-url-worker.js
new file mode 100644
index 000000000000..fdabdafc6304
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-data-url-worker.js
@@ -0,0 +1 @@
+importScripts('data:text/javascript,');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-diff-resource-map-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-diff-resource-map-worker.js
new file mode 100644
index 000000000000..0fdcb0fcf80a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-diff-resource-map-worker.js
@@ -0,0 +1,10 @@
+importScripts('/resources/testharness.js');
+
+let echo1 = null;
+let echo2 = null;
+let arg1 = 'import-scripts-get.py?output=echo1&msg=test1';
+let arg2 = 'import-scripts-get.py?output=echo2&msg=test2';
+
+importScripts(arg1, arg2);
+assert_equals(echo1, 'test1');
+assert_equals(echo2, 'test2');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-mime-types-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-mime-types-worker.js
new file mode 100644
index 000000000000..7658eeace695
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-mime-types-worker.js
@@ -0,0 +1,54 @@
+const badMimeTypes = [
+  null,  // no MIME type
+  'text/plain',
+  // JSON is only valid for JSON module imports, never for classic
+  // importScripts(), even when the body is valid JavaScript.
+  'application/json',
+  'text/json',
+  'application/manifest+json',
+];
+
+const validMimeTypes = [
+  'application/ecmascript',
+  'application/javascript',
+  'application/x-ecmascript',
+  'application/x-javascript',
+  'text/ecmascript',
+  'text/javascript',
+  'text/javascript1.0',
+  'text/javascript1.1',
+  'text/javascript1.2',
+  'text/javascript1.3',
+  'text/javascript1.4',
+  'text/javascript1.5',
+  'text/jscript',
+  'text/livescript',
+  'text/x-ecmascript',
+  'text/x-javascript',
+];
+
+function importScriptsWithMimeType(mimeType) {
+  importScripts(`./mime-type-worker.py${mimeType ? '?mime=' + mimeType : ''}`);
+}
+
+importScripts('/resources/testharness.js');
+
+for (const mimeType of badMimeTypes) {
+  test(() => {
+    assert_throws_dom(
+      'NetworkError',
+      () => { importScriptsWithMimeType(mimeType); },
+      `importScripts with ${mimeType ? 'bad' : 'no'} MIME type ${mimeType || ''} throws NetworkError`,
+    );
+  }, `Importing script with ${mimeType ? 'bad' : 'no'} MIME type ${mimeType || ''}`);
+}
+
+for (const mimeType of validMimeTypes) {
+  test(() => {
+    try {
+      importScriptsWithMimeType(mimeType);
+    } catch {
+      assert_unreached(`importScripts with MIME type ${mimeType} should not throw`);
+    }
+  }, `Importing script with valid JavaScript MIME type ${mimeType}`);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-import.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-import.js
new file mode 100644
index 000000000000..56c04f094602
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-import.js
@@ -0,0 +1 @@
+// empty script
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-on-second-time-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-on-second-time-worker.js
new file mode 100644
index 000000000000..f612ab8e6aa4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-on-second-time-worker.js
@@ -0,0 +1,7 @@
+// This worker imports a script that returns 200 on the first request and a
+// redirect on the second request. The resulting body also changes each time it
+// is requested.
+const params = new URLSearchParams(location.search);
+const key = params.get('Key');
+importScripts(`update-worker.py?Key=${key}&Mode=redirect&` +
+              `Redirect=update-worker.py?Key=${key}%26Mode=normal`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-worker.js
new file mode 100644
index 000000000000..d02a45349c24
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-redirect-worker.js
@@ -0,0 +1 @@
+importScripts('redirect.py?Redirect=import-scripts-version.py');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-resource-map-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-resource-map-worker.js
new file mode 100644
index 000000000000..b3b9bc46a024
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-resource-map-worker.js
@@ -0,0 +1,15 @@
+importScripts('/resources/testharness.js');
+
+let version = null;
+importScripts('import-scripts-version.py');
+// Once imported, the stored script should be loaded for subsequent importScripts.
+const expected_version = version;
+
+version = null;
+importScripts('import-scripts-version.py');
+assert_equals(expected_version, version, 'second import');
+
+version = null;
+importScripts('import-scripts-version.py', 'import-scripts-version.py',
+    'import-scripts-version.py');
+assert_equals(expected_version, version, 'multiple imports');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-updated-flag-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-updated-flag-worker.js
new file mode 100644
index 000000000000..e01664662ef1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/import-scripts-updated-flag-worker.js
@@ -0,0 +1,31 @@
+importScripts('/resources/testharness.js');
+
+let echo_output = null;
+
+// Tests importing a script that sets |echo_output| to the query string.
+function test_import(str) {
+  echo_output = null;
+  importScripts('import-scripts-echo.py?msg=' + str);
+  assert_equals(echo_output, str);
+}
+
+test_import('root');
+test_import('root-and-message');
+
+self.addEventListener('install', () => {
+    test_import('install');
+    test_import('install-and-message');
+  });
+
+self.addEventListener('message', e => {
+    var error = null;
+    echo_output = null;
+
+    try {
+      importScripts('import-scripts-echo.py?msg=' + e.data);
+    } catch (e) {
+      error = e && e.name;
+    }
+
+    e.source.postMessage({ error: error, value: echo_output });
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/imported-classic-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/imported-classic-script.js
new file mode 100644
index 000000000000..5fc520405135
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/imported-classic-script.js
@@ -0,0 +1 @@
+const imported = 'A classic script.';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/imported-module-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/imported-module-script.js
new file mode 100644
index 000000000000..56d196df040f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/imported-module-script.js
@@ -0,0 +1 @@
+export const imported = 'A module script.';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/imported-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/imported-sw.js
new file mode 100644
index 000000000000..04a894d77f87
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/imported-sw.js
@@ -0,0 +1,13 @@
+'use strict';
+
+import {routerRules} from './router-rules.js';
+
+const params = new URLSearchParams(location.search);
+const key = params.get('imported-sw-router-key');
+
+if (key) {
+  self.addEventListener('install', async e => {
+    await e.addRoutes(routerRules[key]);
+    self.skipWaiting();
+  });
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/indexeddb-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/indexeddb-worker.js
new file mode 100644
index 000000000000..9add47683884
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/indexeddb-worker.js
@@ -0,0 +1,57 @@
+self.addEventListener('message', function(e) {
+    var message = e.data;
+    if (message.action === 'create') {
+      e.waitUntil(deleteDB()
+          .then(doIndexedDBTest)
+          .then(function() {
+              message.port.postMessage({ type: 'created' });
+            })
+          .catch(function(reason) {
+              message.port.postMessage({ type: 'error', value: reason });
+            }));
+    } else if (message.action === 'cleanup') {
+      e.waitUntil(deleteDB()
+          .then(function() {
+              message.port.postMessage({ type: 'done' });
+            })
+          .catch(function(reason) {
+              message.port.postMessage({ type: 'error', value: reason });
+            }));
+    }
+  });
+
+function deleteDB() {
+  return new Promise(function(resolve, reject) {
+      var delete_request = indexedDB.deleteDatabase('db');
+
+      delete_request.onsuccess = resolve;
+      delete_request.onerror = reject;
+    });
+}
+
+function doIndexedDBTest(port) {
+  return new Promise(function(resolve, reject) {
+      var open_request = indexedDB.open('db');
+
+      open_request.onerror = reject;
+      open_request.onupgradeneeded = function() {
+        var db = open_request.result;
+        db.createObjectStore('store');
+      };
+      open_request.onsuccess = function() {
+        var db = open_request.result;
+        var tx = db.transaction('store', 'readwrite');
+        var store = tx.objectStore('store');
+        store.put('value', 'key');
+
+        tx.onerror = function() {
+            db.close();
+            reject(tx.error);
+          };
+        tx.oncomplete = function() {
+            db.close();
+            resolve();
+          };
+      };
+    });
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/install-event-type-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/install-event-type-worker.js
new file mode 100644
index 000000000000..1c94ae21ea9d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/install-event-type-worker.js
@@ -0,0 +1,9 @@
+importScripts('worker-testharness.js');
+
+self.oninstall = function(event) {
+    assert_true(event instanceof ExtendableEvent, 'instance of ExtendableEvent');
+    assert_true(event instanceof InstallEvent, 'instance of InstallEvent');
+    assert_equals(event.type, 'install', '`type` property value');
+    assert_false(event.cancelable, '`cancelable` property value');
+    assert_false(event.bubbles, '`bubbles` property value');
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/install-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/install-worker.html
new file mode 100644
index 000000000000..ed20cd4dca6a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/install-worker.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Loading...</p>
+<script>
+async function install() {
+  let script;
+  for (const q of location.search.slice(1).split('&')) {
+    if (q.split('=')[0] === 'script') {
+      script = q.split('=')[1];
+    }
+  }
+  const scope = location.href;
+  const reg = await navigator.serviceWorker.register(script, {scope});
+  await navigator.serviceWorker.ready;
+  location.reload();
+}
+
+install();
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/intercepted-referrer-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/intercepted-referrer-sw.js
new file mode 100644
index 000000000000..f0246c8dbe46
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/intercepted-referrer-sw.js
@@ -0,0 +1,35 @@
+self.addEventListener('install', event => {
+  // Activate immediately to simplify the test.
+  event.waitUntil(self.skipWaiting());
+});
+
+self.addEventListener('activate', event => {
+  // Make sure the very next navigation is controlled by this SW.
+  event.waitUntil(self.clients.claim());
+});
+
+self.addEventListener('fetch', event => {
+  // Only handle top-level navigations within our scope.
+  if (event.request.mode === 'navigate') {
+    const html = `<!doctype html>
+      <meta charset="utf-8">
+      <title>SW Intercepted Page</title>
+      <script>
+        // Post the referrer observed by this new Document.
+        window.addEventListener('load', () => {
+          parent.postMessage({
+            source: 'sw-intercepted',
+            referrer: document.referrer,
+            url: location.href
+          }, '*');
+        });
+      </script>
+      <h1>SW-synthesized page</h1>
+      <p>This page was served by a Service Worker via respondWith().</p>`;
+
+    event.respondWith(new Response(html, {
+      headers: { 'Content-Type': 'text/html; charset=utf-8' }
+    }));
+  }
+  // Otherwise, fall through to network.
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/interface-requirements-worker.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/interface-requirements-worker.sub.js
new file mode 100644
index 000000000000..a3f239b65481
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/interface-requirements-worker.sub.js
@@ -0,0 +1,59 @@
+'use strict';
+
+// This file checks additional interface requirements, on top of the basic IDL
+// that is validated in service-workers/idlharness.any.js
+
+importScripts('/resources/testharness.js');
+
+test(function() {
+    var req = new Request('http://{{host}}/',
+                          {method: 'POST',
+                           headers: [['Content-Type', 'Text/Html']]});
+    assert_equals(
+      new ExtendableEvent('ExtendableEvent').type,
+      'ExtendableEvent', 'Type of ExtendableEvent should be ExtendableEvent');
+    assert_throws_js(TypeError, function() {
+        new FetchEvent('FetchEvent');
+    }, 'FetchEvent constructor with one argument throws');
+    assert_throws_js(TypeError, function() {
+        new FetchEvent('FetchEvent', {});
+    }, 'FetchEvent constructor with empty init dict throws');
+    assert_throws_js(TypeError, function() {
+        new FetchEvent('FetchEvent', {request: null});
+    }, 'FetchEvent constructor with null request member throws');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).type,
+      'FetchEvent', 'Type of FetchEvent should be FetchEvent');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).cancelable,
+      false, 'Default FetchEvent.cancelable should be false');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).bubbles,
+      false, 'Default FetchEvent.bubbles should be false');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req}).clientId,
+      '', 'Default FetchEvent.clientId should be the empty string');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req, cancelable: false}).cancelable,
+      false, 'FetchEvent.cancelable should be false');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request: req, clientId : 'test-client-id'}).clientId, 'test-client-id',
+      'FetchEvent.clientId with option {clientId : "test-client-id"} should be "test-client-id"');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request : req}).request.url,
+      'http://{{host}}/',
+      'FetchEvent.request.url should return the value it was initialized to');
+    assert_equals(
+      new FetchEvent('FetchEvent', {request : req}).isReload,
+      undefined,
+      'FetchEvent.isReload should not exist');
+
+  }, 'Event constructors');
+
+test(() => {
+    assert_false('XMLHttpRequest' in self);
+  }, 'xhr is not exposed');
+
+test(() => {
+    assert_false('createObjectURL' in self.URL);
+  }, 'URL.createObjectURL is not exposed')
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-iframe.https.html
new file mode 100644
index 000000000000..04a9cb515e09
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-iframe.https.html
@@ -0,0 +1,28 @@
+<script src="test-helpers.sub.js"></script>
+<script>
+
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        if (xhr.getResponseHeader('Content-Type') !== null) {
+          reject('Content-Type must be null.');
+        }
+        resolve();
+      };
+      xhr.onerror = function() {
+        reject('XHR must succeed.');
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port = evt.ports[0];
+    xhr_send('POST', 'test string')
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-worker.js
new file mode 100644
index 000000000000..865dc30d4282
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-blobtype-worker.js
@@ -0,0 +1,10 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        // null byte in blob type
+        resolve(new Response(new Blob([],{type: 'a\0b'})));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-iframe.https.html
new file mode 100644
index 000000000000..8f0e6baca175
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-iframe.https.html
@@ -0,0 +1,25 @@
+<script src="test-helpers.sub.js"></script>
+<script>
+
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        reject('XHR must fail.');
+      };
+      xhr.onerror = function() {
+        resolve();
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port = evt.ports[0];
+    xhr_send('POST', 'test string')
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-worker.js
new file mode 100644
index 000000000000..850874b8116d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/invalid-header-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+    event.respondWith(new Promise(function(resolve) {
+        var headers = new Headers;
+        headers.append('foo', 'foo');
+        headers.append('foo', 'b\0r'); // header value with a null byte
+        resolve(new Response('hello world', {'headers': headers}));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-iframe.html
new file mode 100644
index 000000000000..cf2fa8d14f7c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-iframe.html
@@ -0,0 +1,23 @@
+<script>
+function xhr_send(method, data) {
+  return new Promise(function(resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      xhr.onload = function() {
+        resolve();
+      };
+      xhr.onerror = function() {
+        reject('XHR must succeed.');
+      };
+      xhr.responseType = 'text';
+      xhr.open(method, './sample?test', true);
+      xhr.send(data);
+    });
+}
+
+window.addEventListener('message', function(evt) {
+    var port = evt.ports[0];
+    xhr_send('POST', 'test string')
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-worker.js
new file mode 100644
index 000000000000..d9ecca277b3f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/iso-latin1-header-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+    var url = event.request.url;
+    if (url.indexOf('sample?test') == -1) {
+      return;
+    }
+
+    event.respondWith(new Promise(function(resolve) {
+        var headers = new Headers;
+        headers.append('TEST', 'ßÀ¿'); // header value holds the Latin1 (ISO8859-1) string.
+        resolve(new Response('hello world', {'headers': headers}));
+      }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/load_worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/load_worker.js
new file mode 100644
index 000000000000..18c673bebcab
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/load_worker.js
@@ -0,0 +1,29 @@
+function run_test(data, sender) {
+  if (data === 'xhr') {
+    const xhr = new XMLHttpRequest();
+    xhr.open('GET', 'synthesized-response.txt', true);
+    xhr.responseType = 'text';
+    xhr.send();
+    xhr.onload = evt => sender.postMessage(xhr.responseText);
+    xhr.onerror = () => sender.postMessage('XHR failed!');
+  } else if (data === 'fetch') {
+    fetch('synthesized-response.txt')
+        .then(response => response.text())
+        .then(data => sender.postMessage(data))
+        .catch(error => sender.postMessage('Fetch failed!'));
+  } else if (data === 'importScripts') {
+    importScripts('synthesized-response.js');
+    // |message| is provided by 'synthesized-response.js';
+    sender.postMessage(message);
+  } else {
+    sender.postMessage('Unexpected message! ' + data);
+  }
+}
+
+// Entry point for dedicated workers.
+self.onmessage = evt => run_test(evt.data, self);
+
+// Entry point for shared workers.
+self.onconnect = evt => {
+  evt.ports[0].onmessage = e => run_test(e.data, evt.ports[0]);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/loaded.html b/test/fixtures/wpt/service-workers/service-worker/resources/loaded.html
new file mode 100644
index 000000000000..0cabce69f8e8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/loaded.html
@@ -0,0 +1,9 @@
+<script>
+addEventListener('load', function() {
+  opener.postMessage({ type: 'LOADED' }, '*');
+});
+
+addEventListener('pageshow', function() {
+  opener.postMessage({ type: 'PAGESHOW' }, '*');
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-frame.html
new file mode 100644
index 000000000000..e7214827a4cf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-frame.html
@@ -0,0 +1,189 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+const fetchURL = new URL('sample.js', window.location).href;
+
+const frameControllerText =
+`<script>
+  let t = null;
+  try {
+    if (navigator.serviceWorker.controller) {
+      t = navigator.serviceWorker.controller.scriptURL;
+    }
+  } catch (e) {
+    t = e.message;
+  } finally {
+    parent.postMessage({ data: t }, '*');
+  }
+</` + `script>`;
+
+const frameFetchText =
+`<script>
+  fetch('${fetchURL}', { mode: 'no-cors' }).then(response => {
+    return response.text();
+  }).then(text => {
+    parent.postMessage({ data: text }, '*');
+  }).catch(e => {
+    parent.postMessage({ data: e.message }, '*');
+  });
+</` + `script>`;
+
+const workerControllerText =
+`let t = navigator.serviceWorker.controller
+       ? navigator.serviceWorker.controller.scriptURL
+       : null;
+self.postMessage(t);`;
+
+const workerFetchText =
+`fetch('${fetchURL}', { mode: 'no-cors' }).then(response => {
+  return response.text();
+}).then(text => {
+  self.postMessage(text);
+}).catch(e => {
+  self.postMessage(e.message);
+});`;
+
+const sharedWorkerControllerText =
+`const ports = [];
+self.onconnect = evt => {
+  const port = evt.ports[0];
+  ports.push(port);
+  const t = navigator.serviceWorker.controller
+        ? navigator.serviceWorker.controller.scriptURL
+        : null;
+  port.postMessage(t);
+};
+self.onerror = msg => {
+  ports.forEach(port => {port.postMessage(msg);});
+};`;
+
+const sharedWorkerFetchText =
+`self.onconnect = evt => {
+  const port = evt.ports[0];
+  fetch('${fetchURL}', { mode: 'no-cors' }).then(response => {
+    return response.text();
+  }).then(text => {
+    port.postMessage(text);
+  }).catch(e => {
+    port.postMessage(e.message);
+  });
+};`;
+
+function getChildText(opts) {
+  if (opts.child === 'iframe') {
+    if (opts.check === 'controller') {
+      return frameControllerText;
+    }
+
+    if (opts.check === 'fetch') {
+      return frameFetchText;
+    }
+
+    throw('unexpected feature to check: ' + opts.check);
+  }
+
+  if (opts.child === 'worker') {
+    if (opts.check === 'controller') {
+      return workerControllerText;
+    }
+
+    if (opts.check === 'fetch') {
+      return workerFetchText;
+    }
+
+    throw('unexpected feature to check: ' + opts.check);
+  }
+
+  if (opts.child === 'sharedworker') {
+    if (opts.check === 'controller') {
+      return sharedWorkerControllerText;
+    }
+
+    if (opts.check === 'fetch') {
+      return sharedWorkerFetchText;
+    }
+
+    throw('unexpected feature to check: ' + opts.check);
+  }
+
+  throw('unexpected child type ' + opts.child);
+}
+
+function makeURL(opts) {
+  let mimetype = opts.child === 'iframe' ? 'text/html'
+                                         : 'text/javascript';
+
+  if (opts.scheme === 'blob') {
+    let blob = new Blob([getChildText(opts)], { type: mimetype });
+    return URL.createObjectURL(blob);
+  }
+
+  if (opts.scheme === 'data') {
+    return `data:${mimetype},${getChildText(opts)}`;
+  }
+
+  throw(`unexpected URL scheme ${opts.scheme}`);
+}
+
+function testWorkerChild(url) {
+  let w = new Worker(url);
+  return new Promise((resolve, reject) => {
+    w.onmessage = resolve;
+    w.onerror = evt => {
+      reject(evt.message);
+    }
+  });
+}
+
+function testSharedWorkerChild(url) {
+  let w = new SharedWorker(url);
+  return new Promise((resolve, reject) => {
+    w.port.onmessage = m => {
+      // (null is a valid value when the SharedWorker is not controlled)
+      if (m.data?.includes("Error")) {
+        reject(m.data);
+        return;
+      }
+      resolve(m);
+    }
+    w.onerror = evt => {
+      reject(evt.message);
+    }
+  });
+}
+
+function testIframeChild(url) {
+  let frame = document.createElement('iframe');
+  frame.src = url;
+  document.body.appendChild(frame);
+
+  return new Promise(resolve => {
+    addEventListener('message', evt => {
+      resolve(evt.data);
+    }, { once: true });
+  });
+}
+
+function testURL(opts, url) {
+  if (opts.child === 'worker') {
+    return testWorkerChild(url);
+  }
+
+  if (opts.child === 'sharedworker') {
+    return testSharedWorkerChild(url);
+  }
+
+  if (opts.child === 'iframe') {
+    return testIframeChild(url);
+  }
+
+  throw(`unexpected child type ${opts.child}`);
+}
+
+function checkChildController(opts) {
+  let url = makeURL(opts);
+  return testURL(opts, url);
+}
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-worker.js
new file mode 100644
index 000000000000..4b7aad0f58a8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/local-url-inherit-controller-worker.js
@@ -0,0 +1,5 @@
+addEventListener('fetch', evt => {
+  if (evt.request.url.includes('sample')) {
+    evt.respondWith(new Response('intercepted'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/location-setter.html b/test/fixtures/wpt/service-workers/service-worker/resources/location-setter.html
new file mode 100644
index 000000000000..f0ced06ec26d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/location-setter.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  self.location = params.get('target');
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/malformed-http-response.asis b/test/fixtures/wpt/service-workers/service-worker/resources/malformed-http-response.asis
new file mode 100644
index 000000000000..bc3c68d46d53
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/malformed-http-response.asis
@@ -0,0 +1 @@
+HAHAHA THIS IS NOT HTTP AND THE BROWSER SHOULD CONSIDER IT A NETWORK ERROR
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/message-vs-microtask.html b/test/fixtures/wpt/service-workers/service-worker/resources/message-vs-microtask.html
new file mode 100644
index 000000000000..2c45c59a475a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/message-vs-microtask.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script>
+  let draft = [];
+  var resolve_manual_promise;
+  let manual_promise =
+    new Promise(resolve => resolve_manual_promise = resolve).then(() => draft.push('microtask'));
+
+  let resolve_message_promise;
+  let message_promise = new Promise(resolve => resolve_message_promise = resolve);
+  function handle_message(event) {
+    draft.push('message');
+    resolve_message_promise();
+  }
+
+  var result = Promise.all([manual_promise, message_promise]).then(() => draft);
+</script>
+
+<script src="empty.js?key=start"></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/mime-sniffing-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/mime-sniffing-worker.js
new file mode 100644
index 000000000000..5c34a7a49e87
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/mime-sniffing-worker.js
@@ -0,0 +1,9 @@
+self.addEventListener('fetch', function(event) {
+    // Use an empty content-type value to force mime-sniffing.  Note, this
+    // must be passed to the constructor since the mime-type of the Response
+    // is fixed and cannot be later changed.
+    var res = new Response('<!DOCTYPE html>\n<h1 id=\'testid\'>test</h1>', {
+      headers: { 'content-type': '' }
+    });
+    event.respondWith(res);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/missing.asis b/test/fixtures/wpt/service-workers/service-worker/resources/missing.asis
new file mode 100644
index 000000000000..4846fe01d61a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/missing.asis
@@ -0,0 +1,4 @@
+HTTP/1.1 404 Not Found
+Content-Type: text/javascript
+
+alert("hello");
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/module-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/module-worker.js
new file mode 100644
index 000000000000..385fe7101503
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/module-worker.js
@@ -0,0 +1 @@
+import * as module from './imported-module-script.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-iframe.html
new file mode 100644
index 000000000000..c59b95594ff5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-iframe.html
@@ -0,0 +1,19 @@
+<script>
+function load_multipart_image(src) {
+    return new Promise((resolve, reject) => {
+        const img = document.createElement('img');
+        img.addEventListener('load', () => resolve(img));
+        img.addEventListener('error', (e) => reject(new DOMException('load failed', 'NetworkError')));
+        img.src = src;
+    });
+}
+
+function get_image_data(img) {
+    const canvas = document.createElement('canvas');
+    const context = canvas.getContext('2d');
+    context.drawImage(img, 0, 0);
+    // When |img.src| is cross origin, this should throw a SecurityError.
+    const imageData = context.getImageData(0, 0, 1, 1);
+    return imageData;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-worker.js
new file mode 100644
index 000000000000..a38fe54d34fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/multipart-image-worker.js
@@ -0,0 +1,21 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+const host_info = get_host_info();
+
+const multipart_image_path = base_path() + 'multipart-image.py';
+const sameorigin_url = host_info['HTTPS_ORIGIN'] + multipart_image_path;
+const cross_origin_url = host_info['HTTPS_REMOTE_ORIGIN'] + multipart_image_path;
+
+self.addEventListener('fetch', event => {
+    const url = event.request.url;
+    if (url.indexOf('cross-origin-multipart-image-with-no-cors') >= 0) {
+        event.respondWith(fetch(cross_origin_url, {mode: 'no-cors'}));
+    } else if (url.indexOf('cross-origin-multipart-image-with-cors-rejected') >= 0) {
+        event.respondWith(fetch(cross_origin_url, {mode: 'cors'}));
+    } else if (url.indexOf('cross-origin-multipart-image-with-cors-approved') >= 0) {
+        event.respondWith(fetch(cross_origin_url + '?approvecors', {mode: 'cors'}));
+    } else if (url.indexOf('same-origin-multipart-image') >= 0) {
+        event.respondWith(fetch(sameorigin_url));
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigate-window-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigate-window-worker.js
new file mode 100644
index 000000000000..f9617439fc60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigate-window-worker.js
@@ -0,0 +1,21 @@
+addEventListener('message', function(evt) {
+  if (evt.data.type === 'GET_CLIENTS') {
+    clients.matchAll(evt.data.opts).then(function(clientList) {
+      var resultList = clientList.map(function(c) {
+        return { url: c.url, frameType: c.frameType, id: c.id };
+      });
+      evt.source.postMessage({ type: 'success', detail: resultList });
+    }).catch(function(err) {
+      evt.source.postMessage({
+        type: 'failure',
+        detail: 'matchAll() rejected with "' + err + '"'
+      });
+    });
+    return;
+  }
+
+  evt.source.postMessage({
+    type: 'failure',
+    detail: 'Unexpected message type "' + evt.data.type + '"'
+  });
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-body-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-body-worker.js
new file mode 100644
index 000000000000..39f11baf8cb9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-body-worker.js
@@ -0,0 +1,11 @@
+self.addEventListener('fetch', function(event) {
+    event.respondWith(
+        fetch(event.request)
+          .then(
+              function(response) {
+                return response;
+              },
+              function(error) {
+                return new Response('Error:' + error);
+              }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-other-origin.html b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-other-origin.html
new file mode 100644
index 000000000000..d82571d1a3c7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-other-origin.html
@@ -0,0 +1,89 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var host_info = get_host_info();
+var SCOPE = 'navigation-redirect-scope1.py';
+var SCRIPT = 'redirect-worker.js';
+
+var registration;
+var worker;
+var wait_for_worker_promise = navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(reg) {
+      if (reg)
+        return reg.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+    })
+  .then(function(reg) {
+      registration = reg;
+      worker = reg.installing;
+      return new Promise(function(resolve) {
+          worker.addEventListener('statechange', function() {
+              if (worker.state == 'activated')
+                resolve();
+            });
+        });
+    });
+
+function send_result(message_id, result) {
+  window.parent.postMessage(
+      {id: message_id, result: result},
+      host_info['HTTPS_ORIGIN']);
+}
+
+function get_request_infos(worker) {
+  return new Promise(function(resolve) {
+    var channel = new MessageChannel();
+    channel.port1.onmessage = (msg) => {
+      resolve(msg.data.requestInfos);
+    };
+    worker.postMessage({command: 'getRequestInfos', port: channel.port2},
+                       [channel.port2]);
+  });
+}
+
+function get_clients(worker, actual_ids) {
+  return new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = (msg) => {
+        resolve(msg.data.clients);
+      };
+      worker.postMessage({
+        command: 'getClients',
+        actual_ids,
+        port: channel.port2
+      }, [channel.port2]);
+    });
+}
+
+window.addEventListener('message', on_message, false);
+
+function on_message(e) {
+  if (e.origin != host_info['HTTPS_ORIGIN']) {
+    console.error('invalid origin: ' + e.origin);
+    return;
+  }
+  const command = e.data.message.command;
+  if (command == 'wait_for_worker') {
+    wait_for_worker_promise.then(function() { send_result(e.data.id, 'ok'); });
+  } else if (command == 'get_request_infos') {
+    get_request_infos(worker)
+      .then(function(data) {
+          send_result(e.data.id, data);
+        });
+  } else if (command == 'get_clients') {
+    get_clients(worker, e.data.message.actual_ids)
+      .then(function(data) {
+          send_result(e.data.id, data);
+        });
+  } else if (command == 'unregister') {
+    registration.unregister()
+      .then(function() {
+          send_result(e.data.id, 'ok');
+        });
+  }
+}
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-iframe.html
new file mode 100644
index 000000000000..40e27c630d29
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-iframe.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+var SCOPE = './redirect.py?Redirect=' + encodeURI('http://example.com');
+var SCRIPT = 'navigation-redirect-to-http-worker.js';
+var host_info = get_host_info();
+
+navigator.serviceWorker.getRegistration(SCOPE)
+  .then(function(registration) {
+      if (registration)
+        return registration.unregister();
+    })
+  .then(function() {
+      return navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+    })
+  .then(function(registration) {
+      return new Promise(function(resolve) {
+          registration.addEventListener('updatefound', function() {
+              resolve(registration.installing);
+            });
+        });
+    })
+  .then(function(worker) {
+      worker.addEventListener('statechange', on_state_change);
+    })
+  .catch(function(reason) {
+      window.parent.postMessage({results: 'FAILURE: ' + reason.message},
+                                host_info['HTTPS_ORIGIN']);
+     });
+
+function on_state_change(event) {
+  if (event.target.state != 'activated')
+    return;
+  with_iframe(SCOPE, {auto_remove: false})
+    .then(function(frame) {
+        window.parent.postMessage(
+            {results: frame.contentDocument.body.textContent},
+            host_info['HTTPS_ORIGIN']);
+      });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-worker.js
new file mode 100644
index 000000000000..6f2a8ae1d749
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-redirect-to-http-worker.js
@@ -0,0 +1,22 @@
+importScripts('/resources/testharness.js');
+
+self.addEventListener('fetch', function(event) {
+    event.respondWith(new Promise(function(resolve) {
+      Promise.resolve()
+        .then(function() {
+            assert_equals(
+                event.request.redirect, 'manual',
+                'The redirect mode of navigation request must be manual.');
+            return fetch(event.request);
+          })
+        .then(function(response) {
+            assert_equals(
+                response.type, 'opaqueredirect',
+                'The response type of 302 response must be opaqueredirect.');
+            resolve(new Response('OK'));
+          })
+        .catch(function(error) {
+            resolve(new Response('Failed in SW: ' + error));
+          });
+    }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker-extended.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker-extended.js
new file mode 100644
index 000000000000..79c54088ff60
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker-extended.js
@@ -0,0 +1,22 @@
+importScripts("/resources/testharness.js");
+const timings = {}
+
+const DELAY_ACTIVATION = 500
+
+self.addEventListener('activate', event => {
+    event.waitUntil(new Promise(resolve => {
+        timings.activateWorkerStart = performance.now() + performance.timeOrigin;
+
+        // This gives us enough time to ensure activation would delay fetch handling
+        step_timeout(resolve, DELAY_ACTIVATION);
+    }).then(() => timings.activateWorkerEnd = performance.now() + performance.timeOrigin));
+})
+
+self.addEventListener('fetch', event => {
+    timings.handleFetchEvent = performance.now() + performance.timeOrigin;
+    event.respondWith(Promise.resolve(new Response(new Blob([`
+            <script>
+                parent.postMessage(${JSON.stringify(timings)}, "*")
+            </script>
+    `]))));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker.js
new file mode 100644
index 000000000000..8539b40066dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/navigation-timing-worker.js
@@ -0,0 +1,15 @@
+self.addEventListener('fetch', (event) => {
+    const url = event.request.url;
+
+    // Network fallback.
+    if (url.indexOf('network-fallback') >= 0) {
+        return;
+    }
+
+    // Don't intercept redirect.
+    if (url.indexOf('redirect.py') >= 0) {
+        return;
+    }
+
+    event.respondWith(fetch(url));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-worker-created-from-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-worker-created-from-worker.html
new file mode 100644
index 000000000000..fc048e288e90
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-worker-created-from-worker.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const workerUrl = new URL('create-blob-url-worker.js', baseLocation).href;
+const worker = new Worker(workerUrl);
+
+function fetch_in_worker(url) {
+  const resourceUrl = new URL(url, baseLocation).href;
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(resourceUrl);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-workers.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-workers.html
new file mode 100644
index 000000000000..f0eafcd3e01c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-blob-url-workers.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const parentWorkerScript = `
+  const childWorkerScript = 'self.onmessage = async (e) => {' +
+    '  const response = await fetch(e.data);' +
+    '  const text = await response.text();' +
+    '  self.postMessage(text);' +
+    '};';
+  const blob = new Blob([childWorkerScript], { type: 'text/javascript' });
+  const blobUrl = URL.createObjectURL(blob);
+  const childWorker = new Worker(blobUrl);
+
+  // When a message comes from the parent frame, sends a resource url to the
+  // child worker.
+  self.onmessage = (e) => {
+    childWorker.postMessage(e.data);
+  };
+  // When a message comes from the child worker, sends a content of fetch() to
+  // the parent frame.
+  childWorker.onmessage = (e) => {
+    self.postMessage(e.data);
+  };
+`;
+const blob = new Blob([parentWorkerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function fetch_in_worker(url) {
+  const resourceUrl = new URL(url, baseLocation).href;
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(resourceUrl);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-iframe-parent.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-iframe-parent.html
new file mode 100644
index 000000000000..115ab26e1221
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-iframe-parent.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+  navigator.serviceWorker.onmessage = event => parent.postMessage(event.data, '*', event.ports);
+</script>
+<iframe id='child'></iframe>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-parent.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-parent.html
new file mode 100644
index 000000000000..b4832d461d5c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-parent.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+async function onLoad() {
+  self.addEventListener('message', evt => {
+    if (self.opener)
+      self.opener.postMessage(evt.data, '*');
+    else
+      self.top.postMessage(evt.data, '*');
+  }, { once: true });
+  const params = new URLSearchParams(self.location.search);
+  const frame = document.createElement('iframe');
+  frame.src = params.get('target');
+  document.body.appendChild(frame);
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested-worker-created-from-blob-url-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/nested-worker-created-from-blob-url-worker.html
new file mode 100644
index 000000000000..3fad2c9228ce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested-worker-created-from-blob-url-worker.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<script>
+const baseLocation = window.location;
+const parentWorkerScript = `
+  const workerUrl =
+    new URL('postmessage-fetched-text.js', '${baseLocation}').href;
+  const childWorker = new Worker(workerUrl);
+
+  // When a message comes from the parent frame, sends a resource url to the
+  // child worker.
+  self.onmessage = (e) => {
+    childWorker.postMessage(e.data);
+  };
+  // When a message comes from the child worker, sends a content of fetch() to
+  // the parent frame.
+  childWorker.onmessage = (e) => {
+    self.postMessage(e.data);
+  };
+`;
+const blob = new Blob([parentWorkerScript], { type: 'text/javascript' });
+const blobUrl = URL.createObjectURL(blob);
+const worker = new Worker(blobUrl);
+
+function fetch_in_worker(url) {
+  const resourceUrl = new URL(url, baseLocation).href;
+  return new Promise((resolve) => {
+    worker.onmessage = (event) => {
+      resolve(event.data);
+    };
+    worker.postMessage(resourceUrl);
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/nested_load_worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/nested_load_worker.js
new file mode 100644
index 000000000000..7296d8fe1a3a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/nested_load_worker.js
@@ -0,0 +1,23 @@
+// Entry point for dedicated workers.
+self.onmessage = evt => {
+  try {
+    const worker = new Worker('load_worker.js');
+    worker.onmessage = msg => self.postMessage(msg.data);
+    worker.postMessage(evt.data);
+  } catch (err) {
+    self.postMessage('Unexpected error! ' + err.message);
+  }
+};
+
+// Entry point for shared workers.
+self.onconnect = evt => {
+  evt.ports[0].onmessage = e => {
+    try {
+      const worker = new Worker('load_worker.js');
+      worker.onmessage = msg => evt.ports[0].postMessage(msg.data);
+      worker.postMessage(e.data);
+    } catch (err) {
+      evt.ports[0].postMessage('Unexpected error! ' + err.message);
+    }
+  };
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/no-dynamic-import.js b/test/fixtures/wpt/service-workers/service-worker/resources/no-dynamic-import.js
new file mode 100644
index 000000000000..ecedd6c5d75c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/no-dynamic-import.js
@@ -0,0 +1,18 @@
+/** @type {[name: string, url: string][]} */
+const importUrlTests = [
+  ["Module URL", "./basic-module.js"],
+  // In no-dynamic-import-in-module.any.js, this module is also statically imported
+  ["Another module URL", "./basic-module-2.js"],
+  [
+    "Module data: URL",
+    "data:text/javascript;charset=utf-8," +
+      encodeURIComponent(`export default 'hello!';`),
+  ],
+];
+
+for (const [name, url] of importUrlTests) {
+  promise_test(
+    (t) => promise_rejects_js(t, TypeError, import(url), "Import must reject"),
+    name
+  );
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/object-image-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/object-image-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..5a20a58ab169
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/object-image-is-not-intercepted-iframe.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<object type="image/png" data="/images/green.png"></embed>
+<script>
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    if (!navigator.serviceWorker.controller)
+      resolve('FAIL: this iframe is not controlled');
+
+    const elem = document.querySelector('object');
+    elem.addEventListener('load', e => {
+        resolve('request was not intercepted');
+      });
+    elem.addEventListener('error', e => {
+        resolve('FAIL: request was intercepted');
+      });
+  });
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/object-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/object-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..0aeb81951ede
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/object-is-not-intercepted-iframe.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The OBJECT element will call this with the result about whether the OBJECT
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+</script>
+
+<object data="embedded-content-from-server.html"></object>
+</body>
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/object-navigation-is-not-intercepted-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/object-navigation-is-not-intercepted-iframe.html
new file mode 100644
index 000000000000..5c8ab79a500a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/object-navigation-is-not-intercepted-iframe.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for embed-and-object-are-not-intercepted test</title>
+<body>
+<script>
+// The OBJECT element will call this with the result about whether the OBJECT
+// request was intercepted by the service worker.
+var report_result;
+
+// Our parent (the root frame of the test) will examine this to get the result.
+var test_promise = new Promise(resolve => {
+    report_result = resolve;
+  });
+
+let el = document.createElement('object');
+el.data = "/common/blank.html";
+el.addEventListener('load', _ => {
+  window[0].location = "/service-workers/service-worker/resources/embedded-content-from-server.html";
+}, { once: true });
+document.body.appendChild(el);
+</script>
+
+</body>
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-from-nested-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-from-nested-event-worker.js
new file mode 100644
index 000000000000..7c97014fd042
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-from-nested-event-worker.js
@@ -0,0 +1,13 @@
+var max_nesting_level = 8;
+
+self.addEventListener('message', function(event) {
+    var level = event.data;
+    if (level < max_nesting_level)
+      dispatchEvent(new MessageEvent('message', { data: level + 1 }));
+    throw Error('error at level ' + level);
+  });
+
+self.addEventListener('activate', function(event) {
+    dispatchEvent(new MessageEvent('message', { data: 1 }));
+  });
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-cancel-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-cancel-worker.js
new file mode 100644
index 000000000000..0bd9d318b241
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-cancel-worker.js
@@ -0,0 +1,3 @@
+self.onerror = function(event) { return true; };
+
+self.addEventListener('activate', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-prevent-default-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-prevent-default-worker.js
new file mode 100644
index 000000000000..d56c95113917
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-then-prevent-default-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple error handlers. One error handler
+// calling preventDefault should cause the event to be treated as
+// handled.
+self.addEventListener('error', function(event) {});
+self.addEventListener('error', function(event) { event.preventDefault(); });
+self.addEventListener('error', function(event) {});
+self.addEventListener('activate', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-with-empty-onerror-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-with-empty-onerror-worker.js
new file mode 100644
index 000000000000..eb12ae862c59
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-with-empty-onerror-worker.js
@@ -0,0 +1,2 @@
+self.addEventListener('error', function(event) {});
+self.addEventListener('activate', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-worker.js
new file mode 100644
index 000000000000..1e88ac5c4e78
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-throw-error-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple activate handlers. One handler throwing an
+// error should cause the event dispatch to be treated as having unhandled
+// errors.
+self.addEventListener('activate', function(event) {});
+self.addEventListener('activate', function(event) {});
+self.addEventListener('activate', function(event) { throw new Error(); });
+self.addEventListener('activate', function(event) {});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-waituntil-forever.js b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-waituntil-forever.js
new file mode 100644
index 000000000000..65b02b12b360
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onactivate-waituntil-forever.js
@@ -0,0 +1,8 @@
+'use strict';
+
+self.addEventListener('activate', event => {
+  event.waitUntil(new Promise(() => {
+        // Use a promise that never resolves to prevent this service worker from
+        // advancing past the 'activating' state.
+      }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onfetch-waituntil-forever.js b/test/fixtures/wpt/service-workers/service-worker/resources/onfetch-waituntil-forever.js
new file mode 100644
index 000000000000..b905d555986e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onfetch-waituntil-forever.js
@@ -0,0 +1,10 @@
+'use strict';
+
+self.addEventListener('fetch', event => {
+  if (event.request.url.endsWith('waituntil-forever')) {
+    event.respondWith(new Promise(() => {
+        // Use a promise that never resolves to prevent this fetch from
+        // completing.
+    }));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-from-nested-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-from-nested-event-worker.js
new file mode 100644
index 000000000000..6729ab61a371
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-from-nested-event-worker.js
@@ -0,0 +1,12 @@
+var max_nesting_level = 8;
+
+self.addEventListener('message', function(event) {
+    var level = event.data;
+    if (level < max_nesting_level)
+      dispatchEvent(new MessageEvent('message', { data: level + 1 }));
+    throw Error('error at level ' + level);
+  });
+
+self.addEventListener('install', function(event) {
+    dispatchEvent(new MessageEvent('message', { data: 1 }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-cancel-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-cancel-worker.js
new file mode 100644
index 000000000000..c2c499ab1a37
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-cancel-worker.js
@@ -0,0 +1,3 @@
+self.onerror = function(event) { return true; };
+
+self.addEventListener('install', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-prevent-default-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-prevent-default-worker.js
new file mode 100644
index 000000000000..7667c2781d09
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-then-prevent-default-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple error handlers. One error handler
+// calling preventDefault should cause the event to be treated as
+// handled.
+self.addEventListener('error', function(event) {});
+self.addEventListener('error', function(event) { event.preventDefault(); });
+self.addEventListener('error', function(event) {});
+self.addEventListener('install', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-with-empty-onerror-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-with-empty-onerror-worker.js
new file mode 100644
index 000000000000..8f56d1bf1491
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-with-empty-onerror-worker.js
@@ -0,0 +1,2 @@
+self.addEventListener('error', function(event) {});
+self.addEventListener('install', function(event) { throw new Error(); });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-worker.js
new file mode 100644
index 000000000000..cc2f6d7e5e78
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-throw-error-worker.js
@@ -0,0 +1,7 @@
+// Ensure we can handle multiple install handlers. One handler throwing an
+// error should cause the event dispatch to be treated as having unhandled
+// errors.
+self.addEventListener('install', function(event) {});
+self.addEventListener('install', function(event) {});
+self.addEventListener('install', function(event) { throw new Error(); });
+self.addEventListener('install', function(event) {});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-forever.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-forever.js
new file mode 100644
index 000000000000..964483f2f427
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-forever.js
@@ -0,0 +1,8 @@
+'use strict';
+
+self.addEventListener('install', event => {
+  event.waitUntil(new Promise(() => {
+        // Use a promise that never resolves to prevent this service worker from
+        // advancing past the 'installing' state.
+      }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-throw-error-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-throw-error-worker.js
new file mode 100644
index 000000000000..6cb8f6ede635
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/oninstall-waituntil-throw-error-worker.js
@@ -0,0 +1,5 @@
+self.addEventListener('install', function(event) {
+  event.waitUntil(new Promise(function(aRequest, aResponse) {
+      throw new Error();
+    }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/onparse-infiniteloop-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/onparse-infiniteloop-worker.js
new file mode 100644
index 000000000000..6f439aee94d5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/onparse-infiniteloop-worker.js
@@ -0,0 +1,8 @@
+'use strict';
+
+// Use an infinite loop to prevent this service worker from advancing past the
+// 'parsed' state.
+let i = 0;
+while (true) {
+  ++i;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-being-preloaded-xhr.html b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-being-preloaded-xhr.html
new file mode 100644
index 000000000000..9c6d8bd504a1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-being-preloaded-xhr.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body></body>
+<script>
+const URL = 'opaque-response?from=opaque-response-being-preloaded-xhr.html';
+function runTest() {
+  var l = document.createElement('link');
+  // Use link rel=preload to try to get the browser to cache the opaque
+  // response.
+  l.setAttribute('rel', 'preload');
+  l.setAttribute('href', URL);
+  l.setAttribute('as', 'fetch');
+  l.onerror = function() {
+    parent.done('FAIL: preload failed unexpectedly');
+  };
+  document.body.appendChild(l);
+  xhr = new XMLHttpRequest;
+  xhr.withCredentials = true;
+  xhr.open('GET', URL);
+  // opaque-response returns an opaque response from serviceworker and thus
+  // the XHR must fail because it is not no-cors request.
+  // Particularly, the XHR must not reuse the opaque response from the
+  // preload request.
+  xhr.onerror = function() {
+    parent.done('PASS');
+  };
+  xhr.onload = function() {
+    parent.done('FAIL: ' + xhr.responseText);
+  };
+  xhr.send();
+}
+</script>
+<body onload="setTimeout(runTest, 100)"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-worker.js
new file mode 100644
index 000000000000..4fbe35df277e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-worker.js
@@ -0,0 +1,12 @@
+importScripts('/common/get-host-info.sub.js');
+
+var remoteUrl = get_host_info()['HTTPS_REMOTE_ORIGIN'] +
+  '/service-workers/service-worker/resources/sample.js'
+
+self.addEventListener('fetch', event => {
+    if (!event.request.url.match(/opaque-response\?from=/)) {
+      return;
+    }
+
+    event.respondWith(fetch(remoteUrl, {mode: 'no-cors'}));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-xhr.html b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-xhr.html
new file mode 100644
index 000000000000..f31ac9b5c4ce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-response-preloaded-xhr.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body></body>
+<script>
+const URL = 'opaque-response?from=opaque-response-preloaded-xhr.html';
+function runTest() {
+  var l = document.createElement('link');
+  // Use link rel=preload to try to get the browser to cache the opaque
+  // response.
+  l.setAttribute('rel', 'preload');
+  l.setAttribute('href', URL);
+  l.setAttribute('as', 'fetch');
+  l.onload = function() {
+    xhr = new XMLHttpRequest;
+    xhr.withCredentials = true;
+    xhr.open('GET', URL);
+    // opaque-response returns an opaque response from serviceworker and thus
+    // the XHR must fail because it is not no-cors request.
+    // Particularly, the XHR must not reuse the opaque response from the
+    // preload request.
+    xhr.onerror = function() {
+      parent.done('PASS');
+    };
+    xhr.onload = function() {
+      parent.done('FAIL: ' + xhr.responseText);
+    };
+    xhr.send();
+  };
+  l.onerror = function() {
+    parent.done('FAIL: preload failed unexpectedly');
+  };
+  document.body.appendChild(l);
+}
+</script>
+<body onload="setTimeout(runTest, 100)"></body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-frame.html
new file mode 100644
index 000000000000..a57aacec7c6f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-frame.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+<script>
+self.addEventListener('error', evt => {
+  self.parent.postMessage({ type: 'ErrorEvent', msg: evt.message }, '*');
+});
+
+const el = document.createElement('script');
+const params = new URLSearchParams(self.location.search);
+el.src = params.get('script');
+el.addEventListener('load', evt => {
+  runScript();
+});
+document.body.appendChild(el);
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-large.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-large.js
new file mode 100644
index 000000000000..7e1c598efc5c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-large.js
@@ -0,0 +1,41 @@
+function runScript() {
+  throw new Error("Intentional error.");
+}
+
+function unused() {
+  // The following string is intended to be relatively large since some
+  // browsers trigger different code paths based on script size.
+  return "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a " +
+         "tortor ut orci bibendum blandit non quis diam. Aenean sit amet " +
+         "urna sit amet neque malesuada ultricies at vel nisi. Nunc et lacus " +
+         "est. Nam posuere erat enim, ac fringilla purus pellentesque " +
+         "cursus. Proin sodales eleifend lorem, eu semper massa scelerisque " +
+         "ac. Maecenas pharetra leo malesuada vulputate vulputate. Sed at " +
+         "efficitur odio. In rhoncus neque varius nibh efficitur gravida. " +
+         "Curabitur vitae dolor enim. Mauris semper lobortis libero sed " +
+         "congue. Donec felis ante, fringilla eget urna ut, finibus " +
+         "hendrerit lacus. Donec at interdum diam. Proin a neque vitae diam " +
+         "egestas euismod. Mauris posuere elementum lorem, eget convallis " +
+         "nisl elementum et. In ut leo ac neque dapibus pharetra quis ac " +
+         "velit. Integer pretium lectus non urna vulputate, in interdum mi " +
+         "lobortis. Sed laoreet ex et metus pharetra blandit. Curabitur " +
+         "sollicitudin non neque eu varius. Phasellus posuere congue arcu, " +
+         "in aliquam nunc fringilla a. Morbi id facilisis libero. Phasellus " +
+         "metus. Lorem ipsum dolor sit amet, consectetur adipiscing elit. " +
+         "tortor ut orci bibendum blandit non quis diam. Aenean sit amet " +
+         "urna sit amet neque malesuada ultricies at vel nisi. Nunc et lacus " +
+         "est. Nam posuere erat enim, ac fringilla purus pellentesque " +
+         "cursus. Proin sodales eleifend lorem, eu semper massa scelerisque " +
+         "ac. Maecenas pharetra leo malesuada vulputate vulputate. Sed at " +
+         "efficitur odio. In rhoncus neque varius nibh efficitur gravida. " +
+         "Curabitur vitae dolor enim. Mauris semper lobortis libero sed " +
+         "congue. Donec felis ante, fringilla eget urna ut, finibus " +
+         "hendrerit lacus. Donec at interdum diam. Proin a neque vitae diam " +
+         "egestas euismod. Mauris posuere elementum lorem, eget convallis " +
+         "nisl elementum et. In ut leo ac neque dapibus pharetra quis ac " +
+         "velit. Integer pretium lectus non urna vulputate, in interdum mi " +
+         "lobortis. Sed laoreet ex et metus pharetra blandit. Curabitur " +
+         "sollicitudin non neque eu varius. Phasellus posuere congue arcu, " +
+         "in aliquam nunc fringilla a. Morbi id facilisis libero. Phasellus " +
+         "metus.";
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-small.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-small.js
new file mode 100644
index 000000000000..8b890985752f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-small.js
@@ -0,0 +1,3 @@
+function runScript() {
+  throw new Error("Intentional error.");
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-sw.js
new file mode 100644
index 000000000000..4d882c617d8d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/opaque-script-sw.js
@@ -0,0 +1,37 @@
+importScripts('test-helpers.sub.js');
+importScripts('/common/get-host-info.sub.js');
+
+const NAME = 'foo';
+const SAME_ORIGIN_BASE = new URL('./', self.location.href).href;
+const CROSS_ORIGIN_BASE = new URL('./',
+    get_host_info().HTTPS_REMOTE_ORIGIN + base_path()).href;
+
+const urls = [
+  `${SAME_ORIGIN_BASE}opaque-script-small.js`,
+  `${SAME_ORIGIN_BASE}opaque-script-large.js`,
+  `${CROSS_ORIGIN_BASE}opaque-script-small.js`,
+  `${CROSS_ORIGIN_BASE}opaque-script-large.js`,
+];
+
+self.addEventListener('install', evt => {
+  evt.waitUntil(async function() {
+    const c = await caches.open(NAME);
+    const promises = urls.map(async function(u) {
+      const r = await fetch(u, { mode: 'no-cors' });
+      await c.put(u, r);
+    });
+    await Promise.all(promises);
+  }());
+});
+
+self.addEventListener('fetch', evt => {
+  const url = new URL(evt.request.url);
+  if (!url.pathname.includes('opaque-script-small.js') &&
+      !url.pathname.includes('opaque-script-large.js')) {
+    return;
+  }
+  evt.respondWith(async function() {
+    const c = await caches.open(NAME);
+    return c.match(evt.request);
+  }());
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text
new file mode 100644
index 000000000000..f3d9861c137b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text
@@ -0,0 +1 @@
+Network
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text.headers b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text.headers
new file mode 100644
index 000000000000..156209f9c81f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct1.text.headers
@@ -0,0 +1 @@
+Content-Type: text/html
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text
new file mode 100644
index 000000000000..f3d9861c137b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text
@@ -0,0 +1 @@
+Network
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text.headers b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text.headers
new file mode 100644
index 000000000000..156209f9c81f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/or-test/direct2.text.headers
@@ -0,0 +1 @@
+Content-Type: text/html
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/other.html b/test/fixtures/wpt/service-workers/service-worker/resources/other.html
new file mode 100644
index 000000000000..b9f350438772
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/other.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<title>Other</title>
+Here's an other html file.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/override_assert_object_equals.js b/test/fixtures/wpt/service-workers/service-worker/resources/override_assert_object_equals.js
new file mode 100644
index 000000000000..835046d472b2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/override_assert_object_equals.js
@@ -0,0 +1,58 @@
+// .body attribute of Request and Response object are experimental feture. It is
+// enabled when --enable-experimental-web-platform-features flag is set.
+// Touching this attribute can change the behavior of the objects. To avoid
+// touching it while comparing the objects in LayoutTest, we overwrite
+// assert_object_equals method.
+
+(function() {
+  var original_assert_object_equals = self.assert_object_equals;
+  function _brand(object) {
+    return Object.prototype.toString.call(object).match(/^\[object (.*)\]$/)[1];
+  }
+  var assert_request_equals = function(actual, expected, prefix) {
+    if (typeof actual !== 'object') {
+      assert_equals(actual, expected, prefix);
+      return;
+    }
+    assert_true(actual instanceof Request, prefix);
+    assert_true(expected instanceof Request, prefix);
+    assert_equals(actual.bodyUsed, expected.bodyUsed, prefix + '.bodyUsed');
+    assert_equals(actual.method, expected.method, prefix + '.method');
+    assert_equals(actual.url, expected.url, prefix + '.url');
+    original_assert_object_equals(actual.headers, expected.headers,
+                                  prefix + '.headers');
+    assert_equals(actual.context, expected.context, prefix + '.context');
+    assert_equals(actual.referrer, expected.referrer, prefix + '.referrer');
+    assert_equals(actual.mode, expected.mode, prefix + '.mode');
+    assert_equals(actual.credentials, expected.credentials,
+                  prefix + '.credentials');
+    assert_equals(actual.cache, expected.cache, prefix + '.cache');
+  };
+  var assert_response_equals = function(actual, expected, prefix) {
+    if (typeof actual !== 'object') {
+      assert_equals(actual, expected, prefix);
+      return;
+    }
+    assert_true(actual instanceof Response, prefix);
+    assert_true(expected instanceof Response, prefix);
+    assert_equals(actual.bodyUsed, expected.bodyUsed, prefix + '.bodyUsed');
+    assert_equals(actual.type, expected.type, prefix + '.type');
+    assert_equals(actual.url, expected.url, prefix + '.url');
+    assert_equals(actual.status, expected.status, prefix + '.status');
+    assert_equals(actual.statusText, expected.statusText,
+                  prefix + '.statusText');
+    original_assert_object_equals(actual.headers, expected.headers,
+                                  prefix + '.headers');
+  };
+  var assert_object_equals = function(actual, expected, description) {
+    var prefix = (description ? description + ': ' : '') + _brand(expected);
+    if (expected instanceof Request) {
+      assert_request_equals(actual, expected, prefix);
+    } else if (expected instanceof Response) {
+      assert_response_equals(actual, expected, prefix);
+    } else {
+      original_assert_object_equals(actual, expected, description);
+    }
+  };
+  self.assert_object_equals = assert_object_equals;
+})();
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-credentialless-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-credentialless-frame.html
new file mode 100644
index 000000000000..25ddf601457c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-credentialless-frame.html
@@ -0,0 +1,114 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Credentialless Iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+</head>
+
+<body>
+<script>
+
+// Check workers registered by a credentialless frame can access cookies set in that frame.
+promise_test(async t => {
+  const script = './partitioned-cookies-3p-sw.js';
+  const scope = './partitioned-cookies-3p-';
+  const absolute_scope = new URL(scope, window.location).href;
+
+  // Set a Partitioned cookie.
+  document.cookie = '__Host-partitioned=123; Secure; Path=/; SameSite=None; Partitioned;';
+  assert_true(document.cookie.includes('__Host-partitioned=123'));
+
+  // Make sure DOM cannot access the unpartitioned cookie.
+  assert_false(document.cookie.includes('unpartitioned=456'));
+
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  let filtered_registrations =
+      retrieved_registrations.filter(reg => reg.scope == absolute_scope);
+
+  // on_message will be reassigned below based on the expected reply from the service worker.
+  let on_message;
+  self.addEventListener('message', ev => on_message(ev));
+  navigator.serviceWorker.addEventListener('message', evt => {
+    self.postMessage(evt.data, '*');
+  });
+
+  // First test that the worker script started correctly and message passing is enabled.
+  let resolve_wait_promise;
+  let wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  let got;
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({type: 'test_message'});
+  await wait_promise;
+  assert_true(got.ok, 'Message passing');
+
+  // Test that the partitioned cookie is available to this worker via CookieStore API.
+  wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_js'});
+  await wait_promise;
+  assert_true(got.ok, 'Get cookies');
+  assert_true(
+      got.cookies.includes('__Host-partitioned'),
+      'Credentialless frame worker can access partitioned cookie via JS');
+  assert_false(
+      got.cookies.includes('unpartitioned'),
+      'Credentialless frame worker cannot access unpartitioned cookie via JS');
+
+  // Test that the partitioned cookie is available to this worker via HTTP.
+  wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({ type: 'echo_cookies_http' });
+  await wait_promise;
+  assert_true(got.ok, 'Get cookies');
+  assert_true(
+      got.cookies.includes('__Host-partitioned'),
+      'Credentialless frame worker can access partitioned cookie via HTTP');
+  assert_false(
+      got.cookies.includes('unpartitioned'),
+      'Credentialless frame worker cannot access unpartitioned cookie via HTTP');
+
+  // Test that the partitioned cookie is not available to this worker in HTTP
+  // requests from importScripts.
+  wait_promise = new Promise(resolve => {
+    resolve_wait_promise = resolve;
+  });
+  on_message = ev => {
+    got = ev.data;
+    resolve_wait_promise();
+  };
+  filtered_registrations[0].active.postMessage({ type: 'echo_cookies_import' });
+  await wait_promise;
+  assert_true(got.ok, 'Get cookies');
+  assert_true(
+      got.cookies.includes('__Host-partitioned'),
+      'Credentialless frame worker can access partitioned cookie via importScripts');
+  assert_false(
+      got.cookies.includes('unpartitioned'),
+      'Credentialless frame worker cannot access unpartitioned cookie via importScripts');
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-frame.html
new file mode 100644
index 000000000000..97f3a9c3df3e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-frame.html
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Iframe</title>
+<script src="partitioned-cookies-test-helpers.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="test-helpers.sub.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async t => {
+  const script = './partitioned-cookies-3p-sw.js';
+  const scope = './partitioned-cookies-3p-';
+  const absolute_scope = new URL(scope, window.location).href;
+
+  assert_false(
+      document.cookie.includes('__Host-partitioned=123'),
+      'DOM cannot access partitioned cookie');
+
+  const reg = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+  let filtered_registrations =
+    retrieved_registrations.filter(reg => reg.scope == absolute_scope);
+
+  const next_message = worker_message_generator();
+
+  // First test that the worker script started correctly and message passing
+  // is enabled.
+  filtered_registrations[0].active.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  // Test that the partitioned cookie is not available to this worker via HTTP.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_false(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Worker cannot access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Worker can access unpartitioned cookie via HTTP');
+
+  // Test that the partitioned cookie is not available to this worker via
+  // CookieStore API.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_js'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_false(
+      msg3.cookies.includes('__Host-partitioned'),
+      'Worker cannot access partitioned cookie via JS');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Worker can access unpartitioned cookie via JS');
+
+  // Test that the partitioned cookie is not available to this worker in HTTP
+  // requests from importScripts.
+  filtered_registrations[0].active.postMessage({type: 'echo_cookies_import'});
+  const msg4 = await next_message();
+  assert_true(msg4.ok, 'Get cookies');
+  assert_false(
+      msg4.cookies.includes('__Host-partitioned'),
+      'Worker cannot access partitioned cookie via importScripts');
+  assert_true(
+      msg4.cookies.includes('unpartitioned'),
+      'Worker can access unpartitioned cookie via importScripts');
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-sw.js
new file mode 100644
index 000000000000..c9713b6c50c4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-sw.js
@@ -0,0 +1,3 @@
+// Import the code from the 1P partitioned worker.
+// We use separate URLs for each worker script to keep their scopes unique.
+importScripts('./partitioned-cookies-sw.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-window.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-window.html
new file mode 100644
index 000000000000..40d38b3f79f3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-3p-window.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Window</title>
+<script src="/resources/testharness.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async t => {
+  assert_true(
+      location.search.includes('origin='), 'First party origin passed');
+  const first_party_origin = decodeURIComponent(
+      location.search.split('origin=')[1]);
+  const iframe = document.createElement('iframe');
+  iframe.src = new URL(
+      './partitioned-cookies-3p-frame.html',
+      first_party_origin + location.pathname).href;
+  document.body.appendChild(iframe);
+  await fetch_tests_from_window(iframe.contentWindow);
+
+  const credentialless_frame = document.createElement('iframe');
+  credentialless_frame.credentialless = true;
+  credentialless_frame.src = new URL(
+      './partitioned-cookies-3p-credentialless-frame.html',
+      first_party_origin + location.pathname).href;
+  document.body.appendChild(credentialless_frame);
+  await fetch_tests_from_window(credentialless_frame.contentWindow);
+});
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-sw.js
new file mode 100644
index 000000000000..767dbf443275
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-sw.js
@@ -0,0 +1,53 @@
+self.addEventListener('message', ev => ev.waitUntil(onMessage(ev)));
+
+async function onMessage(event) {
+  if (!event.data)
+    return;
+  switch (event.data.type) {
+    case 'test_message':
+      return onTestMessage(event);
+    case 'echo_cookies_http':
+      return onEchoCookiesHttp(event);
+    case 'echo_cookies_js':
+      return onEchoCookiesJs(event);
+    case 'echo_cookies_import':
+      return onEchoCookiesImport(event);
+    default:
+      return;
+  }
+}
+
+// test_message just verifies that the message passing is working.
+async function onTestMessage(event) {
+  event.source.postMessage({ok: true});
+}
+
+async function onEchoCookiesHttp(event) {
+  try {
+    const resp = await fetch(
+        `${self.origin}/cookies/resources/list.py`, {credentials: 'include'});
+    const cookies = await resp.json();
+    event.source.postMessage({ok: true, cookies: Object.keys(cookies)});
+  } catch (err) {
+    event.source.postMessage({ok: false});
+  }
+}
+
+// echo_cookies returns the names of all of the cookies available to the worker.
+async function onEchoCookiesJs(event) {
+  try {
+    const cookie_objects = await self.cookieStore.getAll();
+    const cookies = cookie_objects.map(c => c.name);
+    event.source.postMessage({ok: true, cookies});
+  } catch (err) {
+    event.source.postMessage({ok: false});
+  }
+}
+
+// Sets `self._cookies` variable, array of the names of cookies available to
+// the request.
+importScripts(`${self.origin}/cookies/resources/list-cookies-for-script.py`);
+
+function onEchoCookiesImport(event) {
+  event.source.postMessage({ok: true, cookies: self._cookies});
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-test-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-test-helpers.js
new file mode 100644
index 000000000000..73f3b0bde069
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-cookies-test-helpers.js
@@ -0,0 +1,31 @@
+// Return a generator containing the worker's message.
+//
+// Usage:
+//   await navigator.serviceWorker.register(...)
+//   ...
+//   const nextMessage = worker_message_generator();
+//   const msg_1 = await nextMessage();
+//   const msg_2 = await nextMessage();
+//   const msg_3 = await nextMessage();
+//
+// Worker should have its own onmessage event listener that
+// postMessages replies to the DOM.
+function worker_message_generator() {
+  const buffer = [];
+  let resolve = null;
+
+  navigator.serviceWorker.addEventListener('message', message => {
+    buffer.push(message.data);
+    if (resolve) {
+      resolve();
+    }
+  });
+
+  return async function () {
+    if (buffer.length != 0) {
+      return buffer.shift();
+    }
+    await new Promise(r => resolve = r);
+    return buffer.shift();
+  }
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-iframe-claim.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-iframe-claim.html
new file mode 100644
index 000000000000..12b048ee04c7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-iframe-claim.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+  <script>
+    // 1p mode will respond to requests for its current controller and
+    // postMessage when its controller changes.
+    async function onLoad1pMode(){
+      self.addEventListener('message', evt => {
+        if(!evt.data)
+          return;
+
+        if (evt.data.type === "get-controller") {
+          window.parent.postMessage({controller: navigator.serviceWorker.controller});
+        }
+      });
+
+      navigator.serviceWorker.addEventListener('controllerchange', evt => {
+        window.parent.postMessage({status: "success", context: "1p"}, '*');
+      });
+    }
+
+    // 3p mode will tell its SW to claim and then postMessage its results
+    // automatically.
+    async function onLoad3pMode() {
+      reg = await setupServiceWorker();
+
+      if(navigator.serviceWorker.controller != null){
+        //This iframe is already under control of a service worker, testing for
+        // a controller change will timeout. Return a failure.
+        window.parent.postMessage({status: "failure", context: "3p"}, '*');
+        return;
+      }
+
+      // Once this client is claimed, let the test know.
+      navigator.serviceWorker.addEventListener('controllerchange', evt => {
+        window.parent.postMessage({status: "success", context: "3p"}, '*');
+      });
+
+      // Trigger the SW to claim.
+      reg.active.postMessage({type: "claim"});
+
+    }
+
+    const request_url = new URL(window.location.href);
+    var url_search = request_url.search.substr(1);
+
+    if(url_search == "1p-mode") {
+      self.addEventListener('load', onLoad1pMode);
+    }
+    else if(url_search == "3p-mode") {
+      self.addEventListener('load', onLoad3pMode);
+    }
+    // Else do nothing.
+  </script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-child.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-child.html
new file mode 100644
index 000000000000..d05fef48bf0e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-child.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: Innermost nested iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+Innermost 1p iframe (A2) with 3p ancestor (A1-B-A2-A3): this iframe will
+register a service worker when it loads and then add its own iframe (A3) that
+will attempt to navigate to a url. ServiceWorker will intercept this navigation
+and resolve the ServiceWorker's internal Promise. When
+ThirdPartyStoragePartitioning is enabled, this iframe should be partitioned
+from the main frame and should not share a ServiceWorker.
+<script>
+
+async function onLoad() {
+  // Set-up the ServiceWorker for this iframe, defined in:
+  // service-workers/service-worker/resources/partitioned-utils.js
+  await setupServiceWorker();
+
+  // When the SW's iframe finishes it'll post a message. This forwards
+  // it up to the middle-iframe.
+  self.addEventListener('message', evt => {
+      window.parent.postMessage(evt.data, '*');
+  });
+
+  // Now that we have set up the ServiceWorker, we need it to
+  // intercept a navigation that will resolve its promise.
+  // To do this, we create an additional iframe to send that
+  // navigation request to resolve (`resolve.fakehtml`). If we're
+  // partitioned then there shouldn't be a promise to resolve. Defined
+  // in: service-workers/service-worker/resources/partitioned-storage-sw.js
+  const resolve_frame_url = new URL('./partitioned-resolve.fakehtml?FromNestedFrame', self.location);
+  const frame_resolve = await new Promise(resolve => {
+    var frame = document.createElement('iframe');
+    frame.src = resolve_frame_url;
+    frame.onload = function() { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+self.addEventListener('load', onLoad);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-parent.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-parent.html
new file mode 100644
index 000000000000..f748e2f78d91
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-nested-iframe-parent.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<title>Service Worker: Middle nested iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+Middle of the nested iframes (3p ancestor or B in A1-B-A2).
+<script>
+
+async function onLoad() {
+  // The innermost iframe will recieve a message from the
+  // ServiceWorker and pass it to this iframe. We need to
+  // then pass that message to the main frame to complete
+  // the test.
+  self.addEventListener('message', evt => {
+      window.parent.postMessage(evt.data, '*');
+  });
+
+  // Embed the innermost iframe and set-up the service worker there.
+  const innermost_iframe_url = new URL('./partitioned-service-worker-nested-iframe-child.html',
+    get_host_info().HTTPS_ORIGIN + self.location.pathname);
+  var frame = document.createElement('iframe');
+  frame.src = innermost_iframe_url;
+  document.body.appendChild(frame);
+}
+
+self.addEventListener('load', onLoad);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-getRegistrations.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-getRegistrations.html
new file mode 100644
index 000000000000..747c05894602
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-getRegistrations.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+  This iframe will register a service worker when it loads and then will use
+  getRegistrations to get a handle to the SW. It will then postMessage to the
+  SW to retrieve the SW's ID. This iframe will then forward that message up,
+  eventually, to the test.
+  <script>
+
+    async function onLoad() {
+      const scope = './partitioned-'
+      const absoluteScope = new URL(scope, window.location).href;
+
+      await setupServiceWorker();
+
+      // Once the SW sends us its ID, forward it up to the window.
+      navigator.serviceWorker.addEventListener('message', evt => {
+        window.parent.postMessage(evt.data, '*');
+      });
+
+      // Now get the SW with getRegistrations.
+      const retrieved_registrations =
+        await navigator.serviceWorker.getRegistrations();
+
+      // It's possible that other tests have left behind other service workers.
+      // This steps filters those other SWs out.
+      const filtered_registrations =
+        retrieved_registrations.filter(reg => reg.scope == absoluteScope);
+
+      filtered_registrations[0].active.postMessage({type: "get-id"});
+
+    }
+
+    self.addEventListener('load', onLoad);
+  </script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-matchAll.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-matchAll.html
new file mode 100644
index 000000000000..7a2c36693e1e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe-matchAll.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+<body>
+  This iframe will register a service worker when it loads and then will use
+  getRegistrations to get a handle to the SW. It will then postMessage to the
+  SW to get the SW's clients via matchAll(). This iframe will then forward the
+  SW's response up, eventually, to the test.
+  <script>
+    async function onLoad() {
+      reg = await setupServiceWorker();
+
+      // Once the SW sends us its ID, forward it up to the window.
+      navigator.serviceWorker.addEventListener('message', evt => {
+        window.parent.postMessage(evt.data, '*');
+      });
+
+      reg.active.postMessage({type: "get-match-all"});
+
+    }
+
+    self.addEventListener('load', onLoad);
+  </script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe.html
new file mode 100644
index 000000000000..1b7f671b3714
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-iframe.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P iframe for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="./partitioned-utils.js"></script>
+
+
+<body>
+This iframe will register a service worker when it loads and then add its own
+iframe that will attempt to navigate to a url that service worker will intercept
+and use to resolve the service worker's internal Promise.
+<script>
+
+async function onLoad() {
+  await setupServiceWorker();
+
+  // When the SW's iframe finishes it'll post a message. This forwards it up to
+  // the window.
+  self.addEventListener('message', evt => {
+      window.parent.postMessage(evt.data, '*');
+  });
+
+  // Now try to resolve the SW's promise. If we're partitioned then there
+  // shouldn't be a promise to resolve.
+  const resolve_frame_url = new URL('./partitioned-resolve.fakehtml?From3pFrame', self.location);
+  const frame_resolve = await new Promise(resolve => {
+    var frame = document.createElement('iframe');
+    frame.src = resolve_frame_url;
+    frame.onload = function() { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+self.addEventListener('load', onLoad);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-window.html b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-window.html
new file mode 100644
index 000000000000..86384ce28087
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-service-worker-third-party-window.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>Service Worker: 3P window for partitioned service workers</title>
+<script src="./test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+
+
+<body>
+This page should be opened as a third-party window. It then loads an iframe
+specified by the query parameter. Finally it forwards the postMessage from the
+iframe up to the opener (the test).
+
+<script>
+
+async function onLoad() {
+  const message_promise = new Promise(resolve => {
+    self.addEventListener('message', evt => {
+      resolve(evt.data);
+    });
+  });
+
+  const search_param = new URLSearchParams(window.location.search);
+  const iframe_url = search_param.get('target');
+
+  var frame = document.createElement('iframe');
+  frame.src = iframe_url;
+  frame.style.position = 'absolute';
+  document.body.appendChild(frame);
+
+
+  await message_promise.then(data => {
+    // We're done, forward the message and clean up.
+    window.opener.postMessage(data, '*');
+
+    frame.remove();
+  });
+}
+
+self.addEventListener('load', onLoad);
+
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-storage-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-storage-sw.js
new file mode 100644
index 000000000000..00f797981037
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-storage-sw.js
@@ -0,0 +1,81 @@
+// Holds the promise that the "resolve.fakehtml" call attempts to resolve.
+// This is "the SW's promise" that other parts of the test refer to.
+var promise;
+// Stores the resolve funcution for the current promise.
+var pending_resolve_func = null;
+// Unique ID to determine which service worker is being used.
+const ID = Math.random();
+
+function callAndResetResolve() {
+  var local_resolve = pending_resolve_func;
+  pending_resolve_func = null;
+  local_resolve();
+}
+
+self.addEventListener('fetch', function(event) {
+  fetchEventHandler(event);
+})
+
+self.addEventListener('message', (event) => {
+  event.waitUntil(async function() {
+    if(!event.data)
+      return;
+
+    if (event.data.type === "get-id") {
+      event.source.postMessage({ID: ID});
+    }
+    else if(event.data.type === "get-match-all") {
+      clients.matchAll({includeUncontrolled: true}).then(clients_list => {
+        const url_list = clients_list.map(item => item.url);
+        event.source.postMessage({urls_list: url_list});
+      });
+    }
+    else if(event.data.type === "claim") {
+      await clients.claim();
+    }
+  }());
+});
+
+async function fetchEventHandler(event){
+  var request_url = new URL(event.request.url);
+  var url_search = request_url.search.substr(1);
+  request_url.search = "";
+  if ( request_url.href.endsWith('waitUntilResolved.fakehtml') ) {
+
+      if (pending_resolve_func != null) {
+        // Respond with an error if there is already a pending promise
+        event.respondWith(Response.error());
+        return;
+      }
+
+      // Create the new promise.
+      promise = new Promise(function(resolve) {
+        pending_resolve_func = resolve;
+      });
+      event.waitUntil(promise);
+
+      event.respondWith(new Response(`
+        <html>
+        Promise created by ${url_search}
+        <script>self.parent.postMessage({ ID:${ID}, source: "${url_search}"
+          }, '*');</script>
+        </html>
+        `, {headers: {'Content-Type': 'text/html'}}
+      ));
+
+  }
+  else if ( request_url.href.endsWith('resolve.fakehtml') ) {
+    var has_pending = !!pending_resolve_func;
+    event.respondWith(new Response(`
+      <html>
+      Promise settled for ${url_search}
+      <script>self.parent.postMessage({ ID:${ID}, has_pending: ${has_pending},
+        source: "${url_search}"  }, '*');</script>
+      </html>
+    `, {headers: {'Content-Type': 'text/html'}}));
+
+    if (has_pending) {
+      callAndResetResolve();
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-utils.js b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-utils.js
new file mode 100644
index 000000000000..22e90beaec77
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/partitioned-utils.js
@@ -0,0 +1,110 @@
+// The resolve function for the current pending event listener's promise.
+// It is nulled once the promise is resolved.
+var message_event_promise_resolve = null;
+
+function messageEventHandler(evt) {
+  if (message_event_promise_resolve) {
+    local_resolve = message_event_promise_resolve;
+    message_event_promise_resolve = null;
+    local_resolve(evt.data);
+  }
+}
+
+function makeMessagePromise() {
+  if (message_event_promise_resolve != null) {
+    // Do not create a new promise until the previous is settled.
+    return;
+  }
+
+  return new Promise(resolve => {
+    message_event_promise_resolve = resolve;
+  });
+}
+
+// Loads a url for the frame type and then returns a promise for
+// the data that was postMessage'd from the loaded frame.
+// If the frame type is 'window' then `url` is encoded into the search param
+// as the url the 3p window is meant to iframe.
+function loadAndReturnSwData(t, url, frame_type) {
+  if (frame_type !== 'iframe' && frame_type !== 'window') {
+    return;
+  }
+
+  const message_promise = makeMessagePromise();
+
+  // Create the iframe or window and then return the promise for data.
+  if ( frame_type === 'iframe' ) {
+    const frame = with_iframe(url, false);
+    t.add_cleanup(async () => {
+      const f = await frame;
+      f.remove();
+    });
+  }
+  else {
+    // 'window' case.
+    const search_param = new URLSearchParams();
+    search_param.append('target', url);
+
+    const third_party_window_url = new URL(
+    './resources/partitioned-service-worker-third-party-window.html' +
+    '?' + search_param,
+    get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname);
+
+    const w = window.open(third_party_window_url);
+    t.add_cleanup(() => w.close());
+  }
+
+  return message_promise;
+}
+
+// Checks for an existing service worker registration. If not present,
+// registers and maintains a service worker. Used in windows or iframes
+// that will be partitioned from the main frame.
+async function setupServiceWorker() {
+
+  const script = './partitioned-storage-sw.js';
+  const scope = './partitioned-';
+
+  var reg = await navigator.serviceWorker.register(script, { scope: scope });
+
+  // We should keep track if we installed a worker or not. If we did then we
+  // need to uninstall it. Otherwise we let the top level test uninstall it
+  // (If partitioning is not working).
+  var installed_a_worker = true;
+  await new Promise(resolve => {
+    // Check if a worker is already activated.
+    var worker = reg.active;
+    // If so, just resolve.
+    if ( worker ) {
+      installed_a_worker = false;
+      resolve();
+      return;
+    }
+
+    //Otherwise check if one is waiting.
+    worker = reg.waiting;
+    // If not waiting, grab the installing worker.
+    if ( !worker ) {
+      worker = reg.installing;
+    }
+
+    // Resolve once it's activated.
+    worker.addEventListener('statechange', evt => {
+      if (worker.state === 'activated') {
+        resolve();
+      }
+    });
+  });
+
+  self.addEventListener('unload', async () => {
+    // If we didn't install a worker then that means the top level test did, and
+    // that test is therefore responsible for cleaning it up.
+    if ( !installed_a_worker ) {
+        return;
+    }
+
+    await reg.unregister();
+  });
+
+  return reg;
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/pass-through-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/pass-through-worker.js
new file mode 100644
index 000000000000..5eaf48d5887d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/pass-through-worker.js
@@ -0,0 +1,3 @@
+addEventListener('fetch', evt => {
+  evt.respondWith(fetch(evt.request));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/pass.txt b/test/fixtures/wpt/service-workers/service-worker/resources/pass.txt
new file mode 100644
index 000000000000..7ef22e9a431a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/pass.txt
@@ -0,0 +1 @@
+PASS
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/performance-timeline-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/performance-timeline-worker.js
new file mode 100644
index 000000000000..6c6dfcbd2811
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/performance-timeline-worker.js
@@ -0,0 +1,62 @@
+importScripts('/resources/testharness.js');
+
+promise_test(function(test) {
+    var durationMsec = 100;
+    // There are limits to our accuracy here.  Timers may fire up to a
+    // millisecond early due to platform-dependent rounding.  In addition
+    // the performance API introduces some rounding as well to prevent
+    // timing attacks.
+    var accuracy = 1.5;
+    return new Promise(function(resolve) {
+        performance.mark('startMark');
+        setTimeout(resolve, durationMsec);
+      }).then(function() {
+          performance.mark('endMark');
+          performance.measure('measure', 'startMark', 'endMark');
+          var startMark = performance.getEntriesByName('startMark')[0];
+          var endMark = performance.getEntriesByName('endMark')[0];
+          var measure = performance.getEntriesByType('measure')[0];
+          assert_equals(measure.startTime, startMark.startTime);
+          assert_approx_equals(endMark.startTime - startMark.startTime,
+                               measure.duration, 0.001);
+          assert_greater_than(measure.duration, durationMsec - accuracy);
+          assert_equals(performance.getEntriesByType('mark').length, 2);
+          assert_equals(performance.getEntriesByType('measure').length, 1);
+          performance.clearMarks('startMark');
+          performance.clearMeasures('measure');
+          assert_equals(performance.getEntriesByType('mark').length, 1);
+          assert_equals(performance.getEntriesByType('measure').length, 0);
+      });
+  }, 'User Timing');
+
+promise_test(function(test) {
+    return fetch('sample.txt')
+      .then(function(resp) {
+          return resp.text();
+        })
+      .then(function(text) {
+          var expectedResources = ['testharness.js', 'sample.txt'];
+          assert_equals(performance.getEntriesByType('resource').length, expectedResources.length);
+          for (var i = 0; i < expectedResources.length; i++) {
+              var entry = performance.getEntriesByType('resource')[i];
+              assert_true(entry.name.endsWith(expectedResources[i]));
+              assert_equals(entry.workerStart, 0);
+              assert_greater_than(entry.startTime, 0);
+              assert_greater_than(entry.responseEnd, entry.startTime);
+          }
+          return new Promise(function(resolve) {
+              performance.onresourcetimingbufferfull = _ => {
+                resolve('bufferfull');
+              }
+              performance.setResourceTimingBufferSize(expectedResources.length);
+              fetch('sample.txt');
+          });
+        })
+      .then(function(result) {
+          assert_equals(result, 'bufferfull');
+          performance.clearResourceTimings();
+          assert_equals(performance.getEntriesByType('resource').length, 0);
+        })
+  }, 'Resource Timing');
+
+done();
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-blob-url.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-blob-url.js
new file mode 100644
index 000000000000..9095194a4c03
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-blob-url.js
@@ -0,0 +1,5 @@
+self.onmessage = e => {
+  fetch(e.data)
+  .then(response => response.text())
+  .then(text => e.source.postMessage('Worker reply:' + text));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-dictionary-transferables-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-dictionary-transferables-worker.js
new file mode 100644
index 000000000000..87a4500d754a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-dictionary-transferables-worker.js
@@ -0,0 +1,24 @@
+var messageHandler = function(port, e) {
+    var text_decoder = new TextDecoder;
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+
+    // Send back the array buffer via Client.postMessage.
+    port.postMessage(e.data, {transfer: [e.data.buffer]});
+
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+};
+
+self.addEventListener('message', e => {
+    if (e.ports[0]) {
+      // Wait for messages sent via MessagePort.
+      e.ports[0].onmessage = messageHandler.bind(null, e.ports[0]);
+      return;
+    }
+    messageHandler(e.source, e);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-echo-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-echo-worker.js
new file mode 100644
index 000000000000..f088ad127804
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-echo-worker.js
@@ -0,0 +1,3 @@
+self.addEventListener('message', event => {
+  event.source.postMessage(event.data);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-fetched-text.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-fetched-text.js
new file mode 100644
index 000000000000..9fc67171d05d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-fetched-text.js
@@ -0,0 +1,5 @@
+self.onmessage = async (e) => {
+  const response = await fetch(e.data);
+  const text = await response.text();
+  self.postMessage(text);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-msgport-to-client-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-msgport-to-client-worker.js
new file mode 100644
index 000000000000..7af935f4f8fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-msgport-to-client-worker.js
@@ -0,0 +1,19 @@
+self.onmessage = function(e) {
+  e.waitUntil(self.clients.matchAll().then(function(clients) {
+      clients.forEach(function(client) {
+          var messageChannel = new MessageChannel();
+          messageChannel.port1.onmessage =
+            onMessageViaMessagePort.bind(null, messageChannel.port1);
+          client.postMessage(undefined, [messageChannel.port2]);
+        });
+    }));
+};
+
+function onMessageViaMessagePort(port, e) {
+  var message = e.data;
+  if ('value' in message) {
+    port.postMessage({ack: 'Acking value: ' + message.value});
+  } else if ('done' in message) {
+    port.postMessage({done: true});
+  }
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-on-load-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-on-load-worker.js
new file mode 100644
index 000000000000..c2b0bcb8bfb0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-on-load-worker.js
@@ -0,0 +1,9 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage('dedicated worker script loaded');
+} else if ('SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = evt => {
+    evt.ports[0].postMessage('shared worker script loaded');
+  };
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-to-client-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-to-client-worker.js
new file mode 100644
index 000000000000..17913063583a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-to-client-worker.js
@@ -0,0 +1,10 @@
+self.onmessage = function(e) {
+  e.waitUntil(self.clients.matchAll().then(function(clients) {
+      clients.forEach(function(client) {
+          client.postMessage('Sending message via clients');
+          if (!Array.isArray(clients))
+            client.postMessage('clients is not an array');
+          client.postMessage('quit');
+        });
+    }));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-transferables-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-transferables-worker.js
new file mode 100644
index 000000000000..d35c1c952b88
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-transferables-worker.js
@@ -0,0 +1,24 @@
+var messageHandler = function(port, e) {
+    var text_decoder = new TextDecoder;
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+
+    // Send back the array buffer via Client.postMessage.
+    port.postMessage(e.data, [e.data.buffer]);
+
+    port.postMessage({
+      content: text_decoder.decode(e.data),
+      byteLength: e.data.byteLength
+    });
+};
+
+self.addEventListener('message', e => {
+    if (e.ports[0]) {
+      // Wait for messages sent via MessagePort.
+      e.ports[0].onmessage = messageHandler.bind(null, e.ports[0]);
+      return;
+    }
+    messageHandler(e.source, e);
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-worker.js
new file mode 100644
index 000000000000..858cf04267c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/postmessage-worker.js
@@ -0,0 +1,19 @@
+var port;
+
+// Exercise the 'onmessage' handler:
+self.onmessage = function(e) {
+  var message = e.data;
+  if ('port' in message) {
+    port = message.port;
+  }
+};
+
+// And an event listener:
+self.addEventListener('message', function(e) {
+    var message = e.data;
+    if ('value' in message) {
+      port.postMessage('Acking value: ' + message.value);
+    } else if ('done' in message) {
+      port.postMessage('quit');
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/range-request-to-different-origins-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-to-different-origins-worker.js
new file mode 100644
index 000000000000..cab605833905
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-to-different-origins-worker.js
@@ -0,0 +1,40 @@
+// This worker is meant to test range requests where the responses come from
+// multiple origins. It forwards the first request to a cross-origin URL
+// (generating an opaque response). The server is expected to return a 206
+// Partial Content response.  Then the worker lets subsequent range requests
+// fall back to network (generating same-origin responses). The intent is to try
+// to trick the browser into treating the resource as same-origin.
+//
+// It would also be interesting to do the reverse test where the first request
+// goes to the same-origin URL, and subsequent range requests go cross-origin in
+// 'no-cors' mode to receive opaque responses. But the service worker cannot do
+// this, because in 'no-cors' mode the 'range' HTTP header is disallowed.
+
+importScripts('/common/get-host-info.sub.js')
+
+let initial = true;
+function is_initial_request() {
+  const old = initial;
+  initial = false;
+  return old;
+}
+
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url);
+    if (url.search.indexOf('VIDEO') == -1) {
+      // Fall back for non-video.
+      return;
+    }
+
+    // Make the first request go cross-origin.
+    if (is_initial_request()) {
+      const cross_origin_url = get_host_info().HTTPS_REMOTE_ORIGIN +
+          url.pathname + url.search;
+      const cross_origin_request = new Request(cross_origin_url,
+          {mode: 'no-cors', headers: e.request.headers});
+      e.respondWith(fetch(cross_origin_request));
+      return;
+    }
+
+    // Fall back to same origin for subsequent range requests.
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-different-cors-modes-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-different-cors-modes-worker.js
new file mode 100644
index 000000000000..7580b0b68a95
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-different-cors-modes-worker.js
@@ -0,0 +1,60 @@
+// This worker is meant to test range requests where the responses are a mix of
+// opaque ones and non-opaque ones. It forwards the first request to a
+// cross-origin URL (generating an opaque response). The server is expected to
+// return a 206 Partial Content response.  Then the worker forwards subsequent
+// range requests to that URL, with CORS sharing generating a non-opaque
+// responses. The intent is to try to trick the browser into treating the
+// resource as non-opaque.
+//
+// It would also be interesting to do the reverse test where the first request
+// uses 'cors', and subsequent range requests use 'no-cors' mode. But the
+// service worker cannot do this, because in 'no-cors' mode the 'range' HTTP
+// header is disallowed.
+
+importScripts('/common/get-host-info.sub.js')
+
+let initial = true;
+function is_initial_request() {
+  const old = initial;
+  initial = false;
+  return old;
+}
+
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url);
+    if (url.search.indexOf('VIDEO') == -1) {
+      // Fall back for non-video.
+      return;
+    }
+
+    let cross_origin_url = get_host_info().HTTPS_REMOTE_ORIGIN +
+        url.pathname + url.search;
+
+    // The first request is no-cors.
+    if (is_initial_request()) {
+      const init = { mode: 'no-cors', headers: e.request.headers };
+      const cross_origin_request = new Request(cross_origin_url, init);
+      e.respondWith(fetch(cross_origin_request));
+      return;
+    }
+
+    // Subsequent range requests are cors.
+
+    // Copy headers needed for range requests.
+    let my_headers = new Headers;
+    if (e.request.headers.get('accept'))
+      my_headers.append('accept', e.request.headers.get('accept'));
+    if (e.request.headers.get('range'))
+    my_headers.append('range', e.request.headers.get('range'));
+
+    // Add &ACAOrigin to allow CORS.
+    cross_origin_url += '&ACAOrigin=' + get_host_info().HTTPS_ORIGIN;
+    // Add &ACAHeaders to allow range requests.
+    cross_origin_url += '&ACAHeaders=accept,range';
+
+    // Make the CORS request.
+    const init = { mode: 'cors', headers: my_headers };
+    const cross_origin_request = new Request(cross_origin_url, init);
+    e.respondWith(fetch(cross_origin_request));
+  });
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-synth-head-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-synth-head-worker.js
new file mode 100644
index 000000000000..6b6395aecaef
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/range-request-with-synth-head-worker.js
@@ -0,0 +1,36 @@
+// This worker is meant to test range requests where the initial response
+// synthesizes a 206 Partial Content response with leading bytes.
+// Then the worker lets subsequent range requests fall back to network.
+
+let initial = true;
+function is_initial_request() {
+  const old = initial;
+  initial = false;
+  return old;
+}
+
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url);
+    if (url.search.indexOf('VIDEO') == -1) {
+      // Fall back for non-video.
+      return;
+    }
+
+    // Synthesize the response to the first request.
+    if (is_initial_request()) {
+      // Consistent with fetch-access-control.py?VIDEO
+      const init = {
+        status: 206,
+        headers: {
+          "Accept-Ranges": "bytes",
+          "Content-Type": "video/webm",
+          "Content-Range": "bytes 0-1/*",
+          "Content-Length": "2",
+        },
+      };
+      e.respondWith(new Response(new Uint8Array([0x1a, 0x45]), init));
+      return;
+    }
+
+    // Fall back for subsequent range requests.
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/redirect-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/redirect-worker.js
new file mode 100644
index 000000000000..82e21fc26fdb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/redirect-worker.js
@@ -0,0 +1,145 @@
+// We store an empty response for each fetch event request we see
+// in this Cache object so we can get the list of urls in the
+// message event.
+var cacheName = 'urls-' + self.registration.scope;
+
+var waitUntilPromiseList = [];
+
+// Sends the requests seen by this worker. The output is:
+// {
+//   requestInfos: [
+//     {url: url1, resultingClientId: id1},
+//     {url: url2, resultingClientId: id2},
+//   ]
+// }
+async function getRequestInfos(event) {
+  // Wait for fetch events to finish.
+  await Promise.all(waitUntilPromiseList);
+  waitUntilPromiseList = [];
+
+  // Generate the message.
+  const cache = await caches.open(cacheName);
+  const requestList = await cache.keys();
+  const requestInfos = [];
+  for (let i = 0; i < requestList.length; i++) {
+    const response = await cache.match(requestList[i]);
+    const body = await response.json();
+    requestInfos[i] = {
+      url: requestList[i].url,
+      resultingClientId: body.resultingClientId
+    };
+  }
+  await caches.delete(cacheName);
+
+  event.data.port.postMessage({requestInfos});
+}
+
+// Sends the results of clients.get(id) from this worker. The
+// input is:
+// {
+//   actual_ids: {a: id1, b: id2, x: id3}
+// }
+//
+// The output is:
+// {
+//   clients: {
+//     a: {found: false},
+//     b: {found: false},
+//     x: {
+//       id: id3,
+//       url: url1,
+//       found: true
+//    }
+//   }
+// }
+async function getClients(event) {
+  // |actual_ids| is like:
+  // {a: id1, b: id2, x: id3}
+  const actual_ids = event.data.actual_ids;
+  const result = {}
+  for (let key of Object.keys(actual_ids)) {
+    const id = actual_ids[key];
+    const client = await self.clients.get(id);
+    if (client === undefined)
+      result[key] = {found: false};
+    else
+      result[key] = {found: true, url: client.url, id: client.id};
+  }
+  event.data.port.postMessage({clients: result});
+}
+
+self.addEventListener('message', async function(event) {
+  if (event.data.command == 'getRequestInfos') {
+    event.waitUntil(getRequestInfos(event));
+    return;
+  }
+
+  if (event.data.command == 'getClients') {
+    event.waitUntil(getClients(event));
+    return;
+  }
+});
+
+function get_query_params(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+
+self.addEventListener('fetch', function(event) {
+    var waitUntilPromise = caches.open(cacheName).then(function(cache) {
+      const responseBody = {};
+      responseBody['resultingClientId'] = event.resultingClientId;
+      const headers = new Headers({'Content-Type': 'application/json'});
+      const response = new Response(JSON.stringify(responseBody), {headers});
+      return cache.put(event.request, response);
+    });
+    event.waitUntil(waitUntilPromise);
+
+    var params = get_query_params(event.request.url);
+    if (!params['sw']) {
+      // To avoid races, add the waitUntil() promise to our global list.
+      // If we get a message event before we finish here, it will wait
+      // these promises to complete before proceeding to read from the
+      // cache.
+      waitUntilPromiseList.push(waitUntilPromise);
+      return;
+    }
+
+    event.respondWith(waitUntilPromise.then(async () => {
+      if (params['sw'] == 'gen') {
+        return Response.redirect(params['url']);
+      } else if (params['sw'] == 'gen-manual') {
+        // Note this differs from Response.redirect() in that relative URLs are
+        // preserved.
+        return new Response("", {
+          status: 301,
+          headers: {location: params['url']},
+        });
+      } else if (params['sw'] == 'fetch') {
+        return fetch(event.request);
+      } else if (params['sw'] == 'fetch-url') {
+        return fetch(params['url']);
+      } else if (params['sw'] == 'follow') {
+        return fetch(new Request(event.request.url, {redirect: 'follow'}));
+      } else if (params['sw'] == 'manual') {
+        return fetch(new Request(event.request.url, {redirect: 'manual'}));
+      } else if (params['sw'] == 'manualThroughCache') {
+        const url = event.request.url;
+        await caches.delete(url)
+        const cache = await self.caches.open(url);
+        const response = await fetch(new Request(url, {redirect: 'manual'}));
+        await cache.put(event.request, response);
+        return cache.match(url);
+      }
+      // unexpected... trigger an interception failure
+    }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/referer-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/referer-iframe.html
new file mode 100644
index 000000000000..295ff4567154
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/referer-iframe.html
@@ -0,0 +1,39 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+function check_referer(url, expected_referer) {
+  return fetch(url)
+    .then(function(res) { return res.json(); })
+    .then(function(headers) {
+        if (headers['referer'] === expected_referer) {
+          return Promise.resolve();
+        } else {
+          return Promise.reject('Referer for ' + url + ' must be ' +
+                                expected_referer + ' but got ' +
+                                headers['referer']);
+        }
+      });
+}
+
+window.addEventListener('message', function(evt) {
+    var host_info = get_host_info();
+    var port = evt.ports[0];
+    check_referer('request-headers.py?ignore=true',
+                  host_info['HTTPS_ORIGIN'] +
+                  base_path() + 'referer-iframe.html')
+      .then(function() {
+          return check_referer(
+              'request-headers.py',
+              host_info['HTTPS_ORIGIN'] +
+              base_path() + 'referer-iframe.html');
+        })
+      .then(function() {
+          return check_referer(
+              'request-headers.py?url=request-headers.py',
+              host_info['HTTPS_ORIGIN'] +
+              base_path() + 'fetch-rewrite-worker.js');
+        })
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/referrer-policy-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/referrer-policy-iframe.html
new file mode 100644
index 000000000000..9ef3cd19a982
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/referrer-policy-iframe.html
@@ -0,0 +1,32 @@
+<script src="/common/get-host-info.sub.js"></script>
+<script src="test-helpers.sub.js"></script>
+<script>
+function check_referer(url, expected_referer) {
+  return fetch(url)
+    .then(function(res) { return res.json(); })
+    .then(function(headers) {
+        if (headers['referer'] === expected_referer) {
+          return Promise.resolve();
+        } else {
+          return Promise.reject('Referer for ' + url + ' must be ' +
+                                expected_referer + ' but got ' +
+                                headers['referer']);
+        }
+      });
+}
+
+window.addEventListener('message', function(evt) {
+    var host_info = get_host_info();
+    var port = evt.ports[0];
+    check_referer('request-headers.py?ignore=true',
+                  host_info['HTTPS_ORIGIN'] +
+                  base_path() + 'referrer-policy-iframe.html')
+      .then(function() {
+          return check_referer(
+              'request-headers.py?url=request-headers.py',
+              host_info['HTTPS_ORIGIN'] + '/');
+        })
+      .then(function() { port.postMessage({results: 'finish'}); })
+      .catch(function(e) { port.postMessage({results: 'failure:' + e}); });
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-closed-window-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-closed-window-iframe.html
new file mode 100644
index 000000000000..bd386574e2c5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-closed-window-iframe.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+window.addEventListener('message', async function(evt) {
+  if (evt.data === 'START') {
+    var w = window.open('./');
+    var sw = w.navigator.serviceWorker;
+    w.close();
+    w = null;
+
+    // Ensure sw.register receives a valid URL. The popup might have
+    // about:blank as base so sw.register('doestnmatter.js') would be invalid.
+    const swUrl = new URL('doestnmatter.js', document.baseURI).href;
+    try {
+      await sw.register(swUrl);
+    } finally {
+      parent.postMessage('OK', '*');
+    }
+  }
+});
+</script>
+</head>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-iframe.html
new file mode 100644
index 000000000000..f5a040e41d96
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-iframe.html
@@ -0,0 +1,4 @@
+<script type="text/javascript">
+navigator.serviceWorker.register('empty-worker.js',
+                                 {scope: 'register-iframe.html'});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-rewrite-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-rewrite-worker.html
new file mode 100644
index 000000000000..bf06317ad9e3
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-rewrite-worker.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<script>
+async function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  const scope = self.origin + params.get('scopepath');
+  const script = './fetch-rewrite-worker.js';
+  const reg = await navigator.serviceWorker.register(script, { scope: scope });
+  // In nested cases we may be impacted by partitioning or not depending on
+  // the browser.  With partitioning we will be installing a new worker here,
+  // but without partitioning the worker will already exist.  Handle both cases.
+  if (reg.installing) {
+    await new Promise(resolve => {
+      const worker = reg.installing;
+      worker.addEventListener('statechange', evt => {
+        if (worker.state === 'activated') {
+          resolve();
+        }
+      });
+    });
+    if (reg.navigationPreload) {
+      await reg.navigationPreload.enable();
+    }
+  }
+  if (window.opener) {
+    window.opener.postMessage({ type: 'SW-REGISTERED' }, '*');
+  } else {
+    window.top.postMessage({ type: 'SW-REGISTERED' }, '*');
+  }
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/register-static-router-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/register-static-router-iframe.html
new file mode 100644
index 000000000000..f23353af9cf9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/register-static-router-iframe.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<script>
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  async function setup() {
+    try {
+      const reg = await navigator.serviceWorker.register('static-router-sw.js?key=' + key, {scope: './', type: 'module'});
+      const worker = reg.installing || reg.waiting || reg.active;
+
+      // Wait for activation to ensure the SW controls the page and doesn't
+      // overwrite the cache entry in its install handler.
+      await new Promise(resolve => {
+        if (worker.state === 'activated') {
+          resolve();
+          return;
+        }
+        worker.addEventListener('statechange', () => {
+          if (worker.state === 'activated') resolve();
+        });
+      });
+
+      // Put a custom response for 'cache.html' that sends a message back.
+      const cache = await caches.open('v1');
+      await cache.put('cache.html', new Response(
+        '<html><body><script>window.parent.postMessage({type: "loaded_from_cache"}, "*");<\/script><\/body><\/html>',
+        {headers: {'Content-Type': 'text/html'}}
+      ));
+
+      window.parent.postMessage({type: 'registered'}, '*');
+    } catch (err) {
+      window.parent.postMessage({type: 'error', error: err.message}, '*');
+    }
+  }
+  setup();
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-mime-types.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-mime-types.js
new file mode 100644
index 000000000000..7a64cd91e411
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-mime-types.js
@@ -0,0 +1,122 @@
+// Registration tests that mostly verify the MIME type.
+//
+// This file tests every MIME type so it necessarily starts many service
+// workers, so it may be slow.
+function registration_tests_mime_types(register_method) {
+  promise_test(function(t) {
+      var script = 'resources/mime-type-worker.py';
+      var scope = 'resources/scope/no-mime-type-worker/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration of no MIME type script should fail.');
+    }, 'Registering script with no MIME type');
+
+  promise_test(function(t) {
+      var script = 'resources/mime-type-worker.py?mime=text/plain';
+      var scope = 'resources/scope/bad-mime-type-worker/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration of plain text script should fail.');
+    }, 'Registering script with bad MIME type');
+
+  // The top-level service worker script must have a JavaScript MIME type. A
+  // JSON MIME type is only valid for imported (non-top-level) modules, so
+  // registering a top-level script served as JSON must fail even when the body
+  // happens to be valid JavaScript.
+  const jsonMimeTypes = [
+    'application/json',
+    'text/json',
+    'application/manifest+json',
+  ];
+
+  for (const jsonMimeType of jsonMimeTypes) {
+    promise_test(function(t) {
+        // Encode the MIME type so characters such as '+' survive the query
+        // string instead of being decoded to a space by the server.
+        var script =
+            `resources/mime-type-worker.py?mime=${encodeURIComponent(jsonMimeType)}`;
+        // Use a scope unique to each MIME type so the registrations don't
+        // interfere with one another.
+        var scope = `resources/scope/json-mime-type-worker/${jsonMimeType}`;
+        return promise_rejects_dom(t,
+            'SecurityError',
+            register_method(script, {scope: scope}),
+            'Registration of JSON MIME type script should fail.');
+      }, `Registering script with JSON MIME type ${jsonMimeType}`);
+  }
+
+  /**
+   * ServiceWorkerContainer.register() should throw a TypeError, according to
+   * step 17.1 of https://w3c.github.io/ServiceWorker/#importscripts
+   *
+   * "[17] If an uncaught runtime script error occurs during the above step, then:
+   *  [17.1] Invoke Reject Job Promise with job and TypeError"
+   *
+   * (Where the "uncaught runtime script error" is thrown by an unsuccessful
+   * importScripts())
+   */
+  promise_test(function(t) {
+      var script = 'resources/import-mime-type-worker.py';
+      var scope = 'resources/scope/no-mime-type-worker/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of no MIME type imported script should fail.');
+    }, 'Registering script that imports script with no MIME type');
+
+  promise_test(function(t) {
+      var script = 'resources/import-mime-type-worker.py?mime=text/plain';
+      var scope = 'resources/scope/bad-mime-type-worker/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of plain text imported script should fail.');
+    }, 'Registering script that imports script with bad MIME type');
+
+  const validMimeTypes = [
+    'application/ecmascript',
+    'application/javascript',
+    'application/x-ecmascript',
+    'application/x-javascript',
+    'text/ecmascript',
+    'text/javascript',
+    'text/javascript1.0',
+    'text/javascript1.1',
+    'text/javascript1.2',
+    'text/javascript1.3',
+    'text/javascript1.4',
+    'text/javascript1.5',
+    'text/jscript',
+    'text/livescript',
+    'text/x-ecmascript',
+    'text/x-javascript'
+  ];
+
+  for (const validMimeType of validMimeTypes) {
+    promise_test(() => {
+      var script = `resources/mime-type-worker.py?mime=${validMimeType}`;
+      var scope = 'resources/scope/good-mime-type-worker/';
+
+      return register_method(script, {scope}).then(registration => {
+        assert_true(
+          registration instanceof ServiceWorkerRegistration,
+          'Successfully registered.');
+        return registration.unregister();
+      });
+    }, `Registering script with good MIME type ${validMimeType}`);
+
+    promise_test(() => {
+      var script = `resources/import-mime-type-worker.py?mime=${validMimeType}`;
+      var scope = 'resources/scope/good-mime-type-worker/';
+
+      return register_method(script, { scope }).then(registration => {
+        assert_true(
+          registration instanceof ServiceWorkerRegistration,
+          'Successfully registered.');
+        return registration.unregister();
+      });
+    }, `Registering script that imports script with good MIME type ${validMimeType}`);
+  }
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-scope.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-scope.js
new file mode 100644
index 000000000000..30c424b2b423
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-scope.js
@@ -0,0 +1,120 @@
+// Registration tests that mostly exercise the scope option.
+function registration_tests_scope(register_method) {
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/scope%2fencoded-slash-in-scope';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded slash in the scope should be rejected.');
+    }, 'Scope including URL-encoded slash');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/scope%5cencoded-slash-in-scope';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded backslash in the scope should be rejected.');
+    }, 'Scope including URL-encoded backslash');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'data:text/html,';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'scope URL scheme is not "http" or "https"');
+    }, 'Scope URL scheme is a data: URL');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = new URL('resources', location).href.replace('https:', 'ftp:');
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'scope URL scheme is not "http" or "https"');
+    }, 'Scope URL scheme is an ftp: URL');
+
+  promise_test(function(t) {
+      // URL-encoded full-width 'scope'.
+      var name = '%ef%bd%93%ef%bd%83%ef%bd%8f%ef%bd%90%ef%bd%85';
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/' + name + '/escaped-multibyte-character-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL(scope),
+              'URL-encoded multibyte characters should be available.');
+            return registration.unregister();
+          });
+    }, 'Scope including URL-encoded multibyte characters');
+
+  promise_test(function(t) {
+      // Non-URL-encoded full-width "scope".
+      var name = String.fromCodePoint(0xff53, 0xff43, 0xff4f, 0xff50, 0xff45);
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/' + name  + '/non-escaped-multibyte-character-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL(scope),
+              'Non-URL-encoded multibyte characters should be available.');
+            return registration.unregister();
+          });
+    }, 'Scope including non-escaped multibyte characters');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/././scope/self-reference-in-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL('resources/scope/self-reference-in-scope'),
+              'Scope including self-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Scope including self-reference');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/../resources/scope/parent-reference-in-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              registration.scope,
+              normalizeURL('resources/scope/parent-reference-in-scope'),
+              'Scope including parent-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Scope including parent-reference');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/scope////consecutive-slashes-in-scope';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            // Although consecutive slashes in the scope are not unified, the
+            // scope is under the script directory and registration should
+            // succeed.
+            assert_equals(
+              registration.scope,
+              normalizeURL(scope),
+              'Should successfully be registered.');
+            return registration.unregister();
+          })
+    }, 'Scope including consecutive slashes');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'filesystem:' + normalizeURL('resources/scope/filesystem-scope-url');
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registering with the scope that has same-origin filesystem: URL ' +
+              'should fail with TypeError.');
+    }, 'Scope URL is same-origin filesystem: URL');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script-url.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script-url.js
new file mode 100644
index 000000000000..55cbe6fa9594
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script-url.js
@@ -0,0 +1,82 @@
+// Registration tests that mostly exercise the scriptURL parameter.
+function registration_tests_script_url(register_method) {
+  promise_test(function(t) {
+        var script = 'resources%2fempty-worker.js';
+        var scope = 'resources/scope/encoded-slash-in-script-url';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'URL-encoded slash in the script URL should be rejected.');
+      }, 'Script URL including URL-encoded slash');
+
+  promise_test(function(t) {
+      var script = 'resources%2Fempty-worker.js';
+      var scope = 'resources/scope/encoded-slash-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded slash in the script URL should be rejected.');
+    }, 'Script URL including uppercase URL-encoded slash');
+
+  promise_test(function(t) {
+      var script = 'resources%5cempty-worker.js';
+      var scope = 'resources/scope/encoded-slash-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded backslash in the script URL should be rejected.');
+    }, 'Script URL including URL-encoded backslash');
+
+  promise_test(function(t) {
+      var script = 'resources%5Cempty-worker.js';
+      var scope = 'resources/scope/encoded-slash-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'URL-encoded backslash in the script URL should be rejected.');
+    }, 'Script URL including uppercase URL-encoded backslash');
+
+  promise_test(function(t) {
+      var script = 'data:application/javascript,';
+      var scope = 'resources/scope/data-url-in-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Data URLs should not be registered as service workers.');
+    }, 'Script URL is a data URL');
+
+  promise_test(function(t) {
+      var script = 'data:application/javascript,';
+      var scope = new URL('resources/scope/data-url-in-script-url', location);
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Data URLs should not be registered as service workers.');
+    }, 'Script URL is a data URL and scope URL is not relative');
+
+  promise_test(function(t) {
+      var script = 'resources/././empty-worker.js';
+      var scope = 'resources/scope/parent-reference-in-script-url';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              get_newest_worker(registration).scriptURL,
+              normalizeURL('resources/empty-worker.js'),
+              'Script URL including self-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Script URL including self-reference');
+
+  promise_test(function(t) {
+      var script = 'resources/../resources/empty-worker.js';
+      var scope = 'resources/scope/parent-reference-in-script-url';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_equals(
+              get_newest_worker(registration).scriptURL,
+              normalizeURL('resources/empty-worker.js'),
+              'Script URL including parent-reference should be normalized.');
+            return registration.unregister();
+          });
+    }, 'Script URL including parent-reference');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script.js
new file mode 100644
index 000000000000..a74cab8e3ace
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-script.js
@@ -0,0 +1,121 @@
+// Registration tests that mostly exercise the service worker script contents or
+// response.
+function registration_tests_script(register_method, type) {
+  promise_test(function(t) {
+      var script = 'resources/invalid-chunked-encoding.py';
+      var scope = 'resources/scope/invalid-chunked-encoding/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of invalid chunked encoding script should fail.');
+    }, 'Registering invalid chunked encoding script');
+
+  promise_test(function(t) {
+      var script = 'resources/invalid-chunked-encoding-with-flush.py';
+      var scope = 'resources/scope/invalid-chunked-encoding-with-flush/';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of invalid chunked encoding script should fail.');
+    }, 'Registering invalid chunked encoding script with flush');
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?parse-error';
+      var scope = 'resources/scope/parse-error';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of script including parse error should fail.');
+    }, 'Registering script including parse error');
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?undefined-error';
+      var scope = `resources/scope/undefined-error/${type}`;
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of script including undefined error should fail.');
+    }, `Registering script including undefined error: ${type}`);
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?uncaught-exception';
+      var scope = `resources/scope/uncaught-exception/${type}`;
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of script including uncaught exception should fail.');
+    }, `Registering script including uncaught exception: ${type}`);
+
+  if (type === 'classic') {
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?import-malformed-script';
+        var scope = 'resources/scope/import-malformed-script';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script importing malformed script should fail.');
+      }, 'Registering script importing malformed script');
+  }
+
+  if (type === 'module') {
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?top-level-await';
+        var scope = 'resources/scope/top-level-await';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script with top-level await should fail.');
+      }, 'Registering script with top-level await');
+
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?instantiation-error';
+        var scope = 'resources/scope/instantiation-error';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script with module instantiation error should fail.');
+      }, 'Registering script with module instantiation error');
+
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?instantiation-error-and-top-level-await';
+        var scope = 'resources/scope/instantiation-error-and-top-level-await';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script with module instantiation error and top-level await should fail.');
+      }, 'Registering script with module instantiation error and top-level await');
+  }
+
+  promise_test(function(t) {
+      var script = 'resources/no-such-worker.js';
+      var scope = 'resources/scope/no-such-worker';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registration of non-existent script should fail.');
+    }, 'Registering non-existent script');
+
+  if (type === 'classic') {
+    promise_test(function(t) {
+        var script = 'resources/malformed-worker.py?import-no-such-script';
+        var scope = 'resources/scope/import-no-such-script';
+        return promise_rejects_js(t,
+            TypeError,
+            register_method(script, {scope: scope}),
+            'Registration of script importing non-existent script should fail.');
+      }, 'Registering script importing non-existent script');
+  }
+
+  promise_test(function(t) {
+      var script = 'resources/malformed-worker.py?caught-exception';
+      var scope = 'resources/scope/caught-exception';
+      return register_method(script, {scope: scope})
+        .then(function(registration) {
+            assert_true(
+              registration instanceof ServiceWorkerRegistration,
+              'Successfully registered.');
+            return registration.unregister();
+          });
+    }, 'Registering script including caught exception');
+
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-security-error.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-security-error.js
new file mode 100644
index 000000000000..c45fbd45789a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-tests-security-error.js
@@ -0,0 +1,78 @@
+// Registration tests that mostly exercise SecurityError cases.
+function registration_tests_security_error(register_method) {
+  promise_test(function(t) {
+      var script = 'resources/registration-worker.js';
+      var scope = 'resources';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registering same scope as the script directory without the last ' +
+              'slash should fail with SecurityError.');
+    }, 'Registering same scope as the script directory without the last slash');
+
+  promise_test(function(t) {
+      var script = 'resources/registration-worker.js';
+      var scope = 'different-directory/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration scope outside the script directory should fail ' +
+              'with SecurityError.');
+    }, 'Registration scope outside the script directory');
+
+  promise_test(function(t) {
+      var script = 'resources/registration-worker.js';
+      var scope = 'http://example.com/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration scope outside domain should fail with SecurityError.');
+    }, 'Registering scope outside domain');
+
+  promise_test(function(t) {
+      var script = 'http://example.com/worker.js';
+      var scope = 'http://example.com/scope/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration script outside domain should fail with SecurityError.');
+    }, 'Registering script outside domain');
+
+  promise_test(function(t) {
+      var script = 'resources/redirect.py?Redirect=' +
+                    encodeURIComponent('/resources/registration-worker.js');
+      var scope = 'resources/scope/redirect/';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Registration of redirected script should fail.');
+    }, 'Registering redirected script');
+
+  promise_test(function(t) {
+      var script = 'resources/empty-worker.js';
+      var scope = 'resources/../scope/parent-reference-in-scope';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Scope not under the script directory should be rejected.');
+    }, 'Scope including parent-reference and not under the script directory');
+
+  promise_test(function(t) {
+      var script = 'resources////empty-worker.js';
+      var scope = 'resources/scope/consecutive-slashes-in-script-url';
+      return promise_rejects_dom(t,
+          'SecurityError',
+          register_method(script, {scope: scope}),
+          'Consecutive slashes in the script url should not be unified.');
+    }, 'Script URL including consecutive slashes');
+
+  promise_test(function(t) {
+      var script = 'filesystem:' + normalizeURL('resources/empty-worker.js');
+      var scope = 'resources/scope/filesystem-script-url';
+      return promise_rejects_js(t,
+          TypeError,
+          register_method(script, {scope: scope}),
+          'Registering a script which has same-origin filesystem: URL should ' +
+              'fail with TypeError.');
+    }, 'Script URL is same-origin filesystem: URL');
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/registration-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/registration-worker.js
new file mode 100644
index 000000000000..44d1d2774a24
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/registration-worker.js
@@ -0,0 +1 @@
+// empty for now
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/reject-install-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/reject-install-worker.js
new file mode 100644
index 000000000000..41f07fd5db81
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/reject-install-worker.js
@@ -0,0 +1,3 @@
+self.oninstall = function(event) {
+  event.waitUntil(Promise.reject());
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/reply-to-message.html b/test/fixtures/wpt/service-workers/service-worker/resources/reply-to-message.html
new file mode 100644
index 000000000000..8a70e2ad933e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/reply-to-message.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+window.addEventListener('message', event => {
+    var port = event.ports[0];
+    port.postMessage(event.data);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/request-end-to-end-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/request-end-to-end-worker.js
new file mode 100644
index 000000000000..6bd2b72137e5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/request-end-to-end-worker.js
@@ -0,0 +1,34 @@
+'use strict';
+
+onfetch = function(e) {
+  var headers = {};
+  for (var header of e.request.headers) {
+    var key = header[0], value = header[1];
+    headers[key] = value;
+  }
+  var append_header_error = '';
+  try {
+    e.request.headers.append('Test-Header', 'TestValue');
+  } catch (error) {
+    append_header_error = error.name;
+  }
+
+  var request_construct_error = '';
+  try {
+    new Request(e.request, {method: 'GET'});
+  } catch (error) {
+    request_construct_error = error.name;
+  }
+
+  e.respondWith(new Response(JSON.stringify({
+    url: e.request.url,
+    method: e.request.method,
+    referrer: e.request.referrer,
+    headers: headers,
+    mode: e.request.mode,
+    credentials: e.request.credentials,
+    redirect: e.request.redirect,
+    append_header_error: append_header_error,
+    request_construct_error: request_construct_error
+  })));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-iframe.sub.html b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-iframe.sub.html
new file mode 100644
index 000000000000..ec4c726331d6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-iframe.sub.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script src="empty.js"></script>
+<script src="sample.js"></script>
+<script src="redirect.py?Redirect=empty.js"></script>
+<img src="square.png">
+<img src="https://{{hosts[alt][]}}:{{ports[https][0]}}/service-workers/service-worker/resources/square.png">
+<img src="missing.jpg">
+<img src="https://{{hosts[alt][]}}:{{ports[https][0]}}/service-workers/service-worker/resources/missing.asis">
+<img src='missing.jpg?SWRespondsWithFetch'>
+<script src='empty-worker.js'></script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-worker.js
new file mode 100644
index 000000000000..b74e8cd6a236
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/resource-timing-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', function(event) {
+  if (event.request.url.indexOf('sample.js') != -1) {
+    event.respondWith(new Promise(resolve => {
+      // Slightly delay the response so we ensure we get a non-zero
+      // duration.
+      setTimeout(_ => resolve(new Response('// Empty javascript')), 50);
+    }));
+  }
+  else if (event.request.url.indexOf('missing.jpg?SWRespondsWithFetch') != -1) {
+    event.respondWith(fetch('sample.txt?SWFetched'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-then-throw-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/respond-then-throw-worker.js
new file mode 100644
index 000000000000..adb48de69e72
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-then-throw-worker.js
@@ -0,0 +1,40 @@
+var syncport = null;
+
+self.addEventListener('message', function(e) {
+  if ('port' in e.data) {
+    if (syncport) {
+      syncport(e.data.port);
+    } else {
+      syncport = e.data.port;
+    }
+  }
+});
+
+function sync() {
+  return new Promise(function(resolve) {
+      if (syncport) {
+        resolve(syncport);
+      } else {
+        syncport = resolve;
+      }
+    }).then(function(port) {
+      port.postMessage('SYNC');
+      return new Promise(function(resolve) {
+          port.onmessage = function(e) {
+            if (e.data === 'ACK') {
+              resolve();
+            }
+          }
+        });
+    });
+}
+
+
+self.addEventListener('fetch', function(event) {
+    // In Firefox the result would depend on a race between fetch handling
+    // and exception handling code. On the assumption that this might be a common
+    // design error, we explicitly allow the exception to be handled first.
+    event.respondWith(sync().then(() => new Response('intercepted')));
+
+    throw("error");
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-iframe.html
new file mode 100644
index 000000000000..7be314879499
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-iframe.html
@@ -0,0 +1,20 @@
+<script>
+var callback;
+
+// Creates a <script> element with |url| source, and returns a promise for the
+// result of the executed script. Uses JSONP because some responses to |url|
+// are opaque so their body cannot be tested directly.
+function getJSONP(url) {
+  var sc = document.createElement('script');
+  sc.src = url;
+  var promise = new Promise(function(resolve, reject) {
+      // This callback function is called by appending a script element.
+      callback = resolve;
+      sc.addEventListener(
+          'error',
+          function() { reject('Failed to load url:' + url); });
+    });
+  document.body.appendChild(sc);
+  return promise;
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-worker.js
new file mode 100644
index 000000000000..c602109bc683
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response-worker.js
@@ -0,0 +1,93 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+function getQueryParams(url) {
+  var search = (new URL(url)).search;
+  if (!search) {
+    return {};
+  }
+  var ret = {};
+  var params = search.substring(1).split('&');
+  params.forEach(function(param) {
+      var element = param.split('=');
+      ret[decodeURIComponent(element[0])] = decodeURIComponent(element[1]);
+    });
+  return ret;
+}
+
+function createResponse(params) {
+  if (params['type'] == 'basic') {
+    return fetch('respond-with-body-accessed-response.jsonp');
+  }
+  if (params['type'] == 'opaque') {
+    return fetch(get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() +
+          'respond-with-body-accessed-response.jsonp',
+          {mode: 'no-cors'});
+  }
+  if (params['type'] == 'default') {
+    return Promise.resolve(new Response('callback(\'OK\');'));
+  }
+
+  return Promise.reject(new Error('unexpected type :' + params['type']));
+}
+
+function cloneResponseIfNeeded(params, response) {
+  if (params['clone'] == '1') {
+    return response.clone();
+  } else if (params['clone'] == '2') {
+    response.clone();
+    return response;
+  }
+  return response;
+}
+
+function passThroughCacheIfNeeded(params, request, response) {
+  return new Promise(function(resolve) {
+      if (params['passThroughCache'] == 'true') {
+        var cache_name = request.url;
+        var cache;
+        self.caches.delete(cache_name)
+          .then(function() {
+              return self.caches.open(cache_name);
+            })
+          .then(function(c) {
+              cache = c;
+              return cache.put(request, response);
+            })
+          .then(function() {
+              return cache.match(request.url);
+            })
+          .then(function(res) {
+              // Touch .body here to test the behavior after touching it.
+              res.body;
+              resolve(res);
+            });
+      } else {
+        resolve(response);
+      }
+    })
+}
+
+self.addEventListener('fetch', function(event) {
+    if (event.request.url.indexOf('TestRequest') == -1) {
+      return;
+    }
+    var params = getQueryParams(event.request.url);
+    event.respondWith(
+        createResponse(params)
+          .then(function(response) {
+              // Touch .body here to test the behavior after touching it.
+              response.body;
+              return cloneResponseIfNeeded(params, response);
+            })
+          .then(function(response) {
+              // Touch .body here to test the behavior after touching it.
+              response.body;
+              return passThroughCacheIfNeeded(params, event.request, response);
+            })
+          .then(function(response) {
+              // Touch .body here to test the behavior after touching it.
+              response.body;
+              return response;
+            }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response.jsonp b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response.jsonp
new file mode 100644
index 000000000000..b9c28f51f90a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/respond-with-body-accessed-response.jsonp
@@ -0,0 +1 @@
+callback('OK');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/router-rules.js b/test/fixtures/wpt/service-workers/service-worker/resources/router-rules.js
new file mode 100644
index 000000000000..27462b6c1d74
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/router-rules.js
@@ -0,0 +1,148 @@
+const TEST_CACHE_NAME = 'v1';
+// https://w3c.github.io/ServiceWorker/#check-router-registration-limit-algorithm
+const CONDITION_MAX_RECURSION_DEPTH = 10;
+const CONDITION_MAX_COUNT = 1024;
+
+const routerRules = {
+  'condition-urlpattern-constructed-source-network': [{
+    condition: {urlPattern: new URLPattern({pathname: '/**/direct.txt'})},
+    source: 'network'
+  }],
+  'condition-urlpattern-not-source-network': [{
+    condition: {not: {urlPattern: new URLPattern({pathname: '/**/not.txt'})}},
+    source: 'network'
+  }],
+  'condition-urlpattern-constructed-match-all-source-cache': [
+    {condition: {urlPattern: new URLPattern({})}, source: 'cache'},
+  ],
+  'condition-urlpattern-urlpatterncompatible-source-network': [
+    {condition: {urlPattern: {pathname: '/**/direct.txt'}}, source: 'network'},
+  ],
+  'condition-urlpattern-string-source-network': [
+    {condition: {urlPattern: '/**/direct.txt'}, source: 'network'},
+  ],
+  'condition-urlpattern-string-source-cache': [
+    {condition: {urlPattern: '/**/cache.txt'}, source: 'cache'},
+  ],
+  'condition-urlpattern-string-source-cache-with-name': [
+    {condition: {urlPattern: '/**/cache.txt'}, source: {cacheName: TEST_CACHE_NAME}},
+  ],
+  'condition-urlpattern-constructed-ignore-case-source-network': [{
+    condition: {
+      urlPattern:
+          new URLPattern({pathname: '/**/DiReCT.TxT'}, {ignoreCase: true})
+    },
+    source: 'network'
+  }],
+  'condition-urlpattern-constructed-respect-case-source-network': [{
+    condition: {urlPattern: new URLPattern({pathname: '/**/DiReCT.TxT'})},
+    source: 'network'
+  }],
+  'condition-request-source-network':
+      [{condition: {requestMode: 'no-cors'}, source: 'network'}],
+  'condition-request-navigate-source-cache':
+      [{condition: {requestMode: 'navigate'}, source: 'cache'}],
+  'condition-request-method-get-network':
+      [{condition: {requestMethod: 'GET'}, source: 'network'}],
+  'condition-request-method-post-network':
+      [{condition: {requestMethod: 'POST'}, source: 'network'}],
+  'condition-request-method-put-network':
+      [{condition: {requestMethod: 'PUT'}, source: 'network'}],
+  'condition-request-method-delete-network':
+      [{condition: {requestMethod: 'DELETE'}, source: 'network'}],
+  'condition-lack-of-condition': [{
+    source: 'network'
+  }],
+  'condition-lack-of-source': [{
+    condition: {requestMode: 'no-cors'},
+  }],
+  'condition-invalid-bytestring-request-method': [{
+    condition: {requestMethod: String.fromCodePoint(0x3042)},
+    source: 'network'
+  }],
+  'condition-invalid-http-request-method': [{
+    condition: {requestMethod: '(GET|POST)'},
+    source: 'network'
+  }],
+  'condition-forbidden-request-method': [{
+    condition: {requestMethod: 'connect'},
+    source: 'network'
+  }],
+  'condition-invalid-or-condition-depth': (() => {
+    const addOrCondition = (depth) => {
+      if (depth > CONDITION_MAX_RECURSION_DEPTH + 1) {
+        return {urlPattern: '/foo'};
+      }
+      return {
+        or: [addOrCondition(depth + 1)]
+      };
+    };
+    return {condition: addOrCondition(1), source: 'network'};
+  })(),
+  'condition-invalid-not-condition-depth': (() => {
+    const generateNotCondition = (depth) => {
+      if (depth > CONDITION_MAX_RECURSION_DEPTH + 1) {
+        return {
+          urlPattern: '/**/example.txt',
+        };
+      }
+      return {not: generateNotCondition(depth + 1)};
+    };
+    return {condition: generateNotCondition(1), source: 'network'};
+  })(),
+  'condition-invalid-router-size': [...Array(CONDITION_MAX_COUNT + 1)].map((val, i) => {
+    return {
+      condition: {urlPattern: `/foo-${i}`},
+      source: 'network'
+    };
+  }),
+  'condition-request-destination-script-network':
+      [{condition: {requestDestination: 'script'}, source: 'network'}],
+  'condition-or-source-network': [{
+    condition: {
+      or: [
+        {
+          or: [{urlPattern: '/**/or-test/direct1.*??*'}],
+        },
+        {urlPattern: '/**/or-test/direct2.*??*'}
+      ]
+    },
+    source: 'network'
+  }],
+  'condition-request-source-fetch-event':
+      [{condition: {requestMode: 'no-cors'}, source: 'fetch-event'}],
+  'condition-urlpattern-string-source-fetch-event':
+      [{condition: {urlPattern: '/**/*'}, source: 'fetch-event'}],
+  'multiple-router-rules': [
+    {
+      condition: {
+        urlPattern: '/**/direct.txt',
+      },
+      source: 'network'
+    },
+    {condition: {urlPattern: '/**/direct.html'}, source: 'network'}
+  ],
+  'condition-urlpattern-string-source-race-network-and-fetch-handler': [
+    {
+      condition: {urlPattern: '/**/direct.py'},
+      source: 'race-network-and-fetch-handler'
+    },
+  ],
+  'multiple-conditions-network': {
+    condition: {
+      urlPattern: new URLPattern({search: 'test'}),
+      requestMode: 'cors',
+      requestMethod: 'post',
+    },
+    source: 'network'
+  },
+  'multiple-conditions-with-destination-network' : {
+    condition: {
+      urlPattern: new URLPattern({search: 'test'}),
+      requestDestination: 'style'
+    },
+    source: 'network'
+  }
+};
+
+export {routerRules, TEST_CACHE_NAME as cacheName};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample-worker-interceptor.js b/test/fixtures/wpt/service-workers/service-worker/resources/sample-worker-interceptor.js
new file mode 100644
index 000000000000..c06f8dd77b79
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample-worker-interceptor.js
@@ -0,0 +1,62 @@
+importScripts('/common/get-host-info.sub.js');
+
+const text = 'worker loading intercepted by service worker';
+const dedicated_worker_script = `postMessage('${text}');`;
+const shared_worker_script =
+    `onconnect = evt => evt.ports[0].postMessage('${text}');`;
+
+let source;
+let resolveDone;
+let done = new Promise(resolve => resolveDone = resolve);
+
+// The page messages this worker to ask for the result. Keep the worker alive
+// via waitUntil() until the result is sent.
+self.addEventListener('message', event => {
+  source = event.data.port;
+  source.postMessage({id: event.source.id});
+  source.onmessage = resolveDone;
+  event.waitUntil(done);
+});
+
+self.onfetch = event => {
+  const url = event.request.url;
+  const destination = event.request.destination;
+
+  if (source)
+     source.postMessage({clientId:event.clientId, resultingClientId: event.resultingClientId});
+
+  // Request handler for a synthesized response.
+  if (url.indexOf('synthesized') != -1) {
+    let script_headers = new Headers({ "Content-Type": "text/javascript" });
+    if (destination === 'worker')
+      event.respondWith(new Response(dedicated_worker_script, { 'headers': script_headers }));
+    else if (destination === 'sharedworker')
+      event.respondWith(new Response(shared_worker_script, { 'headers': script_headers }));
+    else
+      event.respondWith(new Response('Unexpected request! ' + destination));
+    return;
+  }
+
+  // Request handler for a same-origin response.
+  if (url.indexOf('same-origin') != -1) {
+    event.respondWith(fetch('postmessage-on-load-worker.js'));
+    return;
+  }
+
+  // Request handler for a cross-origin response.
+  if (url.indexOf('cors') != -1) {
+    const filename = 'postmessage-on-load-worker.js';
+    const path = (new URL(filename, self.location)).pathname;
+    let new_url = get_host_info()['HTTPS_REMOTE_ORIGIN'] + path;
+    let mode;
+    if (url.indexOf('no-cors') != -1) {
+      // Test no-cors mode.
+      mode = 'no-cors';
+    } else {
+      // Test cors mode.
+      new_url += '?pipe=header(Access-Control-Allow-Origin,*)';
+      mode = 'cors';
+    }
+    event.respondWith(fetch(new_url, { mode: mode }));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample.html b/test/fixtures/wpt/service-workers/service-worker/resources/sample.html
new file mode 100644
index 000000000000..12a179980df2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body>Hello world
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample.js b/test/fixtures/wpt/service-workers/service-worker/resources/sample.js
new file mode 100644
index 000000000000..b8889db05d08
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample.js
@@ -0,0 +1 @@
+var hello = "world";
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sample.txt b/test/fixtures/wpt/service-workers/service-worker/resources/sample.txt
new file mode 100644
index 000000000000..802992c4220d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sample.txt
@@ -0,0 +1 @@
+Hello world
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-iframe.html
new file mode 100644
index 000000000000..239fa7330371
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-iframe.html
@@ -0,0 +1,63 @@
+<script>
+function with_iframe(url) {
+  return new Promise(resolve => {
+    let frame = document.createElement('iframe');
+    frame.src = url;
+    frame.onload = () => { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+function with_sandboxed_iframe(url, sandbox) {
+  return new Promise(resolve => {
+    let frame = document.createElement('iframe');
+    frame.sandbox = sandbox;
+    frame.src = url;
+    frame.onload = () => { resolve(frame); };
+    document.body.appendChild(frame);
+  });
+}
+
+function fetch_from_worker(url) {
+  return new Promise(resolve => {
+    let blob = new Blob([
+      `fetch('${url}', {mode: 'no-cors'})` +
+      "  .then(() => { self.postMessage('OK'); });"]);
+    let worker_url = URL.createObjectURL(blob);
+    let worker = new Worker(worker_url);
+    worker.onmessage = resolve;
+  });
+}
+
+function run_test(type) {
+  const base_path = location.href;
+  switch (type) {
+    case 'fetch':
+      return fetch(`${base_path}&test=fetch`, {mode: 'no-cors'});
+    case 'fetch-from-worker':
+      return fetch_from_worker(`${base_path}&test=fetch-from-worker`);
+    case 'iframe':
+      return with_iframe(`${base_path}&test=iframe`);
+    case 'sandboxed-iframe':
+      return with_sandboxed_iframe(`${base_path}&test=sandboxed-iframe`,
+                                   "allow-scripts");
+    case 'sandboxed-iframe-same-origin':
+      return with_sandboxed_iframe(
+        `${base_path}&test=sandboxed-iframe-same-origin`,
+        "allow-scripts allow-same-origin");
+    default:
+      return Promise.reject(`Unknown type: ${type}`);
+  }
+}
+
+window.onmessage = event => {
+  let id = event.data['id'];
+  run_test(event.data['type'])
+    .then(() => {
+      window.top.postMessage({id: id, result: 'done'}, '*');
+    })
+    .catch(e => {
+      window.top.postMessage({id: id, result: 'error: ' + e.toString()}, '*');
+    });
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-worker.js
new file mode 100644
index 000000000000..4035a8b19b90
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-fetch-event-worker.js
@@ -0,0 +1,20 @@
+var requests = [];
+
+self.addEventListener('message', function(event) {
+    event.waitUntil(self.clients.matchAll()
+      .then(function(clients) {
+          var client_urls = [];
+          for(var client of clients){
+            client_urls.push(client.url);
+          }
+          client_urls = client_urls.sort();
+          event.data.port.postMessage(
+              {clients: client_urls, requests: requests});
+          requests = [];
+        }));
+  });
+
+self.addEventListener('fetch', function(event) {
+    requests.push(event.request.url);
+    event.respondWith(fetch(event.request));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-navigator-serviceworker-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-navigator-serviceworker-iframe.html
new file mode 100644
index 000000000000..1d682e47ef5e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/sandboxed-iframe-navigator-serviceworker-iframe.html
@@ -0,0 +1,25 @@
+<script>
+window.onmessage = function(e) {
+  const id = e.data['id'];
+  try {
+    var sw = window.navigator.serviceWorker;
+  } catch (e) {
+    window.top.postMessage({
+        id: id,
+        result: 'navigator.serviceWorker failed: ' + e.name
+      }, '*');
+    return;
+  }
+
+  window.navigator.serviceWorker.getRegistration()
+    .then(function() {
+        window.top.postMessage({id: id, result:'ok'}, '*');
+      })
+    .catch(function(e) {
+        window.top.postMessage({
+            id: id,
+            result: 'getRegistration() failed: ' + e.name
+          }, '*');
+        });
+};
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-redirect-to-scope2.js b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-redirect-to-scope2.js
new file mode 100644
index 000000000000..ae681ba30e0b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-redirect-to-scope2.js
@@ -0,0 +1 @@
+import * as module from './redirect.py?Redirect=/service-workers/service-worker/resources/scope2/imported-module-script.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-scope2.js b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-scope2.js
new file mode 100644
index 000000000000..e28505249c28
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope1/module-worker-importing-scope2.js
@@ -0,0 +1 @@
+import * as module from '../scope2/imported-module-script.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope2/imported-module-script.js b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/imported-module-script.js
new file mode 100644
index 000000000000..a18e704a3c58
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/imported-module-script.js
@@ -0,0 +1,4 @@
+export const imported = 'A module script.';
+onmessage = msg => {
+    msg.source.postMessage('pong');
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/scope2/simple.txt b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/simple.txt
new file mode 100644
index 000000000000..cd876676e85e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/scope2/simple.txt
@@ -0,0 +1 @@
+a simple text file (scope2/)
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/secure-context-service-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context-service-worker.js
new file mode 100644
index 000000000000..5ba99f075362
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context-service-worker.js
@@ -0,0 +1,21 @@
+self.addEventListener('fetch', event => {
+    let url = new URL(event.request.url);
+    if (url.pathname.indexOf('sender.html') != -1) {
+        event.respondWith(new Response(
+            "<script>window.parent.postMessage('interception', '*');</script>",
+            { headers: { 'Content-Type': 'text/html'} }
+        ));
+    } else if (url.pathname.indexOf('report') != -1) {
+        self.clients.matchAll().then(clients => {
+            for (client of clients) {
+                client.postMessage(url.searchParams.get('result'));
+            }
+        });
+        event.respondWith(
+            new Response(
+                '<script>window.close()</script>',
+                { headers: { 'Content-Type': 'text/html'} }
+            )
+        );
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/sender.html b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/sender.html
new file mode 100644
index 000000000000..05e58822a862
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/sender.html
@@ -0,0 +1 @@
+<script>window.parent.postMessage('network', '*');</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/window.html b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/window.html
new file mode 100644
index 000000000000..071a507cb33e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/secure-context/window.html
@@ -0,0 +1,15 @@
+<body>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="../test-helpers.sub.js"></script>
+<script>
+const HTTPS_PREFIX = get_host_info().HTTPS_ORIGIN + base_path();
+
+window.onmessage = event => {
+    window.location = HTTPS_PREFIX + 'report?result=' + event.data;
+};
+
+const frame = document.createElement('iframe');
+frame.src = HTTPS_PREFIX + 'sender.html';
+document.body.appendChild(frame);
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-dynamic-import-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-dynamic-import-worker.js
new file mode 100644
index 000000000000..680e07ff588c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-dynamic-import-worker.js
@@ -0,0 +1 @@
+import('./service-worker-interception-network-worker.js');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-network-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-network-worker.js
new file mode 100644
index 000000000000..5ff390010134
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-network-worker.js
@@ -0,0 +1 @@
+postMessage('LOADED_FROM_NETWORK');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-service-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-service-worker.js
new file mode 100644
index 000000000000..6b43a3769637
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-service-worker.js
@@ -0,0 +1,9 @@
+const kURL = '/service-worker-interception-network-worker.js';
+const kScript = 'postMessage("LOADED_FROM_SERVICE_WORKER")';
+const kHeaders = [['content-type', 'text/javascript']];
+
+self.addEventListener('fetch', e => {
+  // Serve a generated response for kURL.
+  if (e.request.url.indexOf(kURL) != -1)
+    e.respondWith(new Response(kScript, { headers: kHeaders }));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-static-import-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-static-import-worker.js
new file mode 100644
index 000000000000..e570958701db
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/service-worker-interception-static-import-worker.js
@@ -0,0 +1 @@
+import './service-worker-interception-network-worker.js';
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/silence.oga b/test/fixtures/wpt/service-workers/service-worker/resources/silence.oga
new file mode 100644
index 000000000000..af591880436a
Binary files /dev/null and b/test/fixtures/wpt/service-workers/service-worker/resources/silence.oga differ
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js
new file mode 100644
index 000000000000..f8b5f8c5cb77
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js
@@ -0,0 +1,5 @@
+self.onfetch = function(event) {
+  if (event.request.url.indexOf('simple') != -1)
+    event.respondWith(
+      new Response(new Blob(['intercepted by service worker'])));
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js.headers b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple-intercept-worker.js.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple-test-for-condition-main-resource.html b/test/fixtures/wpt/service-workers/service-worker/resources/simple-test-for-condition-main-resource.html
new file mode 100644
index 000000000000..0c3e3e78707b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple-test-for-condition-main-resource.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<title>Simple</title>
+Here's a simple html file.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple.csv b/test/fixtures/wpt/service-workers/service-worker/resources/simple.csv
new file mode 100644
index 000000000000..ecbef786e738
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple.csv
@@ -0,0 +1 @@
+matched,with,non-url,conditions
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple.html b/test/fixtures/wpt/service-workers/service-worker/resources/simple.html
new file mode 100644
index 000000000000..0c3e3e78707b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<title>Simple</title>
+Here's a simple html file.
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/simple.txt b/test/fixtures/wpt/service-workers/service-worker/resources/simple.txt
new file mode 100644
index 000000000000..9e3cb91fb9b9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/simple.txt
@@ -0,0 +1 @@
+a simple text file
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-installed-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-installed-worker.js
new file mode 100644
index 000000000000..6f7008bddcdf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-installed-worker.js
@@ -0,0 +1,33 @@
+var saw_activate_event = false
+
+self.addEventListener('activate', function() {
+    saw_activate_event = true;
+  });
+
+self.addEventListener('message', function(event) {
+    var port = event.data.port;
+    event.waitUntil(self.skipWaiting()
+      .then(function(result) {
+          if (result !== undefined) {
+            port.postMessage('FAIL: Promise should be resolved with undefined');
+            return;
+          }
+
+          if (!saw_activate_event) {
+            port.postMessage(
+                'FAIL: Promise should be resolved after activate event is dispatched');
+            return;
+          }
+
+          if (self.registration.active.state !== 'activating') {
+            port.postMessage(
+                'FAIL: Promise should be resolved before ServiceWorker#state is set to activated');
+            return;
+          }
+
+          port.postMessage('PASS');
+        })
+      .catch(function(e) {
+          port.postMessage('FAIL: unexpected exception: ' + e);
+        }));
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-worker.js
new file mode 100644
index 000000000000..3fc1d1e237aa
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/skip-waiting-worker.js
@@ -0,0 +1,21 @@
+importScripts('worker-testharness.js');
+
+promise_test(function() {
+    return skipWaiting()
+      .then(function(result) {
+          assert_equals(result, undefined,
+                        'Promise should be resolved with undefined');
+        })
+      .then(function() {
+          var promises = [];
+          for (var i = 0; i < 8; ++i)
+            promises.push(self.skipWaiting());
+          return Promise.all(promises);
+        })
+      .then(function(results) {
+          results.forEach(function(r) {
+              assert_equals(r, undefined,
+                            'Promises should be resolved with undefined');
+            });
+        });
+  }, 'skipWaiting');
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/square.png b/test/fixtures/wpt/service-workers/service-worker/resources/square.png
new file mode 100644
index 000000000000..01c9666a8de9
Binary files /dev/null and b/test/fixtures/wpt/service-workers/service-worker/resources/square.png differ
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/square.png.sub.headers b/test/fixtures/wpt/service-workers/service-worker/resources/square.png.sub.headers
new file mode 100644
index 000000000000..7341132745be
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/square.png.sub.headers
@@ -0,0 +1,2 @@
+Content-Type: image/png
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe-worker.js
new file mode 100644
index 000000000000..548116c89ea8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe-worker.js
@@ -0,0 +1,11 @@
+self.addEventListener('message', event => {
+  event.source.postMessage('passed');
+});
+
+self.addEventListener('fetch', event => {
+  let url = new URL(event.request.url);
+  if (!url.searchParams.get('test_resource')) {
+    return;
+  }
+  event.respondWith(new Response('passed'));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe.html
new file mode 100644
index 000000000000..6407845c5adf
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/srcdoc-iframe.html
@@ -0,0 +1,92 @@
+<!doctype html>
+<html>
+<body>
+<iframe id="srcdocFrame" srcdoc="
+<script>
+  function reportTestResult(result) {
+    top.postMessage({ type: 'TEST_RESULT', result: result }, '*');
+  }
+
+  async function postMessageToController() {
+    let controller = navigator.serviceWorker.controller;
+    if (!controller) {
+      reportTestResult('no navigator.serviceWorker.controller');
+    }
+    try {
+      controller.postMessage('test');
+    } catch (e) {
+      reportTestResult('Unexpected Error ' + e.name + ' : ' + e.message);
+    }
+  }
+
+  async function getServiceWorkerRegistration(scope) {
+    try {
+      let reg = await navigator.serviceWorker.getRegistration(scope);
+      if (!reg) {
+        reportTestResult('no regsitration for ' + scope);
+      }
+      if (reg.scope !==  scope) {
+        reportTestResult('regsitration scope does not match');
+      }
+
+      if (!reg.active) {
+        reportTestResult('regsitration.active is not valid' + reg.active);
+      }
+      reportTestResult('passed');
+    } catch (e) {
+      reportTestResult('Unexpected Error ' + e.name + ' : ' + e.message);
+    }
+  }
+
+  function addSrcdocIframeWithSandbox(sandbox) {
+    let frame = document.createElement('iframe');
+    frame.sandbox = sandbox;
+    frame.srcdoc = `
+    <script>
+      function reportTestResult(result) {
+        top.postMessage({ type: 'TEST_RESULT', result: result }, '*');
+      }
+
+      window.onload = function onLoad() {
+        try {
+          let controller = navigator.serviceWorker.controller;
+          reportTestResult(controller ? 'HasController' : 'NoController');
+        } catch (e) {
+          reportTestResult((e.name == 'SecurityError') ?
+              'NoController' : 'UnexpectedError:' + e.message);
+        }
+      }
+    <\/script>`;
+    document.body.appendChild(frame);
+  }
+
+  function addSandboxedSrcdocFrame() {
+    addSrcdocIframeWithSandbox('allow-scripts');
+  }
+
+  function addSameOriginSandboxedSrcdocFrame() {
+    addSrcdocIframeWithSandbox('allow-scripts allow-same-origin');
+  }
+
+  async function fetchResource() {
+    let response = await fetch('?test_resource=1');
+    reportTestResult(await response.text());
+  }
+
+  window.navigator.serviceWorker.addEventListener(
+      'message', function onMsg(evt) {
+    // Forward the message as test result.
+    reportTestResult(evt.data);
+  });
+</script>
+"></iframe>
+
+<script>
+// Helper routine to make it slightly easier for our parent to find
+// the srcdoc frame.
+function srcdocFrame() {
+  return document.getElementById('srcdocFrame').contentWindow;
+}
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/stalling-service-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/stalling-service-worker.js
new file mode 100644
index 000000000000..fdf1e6cac04e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/stalling-service-worker.js
@@ -0,0 +1,54 @@
+async function post_message_to_client(role, message, ports) {
+    (await clients.matchAll()).forEach(client => {
+        if (new URL(client.url).searchParams.get('role') === role) {
+            client.postMessage(message, ports);
+        }
+    });
+}
+
+async function post_message_to_child(message, ports) {
+    await post_message_to_client('child', message, ports);
+}
+
+function ping_message(data) {
+    return { type: 'ping', data };
+}
+
+self.onmessage = event => {
+    const message = ping_message(event.data);
+    post_message_to_child(message);
+    post_message_to_parent(message);
+}
+
+async function post_message_to_parent(message, ports) {
+    await post_message_to_client('parent', message, ports);
+}
+
+function fetch_message(key) {
+    return { type: 'fetch', key };
+}
+
+// Send a message to the parent along with a MessagePort to respond
+// with.
+function report_fetch_request(key) {
+    const channel = new MessageChannel();
+    const reply = new Promise(resolve => {
+        channel.port1.onmessage = resolve;
+    }).then(event => event.data);
+    return post_message_to_parent(fetch_message(key), [channel.port2]).then(() => reply);
+}
+
+function respond_with_script(script) {
+    return new Response(new Blob(script, { type: 'text/javascript' }));
+}
+
+// Whenever a controlled document requests a URL with a 'key' search
+// parameter we report the request to the parent frame and wait for
+// a response. The content of the response is then used to respond to
+// the fetch request.
+addEventListener('fetch', event => {
+    let key = new URL(event.request.url).searchParams.get('key');
+    if (key) {
+        event.respondWith(report_fetch_request(key).then(respond_with_script));
+    }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-helpers.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-helpers.sub.js
new file mode 100644
index 000000000000..0ab1f1fae1dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-helpers.sub.js
@@ -0,0 +1,82 @@
+// Helper functions for ServiceWorker static routing API.
+//
+// test-helpers.sub.js must be loaded before using this.
+
+// Get a dictionary of information recorded inside ServiceWorker.
+// It includes:
+// - request URL and mode.
+// - errors.
+//
+// See: static-router-sw.js for details.
+const get_info_from_worker =
+    async worker => {
+  const promise = new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(msg) { resolve(msg); };
+      worker.postMessage({port: channel.port2}, [channel.port2]);
+    });
+  const message = await promise;
+
+  return message.data;
+}
+
+// Reset information stored inside ServiceWorker.
+const reset_info_in_worker =
+    async worker => {
+  const promise = new Promise(function(resolve) {
+      var channel = new MessageChannel();
+      channel.port1.onmessage = function(msg) { resolve(msg); };
+      worker.postMessage({port: channel.port2, reset: true}, [channel.port2]);
+    });
+  await promise;
+}
+
+// This script's directory name. It is used for specifying test files.
+const scriptDir = document.currentScript.src.match(/.*\//)[0];
+
+// Register the ServiceWorker and wait until activated.
+// {ruleKey} represents the key of routerRules defined in router-rules.js.
+// {swScript} represents the service worker source URL.
+// {swScope} represents the service worker resource scope.
+const registerAndActivate = async (test, ruleKey, swScript, swScope) => {
+  if (!swScript) {
+    swScript = scriptDir + 'static-router-sw.js'
+  }
+  if (!swScope) {
+    swScope = scriptDir;
+  }
+  const swURL = `${swScript}?key=${ruleKey}`;
+  const reg = await service_worker_unregister_and_register(
+    test, swURL, swScope, { type: 'module' });
+  add_completion_callback(() => reg.unregister());
+  const worker = reg.installing;
+  await wait_for_state(test, worker, 'activated');
+
+  return worker;
+};
+
+// Create iframe with the given url. This automatically removes the iframe in a
+// cleanup.
+const createIframe = async (t, url) => {
+  const iframe = await with_iframe(url);
+  t.add_cleanup(() => iframe.remove());
+
+  return iframe;
+};
+
+// Register a service worker, then create an iframe at url.
+function iframeTest(url, ruleKey, callback, name) {
+  return promise_test(async t => {
+    const worker = await registerAndActivate(t, ruleKey);
+    const iframe = await createIframe(t, url);
+    await callback(t, iframe.contentWindow, worker);
+  }, name);
+};
+
+function randomString() {
+  let result = "";
+  for (let i = 0; i < 5; i++) {
+    result += String.fromCharCode(97 + Math.floor(Math.random() * 26));
+  }
+  return result;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-no-fetch-handler-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-no-fetch-handler-sw.js
new file mode 100644
index 000000000000..1ba5fd7d463b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-no-fetch-handler-sw.js
@@ -0,0 +1,35 @@
+'use strict';
+
+import {routerRules} from './router-rules.js';
+import {
+  recordError,
+  getRecords,
+  resetRecords } from './static-router-sw.sub.js';
+
+self.addEventListener('install', async e => {
+  e.waitUntil(caches.open('v1').then(
+      cache => {cache.put('cache.txt', new Response('From cache'))}));
+
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  try {
+    await e.addRoutes(routerRules[key]);
+  } catch (e) {
+    recordError(e);
+  }
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', e => {
+  e.waitUntil(clients.claim());
+});
+
+self.addEventListener('message', function(event) {
+  if (event.data.reset) {
+    resetRecords();
+  }
+  if (event.data.port) {
+    const {requests, errors} = getRecords();
+    event.data.port.postMessage({requests, errors});
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js
new file mode 100644
index 000000000000..904ff0f46d8f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js
@@ -0,0 +1,62 @@
+'use strict';
+
+import {routerRules} from './router-rules.js';
+import {
+  recordRequest,
+  recordError,
+  getRecords,
+  resetRecords } from './static-router-sw.sub.js';
+
+import './imported-sw.js';
+
+self.addEventListener('install', async e => {
+  e.waitUntil(caches.open('v1').then(
+      cache => {cache.put('cache.txt', new Response('From cache'))}));
+
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  try {
+    await e.addRoutes(routerRules[key]);
+  } catch (e) {
+    recordError(e);
+  }
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', e => {
+  e.waitUntil(clients.claim());
+});
+
+self.addEventListener('fetch', async function(event) {
+  try {
+    recordRequest(event.request);
+    const url = new URL(event.request.url);
+    // Force slow response
+    if (url.searchParams.has('sw_slow')) {
+      const start = Date.now();
+      while (true) {
+        if (Date.now() - start > 200) {
+          break;
+        }
+      }
+    }
+    const nonce = url.searchParams.get('nonce');
+    event.respondWith(new Response(nonce));
+    // Call `fetch(e.request)` but it's not consumed.
+    if (url.searchParams.has('call_fetch')) {
+      await fetch(event.request);
+    }
+  } catch (e) {
+    recordError(e)
+  }
+});
+
+self.addEventListener('message', function(event) {
+  if (event.data.reset) {
+    resetRecords();
+  }
+  if (event.data.port) {
+    const {requests, errors} = getRecords();
+    event.data.port.postMessage({requests, errors});
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.js
new file mode 100644
index 000000000000..c0bd683f9182
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.js
@@ -0,0 +1,45 @@
+'use strict';
+
+import {routerRules, cacheName} from './router-rules.js';
+import {
+  recordRequest,
+  recordError,
+  getRecords,
+  resetRecords } from './static-router-sw.sub.js';
+
+import './imported-sw.js';
+
+self.addEventListener('install', async e => {
+  e.waitUntil(caches.open(cacheName).then(
+      cache => {cache.put('cache.txt', new Response('From cache'))}));
+
+  const params = new URLSearchParams(location.search);
+  const key = params.get('key');
+  try {
+    await e.addRoutes(routerRules[key]);
+  } catch (e) {
+    recordError(e);
+  }
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', e => {
+  e.waitUntil(clients.claim());
+});
+
+self.addEventListener('fetch', function(event) {
+  recordRequest(event.request);
+  const url = new URL(event.request.url);
+  const nonce = url.searchParams.get('nonce');
+  event.respondWith(new Response(nonce));
+});
+
+self.addEventListener('message', function(event) {
+  if (event.data.reset) {
+    resetRecords();
+  }
+  if (event.data.port) {
+    const {requests, errors} = getRecords();
+    event.data.port.postMessage({requests, errors});
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.sub.js
new file mode 100644
index 000000000000..04f9c5533a48
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/static-router-sw.sub.js
@@ -0,0 +1,29 @@
+let requests = [];
+let errors = [];
+
+const recordRequest = req => {
+  requests.push({url: req.url, mode: req.mode, destination: req.destination});
+};
+
+const recordError = (error) => {
+  errors.push(error);
+};
+
+const getRecords = () => {
+  return {
+    requests,
+    errors
+  };
+}
+
+const resetRecords = () => {
+  requests = [];
+  errors = [];
+}
+
+export {
+  recordRequest,
+  recordError,
+  getRecords,
+  resetRecords
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/subdir/blank.html b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/blank.html
new file mode 100644
index 000000000000..a3c3a4689a62
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/blank.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<title>Empty doc</title>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/subdir/simple.txt b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/simple.txt
new file mode 100644
index 000000000000..86bcdd7dc56f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/subdir/simple.txt
@@ -0,0 +1 @@
+a simple text file (subdir/)
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001-frame.html
new file mode 100644
index 000000000000..59fb524049d8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001-frame.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<img src="/images/green.svg">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001.html b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001.html
new file mode 100644
index 000000000000..9a93d3b37047
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-001.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Green svg box reference file</title>
+<p>Pass if you see a green box below.</p>
+<iframe src="svg-target-reftest-001-frame.html">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-frame.html
new file mode 100644
index 000000000000..d6fc820f7834
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/svg-target-reftest-frame.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img src="/images/colors.svg#green">
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/test-helpers.sub.js b/test/fixtures/wpt/service-workers/service-worker/resources/test-helpers.sub.js
new file mode 100644
index 000000000000..74301523e735
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/test-helpers.sub.js
@@ -0,0 +1,300 @@
+// Adapter for testharness.js-style tests with Service Workers
+
+/**
+ * @param options an object that represents RegistrationOptions except for scope.
+ * @param options.type a WorkerType.
+ * @param options.updateViaCache a ServiceWorkerUpdateViaCache.
+ * @see https://w3c.github.io/ServiceWorker/#dictdef-registrationoptions
+ */
+function service_worker_unregister_and_register(test, url, scope, options) {
+  if (!scope || scope.length == 0)
+    return Promise.reject(new Error('tests must define a scope'));
+
+  if (options && options.scope)
+    return Promise.reject(new Error('scope must not be passed in options'));
+
+  options = Object.assign({ scope: scope }, options);
+  return service_worker_unregister(test, scope)
+    .then(function() {
+        return navigator.serviceWorker.register(url, options);
+      })
+    .catch(unreached_rejection(test,
+                               'unregister and register should not fail'));
+}
+
+// This unregisters the registration that precisely matches scope. Use this
+// when unregistering by scope. If no registration is found, it just resolves.
+function service_worker_unregister(test, scope) {
+  var absoluteScope = (new URL(scope, window.location).href);
+  return navigator.serviceWorker.getRegistration(scope)
+    .then(function(registration) {
+        if (registration && registration.scope === absoluteScope)
+          return registration.unregister();
+      })
+    .catch(unreached_rejection(test, 'unregister should not fail'));
+}
+
+function service_worker_unregister_and_done(test, scope) {
+  return service_worker_unregister(test, scope)
+    .then(test.done.bind(test));
+}
+
+function unreached_fulfillment(test, prefix) {
+  return test.step_func(function(result) {
+      var error_prefix = prefix || 'unexpected fulfillment';
+      assert_unreached(error_prefix + ': ' + result);
+    });
+}
+
+// Rejection-specific helper that provides more details
+function unreached_rejection(test, prefix) {
+  return test.step_func(function(error) {
+      var reason = error.message || error.name || error;
+      var error_prefix = prefix || 'unexpected rejection';
+      assert_unreached(error_prefix + ': ' + reason);
+    });
+}
+
+/**
+ * Adds an iframe to the document and returns a promise that resolves to the
+ * iframe when it finishes loading. The caller is responsible for removing the
+ * iframe later if needed.
+ *
+ * @param {string} url
+ * @returns {HTMLIFrameElement}
+ */
+function with_iframe(url) {
+  return new Promise(function(resolve) {
+      var frame = document.createElement('iframe');
+      frame.className = 'test-iframe';
+      frame.src = url;
+      frame.onload = function() { resolve(frame); };
+      document.body.appendChild(frame);
+    });
+}
+
+function normalizeURL(url) {
+  return new URL(url, self.location).toString().replace(/#.*$/, '');
+}
+
+function wait_for_update(test, registration) {
+  if (!registration || registration.unregister == undefined) {
+    return Promise.reject(new Error(
+      'wait_for_update must be passed a ServiceWorkerRegistration'));
+  }
+
+  return new Promise(test.step_func(function(resolve) {
+      var handler = test.step_func(function() {
+        registration.removeEventListener('updatefound', handler);
+        resolve(registration.installing);
+      });
+      registration.addEventListener('updatefound', handler);
+    }));
+}
+
+// Return true if |state_a| is more advanced than |state_b|.
+function is_state_advanced(state_a, state_b) {
+  if (state_b === 'installing') {
+    switch (state_a) {
+      case 'installed':
+      case 'activating':
+      case 'activated':
+      case 'redundant':
+        return true;
+    }
+  }
+
+  if (state_b === 'installed') {
+    switch (state_a) {
+      case 'activating':
+      case 'activated':
+      case 'redundant':
+        return true;
+    }
+  }
+
+  if (state_b === 'activating') {
+    switch (state_a) {
+      case 'activated':
+      case 'redundant':
+        return true;
+    }
+  }
+
+  if (state_b === 'activated') {
+    switch (state_a) {
+      case 'redundant':
+        return true;
+    }
+  }
+  return false;
+}
+
+function wait_for_state(test, worker, state) {
+  if (!worker || worker.state == undefined) {
+    return Promise.reject(new Error(
+      'wait_for_state needs a ServiceWorker object to be passed.'));
+  }
+  if (worker.state === state)
+    return Promise.resolve(state);
+
+  if (is_state_advanced(worker.state, state)) {
+    return Promise.reject(new Error(
+      `Waiting for ${state} but the worker is already ${worker.state}.`));
+  }
+  return new Promise(test.step_func(function(resolve, reject) {
+      worker.addEventListener('statechange', test.step_func(function() {
+          if (worker.state === state)
+            resolve(state);
+
+          if (is_state_advanced(worker.state, state)) {
+            reject(new Error(
+              `The state of the worker becomes ${worker.state} while waiting` +
+                `for ${state}.`));
+          }
+        }));
+    }));
+}
+
+// Declare a test that runs entirely in the ServiceWorkerGlobalScope. The |url|
+// is the service worker script URL. This function:
+// - Instantiates a new test with the description specified in |description|.
+//   The test will succeed if the specified service worker can be successfully
+//   registered and installed.
+// - Creates a new ServiceWorker registration with a scope unique to the current
+//   document URL. Note that this doesn't allow more than one
+//   service_worker_test() to be run from the same document.
+// - Waits for the new worker to begin installing.
+// - Imports tests results from tests running inside the ServiceWorker.
+function service_worker_test(url, description) {
+  // If the document URL is https://example.com/document and the script URL is
+  // https://example.com/script/worker.js, then the scope would be
+  // https://example.com/script/scope/document.
+  var scope = new URL('scope' + window.location.pathname,
+                      new URL(url, window.location)).toString();
+  promise_test(function(test) {
+      return service_worker_unregister_and_register(test, url, scope)
+        .then(function(registration) {
+            add_completion_callback(function() {
+                registration.unregister();
+              });
+            return wait_for_update(test, registration)
+              .then(function(worker) {
+                  return fetch_tests_from_worker(worker);
+                });
+          });
+    }, description);
+}
+
+function base_path() {
+  return location.pathname.replace(/\/[^\/]*$/, '/');
+}
+
+function test_login(test, origin, username, password, cookie) {
+  return new Promise(function(resolve, reject) {
+      with_iframe(
+        origin + base_path() +
+        'resources/fetch-access-control-login.html')
+        .then(test.step_func(function(frame) {
+            var channel = new MessageChannel();
+            channel.port1.onmessage = test.step_func(function() {
+                frame.remove();
+                resolve();
+              });
+            frame.contentWindow.postMessage(
+              {username: username, password: password, cookie: cookie},
+              origin, [channel.port2]);
+          }));
+    });
+}
+
+function test_websocket(test, frame, url) {
+  return new Promise(function(resolve, reject) {
+      var ws = new frame.contentWindow.WebSocket(url, ['echo', 'chat']);
+      var openCalled = false;
+      ws.addEventListener('open', test.step_func(function(e) {
+          assert_equals(ws.readyState, 1, "The WebSocket should be open");
+          openCalled = true;
+          ws.close();
+        }), true);
+
+      ws.addEventListener('close', test.step_func(function(e) {
+          assert_true(openCalled, "The WebSocket should be closed after being opened");
+          resolve();
+        }), true);
+
+      ws.addEventListener('error', reject);
+    });
+}
+
+function login_https(test) {
+  var host_info = get_host_info();
+  return test_login(test, host_info.HTTPS_REMOTE_ORIGIN,
+                    'username1s', 'password1s', 'cookie1')
+    .then(function() {
+        return test_login(test, host_info.HTTPS_ORIGIN,
+                          'username2s', 'password2s', 'cookie2');
+      });
+}
+
+function websocket(test, frame) {
+  return test_websocket(test, frame, get_websocket_url());
+}
+
+function get_websocket_url() {
+  return 'wss://{{host}}:{{ports[wss][0]}}/echo';
+}
+
+// The navigator.serviceWorker.register() method guarantees that the newly
+// installing worker is available as registration.installing when its promise
+// resolves. However some tests test installation using a <link> element where
+// it is possible for the installing worker to have already become the waiting
+// or active worker. So this method is used to get the newest worker when these
+// tests need access to the ServiceWorker itself.
+function get_newest_worker(registration) {
+  if (registration.installing)
+    return registration.installing;
+  if (registration.waiting)
+    return registration.waiting;
+  if (registration.active)
+    return registration.active;
+}
+
+function register_using_link(script, options) {
+  var scope = options.scope;
+  var link = document.createElement('link');
+  link.setAttribute('rel', 'serviceworker');
+  link.setAttribute('href', script);
+  link.setAttribute('scope', scope);
+  document.getElementsByTagName('head')[0].appendChild(link);
+  return new Promise(function(resolve, reject) {
+        link.onload = resolve;
+        link.onerror = reject;
+      })
+    .then(() => navigator.serviceWorker.getRegistration(scope));
+}
+
+function with_sandboxed_iframe(url, sandbox) {
+  return new Promise(function(resolve) {
+      var frame = document.createElement('iframe');
+      frame.sandbox = sandbox;
+      frame.src = url;
+      frame.onload = function() { resolve(frame); };
+      document.body.appendChild(frame);
+    });
+}
+
+// Registers, waits for activation, then unregisters on a sample scope.
+//
+// This can be used to wait for a period of time needed to register,
+// activate, and then unregister a service worker.  When checking that
+// certain behavior does *NOT* happen, this is preferable to using an
+// arbitrary delay.
+async function wait_for_activation_on_sample_scope(t, window_or_workerglobalscope) {
+  const script = '/service-workers/service-worker/resources/empty-worker.js';
+  const scope = 'resources/there/is/no/there/there?' + Date.now();
+  let registration = await window_or_workerglobalscope.navigator.serviceWorker.register(script, { scope });
+  await wait_for_state(t, registration.installing, 'activated');
+  await registration.unregister();
+}
+
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/test-request-headers-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-headers-worker.js
new file mode 100644
index 000000000000..566e2e9984b5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-headers-worker.js
@@ -0,0 +1,10 @@
+// Add a unique UUID per request to induce service worker script update.
+// Time stamp: %UUID%
+
+// The server injects the request headers here as a JSON string.
+const headersAsJson = `%HEADERS%`;
+const headers = JSON.parse(headersAsJson);
+
+self.addEventListener('message', async (e) => {
+  e.source.postMessage(headers);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/test-request-mode-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-mode-worker.js
new file mode 100644
index 000000000000..566e2e9984b5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/test-request-mode-worker.js
@@ -0,0 +1,10 @@
+// Add a unique UUID per request to induce service worker script update.
+// Time stamp: %UUID%
+
+// The server injects the request headers here as a JSON string.
+const headersAsJson = `%HEADERS%`;
+const headers = JSON.parse(headersAsJson);
+
+self.addEventListener('message', async (e) => {
+  e.source.postMessage(headers);
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/testharness-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/testharness-helpers.js
new file mode 100644
index 000000000000..5f93a25438a0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/testharness-helpers.js
@@ -0,0 +1,136 @@
+/*
+ * testharness-helpers contains various useful extensions to testharness.js to
+ * allow them to be used across multiple tests before they have been
+ * upstreamed. This file is intended to be usable from both document and worker
+ * environments, so code should for example not rely on the DOM.
+ */
+
+// Asserts that two objects |actual| and |expected| are weakly equal under the
+// following definition:
+//
+// |a| and |b| are weakly equal if any of the following are true:
+//   1. If |a| is not an 'object', and |a| === |b|.
+//   2. If |a| is an 'object', and all of the following are true:
+//     2.1 |a.p| is weakly equal to |b.p| for all own properties |p| of |a|.
+//     2.2 Every own property of |b| is an own property of |a|.
+//
+// This is a replacement for the version of assert_object_equals() in
+// testharness.js. The latter doesn't handle own properties correctly. I.e. if
+// |a.p| is not an own property, it still requires that |b.p| be an own
+// property.
+//
+// Note that |actual| must not contain cyclic references.
+self.assert_object_equals = function(actual, expected, description) {
+  var object_stack = [];
+
+  function _is_equal(actual, expected, prefix) {
+    if (typeof actual !== 'object') {
+      assert_equals(actual, expected, prefix);
+      return;
+    }
+    assert_equals(typeof expected, 'object', prefix);
+    assert_equals(object_stack.indexOf(actual), -1,
+                  prefix + ' must not contain cyclic references.');
+
+    object_stack.push(actual);
+
+    Object.getOwnPropertyNames(expected).forEach(function(property) {
+        assert_own_property(actual, property, prefix);
+        _is_equal(actual[property], expected[property],
+                  prefix + '.' + property);
+      });
+    Object.getOwnPropertyNames(actual).forEach(function(property) {
+        assert_own_property(expected, property, prefix);
+      });
+
+    object_stack.pop();
+  }
+
+  function _brand(object) {
+    return Object.prototype.toString.call(object).match(/^\[object (.*)\]$/)[1];
+  }
+
+  _is_equal(actual, expected,
+            (description ? description + ': ' : '') + _brand(expected));
+};
+
+// Equivalent to assert_in_array, but uses a weaker equivalence relation
+// (assert_object_equals) than '==='.
+function assert_object_in_array(actual, expected_array, description) {
+  assert_true(expected_array.some(function(element) {
+      try {
+        assert_object_equals(actual, element);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    }), description);
+}
+
+// Assert that the two arrays |actual| and |expected| contain the same set of
+// elements as determined by assert_object_equals. The order is not significant.
+//
+// |expected| is assumed to not contain any duplicates as determined by
+// assert_object_equals().
+function assert_array_equivalent(actual, expected, description) {
+  assert_true(Array.isArray(actual), description);
+  assert_equals(actual.length, expected.length, description);
+  expected.forEach(function(expected_element) {
+      // assert_in_array treats the first argument as being 'actual', and the
+      // second as being 'expected array'. We are switching them around because
+      // we want to be resilient against the |actual| array containing
+      // duplicates.
+      assert_object_in_array(expected_element, actual, description);
+    });
+}
+
+// Asserts that two arrays |actual| and |expected| contain the same set of
+// elements as determined by assert_object_equals(). The corresponding elements
+// must occupy corresponding indices in their respective arrays.
+function assert_array_objects_equals(actual, expected, description) {
+  assert_true(Array.isArray(actual), description);
+  assert_equals(actual.length, expected.length, description);
+  actual.forEach(function(value, index) {
+      assert_object_equals(value, expected[index],
+                           description + ' : object[' + index + ']');
+    });
+}
+
+// Asserts that |object| that is an instance of some interface has the attribute
+// |attribute_name| following the conditions specified by WebIDL, but it's
+// acceptable that the attribute |attribute_name| is an own property of the
+// object because we're in the middle of moving the attribute to a prototype
+// chain.  Once we complete the transition to prototype chains,
+// assert_will_be_idl_attribute must be replaced with assert_idl_attribute
+// defined in testharness.js.
+//
+// FIXME: Remove assert_will_be_idl_attribute once we complete the transition
+// of moving the DOM attributes to prototype chains.  (http://crbug.com/43394)
+function assert_will_be_idl_attribute(object, attribute_name, description) {
+  assert_equals(typeof object, "object", description);
+
+  assert_true("hasOwnProperty" in object, description);
+
+  // Do not test if |attribute_name| is not an own property because
+  // |attribute_name| is in the middle of the transition to a prototype
+  // chain.  (http://crbug.com/43394)
+
+  assert_true(attribute_name in object, description);
+}
+
+// Stringifies a DOM object.  This function stringifies not only own properties
+// but also DOM attributes which are on a prototype chain.  Note that
+// JSON.stringify only stringifies own properties.
+function stringifyDOMObject(object)
+{
+    function deepCopy(src) {
+        if (typeof src != "object")
+            return src;
+        var dst = Array.isArray(src) ? [] : {};
+        for (var property in src) {
+            dst[property] = deepCopy(src[property]);
+        }
+        return dst;
+    }
+    return JSON.stringify(deepCopy(object));
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/type-check-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/type-check-worker.js
new file mode 100644
index 000000000000..1779e2323d92
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/type-check-worker.js
@@ -0,0 +1,10 @@
+let type = '';
+try {
+  importScripts('empty.js');
+  type = 'classic';
+} catch (e) {
+  type = 'module';
+}
+onmessage = e => {
+  e.source.postMessage(type);
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/unregister-controller-page.html b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-controller-page.html
new file mode 100644
index 000000000000..18a95ee892b1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-controller-page.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+function fetch_url(url) {
+    return new Promise(function(resolve, reject) {
+        var request = new XMLHttpRequest();
+        request.addEventListener('load', function(event) {
+            if (request.status == 200)
+                resolve(request.response);
+            else
+                reject(Error(request.statusText));
+        });
+        request.open('GET', url);
+        request.send();
+    });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/unregister-immediately-helpers.js b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-immediately-helpers.js
new file mode 100644
index 000000000000..91a30de5b777
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-immediately-helpers.js
@@ -0,0 +1,19 @@
+'use strict';
+
+// Returns a promise for a network response that contains the Clear-Site-Data:
+// "storage" header.
+function clear_site_data() {
+  return fetch('resources/blank.html?pipe=header(Clear-Site-Data,"storage")');
+}
+
+async function assert_no_registrations_exist() {
+  const registrations = await navigator.serviceWorker.getRegistrations();
+  assert_equals(registrations.length, 0);
+}
+
+async function add_controlled_iframe(test, url) {
+  const frame = await with_iframe(url);
+  test.add_cleanup(() => { frame.remove(); });
+  assert_not_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  return frame;
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/unregister-rewrite-worker.html b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-rewrite-worker.html
new file mode 100644
index 000000000000..f5d0367877a4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/unregister-rewrite-worker.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<script>
+async function onLoad() {
+  const params = new URLSearchParams(self.location.search);
+  const scope = self.origin + params.get('scopepath');
+  const reg = await navigator.serviceWorker.getRegistration(scope);
+  if (reg) {
+    await reg.unregister();
+  }
+  if (window.opener) {
+    window.opener.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  } else {
+    window.top.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  }
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update-during-installation-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/update-during-installation-worker.js
new file mode 100644
index 000000000000..f1997bd824e8
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update-during-installation-worker.js
@@ -0,0 +1,61 @@
+'use strict';
+
+const installEventFired = new Promise(resolve => {
+  self.fireInstallEvent = resolve;
+});
+
+const installFinished = new Promise(resolve => {
+  self.finishInstall = resolve;
+});
+
+addEventListener('install', event => {
+  fireInstallEvent();
+  event.waitUntil(installFinished);
+});
+
+addEventListener('message', event => {
+  let resolveWaitUntil;
+  event.waitUntil(new Promise(resolve => { resolveWaitUntil = resolve; }));
+
+  // Use a dedicated MessageChannel for every request so senders can wait for
+  // individual requests to finish, and concurrent requests (to different
+  // workers) don't cause race conditions.
+  const port = event.data;
+  port.onmessage = (event) => {
+    switch (event.data) {
+      case 'awaitInstallEvent':
+        installEventFired.then(() => {
+            port.postMessage('installEventFired');
+        }).finally(resolveWaitUntil);
+        break;
+
+      case 'finishInstall':
+        installFinished.then(() => {
+            port.postMessage('installFinished');
+        }).finally(resolveWaitUntil);
+        finishInstall();
+        break;
+
+      case 'callUpdate': {
+        const channel = new MessageChannel();
+        registration.update().then(() => {
+            channel.port2.postMessage({
+                success: true,
+            });
+        }).catch((exception) => {
+            channel.port2.postMessage({
+                success: false,
+                exception: exception.name,
+            });
+        }).finally(resolveWaitUntil);
+        port.postMessage(channel.port1, [channel.port1]);
+        break;
+      }
+
+      default:
+        port.postMessage('Unexpected command ' + event.data);
+        resolveWaitUntil();
+        break;
+    }
+  };
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-after-update-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-after-update-worker.js
new file mode 100644
index 000000000000..d43f6b2f5c3d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-after-update-worker.js
@@ -0,0 +1 @@
+// Hello world!
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-before-update-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-before-update-worker.js
new file mode 100644
index 000000000000..30c8783a7025
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update-smaller-body-before-update-worker.js
@@ -0,0 +1,2 @@
+// Hello world!
+// **with extra body**
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/update/update-after-oneday.https.html b/test/fixtures/wpt/service-workers/service-worker/resources/update/update-after-oneday.https.html
new file mode 100644
index 000000000000..9d4c98272187
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/update/update-after-oneday.https.html
@@ -0,0 +1,8 @@
+<body>
+<script>
+function load_image(url) {
+  var img = document.createElement('img');
+  img.src = url;
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/vtt-frame.html b/test/fixtures/wpt/service-workers/service-worker/resources/vtt-frame.html
new file mode 100644
index 000000000000..c3ac8034e192
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/vtt-frame.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Page Title</title>
+<video>
+  <track>
+</video>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/wait-forever-in-install-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/wait-forever-in-install-worker.js
new file mode 100644
index 000000000000..af85a73ad3e1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/wait-forever-in-install-worker.js
@@ -0,0 +1,12 @@
+var waitUntilResolve;
+self.addEventListener('install', function(event) {
+    event.waitUntil(new Promise(function(resolve) {
+        waitUntilResolve = resolve;
+      }));
+  });
+
+self.addEventListener('message', function(event) {
+    if (event.data === 'STOP_WAITING') {
+      waitUntilResolve();
+    }
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/websocket-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/websocket-worker.js
new file mode 100644
index 000000000000..bb2dc81e553f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/websocket-worker.js
@@ -0,0 +1,35 @@
+let port;
+let received = false;
+
+function reportFailure(details) {
+  port.postMessage('FAIL: ' + details);
+}
+
+onmessage = event => {
+  port = event.source;
+
+  const ws = new WebSocket('wss://{{host}}:{{ports[wss][0]}}/echo');
+  ws.onopen = () => {
+    ws.send('Hello');
+  };
+  ws.onmessage = msg => {
+    if (msg.data !== 'Hello') {
+      reportFailure('Unexpected reply: ' + msg.data);
+      return;
+    }
+
+    received = true;
+    ws.close();
+  };
+  ws.onclose = (event) => {
+    if (!received) {
+      reportFailure('Closed before receiving reply: ' + event.code);
+      return;
+    }
+
+    port.postMessage('PASS');
+  };
+  ws.onerror = () => {
+    reportFailure('Got an error event');
+  };
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/websocket.js b/test/fixtures/wpt/service-workers/service-worker/resources/websocket.js
new file mode 100644
index 000000000000..fc6abd283a04
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/websocket.js
@@ -0,0 +1,7 @@
+self.urls = [];
+self.addEventListener('fetch', function(event) {
+    self.urls.push(event.request.url);
+  });
+self.addEventListener('message', function(event) {
+    event.data.port.postMessage({urls: self.urls});
+  });
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/window-opener.html b/test/fixtures/wpt/service-workers/service-worker/resources/window-opener.html
new file mode 100644
index 000000000000..32d074464679
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/window-opener.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+function onLoad() {
+  self.onmessage = evt => {
+    if (self.opener)
+      self.opener.postMessage(evt.data, '*');
+    else
+      self.top.postMessage(evt.data, '*');
+  }
+  const params = new URLSearchParams(self.location.search);
+  const w = window.open(params.get('target'));
+  self.addEventListener('unload', evt => w.close());
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/windowclient-navigate-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/windowclient-navigate-worker.js
new file mode 100644
index 000000000000..383f66631d3a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/windowclient-navigate-worker.js
@@ -0,0 +1,75 @@
+importScripts('/resources/testharness.js');
+
+function matchQuery(queryString) {
+  return self.location.search.substr(1) === queryString;
+}
+
+async function navigateTest(t, e) {
+  const port = e.data.port;
+  const url = e.data.url;
+  const expected = e.data.expected;
+
+  let p = clients.matchAll({ includeUncontrolled : true })
+    .then(function(clients) {
+      for (const client of clients) {
+        if (client.url === e.data.clientUrl) {
+          assert_equals(client.frameType, e.data.frameType);
+          return client.navigate(url);
+        }
+      }
+      throw 'Could not locate window client.';
+    }).then(function(newClient) {
+      // If we didn't reject, we better get resolved with the right thing.
+      if (newClient === null) {
+        assert_equals(newClient, expected);
+      } else {
+        assert_equals(newClient.url, expected);
+      }
+    });
+
+  if (typeof self[expected] === "function") {
+    // It's a JS error type name.  We are expecting our promise to be rejected
+    // with that error.
+    p = promise_rejects_js(t, self[expected], p);
+  }
+
+  // Let our caller know we are done.
+  return p.finally(() => port.postMessage(null));
+}
+
+function getTestClient() {
+  return clients.matchAll({ includeUncontrolled: true })
+    .then(function(clients) {
+      for (const client of clients) {
+        if (client.url.includes('windowclient-navigate.https.html')) {
+          return client;
+        }
+      }
+
+      throw new Error('Service worker was unable to locate test client.');
+    });
+}
+
+function waitForMessage(client) {
+  const channel = new MessageChannel();
+  client.postMessage({ port: channel.port2 }, [channel.port2]);
+
+  return new Promise(function(resolve) {
+    channel.port1.onmessage = resolve;
+  });
+}
+
+// The worker must remain in the "installing" state for the duration of some
+// sub-tests. In order to achieve this coordination without relying on global
+// state, the worker must create a message channel with the client from within
+// the "install" event handler.
+if (matchQuery('installing')) {
+  self.addEventListener('install', function(e) {
+    e.waitUntil(getTestClient().then(waitForMessage));
+  });
+}
+
+self.addEventListener('message', function(e) {
+  e.waitUntil(promise_test(t => navigateTest(t, e),
+                           e.data.description + " worker side"));
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-client-id-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-client-id-worker.js
new file mode 100644
index 000000000000..f592629d074b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-client-id-worker.js
@@ -0,0 +1,25 @@
+addEventListener('fetch', evt => {
+  if (evt.request.url.includes('worker-echo-client-id.js')) {
+    evt.respondWith(new Response(
+      'fetch("fetch-echo-client-id").then(r => r.text()).then(t => self.postMessage(t));',
+      { headers: { 'Content-Type': 'application/javascript' }}));
+    return;
+  }
+
+  if (evt.request.url.includes('fetch-echo-client-id')) {
+    evt.respondWith(new Response(evt.clientId));
+    return;
+  }
+
+  if (evt.request.url.includes('frame.html')) {
+    evt.respondWith(new Response(''));
+    return;
+  }
+});
+
+addEventListener('message', evt => {
+  if (evt.data === 'echo-client-id') {
+    evt.ports[0].postMessage(evt.source.id);
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-fetching-cross-origin.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-fetching-cross-origin.js
new file mode 100644
index 000000000000..a81bb3dd6ed7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-fetching-cross-origin.js
@@ -0,0 +1,12 @@
+importScripts('/common/get-host-info.sub.js');
+importScripts('test-helpers.sub.js');
+
+self.addEventListener('fetch', event => {
+  const host_info = get_host_info();
+  // The sneaky Service Worker changes the same-origin 'square' request for a cross-origin image.
+  if (event.request.url.indexOf('square') != -1) {
+    const searchParams = new URLSearchParams(location.search);
+    const mode = searchParams.get("mode") || "cors";
+    event.respondWith(fetch(`${host_info['HTTPS_REMOTE_ORIGIN']}${base_path()}square.png`, { mode }));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-serviceworker.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-serviceworker.js
new file mode 100644
index 000000000000..d36b0b6da64d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-serviceworker.js
@@ -0,0 +1,53 @@
+let name;
+if (self.registration.scope.indexOf('scope1') != -1)
+  name = 'sw1';
+if (self.registration.scope.indexOf('scope2') != -1)
+  name = 'sw2';
+
+
+self.addEventListener('fetch', evt => {
+  // There are three types of requests this service worker handles.
+
+  // (1) The first request for the worker, which will redirect elsewhere.
+  // "redirect.py" means to test network redirect, so let network handle it.
+  if (evt.request.url.indexOf('redirect.py') != -1) {
+    return;
+  }
+  // "sw-redirect" means to test service worker redirect, so respond with a
+  // redirect.
+  if (evt.request.url.indexOf('sw-redirect') != -1) {
+    const url = new URL(evt.request.url);
+    const redirect_to = url.searchParams.get('Redirect');
+    evt.respondWith(Response.redirect(redirect_to));
+    return;
+  }
+
+  // (2) After redirect, the request is for a "webworker.py" URL.
+  // Add a search parameter to indicate this service worker handled the
+  // final request for the worker.
+  if (evt.request.url.indexOf('webworker.py') != -1) {
+    const greeting = encodeURIComponent(`${name} saw the request for the worker script`);
+    // Serve from `./subdir/`, not `./`,
+    // to conform that the base URL used in the worker is
+    // the response URL (`./subdir/`), not the current request URL (`./`).
+    evt.respondWith(fetch(`subdir/worker_interception_redirect_webworker.py?greeting=${greeting}`));
+    return;
+  }
+
+  const path = (new URL(evt.request.url)).pathname;
+
+  // (3) The worker does an importScripts() to import-scripts-echo.py. Indicate
+  // that this service worker handled the request.
+  if (evt.request.url.indexOf('import-scripts-echo.py') != -1) {
+    const msg = encodeURIComponent(`${name} saw importScripts from the worker: ${path}`);
+    evt.respondWith(fetch(`import-scripts-echo.py?msg=${msg}`));
+    return;
+  }
+
+  // (4) The worker does a fetch() to simple.txt. Indicate that this service
+  // worker handled the request.
+  if (evt.request.url.indexOf('simple.txt') != -1) {
+    evt.respondWith(new Response(`${name} saw the fetch from the worker: ${path}`));
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-webworker.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-webworker.js
new file mode 100644
index 000000000000..b7e6d81b091a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-interception-redirect-webworker.js
@@ -0,0 +1,56 @@
+// This is the (shared or dedicated) worker file for the
+// worker-interception-redirect test. It should be served by the corresponding
+// .py file instead of being served directly.
+//
+// This file is served from both resources/*webworker.py,
+// resources/scope2/*webworker.py and resources/subdir/*webworker.py.
+// Relative paths are used in `fetch()` and `importScripts()` to confirm that
+// the correct base URLs are used.
+
+// This greeting text is meant to be injected by the Python script that serves
+// this file, to indicate how the script was served (from network or from
+// service worker).
+//
+// We can't just use a sub pipe and name this file .sub.js since we want
+// to serve the file from multiple URLs (see above).
+let greeting = '%GREETING_TEXT%';
+if (!greeting)
+  greeting = 'the worker script was served from network';
+
+// Call importScripts() which fills |echo_output| with a string indicating
+// whether a service worker intercepted the importScripts() request.
+let echo_output;
+const import_scripts_msg = encodeURIComponent(
+    'importScripts: served from network');
+let import_scripts_greeting = 'not set';
+try {
+  importScripts(`import-scripts-echo.py?msg=${import_scripts_msg}`);
+  import_scripts_greeting = echo_output;
+} catch(e) {
+  import_scripts_greeting = 'importScripts failed';
+}
+
+async function runTest(port) {
+  port.postMessage(greeting);
+
+  port.postMessage(import_scripts_greeting);
+
+  const response = await fetch('simple.txt');
+  const text = await response.text();
+  port.postMessage('fetch(): ' + text);
+
+  port.postMessage(self.location.href);
+}
+
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  runTest(self);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = function(e) {
+    const port = e.ports[0];
+    port.start();
+    runTest(port);
+  };
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-load-interceptor.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-load-interceptor.js
new file mode 100644
index 000000000000..ebc0db67aa50
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-load-interceptor.js
@@ -0,0 +1,16 @@
+importScripts('/common/get-host-info.sub.js');
+
+const response_text = 'This load was successfully intercepted.';
+const response_script =
+    `const message = 'This load was successfully intercepted.';`;
+
+self.onfetch = event => {
+  const url = event.request.url;
+  if (url.indexOf('synthesized-response.txt') != -1) {
+    event.respondWith(new Response(response_text));
+  } else if (url.indexOf('synthesized-response.js') != -1) {
+    event.respondWith(new Response(
+        response_script,
+        {headers: {'Content-Type': 'application/javascript'}}));
+  }
+};
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/worker-testharness.js b/test/fixtures/wpt/service-workers/service-worker/resources/worker-testharness.js
new file mode 100644
index 000000000000..73e97be1eaa4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/worker-testharness.js
@@ -0,0 +1,49 @@
+/*
+ * worker-test-harness should be considered a temporary polyfill around
+ * testharness.js for supporting Service Worker based tests. It should not be
+ * necessary once the test harness is able to drive worker based tests natively.
+ * See https://github.com/w3c/testharness.js/pull/82 for status of effort to
+ * update upstream testharness.js. Once the upstreaming is complete, tests that
+ * reference worker-test-harness should be updated to directly import
+ * testharness.js.
+ */
+
+importScripts('/resources/testharness.js');
+
+(function() {
+  var next_cache_index = 1;
+
+  // Returns a promise that resolves to a newly created Cache object. The
+  // returned Cache will be destroyed when |test| completes.
+  function create_temporary_cache(test) {
+    var uniquifier = String(++next_cache_index);
+    var cache_name = self.location.pathname + '/' + uniquifier;
+
+    test.add_cleanup(function() {
+        return self.caches.delete(cache_name);
+      });
+
+    return self.caches.delete(cache_name)
+      .then(function() {
+          return self.caches.open(cache_name);
+        });
+  }
+
+  self.create_temporary_cache = create_temporary_cache;
+})();
+
+// Runs |test_function| with a temporary unique Cache passed in as the only
+// argument. The function is run as a part of Promise chain owned by
+// promise_test(). As such, it is expected to behave in a manner identical (with
+// the exception of the argument) to a function passed into promise_test().
+//
+// E.g.:
+//    cache_test(function(cache) {
+//      // Do something with |cache|, which is a Cache object.
+//    }, "Some Cache test");
+function cache_test(test_function, description) {
+  promise_test(function(test) {
+      return create_temporary_cache(test)
+        .then(test_function);
+    }, description);
+}
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xhr-content-length-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-content-length-worker.js
new file mode 100644
index 000000000000..604deece2d25
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-content-length-worker.js
@@ -0,0 +1,22 @@
+// Service worker for the xhr-content-length test.
+
+self.addEventListener("fetch", event => {
+  const url = new URL(event.request.url);
+  const type = url.searchParams.get("type");
+
+  if (type === "no-content-length") {
+    event.respondWith(new Response("Hello!"));
+  }
+
+  if (type === "larger-content-length") {
+    event.respondWith(new Response("meeeeh", { headers: [["Content-Length", "10000"]] }));
+  }
+
+  if (type === "double-content-length") {
+    event.respondWith(new Response("meeeeh", { headers: [["Content-Length", "10000"], ["Content-Length", "10000"]] }));
+  }
+
+  if (type === "bogus-content-length") {
+    event.respondWith(new Response("meeeeh", { headers: [["Content-Length", "test"]] }));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xhr-iframe.html b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-iframe.html
new file mode 100644
index 000000000000..4c57bbbc6589
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-iframe.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>iframe for xhr tests</title>
+<script>
+async function xhr(url, options) {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    const opts = options ? options : {};
+    xhr.onload = () => {
+      resolve(xhr);
+    };
+    xhr.onerror = () => {
+      reject('xhr failed');
+    };
+
+    xhr.open('GET', url);
+    if (opts.responseType) {
+      xhr.responseType = opts.responseType;
+    }
+    xhr.send();
+  });
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xhr-response-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-response-url-worker.js
new file mode 100644
index 000000000000..906ad5005b59
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xhr-response-url-worker.js
@@ -0,0 +1,32 @@
+// Service worker for the xhr-response-url test.
+
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  const respondWith = url.searchParams.get('respondWith');
+  if (!respondWith)
+    return;
+
+  if (respondWith == 'fetch') {
+    const target = url.searchParams.get('url');
+    event.respondWith(fetch(target));
+    return;
+  }
+
+  if (respondWith == 'string') {
+    const headers = {'content-type': 'text/plain'};
+    event.respondWith(new Response('hello', {headers}));
+    return;
+  }
+
+  if (respondWith == 'document') {
+    const doc = `
+        <!DOCTYPE html>
+        <html>
+        <title>hi</title>
+        <body>hello</body>
+        </html>`;
+    const headers = {'content-type': 'text/html'};
+    event.respondWith(new Response(doc, {headers}));
+    return;
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-iframe.xml b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-iframe.xml
new file mode 100644
index 000000000000..065a07acb284
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-iframe.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="resources/request-url-path/import-relative.xsl"?>
+<stylesheet-test>
+This tests a stylesheet which has a xsl:import with a relative URL.
+</stylesheet-test>
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-worker.js b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-worker.js
new file mode 100644
index 000000000000..50e2b1842ffc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xsl-base-url-worker.js
@@ -0,0 +1,12 @@
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+
+  // For the import-relative.xsl file, respond in a way that changes the
+  // response URL. This is expected to change the base URL and allow the import
+  // from the file to succeed.
+  const path = 'request-url-path/import-relative.xsl';
+  if (url.pathname.indexOf(path) != -1) {
+    // Respond with a different URL, deleting "request-url-path/".
+    event.respondWith(fetch('import-relative.xsl'));
+  }
+});
diff --git a/test/fixtures/wpt/service-workers/service-worker/resources/xslt-pass.xsl b/test/fixtures/wpt/service-workers/service-worker/resources/xslt-pass.xsl
new file mode 100644
index 000000000000..2cd7f2f8f86a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/resources/xslt-pass.xsl
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="/">
+    <html>
+      <body>
+           <p>PASS</p>
+      </body>
+    </html>
+  </xsl:template>
+</xsl:stylesheet>
diff --git a/test/fixtures/wpt/service-workers/service-worker/respond-with-body-accessed-response.https.html b/test/fixtures/wpt/service-workers/service-worker/respond-with-body-accessed-response.https.html
new file mode 100644
index 000000000000..f6713d89216e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/respond-with-body-accessed-response.https.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<title>Service Worker responds with .body accessed response.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+let frame;
+
+promise_test(t => {
+    const SCOPE = 'resources/respond-with-body-accessed-response-iframe.html';
+    const SCRIPT = 'resources/respond-with-body-accessed-response-worker.js';
+
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(reg => {
+          promise_test(t => {
+              if (frame)
+                frame.remove();
+              return reg.unregister();
+            }, 'restore global state');
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(() => { return with_iframe(SCOPE); })
+      .then(f => { frame = f; });
+  }, 'initialize global state');
+
+const TEST_CASES = [
+  "type=basic",
+  "type=opaque",
+  "type=default",
+  "type=basic&clone=1",
+  "type=opaque&clone=1",
+  "type=default&clone=1",
+  "type=basic&clone=2",
+  "type=opaque&clone=2",
+  "type=default&clone=2",
+  "type=basic&passThroughCache=true",
+  "type=opaque&passThroughCache=true",
+  "type=default&passThroughCache=true",
+  "type=basic&clone=1&passThroughCache=true",
+  "type=opaque&clone=1&passThroughCache=true",
+  "type=default&clone=1&passThroughCache=true",
+  "type=basic&clone=2&passThroughCache=true",
+  "type=opaque&clone=2&passThroughCache=true",
+  "type=default&clone=2&passThroughCache=true",
+];
+
+TEST_CASES.forEach(param => {
+    promise_test(t => {
+        const url = 'TestRequest?' + param;
+        return frame.contentWindow.getJSONP(url)
+          .then(result => { assert_equals(result, 'OK'); });
+      }, 'test: ' + param);
+  });
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/same-site-cookies.https.html b/test/fixtures/wpt/service-workers/service-worker/same-site-cookies.https.html
new file mode 100644
index 000000000000..1d9b60d44701
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/same-site-cookies.https.html
@@ -0,0 +1,496 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Same-site cookie behavior</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const COOKIE_VALUE = 'COOKIE_VALUE';
+
+function make_nested_url(nested_origins, target_url) {
+  for (let i = nested_origins.length - 1; i >= 0; --i) {
+    target_url = new URL(
+      `./resources/nested-parent.html?target=${encodeURIComponent(target_url)}`,
+      nested_origins[i] + self.location.pathname);
+  }
+  return target_url;
+}
+
+const scopepath = '/cookies/resources/postToParent.py?with-sw';
+
+async function unregister_service_worker(origin, nested_origins=[]) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/unregister-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  target_url = make_nested_url(nested_origins, target_url);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-UNREGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function register_service_worker(origin, nested_origins=[]) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/register-rewrite-worker.html' +
+      '?scopepath=' + encodeURIComponent(scopepath);
+  target_url = make_nested_url(nested_origins, target_url);
+  const w = window.open(target_url);
+  try {
+    await wait_for_message('SW-REGISTERED');
+  } finally {
+    w.close();
+  }
+}
+
+async function run_test(t, origin, navaction, swaction, expected,
+                        redirect_origins=[], nested_origins=[]) {
+  if (swaction === 'navpreload') {
+    assert_true('navigationPreload' in ServiceWorkerRegistration.prototype,
+                'navigation preload must be supported');
+  }
+  const sw_param = swaction === 'no-sw' ? 'no-sw' : 'with-sw';
+  let action_param = '';
+  if (swaction === 'fallback') {
+    action_param = '&ignore';
+  } else if (swaction !== 'no-sw') {
+    action_param = '&' + swaction;
+  }
+  const navpreload_param = swaction === 'navpreload' ? '&navpreload' : '';
+  const change_request_param = swaction === 'change-request' ? '&change-request' : '';
+  const target_string = origin + `/cookies/resources/postToParent.py?` +
+                                 `${sw_param}${action_param}`
+  let target_url = new URL(target_string);
+
+  for (let i = redirect_origins.length - 1; i >= 0; --i) {
+    const redirect_url = new URL(
+        `./resources/redirect.py?Status=307&Redirect=${encodeURIComponent(target_url)}`,
+        redirect_origins[i] + self.location.pathname);
+    target_url = redirect_url;
+  }
+
+  if (navaction === 'window.open') {
+    target_url = new URL(
+        `./resources/window-opener.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  } else if (navaction === 'form post') {
+    target_url = new URL(
+        `./resources/form-poster.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  } else if (navaction === 'set location') {
+    target_url = new URL(
+        `./resources/location-setter.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  }
+
+  const w = window.open(make_nested_url(nested_origins, target_url));
+  t.add_cleanup(() => w.close());
+
+  const result = await wait_for_message('COOKIES');
+  verifySameSiteCookieState(expected, COOKIE_VALUE, result.data);
+}
+
+promise_test(async t => {
+  await resetSameSiteCookies(self.origin, COOKIE_VALUE);
+  await register_service_worker(self.origin);
+
+  await resetSameSiteCookies(SECURE_SUBDOMAIN_ORIGIN, COOKIE_VALUE);
+  await register_service_worker(SECURE_SUBDOMAIN_ORIGIN);
+
+  await resetSameSiteCookies(SECURE_CROSS_SITE_ORIGIN, COOKIE_VALUE);
+  await register_service_worker(SECURE_CROSS_SITE_ORIGIN);
+
+  await register_service_worker(self.origin,
+      [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'Setup service workers');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with fallback');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with passthrough');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with change-request');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, window.open with navpreload');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT);
+}, 'same-site, window.open with navpreload');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'no-sw',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'fallback',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'passthrough',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'cross-site, window.open with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'navpreload',
+                  SameSiteStatus.LAX);
+}, 'cross-site, window.open with navpreload');
+
+//
+// window.open redirect tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with no service worker and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with fallback and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with passthrough and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with change-request and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, window.open with navpreload and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with no service worker and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with fallback and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with passthrough and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with change-request and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, window.open with navpreload and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with no service worker, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with fallback, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with passthrough, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with change-request, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
+}, 'same-origin, window.open with navpreload, cross-site redirect, and ' +
+   'same-origin redirect');
+
+//
+// Double-nested frame calling open.window() tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'fallback service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'passthrough service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'change-request service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'navpreload service worker');
+
+//
+// Double-nested frame setting location tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'fallback service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'passthrough service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'change-request',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'change-request service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'navpreload',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'navpreload service worker');
+
+//
+// Form POST tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw', SameSiteStatus.STRICT);
+}, 'same-origin, form post with no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, form post with fallback');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, form post with passthrough');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-origin, form post with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'no-sw',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'fallback',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'passthrough',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'same-site, form post with change-request');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'no-sw',
+                  SameSiteStatus.CROSS_SITE);
+}, 'cross-site, form post with no service worker');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'fallback',
+                  SameSiteStatus.CROSS_SITE);
+}, 'cross-site, form post with fallback');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'passthrough',
+                  SameSiteStatus.CROSS_SITE);
+}, 'cross-site, form post with passthrough');
+
+promise_test(t => {
+  return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'change-request',
+                  SameSiteStatus.STRICT);
+}, 'cross-site, form post with change-request');
+
+//
+// Form POST redirect tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with no service worker and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with fallback and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with passthrough and same-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
+}, 'same-origin, form post with change-request and same-site redirect');
+
+// navpreload is not supported for POST requests
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with no service worker and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with fallback and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with passthrough and cross-site redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, form post with change-request and cross-site redirect');
+
+// navpreload is not supported for POST requests
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
+                                              self.origin]);
+}, 'same-origin, form post with no service worker, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
+                                              self.origin]);
+}, 'same-origin, form post with fallback, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
+                                              self.origin]);
+}, 'same-origin, form post with passthrough, cross-site redirect, and ' +
+   'same-origin redirect');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'form post', 'change-request',
+                  SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN,
+                                          self.origin]);
+}, 'same-origin, form post with change-request, cross-site redirect, and ' +
+   'same-origin redirect');
+
+// navpreload is not supported for POST requests
+
+promise_test(async t => {
+  await unregister_service_worker(self.origin);
+  await unregister_service_worker(SECURE_SUBDOMAIN_ORIGIN);
+  await unregister_service_worker(SECURE_CROSS_SITE_ORIGIN);
+  await unregister_service_worker(self.origin,
+      [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'Cleanup service workers');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html
new file mode 100644
index 000000000000..ba34e790ff07
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html
@@ -0,0 +1,536 @@
+<!DOCTYPE html>
+<title>ServiceWorker FetchEvent for sandboxed iframe.</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var lastCallbackId = 0;
+var callbacks = {};
+function doTest(frame, type) {
+  return new Promise(function(resolve) {
+    var id = ++lastCallbackId;
+    callbacks[id] = resolve;
+    frame.contentWindow.postMessage({id: id, type: type}, '*');
+  });
+}
+
+// Asks the service worker for data about requests and clients seen. The
+// worker posts a message back with |data| where:
+// |data.requests|: the requests the worker received FetchEvents for
+// |data.clients|: the URLs of all the worker's clients
+// The worker clears its data after responding.
+function getResultsFromWorker(worker) {
+  return new Promise(resolve => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = msg => {
+      resolve(msg.data);
+    };
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+}
+
+window.onmessage = function (e) {
+  message = e.data;
+  var id = message['id'];
+  var callback = callbacks[id];
+  delete callbacks[id];
+  callback(message['result']);
+};
+
+const SCOPE = 'resources/sandboxed-iframe-fetch-event-iframe.py';
+const SCRIPT = 'resources/sandboxed-iframe-fetch-event-worker.js';
+const expected_base_url = new URL(SCOPE, location.href);
+// Service worker controlling |SCOPE|.
+let worker;
+// A normal iframe.
+// This should be controlled by a service worker.
+let normal_frame;
+// An iframe created by <iframe sandbox='allow-scripts'>.
+// This should NOT be controlled by a service worker.
+let sandboxed_frame;
+// An iframe created by <iframe sandbox='allow-scripts allow-same-origin'>.
+// This should be controlled by a service worker.
+let sandboxed_same_origin_frame;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts'.
+// This should NOT be controlled by a service worker.
+let sandboxed_frame_by_header;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts allow-same-origin'.
+// This should be controlled by a service worker.
+let sandboxed_same_origin_frame_by_header;
+
+promise_test(t => {
+  return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+    .then(function(registration) {
+      add_completion_callback(() => registration.unregister());
+      worker = registration.installing;
+      return wait_for_state(t, registration.installing, 'activated');
+    });
+}, 'Prepare a service worker.');
+
+promise_test(t => {
+  return with_iframe(SCOPE + '?iframe')
+    .then(f => {
+      normal_frame = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0], expected_base_url + '?iframe');
+      assert_true(data.clients.includes(expected_base_url + '?iframe'));
+    });
+}, 'Prepare a normal iframe.');
+
+promise_test(t => {
+  return with_sandboxed_iframe(SCOPE + '?sandboxed-iframe', 'allow-scripts')
+    .then(f => {
+      sandboxed_frame = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0);
+      assert_false(data.clients.includes(expected_base_url +
+                                         '?sandboxed-iframe'));
+    });
+}, 'Prepare an iframe sandboxed by <iframe sandbox="allow-scripts">.');
+
+promise_test(t => {
+  return with_sandboxed_iframe(SCOPE + '?sandboxed-iframe-same-origin',
+                               'allow-scripts allow-same-origin')
+    .then(f => {
+      sandboxed_same_origin_frame = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0],
+                    expected_base_url + '?sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        expected_base_url + '?sandboxed-iframe-same-origin'));
+    })
+}, 'Prepare an iframe sandboxed by ' +
+   '<iframe sandbox="allow-scripts allow-same-origin">.');
+
+promise_test(t => {
+  const iframe_full_url = expected_base_url + '?sandbox=allow-scripts&' +
+                          'sandboxed-frame-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'Service worker should provide the response');
+      assert_equals(requests[0], iframe_full_url);
+      assert_false(data.clients.includes(iframe_full_url),
+                   'Service worker should NOT control the sandboxed page');
+    });
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts.');
+
+promise_test(t => {
+  const iframe_full_url =
+    expected_base_url + '?sandbox=allow-scripts%20allow-same-origin&' +
+    'sandboxed-iframe-same-origin-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_same_origin_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0], iframe_full_url);
+      assert_true(data.clients.includes(iframe_full_url));
+    })
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts and ' +
+   'allow-same-origin.');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch');
+    });
+}, 'Fetch request from a normal iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch-from-worker');
+    });
+}, 'Fetch request from a worker in a normal iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=iframe');
+      assert_true(data.clients.includes(frame.src + '&test=iframe'));
+
+    });
+}, 'Request for an iframe in the normal iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the normal ' +
+   'iframe');
+
+promise_test(t => {
+  let frame = normal_frame;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the normal iframe');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The fetch request should NOT be handled by SW.');
+    });
+}, 'Fetch request from iframe sandboxed by an attribute with allow-scripts ' +
+   'flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The fetch request should NOT be handled by SW.');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by an attribute with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by an attribute with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the iframe ' +
+   'sandboxed by an attribute with allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by an attribute with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch');
+    });
+}, 'Fetch request from iframe sandboxed by an attribute with allow-scripts ' +
+   'and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The fetch request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=fetch-from-worker');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by an attribute with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=iframe');
+      assert_true(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by an attribute with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the iframe ' +
+   'sandboxed by attribute with allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by attribute with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+    });
+}, 'Fetch request from iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the iframe ' +
+   'sandboxed by CSP HTTP header with allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'fetch')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch');
+    });
+}, 'Fetch request from iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=iframe');
+      assert_true(data.clients.includes(frame.src + '&test=iframe'));
+    });
+}, 'Request for an iframe in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts and allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+      assert_false(
+        data.clients.includes(frame.src + '&test=sandboxed-iframe'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts flag in the ' +
+   'iframe sandboxed by CSP HTTP header with allow-scripts and ' +
+   'allow-same-origin flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'sandboxed-iframe-same-origin')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0],
+                    frame.src + '&test=sandboxed-iframe-same-origin');
+      assert_true(data.clients.includes(
+        frame.src + '&test=sandboxed-iframe-same-origin'));
+    });
+}, 'Request for an sandboxed iframe with allow-scripts and ' +
+   'allow-same-origin flag in the iframe sandboxed by CSP HTTP header with ' +
+   'allow-scripts and allow-same-origin flag');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-navigator-serviceworker.https.html b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-navigator-serviceworker.https.html
new file mode 100644
index 000000000000..70be6ef9b0a9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/sandboxed-iframe-navigator-serviceworker.https.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<title>Accessing navigator.serviceWorker in sandboxed iframe.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+var lastCallbackId = 0;
+var callbacks = {};
+function postMessageAndWaitResult(frame) {
+  return new Promise(function(resolve, reject) {
+    var id = ++lastCallbackId;
+    callbacks[id] = resolve;
+    frame.contentWindow.postMessage({id:id}, '*');
+    const timeout = 1000;
+    step_timeout(() => reject("no msg back after " + timeout + "ms"), timeout);
+  });
+}
+
+window.onmessage = function(e) {
+  message = e.data;
+  var id = message['id'];
+  var callback = callbacks[id];
+  delete callbacks[id];
+  callback(message.result);
+};
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return with_iframe(url)
+      .then(function(f) {
+          frame = f;
+          add_result_callback(() => { frame.remove(); });
+          return postMessageAndWaitResult(f);
+        })
+      .then(function(result) {
+          assert_equals(result, 'ok');
+        });
+  }, 'Accessing navigator.serviceWorker in normal iframe should not throw.');
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return with_sandboxed_iframe(url, 'allow-scripts')
+      .then(function(f) {
+          frame = f;
+          add_result_callback(() => { frame.remove(); });
+          return postMessageAndWaitResult(f);
+        })
+      .then(function(result) {
+          assert_equals(
+              result,
+              'navigator.serviceWorker failed: SecurityError');
+        });
+  }, 'Accessing navigator.serviceWorker in sandboxed iframe should throw.');
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return with_sandboxed_iframe(url, 'allow-scripts allow-same-origin')
+      .then(function(f) {
+          frame = f;
+          add_result_callback(() => { frame.remove(); });
+          return postMessageAndWaitResult(f);
+        })
+      .then(function(result) {
+          assert_equals(result, 'ok');
+        });
+  },
+  'Accessing navigator.serviceWorker in sandboxed iframe with ' +
+  'allow-same-origin flag should not throw.');
+
+promise_test(function(t) {
+    var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html';
+    var frame;
+    return new Promise(function(resolve) {
+          frame = document.createElement('iframe');
+          add_result_callback(() => { frame.remove(); });
+          frame.sandbox = '';
+          frame.src = url;
+          frame.onload = resolve;
+          document.body.appendChild(frame);
+          // Switch the sandbox attribute while loading the iframe.
+          frame.sandbox = 'allow-scripts allow-same-origin';
+        })
+      .then(function() {
+          return postMessageAndWaitResult(frame)
+        })
+      .then(function(result) {
+          // The HTML spec seems to say that changing the sandbox attribute
+          // after the iframe is inserted into its parent document does not
+          // affect the sandboxing. If that's true, the frame should still
+          // act as if it still doesn't have
+          // 'allow-scripts allow-same-origin' set and throw a SecurityError.
+          //
+          // 1) From Section 4.8.5 "The iframe element":
+          // "When an iframe element is inserted into a document that has a
+          // browsing context, the user agent must create a new browsing
+          // context..."
+          // 2) "Create a new browsing context" expands to Section 7.1
+          // "Browsing contexts", which includes creating a Document and
+          // "Implement the sandboxing for document."
+          // 3) "Implement the sandboxing" expands to Section 7.6 "Sandboxing",
+          // which includes "populate document's active sandboxing flag set".
+          //
+          // It's not clear whether navigation subsequently creates a new
+          // Document, but I'm assuming it wouldn't.
+          // https://html.spec.whatwg.org/multipage/embedded-content.html#attr-iframe-sandbox
+          assert_true(
+              false,
+              'should NOT get message back from a sandboxed frame where scripts are not allowed to execute');
+        })
+      .catch(msg => {
+        assert_true(msg.startsWith('no msg back'), 'expecting error message "no msg back"');
+      });
+  }, 'Switching iframe sandbox attribute while loading the iframe');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/secure-context.https.html b/test/fixtures/wpt/service-workers/service-worker/secure-context.https.html
new file mode 100644
index 000000000000..666a5d378760
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/secure-context.https.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Ensure service worker is bypassed in insecure contexts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// This test checks that an HTTPS iframe embedded in an HTTP document is not
+// loaded via a service worker, since it's not a secure context. To that end, we
+// first register a service worker, wait for its activation, and create an
+// iframe that is controlled by said service worker. We use the iframe as a
+// way to receive messages from the service worker.
+// The bulk of the test begins by opening an HTTP window with the noopener
+// option, installing a message event handler, and embedding an HTTPS iframe. If
+// the browser behaves correctly then the iframe will be loaded from the network
+// and will contain a script that posts a message to the parent window,
+// informing it that it was loaded from the network. If, however, the iframe is
+// intercepted, the service worker will return a page with a script that posts a
+// message to the parent window, informing it that it was intercepted.
+// Upon getting either result, the window will report the result to the service
+// worker by navigating to a reporting URL. The service worker will then inform
+// all clients about the result, including the controlled iframe from the
+// beginning of the test. The message event handler will verify that the result
+// is as expected, concluding the test.
+promise_test(t => {
+    const SCRIPT = "resources/secure-context-service-worker.js";
+    const SCOPE = "resources/";
+    const HTTP_IFRAME_URL = get_host_info().HTTP_ORIGIN + base_path() + SCOPE + "secure-context/window.html";
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+        .then(registration => {
+            t.add_cleanup(() => {
+                return registration.unregister();
+            });
+            return wait_for_state(t, registration.installing, 'activated');
+        })
+        .then(() => {
+            return with_iframe(SCOPE + "blank.html");
+        })
+        .then(iframe => {
+            t.add_cleanup(() => {
+                iframe.remove();
+            });
+            return new Promise(resolve => {
+                iframe.contentWindow.navigator.serviceWorker.onmessage = t.step_func(event => {
+                    assert_equals(event.data, 'network');
+                    resolve();
+                });
+                window.open(HTTP_IFRAME_URL, 'MyWindow', 'noopener');
+            });
+        });
+})
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-connect.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-connect.https.html
new file mode 100644
index 000000000000..226f4a40e4e9
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-connect.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP connect directive for ServiceWorker script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+service_worker_test(
+    'resources/service-worker-csp-worker.py?directive=connect',
+    'CSP test for connect-src in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-default.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-default.https.html
new file mode 100644
index 000000000000..1d4e7624d861
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-default.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP default directive for ServiceWorker script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+service_worker_test(
+    'resources/service-worker-csp-worker.py?directive=default',
+    'CSP test for default-src in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-script.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-script.https.html
new file mode 100644
index 000000000000..14c2eb72bdc4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-csp-script.https.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Service Worker: CSP script directive for ServiceWorker script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+service_worker_test(
+    'resources/service-worker-csp-worker.py?directive=script',
+    'CSP test for script-src in ServiceWorkerGlobalScope');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/service-worker-header.https.html b/test/fixtures/wpt/service-workers/service-worker/service-worker-header.https.html
new file mode 100644
index 000000000000..fb902cd1b455
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/service-worker-header.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Service Worker: Service-Worker header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(async t => {
+  const script = 'resources/service-worker-header.py'
+    + '?header&import=service-worker-header.py?no-header';
+  const scope = 'resources/service-worker-header';
+  const expected_url = normalizeURL(script);
+  const registration =
+    await service_worker_unregister_and_register(t, script, scope);
+  t.add_cleanup(() => registration.unregister());
+  assert_true(registration instanceof ServiceWorkerRegistration);
+
+  await wait_for_state(t, registration.installing, 'activated');
+  await registration.update();
+}, 'A request to fetch service worker main script should have Service-Worker '
+  + 'header and imported scripts should not have one');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html b/test/fixtures/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html
new file mode 100644
index 000000000000..fac8f2076fb6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>Service Worker: ServiceWorkerMessageEvent</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html';
+    var url = 'resources/postmessage-to-client-worker.js';
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          var w = frame.contentWindow;
+          var worker = w.navigator.serviceWorker.controller;
+          assert_equals(
+              self.ServiceWorkerMessageEvent, undefined,
+              'ServiceWorkerMessageEvent should not be defined.');
+          return new Promise(function(resolve) {
+              w.navigator.serviceWorker.onmessage = t.step_func(function(e) {
+                  assert_true(
+                      e instanceof w.MessageEvent,
+                      'message events should use MessageEvent interface.');
+                  assert_true(e.source instanceof w.ServiceWorker);
+                  assert_equals(e.type, 'message');
+                  assert_equals(e.source, worker,
+                                'source should equal to the controller.');
+                  assert_equals(e.ports.length, 0);
+                  resolve();
+                });
+              worker.postMessage('PING');
+            });
+        });
+  }, 'Test MessageEvent supplants ServiceWorkerMessageEvent.');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html b/test/fixtures/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html
new file mode 100644
index 000000000000..6004985a3460
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<title>ServiceWorker object: scriptURL property</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+function url_test(name, url) {
+  const scope = 'resources/scope/' + name;
+  const expectedURL = normalizeURL(url);
+
+  promise_test(async t => {
+    const registration =
+        await service_worker_unregister_and_register(t, url, scope);
+    const worker = registration.installing;
+    assert_equals(worker.scriptURL, expectedURL, 'scriptURL');
+    await registration.unregister();
+  }, 'Verify the scriptURL property: ' + name);
+}
+
+url_test('relative', 'resources/empty-worker.js');
+url_test('with-fragment', 'resources/empty-worker.js#ref');
+url_test('with-query', 'resources/empty-worker.js?ref');
+url_test('absolute', normalizeURL('./resources/empty-worker.js'));
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-installed.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-installed.https.html
new file mode 100644
index 000000000000..b604f651b3c1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-installed.https.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting installed worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting-installed';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/skip-waiting-installed-worker.js';
+    var frame, frame_sw, service_worker, registration, onmessage, oncontrollerchanged;
+    var saw_message = new Promise(function(resolve) {
+        onmessage = function(e) {
+            resolve(e.data);
+          };
+        })
+      .then(function(message) {
+          assert_equals(
+            message, 'PASS',
+            'skipWaiting promise should be resolved with undefined');
+        });
+    var saw_controllerchanged = new Promise(function(resolve) {
+        oncontrollerchanged = function() {
+            assert_equals(
+                frame_sw.controller.scriptURL, normalizeURL(url2),
+                'Controller scriptURL should change to the second one');
+            assert_equals(registration.active.scriptURL, normalizeURL(url2),
+                          'Worker which calls skipWaiting should be active by controllerchange');
+            resolve();
+        };
+      });
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          frame_sw = f.contentWindow.navigator.serviceWorker;
+          assert_equals(
+              frame_sw.controller.scriptURL, normalizeURL(url1),
+              'Document controller scriptURL should equal to the first one');
+          frame_sw.oncontrollerchange = t.step_func(oncontrollerchanged);
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(r) {
+          registration = r;
+          service_worker = r.installing;
+          return wait_for_state(t, service_worker, 'installed');
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          channel.port1.onmessage = t.step_func(onmessage);
+          service_worker.postMessage({port: channel.port2}, [channel.port2]);
+          return Promise.all([saw_message, saw_controllerchanged]);
+        })
+      .then(function() {
+          frame.remove();
+        });
+  }, 'Test skipWaiting when a installed worker is waiting');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html
new file mode 100644
index 000000000000..412ee2a4438e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting using registration</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting-using-registration';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/skip-waiting-worker.js';
+    var frame, frame_sw, sw_registration, oncontrollerchanged;
+    var saw_controllerchanged = new Promise(function(resolve) {
+        oncontrollerchanged = function(e) {
+            resolve(e);
+          };
+        })
+      .then(function(e) {
+          assert_equals(e.type, 'controllerchange',
+                        'Event name should be "controllerchange"');
+          assert_true(
+              e.target instanceof frame.contentWindow.ServiceWorkerContainer,
+              'Event target should be a ServiceWorkerContainer');
+          assert_equals(e.target.controller.state, 'activating',
+                        'Controller state should be activating');
+          assert_equals(
+              frame_sw.controller.scriptURL, normalizeURL(url2),
+              'Controller scriptURL should change to the second one');
+        });
+
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame = f;
+          frame_sw = f.contentWindow.navigator.serviceWorker;
+          assert_equals(
+              frame_sw.controller.scriptURL, normalizeURL(url1),
+              'Document controller scriptURL should equal to the first one');
+          frame_sw.oncontrollerchange = t.step_func(oncontrollerchanged);
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(registration) {
+          sw_registration = registration;
+          t.add_cleanup(function() {
+              return registration.unregister();
+            });
+          return saw_controllerchanged;
+        })
+      .then(function() {
+          assert_not_equals(sw_registration.active, null,
+                            'Registration active worker should not be null');
+          return fetch_tests_from_worker(sw_registration.active);
+        });
+  }, 'Test skipWaiting while a client is using the registration');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-client.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-client.https.html
new file mode 100644
index 000000000000..62060a82472f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-client.https.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting without client</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+service_worker_test(
+    'resources/skip-waiting-worker.js',
+    'Test single skipWaiting() when no client attached');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-using-registration.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-using-registration.https.html
new file mode 100644
index 000000000000..ced64e5f67fb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting-without-using-registration.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting without using registration</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting-without-using-registration';
+    var url = 'resources/skip-waiting-worker.js';
+    var frame_sw, sw_registration;
+
+    return service_worker_unregister(t, scope)
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          frame_sw = f.contentWindow.navigator.serviceWorker;
+          assert_equals(frame_sw.controller, null,
+                        'Document controller should be null');
+          return navigator.serviceWorker.register(url, {scope: scope});
+        })
+      .then(function(registration) {
+          sw_registration = registration;
+          t.add_cleanup(function() {
+              return registration.unregister();
+            });
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(frame_sw.controller, null,
+                        'Document controller should still be null');
+          assert_not_equals(sw_registration.active, null,
+                            'Registration active worker should not be null');
+          return fetch_tests_from_worker(sw_registration.active);
+        });
+  }, 'Test skipWaiting while a client is not being controlled');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/skip-waiting.https.html b/test/fixtures/wpt/service-workers/service-worker/skip-waiting.https.html
new file mode 100644
index 000000000000..f8392fc955b4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/skip-waiting.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Skip waiting</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+promise_test(function(t) {
+    var scope = 'resources/blank.html?skip-waiting';
+    var url1 = 'resources/empty.js';
+    var url2 = 'resources/empty-worker.js';
+    var url3 = 'resources/skip-waiting-worker.js';
+    var sw_registration, activated_worker, waiting_worker;
+    return service_worker_unregister_and_register(t, url1, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          sw_registration = registration;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          t.add_cleanup(function() {
+              f.remove();
+            });
+          return navigator.serviceWorker.register(url2, {scope: scope});
+        })
+      .then(function(registration) {
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          activated_worker = sw_registration.active;
+          waiting_worker = sw_registration.waiting;
+          assert_equals(activated_worker.scriptURL, normalizeURL(url1),
+                        'Worker with url1 should be activated');
+          assert_equals(waiting_worker.scriptURL, normalizeURL(url2),
+                        'Worker with url2 should be waiting');
+          return navigator.serviceWorker.register(url3, {scope: scope});
+        })
+      .then(function(registration) {
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          assert_equals(activated_worker.state, 'redundant',
+                        'Worker with url1 should be redundant');
+          assert_equals(waiting_worker.state, 'redundant',
+                        'Worker with url2 should be redundant');
+          assert_equals(sw_registration.active.scriptURL, normalizeURL(url3),
+                        'Worker with url3 should be activated');
+        });
+  }, 'Test skipWaiting with both active and waiting workers');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/soft-update-fetch-metadata.https.html b/test/fixtures/wpt/service-workers/service-worker/soft-update-fetch-metadata.https.html
new file mode 100644
index 000000000000..45bf61701c38
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/soft-update-fetch-metadata.https.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>Test that soft update script fetches send the same Fetch Metadata headers as the initial fetches</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/';
+
+async function register_worker(t, scriptURL, options) {
+  await service_worker_unregister(t, scope);
+  const registration = await navigator.serviceWorker.register(scriptURL, options);
+  t.add_cleanup(() => registration.unregister());
+  await wait_for_state(t, registration.installing, 'activated');
+  return registration;
+}
+
+async function trigger_soft_update_and_get_records(recordsURL, expectedRecordCount) {
+  const frame = await with_iframe(scope + 'blank.html');
+  frame.remove();
+
+  let records = [];
+  let counter = 0;
+  do {
+    await new Promise(resolve => step_timeout(resolve, 50));
+    records = await (await fetch(recordsURL)).json();
+  } while (records.length < expectedRecordCount && ++counter < 100);
+
+  return records;
+}
+
+function assert_records(records, expectedRecordCount, expectedRecord, description) {
+  // We expect records[0] to be the registration triggered load and records[1] to be the soft update load.
+  assert_greater_than_equal(records.length, expectedRecordCount,
+                            `${description}, got ${JSON.stringify(records)}`);
+  for (let index = 0; index < records.length; ++index)
+    assert_object_equals(records[index], expectedRecord, `${description}, request #${index}`);
+}
+
+promise_test(async (t) => {
+  const scriptURL = `${scope}soft-update-fetch-metadata.py?token=${token()}&kind=classic`;
+  await register_worker(t, scriptURL);
+
+  const records = await trigger_soft_update_and_get_records(`${scriptURL}&get_records`, 2);
+  assert_records(records, 2, {
+    'service-worker': 'script',
+    'sec-fetch-dest': 'serviceworker',
+    'sec-fetch-mode': 'same-origin',
+    'sec-fetch-site': 'same-origin',
+    'url': new URL(scriptURL, window.location).toString(),
+  }, 'expected one install and one update check request for the main script');
+}, 'headers of the main script');
+
+promise_test(async (t) => {
+  const importToken = token();
+  const scriptURL = `${scope}soft-update-fetch-metadata.py?token=${token()}&kind=classic-with-import&importtoken=${importToken}`;
+  const importedScriptURL = `${scope}soft-update-fetch-metadata.py?token=${importToken}&kind=imported`;
+  await register_worker(t, scriptURL);
+
+  const records = await trigger_soft_update_and_get_records(`${importedScriptURL}&get_records`, 2);
+  assert_records(records, 2, {
+    'service-worker': null,
+    'sec-fetch-dest': 'script',
+    'sec-fetch-mode': 'no-cors',
+    'sec-fetch-site': 'same-origin',
+    'url': new URL(importedScriptURL, window.location).toString(),
+  }, 'expected one install and one update check request for the imported script');
+}, 'headers of a script imported by a classic script');
+
+promise_test(async (t) => {
+  const importToken = token();
+  const scriptURL = `${scope}soft-update-fetch-metadata.py?token=${token()}&kind=module-with-import&importtoken=${importToken}`;
+  const importedScriptURL = `${scope}soft-update-fetch-metadata.py?token=${importToken}&kind=imported`;
+  await register_worker(t, scriptURL, { type: 'module' });
+
+  const records = await trigger_soft_update_and_get_records(`${importedScriptURL}&get_records`, 2);
+  assert_records(records, 2, {
+    'url': window.location + importedScriptURL,
+    'service-worker': null,
+    'sec-fetch-dest': 'serviceworker',
+    'sec-fetch-mode': 'cors',
+    'sec-fetch-site': 'same-origin',
+    'url': new URL(importedScriptURL, window.location).toString(),
+  }, 'expected one install and one update check request for the imported module script');
+}, 'headers of a script imported by a module script');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/srcdoc-iframe.https.html b/test/fixtures/wpt/service-workers/service-worker/srcdoc-iframe.https.html
new file mode 100644
index 000000000000..9c1c88e15a8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/srcdoc-iframe.https.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<title>Service Worker: srcdoc frame handling</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// This test attempts to verify various service worker behaviors in
+// srcdoc iframe.
+
+function runTestInSrcDocFrame(testFunc, testFuncParam) {
+  return new Promise((resolve, reject) => {
+    window.addEventListener('message', function onMsg(evt) {
+      if (evt.data.type !== 'TEST_RESULT') {
+        return;
+      }
+      window.removeEventListener('message', onMsg);
+      resolve(evt.data.result);
+    });
+    testFunc(testFuncParam);
+  });
+}
+
+async function doAsyncTest(t, testFuncName, expectedResult) {
+  const worker = 'resources/srcdoc-iframe-worker.js';
+  const scope = 'resources/srcdoc-iframe.html';
+
+  let reg = await service_worker_unregister_and_register(t, worker, scope);
+
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let frame = await with_iframe(scope);
+  let scopeFullUlr = frame.contentWindow.location.href;
+
+  let testFunc = frame.contentWindow.srcdocFrame()[testFuncName];
+  let testResult = await runTestInSrcDocFrame(testFunc, scopeFullUlr);
+  assert_equals(testResult, expectedResult);
+
+  frame.remove();
+}
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'addSandboxedSrcdocFrame', 'NoController');
+}, 'nested sandboxed srcdoc frame should not inherit controller');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'addSameOriginSandboxedSrcdocFrame', 'HasController');
+}, 'nested same origin sandboxed srcdoc frame should inherit controller');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'fetchResource', 'passed');
+}, 'should be able to serve resource from controller for srcdoc frame');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'getServiceWorkerRegistration', 'passed');
+}, 'getRegistration should work in srcdoc iframe');
+
+promise_test(async function(t) {
+  await doAsyncTest(t, 'postMessageToController', 'passed');
+}, 'controller.postMessage should work in srcdoc iframe');
+
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/service-workers/service-worker/state.https.html b/test/fixtures/wpt/service-workers/service-worker/state.https.html
new file mode 100644
index 000000000000..7358e58ff14a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/state.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(function (t) {
+    var currentState = 'test-is-starting';
+    var scope = 'resources/state/';
+
+    return service_worker_unregister_and_register(
+        t, 'resources/empty-worker.js', scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          var sw = registration.installing;
+
+          assert_equals(sw.state, 'installing',
+                        'the service worker should be in "installing" state.');
+          checkStateTransition(sw.state);
+          return onStateChange(sw);
+        });
+
+    function checkStateTransition(newState) {
+        switch (currentState) {
+        case 'test-is-starting':
+            break; // anything goes
+        case 'installing':
+            assert_in_array(newState, ['installed', 'redundant']);
+            break;
+        case 'installed':
+            assert_in_array(newState, ['activating', 'redundant']);
+            break;
+        case 'activating':
+            assert_in_array(newState, ['activated', 'redundant']);
+            break;
+        case 'activated':
+            assert_equals(newState, 'redundant');
+            break;
+        case 'redundant':
+            assert_unreached('a ServiceWorker should not transition out of ' +
+                             'the "redundant" state');
+            break;
+        default:
+            assert_unreached('should not transition into unknown state "' +
+                             newState + '"');
+            break;
+        }
+        currentState = newState;
+    }
+
+    function onStateChange(expectedTarget) {
+      return new Promise(function(resolve) {
+            expectedTarget.addEventListener('statechange', resolve);
+          }).then(function(event) {
+            assert_true(event.target instanceof ServiceWorker,
+                        'the target of the statechange event should be a ' +
+                        'ServiceWorker.');
+            assert_equals(event.target, expectedTarget,
+                          'the target of the statechange event should be ' +
+                          'the installing ServiceWorker');
+            assert_equals(event.type, 'statechange',
+                          'the type of the event should be "statechange".');
+
+            checkStateTransition(event.target.state);
+
+            if (event.target.state != 'activated')
+                return onStateChange(expectedTarget);
+          });
+    }
+}, 'Service Worker state property and "statechange" event');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-cross-origin-navigation.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-cross-origin-navigation.https.html
new file mode 100644
index 000000000000..0413bccfbd8e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-cross-origin-navigation.https.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Static Router: Cross-origin navigation via cache source</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+const host_info = get_host_info();
+const path = new URL(".", window.location).pathname;
+const remote_origin = host_info.HTTPS_REMOTE_ORIGIN;
+
+// Use the rule that matches all requests and serves from cache.
+const ROUTER_KEY = 'condition-urlpattern-constructed-match-all-source-cache';
+const helper_url = `${remote_origin}${path}resources/register-static-router-iframe.html?key=${ROUTER_KEY}`;
+const target_url = `${remote_origin}${path}resources/cache.html`;
+
+promise_test(async t => {
+  // 1. Register SW on remote origin.
+  const remote_iframe = document.createElement('iframe');
+  t.add_cleanup(() => remote_iframe.remove());
+
+  const registered_promise = new Promise((resolve, reject) => {
+    window.addEventListener('message', e => {
+      if (e.data.type === 'registered') {
+        resolve();
+      } else if (e.data.type === 'error') {
+        reject(new Error(e.data.error));
+      }
+    });
+  });
+
+  remote_iframe.src = helper_url;
+  document.body.appendChild(remote_iframe);
+  await registered_promise;
+
+  // 2. Create same-origin iframe to initiate navigation.
+  const local_iframe = document.createElement('iframe');
+  t.add_cleanup(() => local_iframe.remove());
+  local_iframe.srcdoc = '<html><body></body></html>';
+  document.body.appendChild(local_iframe);
+
+  // Wait for srcdoc to load.
+  await new Promise(resolve => {
+    local_iframe.onload = resolve;
+  });
+
+  // 3. Click link inside local iframe to go to remote origin.
+  const link = local_iframe.contentDocument.createElement('a');
+  link.href = target_url;
+  link.innerText = 'Click me';
+  local_iframe.contentDocument.body.appendChild(link);
+
+  // Wait for the message from the cached response.
+  const cached_promise = new Promise(resolve => {
+    window.addEventListener('message', function handler(e) {
+      if (e.data.type === 'loaded_from_cache') {
+        window.removeEventListener('message', handler);
+        resolve();
+      }
+    });
+  });
+
+  link.click();
+  await cached_promise;
+
+  assert_true(true, "Navigation completed and loaded from cache");
+}, 'Cross-origin navigation with static router cache rule');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-fetch-event.https.html
new file mode 100644
index 000000000000..167e3af00909
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-fetch-event.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the fetch-event source.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY = 'condition-urlpattern-string-source-fetch-event';
+const REGISTERED_ROUTE = 'resources/simple.html';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY);
+  const rnd = randomString();
+  const iframe = await createIframe(t, `${REGISTERED_ROUTE}?nonce=${rnd}`);
+  const {errors, requests} = await get_info_from_worker(worker);
+
+  assert_equals(errors.length, 0);
+  assert_equals(requests.length, 1);
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+}, 'Main resource matched the rule with fetch-event source');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_KEY, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch(`?nonce=${rnd}`);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests} = await get_info_from_worker(worker);
+  // Main resource request + subreosurce request = 2.
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule fetch-event source');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-invalid-rules.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-invalid-rules.https.html
new file mode 100644
index 000000000000..958d74374d8c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-invalid-rules.https.html
@@ -0,0 +1,93 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: registration of invalid rules should raise.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+
+const ROUTER_RULE_KEY_INVALID_BYTESTRING_REQUEST_METHOD =
+    'condition-invalid-bytestring-request-method';
+const ROUTER_RULE_KEY_INVALID_HTTP_REQUEST_METHOD =
+    'condition-invalid-http-request-method';
+const ROUTER_RULE_KEY_FORBIDDEN_REQUEST_METHOD =
+    'condition-invalid-forbidden-method';
+const ROUTER_RULE_KEY_INVALID_REQUEST_METHOD =
+    'condition-invalid-request-method';
+const ROUTER_RULE_KEY_INVALID_OR_CONDITION_DEPTH =
+    'condition-invalid-or-condition-depth';
+const ROUTER_RULE_KEY_INVALID_NOT_CONDITION_DEPTH =
+    'condition-invalid-not-condition-depth';
+const ROUTER_RULE_KEY_INVALID_ROUTER_SIZE =
+    'condition-invalid-router-size';
+const ROUTER_RULE_KEY_LACK_OF_CONDITION =
+    'condition-lack-of-condition';
+const ROUTER_RULE_KEY_LACK_OF_SOURCE =
+    'condition-lack-of-source';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_BYTESTRING_REQUEST_METHOD);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise for invalid ByteString request method.');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_HTTP_REQUEST_METHOD);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise for invalid HTTP request method.');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_FORBIDDEN_REQUEST_METHOD);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise for forbidden request method.');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_OR_CONDITION_DEPTH);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if or condition exceeds the depth limit');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_NOT_CONDITION_DEPTH);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if not condition exceeds the depth limit');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_INVALID_ROUTER_SIZE);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the number of router rules exceeds the length limit');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_LACK_OF_CONDITION);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the conditon does not exist in the rule');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_LACK_OF_SOURCE);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the source does not exiswt in the rule');
+
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-main-resource.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-main-resource.https.html
new file mode 100644
index 000000000000..71bc0697f9c0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-main-resource.https.html
@@ -0,0 +1,93 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: simply skip fetch handler for main resource if pattern matches
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/static-router-helpers.sub.js"></script>
+<body>
+<script>
+const ROUTER_RULE_KEY = 'condition-urlpattern-constructed-source-network';
+const ROUTER_RULE_NOT_KEY = 'condition-urlpattern-not-source-network';
+const ROUTER_RULE_KEY_IGNORE_CASE =
+  'condition-urlpattern-constructed-ignore-case-source-network';
+const ROUTER_RULE_KEY_RESPECT_CASE =
+  'condition-urlpattern-constructed-respect-case-source-network';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE =
+  'condition-urlpattern-string-source-cache';
+const ROUTER_RULE_KEY_REQUEST_CACHE = 'condition-request-navigate-source-cache';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME =
+  'condition-urlpattern-string-source-cache-with-name';
+const REGISTERED_ROUTE = 'resources/direct.txt';
+const CACHED_ROUTE = 'resources/cache.txt';
+const NON_REGISTERED_ROUTE = 'resources/simple.html';
+const NOT_ROUTE = 'resources/not.txt';
+const host_info = get_host_info();
+const path = new URL(".", window.location).pathname;
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+}, 'Main resource load matched with the condition');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY_IGNORE_CASE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+}, 'Main resource load matched with the ignore case condition');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY_RESPECT_CASE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+}, 'Main resource load matched without the ignore case condition');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(
+    requests[0].url,
+    `${host_info['HTTPS_ORIGIN']}${path}${NON_REGISTERED_ROUTE}`);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Main resource load not matched with the condition');
+
+iframeTest(CACHED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "From cache");
+}, 'Main resource load matched with the cache source');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_REQUEST_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  // When the request matched to the rule with the "cache" source but failed to
+  // get the cache entry, the fetch handler is not involved and the network
+  // fallback is triggered instead.
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Here's a simple html file.");
+}, 'Main resource fallback to the network when there is no cache entry');
+
+iframeTest(CACHED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "From cache");
+}, 'Main resource load matched with the cache source, with specifying the cache name');
+
+iframeTest(NOT_ROUTE, ROUTER_RULE_NOT_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(
+    requests[0].url,
+    `${host_info['HTTPS_ORIGIN']}${path}${NOT_ROUTE}`);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Main resource load should not match the condition with not');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_NOT_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+}, 'Main resource load should match the condition without not');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-multiple-router-registrations.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-multiple-router-registrations.https.html
new file mode 100644
index 000000000000..dd7ff1e4e9dd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-multiple-router-registrations.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are registered multiple times.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY_MULTIPLE_RULES = 'multiple-router-rules';
+const ROUTER_KEY_1 = 'condition-urlpattern-string-source-network';
+const ROUTER_KEY_2 = 'condition-request-method-post-network';
+
+const REGISTERED_ROUTE_1 = 'resources/direct.txt';
+const REGISTERED_ROUTE_2 = 'resources/direct.html';
+const REGISTERED_ROUTE_3 = 'direct.py';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY_MULTIPLE_RULES);
+
+  // Matched with the first rule.
+  const iframe = await createIframe(t, REGISTERED_ROUTE_1);
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network\n");
+
+  // Matched with the second rule.
+  const second_iframe = await createIframe(t, REGISTERED_ROUTE_2);
+  assert_equals(second_iframe.contentWindow.document.body.innerText, "Here's a direct html from network.");
+
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'Main reosurce load matched with the service worker having multiple rules');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t,
+    `${ROUTER_KEY_1}&imported-sw-router-key=${ROUTER_KEY_2}`);
+
+  // Matched with the first rule.
+  const iframe = await createIframe(t, REGISTERED_ROUTE_1);
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network\n");
+  let info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 0);
+
+  // Matched with the second rule, which is registered in the service worker
+  // loaded via `import` by the main script.
+  const response = await iframe.contentWindow.fetch(REGISTERED_ROUTE_3, {method: 'POST'});
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "Network with POST request");
+  info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 0);
+}, 'Resource load matched with the rule registered in the imported service worker');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-mutiple-conditions.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-mutiple-conditions.https.html
new file mode 100644
index 000000000000..3d69411843c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-mutiple-conditions.https.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request method condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY = 'multiple-conditions-network';
+const ROUTER_KEY_WITH_DESTINATION =
+  'multiple-conditions-with-destination-network';
+const HTML_FILE = 'resources/simple.html';
+const REQUEST_SRC = 'resources/direct.py';
+
+const is_matched = async (worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  return requests.length == 0;
+}
+
+const appendCSS = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const link = iwin.document.createElement('link');
+    link.rel = 'stylesheet';
+    link.href = src;
+    iwin.document.head.appendChild(link);
+    link.onload = () => {
+      resolve(link);
+    };
+  });
+
+  return promise;
+};
+
+const appendScript = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const script = iwin.document.createElement('script');
+    script.src = src;
+    iwin.document.body.appendChild(script);
+    script.onload = () => {
+      resolve(script);
+    };
+  });
+
+  return promise;
+};
+
+iframeTest(HTML_FILE, ROUTER_KEY, async (t, iwin, worker) => {
+  // Reset the fetch count created by the setup process.
+  await reset_info_in_worker(worker);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+
+  // Expected condtion:
+  //  - urlPattern: { search: 'test' }
+  //  - mode: 'cors'
+  //  - method: POST
+
+  // Expect match.
+  let response = await iwin.fetch(`../${REQUEST_SRC}?test`, {mode: 'cors', method: 'post'});
+  assert_equals(response.status, 200);
+  assert_true(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // mode: 'no-cors' won't match.
+  response = await iwin.fetch(`../${REQUEST_SRC}?test`, {mode: 'no-cors', method: 'post'});
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // method: GET won't match.
+  response = await iwin.fetch(`../${REQUEST_SRC}?test`, {mode: 'cors', method: 'get'});
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // No seqarch query won't match.
+  response = await iwin.fetch(`../${REQUEST_SRC}`, {mode: 'cors', method: 'post'});
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+}, 'Multiple conditions work with `and` operation');
+
+iframeTest(HTML_FILE, ROUTER_KEY_WITH_DESTINATION, async (t, iwin, worker) => {
+  // Reset the fetch count created by the setup process.
+  await reset_info_in_worker(worker);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+
+  // Expected condtion:
+  //  - urlPattern: { search: 'test' }
+  //  - destination: style
+
+  // Expect match.
+  await appendCSS(iwin, `../${REQUEST_SRC}?test`);
+  assert_true(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // Other request destination won't match.
+  await appendScript(iwin, `../${REQUEST_SRC}?test`);
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+
+  // No seqarch query won't match.
+  await appendCSS(iwin, `../${REQUEST_SRC}`);
+  assert_false(await is_matched(worker));
+  await reset_info_in_worker(worker);
+}, 'Multiple conditions including requestDestination work with `and` operation');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-no-fetch-handler.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-no-fetch-handler.https.html
new file mode 100644
index 000000000000..4dbbbe69c7df
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-no-fetch-handler.https.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated when there is no fetch handler.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const RULE_KEY_SOURCE_CACHE = 'condition-urlpattern-string-source-cache';
+const RULE_KEY_SOURCE_FETCH_EVENT =
+    'condition-request-source-fetch-event';
+const RULE_KEY_SOURCE_RACE_NETWORK_AND_FETCH_HANDLER =
+    'condition-urlpattern-string-source-race-network-and-fetch-handler';
+const SW_SRC = 'resources/static-router-no-fetch-handler-sw.js';
+const CACHED_FILE = 'cache.txt';
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, RULE_KEY_SOURCE_CACHE, SW_SRC);
+
+  // Matched with the main reosurce load.
+  const {contentWindow} = await createIframe(t, `resources/${CACHED_FILE}`);
+  assert_equals(contentWindow.document.body.innerText, "From cache");
+
+  // Matched with the subreosurce load.
+  const response = await contentWindow.fetch(CACHED_FILE);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "From cache");
+
+  // Both requests are served from cache.
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'The router rule is evaluated without fetch handlers in service worker');
+
+promise_test(async t => {
+  const worker =
+      await registerAndActivate(t, RULE_KEY_SOURCE_FETCH_EVENT, SW_SRC);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the fetch-event source is used without onfetch')
+
+promise_test(async t => {
+  const worker =
+      await registerAndActivate(t,
+          RULE_KEY_SOURCE_RACE_NETWORK_AND_FETCH_HANDLER, SW_SRC);
+  t.add_cleanup(() => {reset_info_in_worker(worker)});
+
+  const {errors} = await get_info_from_worker(worker);
+  assert_equals(errors.length, 1);
+}, 'addRoutes should raise if the race-network-and-fetch-handler source is used without onfetch')
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-race-network-and-fetch-handler.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-race-network-and-fetch-handler.https.html
new file mode 100644
index 000000000000..6bc2fff1d874
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-race-network-and-fetch-handler.https.html
@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request desitnation condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY = 'condition-urlpattern-string-source-race-network-and-fetch-handler';
+const SW_SRC = 'resources/static-router-race-network-and-fetch-handler-sw.js';
+const FRAME_SRC = 'resources/direct.py';
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&server_slow`);
+  // Expect the response from the fetch handler.
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&sw_slow`);
+  // Expect the response from the netowrk request.
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&server_slow&call_fetch`);
+  // Expect the response from the fetch handler.
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response while fetch() is triggered inside the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, `${FRAME_SRC}?nonce=${rnd}&sw_slow&call_fetch`);
+  // Expect the response from the netowrk request.
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests, errors}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(errors.length, 0);
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler while fetch() is triggered inside the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  // Expect the response from the fetch handler.
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&server_slow`);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  // Expect the response from the network request.
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&sw_slow`);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  // Expect the response from the network request.
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&sw_slow&server_no_content`);
+  assert_equals(response.status, 204);
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse with 204 response is faster than the fetch handler');
+
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, ROUTER_KEY, SW_SRC);
+  const iframe = await createIframe(t, FRAME_SRC);
+  const response = await iframe.contentWindow.fetch(`?nonce=${rnd}&sw_slow&server_not_found`);
+  // Expect the response from the network request was faster, but the result was 404.
+  // So, the fetch handler result will be used instead.
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler, but not found');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-request-destination.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-request-destination.https.html
new file mode 100644
index 000000000000..55ad6da31aad
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-request-destination.https.html
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request desitnation condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY_DESTINATION_SCRIPT = 'condition-request-destination-script-network';
+const FRAME_SRC = 'resources/direct.html';
+const SCRIPT_SRC = 'direct.js';
+const STYLE_SRC = 'direct.txt';
+
+const appendScript = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const script = iwin.document.createElement('script');
+    script.src = src;
+    iwin.document.body.appendChild(script);
+    script.onload = () => {
+      resolve(script);
+    };
+  });
+
+  return promise;
+};
+
+const appendCSS = async (iwin, src) => {
+  const promise = new Promise(resolve => {
+    const link = iwin.document.createElement('link');
+    link.rel = 'stylesheet';
+    link.href = src;
+    iwin.document.head.appendChild(link);
+    link.onload = () => {
+      resolve(link);
+    };
+  });
+
+  return promise;
+};
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY_DESTINATION_SCRIPT);
+  const iframe = await createIframe(t, FRAME_SRC);
+
+  let info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 1);
+  assert_equals(info.requests[0].destination, 'iframe');
+
+  // JavaScript is not handled by fetch handler.
+  await appendScript(iframe.contentWindow, SCRIPT_SRC);
+  assert_equals(iframe.contentWindow.router_condition_request_destination_script, true);
+  info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 1);
+}, 'Subreosurce load matched with the requestMethod script condition');
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_KEY_DESTINATION_SCRIPT);
+  const iframe = await createIframe(t, FRAME_SRC);
+
+  let info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 1);
+  assert_equals(info.requests[0].destination, 'iframe');
+
+  // Stylesheet is not handled by fetch handler.
+  await appendCSS(iframe.contentWindow, STYLE_SRC);
+  info = await get_info_from_worker(worker);
+  assert_equals(info.requests.length, 2);
+  assert_equals(info.requests[1].destination, 'style');
+}, 'Subreosurce load not matched with the requestMethod script condition');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-request-method.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-request-method.https.html
new file mode 100644
index 000000000000..8e219532a3e6
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-request-method.https.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: routers are evaluated with the request method condition.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js">
+</script>
+<script src="resources/static-router-helpers.sub.js">
+</script>
+<body>
+<script>
+const ROUTER_KEY_MEHOD_GET = 'condition-request-method-get-network';
+const ROUTER_KEY_MEHOD_POST = 'condition-request-method-post-network';
+const ROUTER_KEY_MEHOD_PUT = 'condition-request-method-put-network';
+const ROUTER_KEY_MEHOD_DELETE = 'condition-request-method-delete-network';
+const REQUET_SRC = 'resources/direct.py';
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_GET, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network with GET request");
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'Subresource load matched with the requestMethod GET condition');
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_POST, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, {method: 'POST'});
+  assert_equals(await response.text(), "Network with POST request");
+  const {requests} = await get_info_from_worker(worker);
+  // The navigation request is the only request handled by fetch handler.
+  assert_equals(requests.length, 1);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Subresource load matched with the requestMethod POST condition');
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_PUT, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, {method: 'PUT'});
+  assert_equals(await response.text(), "Network with PUT request");
+  const {requests} = await get_info_from_worker(worker);
+  // The navigation request is the only request handled by fetch handler.
+  assert_equals(requests.length, 1);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Subresource load matched with the requestMethod PUT condition');
+
+iframeTest(REQUET_SRC, ROUTER_KEY_MEHOD_DELETE, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, {method: 'DELETE'});
+  assert_equals(await response.text(), "Network with DELETE request");
+  const {requests} = await get_info_from_worker(worker);
+  // The navigation request is the only request handled by fetch handler.
+  assert_equals(requests.length, 1);
+  assert_equals(requests[0].mode, 'navigate');
+}, 'Subresource load matched with the requestMethod DELETE condition');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/static-router-subresource.https.html b/test/fixtures/wpt/service-workers/service-worker/static-router-subresource.https.html
new file mode 100644
index 000000000000..ab05a3d25282
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/static-router-subresource.https.html
@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Static Router: simply skip fetch handler if pattern matches</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/static-router-helpers.sub.js"></script>
+<body>
+<script>
+const SCRIPT = 'resources/static-router-sw.js';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED =
+  'condition-urlpattern-constructed-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_IGNORE_CASE =
+  'condition-urlpattern-constructed-ignore-case-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_RESPECT_CASE =
+  'condition-urlpattern-constructed-respect-case-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_URLPATTERNCOMPATIBLE =
+  'condition-urlpattern-urlpatterncompatible-source-network';
+const ROUTER_RULE_KEY_URL_PATTERN_STRING =
+  'condition-urlpattern-string-source-network';
+const ROUTER_RULE_KEY_REQUEST = 'condition-request-source-network'
+const ROUTER_RULE_KEY_URL_PATTERN_STRING_CACHE =
+  'condition-urlpattern-string-source-cache';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE =
+  'condition-urlpattern-constructed-match-all-source-cache';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME =
+  'condition-urlpattern-string-source-cache-with-name';
+const ROUTER_RULE_KEY_OR = 'condition-or-source-network'
+const ROUTER_RULE_KEY_NOT = 'condition-urlpattern-not-source-network';
+const SCOPE = 'resources/';
+const HTML_FILE = 'resources/simple.html';
+const TXT_FILE = 'resources/direct.txt';
+const CSV_FILE = 'resources/simple.csv';
+const NOT_FILE = 'resources/not.txt';
+// Warning: please prepare the corresponding `*.text.headers` files, otherwise
+// iframeTest() fails to load the following files due to MIME mismatches.
+const OR_TEST_FILES = [
+  'resources/or-test/direct1.text',
+  'resources/or-test/direct2.text',
+  'resources/or-test/does-not-exist.text',
+];
+
+iframeTest(HTML_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load not matched with URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED, async (t, iwin, worker) => {
+  const rnd = randomString();
+  // Confirm that the given URLPatternCompatible has a wildcard pattern for the
+  // hostname. Also, if |urlPattern| is a consutructed URLPattern object,
+  // baseURL won't be set while adding router rules, thus it matches the cross
+  // origin request as far as other components matches. So expecting the direct
+  // network request and the fetch handler doesn't capture the response.
+  // The response is going to be a opaque.
+  const origin = get_host_info().HTTPS_REMOTE_ORIGIN;
+  const response = await iwin.fetch(
+    `${origin}/${TXT_FILE}?nonce=${rnd}`, {mode: 'no-cors'});
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(response.type, 'opaque');
+}, 'Subresource cross origin load matched with URLPattern condition via constructed object');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_IGNORE_CASE, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with ignoreCase URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_RESPECT_CASE, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load matched without ignoreCase URLPattern condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_URLPATTERNCOMPATIBLE, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with URLPattern condition via URLPatternCompatible');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_URLPATTERNCOMPATIBLE, async (t, iwin, worker) => {
+  // The SW script URL is added as a baseURL when |urlPattern| is passed via
+  // URLPatternCompatible, and there is not |baseURL| in it. Cross
+  // origin request will go through the fetch handler because |baseURL| info
+  // complements hostname with the hostname of the SW script.
+  const rnd = randomString();
+  const origin = get_host_info().HTTPS_REMOTE_ORIGIN;
+  const response = await iwin.fetch(`${origin}/${TXT_FILE}?nonce=${rnd}`);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource cross origin load not matched with URLPattern condition via URLPatternCompatible');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_STRING, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with URLPattern condition via string');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_STRING, async (t, iwin, worker) => {
+  // The SW script URL is added as a baseURL when |urlPattern| is passed via
+  // string, and there is not |baseURL| in it. Cross origin request will go
+  // through the fetch handler because |baseURL| info complements hostname with
+  // the hostname of the SW script.
+  const rnd = randomString();
+  const origin = get_host_info().HTTPS_REMOTE_ORIGIN;
+  const response = await iwin.fetch(`${origin}/${TXT_FILE}?nonce=${rnd}`);
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource cross origin load not matched with URLPattern condition via string');
+
+iframeTest(CSV_FILE, ROUTER_RULE_KEY_REQUEST, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd, { mode: 'no-cors' });
+  assert_equals(await response.text(), "matched,with,non-url,conditions\n");
+}, 'Subresource load matched with RequestMode condition');
+
+iframeTest(OR_TEST_FILES[0], ROUTER_RULE_KEY_OR, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with the nested `or` condition');
+
+iframeTest(OR_TEST_FILES[1], ROUTER_RULE_KEY_OR, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load matched with the next `or` condition');
+
+iframeTest(OR_TEST_FILES[2], ROUTER_RULE_KEY_OR, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load not matched with `or` condition');
+
+iframeTest(HTML_FILE, ROUTER_RULE_KEY_URL_PATTERN_STRING_CACHE, async (t, iwin) => {
+  // No need to set `resources/` because the request is dispatched from iframe.
+  const CACHED_FILE = 'cache.txt';
+  const response = await iwin.fetch(CACHED_FILE);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "From cache");
+
+  // This doesn't match because the cache key is wrong.
+  const rnd = randomString();
+  const response_with_param = await iwin.fetch(`${CACHED_FILE}?nonce=${rnd}`);
+  assert_equals(response_with_param.status, 404);
+}, 'Subresource load matched with the cache source rule');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE, async (t, iwin, worker) => {
+  // Send a request, which is not stored in the cache, but it exists over the network.
+  const rnd = randomString();
+  let response = await iwin.fetch(`?nonce=${rnd}`);
+  assert_equals(await response.text(), "Network\n");
+  assert_equals(response.status, 200);
+
+  // Send a request, which is not stored in the cache, and does not exist over the network.
+  const NON_EXISTING_FILE = 'not-found.txt';
+  response = await iwin.fetch(`${NON_EXISTING_FILE}?nonce=${randomString()}`);
+  assert_equals(response.status, 404);
+
+  // Both requests are not handled by ServiceWorker.
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+}, 'Subresource load did not match with the cache and fallback to the network');
+
+iframeTest(HTML_FILE, ROUTER_RULE_KEY_URLPATTERN_CACHE_WITH_NAME, async (t, iwin, worker) => {
+  // No need to set `resources/` because the request is dispatched from iframe.
+  const CACHED_FILE = 'cache.txt';
+  const response = await iwin.fetch(CACHED_FILE);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "From cache");
+
+  // This doesn't match because the cache key is wrong.
+  const rnd = randomString();
+  const response_with_param = await iwin.fetch(`${CACHED_FILE}?nonce=${rnd}`);
+  assert_equals(response_with_param.status, 404);
+}, 'Subresource load matched with the cache source, with specifying the cache name');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_NOT, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch(`${NOT_FILE}?nonce=${rnd}`);
+  assert_equals(await response.text(), rnd);
+}, 'Subresource load should not match with the not condition');
+
+iframeTest(TXT_FILE, ROUTER_RULE_KEY_NOT, async (t, iwin) => {
+  const rnd = randomString();
+  const response = await iwin.fetch('?nonce=' + rnd);
+  assert_equals(await response.text(), "Network\n");
+}, 'Subresource load should match with a file other than not');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/svg-target-reftest.https.html b/test/fixtures/wpt/service-workers/service-worker/svg-target-reftest.https.html
new file mode 100644
index 000000000000..3710ee61d85f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/svg-target-reftest.https.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<title>Service worker interception does not break SVG fragment targets</title>
+<meta name="assert" content="SVG with link fragment should render correctly when intercepted by a service worker.">
+<script src="resources/test-helpers.sub.js"></script>
+<link rel="match" href="resources/svg-target-reftest-001.html">
+<p>Pass if you see a green box below.</p>
+<script>
+// We want to use utility functions designed for testharness.js where
+// there is a test object.  We don't have a test object in reftests
+// so fake one for now.
+const fake_test = { step_func: f => f };
+
+async function runTest() {
+  const script = './resources/pass-through-worker.js';
+  const scope = './resources/svg-target-reftest-frame.html';
+  let reg = await navigator.serviceWorker.register(script, { scope });
+  await wait_for_state(fake_test, reg.installing, 'activated');
+  let f = await with_iframe(scope);
+  document.documentElement.classList.remove('reftest-wait');
+  await reg.unregister();
+  // Note, we cannot remove the frame explicitly because we can't
+  // tell when the reftest completes.
+}
+runTest();
+</script>
+</html>
diff --git a/test/fixtures/wpt/service-workers/service-worker/synced-state.https.html b/test/fixtures/wpt/service-workers/service-worker/synced-state.https.html
new file mode 100644
index 000000000000..0e9f63a9a2e5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/synced-state.https.html
@@ -0,0 +1,93 @@
+<!doctype html>
+<title>ServiceWorker: worker objects have synced state</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests that ServiceWorker objects representing the same Service Worker
+// entity have the same state. JS-level equality is now required according to
+// the spec.
+'use strict';
+
+function nextChange(worker) {
+  return new Promise(function(resolve, reject) {
+      worker.addEventListener('statechange', function handler(event) {
+          try {
+            worker.removeEventListener('statechange', handler);
+            resolve(event.currentTarget.state);
+          } catch (err) {
+            reject(err);
+          }
+        });
+    });
+}
+
+promise_test(function(t) {
+    var scope = 'resources/synced-state';
+    var script = 'resources/empty-worker.js';
+    var registration, worker;
+
+    return service_worker_unregister_and_register(t, script, scope)
+      .then(function(r) {
+          registration = r;
+          worker = registration.installing;
+
+          t.add_cleanup(function() {
+              return r.unregister();
+            });
+
+          return nextChange(worker);
+        })
+      .then(function(state) {
+          assert_equals(state, 'installed',
+                        'original SW should be installed');
+          assert_equals(registration.installing, null,
+                        'in installed, .installing should be null');
+          assert_equals(registration.waiting, worker,
+                        'in installed, .waiting should be equal to the ' +
+                          'original worker');
+          assert_equals(registration.waiting.state, 'installed',
+                        'in installed, .waiting should be installed');
+          assert_equals(registration.active, null,
+                        'in installed, .active should be null');
+
+          return nextChange(worker);
+        })
+      .then(function(state) {
+          assert_equals(state, 'activating',
+                        'original SW should be activating');
+          assert_equals(registration.installing, null,
+                        'in activating, .installing should be null');
+          assert_equals(registration.waiting, null,
+                        'in activating, .waiting should be null');
+          assert_equals(registration.active, worker,
+                        'in activating, .active should be equal to the ' +
+                          'original worker');
+          assert_equals(
+              registration.active.state, 'activating',
+              'in activating, .active should be activating');
+
+          return nextChange(worker);
+        })
+      .then(function(state) {
+          assert_equals(state, 'activated',
+                        'original SW should be activated');
+          assert_equals(registration.installing, null,
+                        'in activated, .installing should be null');
+          assert_equals(registration.waiting, null,
+                        'in activated, .waiting should be null');
+          assert_equals(registration.active, worker,
+                        'in activated, .active should be equal to the ' +
+                          'original worker');
+          assert_equals(registration.active.state, 'activated',
+                        'in activated .active should be activated');
+        })
+      .then(function() {
+          return navigator.serviceWorker.getRegistration(scope);
+        })
+      .then(function(r) {
+          assert_equals(r, registration, 'getRegistration should return the ' +
+                                         'same object');
+        });
+  }, 'worker objects for the same entity have the same state');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/WEB_FEATURES.yml b/test/fixtures/wpt/service-workers/service-worker/tentative/WEB_FEATURES.yml
new file mode 100644
index 000000000000..5bee18ab21d0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [service-workers]
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-fallback.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-fallback.https.html
new file mode 100644
index 000000000000..34a1674d5cf7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-fallback.https.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>Service Worker: download FetchEvent without respondWith() falls through (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// When the SW observes the download FetchEvent but does NOT call
+// event.respondWith(), the request must fall back to the network. We can't
+// observe the saved file from script, but we can observe that:
+//   (a) the SW saw the fetch event (so the new interception path ran), and
+//   (b) the page itself didn't navigate (so the click was treated as a
+//       download, not as a regular link click).
+
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const channelId = uniqueChannelId();
+  const targetUrl =
+      SCOPE + 'download-target.txt?channel=' + channelId + '&mode=fallback';
+  const messagePromise = nextChannelMessage(t, channelId);
+
+  const urlBefore = location.href;
+  await clickDownloadAnchor(t, targetUrl);
+
+  const data = await messagePromise;
+  assert_equals(data.type, 'fetch',
+      'SW must still observe the fetch event even without respondWith().');
+  assert_equals(data.destination, '');
+  assert_equals(data.mode, 'navigate',
+      'Download FetchEvent mode must be "navigate" (HTML "Downloading hyperlinks").');
+
+  // The page must not navigate as a result of the download click.
+  assert_equals(location.href, urlBefore,
+      'The page must not navigate when <a download> is clicked.');
+}, 'Download FetchEvent without respondWith() falls back without navigating the page.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-out-of-scope.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-out-of-scope.https.html
new file mode 100644
index 000000000000..3a71d85259a0
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-out-of-scope.https.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>Service Worker: download FetchEvent only fires for in-scope URLs (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// A download whose URL falls outside the SW's registration scope must NOT
+// dispatch a FetchEvent on that SW. We register the worker with scope
+// resources/ and then trigger a download against a URL outside that path.
+//
+// Verifying a *negative* (no message) requires a timeout. To avoid spurious
+// failures we first prove the SW is healthy by issuing an in-scope download
+// and observing its FetchEvent on the same channel; only after that do we
+// expect silence for the out-of-scope click.
+
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+const QUIET_TIMEOUT_MS = 500;
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Sanity: in-scope download dispatches a FetchEvent.
+  {
+    const channelId = uniqueChannelId();
+    const inScopeUrl = SCOPE + 'in-scope.txt?channel=' + channelId;
+    const message = nextChannelMessage(t, channelId);
+    await clickDownloadAnchor(t, inScopeUrl);
+    const data = await message;
+    assert_equals(data.type, 'fetch',
+        'In-scope sanity check: SW saw the fetch event.');
+  }
+
+  // Out-of-scope: same origin, but URL not under SCOPE → no FetchEvent.
+  {
+    const channelId = uniqueChannelId();
+    // 'out-of-scope.txt' has no leading 'resources/' segment, so it is not
+    // covered by the worker's scope.
+    const outOfScopeUrl = 'out-of-scope.txt?channel=' + channelId;
+    const sawMessage = awaitChannelSilence(t, channelId, QUIET_TIMEOUT_MS);
+    await clickDownloadAnchor(t, outOfScopeUrl);
+    const received = await sawMessage;
+    assert_false(received,
+        'SW must not receive a FetchEvent for an out-of-scope download URL.');
+  }
+}, 'Download FetchEvent fires only for URLs within the SW registration scope.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-respond-with.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-respond-with.https.html
new file mode 100644
index 000000000000..11c97c5bb05d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download-respond-with.https.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<title>Service Worker: event.respondWith() accepted for download FetchEvent (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// Verifies that a service worker may call event.respondWith() on a download
+// FetchEvent without raising errors. We can't read the saved file's bytes
+// from script (no filesystem access), so we assert the SW-side observable
+// outcome: the fetch event was dispatched, the SW called respondWith, and
+// no error event fired on the SW.
+
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  // Watch for SW errors. Using `error` on the registration's active worker
+  // fires for uncaught exceptions thrown inside the worker, which is what
+  // a misbehaving respondWith() would surface as.
+  let workerError = null;
+  reg.active.addEventListener('error', (e) => { workerError = e; });
+
+  const channelId = uniqueChannelId();
+  // mode=respond is the worker's default; making it explicit for readability.
+  const targetUrl =
+      SCOPE + 'download-target.txt?channel=' + channelId + '&mode=respond';
+  const messagePromise = nextChannelMessage(t, channelId);
+
+  await clickDownloadAnchor(t, targetUrl);
+
+  const data = await messagePromise;
+  assert_equals(data.type, 'fetch',
+      'SW should observe the fetch event before respondWith() resolves.');
+  assert_equals(data.destination, '',
+      'Per HTML "Downloading hyperlinks", the request destination must be "".');
+
+  // Give the microtask that resolves respondWith()'s promise a turn to run,
+  // then ensure no error escaped from the worker.
+  await new Promise((r) => step_timeout(r, 100));
+  assert_equals(workerError, null,
+      'No error event should fire on the worker after respondWith().');
+}, 'event.respondWith() is accepted for a download FetchEvent.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download.https.html
new file mode 100644
index 000000000000..21cd28003e69
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/fetch-event-download.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>Service Worker: FetchEvent fires for &lt;a download&gt; (crbug.com/40410035)</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="../resources/test-helpers.sub.js"></script>
+<script src="../resources/fetch-event-download-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// The SW lives at resources/fetch-event-download-worker.js with scope
+// resources/. The `<a download>` link points into that scope so the SW
+// receives the fetch event.
+const WORKER = 'resources/fetch-event-download-worker.js';
+const SCOPE = 'resources/';
+
+promise_test(async (t) => {
+  const reg = await service_worker_unregister_and_register(t, WORKER, SCOPE);
+  t.add_cleanup(() => reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  const channelId = uniqueChannelId();
+  const targetUrl = SCOPE + 'download-target.txt?channel=' + channelId;
+  const messagePromise = nextChannelMessage(t, channelId);
+
+  await clickDownloadAnchor(t, targetUrl);
+
+  const data = await messagePromise;
+  assert_equals(data.type, 'fetch',
+      'SW should observe a fetch event for the download URL.');
+  assert_equals(new URL(data.url).pathname,
+      new URL(targetUrl, location).pathname,
+      'fetch event URL matches the <a download> target.');
+  assert_equals(data.destination, '',
+      'Per HTML "Downloading hyperlinks", the request destination must be "".');
+  assert_equals(data.mode, 'navigate',
+      'Per HTML "Downloading hyperlinks", the request mode must be "navigate".');
+  assert_equals(data.method, 'GET',
+      'Downloads use GET.');
+}, 'FetchEvent fires for <a download> with destination "".');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/README.md b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/README.md
new file mode 100644
index 000000000000..33e508aba2c4
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/README.md
@@ -0,0 +1,4 @@
+A test suite for the ServiceWorker Static Routing API Resource Timing.
+
+Explainer: https://github.com/WICG/service-worker-static-routing-api/blob/main/resource-timing-api.md
+Resource-Timing Proposal: https://github.com/w3c/resource-timing/issues/389
diff --git a/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/static-router-resource-timing.https.html b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/static-router-resource-timing.https.html
new file mode 100644
index 000000000000..5046c9a4e7c2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/tentative/static-router/static-router-resource-timing.https.html
@@ -0,0 +1,341 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>
+  Static Router: timing information should be shown when used.
+</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
+<script src="/service-workers/service-worker/resources/static-router-helpers.sub.js"></script>
+<body>
+<script>
+const ROUTER_RULE_KEY = 'condition-urlpattern-constructed-source-network';
+const ROUTER_RULE_KEY_URLPATTERN_CACHE =
+  'condition-urlpattern-string-source-cache';
+const ROUTER_RULE_KEY_REQUEST_CACHE = 'condition-request-navigate-source-cache';
+const ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE =
+  'condition-urlpattern-constructed-match-all-source-cache';
+const ROUTER_RULE_KEY_REQUEST_FETCH = 'condition-urlpattern-string-source-fetch-event';
+const REGISTERED_ROUTE = '/service-workers/service-worker/resources/direct.txt';
+const CACHED_ROUTE = '/service-workers/service-worker/resources/cache.txt';
+const NON_REGISTERED_ROUTE = '/service-workers/service-worker/resources/simple.html';
+
+const RACE_ROUTER_KEY =
+  'condition-urlpattern-string-source-race-network-and-fetch-handler';
+const RACE_SW_SRC = '/service-workers/service-worker/resources/static-router-race-network-and-fetch-handler-sw.js';
+const RACE_ROUTE = '/service-workers/service-worker/resources/direct.py';
+
+const host_info = get_host_info();
+
+function resourceUrl(resource) {
+  return `${host_info['HTTPS_ORIGIN']}${resource}`;
+}
+
+// Verify existance of a PerformanceEntry and the order between the timings of
+// ServiceWorker Static routing API.
+//
+// |options| has these properties:
+// performance: Performance interface to verify existance of the entry.
+// url: the URL of resource
+// description: the description passed to each assertion.
+// matched_source: the expected matched source of router evaluation.
+// actual_source: the expected actual source used to get the resource.
+function test_resource_timing(options) {
+  const description = options.description;
+  const entryList = options.performance.getEntriesByName(resourceUrl(options.url));
+  assert_equals(entryList.length, 1, description);
+  const entry = entryList[0];
+
+  // FIXME: Remove workerMatchedSourceType and workerFinalSourceType when moved out of tentative.
+  const workerMatchedRouterSource = "workerMatchedRouterSource" in entry ? entry.workerMatchedRouterSource : entry.workerMatchedSourceType;
+  const workerFinalRouterSource = "workerFinalRouterSource" in entry ? entry.workerFinalRouterSource : entry.workerFinalSourceType;
+
+  assert_equals(workerMatchedRouterSource, options.matched_source_type, description);
+  assert_equals(workerFinalRouterSource, options.final_source_type, description);
+
+  assert_greater_than(entry.workerRouterEvaluationStart, 0, description);
+  switch (entry.matchedSouceType) {
+    case 'network':
+      assert_equals(entry.workerStart, 0, description);
+      assert_equals(entry.workerCacheLookupStart, 0, description);
+      assert_less_than_equal(entry.workerRouterEvaluationStart, entry.fetchStart, description);
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      break;
+    case 'cache':
+      assert_equals(entry.workerStart, 0, description);
+      assert_greater_than_equal(entry.workerCacheLookupStart, entry.workerRouterEvaluationStart, description);
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      if (entry.workerFinalSourceType === 'cache') {
+        assert_equals(entry.fetchStart, entry.responseStart, description);
+        assert_less_than_equal(entry.workerCacheLookupStart, entry.responseStart, description);
+        assert_equals(entry.deliveryType, 'cache-storage', description);
+      } else {
+        assert_less_than_equal(entry.workerCacheLookupStart, entry.fetchStart, description);
+      }
+      break;
+    case 'race-network-and-fetch-handler':
+      assert_equals(entry.workerCacheLookupStart, 0, description);
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      if (entry.workerFinalSourceType === 'network') {
+        assert_equals(entry.workerStart, 0, description);
+        assert_less_than_equal(entry.workerRouterEvaluationStart, entry.fetchStart, description);
+      } else {
+        assert_greater_than_equal(entry.workerStart, entry.workerRouterEvaluationStart, description);
+        assert_greater_than_equal(entry.fetchStart, entry.workerStart, description);
+      }
+      break;
+    case 'fetch-event':
+      assert_greater_than(entry.encodedBodySize, 0, description);
+      break;
+    case '':  // i.e. no matching rules
+      assert_equals(entry.workerCacheLookupStart, 0, description);
+      assert_greater_than_equal(entry.workerStart, entry.workerRouterEvaluationStart, description);
+      assert_greater_than_equal(entry.fetchStart, entry.workerStart, description);
+      break;
+  }
+}
+
+promise_test(async t => {
+  const worker = await registerAndActivate(t, ROUTER_RULE_KEY_REQUEST_FETCH);
+  const rnd = randomString();
+  const url = `${NON_REGISTERED_ROUTE}?nonce=${rnd}`;
+  const iframe = await createIframe(t, url);
+  const {errors, requests} = await get_info_from_worker(worker);
+
+  assert_equals(errors.length, 0);
+  assert_equals(requests.length, 1);
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: url,
+    matched_source_type: 'fetch-event',
+    final_source_type: 'fetch-event',
+    description: "fetch-event as source on main resource"
+  });
+}, 'Main resource matched the rule with fetch-event source');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Network\n");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: REGISTERED_ROUTE,
+    matched_source_type: 'network',
+    final_source_type: 'network',
+    description: "network as source on main resource"
+  });
+}, 'Main resource load matched with the condition and resource timing');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  assert_equals(
+    requests[0].url,
+    resourceUrl(NON_REGISTERED_ROUTE));
+  assert_equals(requests[0].mode, 'navigate');
+  test_resource_timing({
+    performance: iwin.performance,
+    url: NON_REGISTERED_ROUTE,
+    matched_source_type: '',
+    final_source_type: '',
+    description: "no rule matched on main resource"
+  });
+}, 'Main resource load not matched with the condition and resource timing');
+
+iframeTest(CACHED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "From cache");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: CACHED_ROUTE,
+    matched_source_type: 'cache',
+    final_source_type: 'cache',
+    description: "cache as source on main resource and cache hit"
+  });
+}, 'Main resource load matched with the cache source and resource timing');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_REQUEST_CACHE, async (t, iwin, worker) => {
+  const {requests} = await get_info_from_worker(worker);
+  // When the request matched to the rule with the "cache" source but failed to
+  // get the cache entry, the fetch handler is not involved and the network
+  // fallback is triggered instead.
+  assert_equals(requests.length, 0);
+  assert_equals(iwin.document.body.innerText, "Here's a simple html file.");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: NON_REGISTERED_ROUTE,
+    matched_source_type: 'cache',
+    final_source_type: 'network',
+    description: "cache as source on main resource and cache miss, fallback to network"
+  });
+}, 'Main resource fallback to the network when there is no cache entry and resource timing');
+
+// Subresource
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_REQUEST_FETCH, async (t, iwin, worker) => {
+  const rnd = randomString();
+  const subresource = `?nonce=${rnd}`;
+  const response = await iwin.fetch(subresource);
+
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests} = await get_info_from_worker(worker);
+  // Main resource request + subreosurce request = 2.
+  assert_equals(requests.length, 2);
+
+  test_resource_timing({
+    performance: iwin.performance,
+    url: `${NON_REGISTERED_ROUTE}${subresource}`,
+    matched_source_type: 'fetch-event',
+    final_source_type: 'fetch-event',
+    description: "fetch-event as source on sub resource"
+  });
+}, 'Subresource load matched the rule fetch-event source');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin) => {
+  const rnd = randomString();
+  const subresource = `?nonce=${rnd}`;
+  const response = await iwin.fetch(subresource);
+  assert_equals(await response.text(), rnd);
+  test_resource_timing({
+    performance: iwin.performance,
+    url: NON_REGISTERED_ROUTE + subresource,
+    matched_source_type: '',
+    final_source_type: '',
+    description: "no source type matched"
+  });
+}, 'Subresource load not matched with URLPattern condition');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY, async (t, iwin) => {
+  const rnd = randomString();
+  const subresource = `?nonce=${rnd}`;
+  const response = await iwin.fetch(subresource);
+  assert_equals(await response.text(), "Network\n");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: REGISTERED_ROUTE + subresource,
+    matched_source_type: 'network',
+    final_source_type: 'network',
+    description: "network as source on subresource"
+  });
+}, 'Subresource load matched with URLPattern condition');
+
+iframeTest(NON_REGISTERED_ROUTE, ROUTER_RULE_KEY_URLPATTERN_CACHE, async (t, iwin) => {
+  // No need to set `resources/` because the request is dispatched from iframe.
+  const CACHED_FILE = 'cache.txt';
+  const response = await iwin.fetch(CACHED_FILE);
+  assert_equals(await response.text(), "From cache");
+  test_resource_timing({
+    performance: iwin.performance,
+    url: CACHED_ROUTE, // We need a path including `resources/` to get the resource
+    matched_source_type: 'cache',
+    final_source_type: 'cache',
+    description: "cache as source on subresource and cache hits"
+  });
+}, 'Subresource load matched with the cache source rule');
+
+iframeTest(REGISTERED_ROUTE, ROUTER_RULE_KEY_URL_PATTERN_CONSTRUCTED_MATCH_ALL_CACHE, async (t, iwin, worker) => {
+  // Send a request, which is not stored in the cache, but it exists over the network.
+  const rnd = randomString();
+  let subresource = `?nonce=${rnd}`;
+  let response = await iwin.fetch(subresource);
+  assert_equals(await response.text(), "Network\n");
+  assert_equals(response.status, 200);
+
+  // Request is not handled by ServiceWorker.
+  const {requests} = await get_info_from_worker(worker);
+  assert_equals(requests.length, 0);
+  test_resource_timing({
+    performance: iwin.performance,
+    url: `${REGISTERED_ROUTE}${subresource}`,
+    matched_source_type: 'cache',
+    final_source_type: 'network',
+    description: "cache as source on subresource and cache misses"
+  });
+}, 'Subresource load did not match with the cache and fallback to the network');
+
+// Race Tests
+promise_test(async t => {
+  const rnd = randomString();
+  const url = `${RACE_ROUTE}?nonce=${rnd}&server_slow`;
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, url);
+  // Expect the response from the fetch handler.
+  assert_equals(iframe.contentWindow.document.body.innerText, rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: url,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'fetch-event',
+    description: "race as source on main resource, and fetch-event wins"
+  });
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const url = `${RACE_ROUTE}?nonce=${rnd}&sw_slow`;
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, url);
+  // Expect the response from the netowrk request.
+  assert_equals(iframe.contentWindow.document.body.innerText, "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 1);
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: url,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'network',
+    description: "race as source on main resource, and network wins"
+  });
+}, 'Main resource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, RACE_ROUTE);
+  const subresource = `?nonce=${rnd}&server_slow`;
+  // Expect the response from the fetch handler.
+  const response = await iframe.contentWindow.fetch(subresource);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), rnd);
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: `${RACE_ROUTE}${subresource}`,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'fetch-event',
+    description: "race as source on subresource and fetch wins"
+  });
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the fetch handler response is faster than the server response');
+
+promise_test(async t => {
+  const rnd = randomString();
+  const worker = await registerAndActivate(t, RACE_ROUTER_KEY, RACE_SW_SRC);
+  const iframe = await createIframe(t, RACE_ROUTE);
+  const subresource = `?nonce=${rnd}&sw_slow`;
+  // Expect the response from the network request.
+  const response = await iframe.contentWindow.fetch(subresource);
+  assert_equals(response.status, 200);
+  assert_equals(await response.text(), "Network with GET request");
+  // Ensure the fetch handler is also executed.
+  const {requests}  = await get_info_from_worker(worker);
+  assert_equals(requests.length, 2);
+
+  test_resource_timing({
+    performance: iframe.contentWindow.performance,
+    url: `${RACE_ROUTE}${subresource}`,
+    matched_source_type: 'race-network-and-fetch-handler',
+    final_source_type: 'network',
+    description: "race as source on subresource and network wins"
+  });
+}, 'Subresource load matched the rule with race-network-and-fetch-handler source, and the server reseponse is faster than the fetch handler');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/uncontrolled-page.https.html b/test/fixtures/wpt/service-workers/service-worker/uncontrolled-page.https.html
new file mode 100644
index 000000000000..e22ca8f0a91a
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/uncontrolled-page.https.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+function fetch_url(url) {
+  return new Promise(function(resolve, reject) {
+      var request = new XMLHttpRequest();
+      request.addEventListener('load', function(event) {
+          if (request.status == 200)
+            resolve(request.response);
+          else
+            reject(Error(request.statusText));
+        });
+      request.open('GET', url);
+      request.send();
+    });
+}
+var worker = 'resources/fail-on-fetch-worker.js';
+
+promise_test(function(t) {
+    var scope = 'resources/scope/uncontrolled-page/';
+    return service_worker_unregister_and_register(t, worker, scope)
+      .then(function(reg) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, reg.installing, 'activated');
+        })
+      .then(function() {
+          return fetch_url('resources/simple.txt');
+        })
+      .then(function(text) {
+          assert_equals(text, 'a simple text file\n');
+        });
+  }, 'Fetch events should not go through uncontrolled page.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-controller.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-controller.https.html
new file mode 100644
index 000000000000..3bf4cff7200e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-controller.https.html
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var worker_url = 'resources/simple-intercept-worker.js';
+
+async_test(function(t) {
+    var scope =
+        'resources/unregister-controller-page.html?load-before-unregister';
+    var frame_window;
+    var controller;
+    var registration;
+    var frame;
+
+    service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          frame_window = frame.contentWindow;
+          controller = frame_window.navigator.serviceWorker.controller;
+          assert_true(controller instanceof frame_window.ServiceWorker,
+                      'document should load with a controller');
+          return registration.unregister();
+        })
+      .then(function() {
+          assert_equals(frame_window.navigator.serviceWorker.controller,
+                        controller,
+                        'unregistration should not modify controller');
+          return frame_window.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'intercepted by service worker',
+                        'controller should intercept requests');
+          frame.remove();
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister does not affect existing controller');
+
+async_test(function(t) {
+    var scope =
+        'resources/unregister-controller-page.html?load-after-unregister';
+    var registration;
+    var frame;
+
+    service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return registration.unregister();
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(f) {
+          frame = f;
+          var frame_window = frame.contentWindow;
+          assert_equals(frame_window.navigator.serviceWorker.controller, null,
+                        'document should not have a controller');
+          return frame_window.fetch_url('simple.txt');
+        })
+      .then(function(response) {
+          assert_equals(response, 'a simple text file\n',
+                        'requests should not be intercepted');
+          frame.remove();
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister prevents control of subsequent navigations');
+
+async_test(function(t) {
+    var scope =
+        'resources/scope/no-new-controllee-even-if-registration-is-still-used';
+    var registration;
+
+    service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          return registration.unregister();
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          assert_equals(frame.contentWindow.navigator.serviceWorker.controller,
+                        null,
+                        'document should not have a controller');
+          frame.remove();
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister prevents new controllee even if registration is still in use');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-before-installed.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-before-installed.https.html
new file mode 100644
index 000000000000..c56674c0fb1b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-before-installed.https.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Use Clear-Site-Data to immediately unregister service workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/unregister-immediately-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// These tests use the Clear-Site-Data network response header to immediately
+// unregister a service worker registration with a worker whose state is
+// 'installing' or 'parsed'.  Clear-Site-Data must delete the registration,
+// abort the installation and then clear the registration by setting the
+// worker's state to 'redundant'.
+
+promise_test(async test => {
+  // This test keeps the service worker in the 'parsed' state by using a
+  // script with an infinite loop.
+  const script_url = 'resources/onparse-infiniteloop-worker.js';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-parsed-worker';
+
+  await service_worker_unregister(test, /*scope=*/script_url);
+
+  // Clear-Site-Data must cause register() to fail.
+  const register_promise = promise_rejects_dom(test, 'AbortError',
+    navigator.serviceWorker.register(script_url, { scope: scope_url}));;
+
+  await Promise.all([clear_site_data(), register_promise]);
+
+  await assert_no_registrations_exist();
+ }, 'Clear-Site-Data must abort service worker registration.');
+
+promise_test(async test => {
+  // This test keeps the service worker in the 'installing' state by using a
+  // script with an install event waitUntil() promise that never resolves.
+  const script_url = 'resources/oninstall-waituntil-forever.js';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-installing-worker';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  // Clear-Site-Data must cause install to fail.
+  await Promise.all([
+    clear_site_data(),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  await assert_no_registrations_exist();
+ }, 'Clear-Site-Data must unregister a registration with a worker '
+     + 'in the "installing" state.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-during-extendable-events.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-during-extendable-events.https.html
new file mode 100644
index 000000000000..6ba87a7ce80e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately-during-extendable-events.https.html
@@ -0,0 +1,50 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Use Clear-Site-Data to immediately unregister service workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/unregister-immediately-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// These tests use the Clear-Site-Data network response header to immediately
+// unregister a service worker registration with a worker that has pending
+// extendable events.  Clear-Site-Data must delete the registration,
+// abort all pending extendable events and then clear the registration by
+// setting the worker's state to 'redundant'
+
+promise_test(async test => {
+  // Use a service worker script that can produce fetch events with pending
+  // respondWith() promises that never resolve.
+  const script_url = 'resources/onfetch-waituntil-forever.js';
+  const scope_url =
+    'resources/blank.html?unregister-immediately-with-fetch-event';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+
+  await wait_for_state(test, registration.installing, 'activated');
+
+  const frame = await add_controlled_iframe(test, scope_url);
+
+  // Clear-Site-Data must cause the pending fetch promise to reject.
+  const fetch_promise = promise_rejects_js(
+    test, TypeError, frame.contentWindow.fetch('waituntil-forever'));
+
+  const event_watcher = new EventWatcher(
+    test, frame.contentWindow.navigator.serviceWorker, 'controllerchange');
+
+  await Promise.all([
+    clear_site_data(),
+    fetch_promise,
+    event_watcher.wait_for('controllerchange'),
+    wait_for_state(test, registration.active, 'redundant'),]);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  await assert_no_registrations_exist();
+}, 'Clear-Site-Data must fail pending subresource fetch events.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-immediately.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately.https.html
new file mode 100644
index 000000000000..c6a91f8e235f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-immediately.https.html
@@ -0,0 +1,134 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Use Clear-Site-Data to immediately unregister service workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="resources/unregister-immediately-helpers.js"></script>
+<body>
+<script>
+'use strict';
+
+// These tests use the Clear-Site-Data network response header to immediately
+// unregister a service worker registration with a worker whose state is
+// 'installed', 'waiting', 'activating' or 'activated'.  Immediately
+// unregistering runs the "Clear Registration" algorithm without waiting for the
+// active worker's controlled clients to unload.
+
+promise_test(async test => {
+  // This test keeps the service worker in the 'activating' state by using a
+  // script with an activate event waitUntil() promise that never resolves.
+  const script_url = 'resources/onactivate-waituntil-forever.js';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-waiting-worker';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  await wait_for_state(test, service_worker, 'activating');
+
+  // Clear-Site-Data must cause activation to fail.
+  await Promise.all([
+    clear_site_data(),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  await assert_no_registrations_exist();
+ }, 'Clear-Site-Data must unregister a registration with a worker '
+     + 'in the "activating" state.');
+
+promise_test(async test => {
+  // Create an registration with two service workers: one activated and one
+  // installed.
+  const script_url = 'resources/update_shell.py';
+  const scope_url =
+    'resources/scope-for-unregister-immediately-with-with-update';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const first_service_worker = registration.installing;
+
+  await wait_for_state(test, first_service_worker, 'activated');
+  registration.update();
+
+  const event_watcher = new EventWatcher(test, registration, 'updatefound');
+  await event_watcher.wait_for('updatefound');
+
+  const second_service_worker = registration.installing;
+  await wait_for_state(test, second_service_worker, 'installed');
+
+  // Clear-Site-Data must clear both workers from the registration.
+  await Promise.all([
+    clear_site_data(),
+    wait_for_state(test, first_service_worker, 'redundant'),
+    wait_for_state(test, second_service_worker, 'redundant')]);
+
+  await assert_no_registrations_exist();
+}, 'Clear-Site-Data must unregister an activated registration with '
+    + 'an update waiting.');
+
+promise_test(async test => {
+  const script_url = 'resources/empty.js';
+  const scope_url =
+    'resources/blank.html?unregister-immediately-with-controlled-client';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  await wait_for_state(test, service_worker, 'activated');
+  const frame = await add_controlled_iframe(test, scope_url);
+  const frame_registration =
+    await frame.contentWindow.navigator.serviceWorker.ready;
+
+  const event_watcher = new EventWatcher(
+    test, frame.contentWindow.navigator.serviceWorker, 'controllerchange');
+
+  // Clear-Site-Data must remove the iframe's controller.
+  await Promise.all([
+    clear_site_data(),
+    event_watcher.wait_for('controllerchange'),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  await assert_no_registrations_exist();
+
+  // The ready promise must continue to resolve with the unregistered
+  // registration.
+  assert_equals(frame_registration,
+    await frame.contentWindow.navigator.serviceWorker.ready);
+}, 'Clear-Site-Data must unregister an activated registration with controlled '
+   + 'clients.');
+
+promise_test(async test => {
+  const script_url = 'resources/empty.js';
+  const scope_url =
+    'resources/blank.html?unregister-immediately-while-waiting-to-clear';
+
+  const registration = await service_worker_unregister_and_register(
+    test, script_url, scope_url);
+  const service_worker = registration.installing;
+
+  await wait_for_state(test, service_worker, 'activated');
+  const frame = await add_controlled_iframe(test, scope_url);
+
+  const event_watcher = new EventWatcher(
+    test, frame.contentWindow.navigator.serviceWorker, 'controllerchange');
+
+  // Unregister waits to clear the registration until no controlled clients
+  // exist.
+  await registration.unregister();
+
+  // Clear-Site-Data must clear the unregistered registration immediately.
+  await Promise.all([
+    clear_site_data(),
+    event_watcher.wait_for('controllerchange'),
+    wait_for_state(test, service_worker, 'redundant')]);
+
+  assert_equals(frame.contentWindow.navigator.serviceWorker.controller, null);
+  await assert_no_registrations_exist();
+}, 'Clear-Site-Data must clear an unregistered registration waiting for '
+   + ' controlled clients to unload.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html
new file mode 100644
index 000000000000..d046423e0c29
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html
@@ -0,0 +1,136 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var worker_url = 'resources/empty-worker.js';
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/unregister-then-register-new-script-that-exists';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  const newWorkerURL = worker_url + '?new';
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+
+  const newRegistration = await navigator.serviceWorker.register(newWorkerURL, { scope });
+  t.add_cleanup(() => newRegistration.unregister());
+
+  assert_equals(
+    registration.installing,
+    null,
+    'before activated registration.installing'
+  );
+  assert_equals(
+    registration.waiting,
+    null,
+    'before activated registration.waiting'
+  );
+  assert_equals(
+    registration.active.scriptURL,
+    normalizeURL(worker_url),
+    'before activated registration.active'
+  );
+  assert_equals(
+    newRegistration.installing.scriptURL,
+    normalizeURL(newWorkerURL),
+    'before activated newRegistration.installing'
+  );
+  assert_equals(
+    newRegistration.waiting,
+    null,
+    'before activated newRegistration.waiting'
+  );
+  assert_equals(
+    newRegistration.active,
+    null,
+    'before activated newRegistration.active'
+  );
+  iframe.remove();
+
+  await wait_for_state(t, newRegistration.installing, 'activated');
+
+  assert_equals(
+    newRegistration.installing,
+    null,
+    'after activated newRegistration.installing'
+  );
+  assert_equals(
+    newRegistration.waiting,
+    null,
+    'after activated newRegistration.waiting'
+  );
+  assert_equals(
+    newRegistration.active.scriptURL,
+    normalizeURL(newWorkerURL),
+    'after activated newRegistration.active'
+  );
+
+  const newIframe = await with_iframe(scope);
+  t.add_cleanup(() => newIframe.remove());
+
+  assert_equals(
+    newIframe.contentWindow.navigator.serviceWorker.controller.scriptURL,
+    normalizeURL(newWorkerURL),
+    'the new worker should control a new document'
+  );
+}, 'Registering a new script URL while an unregistered registration is in use');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/unregister-then-register-new-script-that-404s';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+
+  await promise_rejects_js(
+    t, TypeError,
+    navigator.serviceWorker.register('this-will-404', { scope })
+  );
+
+  assert_equals(registration.installing, null, 'registration.installing');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.active.scriptURL, normalizeURL(worker_url), 'registration.active');
+
+  const newIframe = await with_iframe(scope);
+  t.add_cleanup(() => newIframe.remove());
+
+  assert_equals(newIframe.contentWindow.navigator.serviceWorker.controller, null, 'Document should not be controlled');
+}, 'Registering a new script URL that 404s does not resurrect unregistered registration');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/unregister-then-register-reject-install-worker';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+
+  const newRegistration = await navigator.serviceWorker.register(
+    'resources/reject-install-worker.js', { scope }
+  );
+  t.add_cleanup(() => newRegistration.unregister());
+
+  await wait_for_state(t, newRegistration.installing, 'redundant');
+
+  assert_equals(registration.installing, null, 'registration.installing');
+  assert_equals(registration.waiting, null, 'registration.waiting');
+  assert_equals(registration.active.scriptURL, normalizeURL(worker_url),
+                'registration.active');
+  assert_not_equals(registration, newRegistration, 'New registration is different');
+}, 'Registering a new script URL that fails to install does not resurrect unregistered registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister-then-register.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register.https.html
new file mode 100644
index 000000000000..b61608c8419f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister-then-register.https.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+var worker_url = 'resources/empty-worker.js';
+
+promise_test(async function(t) {
+    const scope = 'resources/scope/re-register-resolves-to-new-value';
+    const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+    t.add_cleanup(() => registration.unregister());
+
+    await wait_for_state(t, registration.installing, 'activated');
+    await registration.unregister();
+    const newRegistration = await navigator.serviceWorker.register(worker_url, { scope });
+    t.add_cleanup(() => newRegistration.unregister());
+
+    assert_not_equals(
+      registration, newRegistration,
+      'register should resolve to a new value'
+    );
+  }, 'Unregister then register resolves to a new value');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/re-register-while-old-registration-in-use';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activated');
+  const frame = await with_iframe(scope);
+  t.add_cleanup(() => frame.remove());
+
+  await registration.unregister();
+  const newRegistration = await navigator.serviceWorker.register(worker_url, { scope });
+  t.add_cleanup(() => newRegistration.unregister());
+
+  assert_not_equals(
+    registration, newRegistration,
+    'Unregister and register should always create a new registration'
+  );
+}, 'Unregister then register does not resolve to the original value even if the registration is in use.');
+
+promise_test(function(t) {
+    var scope = 'resources/scope/re-register-does-not-affect-existing-controllee';
+    var iframe;
+    var registration;
+    var controller;
+
+    return service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+            return service_worker_unregister(t, scope);
+          });
+
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          iframe = frame;
+          controller = iframe.contentWindow.navigator.serviceWorker.controller;
+          return registration.unregister();
+        })
+      .then(function() {
+          return navigator.serviceWorker.register(worker_url, { scope: scope });
+        })
+      .then(function(newRegistration) {
+          assert_equals(registration.installing, null,
+                        'installing version is null');
+          assert_equals(registration.waiting, null, 'waiting version is null');
+          assert_equals(
+              iframe.contentWindow.navigator.serviceWorker.controller,
+              controller,
+              'the worker from the first registration is the controller');
+          iframe.remove();
+        });
+  }, 'Unregister then register does not affect existing controllee');
+
+promise_test(async function(t) {
+  const scope = 'resources/scope/resurrection';
+  const altWorkerURL = worker_url + '?alt';
+  const registration = await service_worker_unregister_and_register(t, worker_url, scope);
+  t.add_cleanup(() => registration.unregister());
+
+  await wait_for_state(t, registration.installing, 'activating');
+  const iframe = await with_iframe(scope);
+  t.add_cleanup(() => iframe.remove());
+
+  await registration.unregister();
+  const newRegistration = await navigator.serviceWorker.register(altWorkerURL, { scope });
+  t.add_cleanup(() => newRegistration.unregister());
+
+  assert_equals(newRegistration.active, null, 'Registration is new');
+
+  await wait_for_state(t, newRegistration.installing, 'activating');
+
+  const newIframe = await with_iframe(scope);
+  t.add_cleanup(() => newIframe.remove());
+
+  const iframeController = iframe.contentWindow.navigator.serviceWorker.controller;
+  const newIframeController = newIframe.contentWindow.navigator.serviceWorker.controller;
+
+  assert_not_equals(iframeController, newIframeController, 'iframes have different controllers');
+}, 'Unregister then register does not resurrect the registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/unregister.https.html b/test/fixtures/wpt/service-workers/service-worker/unregister.https.html
new file mode 100644
index 000000000000..492aecb21a87
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/unregister.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+async_test(function(t) {
+    var scope = 'resources/scope/unregister-twice';
+    var registration;
+    navigator.serviceWorker.register('resources/empty-worker.js',
+                                     {scope: scope})
+      .then(function(r) {
+          registration = r;
+          return registration.unregister();
+        })
+      .then(function() {
+          return registration.unregister();
+        })
+      .then(function(value) {
+          assert_equals(value, false,
+                        'unregistering twice should resolve with false');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Unregister twice');
+
+async_test(function(t) {
+    var scope = 'resources/scope/successful-unregister/';
+    navigator.serviceWorker.register('resources/empty-worker.js',
+                                     {scope: scope})
+      .then(function(registration) {
+          return registration.unregister();
+        })
+      .then(function(value) {
+          assert_equals(value, true,
+                        'unregistration should resolve with true');
+          t.done();
+        })
+      .catch(unreached_rejection(t));
+  }, 'Register then unregister');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html
new file mode 100644
index 000000000000..ff51f7f902c7
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html
@@ -0,0 +1,91 @@
+<!DOCTYPE html>
+<meta name=timeout content=long>
+<title>Service Worker: Update should be triggered after a navigation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+async function cleanup(frame, registration) {
+  if (frame)
+    frame.remove();
+  if (registration)
+   await registration.unregister();
+}
+
+promise_test(async t => {
+  const script = 'resources/update_shell.py?filename=empty.js';
+  const scope = 'resources/scope/update';
+  let registration;
+  let frame;
+
+  async function run() {
+    registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Navigation should trigger update.
+    frame = await with_iframe(scope);
+    await wait_for_update(t, registration);
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup(frame, registration);
+  }
+}, 'Update should be triggered after a navigation (no fetch event worker).');
+
+promise_test(async t => {
+  const script = 'resources/update_shell.py?filename=simple-intercept-worker.js';
+  const scope = 'resources/scope/update';
+  let registration;
+  let frame;
+
+  async function run() {
+    registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Navigation should trigger update (network fallback).
+    frame = await with_iframe(scope + '?ignore');
+    await wait_for_update(t, registration);
+
+    // Navigation should trigger update (respondWith called).
+    frame.src = scope + '?string';
+    await wait_for_update(t, registration);
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup(frame, registration);
+  }
+}, 'Update should be triggered after a navigation (fetch event worker).');
+
+promise_test(async t => {
+  const script = 'resources/update_shell.py?filename=empty.js';
+  const scope = 'resources/';
+  let registration;
+  let frame;
+
+  async function run() {
+    registration = await service_worker_unregister_and_register(
+        t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+
+    // Navigation should trigger update. Don't use with_iframe as it waits for
+    // the onload event.
+    frame = document.createElement('iframe');
+    frame.src = 'resources/malformed-http-response.asis';
+    document.body.appendChild(frame);
+    await wait_for_update(t, registration);
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup(frame, registration);
+  }
+}, 'Update should be triggered after a navigation (network error).');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-redirect.https.html
new file mode 100644
index 000000000000..6e821fe479f2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-after-navigation-redirect.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Update should be triggered after redirects during navigation</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(async t => {
+  // This test does a navigation that goes through a redirect chain. Each
+  // request in the chain has a service worker. Each service worker has no
+  // fetch event handler. The redirects are performed by redirect.py.
+  const script = 'resources/update-nocookie-worker.py';
+  const scope1 = 'resources/redirect.py?scope1';
+  const scope2 = 'resources/redirect.py?scope2';
+  const scope3 = 'resources/empty.html';
+  let registration1;
+  let registration2;
+  let registration3;
+  let frame;
+
+  async function cleanup() {
+    if (frame)
+      frame.remove();
+    if (registration1)
+      return registration1.unregister();
+    if (registration2)
+      return registration2.unregister();
+    if (registration3)
+      return registration3.unregister();
+  }
+
+  async function make_active_registration(scope) {
+    const registration =
+        await service_worker_unregister_and_register(t, script, scope);
+    await wait_for_state(t, registration.installing, 'activated');
+    return registration;
+  }
+
+  async function run() {
+    // Make the registrations.
+    registration1 = await make_active_registration(scope1);
+    registration2 = await make_active_registration(scope2);
+    registration3 = await make_active_registration(scope3);
+
+    // Make the promises that resolve on update.
+    const saw_update1 = wait_for_update(t, registration1);
+    const saw_update2 = wait_for_update(t, registration2);
+    const saw_update3 = wait_for_update(t, registration3);
+
+    // Create a URL for the redirect chain: scope1 -> scope2 -> scope3.
+    // Build the URL in reverse order.
+    let url = `${base_path()}${scope3}`;
+    url = `${base_path()}${scope2}&Redirect=${encodeURIComponent(url)}`
+    url = `${base_path()}${scope1}&Redirect=${encodeURIComponent(url)}`
+
+    // Navigate to the URL.
+    frame = await with_iframe(url);
+
+    // Each registration should update.
+    await saw_update1;
+    await saw_update2;
+    await saw_update3;
+  }
+
+  try {
+    await run();
+  } finally {
+    await cleanup();
+  }
+}, 'service workers are updated on redirects during navigation');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-after-oneday.https.html b/test/fixtures/wpt/service-workers/service-worker/update-after-oneday.https.html
new file mode 100644
index 000000000000..e7a8aa42d307
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-after-oneday.https.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<!-- This test requires browser to treat all registrations are older than 24 hours.
+     Preference 'dom.serviceWorkers.testUpdateOverOneDay' should be enabled during
+     the execution of the test -->
+<title>Service Worker: Functional events should trigger update if last update time is over 24 hours</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+
+promise_test(function(t) {
+    var script = 'resources/update-nocookie-worker.py';
+    var scope = 'resources/update/update-after-oneday.https.html';
+    var expected_url = normalizeURL(script);
+    var registration;
+    var frame;
+
+    return service_worker_unregister_and_register(t, expected_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(scope); })
+      .then(function(f) {
+          frame = f;
+          return wait_for_update(t, registration);
+        })
+      .then(function() {
+          assert_equals(registration.installing.scriptURL, expected_url,
+                        'new installing should be set after update resolves.');
+          assert_equals(registration.waiting, null,
+                        'waiting should still be null after update resolves.');
+          assert_equals(registration.active.scriptURL, expected_url,
+                        'active should still exist after update found.');
+          return wait_for_state(t, registration.installing, 'installed');
+        })
+      .then(function() {
+          // Trigger a non-navigation fetch event
+          frame.contentWindow.load_image(normalizeURL('resources/update/sample'));
+          return wait_for_update(t, registration);
+       })
+       .then(function() {
+          frame.remove();
+       })
+  }, 'Update should be triggered after a functional event when last update time is over 24 hours');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-bytecheck-cors-import.https.html b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck-cors-import.https.html
new file mode 100644
index 000000000000..121a7378e358
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck-cors-import.https.html
@@ -0,0 +1,92 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+// Tests of updating a service worker. This file contains cors cases only.
+
+/*
+ * @param string main
+ *   Decide the content of the main script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ * @param string imported
+ *   Decide the content of the imported script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ */
+const settings = [{main: 'default', imported: 'default'},
+                  {main: 'default', imported: 'time'   },
+                  {main: 'time',    imported: 'default'},
+                  {main: 'time',    imported: 'time'   }];
+
+const host_info = get_host_info();
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Specify a cross origin path to load imported scripts from a cross origin.
+    const path = host_info.HTTPS_REMOTE_ORIGIN +
+                 '/service-workers/service-worker/resources/';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=classic';
+    const scope = 'resources/blank.html';
+
+    // Register a service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test(main: ${main}, imported: ${imported})`);
+});
+
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Specify a cross origin path to load imported scripts from a cross origin.
+    const path = host_info.HTTPS_REMOTE_ORIGIN +
+                 '/service-workers/service-worker/resources/';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=module';
+    const scope = 'resources/blank.html';
+
+    // Register a service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope, {type: 'module'});
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test module script(main: ${main}, imported: ${imported})`);
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-bytecheck.https.html b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck.https.html
new file mode 100644
index 000000000000..3e5a28bb67cb
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-bytecheck.https.html
@@ -0,0 +1,92 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+// Tests of updating a service worker. This file contains non-cors cases only.
+
+/*
+ * @param string main
+ *   Decide the content of the main script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ * @param string imported
+ *   Decide the content of the imported script, where 'default' is for constant
+ *   content while 'time' is for time-variant content.
+ */
+const settings = [{main: 'default', imported: 'default'},
+                  {main: 'default', imported: 'time'   },
+                  {main: 'time',    imported: 'default'},
+                  {main: 'time',    imported: 'time'   }];
+
+const host_info = get_host_info();
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Empty path results in the same origin imported scripts.
+    const path = '';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=classic';
+    const scope = 'resources/blank.html';
+
+    // Register a service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test(main: ${main}, imported: ${imported})`);
+});
+
+settings.forEach(({main, imported}) => {
+  promise_test(async (t) => {
+    // Empty path results in the same origin imported scripts.
+    const path = './';
+    const script = 'resources/bytecheck-worker.py' +
+                   '?main=' + main +
+                   '&imported=' + imported +
+                   '&path=' + path +
+                   '&type=module';
+    const scope = 'resources/blank.html';
+
+    // Register a module service worker.
+    const swr = await service_worker_unregister_and_register(t, script, scope,
+                                                            {type: 'module'});
+
+    t.add_cleanup(() => swr.unregister());
+    const sw = await wait_for_update(t, swr);
+    await wait_for_state(t, sw, 'activated');
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+
+    // Update the service worker registration.
+    await swr.update();
+
+    // If there should be a new service worker.
+    if (main === 'time' || imported === 'time') {
+      return wait_for_update(t, swr);
+    }
+    // Otherwise, make sure there is no newly created service worker.
+    assert_array_equals([swr.active, swr.waiting, swr.installing],
+                        [sw, null, null]);
+  }, `Test module script(main: ${main}, imported: ${imported})`);
+});
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-import-scripts.https.html b/test/fixtures/wpt/service-workers/service-worker/update-import-scripts.https.html
new file mode 100644
index 000000000000..a2df529e90df
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-import-scripts.https.html
@@ -0,0 +1,135 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests for importScripts: import scripts ignored error</title>
+<script src="/common/utils.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This file contains tests to check if imported scripts appropriately updated.
+
+const SCOPE = 'resources/simple.txt';
+
+// Create a service worker (update-worker-from-file.py), which is initially
+// |initial_worker| and |updated_worker| later.
+async function prepare_ready_update_worker_from_file(
+    t, initial_worker, updated_worker) {
+  const key = token();
+  const worker_url = `resources/update-worker-from-file.py?` +
+      `First=${initial_worker}&Second=${updated_worker}&Key=${key}`;
+  const expected_url = normalizeURL(worker_url);
+
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+// Create a service worker using the script under resources/.
+async function prepare_ready_normal_worker(t, filename, additional_params='') {
+  const key = token();
+  const worker_url = `resources/${filename}?Key=${key}&${additional_params}`;
+  const expected_url = normalizeURL(worker_url);
+
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+function assert_installing_and_active(registration, expected_url) {
+  assert_equals(registration.installing.scriptURL, expected_url,
+                'assert_installing_and_active: installing');
+  assert_equals(registration.waiting, null,
+                'assert_installing_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_installing_and_active: active');
+}
+
+function assert_waiting_and_active(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_waiting_and_active: installing');
+  assert_equals(registration.waiting.scriptURL, expected_url,
+                'assert_waiting_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_waiting_and_active: active');
+}
+
+function assert_active_only(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_active_only: installing');
+  assert_equals(registration.waiting, null,
+                'assert_active_only: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_active_only: active');
+}
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_update_worker_from_file(
+          t, 'empty.js', 'import-scripts-404.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when a new worker imports an unavailable script.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_update_worker_from_file(
+          t, 'import-scripts-404-after-update.js', 'empty.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.installing, 'installed');
+  assert_waiting_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.waiting, 'activated');
+  assert_active_only(registration, expected_url);
+}, 'update() should succeed when the old imported script no longer exist but ' +
+   "the new worker doesn't import it.");
+
+promise_test(async t => {
+  const [registration, expected_url] = await prepare_ready_normal_worker(
+    t, 'import-scripts-404-after-update.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await registration.update();
+  assert_active_only(registration, expected_url);
+}, 'update() should treat 404 on imported scripts as no change.');
+
+promise_test(async t => {
+  const [registration, expected_url] = await prepare_ready_normal_worker(
+    t, 'import-scripts-404-after-update-plus-update-worker.js',
+       `AdditionalKey=${token()}`);
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should find an update in an imported script but update() should ' +
+   'result in failure due to missing the other imported script.');
+
+promise_test(async t => {
+  const [registration, expected_url] = await prepare_ready_normal_worker(
+    t, 'import-scripts-cross-origin-worker.sub.js');
+  t.add_cleanup(() => registration.unregister());
+  await registration.update();
+  assert_installing_and_active(registration, expected_url);
+}, 'update() should work with cross-origin importScripts.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-missing-import-scripts.https.html b/test/fixtures/wpt/service-workers/service-worker/update-missing-import-scripts.https.html
new file mode 100644
index 000000000000..66e8bfac751e
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-missing-import-scripts.https.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Service Worker: update with missing importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script src="/common/utils.js"></script>
+<body>
+<script>
+/**
+ * Test ServiceWorkerRegistration.update() when importScripts in a service worker
+ * script is no longer available (but was initially).
+ */
+let registration = null;
+
+promise_test(async (test) => {
+  const script = `resources/update-missing-import-scripts-main-worker.py?key=${token()}`;
+  const scope = 'resources/update-missing-import-scripts';
+
+  registration = await service_worker_unregister_and_register(test, script, scope);
+
+  add_completion_callback(() => { registration.unregister(); });
+
+  await wait_for_state(test, registration.installing, 'activated');
+}, 'Initialize global state');
+
+promise_test(test => {
+  return new Promise(resolve => {
+    registration.addEventListener('updatefound', resolve);
+    registration.update();
+  });
+}, 'Update service worker with new script that\'s missing importScripts()');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-module-request-mode.https.html b/test/fixtures/wpt/service-workers/service-worker/update-module-request-mode.https.html
new file mode 100644
index 000000000000..b3875d207bc2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-module-request-mode.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<title>Test that mode is set to same-origin for a main module</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests a main module service worker script fetch during an update check.
+// The fetch should have the mode set to 'same-origin'.
+//
+// The test works by registering a main module service worker. It then does an
+// update. The test server responds with an updated worker script that remembers
+// the http request. The updated worker reports back this request to the test
+// page.
+promise_test(async (t) => {
+  const script = "resources/test-request-mode-worker.py";
+  const scope = "resources/";
+
+  // Register the service worker.
+  await service_worker_unregister(t, scope);
+  const registration = await navigator.serviceWorker.register(
+      script, {scope, type: 'module'});
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Do an update.
+  await registration.update();
+
+  // Ask the new worker what the request was.
+  const newWorker = registration.installing;
+  const sawMessage = new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+  newWorker.postMessage('getHeaders');
+  const result = await sawMessage;
+
+  // Test the result.
+  assert_equals(result['sec-fetch-mode'], 'same-origin');
+  assert_equals(result['origin'], undefined);
+
+}, 'headers of a main module script');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-no-cache-request-headers.https.html b/test/fixtures/wpt/service-workers/service-worker/update-no-cache-request-headers.https.html
new file mode 100644
index 000000000000..6ebad4b7b10b
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-no-cache-request-headers.https.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test that cache is being bypassed/validated in no-cache mode on update</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// Tests a service worker script fetch during an update check which
+// bypasses/validates the browser cache. The fetch should have the
+// 'if-none-match' request header.
+//
+// This tests the Update step:
+//  "Set request’s cache mode to "no-cache" if any of the following are true..."
+// https://w3c.github.io/ServiceWorker/#update-algorithm
+//
+// The test works by registering a service worker with |updateViaCache|
+// set to "none". It then does an update. The test server responds with
+// an updated worker script that remembers the http request headers.
+// The updated worker reports back these headers to the test page.
+promise_test(async (t) => {
+  const script = "resources/test-request-headers-worker.py";
+  const scope = "resources/";
+
+  // Register the service worker.
+  await service_worker_unregister(t, scope);
+  const registration = await navigator.serviceWorker.register(
+      script, {scope, updateViaCache: 'none'});
+  await wait_for_state(t, registration.installing, 'activated');
+
+  // Do an update.
+  await registration.update();
+
+  // Ask the new worker what the request headers were.
+  const newWorker = registration.installing;
+  const sawMessage = new Promise((resolve) => {
+    navigator.serviceWorker.onmessage = (event) => {
+      resolve(event.data);
+    };
+  });
+  newWorker.postMessage('getHeaders');
+  const result = await sawMessage;
+
+  // Test the result.
+  assert_equals(result['service-worker'], 'script');
+  assert_equals(result['if-none-match'], 'etag');
+}, 'headers in no-cache mode');
+
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-not-allowed.https.html b/test/fixtures/wpt/service-workers/service-worker/update-not-allowed.https.html
new file mode 100644
index 000000000000..0a54aa935038
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-not-allowed.https.html
@@ -0,0 +1,140 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+function send_message_to_worker_and_wait_for_response(worker, message) {
+  return new Promise(resolve => {
+    // Use a dedicated channel for every request to avoid race conditions on
+    // concurrent requests.
+    const channel = new MessageChannel();
+    worker.postMessage(channel.port1, [channel.port1]);
+
+    let messageReceived = false;
+    channel.port2.onmessage = event => {
+      assert_false(messageReceived, 'Already received response for ' + message);
+      messageReceived = true;
+      resolve(event.data);
+    };
+    channel.port2.postMessage(message);
+  });
+}
+
+async function ensure_install_event_fired(worker) {
+  const response = await send_message_to_worker_and_wait_for_response(worker, 'awaitInstallEvent');
+  assert_equals('installEventFired', response);
+  assert_equals('installing', worker.state, 'Expected worker to be installing.');
+}
+
+async function finish_install(worker) {
+  await ensure_install_event_fired(worker);
+  const response = await send_message_to_worker_and_wait_for_response(worker, 'finishInstall');
+  assert_equals('installFinished', response);
+}
+
+async function activate_service_worker(t, worker) {
+  await finish_install(worker);
+  // By waiting for both states at the same time, the test fails
+  // quickly if the installation fails, avoiding a timeout.
+  await Promise.race([wait_for_state(t, worker, 'activated'),
+                      wait_for_state(t, worker, 'redundant')]);
+  assert_equals('activated', worker.state, 'Service worker should be activated.');
+}
+
+async function update_within_service_worker(worker) {
+  // This function returns a Promise that resolves when update()
+  // has been called but is not necessarily finished yet.
+  // Call finish() on the returned object to wait for update() settle.
+  const port = await send_message_to_worker_and_wait_for_response(worker, 'callUpdate');
+  let messageReceived = false;
+  return {
+    finish: () => {
+      return new Promise(resolve => {
+        port.onmessage = event => {
+          assert_false(messageReceived, 'Update already finished.');
+          messageReceived = true;
+          resolve(event.data);
+        };
+      });
+    },
+  };
+}
+
+async function update_from_client_and_await_installing_version(test, registration) {
+  const updatefound = wait_for_update(test, registration);
+  registration.update();
+  await updatefound;
+  return registration.installing;
+}
+
+async function spin_up_service_worker(test) {
+  const script = 'resources/update-during-installation-worker.py';
+  const scope = 'resources/blank.html';
+
+  const registration = await service_worker_unregister_and_register(test, script, scope);
+  test.add_cleanup(async () => {
+    if (registration.installing) {
+      // If there is an installing worker, we need to finish installing it.
+      // Otherwise, the tests fails with an timeout because unregister() blocks
+      // until the install-event-handler finishes.
+      const worker = registration.installing;
+      await send_message_to_worker_and_wait_for_response(worker, 'awaitInstallEvent');
+      await send_message_to_worker_and_wait_for_response(worker, 'finishInstall');
+    }
+    return registration.unregister();
+  });
+
+  return registration;
+}
+
+promise_test(async t => {
+  const registration = await spin_up_service_worker(t);
+  const worker = registration.installing;
+  await ensure_install_event_fired(worker);
+
+  const result = registration.update();
+  await activate_service_worker(t, worker);
+  return result;
+}, 'ServiceWorkerRegistration.update() from client succeeds while installing service worker.');
+
+promise_test(async t => {
+  const registration = await spin_up_service_worker(t);
+  const worker = registration.installing;
+  await ensure_install_event_fired(worker);
+
+  // Add event listener to fail the test if update() succeeds.
+  const updatefound = t.step_func(async () => {
+    registration.removeEventListener('updatefound', updatefound);
+    // Activate new worker so non-compliant browsers don't fail with timeout.
+    await activate_service_worker(t, registration.installing);
+    assert_unreached("update() should have failed");
+  });
+  registration.addEventListener('updatefound', updatefound);
+
+  const update = await update_within_service_worker(worker);
+  // Activate worker to ensure update() finishes and the test doesn't timeout
+  // in non-compliant browsers.
+  await activate_service_worker(t, worker);
+
+  const response = await update.finish();
+  assert_false(response.success, 'update() should have failed.');
+  assert_equals('InvalidStateError', response.exception, 'update() should have thrown InvalidStateError.');
+}, 'ServiceWorkerRegistration.update() from installing service worker throws.');
+
+promise_test(async t => {
+  const registration = await spin_up_service_worker(t);
+  const worker1 = registration.installing;
+  await activate_service_worker(t, worker1);
+
+  const worker2 = await update_from_client_and_await_installing_version(t, registration);
+  await ensure_install_event_fired(worker2);
+
+  const update = await update_within_service_worker(worker1);
+  // Activate the new version so that update() finishes and the test doesn't timeout.
+  await activate_service_worker(t, worker2);
+  const response = await update.finish();
+  assert_true(response.success, 'update() from active service worker should have succeeded.');
+}, 'ServiceWorkerRegistration.update() from active service worker succeeds while installing service worker.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-on-navigation.https.html b/test/fixtures/wpt/service-workers/service-worker/update-on-navigation.https.html
new file mode 100644
index 000000000000..5273420b90fc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-on-navigation.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Update on navigation</title>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='resources/test-helpers.sub.js'></script>
+<script>
+promise_test(async (t) => {
+    var script = 'resources/update-fetch-worker.py';
+    var scope = 'resources/trickle.py?ms=1000&count=1';
+
+    const registration = await service_worker_unregister_and_register(t, script, scope);
+    t.add_cleanup(() => registration.unregister());
+
+    if (registration.installing)
+        await wait_for_state(t, registration.installing, 'activated');
+
+    const frame = await with_iframe(scope);
+    t.add_cleanup(() => frame.remove());
+}, 'The active service worker in charge of a navigation load should not be terminated as part of updating the registration');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-recovery.https.html b/test/fixtures/wpt/service-workers/service-worker/update-recovery.https.html
new file mode 100644
index 000000000000..17608d2ef790
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-recovery.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<title>Service Worker: recovery by navigation update</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(function(t) {
+    var scope = 'resources/simple.txt';
+    var worker_url = 'resources/update-recovery-worker.py';
+    var expected_url = normalizeURL(worker_url);
+    var registration;
+
+    function with_bad_iframe(url) {
+      return new Promise(function(resolve, reject) {
+        var frame = document.createElement('iframe');
+
+        // There is no cross-browser event to listen for to detect an
+        // iframe that fails to load due to a bad interception.  Unfortunately
+        // we have to use a timeout.
+        var timeout = setTimeout(function() {
+          frame.remove();
+          resolve();
+        }, 5000);
+
+        // If we do get a load event, though, we know something went wrong.
+        frame.addEventListener('load', function() {
+          clearTimeout(timeout);
+          frame.remove();
+          reject('expected bad iframe should not fire a load event!');
+        });
+
+        frame.src = url;
+        document.body.appendChild(frame);
+      });
+    }
+
+    function with_update(t) {
+      return new Promise(function(resolve, reject) {
+        registration.addEventListener('updatefound', function onUpdate() {
+          registration.removeEventListener('updatefound', onUpdate);
+          wait_for_state(t, registration.installing, 'activated').then(function() {
+            resolve();
+          });
+        });
+      });
+    }
+
+    return service_worker_unregister_and_register(t, worker_url, scope)
+      .then(function(r) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          registration = r;
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() {
+          return Promise.all([
+            with_update(t),
+            with_bad_iframe(scope)
+          ]);
+        })
+      .then(function() {
+          return with_iframe(scope);
+        })
+      .then(function(frame) {
+          assert_equals(frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+                        expected_url);
+          frame.remove();
+        });
+  }, 'Recover from a bad service worker by updating after a failed navigation.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-registration-with-type.https.html b/test/fixtures/wpt/service-workers/service-worker/update-registration-with-type.https.html
new file mode 100644
index 000000000000..269e61b390bd
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-registration-with-type.https.html
@@ -0,0 +1,208 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: Update the registration with a different script type.</title>
+<!-- common.js is for guid() -->
+<script src="/common/security-features/resources/common.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+// The following two tests check that a registration is updated correctly
+// with different script type. At first Service Worker is registered as
+// classic script type, then it is re-registered as module script type,
+// and vice versa. A main script is also updated at the same time.
+promise_test(async t => {
+  const key = guid();
+  const script = `resources/update-registration-with-type.py?classic_first=1&key=${key}`;
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with classic script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+  firstWorker.postMessage(' ');
+  let msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A classic script.');
+
+  // Re-register with module script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const secondWorker = secondRegistration.installing;
+  secondWorker.postMessage(' ');
+  msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A module script.');
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (classic => module).');
+
+promise_test(async t => {
+  const key = guid();
+  const script = `resources/update-registration-with-type.py?classic_first=0&key=${key}`;
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+  firstWorker.postMessage(' ');
+  let msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A module script.');
+
+  // Re-register with classic script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const secondWorker = secondRegistration.installing;
+  secondWorker.postMessage(' ');
+  msgEvent = await new Promise(r => navigator.serviceWorker.onmessage = r);
+  assert_equals(msgEvent.data, 'A classic script.');
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (module => classic).');
+
+// The following two tests change the script type while keeping
+// the script identical.
+promise_test(async t => {
+  const script = 'resources/empty-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with classic script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+
+  // Re-register with module script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const secondWorker = secondRegistration.installing;
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (classic => module) '
+    + 'and with a same main script.');
+
+promise_test(async t => {
+  const script = 'resources/empty-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  const firstWorker = firstRegistration.installing;
+  await wait_for_state(t, firstWorker, 'activated');
+
+  // Re-register with classic script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  const secondWorker = secondRegistration.installing;
+
+  assert_not_equals(firstWorker, secondWorker);
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Update the registration with a different script type (module => classic) '
+    + 'and with a same main script.');
+
+// This test checks that a registration is not updated with the same script
+// type and the same main script.
+promise_test(async t => {
+  const script = 'resources/empty-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  await wait_for_state(t, firstRegistration.installing, 'activated');
+
+  // Re-register with module script type.
+  const secondRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  assert_equals(secondRegistration.installing, null);
+
+  assert_equals(firstRegistration, secondRegistration);
+}, 'Does not update the registration with the same script type and '
+    + 'the same main script.');
+
+// In the case (classic => module), a worker script contains importScripts()
+// that is disallowed on module scripts, so the second registration is
+// expected to fail script evaluation.
+promise_test(async t => {
+  const script = 'resources/classic-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with classic script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  });
+  assert_not_equals(firstRegistration.installing, null);
+  await wait_for_state(t, firstRegistration.installing, 'activated');
+
+  // Re-register with module script type and expect TypeError.
+  return promise_rejects_js(t, TypeError, navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  }), 'Registering with invalid evaluation should be failed.');
+}, 'Update the registration with a different script type (classic => module) '
+    + 'and with a same main script. Expect evaluation failed.');
+
+// In the case (module => classic), a worker script contains static-import
+// that is disallowed on classic scripts, so the second registration is
+// expected to fail script evaluation.
+promise_test(async t => {
+  const script = 'resources/module-worker.js';
+  const scope = 'resources/update-registration-with-type';
+  await service_worker_unregister(t, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+
+  // Register with module script type.
+  const firstRegistration = await navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'module'
+  });
+  assert_not_equals(firstRegistration.installing, null);
+  await wait_for_state(t, firstRegistration.installing, 'activated');
+
+  // Re-register with classic script type and expect TypeError.
+  return promise_rejects_js(t, TypeError, navigator.serviceWorker.register(script, {
+    scope: scope,
+    type: 'classic'
+  }), 'Registering with invalid evaluation should be failed.');
+}, 'Update the registration with a different script type (module => classic) '
+    + 'and with a same main script. Expect evaluation failed.');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update-result.https.html b/test/fixtures/wpt/service-workers/service-worker/update-result.https.html
new file mode 100644
index 000000000000..d8ed94f77665
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update-result.https.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Service Worker: update() should resolve a ServiceWorkerRegistration</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+promise_test(async function(t) {
+  const script = './resources/empty.js';
+  const scope = './resources/empty.html?update-result';
+
+  let reg = await navigator.serviceWorker.register(script, { scope });
+  t.add_cleanup(async _ => await reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let result = await reg.update();
+  assert_true(result instanceof ServiceWorkerRegistration,
+              'update() should resolve a ServiceWorkerRegistration');
+}, 'ServiceWorkerRegistration.update() should resolve a registration object');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/update.https.html b/test/fixtures/wpt/service-workers/service-worker/update.https.html
new file mode 100644
index 000000000000..f9fded3db49f
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/update.https.html
@@ -0,0 +1,164 @@
+<!DOCTYPE html>
+<title>Service Worker: Registration update()</title>
+<meta name="timeout" content="long">
+<script src="/common/utils.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/testharness-helpers.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+'use strict';
+
+const SCOPE = 'resources/simple.txt';
+
+// Create a service worker (update-worker.py). The response to update() will be
+// different based on the mode.
+async function prepare_ready_registration_with_mode(t, mode) {
+  const key = token();
+  const worker_url = `resources/update-worker.py?Key=${key}&Mode=${mode}`;
+  const expected_url = normalizeURL(worker_url);
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+// Create a service worker (update-worker-from-file.py), which is initially
+// |initial_worker| and |updated_worker| later.
+async function prepare_ready_registration_with_file(
+    t, initial_worker, updated_worker) {
+  const key = token();
+  const worker_url = `resources/update-worker-from-file.py?` +
+      `First=${initial_worker}&Second=${updated_worker}&Key=${key}`;
+  const expected_url = normalizeURL(worker_url);
+
+  const registration = await service_worker_unregister_and_register(
+      t, worker_url, SCOPE);
+  await wait_for_state(t, registration.installing, 'activated');
+  assert_equals(registration.installing, null,
+                'prepare_ready: installing');
+  assert_equals(registration.waiting, null,
+                'prepare_ready: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'prepare_ready: active');
+  return [registration, expected_url];
+}
+
+function assert_installing_and_active(registration, expected_url) {
+  assert_equals(registration.installing.scriptURL, expected_url,
+                'assert_installing_and_active: installing');
+  assert_equals(registration.waiting, null,
+                'assert_installing_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_installing_and_active: active');
+}
+
+function assert_waiting_and_active(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_waiting_and_active: installing');
+  assert_equals(registration.waiting.scriptURL, expected_url,
+                'assert_waiting_and_active: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_waiting_and_active: active');
+}
+
+function assert_active_only(registration, expected_url) {
+  assert_equals(registration.installing, null,
+                'assert_active_only: installing');
+  assert_equals(registration.waiting, null,
+                'assert_active_only: waiting');
+  assert_equals(registration.active.scriptURL, expected_url,
+                'assert_active_only: active');
+}
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'normal');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.installing, 'installed');
+  assert_waiting_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.waiting, 'activated');
+  assert_active_only(registration, expected_url);
+}, 'update() should succeed when new script is available.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'bad_mime_type');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_dom(t, 'SecurityError', registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when mime type is invalid.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'redirect');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when a response for the main script is redirect.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'syntax_error');
+  t.add_cleanup(() => registration.unregister());
+
+  await promise_rejects_js(t, TypeError, registration.update());
+  assert_active_only(registration, expected_url);
+}, 'update() should fail when a new script contains a syntax error.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'throw_install');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+}, 'update() should resolve when the install event throws.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_mode(t, 'normal');
+  t.add_cleanup(() => registration.unregister());
+
+  // We need to hold a client alive so that unregister() below doesn't remove
+  // the registration before update() has had a chance to look at the pending
+  // uninstall flag.
+  const frame = await with_iframe(SCOPE);
+  t.add_cleanup(() => frame.remove());
+
+  await promise_rejects_js(
+      t, TypeError,
+      Promise.all([registration.unregister(), registration.update()]));
+}, 'update() should fail when the pending uninstall flag is set.');
+
+promise_test(async t => {
+  const [registration, expected_url] =
+      await prepare_ready_registration_with_file(
+        t,
+        'update-smaller-body-before-update-worker.js',
+        'update-smaller-body-after-update-worker.js');
+  t.add_cleanup(() => registration.unregister());
+
+  await Promise.all([registration.update(), wait_for_update(t, registration)]);
+  assert_installing_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.installing, 'installed');
+  assert_waiting_and_active(registration, expected_url);
+
+  await wait_for_state(t, registration.waiting, 'activated');
+  assert_active_only(registration, expected_url);
+}, 'update() should succeed when the script shrinks.');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/waiting.https.html b/test/fixtures/wpt/service-workers/service-worker/waiting.https.html
new file mode 100644
index 000000000000..499e581eb353
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/waiting.https.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<title>ServiceWorker: navigator.serviceWorker.waiting</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+const SCRIPT = 'resources/empty-worker.js';
+const SCOPE = 'resources/blank.html';
+
+promise_test(async t => {
+
+  t.add_cleanup(async() => {
+    if (frame)
+      frame.remove();
+    if (registration)
+      await registration.unregister();
+  });
+
+  await service_worker_unregister(t, SCOPE);
+  const frame = await with_iframe(SCOPE);
+  const registration =
+      await navigator.serviceWorker.register(SCRIPT, {scope: SCOPE});
+  await wait_for_state(t, registration.installing, 'installed');
+  const controller = frame.contentWindow.navigator.serviceWorker.controller;
+  assert_equals(controller, null, 'controller');
+  assert_equals(registration.active, null, 'registration.active');
+  assert_equals(registration.waiting.state, 'installed',
+                'registration.waiting');
+  assert_equals(registration.installing, null, 'registration.installing');
+}, 'waiting is set after installation');
+
+// Tests that the ServiceWorker objects returned from waiting attribute getter
+// that represent the same service worker are the same objects.
+promise_test(async t => {
+  const registration1 =
+      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
+  const registration2 = await navigator.serviceWorker.getRegistration(SCOPE);
+  assert_equals(registration1.waiting, registration2.waiting,
+                'ServiceWorkerRegistration.waiting should return the same ' +
+                'object');
+  await registration1.unregister();
+}, 'The ServiceWorker objects returned from waiting attribute getter that ' +
+   'represent the same service worker are the same objects');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/websocket-in-service-worker.https.html b/test/fixtures/wpt/service-workers/service-worker/websocket-in-service-worker.https.html
new file mode 100644
index 000000000000..cda9d6fe67e2
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/websocket-in-service-worker.https.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>Service Worker: WebSockets can be created in a Service Worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+promise_test(t => {
+    const SCRIPT = 'resources/websocket-worker.js?pipe=sub';
+    const SCOPE = 'resources/blank.html';
+    let registration;
+    return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+      .then(r => {
+          add_completion_callback(() => { r.unregister(); });
+          registration = r;
+          return wait_for_state(t, r.installing, 'activated');
+        })
+      .then(() => {
+          return new Promise(resolve => {
+              navigator.serviceWorker.onmessage = t.step_func(msg => {
+                  assert_equals(msg.data, 'PASS');
+                  resolve();
+              });
+              registration.active.postMessage({});
+          });
+        });
+  }, 'Verify WebSockets can be created in a Service Worker');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/websocket.https.html b/test/fixtures/wpt/service-workers/service-worker/websocket.https.html
new file mode 100644
index 000000000000..cbfed456a9dc
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/websocket.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>Service Worker: WebSocket handshake channel is not intercepted</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+
+promise_test(function(t) {
+    var path = new URL(".", window.location).pathname
+    var url = 'resources/websocket.js';
+    var scope = 'resources/blank.html?websocket';
+    var host_info = get_host_info();
+    var frameURL = host_info['HTTPS_ORIGIN'] + path + scope;
+    var frame;
+
+    return service_worker_unregister_and_register(t, url, scope)
+      .then(function(registration) {
+          t.add_cleanup(function() {
+              return service_worker_unregister(t, scope);
+            });
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(function() { return with_iframe(frameURL); })
+      .then(function(f) {
+          frame = f;
+          return websocket(t, frame);
+        })
+      .then(function() {
+          var channel = new MessageChannel();
+          return new Promise(function(resolve) {
+            channel.port1.onmessage = resolve;
+            frame.contentWindow.navigator.serviceWorker.controller.postMessage({port: channel.port2}, [channel.port2]);
+          });
+        })
+      .then(function(e) {
+          for (var url in e.data.urls) {
+            assert_equals(url.indexOf(get_websocket_url()), -1,
+                          "Observed an unexpected FetchEvent for the WebSocket handshake");
+          }
+          frame.remove();
+        });
+  }, 'Verify WebSocket handshake channel does not get intercepted');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/webvtt-cross-origin.https.html b/test/fixtures/wpt/service-workers/service-worker/webvtt-cross-origin.https.html
new file mode 100644
index 000000000000..9394ff75c4a5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/webvtt-cross-origin.https.html
@@ -0,0 +1,175 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>cross-origin webvtt returned by service worker is detected</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<body>
+<script>
+// This file tests responses for WebVTT text track from a service worker. It
+// creates an iframe with a <track> element, controlled by a service worker.
+// Each test tries to load a text track, the service worker intercepts the
+// requests and responds with opaque or non-opaque responses. As the
+// crossorigin attribute is not set, request's mode is always "same-origin",
+// and as specified in https://fetch.spec.whatwg.org/#http-fetch,
+// a response from a service worker whose type is neither "basic" nor
+// "default" is rejected.
+
+const host_info = get_host_info();
+const kScript = 'resources/fetch-rewrite-worker.js';
+// Add '?ignore' so the service worker falls back for the navigation.
+const kScope = 'resources/vtt-frame.html?ignore';
+let frame;
+
+function load_track(url) {
+  const track = frame.contentDocument.querySelector('track');
+  const result = new Promise((resolve, reject) => {
+      track.onload = (e => {
+          resolve('load event');
+        });
+      track.onerror = (e => {
+          resolve('error event');
+        });
+    });
+
+  track.src = url;
+  // Setting mode to hidden seems needed, or else the text track requests don't
+  // occur.
+  track.track.mode = 'hidden';
+  return result;
+}
+
+promise_test(t => {
+    return service_worker_unregister_and_register(t, kScript, kScope)
+      .then(registration => {
+          promise_test(() => {
+              frame.remove();
+              return registration.unregister();
+            }, 'restore global state');
+
+          return wait_for_state(t, registration.installing, 'activated');
+        })
+      .then(() => {
+          return with_iframe(kScope);
+        })
+      .then(f => {
+          frame = f;
+        })
+  }, 'initialize global state');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL.
+    url += '?url=' + host_info.HTTPS_ORIGIN + '/media/foo.vtt';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'load event');
+        });
+  }, 'same-origin text track should load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a cross-origin URL.
+    url += '?url=' + get_host_info().HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'cross-origin text track with no-cors request should not load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a cross-origin URL that
+    // doesn't support CORS.
+    url += '?url=' + get_host_info().HTTPS_REMOTE_ORIGIN +
+        '/media/foo-no-cors.vtt';
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'cross-origin text track with rejected cors request should not load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a cross-origin URL.
+    url += '?url=' + get_host_info().HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    // Add '&credentials=same-origin' to allow Access-Control-Allow-Origin=* so
+    // that CORS will succeed if the service approves it.
+    url += '&credentials=same-origin';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'cross-origin text track with approved cors request should not load');
+
+// Redirect tests.
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a same-origin URL.
+    redirect_target = host_info.HTTPS_ORIGIN + '/media/foo.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'load event');
+        });
+  }, 'same-origin text track that redirects same-origin should load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a cross-origin URL.
+    redirect_target = host_info.HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'same-origin text track that redirects cross-origin should not load');
+
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a cross-origin URL.
+    redirect_target = host_info.HTTPS_REMOTE_ORIGIN + '/media/foo-no-cors.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    // Add '&credentials=same-origin' to allow Access-Control-Allow-Origin=* so
+    // that CORS will succeed if the server approves it.
+    url += '&credentials=same-origin';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'same-origin text track that redirects to a cross-origin text track with rejected cors should not load');
+
+promise_test(t => {
+    let url = '/media/foo.vtt';
+    // Add '?url' and tell the service worker to fetch a same-origin URL that redirects...
+    redirector_url = host_info.HTTPS_ORIGIN + base_path() + 'resources/redirect.py?Redirect=';
+    // ... to a cross-origin URL.
+    redirect_target = host_info.HTTPS_REMOTE_ORIGIN + '/media/foo.vtt';
+    url += '?url=' + encodeURIComponent(redirector_url + encodeURIComponent(redirect_target));
+    // Add '&mode' to tell the service worker to do a CORS request.
+    url += '&mode=cors';
+    // Add '&credentials=same-origin' to allow Access-Control-Allow-Origin=* so
+    // that CORS will succeed if the server approves it.
+    url += '&credentials=same-origin';
+    return load_track(url)
+      .then(result => {
+          assert_equals(result, 'error event');
+        });
+  }, 'same-origin text track that redirects to a cross-origin text track with approved cors should not load');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/windowclient-ancestorOrigins.sub.https.html b/test/fixtures/wpt/service-workers/service-worker/windowclient-ancestorOrigins.sub.https.html
new file mode 100644
index 000000000000..05f8cfc5308c
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/windowclient-ancestorOrigins.sub.https.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Client ancestorOrigins with iframe referrerpolicy</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+const origins = {
+  A: window.origin,
+  B: "https://{{domains[www]}}:{{ports[https][0]}}",
+};
+const tests = [
+  {policy: "",            origin: 'A', expect: [origins.A]},
+  {policy: "no-referrer", origin: 'A', expect: ["null"]},
+  {policy: "same-origin", origin: 'A', expect: [origins.A]},
+  {policy: "same-origin", origin: 'B', expect: ["null"]},
+];
+for (const test of tests) {
+  promise_test(async (t) => {
+    const origin = origins[test.origin];
+    const iframe = document.createElement('iframe');
+    t.add_cleanup(() => { iframe.remove(); });
+    const id = `${test.policy},${origin}`;
+    iframe.name = id;
+    iframe.referrerPolicy = test.policy;
+    iframe.src = `${origin}/service-workers/service-worker/resources/ancestorOrigins.html?id=${id}`;
+    document.body.append(iframe);
+    const result = await new Promise(resolve => {
+      addEventListener('message', e => { resolve(e.data); }, {once: true});
+    });
+    assert_equals(result.id, id, 'id');
+    assert_array_equals(result.swAO, test.expect, 'windowClient.ancestorOrigins');
+    assert_true(result.sameObject, 'windowClient.ancestorOrigins is [SameObject]');
+    assert_array_equals(result.locationAO, test.expect, 'location.ancestorOrigins');
+  }, `iframe referrerpolicy="${test.policy}", origin ${test.origin}`);
+}
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/windowclient-navigate.https.html b/test/fixtures/wpt/service-workers/service-worker/windowclient-navigate.https.html
new file mode 100644
index 000000000000..8c1dcad5b65d
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/windowclient-navigate.https.html
@@ -0,0 +1,190 @@
+<!DOCTYPE html>
+<title>Service Worker: WindowClient.navigate() tests</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+'use strict';
+
+const SCOPE = 'resources/blank.html';
+const SCRIPT_URL = 'resources/windowclient-navigate-worker.js';
+const CROSS_ORIGIN_URL =
+  get_host_info()['HTTPS_REMOTE_ORIGIN'] + base_path() + 'resources/blank.html';
+
+navigateTest({
+  description: 'normal',
+  destUrl: 'blank.html?navigate',
+  expected: normalizeURL(SCOPE) + '?navigate',
+});
+
+navigateTest({
+  description: 'blank url',
+  destUrl: '',
+  expected: normalizeURL(SCRIPT_URL)
+});
+
+navigateTest({
+  description: 'in scope but not controlled test on installing worker',
+  destUrl: 'blank.html?navigate',
+  expected: 'TypeError',
+  waitState: 'installing',
+});
+
+navigateTest({
+  description: 'in scope but not controlled test on active worker',
+  destUrl: 'blank.html?navigate',
+  expected: 'TypeError',
+  controlled: false,
+});
+
+navigateTest({
+  description: 'out of scope',
+  srcUrl: '/common/blank.html',
+  destUrl: 'blank.html?navigate',
+  expected: 'TypeError',
+});
+
+navigateTest({
+  description: 'cross origin url',
+  destUrl: CROSS_ORIGIN_URL,
+  expected: null
+});
+
+navigateTest({
+  description: 'invalid url (http://[example.com])',
+  destUrl: 'http://[example].com',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'invalid url (view-source://example.com)',
+  destUrl: 'view-source://example.com',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'invalid url (file:///)',
+  destUrl: 'file:///',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'invalid url (about:blank)',
+  destUrl: 'about:blank',
+  expected: 'TypeError'
+});
+
+navigateTest({
+  description: 'navigate on a top-level window client',
+  destUrl: 'blank.html?navigate',
+  srcUrl: 'resources/loaded.html',
+  scope: 'resources/loaded.html',
+  expected: normalizeURL(SCOPE) + '?navigate',
+  frameType: 'top-level'
+});
+
+async function createFrame(t, parameters) {
+  if (parameters.frameType === 'top-level') {
+    // Wait for window.open is completed.
+    await new Promise(resolve => {
+      const win = window.open(parameters.srcUrl);
+      t.add_cleanup(() => win.close());
+      window.addEventListener('message', (e) => {
+        if (e.data.type === 'LOADED') {
+          resolve();
+        }
+      });
+    });
+  }
+
+  if (parameters.frameType === 'nested') {
+    const frame = await with_iframe(parameters.srcUrl);
+    t.add_cleanup(() => frame.remove());
+  }
+}
+
+function navigateTest(overrideParameters) {
+  // default parameters
+  const parameters = {
+    description: null,
+    srcUrl: SCOPE,
+    destUrl: null,
+    expected: null,
+    waitState: 'activated',
+    scope: SCOPE,
+    controlled: true,
+    // `frameType` can be 'nested' for an iframe WindowClient or 'top-level' for
+    // a main frame WindowClient.
+    frameType: 'nested'
+  };
+
+  for (const key in overrideParameters)
+    parameters[key] = overrideParameters[key];
+
+  promise_test(async function(t) {
+    let pausedLifecyclePort;
+    let scriptUrl = SCRIPT_URL;
+
+    // For in-scope-but-not-controlled test on installing worker,
+    // if the waitState is "installing", then append the query to scriptUrl.
+    if (parameters.waitState === 'installing') {
+      scriptUrl += '?' + parameters.waitState;
+
+      navigator.serviceWorker.addEventListener('message', (event) => {
+        if (event.data.port) {
+          pausedLifecyclePort = event.data.port;
+        }
+      });
+    }
+
+    t.add_cleanup(() => {
+      // Some tests require that the worker remain in a given lifecycle phase.
+      // "Clean up" logic for these tests requires signaling the worker to
+      // release the hold; this allows the worker to be properly discarded
+      // prior to the execution of additional tests.
+      if (pausedLifecyclePort) {
+        // The value of the posted message is inconsequential. A string is
+        // specified here solely to aid in test debugging.
+        pausedLifecyclePort.postMessage('continue lifecycle');
+      }
+    });
+
+    // Create a frame that is not controlled by a service worker.
+    if (!parameters.controlled) {
+      await createFrame(t, parameters);
+    }
+
+    const registration = await service_worker_unregister_and_register(
+        t, scriptUrl, parameters.scope);
+    const serviceWorker = registration.installing;
+    await wait_for_state(t, serviceWorker, parameters.waitState);
+    t.add_cleanup(() => registration.unregister());
+
+    // Create a frame after a service worker is registered so that the frmae is
+    // controlled by an active service worker.
+    if (parameters.controlled) {
+      await createFrame(t, parameters);
+    }
+
+    const response = await new Promise(resolve => {
+      const channel = new MessageChannel();
+      channel.port1.onmessage = t.step_func(resolve);
+      serviceWorker.postMessage({
+        port: channel.port2,
+        url: parameters.destUrl,
+        clientUrl: new URL(parameters.srcUrl, location).toString(),
+        frameType: parameters.frameType,
+        expected: parameters.expected,
+        description: parameters.description,
+      }, [channel.port2]);
+    });
+
+    assert_equals(response.data, null);
+    await fetch_tests_from_worker(serviceWorker);
+  }, parameters.description);
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-client-id.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-client-id.https.html
new file mode 100644
index 000000000000..4e4d31660bd5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-client-id.https.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<title>Service Worker: Workers should have their own unique client Id</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// Get the iframe client ID by calling postMessage() on its controlling
+// worker.  This will cause the service worker to post back the
+// MessageEvent.source.id value.
+function getFrameClientId(frame) {
+  return new Promise(resolve => {
+    let mc = new MessageChannel();
+    frame.contentWindow.navigator.serviceWorker.controller.postMessage(
+      'echo-client-id', [mc.port2]);
+    mc.port1.onmessage = evt => {
+      resolve(evt.data);
+    };
+  });
+}
+
+// Get the worker client ID by creating a worker that performs an intercepted
+// fetch().  The synthetic fetch() response will contain the FetchEvent.clientId
+// value.  This is then posted back to here.
+function getWorkerClientId(frame) {
+  return new Promise(resolve => {
+    let w = new frame.contentWindow.Worker('worker-echo-client-id.js');
+    w.onmessage = evt => {
+      resolve(evt.data);
+    };
+  });
+}
+
+promise_test(async function(t) {
+  const script = './resources/worker-client-id-worker.js';
+  const scope = './resources/worker-client-id';
+  const frame = scope + '/frame.html';
+
+  let reg = await navigator.serviceWorker.register(script, { scope });
+  t.add_cleanup(async _ => await reg.unregister());
+  await wait_for_state(t, reg.installing, 'activated');
+
+  let f = await with_iframe(frame);
+  t.add_cleanup(_ => f.remove());
+
+  let frameClientId = await getFrameClientId(f);
+  assert_not_equals(frameClientId, null, 'frame client id should exist');
+
+  let workerClientId = await getWorkerClientId(f);
+  assert_not_equals(workerClientId, null, 'worker client id should exist');
+
+  assert_not_equals(frameClientId, workerClientId,
+                    'frame and worker client ids should be different');
+}, 'Verify workers have a unique client id separate from their owning documents window');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-in-sandboxed-iframe-by-csp-fetch-event.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-in-sandboxed-iframe-by-csp-fetch-event.https.html
new file mode 100644
index 000000000000..c8480bf1be00
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-in-sandboxed-iframe-by-csp-fetch-event.https.html
@@ -0,0 +1,132 @@
+<!DOCTYPE html>
+<title>ServiceWorker FetchEvent issued from workers in an iframe sandboxed via CSP HTTP response header.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+let lastCallbackId = 0;
+let callbacks = {};
+function doTest(frame, type) {
+  return new Promise(function(resolve) {
+    var id = ++lastCallbackId;
+    callbacks[id] = resolve;
+    frame.contentWindow.postMessage({id: id, type: type}, '*');
+  });
+}
+
+// Asks the service worker for data about requests and clients seen. The
+// worker posts a message back with |data| where:
+// |data.requests|: the requests the worker received FetchEvents for
+// |data.clients|: the URLs of all the worker's clients
+// The worker clears its data after responding.
+function getResultsFromWorker(worker) {
+  return new Promise(resolve => {
+    let channel = new MessageChannel();
+    channel.port1.onmessage = msg => {
+      resolve(msg.data);
+    };
+    worker.postMessage({port: channel.port2}, [channel.port2]);
+  });
+}
+
+window.onmessage = function (e) {
+  message = e.data;
+  let id = message['id'];
+  let callback = callbacks[id];
+  delete callbacks[id];
+  callback(message['result']);
+};
+
+const SCOPE = 'resources/sandboxed-iframe-fetch-event-iframe.py';
+const SCRIPT = 'resources/sandboxed-iframe-fetch-event-worker.js';
+const expected_base_url = new URL(SCOPE, location.href);
+// A service worker controlling |SCOPE|.
+let worker;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts'.
+// This should NOT be controlled by a service worker.
+let sandboxed_frame_by_header;
+// An iframe whose response header has
+// 'Content-Security-Policy: allow-scripts allow-same-origin'.
+// This should be controlled by a service worker.
+let sandboxed_same_origin_frame_by_header;
+
+promise_test(t => {
+  return service_worker_unregister_and_register(t, SCRIPT, SCOPE)
+    .then(function(registration) {
+      add_completion_callback(() => registration.unregister());
+      worker = registration.installing;
+      return wait_for_state(t, registration.installing, 'activated');
+    });
+}, 'Prepare a service worker.');
+
+promise_test(t => {
+  const iframe_full_url = expected_base_url + '?sandbox=allow-scripts&' +
+                          'sandboxed-frame-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'Service worker should provide the response');
+      assert_equals(requests[0], iframe_full_url);
+      assert_false(data.clients.includes(iframe_full_url),
+                   'Service worker should NOT control the sandboxed page');
+    });
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts.');
+
+promise_test(t => {
+  const iframe_full_url =
+    expected_base_url + '?sandbox=allow-scripts%20allow-same-origin&' +
+    'sandboxed-iframe-same-origin-by-header';
+  return with_iframe(iframe_full_url)
+    .then(f => {
+      sandboxed_same_origin_frame_by_header = f;
+      add_completion_callback(() => f.remove());
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1);
+      assert_equals(requests[0], iframe_full_url);
+      assert_true(data.clients.includes(iframe_full_url));
+    })
+}, 'Prepare an iframe sandboxed by CSP HTTP header with allow-scripts and ' +
+   'allow-same-origin.');
+
+promise_test(t => {
+  let frame = sandboxed_frame_by_header;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      assert_equals(data.requests.length, 0,
+                    'The request should NOT be handled by SW.');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by CSP HTTP header ' +
+   'allow-scripts flag');
+
+promise_test(t => {
+  let frame = sandboxed_same_origin_frame_by_header;
+  return doTest(frame, 'fetch-from-worker')
+    .then(result => {
+      assert_equals(result, 'done');
+      return getResultsFromWorker(worker);
+    })
+    .then(data => {
+      let requests = data.requests;
+      assert_equals(requests.length, 1,
+                    'The request should be handled by SW.');
+      assert_equals(requests[0], frame.src + '&test=fetch-from-worker');
+    });
+}, 'Fetch request from a worker in iframe sandboxed by CSP HTTP header ' +
+   'with allow-scripts and allow-same-origin flag');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-interception-redirect.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-interception-redirect.https.html
new file mode 100644
index 000000000000..8d566b9c15b1
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-interception-redirect.https.html
@@ -0,0 +1,212 @@
+<!DOCTYPE html>
+<title>Service Worker: controlling Worker/SharedWorker</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+// This tests service worker interception for worker clients, when the request
+// for the worker script goes through redirects. For example, a request can go
+// through a chain of URLs like A -> B -> C -> D and each URL might fall in the
+// scope of a different service worker, if any.
+// The two key questions are:
+// 1. Upon a redirect from A -> B, should a service worker for scope B
+//    intercept the request?
+// 2. After the final response, which service worker controls the resulting
+//    client?
+//
+// The standard prescribes the following:
+// 1. The service worker for scope B intercepts the redirect. *However*, once a
+//    request falls back to network (i.e., a service worker did not call
+//    respondWith()) and a redirect is then received from network, no service
+//    worker should intercept that redirect or any subsequent redirects.
+// 2. The final service worker that got a fetch event (or would have, in the
+//    case of a non-fetch-event worker) becomes the controller of the client.
+//
+// The standard may change later, see:
+// https://github.com/w3c/ServiceWorker/issues/1289
+//
+// The basic test setup is:
+// 1. Page registers service workers for scope1 and scope2.
+// 2. Page requests a worker from scope1.
+// 3. The request is redirected to scope2 or out-of-scope.
+// 4. The worker posts message to the page describing where the final response
+//   was served from (service worker or network).
+// 5. The worker does an importScripts() and fetch(), and posts back the
+//   responses, which describe where the responses where served from.
+
+// Globals for easier cleanup.
+const scope1 = 'resources/scope1';
+const scope2 = 'resources/scope2';
+let frame;
+
+function get_message_from_worker(port) {
+  return new Promise(resolve => {
+      port.onmessage = evt => {
+        resolve(evt.data);
+      }
+    });
+}
+
+async function cleanup() {
+  if (frame)
+    frame.remove();
+
+  const reg1 = await navigator.serviceWorker.getRegistration(scope1);
+  if (reg1)
+    await reg1.unregister();
+  const reg2 = await navigator.serviceWorker.getRegistration(scope2);
+  if (reg2)
+    await reg2.unregister();
+}
+
+// Builds the worker script URL, which encodes information about where
+// to redirect to. The URL falls in sw1's scope.
+//
+// - |redirector| is "network" or "serviceworker". If "serviceworker", sw1 will
+// respondWith() a redirect. Otherwise, it falls back to network and the server
+// responds with a redirect.
+// - |redirect_location| is "scope2" or "out-of-scope". If "scope2", the
+// redirect ends up in sw2's scope2. Otherwise it's out of scope.
+function build_worker_url(redirector, redirect_location) {
+  let redirect_path;
+  // Set path to redirect.py, a file on the server that serves
+  // a redirect. When sw1 sees this URL, it falls back to network.
+  if (redirector == 'network')
+    redirector_path = 'redirect.py';
+  // Set path to 'sw-redirect', to tell the service worker
+  // to respond with redirect.
+  else if (redirector == 'serviceworker')
+    redirector_path = 'sw-redirect';
+
+  let redirect_to = base_path() + 'resources/';
+  // Append "scope2/" to redirect_to, so the redirect falls in scope2.
+  // Otherwise no change is needed, as the parent "resources/" directory is
+  // used, and is out-of-scope.
+  if (redirect_location == 'scope2')
+    redirect_to += 'scope2/';
+  // Append the name of the file which serves the worker script.
+  redirect_to += 'worker_interception_redirect_webworker.py';
+
+  return `scope1/${redirector_path}?Redirect=${redirect_to}`
+}
+
+promise_test(async t => {
+  await cleanup();
+  const service_worker = 'resources/worker-interception-redirect-serviceworker.js';
+  const registration1 = await navigator.serviceWorker.register(service_worker, {scope: scope1});
+  await wait_for_state(t, registration1.installing, 'activated');
+  const registration2 = await navigator.serviceWorker.register(service_worker, {scope: scope2});
+  await wait_for_state(t, registration2.installing, 'activated');
+
+  promise_test(t => {
+    return cleanup();
+  }, 'cleanup global state');
+}, 'initialize global state');
+
+async function worker_redirect_test(worker_request_url,
+                              worker_expected_url,
+                              expected_main_resource_message,
+                              expected_import_scripts_message,
+                              expected_fetch_message,
+                              description) {
+  for (const workerType of ['DedicatedWorker', 'SharedWorker']) {
+    for (const type of ['classic', 'module']) {
+      promise_test(async t => {
+        // Create a frame to load the worker from. This way we can remove the
+        // frame to destroy the worker client when the test is done.
+        frame = await with_iframe('resources/blank.html');
+        t.add_cleanup(() => { frame.remove(); });
+
+        // Start the worker.
+        let w;
+        let port;
+        if (workerType === 'DedicatedWorker') {
+          w = new frame.contentWindow.Worker(worker_request_url, {type});
+          port = w;
+        } else {
+          w = new frame.contentWindow.SharedWorker(worker_request_url, {type});
+          port = w.port;
+          w.port.start();
+        }
+        w.onerror = t.unreached_func('Worker error');
+
+        // Expect a message from the worker indicating which service worker
+        // provided the response for the worker script request, if any.
+        const data = await get_message_from_worker(port);
+
+        // The worker does an importScripts(). Expect a message from the worker
+        // indicating which service worker provided the response for the
+        // importScripts(), if any.
+        const import_scripts_message = await get_message_from_worker(port);
+        test(() => {
+          if (type === 'classic') {
+            assert_equals(import_scripts_message,
+                          expected_import_scripts_message);
+          } else {
+            assert_equals(import_scripts_message, 'importScripts failed');
+          }
+        }, `${description} (${type} ${workerType}, importScripts())`);
+
+        // The worker does a fetch(). Expect a message from the worker
+        // indicating which service worker provided the response for the
+        // fetch(), if any.
+        const fetch_message = await get_message_from_worker(port);
+        test(() => {
+          assert_equals(fetch_message, expected_fetch_message);
+        }, `${description} (${type} ${workerType}, fetch())`);
+
+        // Expect a message from the worker indicating |self.location|.
+        const worker_actual_url = await get_message_from_worker(port);
+        test(() => {
+          assert_equals(
+            worker_actual_url,
+            (new URL(worker_expected_url, location.href)).toString(),
+            'location.href');
+        }, `${description} (${type} ${workerType}, location.href)`);
+
+        assert_equals(data, expected_main_resource_message);
+
+      }, `${description} (${type} ${workerType})`);
+    }
+  }
+}
+
+// request to sw1 scope gets network redirect to sw2 scope
+worker_redirect_test(
+    build_worker_url('network', 'scope2'),
+    'resources/scope2/worker_interception_redirect_webworker.py',
+    'the worker script was served from network',
+    'sw1 saw importScripts from the worker: /service-workers/service-worker/resources/scope2/import-scripts-echo.py',
+    'fetch(): sw1 saw the fetch from the worker: /service-workers/service-worker/resources/scope2/simple.txt',
+    'Case #1: network scope1->scope2');
+
+// request to sw1 scope gets network redirect to out-of-scope
+worker_redirect_test(
+    build_worker_url('network', 'out-scope'),
+    'resources/worker_interception_redirect_webworker.py',
+    'the worker script was served from network',
+    'sw1 saw importScripts from the worker: /service-workers/service-worker/resources/import-scripts-echo.py',
+    'fetch(): sw1 saw the fetch from the worker: /service-workers/service-worker/resources/simple.txt',
+    'Case #2: network scope1->out-scope');
+
+// request to sw1 scope gets service-worker redirect to sw2 scope
+worker_redirect_test(
+    build_worker_url('serviceworker', 'scope2'),
+    'resources/subdir/worker_interception_redirect_webworker.py?greeting=sw2%20saw%20the%20request%20for%20the%20worker%20script',
+    'sw2 saw the request for the worker script',
+    'sw2 saw importScripts from the worker: /service-workers/service-worker/resources/subdir/import-scripts-echo.py',
+    'fetch(): sw2 saw the fetch from the worker: /service-workers/service-worker/resources/subdir/simple.txt',
+    'Case #3: sw scope1->scope2');
+
+// request to sw1 scope gets service-worker redirect to out-of-scope
+worker_redirect_test(
+    build_worker_url('serviceworker', 'out-scope'),
+    'resources/worker_interception_redirect_webworker.py',
+    'the worker script was served from network',
+    'sw1 saw importScripts from the worker: /service-workers/service-worker/resources/import-scripts-echo.py',
+    'fetch(): sw1 saw the fetch from the worker: /service-workers/service-worker/resources/simple.txt',
+    'Case #4: sw scope1->out-scope');
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/worker-interception.https.html b/test/fixtures/wpt/service-workers/service-worker/worker-interception.https.html
new file mode 100644
index 000000000000..27983d8352fe
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/worker-interception.https.html
@@ -0,0 +1,244 @@
+<!DOCTYPE html>
+<title>Service Worker: intercepting Worker script loads</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<body>
+<script>
+
+// ========== Worker main resource interception tests ==========
+
+async function setup_service_worker(t, service_worker_url, scope) {
+  const r = await service_worker_unregister_and_register(
+      t, service_worker_url, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, r.installing, 'activated');
+  return r.active;
+}
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-synthesized-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  const serviceWorker = await setup_service_worker(t, service_worker_url, scope);
+
+  const channels = new MessageChannel();
+  serviceWorker.postMessage({port: channels.port1}, [channels.port1]);
+
+  const clientId = await new Promise(resolve => channels.port2.onmessage = (e) => resolve(e.data.id));
+
+  const resultPromise =  new Promise(resolve => channels.port2.onmessage = (e) => resolve(e.data));
+
+  const w = new Worker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'worker loading intercepted by service worker');
+
+  const results = await resultPromise;
+  assert_equals(results.clientId, clientId);
+  assert_true(!!results.resultingClientId.length);
+
+  channels.port2.postMessage("done");
+}, `Verify a dedicated worker script request gets correct client Ids`);
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-synthesized-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'worker loading intercepted by service worker');
+}, `Verify a dedicated worker script request issued from a uncontrolled ` +
+   `document is intercepted by worker's own service worker.`);
+
+promise_test(async t => {
+  const frame_url = 'resources/create-out-of-scope-worker.html';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = frame_url;
+
+  const registration = await service_worker_unregister_and_register(
+      t, service_worker_url, scope);
+  t.add_cleanup(() => service_worker_unregister(t, scope));
+  await wait_for_state(t, registration.installing, 'activated');
+
+  const frame = await with_iframe(frame_url);
+  t.add_cleanup(_ => frame.remove());
+
+  assert_equals(
+    frame.contentWindow.navigator.serviceWorker.controller.scriptURL,
+    get_newest_worker(registration).scriptURL,
+    'the frame should be controlled by a service worker'
+  );
+
+  const result = await frame.contentWindow.getWorkerPromise();
+
+  assert_equals(result,
+                'worker loading was not intercepted by service worker');
+}, `Verify an out-of-scope dedicated worker script request issued from a ` +
+   `controlled document should not be intercepted by document's service ` +
+   `worker.`);
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-synthesized-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.port.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'worker loading intercepted by service worker');
+}, `Verify a shared worker script request issued from a uncontrolled ` +
+   `document is intercepted by worker's own service worker.`);
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-same-origin-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'dedicated worker script loaded');
+}, 'Verify a same-origin worker script served by a service worker succeeds ' +
+   'in starting a dedicated worker.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-same-origin-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const data = await new Promise((resolve, reject) => {
+    w.port.onmessage = e => resolve(e.data);
+    w.onerror = e => reject(e.message);
+  });
+  assert_equals(data, 'shared worker script loaded');
+}, 'Verify a same-origin worker script served by a service worker succeeds ' +
+   'in starting a shared worker.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-cors-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a cors worker script served by a service worker fails dedicated ' +
+   'worker start.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-cors-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a cors worker script served by a service worker fails shared ' +
+   'worker start.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-no-cors-worker.js?dedicated';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new Worker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a no-cors cross-origin worker script served by a service worker ' +
+   'fails dedicated worker start.');
+
+promise_test(async t => {
+  const worker_url = 'resources/sample-no-cors-worker.js?shared';
+  const service_worker_url = 'resources/sample-worker-interceptor.js';
+  const scope = worker_url;
+
+  await setup_service_worker(t, service_worker_url, scope);
+  const w = new SharedWorker(worker_url);
+  const watcher = new EventWatcher(t, w, ['message', 'error']);
+  await watcher.wait_for('error');
+}, 'Verify a no-cors cross-origin worker script served by a service worker ' +
+   'fails shared worker start.');
+
+// ========== Worker subresource interception tests ==========
+
+const scope_for_subresource_interception = 'resources/load_worker.js';
+
+promise_test(async t => {
+  const service_worker_url = 'resources/worker-load-interceptor.js';
+  const r = await service_worker_unregister_and_register(
+      t, service_worker_url, scope_for_subresource_interception);
+  await wait_for_state(t, r.installing, 'activated');
+}, 'Register a service worker for worker subresource interception tests.');
+
+// Do not call this function multiple times without waiting for the promise
+// resolution because this sets new event handlers on |worker|.
+// TODO(nhiroki): To isolate multiple function calls, use MessagePort instead of
+// worker's onmessage event handler.
+async function request_on_worker(worker, resource_type) {
+  const data = await new Promise((resolve, reject) => {
+    if (worker instanceof Worker) {
+      worker.onmessage = e => resolve(e.data);
+      worker.onerror = e => reject(e);
+      worker.postMessage(resource_type);
+    } else if (worker instanceof SharedWorker) {
+      worker.port.onmessage = e => resolve(e.data);
+      worker.onerror = e => reject(e);
+      worker.port.postMessage(resource_type);
+    } else {
+      reject('Unexpected worker type!');
+    }
+  });
+  assert_equals(data, 'This load was successfully intercepted.');
+}
+
+async function subresource_test(worker) {
+  await request_on_worker(worker, 'xhr');
+  await request_on_worker(worker, 'fetch');
+  await request_on_worker(worker, 'importScripts');
+}
+
+promise_test(async t => {
+  await subresource_test(new Worker('resources/load_worker.js'));
+}, 'Requests on a dedicated worker controlled by a service worker.');
+
+promise_test(async t => {
+  await subresource_test(new SharedWorker('resources/load_worker.js'));
+}, 'Requests on a shared worker controlled by a service worker.');
+
+promise_test(async t => {
+  await subresource_test(new Worker('resources/nested_load_worker.js'));
+}, 'Requests on a dedicated worker nested in a dedicated worker and ' +
+       'controlled by a service worker');
+
+promise_test(async t => {
+  await subresource_test(new SharedWorker('resources/nested_load_worker.js'));
+}, 'Requests on a dedicated worker nested in a shared worker and controlled ' +
+       'by a service worker');
+
+promise_test(async t => {
+  await service_worker_unregister(t, scope_for_subresource_interception);
+}, 'Unregister a service worker for subresource interception tests.');
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/service-workers/service-worker/xhr-content-length.https.window.js b/test/fixtures/wpt/service-workers/service-worker/xhr-content-length.https.window.js
new file mode 100644
index 000000000000..1ae320e9c3c5
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/xhr-content-length.https.window.js
@@ -0,0 +1,55 @@
+// META: script=resources/test-helpers.sub.js
+
+let frame;
+
+promise_test(async (t) => {
+  const scope = "resources/empty.html";
+  const script = "resources/xhr-content-length-worker.js";
+  const registration = await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, "activated");
+  frame = await with_iframe(scope);
+}, "Setup");
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=no-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), null);
+  assert_false(event.lengthComputable);
+  assert_equals(event.total, 0);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response without Content-Length header`);
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=larger-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), "10000");
+  assert_true(event.lengthComputable);
+  assert_equals(event.total, 10000);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response with Content-Length header with value larger than response body length`);
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=double-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), "10000, 10000");
+  assert_true(event.lengthComputable);
+  assert_equals(event.total, 10000);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response with two Content-Length headers value larger than response body length`);
+
+promise_test(async t => {
+  const xhr = new frame.contentWindow.XMLHttpRequest();
+  xhr.open("GET", "test?type=bogus-content-length");
+  xhr.send();
+  const event = await new Promise(resolve => xhr.onload = resolve);
+  assert_equals(xhr.getResponseHeader("content-length"), "test");
+  assert_false(event.lengthComputable);
+  assert_equals(event.total, 0);
+  assert_equals(event.loaded, xhr.responseText.length);
+}, `Synthetic response with bogus Content-Length header`);
diff --git a/test/fixtures/wpt/service-workers/service-worker/xhr-response-url.https.html b/test/fixtures/wpt/service-workers/service-worker/xhr-response-url.https.html
new file mode 100644
index 000000000000..673ca52cc674
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/xhr-response-url.https.html
@@ -0,0 +1,103 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: XHR responseURL uses the response url</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js"></script>
+<script>
+const scope = 'resources/xhr-iframe.html';
+const script = 'resources/xhr-response-url-worker.js';
+let iframe;
+
+function build_url(options) {
+  const url = new URL('test', window.location);
+  const opts = options ? options : {};
+  if (opts.respondWith)
+    url.searchParams.set('respondWith', opts.respondWith);
+  if (opts.url)
+    url.searchParams.set('url', opts.url.href);
+  return url.href;
+}
+
+promise_test(async (t) => {
+  const registration =
+      await service_worker_unregister_and_register(t, script, scope);
+  await wait_for_state(t, registration.installing, 'activated');
+  iframe = await with_iframe(scope);
+}, 'global setup');
+
+// Test that XMLHttpRequest.responseURL uses the response URL from the service
+// worker.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to respondWith(fetch(|target|)).
+  const target = new URL('resources/sample.txt', window.location);
+  const url = build_url({
+    respondWith: 'fetch',
+    url: target
+  });
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url);
+  assert_equals(xhr.responseURL, target.href, 'responseURL');
+}, 'XHR responseURL should be the response URL');
+
+// Same as above with a generated response.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to respondWith(new Response()).
+  const url = build_url({respondWith: 'string'});
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url);
+  assert_equals(xhr.responseURL, url, 'responseURL');
+}, 'XHR responseURL should be the response URL (generated response)');
+
+// Test that XMLHttpRequest.responseXML is a Document whose URL is the
+// response URL from the service worker.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to respondWith(fetch(|target|)).
+  const target = new URL('resources/blank.html', window.location);
+  const url = build_url({
+    respondWith: 'fetch',
+    url: target
+  });
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url, {responseType: 'document'});
+  assert_equals(xhr.responseURL, target.href, 'responseURL');
+
+  // The document's URL uses the response URL:
+  // "Set |document|’s URL to |response|’s url."
+  // https://xhr.spec.whatwg.org/#document-response
+  assert_equals(xhr.responseXML.URL, target.href, 'responseXML.URL');
+
+  // The document's base URL falls back to the document URL:
+  // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#document-base-url
+  assert_equals(xhr.responseXML.baseURI, target.href, 'responseXML.baseURI');
+}, 'XHR Document should use the response URL');
+
+// Same as above with a generated response from the service worker.
+promise_test(async (t) => {
+  // Build a URL that tells the service worker to
+  // respondWith(new Response()) with a document response.
+  const url = build_url({respondWith: 'document'});
+
+  // Perform the XHR.
+  const xhr = await iframe.contentWindow.xhr(url, {responseType: 'document'});
+  assert_equals(xhr.responseURL, url, 'responseURL');
+
+  // The document's URL uses the response URL, which is the request URL:
+  // "Set |document|’s URL to |response|’s url."
+  // https://xhr.spec.whatwg.org/#document-response
+  assert_equals(xhr.responseXML.URL, url, 'responseXML.URL');
+
+  // The document's base URL falls back to the document URL:
+  // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#document-base-url
+  assert_equals(xhr.responseXML.baseURI, url, 'responseXML.baseURI');
+}, 'XHR Document should use the response URL (generated response)');
+
+promise_test(async (t) => {
+  if (iframe)
+    iframe.remove();
+  await service_worker_unregister(t, scope);
+}, 'global cleanup');
+</script>
diff --git a/test/fixtures/wpt/service-workers/service-worker/xsl-base-url.https.html b/test/fixtures/wpt/service-workers/service-worker/xsl-base-url.https.html
new file mode 100644
index 000000000000..1d3c36408a66
--- /dev/null
+++ b/test/fixtures/wpt/service-workers/service-worker/xsl-base-url.https.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Service Worker: XSL's base URL must be the response URL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="resources/test-helpers.sub.js?pipe=sub"></script>
+<script>
+// This test loads an XML document which is controlled a service worker. The
+// document loads a stylesheet and a service worker responds with another URL.
+// The stylesheet imports a relative URL to test that the base URL is the
+// response URL from the service worker.
+promise_test(async (t) => {
+  const SCOPE = 'resources/xsl-base-url-iframe.xml';
+  const SCRIPT = 'resources/xsl-base-url-worker.js';
+  let worker;
+  let frame;
+
+  t.add_cleanup(() => {
+    if (frame)
+      frame.remove();
+    service_worker_unregister(t, SCOPE);
+  });
+
+  const registration = await service_worker_unregister_and_register(
+      t, SCRIPT, SCOPE);
+  worker = registration.installing;
+  await wait_for_state(t, worker, 'activated');
+
+  frame = await with_iframe(SCOPE);
+  assert_equals(frame.contentDocument.body.textContent, 'PASS');
+}, 'base URL when service worker does respondWith(fetch(responseUrl))');
+</script>
diff --git a/test/fixtures/wpt/streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/WEB_FEATURES.yml
index d10bbe4a7d70..54ea2128f328 100644
--- a/test/fixtures/wpt/streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/WEB_FEATURES.yml
@@ -1,5 +1,3 @@
-features:
-- name: streams
-  files:
-    # Top-level only. Subdirectories have their own mapping.
-    - "*"
+rules:
+# Top-level only. Subdirectories have their own mapping.
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/idlharness.any.js b/test/fixtures/wpt/streams/idlharness.any.js
index 0be03b2078f9..42a17da58c5a 100644
--- a/test/fixtures/wpt/streams/idlharness.any.js
+++ b/test/fixtures/wpt/streams/idlharness.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm-in-window
+// META: global=window,worker
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
 // META: timeout=long
diff --git a/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml b/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
index 8cf3517baf08..0f17f6b6b657 100644
--- a/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: streams
-  files: "**"
+rules:
+- "**": [streams]
diff --git a/test/fixtures/wpt/streams/piping/abort.any.js b/test/fixtures/wpt/streams/piping/abort.any.js
index e813b017769c..f2e5429492e7 100644
--- a/test/fixtures/wpt/streams/piping/abort.any.js
+++ b/test/fixtures/wpt/streams/piping/abort.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js b/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
index 25bd475ed13e..5ea47ab85c0c 100644
--- a/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
+++ b/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js b/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
index 0ec94f80abf0..71b6e2628400 100644
--- a/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
+++ b/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js b/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
index f786469d6c1d..ec74592f86ef 100644
--- a/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
+++ b/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js b/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
index e9260f9ea22c..482da2f8a88e 100644
--- a/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
+++ b/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/flow-control.any.js b/test/fixtures/wpt/streams/piping/flow-control.any.js
index e2318da375ab..09c4420f872a 100644
--- a/test/fixtures/wpt/streams/piping/flow-control.any.js
+++ b/test/fixtures/wpt/streams/piping/flow-control.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/piping/general-addition.any.js b/test/fixtures/wpt/streams/piping/general-addition.any.js
index cf4aa9bea6a1..2562b7064338 100644
--- a/test/fixtures/wpt/streams/piping/general-addition.any.js
+++ b/test/fixtures/wpt/streams/piping/general-addition.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(async t => {
diff --git a/test/fixtures/wpt/streams/piping/general.any.js b/test/fixtures/wpt/streams/piping/general.any.js
index f051d8102c2b..272b25a28e80 100644
--- a/test/fixtures/wpt/streams/piping/general.any.js
+++ b/test/fixtures/wpt/streams/piping/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/piping/multiple-propagation.any.js b/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
index 9be828a23269..a78652fc0679 100644
--- a/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
+++ b/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/pipe-through.any.js b/test/fixtures/wpt/streams/piping/pipe-through.any.js
index 339cee199933..26b1cd26a3c8 100644
--- a/test/fixtures/wpt/streams/piping/pipe-through.any.js
+++ b/test/fixtures/wpt/streams/piping/pipe-through.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/piping/then-interception.any.js b/test/fixtures/wpt/streams/piping/then-interception.any.js
index fc48c3683114..543f916d940d 100644
--- a/test/fixtures/wpt/streams/piping/then-interception.any.js
+++ b/test/fixtures/wpt/streams/piping/then-interception.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/throwing-options.any.js b/test/fixtures/wpt/streams/piping/throwing-options.any.js
index 186f8ded1968..b9f906778f63 100644
--- a/test/fixtures/wpt/streams/piping/throwing-options.any.js
+++ b/test/fixtures/wpt/streams/piping/throwing-options.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 class ThrowingOptions {
diff --git a/test/fixtures/wpt/streams/piping/transform-streams.any.js b/test/fixtures/wpt/streams/piping/transform-streams.any.js
index e079bb637cad..caae9fbad884 100644
--- a/test/fixtures/wpt/streams/piping/transform-streams.any.js
+++ b/test/fixtures/wpt/streams/piping/transform-streams.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(() => {
diff --git a/test/fixtures/wpt/streams/queuing-strategies.any.js b/test/fixtures/wpt/streams/queuing-strategies.any.js
index 9efc4570cf2e..fa959ebba283 100644
--- a/test/fixtures/wpt/streams/queuing-strategies.any.js
+++ b/test/fixtures/wpt/streams/queuing-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const highWaterMarkConversions = new Map([
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
index a35508fc0dc6..e45d3ee347b3 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: readable-byte-streams
-  files: "**"
+rules:
+- "**": [readable-byte-streams]
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js b/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
index eae8dde03f6b..0f018d6d7819 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(() => {
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js b/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
index a26f949ee29d..8d460a1c81b7 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js b/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
index 92bd0a26a0ec..d2b37f00a9d6 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 
 promise_test(async t => {
   const error = new Error('cannot proceed');
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/general.any.js b/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
index 50f4f019ff22..6787ce1b474b 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js b/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
index 4bddaef5d647..a70bb6cb23c7 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(async t => {
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js b/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
index ce2e9e9993ae..39aa40e591ec 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js b/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
index 4010e3750ce2..a5d6ad944be5 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js b/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
index e51efa061a65..b93cec97391e 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js b/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
index 60d82b9cf6a1..2ae7e35fcb6a 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
@@ -351,6 +351,39 @@ promise_test(async () => {
 
 }, 'ReadableStream teeing with byte source: canceling branch1 should finish when branch2 reads until end of stream');
 
+promise_test(async () => {
+
+  let controller;
+  const rs = new ReadableStream({
+    type: 'bytes',
+    start(c) {
+      controller = c;
+    }
+  });
+
+  const [branch1, branch2] = rs.tee();
+  const reader1 = branch1.getReader({ mode: 'byob' });
+  const reader2 = branch2.getReader({ mode: 'byob' });
+  const cancelPromise = reader1.cancel();
+
+  controller.enqueue(new Uint8Array([0x01]));
+
+  const read2 = await reader2.read(new Uint8Array(1));
+  assert_equals(read2.done, false, 'first read() from branch2 should not be done');
+  assert_typed_array_equals(read2.value, new Uint8Array([0x01]), 'first read() from branch2');
+
+  controller.close();
+
+  const read2b = await reader2.read(new Uint8Array(1));
+  assert_equals(read2b.done, true, 'second read() from branch2 should be done');
+
+  await Promise.all([
+    reader2.closed,
+    cancelPromise
+  ]);
+
+}, 'ReadableStream teeing with byte source: canceling branch1 should finish when branch2 reads with a BYOB reader until end of stream');
+
 promise_test(async t => {
 
   let controller;
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js b/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
index e4c10f768596..8438db50e9e6 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-test-templates.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
index ad2cb549631f..46a402b60b27 100644
--- a/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
@@ -1,14 +1,6 @@
-features:
-- name: streams
-  files:
-    - "*"
-    - "!async-iterator.any.js"
-    - "!from.any.js"
-    # 'owning' type is not yet standardized
-    - "!owning-type*"
-- name: async-iterable-streams
-  files:
-    - async-iterator.any.js
-- name: readablestream-from
-  files:
-    - from.any.js
+rules:
+- async-iterator.any.js: [async-iterable-streams]
+- from.any.js: [readablestream-from]
+# 'owning' type is not yet standardized
+- owning-type*: []
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js b/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
index e192201b531d..d815e9d1a16b 100644
--- a/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js b/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
index 49fa4bdbece5..409c63b8177e 100644
--- a/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js b/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
index 3d77b923d178..e9cf4c924930 100644
--- a/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 
diff --git a/test/fixtures/wpt/streams/readable-streams/cancel.any.js b/test/fixtures/wpt/streams/readable-streams/cancel.any.js
index d44222f1497f..8e186be586c1 100644
--- a/test/fixtures/wpt/streams/readable-streams/cancel.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/cancel.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/constructor.any.js b/test/fixtures/wpt/streams/readable-streams/constructor.any.js
index 0b995f0cb16b..608dc48cfa39 100644
--- a/test/fixtures/wpt/streams/readable-streams/constructor.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/constructor.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js b/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
index a8c1b91d0068..02ac5bae5c2f 100644
--- a/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
index f4eaacc3edb4..fb282ca004eb 100644
--- a/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
@@ -1,7 +1,3 @@
-features:
-- name: streams
-  files:
-    - strategy-worker-terminate.html
-- name: readablestream-from
-  files:
-    - from-cross-realm.https.html
+rules:
+- strategy-worker-terminate.html: [streams]
+- from-cross-realm.https.html: [readablestream-from]
diff --git a/test/fixtures/wpt/streams/readable-streams/default-reader.any.js b/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
index f92862719e47..59d7ab2f74db 100644
--- a/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js b/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
index 8b88c21d7f0b..50cca3d951a9 100644
--- a/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Due to the limitations of floating-point precision, the calculation of desiredSize sometimes gives different answers
diff --git a/test/fixtures/wpt/streams/readable-streams/from.any.js b/test/fixtures/wpt/streams/readable-streams/from.any.js
index 2b28a05fee39..d8144c5f4c8a 100644
--- a/test/fixtures/wpt/streams/readable-streams/from.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/from.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
@@ -18,11 +18,6 @@ const iterableFactories = [
     return ['a', 'b'][Symbol.iterator]();
   }],
 
-  ['a string', () => {
-    // This iterates over the code points of the string.
-    return 'ab';
-  }],
-
   ['a Set', () => {
     return new Set(['a', 'b']);
   }],
@@ -81,6 +76,19 @@ const iterableFactories = [
     return iterable;
   }],
 
+  ['a sync iterable with a function iterator', () => {
+    const chunks = ['a', 'b'];
+    function functionIterator() {}
+    functionIterator.next = () => ({
+      done: chunks.length === 0,
+      value: chunks.shift()
+    });
+    const iterable = {
+      [Symbol.iterator]: () => functionIterator
+    };
+    return iterable;
+  }],
+
   ['an async iterable', () => {
     const chunks = ['a', 'b'];
     const asyncIterator = {
@@ -97,6 +105,19 @@ const iterableFactories = [
     return asyncIterable;
   }],
 
+  ['an async iterable with a function iterator', () => {
+    const chunks = ['a', 'b'];
+    function functionAsyncIterator() {}
+    functionAsyncIterator.next = () => Promise.resolve({
+      done: chunks.length === 0,
+      value: chunks.shift()
+    });
+    const asyncIterable = {
+      [Symbol.asyncIterator]: () => functionAsyncIterator
+    };
+    return asyncIterable;
+  }],
+
   ['a ReadableStream', () => {
     return new ReadableStream({
       start(c) {
@@ -144,6 +165,7 @@ const badIterables = [
   ['Object.create(null)', Object.create(null)],
   ['a function', () => 42],
   ['a symbol', Symbol()],
+  ['a string', 'ab'],
   ['an object with a non-callable @@iterator method', {
     [Symbol.iterator]: 42
   }],
diff --git a/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js b/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
index abcb4cf21b89..907eb6006822 100644
--- a/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=/common/gc.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/general.any.js b/test/fixtures/wpt/streams/readable-streams/general.any.js
index eee3f62215ee..2a32b27943c8 100644
--- a/test/fixtures/wpt/streams/readable-streams/general.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
similarity index 97%
rename from test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
index 282c1f411485..e9961ce04225 100644
--- a/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.tentative.any.js
similarity index 100%
rename from test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.tentative.any.js
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
similarity index 98%
rename from test/fixtures/wpt/streams/readable-streams/owning-type.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
index 34c2a55d5134..27a3dda894e4 100644
--- a/test/fixtures/wpt/streams/readable-streams/owning-type.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/patched-global.any.js b/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
index c208824c8644..a64a054a97f1 100644
--- a/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Tests which patch the global environment are kept separate to avoid
diff --git a/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js b/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
index 8ae7b98e8d5e..b4988bc2433f 100644
--- a/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
diff --git a/test/fixtures/wpt/streams/readable-streams/tee.any.js b/test/fixtures/wpt/streams/readable-streams/tee.any.js
index c2c2e4823072..00397932f4b6 100644
--- a/test/fixtures/wpt/streams/readable-streams/tee.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/tee.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/readable-streams/templated.any.js b/test/fixtures/wpt/streams/readable-streams/templated.any.js
index 4f2440c0880b..8fdb0176ceff 100644
--- a/test/fixtures/wpt/streams/readable-streams/templated.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/templated.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-test-templates.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml b/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
index 4ecacf5edbc7..a21859368559 100644
--- a/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: transferable-streams
-  files: "**"
+rules:
+- "**": [transferable-streams]
diff --git a/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js b/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
index 05914e12ccbe..3679eb7b140a 100644
--- a/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
+++ b/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 const combinations = [
   (t => [t, t.readable])(new TransformStream()),
diff --git a/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
index f39dc16de4c7..197d23a07ffa 100644
--- a/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
@@ -1,8 +1,3 @@
-features:
-- name: streams
-  files:
-    - "*"
-    - "!cancel.any.js"
-- name: transformstream-transformer-cancel
-  files:
-    - cancel.any.js
+rules:
+- cancel.any.js: [transformstream-transformer-cancel]
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/transform-streams/backpressure.any.js b/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
index 47a21fb7e71f..6befba41b795 100644
--- a/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/cancel.any.js b/test/fixtures/wpt/streams/transform-streams/cancel.any.js
index 9b369bfb7c68..fc5ef9570404 100644
--- a/test/fixtures/wpt/streams/transform-streams/cancel.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/cancel.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/errors.any.js b/test/fixtures/wpt/streams/transform-streams/errors.any.js
index bea060b65908..7efe894f4887 100644
--- a/test/fixtures/wpt/streams/transform-streams/errors.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/errors.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/flush.any.js b/test/fixtures/wpt/streams/transform-streams/flush.any.js
index c95d8ae11865..487de1c93b0f 100644
--- a/test/fixtures/wpt/streams/transform-streams/flush.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/flush.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/general.any.js b/test/fixtures/wpt/streams/transform-streams/general.any.js
index a40ef30843ec..dff2e7e8a70d 100644
--- a/test/fixtures/wpt/streams/transform-streams/general.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js b/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
index e334705db443..f9f148aaf1c6 100644
--- a/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 class LipFuzzTransformer {
diff --git a/test/fixtures/wpt/streams/transform-streams/patched-global.any.js b/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
index cc111eda452f..2d04e3b948b3 100644
--- a/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Tests which patch the global environment are kept separate to avoid
diff --git a/test/fixtures/wpt/streams/transform-streams/properties.any.js b/test/fixtures/wpt/streams/transform-streams/properties.any.js
index dbfd1aa372b9..02981b8bc76a 100644
--- a/test/fixtures/wpt/streams/transform-streams/properties.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/properties.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const transformerMethods = {
diff --git a/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js b/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
index a6d459655856..306cce8fc8b7 100644
--- a/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
diff --git a/test/fixtures/wpt/streams/transform-streams/strategies.any.js b/test/fixtures/wpt/streams/transform-streams/strategies.any.js
index 57e113e668ce..94055ad99dc9 100644
--- a/test/fixtures/wpt/streams/transform-streams/strategies.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/terminate.any.js b/test/fixtures/wpt/streams/transform-streams/terminate.any.js
index a959e70fe693..670006366db2 100644
--- a/test/fixtures/wpt/streams/transform-streams/terminate.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/terminate.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
index 8cf3517baf08..0f17f6b6b657 100644
--- a/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: streams
-  files: "**"
+rules:
+- "**": [streams]
diff --git a/test/fixtures/wpt/streams/writable-streams/aborting.any.js b/test/fixtures/wpt/streams/writable-streams/aborting.any.js
index 9d8e80b1de63..58362b766901 100644
--- a/test/fixtures/wpt/streams/writable-streams/aborting.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/aborting.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js b/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
index a1ef0791168f..63fa443065ee 100644
--- a/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('a unique string');
diff --git a/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js b/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
index 3c434ffe60cc..d0b3467978ea 100644
--- a/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
index eed86ee7004e..ce1962e8917f 100644
--- a/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(t => {
diff --git a/test/fixtures/wpt/streams/writable-streams/close.any.js b/test/fixtures/wpt/streams/writable-streams/close.any.js
index 3b2c07cc3bfe..9c1bc93b011d 100644
--- a/test/fixtures/wpt/streams/writable-streams/close.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/close.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/constructor.any.js b/test/fixtures/wpt/streams/writable-streams/constructor.any.js
index bb382a33b8e0..ba54e39cdbc5 100644
--- a/test/fixtures/wpt/streams/writable-streams/constructor.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/constructor.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
index 8211757530d3..064e16e81506 100644
--- a/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/writable-streams/error.any.js b/test/fixtures/wpt/streams/writable-streams/error.any.js
index d08c8a54863b..faf3fdd95214 100644
--- a/test/fixtures/wpt/streams/writable-streams/error.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js b/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
index 20a14fc19a51..bd34cc53a695 100644
--- a/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Due to the limitations of floating-point precision, the calculation of desiredSize sometimes gives different answers
diff --git a/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js b/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
index 5e39e7c60d2c..a5d935c9aa00 100644
--- a/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=/common/gc.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/writable-streams/general.any.js b/test/fixtures/wpt/streams/writable-streams/general.any.js
index 48f8eeb89e41..cede7fd0845b 100644
--- a/test/fixtures/wpt/streams/writable-streams/general.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/writable-streams/properties.any.js b/test/fixtures/wpt/streams/writable-streams/properties.any.js
index ae0549f0871b..c95bd7d0c080 100644
--- a/test/fixtures/wpt/streams/writable-streams/properties.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/properties.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const sinkMethods = {
diff --git a/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
index 18ce9e84759a..eb05cc068043 100644
--- a/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/start.any.js b/test/fixtures/wpt/streams/writable-streams/start.any.js
index 17972b568ceb..82d869430dd7 100644
--- a/test/fixtures/wpt/streams/writable-streams/start.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/start.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/write.any.js b/test/fixtures/wpt/streams/writable-streams/write.any.js
index 20a2885bf351..f0246f6cad39 100644
--- a/test/fixtures/wpt/streams/writable-streams/write.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/write.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/url/resources/urltestdata.json b/test/fixtures/wpt/url/resources/urltestdata.json
index c4807f9e2cfc..aae7b1f65683 100644
--- a/test/fixtures/wpt/url/resources/urltestdata.json
+++ b/test/fixtures/wpt/url/resources/urltestdata.json
@@ -7581,6 +7581,18 @@
     "hash": ""
   },
   "# IPv6 tests",
+  "IPv4 pieces embedded in IPv6 addresses must not have leading zeroes",
+  {
+    "input": "https://[0:1:2:3:4:5:192.0.02.1]/",
+    "base": null,
+    "failure": true
+  },
+  "An embedded IPv4 address must end the IPv6 address",
+  {
+    "input": "https://[192.0.2.1::]/",
+    "base": null,
+    "failure": true
+  },
   {
     "input": "http://[1:0::]",
     "base": "http://example.net/",
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index e04c397be444..fa3732a0e9fd 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -52,7 +52,7 @@
     "path": "html/webappapis/timers"
   },
   "interfaces": {
-    "commit": "a8392bd0210378dda13278eeccf2c2602278e214",
+    "commit": "3f15e5c09448b8e917c9128d3b07cc78f044c83a",
     "path": "interfaces"
   },
   "performance-timeline": {
@@ -67,12 +67,16 @@
     "commit": "6a2f32237615d7ea9c1eb1e30453066b5555c603",
     "path": "resources"
   },
+  "service-workers": {
+    "commit": "b7ed7c8dcd260f0f80879577752c68f042a7d054",
+    "path": "service-workers"
+  },
   "streams": {
-    "commit": "f8f26a372f357370846226ff64db1f9cc98a1edb",
+    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
     "path": "streams"
   },
   "url": {
-    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
+    "commit": "c23755a1449cc9c5a9131378c13ecf073c0885c6",
     "path": "url"
   },
   "urlpattern": {
@@ -100,7 +104,7 @@
     "path": "WebCryptoAPI"
   },
   "webidl": {
-    "commit": "63ca529a021fec15b2996db82fd7dd04c11abe85",
+    "commit": "65bbe07908e5c19e8a6c7ff8701cc2a722cd215e",
     "path": "webidl"
   },
   "webidl/ecmascript-binding/es-exceptions": {
@@ -114,5 +118,9 @@
   "webstorage": {
     "commit": "1d2c5fb36a6e477c8f915bde7eca027be6abe792",
     "path": "webstorage"
+  },
+  "workers": {
+    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
+    "path": "workers"
   }
 }
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
new file mode 100644
index 000000000000..b4cd1e37fd94
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>WebIDL [AllowShared] semantics</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#AllowShared">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/sab.js"></script>
+<script>
+  "use strict";
+
+  test(t => {
+    // Create a standard SharedArrayBuffer (safe even without COOP/COEP headers)
+    const sab = createBuffer('SharedArrayBuffer', 128);
+    const arr = new Uint8Array(sab);
+    arr.fill(42);
+    assert_equals(sab.constructor.name, 'SharedArrayBuffer');
+    new ImageDecoder({
+      data: arr,
+      // We don't really need encoding to succeed, just for argument conversion before the native call.
+      type: "invalid"
+    });
+
+    assert_throws_js(TypeError, () => {
+      new MIDIMessageEvent('message', { data: arr });
+    }, "An attempt to pass a view backed by a shared array buffer should throw");
+
+  }, "APIs without [AllowShared] do not accept SharedArrayBuffer-backed views with pre-existing wrapper");
+
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
index 9b6978783723..856d13681e60 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
index 011521652654..ca0fc84fc66a 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 test(function() {
     assert_own_property(self, "DOMException", "property of global");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
index c4ddabdafd45..10aad220b917 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
index d1c86930d4cd..467bf054c3a9 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
index 6f3097b222ed..dc39c978217b 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
new file mode 100644
index 000000000000..24f6fd486bdc
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
@@ -0,0 +1,80 @@
+// META: global=window,dedicatedworker
+
+// https://tc39.es/proposal-error-stack-accessor/
+// https://github.com/whatwg/webidl/pull/1421
+
+"use strict";
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() has a stack property that is a string");
+
+test(() => {
+  const e = new DOMException();
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() with no arguments has a stack property that is a string");
+
+if (typeof document !== "undefined") {
+  test(() => {
+    let caught;
+    try {
+      document.createElement("");
+    } catch (e) {
+      caught = e;
+    }
+    assert_true(caught instanceof DOMException, "must be a DOMException");
+    assert_equals(typeof caught.stack, "string", "stack must be a string");
+  }, "thrown DOMException from DOM API has a stack property that is a string");
+}
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_false(e.hasOwnProperty("stack"), "stack must not be an own property of the instance");
+}, "DOMException instance does not have an own stack property");
+
+test(() => {
+  assert_false(DOMException.prototype.hasOwnProperty("stack"),
+    "DOMException.prototype must not have an own stack property");
+}, "DOMException.prototype does not have an own stack property");
+
+test(() => {
+  const desc = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_not_equals(desc, undefined, "Error.prototype must have a stack property descriptor");
+  assert_equals(typeof desc.get, "function", "stack must have a getter");
+  assert_equals(typeof desc.set, "function", "stack must have a setter");
+  assert_false(desc.enumerable, "stack must not be enumerable");
+  assert_true(desc.configurable, "stack must be configurable");
+}, "Error.prototype.stack is an accessor property with correct attributes");
+
+test(() => {
+  const getter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").get;
+  const e = new DOMException("some message", "SyntaxError");
+  const stack = getter.call(e);
+  assert_equals(typeof stack, "string", "getter must return a string for DOMException");
+  assert_equals(stack, e.stack, "getter result must match e.stack");
+}, "Error.prototype.stack getter works on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  const e = new DOMException("some message", "SyntaxError");
+  setter.call(e, "custom stack");
+  assert_true(e.hasOwnProperty("stack"), "after setter, stack must be an own property");
+  assert_equals(e.stack, "custom stack", "own stack property must have the set value");
+
+  const desc = Object.getOwnPropertyDescriptor(e, "stack");
+  assert_equals(desc.value, "custom stack", "must be a data property");
+  assert_true(desc.writable, "must be writable");
+  assert_true(desc.enumerable, "must be enumerable");
+  assert_true(desc.configurable, "must be configurable");
+}, "Error.prototype.stack setter installs own data property on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  // SetterThatIgnoresPrototypeProperties should not install a property on Error.prototype itself
+  const originalStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  setter.call(Error.prototype, "custom stack");
+  const afterStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_equals(typeof afterStack.get, "function",
+    "Error.prototype.stack must still be an accessor after calling setter on it");
+}, "Error.prototype.stack setter ignores Error.prototype itself");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
deleted file mode 100644
index eba96e9adf46..000000000000
--- a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
+++ /dev/null
@@ -1,27 +0,0 @@
-// META: global=shadowrealm
-// META: title=Mutability of the global prototype chain
-
-const objects = [];
-setup(() => {
-  for (let object = self; object; object = Object.getPrototypeOf(object)) {
-    objects.push(object);
-  }
-});
-
-test(() => {
-  for (const object of objects) {
-    const proto = Object.getPrototypeOf(object);
-    const plainObject = {};
-    Object.setPrototypeOf(object, plainObject);
-    assert_equals(Object.getPrototypeOf(object), plainObject);
-    Object.setPrototypeOf(object, proto);
-  }
-}, "Setting to a different prototype");
-
-test(() => {
-  for (const object of objects) {
-    const expected = Object.getPrototypeOf(object);
-    Object.setPrototypeOf(object, expected);
-    assert_equals(Object.getPrototypeOf(object), expected);
-  }
-}, "Setting to the same prototype");
diff --git a/test/fixtures/wpt/webidl/idlharness.any.js b/test/fixtures/wpt/webidl/idlharness.any.js
index f8b285c485c4..164fa0e65c8d 100644
--- a/test/fixtures/wpt/webidl/idlharness.any.js
+++ b/test/fixtures/wpt/webidl/idlharness.any.js
@@ -1,6 +1,6 @@
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
-// META: global=window,dedicatedworker,shadowrealm-in-window
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/workers/META.yml b/test/fixtures/wpt/workers/META.yml
new file mode 100644
index 000000000000..b5b28235ce15
--- /dev/null
+++ b/test/fixtures/wpt/workers/META.yml
@@ -0,0 +1,5 @@
+spec: https://html.spec.whatwg.org/multipage/workers.html
+suggested_reviewers:
+  - caitp
+  - jdm
+  - annevk
diff --git a/test/fixtures/wpt/workers/README.md b/test/fixtures/wpt/workers/README.md
new file mode 100644
index 000000000000..58ee7cca1ab3
--- /dev/null
+++ b/test/fixtures/wpt/workers/README.md
@@ -0,0 +1,140 @@
+# Worker WPT tests
+
+These are the workers (`Worker`, `SharedWorker`) tests for the
+[Web workers chapter of the HTML Standard](https://html.spec.whatwg.org/multipage/workers.html).
+
+See also
+[testharness.js API > Web Workers](https://web-platform-tests.org/writing-tests/testharness-api.html#web-workers).
+
+Note that because workers are defined in the HTML Standard, the idlharness.js
+tests are in [/html/dom]([/html/dom) instead of here.
+
+## Writing `*.any.js`
+
+The easiest and most recommended way to write tests for workers
+is to create .any.js-style tests.
+
+Official doc:
+[WPT > File Name Flags > Test Features](https://web-platform-tests.org/writing-tests/file-names.html#test-features).
+
+- Standard `testharness.js`-style can be used (and is enforced).
+- The same test can be run on window and many types of workers.
+- All glue code are automatically generated.
+- No need to care about how to create and communicate with each type of workers,
+  thanks to `fetch_tests_from_worker` in `testharness.js`.
+
+Converting existing tests into `.any.js`-style also has benefits:
+
+- Multiple tests can be merged into one.
+- Tests written for window can be run on workers
+  with a very low development cost.
+
+### How to write tests
+
+If you write `testharness.js`-based tests in `foo.any.js` and
+specify types of workers to be tested,
+the test can run on any of dedicated, shared and service workers.
+
+See `examples/general.any.js` for example.
+
+Even for testing specific features in a specific type of workers
+(e.g. shared worker's `onconnect`), `.any.js`-style tests can be used.
+
+See `examples/onconnect.any.js` for example.
+
+### How to debug tests
+
+Whether each individual test passed or failed,
+and its assertion failures (if any) are all reported in the final results.
+
+`console.log()` might not appear in the test results and
+thus might not be useful for printf debugging.
+For example, in Chromium, this message
+
+- Appears (in stderr) on a window or a dedicated worker, but
+- Does NOT appear on a shared worker or a service worker.
+
+### How it works
+
+`.any.js`-style tests use
+`fetch_tests_from_worker` functionality of `testharness.js`.
+
+The WPT test server generates necessary glue code
+(including generated Document HTML and worker top-level scripts).
+See
+[serve.py](https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py)
+for the actual glue code.
+
+Note that `.any.js` file is not the worker top-level script,
+and currently we cannot set response headers to the worker top-level script,
+e.g. to set Referrer Policy of the workers.
+
+## Writing `*.worker.js`
+
+Similar to `.any.js`, you can also write `.worker.js`
+for tests only for dedicated workers.
+Almost the same as `.any.js`, except for the things listed below.
+
+Official doc:
+[WPT > File Name Flags > Test Features](https://web-platform-tests.org/writing-tests/file-names.html#test-features).
+
+### How to write tests
+
+You have to write two things manually (which is generated in `.any.js` tests):
+
+- `importScripts("/resources/testharness.js");` at the beginning.
+- `done();` at the bottom.
+
+Note: Even if you write `async_test()` or `promise_test()`,
+this global `done()` is always needed
+(this is different from async_test's `done()`)
+for dedicated workers and shared workers.
+See official doc:
+[testharness.js API > Determining when all tests are complete](https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete).
+
+See `examples/general.worker.js` for example.
+
+### How it works
+
+`.worker.js`-style tests also use
+`fetch_tests_from_worker` functionality of `testharness.js`.
+
+The WPT test server generates glue code in Document HTML-side,
+but not for worker top-level scripts.
+This is why you have to manually write `importScripts()` etc.
+See
+[serve.py](https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py)
+for the actual glue code.
+
+Unlike `*.any.js` cases, the `*.worker.js` is the worker top-level script.
+
+## Using `fetch_tests_from_worker`
+
+If you need more flexibility,
+writing tests using `fetch_tests_from_worker` is the way to go.
+For example, when
+
+- Additional processing is needed on the parent Document.
+- Workers should be created in a specific way.
+- You are writing non-WPT tests using `testharness.js`.
+
+You have to write the main HTMLs and the worker scripts,
+but most of the glue code needed for running tests on workers
+are provided by `fetch_tests_from_worker`.
+
+### How to write tests
+
+See
+
+- `examples/fetch_tests_from_worker.html` and
+  `examples/fetch_tests_from_worker.js`.
+
+## Writing the whole tests manually
+
+If `fetch_tests_from_worker` isn't suitable for your specific case
+(which should be rare but might be still possible),
+you have to write the whole tests,
+including the main Document HTML, worker scripts,
+and message passing code between them.
+
+TODO: Supply the templates for writing this kind of tests.
diff --git a/test/fixtures/wpt/workers/SharedWorker-MessageEvent-source.any.js b/test/fixtures/wpt/workers/SharedWorker-MessageEvent-source.any.js
new file mode 100644
index 000000000000..e47fd0653550
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-MessageEvent-source.any.js
@@ -0,0 +1,6 @@
+// META: global=sharedworker
+const t = async_test("Make sure that MessageEvent.source is properly set in connect event.");
+onconnect = t.step_func_done((event) => {
+  assert_equals(Object.getPrototypeOf(event), MessageEvent.prototype);
+  assert_equals(event.source, event.ports[0]);
+});
diff --git a/test/fixtures/wpt/workers/SharedWorker-constructor.html b/test/fixtures/wpt/workers/SharedWorker-constructor.html
new file mode 100644
index 000000000000..6298dd934e11
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-constructor.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<title>Test SharedWorker constructor functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+test(() => {
+  assert_throws_js(Error,
+                   function() {
+                     new SharedWorker({toString:function(){throw new Error()}}, "name") },
+                   "toString exception not propagated");
+}, "Test toString exception propagated correctly.");
+
+test(() => {
+  assert_throws_js(RangeError,
+                   function() {
+                     var foo = {toString:function(){new Worker(foo)}}
+                     new SharedWorker(foo, name); },
+                   "Trying to create workers recursively did not result in an exception.");
+}, "Test recursive worker creation results in exception.");
+
+test(() => {
+  assert_throws_js(TypeError,
+                   function() { new SharedWorker(); },
+                   "Invoking SharedWorker constructor without arguments did not result in an exception.");
+}, "Test SharedWorker creation without arguments results in exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js");
+  } catch (ex) {
+    assert_unreached("Constructor failed when no name is passed: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor without a name does not result in an exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js", null);
+  } catch (ex) {
+    assert_unreached("Constructor failed when null name is passed: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor with null name does not result in an exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js", undefined);
+  } catch (ex) {
+    assert_unreached("Constructor failed when undefined name is passed: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor with undefined name does not result in an exception.");
+
+test(() => {
+  try {
+    var worker = new SharedWorker("support/SharedWorker-common.js", "name");
+  } catch (ex) {
+    assert_unreached("Invoking SharedWorker constructor resulted in an exception: (" + ex + ")");
+  }
+}, "Test SharedWorker constructor suceeds.");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-detach-frame-in-error-event.html b/test/fixtures/wpt/workers/SharedWorker-detach-frame-in-error-event.html
new file mode 100644
index 000000000000..7363265fbc3c
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-detach-frame-in-error-event.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Test frame detach in shared worker's error handler</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<iframe id="frame"></iframe>
+</body>
+<script>
+promise_test(t => {
+  const frame = document.getElementById('frame');
+
+  const promise = new Promise(resolve => {
+    window.detachFrame = () => {
+      frame.remove();
+      resolve();
+    };
+  });
+
+  // Start a new worker with an invalid script in the frame, and detach the
+  // frame in the worker's error handler. This shouldn't crash.
+  const s = frame.contentWindow.document.createElement('script');
+  s.innerHTML = "const worker = new SharedWorker('error');" +
+                "worker.onerror = () => { window.parent.detachFrame(); };";
+  frame.contentWindow.document.body.appendChild(s);
+
+  return promise;
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-exception-propagation.html b/test/fixtures/wpt/workers/SharedWorker-exception-propagation.html
new file mode 100644
index 000000000000..5823a19a4bfa
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-exception-propagation.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Uncaught error in shared worker should not propagate to window</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/workers.html#runtime-script-errors-2">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/SharedWorker-create-common.js"></script>
+<script>
+// Suppress the default handling of the error event so that a failure
+// manifests as a failed test and not a harness error.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+    addEventListener("error", t.unreached_func("error event fired"));
+    var worker = createWorker();
+    worker.postMessage("throw");
+    worker.postMessage("ping");
+    var pongs = 0;
+    worker.onmessage = function(evt) {
+        // Wait for response from ping - that's how we know we have thrown the exception.
+        if (evt.data == "PASS: Received ping message") {
+            pongs++;
+            if (pongs == 1) {
+                // Send another "ping" message and wait for the response before
+                // ending the test, so that any error propagation that is now
+                // in flight will have finished.
+                worker.postMessage("ping");
+            } else {
+                t.done();
+            }
+        }
+    };
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-exception.html b/test/fixtures/wpt/workers/SharedWorker-exception.html
new file mode 100644
index 000000000000..28b858485727
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-exception.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>This test checks whether exceptions in SharedWorkers are logged to the parent document. An exception should be logged to the error console.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/SharedWorker-create-common.js"></script>
+<script>
+// Ignore any error event fired on window in this test. This is tested
+// separately in SharedWorker-exception-propagation.html.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+    var worker = createWorker();
+    worker.postMessage("throw");
+    worker.postMessage("ping");
+    worker.onmessage = function(evt) {
+        // Wait for response from ping - that's how we know we have thrown the exception.
+        if (evt.data == "PASS: Received ping message") {
+            t.done();
+        }
+    };
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-blob.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-blob.html
new file mode 100644
index 000000000000..5a3945c59185
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-blob.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime (Blob URL)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+const createBlobWorkerAndStore = async (uuid) => {
+  const script = `
+    let stored_data = null;
+    self.onconnect = e => {
+      const port = e.ports[0];
+      port.onmessage = msg => {
+        if (msg.data.op === 'store') {
+          stored_data = msg.data.data;
+          port.postMessage({status: 'OK', reqid: msg.data.reqid});
+        } else if (msg.data.op === 'load') {
+          port.postMessage({status: 'OK', data: stored_data, reqid: msg.data.reqid});
+        }
+      };
+    };
+  `;
+  const blob = new Blob([script], {type: 'application/javascript'});
+  const url = URL.createObjectURL(blob);
+  window.worker = new SharedWorker(url, {extendedLifetime: true});
+  worker.port.start();
+  await new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 1) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'store', data: uuid, reqid: 1});
+  });
+  return url;
+};
+
+const connectAndLoad = async (url) => {
+  window.worker = new SharedWorker(url, {extendedLifetime: true});
+  worker.port.start();
+  return new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 2) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'load', reqid: 2});
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  const blobUrl = await ctx.execute_script(createBlobWorkerAndStore, [uuid]);
+  popup.close();
+
+  // The blob URL might be revoked in the popup's context upon close,
+  // but the SharedWorker should survive because of extendedLifetime.
+  // A new connection from this page should still match the existing worker.
+  const response = await connectAndLoad(blobUrl);
+  assert_equals(response.status, 'OK');
+  assert_equals(response.data, uuid);
+}, "Blob URL SharedWorker should survive across navigations with extendedLifetime");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-data.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-data.html
new file mode 100644
index 000000000000..96e45c4af50c
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-data.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime (Data URL)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+const dataUrl = "data:application/javascript," + encodeURIComponent(`
+  let stored_data = null;
+  self.onconnect = e => {
+    const port = e.ports[0];
+    port.onmessage = msg => {
+      if (msg.data.op === 'store') {
+        stored_data = msg.data.data;
+        port.postMessage({status: 'OK', reqid: msg.data.reqid});
+      } else if (msg.data.op === 'load') {
+        port.postMessage({status: 'OK', data: stored_data, reqid: msg.data.reqid});
+      }
+    };
+  };
+`);
+
+const createDataWorkerAndStore = async (uuid, dataUrl) => {
+  window.worker = new SharedWorker(dataUrl, {extendedLifetime: true});
+  worker.port.start();
+  await new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 1) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'store', data: uuid, reqid: 1});
+  });
+};
+
+const connectAndLoad = async (dataUrl) => {
+  window.worker = new SharedWorker(dataUrl, {extendedLifetime: true});
+  worker.port.start();
+  return new Promise(resolve => {
+    const listener = e => {
+      if (e.data.reqid === 2) {
+        worker.port.removeEventListener('message', listener);
+        resolve(e.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage({op: 'load', reqid: 2});
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  await ctx.execute_script(createDataWorkerAndStore, [uuid, dataUrl]);
+  popup.close();
+
+  // The SharedWorker created with data: URL should survive because of extendedLifetime.
+  const response = await connectAndLoad(dataUrl);
+  assert_equals(response.status, 'OK');
+  assert_equals(response.data, uuid);
+}, "Data URL SharedWorker should survive across navigations with extendedLifetime");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-named-module.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-named-module.html
new file mode 100644
index 000000000000..543c5b24933f
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime-named-module.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime (Named and Module)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+const connectToSharedWorker = async (options) => {
+  window.worker = new SharedWorker(
+    '/workers/resources/shared-worker-memory.js', options);
+  worker.port.start();
+};
+
+const postAndWait = async (data) => {
+  return new Promise(resolve => {
+    const listener = event => {
+      if (event.data.reqid !== data.reqid) {
+        return;
+      }
+      worker.port.removeEventListener('message', listener);
+      resolve(event.data);
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage(data);
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const options = {name: 'named-worker', extendedLifetime: true};
+
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  await ctx.execute_script(connectToSharedWorker, [options]);
+  await ctx.execute_script(postAndWait, [{reqid: 1, op: 'store', data: uuid}]);
+  popup.close();
+
+  // Wait for potential worker teardown (if extendedLifetime were not working)
+  await new Promise(resolve => setTimeout(resolve, 100));
+
+  const ctx2 = new RemoteContext(token());
+  const popup2 = window.open(remoteExecutorUrl(ctx2.context_id));
+  await ctx2.execute_script(connectToSharedWorker, [options]);
+  const response = await ctx2.execute_script(postAndWait, [{reqid: 2, op: 'load'}]);
+  assert_equals(response.data, uuid);
+}, "Named SharedWorker should survive across navigations with extendedLifetime");
+
+promise_test(async t => {
+  const uuid = token();
+  const options = {type: 'module', extendedLifetime: true};
+
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  await ctx.execute_script(connectToSharedWorker, [options]);
+  await ctx.execute_script(postAndWait, [{reqid: 10, op: 'store', data: uuid}]);
+  popup.close();
+
+  // Wait for potential worker teardown
+  await new Promise(resolve => setTimeout(resolve, 100));
+
+  const ctx2 = new RemoteContext(token());
+  const popup2 = window.open(remoteExecutorUrl(ctx2.context_id));
+  await ctx2.execute_script(connectToSharedWorker, [options]);
+  const response = await ctx2.execute_script(postAndWait, [{reqid: 11, op: 'load'}]);
+  assert_equals(response.data, uuid);
+}, "Module SharedWorker should survive across navigations with extendedLifetime");
+
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-extendedLifetime.html b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime.html
new file mode 100644
index 000000000000..a0fb0a007b7d
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-extendedLifetime.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<title>SharedWorker extendedLifetime</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script>
+
+/**
+ * Connects to a SharedWorker and performs a single message exchange.
+ * Used both in the main window and in the popup via execute_script.
+ */
+const connectAndOperate = async (url, data) => {
+  const worker = new SharedWorker(url, {extendedLifetime: true});
+  worker.port.start();
+  return new Promise(resolve => {
+    const listener = event => {
+      if (event.data.reqid === data.reqid) {
+        worker.port.removeEventListener('message', listener);
+        resolve(event.data);
+      }
+    };
+    worker.port.addEventListener('message', listener);
+    worker.port.postMessage(data);
+  });
+};
+
+promise_test(async t => {
+  const uuid = token();
+  const worker_url = '/workers/resources/shared-worker-memory.js?' + token();
+  const ctx = new RemoteContext(token());
+  const popup = window.open(remoteExecutorUrl(ctx.context_id));
+  t.add_cleanup(() => popup.close());
+
+  // 1. Store data from the popup side.
+  const popup_response = await ctx.execute_script(connectAndOperate, [
+    worker_url, {op: 'store', data: uuid, reqid: 1}
+  ]);
+  assert_equals(popup_response.status, 'OK');
+  popup.close();
+
+  // Wait to ensure the worker survives across the client's disappearance.
+  await new Promise(resolve => setTimeout(resolve, 1000));
+
+  // 2. Load data from the main window side.
+  const response = await connectAndOperate(worker_url, {op: 'load', reqid: 2});
+
+  assert_equals(response.status, 'OK');
+  assert_equals(response.data, uuid);
+}, "SharedWorker lifetime should be extended with extendedLifetime");
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-replace-EventHandler.any.js b/test/fixtures/wpt/workers/SharedWorker-replace-EventHandler.any.js
new file mode 100644
index 000000000000..90c7d2d08d17
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-replace-EventHandler.any.js
@@ -0,0 +1,15 @@
+// META: global=sharedworker
+// https://crbug.com/239669
+const t = async_test("Tests that repeatedly setting 'onerror' within a shared worker doesnt crash.");
+onconnect = t.step_func_done((event) => {
+  function update() {
+    onerror = undefined;
+  }
+  try {
+    for (var i = 0; i < 8; ++i) {
+      update();
+    }
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while updating onerror event handler.");
+  }
+});
diff --git a/test/fixtures/wpt/workers/SharedWorker-script-error.html b/test/fixtures/wpt/workers/SharedWorker-script-error.html
new file mode 100644
index 000000000000..3c93cc038f27
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-script-error.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<title>Test SharedWorker script error handling functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+    let worker;
+
+    return new Promise((resolve) => {
+        worker = new SharedWorker("support/SharedWorker-script-error.js");
+        // Shared workers should only invoke onerror for loading errors.
+        worker.onerror = function(evt) {
+            assert_unreached("FAIL: onerror invoked for a script error.");
+        };
+        worker.port.postMessage("unhandledError");
+        worker.port.onmessage = resolve;
+    }).then(e => {
+        assert_equals(e.data, "SUCCESS: unhandled error generated");
+    });
+}, 'Test script error unhandled.')
+
+promise_test(t => {
+    let worker;
+
+    return new Promise((resolve) => {
+        worker = new SharedWorker("support/SharedWorker-script-error.js");
+        // Shared workers should only invoke onerror for loading errors.
+        worker.onerror = function(evt) {
+            assert_unreached("FAIL: onerror invoked for a script error.");
+        };
+        worker.port.postMessage("handledError");
+        worker.port.onmessage = resolve;
+    }).then(e => {
+        assert_equals(e.data, "SUCCESS: error handled via onerror");
+    });
+}, 'Test script error handled.')
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorker-simple.html b/test/fixtures/wpt/workers/SharedWorker-simple.html
new file mode 100644
index 000000000000..7cd3f4f3be65
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker-simple.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<title>Test simple shared worker construction case.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+    let worker;
+
+    return new Promise(resolve => {
+        worker = new SharedWorker('support/SharedWorker-common.js', 'name');
+        worker.port.postMessage("ping");
+        worker.port.onmessage = resolve;
+    }).then(e => {
+        assert_equals(e.data, "PASS: Received ping message");
+    });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/SharedWorkerPerformanceNow.html b/test/fixtures/wpt/workers/SharedWorkerPerformanceNow.html
new file mode 100644
index 000000000000..be5b5e3488c6
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorkerPerformanceNow.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>window.performance.now in shared workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+async_test(function(t) {
+    const worker = new SharedWorker('support/WorkerSendingPerformanceNow.js');
+    worker.port.onmessage = t.step_func(event => {
+        const results = event.data;
+        assert_equals(results.length, 4);
+        assert_equals(results[0], 'undefined',
+          'workerStart not defined on the Worker object');
+        assert_equals(results[1], 'object', 'self.performance is defined');
+        assert_equals(results[2], 'function', 'self.performance.now is defined');
+        assert_greater_than_equal(results[3], 0, 'Time in the worker should be non-negative');
+        assert_greater_than(window.performance.now(), results[3], 'Time in the worker should be before the current time in the main document');
+        setupIframe();
+    });
+    window.iframeStartTime = 0;
+    window.test_iframe = function(event) {
+        const workerTime = event.data[3];
+        assert_greater_than(workerTime, window.iframeStartTime,
+            'Time since origin time should be greater in the shared worker than the iframe');
+        t.done();
+    }
+    function setupIframe() {
+        const iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+        const script = iframe.contentWindow.document.createElement('script');
+        script.innerHTML =
+            'window.top.iframeStartTime = window.performance.now();' +
+            'const worker = new SharedWorker("support/WorkerSendingPerformanceNow.js");' +
+            'worker.port.onmessage = function(event) {' +
+            '    window.top.test_iframe(event);' +
+            '};' +
+            'worker.port.postMessage("");';
+        iframe.contentWindow.document.body.appendChild(script);
+    }
+    worker.port.postMessage('');
+}, 'performance.now() exists in shared workers and reports reasonable times');
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/SharedWorker_blobUrl.html b/test/fixtures/wpt/workers/SharedWorker_blobUrl.html
new file mode 100644
index 000000000000..e5b1c673c060
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker_blobUrl.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<title>Shared Worker: Blob URL passed over message port</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+</body>
+<script>
+
+promise_test(t => {
+  let worker;
+  let blob;
+  let blobUrl;
+  let blobText = 'Blob URL test';
+
+  return new Promise(function(resolve) {
+      worker = new SharedWorker('support/WorkerFetchURL.js');
+      blob = new Blob([blobText]);
+      blobUrl = URL.createObjectURL(blob);
+      worker.port.postMessage(blobUrl);
+      worker.port.onmessage = resolve;
+    })
+  .then(e => {
+    assert_equals(e.data, 'Worker reply:' + blobText);
+    URL.revokeObjectURL(blobUrl);
+  });
+}, 'Blob URL shared by document on SharedWorker');
+
+</script>
+</html>
+
diff --git a/test/fixtures/wpt/workers/SharedWorker_dataUrl.html b/test/fixtures/wpt/workers/SharedWorker_dataUrl.html
new file mode 100644
index 000000000000..c1dec27d49f8
--- /dev/null
+++ b/test/fixtures/wpt/workers/SharedWorker_dataUrl.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<title>Shared Worker: Data URL cross-origin checks</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+</body>
+<script>
+
+function dirname(path) {
+  return path.replace(/\/[^\/]*$/, '/');
+}
+
+promise_test(t => {
+  return new Promise(function(resolve) {
+    let count = 0;
+    onmessage = e => {
+      assert_equals(e.data, 1);
+      if (++count == 2) {
+        resolve(true);
+      }
+    };
+
+    let iframeA = document.createElement('iframe');
+    document.body.appendChild(iframeA);
+    iframeA.src =  get_host_info().HTTP_REMOTE_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+
+    let iframeB = document.createElement('iframe');
+    document.body.appendChild(iframeB);
+    iframeB.src =  get_host_info().HTTPS_REMOTE_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+  });
+}, 'Data URL not shared by cross-origin SharedWorkers');
+
+promise_test(t => {
+  return new Promise(function(resolve) {
+    let count = 0;
+    onmessage = e => {
+      assert_equals(e.data, ++count);
+      if (count == 2) {
+        resolve(true);
+      }
+    };
+
+    let iframeA = document.createElement('iframe');
+    document.body.appendChild(iframeA);
+    iframeA.src =  get_host_info().HTTP_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+
+    let iframeB = document.createElement('iframe');
+    document.body.appendChild(iframeB);
+    iframeB.src =  get_host_info().HTTP_ORIGIN +
+                   dirname(location.pathname) +
+                   "support/iframe_sw_dataUrl.html";
+  });
+}, 'Data URLs shared by same-origin SharedWorkers');
+
+</script>
+</html>
diff --git a/test/fixtures/wpt/workers/WEB_FEATURES.yml b/test/fixtures/wpt/workers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..40ba4aa99ea0
--- /dev/null
+++ b/test/fixtures/wpt/workers/WEB_FEATURES.yml
@@ -0,0 +1,16 @@
+rules:
+- WorkerNavigator-hardware-concurrency.any.js: [hardware-concurrency]
+- WorkerGlobalScope_requestAnimationFrame.worker.js: [request-animation-frame-workers]
+- WorkerGlobalScope_setInterval.htm: [setinterval]
+- WorkerGlobalScope_setTimeout.htm: [settimeout]
+- WorkerNavigator_userAgentData.http.html: [ua-client-hints]
+- WorkerNavigator_userAgentData.https.html: [ua-client-hints]
+- WorkerNavigator_onLine.htm: [online]
+- Worker-postMessage-happens-in-parallel.https.html: [postmessage]
+- postMessage_*: [postmessage]
+- WorkerNavigator_userAgent.htm: [user-agent-sniffing]
+- data-url-shared.html: [shared-workers]
+- SharedWorker-*: [shared-workers]
+- shared-worker-*: [shared-workers]
+- "*.any.*": []
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/Worker-base64.any.js b/test/fixtures/wpt/workers/Worker-base64.any.js
new file mode 100644
index 000000000000..6a46b477848c
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-base64.any.js
@@ -0,0 +1,5 @@
+// META: global=worker
+test(() => {
+  assert_equals(typeof atob, 'function');
+  assert_equals(typeof btoa, 'function');
+}, 'Tests that atob() / btoa() functions are exposed to workers');
diff --git a/test/fixtures/wpt/workers/Worker-call.worker.js b/test/fixtures/wpt/workers/Worker-call.worker.js
new file mode 100644
index 000000000000..ba07498880cb
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-call.worker.js
@@ -0,0 +1,12 @@
+importScripts("/resources/testharness.js");
+test(() => {
+  try {
+    postMessage("SUCCESS: postMessage() called directly");
+    postMessage.call(null, "SUCCESS: postMessage() invoked via postMessage.call()");
+    var saved = postMessage;
+    saved("SUCCESS: postMessage() called via intermediate variable");
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while calling functions from the worker context.");
+  }
+}, 'Test calling functions from WorkerContext.');
+done();
diff --git a/test/fixtures/wpt/workers/Worker-constructor-proto.any.js b/test/fixtures/wpt/workers/Worker-constructor-proto.any.js
new file mode 100644
index 000000000000..297fe6c58b47
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-constructor-proto.any.js
@@ -0,0 +1,7 @@
+//META: global=worker
+test(() => {
+  const proto = {};
+  assert_equals(String(Object.getPrototypeOf(WorkerLocation)).replace(/\n/g, " ").replace(/\s\s+/g, " "), "function () { [native code] }");
+  Object.setPrototypeOf(WorkerLocation, proto);
+  assert_equals(Object.getPrototypeOf(WorkerLocation), proto);
+}, 'Tests that setting the proto of a built in constructor is not reset.');
diff --git a/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html
new file mode 100644
index 000000000000..887d95f3df68
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>Test that creation of a "new Worker()" will occur in parallel to the main JS thread performing other computation, and can be joined with.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  return new Promise(resolve => {
+    let worker = new Worker("support/Worker-creation-happens-in-parallel.js");
+    let sab = new Uint8Array(new SharedArrayBuffer(16));
+    window.sab = sab;
+    worker.postMessage(sab);
+    let end = performance.now() + 10*1000;
+    while(sab[0] != 1 && performance.now() < end) /*wait to join with the result*/;
+    assert_true(sab[0] == 1);
+    resolve();
+  });
+}, 'Tests that creation of a "new Worker()" will occur in parallel');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html.headers b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html.headers
new file mode 100644
index 000000000000..4b06ac7cc63e
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-creation-happens-in-parallel.https.html.headers
@@ -0,0 +1,2 @@
+Cross-Origin-Opener-Policy:same-origin
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/Worker-custom-event.any.js b/test/fixtures/wpt/workers/Worker-custom-event.any.js
new file mode 100644
index 000000000000..d7e983aaddc5
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-custom-event.any.js
@@ -0,0 +1,8 @@
+// META: global=worker
+async_test(t => {
+  var target = self;
+  target.addEventListener('custom-event', t.step_func_done());
+
+  var event = new Event('custom-event');
+  target.dispatchEvent(event);
+}, 'Test CustomEvents on workers.');
diff --git a/test/fixtures/wpt/workers/Worker-formdata.any.js b/test/fixtures/wpt/workers/Worker-formdata.any.js
new file mode 100644
index 000000000000..a07f194bd24e
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-formdata.any.js
@@ -0,0 +1,19 @@
+// META: global=dedicatedworker
+test(() => {
+  assert_own_property(self, 'FormData');
+  assert_equals(FormData.length, 0);
+
+  var formData = new FormData();
+  assert_not_equals(formData, null);
+  assert_own_property(FormData.prototype, 'append');
+  formData.append('key', 'value');
+
+  var blob = new Blob([]);
+  assert_not_equals(blob, null);
+  formData.append('key', blob);
+  formData.append('key', blob, 'filename');
+
+  assert_throws_dom("DataCloneError",
+                    function() { postMessage(formData) },
+                    "Trying to clone formdata inside a postMessage results in an exception." );
+},'Test FormData interface object');
diff --git a/test/fixtures/wpt/workers/Worker-location.sub.any.js b/test/fixtures/wpt/workers/Worker-location.sub.any.js
new file mode 100644
index 000000000000..c05bb1750f71
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-location.sub.any.js
@@ -0,0 +1,14 @@
+// META: global=dedicatedworker,sharedworker
+test(() => {
+  assert_equals(String(WorkerLocation).replace(/\n/g, " ").replace(/\s\s+/g, " "), "function WorkerLocation() { [native code] }");
+  assert_true(location instanceof Object);
+  assert_equals(location.href, 'http://{{host}}:{{ports[http][0]}}/workers/Worker-location.sub.any.worker.js');
+  assert_equals(location.origin, "http://{{host}}:{{ports[http][0]}}");
+  assert_equals(location.protocol, "http:");
+  assert_equals(location.host, "{{host}}:{{ports[http][0]}}");
+  assert_equals(location.hostname, "{{host}}");
+  assert_equals(location.port, "{{ports[http][0]}}");
+  assert_equals(location.pathname, "/workers/Worker-location.sub.any.worker.js");
+  assert_equals(location.search, "");
+  assert_equals(location.hash, "");
+}, 'Test WorkerLocation properties.');
diff --git a/test/fixtures/wpt/workers/Worker-messageport.html b/test/fixtures/wpt/workers/Worker-messageport.html
new file mode 100644
index 000000000000..f7734b2543fc
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-messageport.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>Test that pages and workers can send MessagePorts to one another.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+
+  // Send messages with and without ports to the worker to make sure it gets them.
+  worker.postMessage("noport");
+  worker.onmessage = t.step_func_done(evt => {
+    assert_equals(evt.data, "PASS: evt.ports = [] as expected");
+  });
+}, 'Test sending messages to workers with no port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+  var channel = new MessageChannel();
+
+  worker.postMessage("port", [channel.port1]);
+  worker.onmessage = t.step_func(evt => {
+    assert_equals(evt.data, "PASS: Received message port");
+  });
+
+  // Send a message on the new port to make sure it gets to the worker.
+  channel.port2.postMessage("ping");
+
+  // Wait for the response.
+  channel.port2.onmessage = t.step_func_done(evt => {
+    assert_equals(evt.data, "pong");
+  });
+  channel.port2.start();
+}, 'Test sending message to a worker on a port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+  var channel = new MessageChannel();
+
+  worker.onmessage = t.step_func(evt => {
+    assert_equals(evt.data, "port");
+    assert_equals(String(evt.ports), "[object MessagePort]");
+    assert_equals(evt.ports.length, 1);
+    evt.ports[0].postMessage("ping");
+    evt.ports[0].onmessage = t.step_func_done(evt => {
+      assert_equals(evt.data, "pong");
+    });
+    evt.ports[0].start();
+  });
+  worker.postMessage("getport");
+}, 'Test getting messages from a worker on a port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-messageport.js");
+  var channel = new MessageChannel();
+  worker.onmessage = t.step_func(evt => { gotSpam(channel.port1); });
+  worker.postMessage("spam", [channel.port2]);
+
+  function gotSpam(port) {
+    var spamCount = 0;
+    port.onmessage = t.step_func(evt => {
+      assert_equals(evt.data, spamCount);
+      spamCount++;
+      if (spamCount == 1000) {
+        t.done();
+      }
+    });
+  }
+}, 'Test sending many messages to workers using ports.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-multi-port.html b/test/fixtures/wpt/workers/Worker-multi-port.html
new file mode 100644
index 000000000000..587176e9fc10
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-multi-port.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<title>Test sending multiple ports through Worker.postMessage.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("noport");
+}, 'Test postMessage with no port.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("noargs");
+}, 'Test postMessage with no arguments.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("zero ports", []);
+}, 'Test postMessage with no ports and empty array.');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  var channel = new MessageChannel();
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("two ports", [channel.port1, channel.port2]);
+}, 'Test postMessage with two ports.');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  assert_throws_js(TypeError,
+                   function() { worker.postMessage(); },
+                   'Empty postMessage should throw exception.');
+}, 'Test empty postMessage throws exception.');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  var channel = new MessageChannel();
+  assert_throws_js(TypeError,
+                   function() { worker.postMessage("null port",
+                                                   [channel.port1, null,
+                                                    channel.port2]); },
+                   'postMessage with null ports should throw exception.');
+}, 'Test postMessage with null ports throws exception.');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js")
+  var channel = new MessageChannel();
+  assert_throws_dom('DataCloneError',
+                    function() { worker.postMessage("notAPort",
+                                                    [channel.port1, {},
+                                                     channel.port2]); },
+                    'postMessage with incorrect ports should throw exception.');
+}, 'Test postMessage with incorrect ports throws exception');
+
+test(() => {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  assert_throws_dom('DataCloneError',
+                    function() { worker.postMessage("notASequence", [{length: 3}]) },
+                    'postMessage without sequence should throw exception.');
+}, 'Test postMessage without sequence throws exception');
+
+async_test(function(t) {
+  var worker = new Worker("support/Worker-thread-multi-port.js");
+  var channel = new MessageChannel();
+  assert_throws_dom('DataCloneError',
+                    function() { worker.postMessage("notAPort",
+                                                    [channel.port1, {},
+                                                     channel.port2]); },
+                    'postMessage with incorrect ports should throw exception.');
+  worker.onmessage = t.step_func_done(function(evt) {
+    assert_true(evt.data.startsWith('PASS'));
+  });
+  worker.postMessage("failed ports", [channel.port1, channel.port2]);
+}, 'Test postMessage on channel with previous failed postMessage calls.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-nested-importScripts-error.html b/test/fixtures/wpt/workers/Worker-nested-importScripts-error.html
new file mode 100644
index 000000000000..bd96c835df92
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-nested-importScripts-error.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title>This tests that errors from nested importScripts have the expected provenance.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  let worker;
+
+  return new Promise((resolve) => {
+    worker = new Worker("support/importScripts-1.js");
+    worker.onerror = resolve;
+  }).then(e => {
+    assert_equals(e.type, "error");
+    assert_true(e.filename.indexOf('invalidScript.js') >= 0);
+    e.preventDefault();
+  });
+}, 'Tests that errors from the import scripts come from the expected file.')
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html
new file mode 100644
index 000000000000..3b8683f79dcd
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Test that calling "worker.postMessage()" will occur truly in parallel to the main JS thread performing other computation.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  return new Promise(resolve => {
+    let worker = new Worker("support/Worker-postMessage-happens-in-parallel.js");
+    worker.postMessage('init');
+    worker.onmessage = () => {
+      let sab = new Uint8Array(new SharedArrayBuffer(16));
+      worker.postMessage(sab);
+      let end = performance.now() + 30*1000;
+      while(sab[0] != 1 && performance.now() < end) /*wait to join with the result*/;
+      assert_true(sab[0] == 1);
+      resolve();
+    };
+  });
+}, 'Tests that calling "worker.postMessage()" will occur truly in parallel to the main JS thread');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html.headers b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html.headers
new file mode 100644
index 000000000000..4b06ac7cc63e
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-postMessage-happens-in-parallel.https.html.headers
@@ -0,0 +1,2 @@
+Cross-Origin-Opener-Policy:same-origin
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/Worker-replace-event-handler.any.js b/test/fixtures/wpt/workers/Worker-replace-event-handler.any.js
new file mode 100644
index 000000000000..ff7c764f2bdd
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-replace-event-handler.any.js
@@ -0,0 +1,11 @@
+// META: global=worker
+// This is a regression test for a crash bug in Chrome: http://crbug.com/239669
+function update() {
+  onmessage = undefined;
+}
+
+test(() => {
+  for (var i = 0; i < 8; ++i) {
+    update();
+  }
+}, "Tests that repeatedly setting 'onmessage' within a worker doesn't crash.");
diff --git a/test/fixtures/wpt/workers/Worker-replace-global-constructor.any.js b/test/fixtures/wpt/workers/Worker-replace-global-constructor.any.js
new file mode 100644
index 000000000000..d724c6c8ec6d
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-replace-global-constructor.any.js
@@ -0,0 +1,9 @@
+// META: global=worker
+test(() => {
+  try {
+    self.MessageEvent = 'PASS';
+    assert_equals(self.MessageEvent, 'PASS');
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while replacing global constructor MessageEvent.");
+  }
+}, 'Test replacing global constructors in a worker context.');
diff --git a/test/fixtures/wpt/workers/Worker-replace-self.any.js b/test/fixtures/wpt/workers/Worker-replace-self.any.js
new file mode 100644
index 000000000000..513fd4a257f4
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-replace-self.any.js
@@ -0,0 +1,9 @@
+// META: global=worker
+test(() => {
+  try {
+    self = 'PASS';
+    assert_true(self instanceof WorkerGlobalScope);
+  } catch (ex) {
+    assert_unreached("FAIL: unexpected exception (" + ex + ") received while replacing self.");
+  }
+}, 'Test that self is not replaceable.');
diff --git a/test/fixtures/wpt/workers/Worker-simultaneous-errors.html b/test/fixtures/wpt/workers/Worker-simultaneous-errors.html
new file mode 100644
index 000000000000..4339f2e33436
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-simultaneous-errors.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<title>Test simultaneous errors on workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+    var workers = 4;
+    var promises = [];
+
+    for (i = 0; i < workers; ++i) {
+        var worker = new Worker('support/throw-on-message-Worker.js');
+        promises.push(new Promise(function(resolve, reject) {
+            var error = 0;
+            worker.onmessage = function(event) {
+                if (event.data === 'second')
+                    resolve(error);
+                else if (event.data === 'error')
+                    ++error;
+            }
+        }));
+        worker.postMessage('first');
+        worker.postMessage('second');
+    }
+
+    return Promise.all(promises).then(e => {
+        var sum = 0;
+        for (var key in e) {
+            sum += e[key]
+        }
+        assert_equals(sum, workers);
+    });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-structure-message.html b/test/fixtures/wpt/workers/Worker-structure-message.html
new file mode 100644
index 000000000000..9eb12dc6c55b
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-structure-message.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>Test that pages and workers can send Structure Message to one another.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  let worker;
+
+  return new Promise(resolve => {
+    worker = new Worker("support/Worker-structure-message.js");
+    worker.onmessage = resolve;
+    worker.postMessage({
+      operation: 'find-edges',
+      input: new ArrayBuffer(20),
+      threshold: 0.6
+    });
+  }).then(evt => {
+    assert_false(evt.data.startsWith('FAIL'));
+    return new Promise(resolve => worker.onmessage = resolve);
+  }).then(evt => {
+    assert_equals(evt.data.operation, 'find-edges');
+    assert_true(ArrayBuffer.prototype.isPrototypeOf(evt.data.input));
+    assert_equals(evt.data.input.byteLength, 20);
+    assert_equals(evt.data.threshold, 0.6);
+  });
+}, 'Tests sending structure message to/from worker.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-terminate-forever-during-evaluation.html b/test/fixtures/wpt/workers/Worker-terminate-forever-during-evaluation.html
new file mode 100644
index 000000000000..ab66f29289f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-terminate-forever-during-evaluation.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<title>Test Worker.terminate() for a worker that tries to run forever after top-level script evaluation is started.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// The tests here are to provide execution coverage for the code paths for
+// forcible worker termination.
+// Expectation here is:
+// - Not to crash, not to cause assertion failures
+// - No WorkerGlobalScope error events and thus Worker error events are fired
+//   (#report-the-exception is not called when a script is terminated during
+//   #run-a-classic-script/#run-a-module-script according to the spec)
+// - Nothing after infinte loop, promise resolusion/rejection etc. occurs.
+
+for (const test of [
+  {
+    url: 'support/Worker-run-forever.js',
+    description: 'Worker is terminated during top-level script evaluation'
+  },
+  {
+    url: 'support/Worker-run-forever.js',
+    options: {type: 'module'},
+    description: 'Worker is terminated during top-level script evaluation (module)'
+  },
+  {
+    url: 'support/Worker-run-forever-during-importScripts.js',
+    description: 'Worker is terminated during importScripts() call'
+  },
+  {
+    url: 'support/Worker-run-forever-during-nested-importScripts.js',
+    description: 'Worker is terminated during nested importScripts() call'
+  },
+  {
+    url: 'support/Worker-run-forever-during-dynamic-import.js',
+    description: 'Worker is terminated during dynamic import()'
+  },
+  {
+    url: 'support/Worker-run-forever-during-dynamic-import.js',
+    options: {type: 'module'},
+    description: 'Worker is terminated during dynamic import() (module)'
+  },
+  {
+    url: 'support/Worker-run-forever-during-top-level-await.js',
+    options: {type: 'module'},
+    description: 'Worker is terminated during top-level await'
+  }
+]) {
+  async_test((t) => {
+    const worker = new Worker(test.url, test.options);
+    worker.onerror = t.step_func(e => {
+      // Calls preventDefault() to prevent this event from being considered
+      // as an uncaught exception.
+      e.preventDefault();
+      assert_unreached('onerror');
+    });
+    worker.onmessage = t.step_func((e) => {
+      if (e.data === 'start') {
+        worker.terminate();
+        // To make the worker forcibly terminated, because in Chromium worker is
+        // forcibly terminated after 2 seconds.
+        t.step_timeout(function() { t.done(); }, 4000);
+      }
+      else {
+        assert_unreached('Unexpected message received: ' + e.data);
+      }
+    });
+  }, test.description);
+}
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-terminate-forever.html b/test/fixtures/wpt/workers/Worker-terminate-forever.html
new file mode 100644
index 000000000000..3528bb6246dd
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-terminate-forever.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>Test Worker.terminate() for a worker that tries to run forever.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test((t) => {
+  var worker = new Worker('support/Worker-run-forever.js');
+  worker.terminate();
+  t.step_timeout(function() { t.done(); }, 500);
+}, 'Tests terminating a worker that is trying to run forever.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-termination-with-port-messages.html b/test/fixtures/wpt/workers/Worker-termination-with-port-messages.html
new file mode 100644
index 000000000000..bc19784adae8
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-termination-with-port-messages.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>This test terminates a worker when there are many undelivered MessagePort messages still waiting to be dispatched into the Worker Context. This causes termination of JS execution and test should not try to dispatch the remaining messages. Test succeeds if it does not hang or crash (if worker thread is running in the separate process, that process could hang or crash).</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+    var worker = new Worker("support/Worker-termination-with-port-messages.js");
+    var channel = new MessageChannel();
+
+    channel.port2.onmessage = function(evt)
+    {
+        // On first message back from worker, terminate it.
+        worker.terminate();
+        t.done();
+    }
+    channel.port2.start();
+
+    worker.postMessage("", [channel.port1]);
+    for (i = 0; i < 1000; i++)
+        channel.port2.postMessage("message to worker");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-timeout-cancel-order.html b/test/fixtures/wpt/workers/Worker-timeout-cancel-order.html
new file mode 100644
index 000000000000..78d930df783b
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-timeout-cancel-order.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<title>Test setTimeOut,cancelTimeout in Web Workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  let worker
+
+  return new Promise(resolve => {
+    worker = new Worker('support/Worker-timeout-cancel-order.js');
+    worker.postMessage('start');
+    worker.onmessage = resolve;
+  }).then(evt => {
+    assert_equals(evt.data, 2, 'Timeout not canceled');
+  });
+}, 'Tests setting and canceling timeout in workers.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-timeout-decreasing-order.html b/test/fixtures/wpt/workers/Worker-timeout-decreasing-order.html
new file mode 100644
index 000000000000..f459461ec061
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-timeout-decreasing-order.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Test setTimeOut,fired in decreasing order in Web Workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test (t => {
+  let worker;
+
+  return new Promise(resolve => {
+    worker = new Worker('support/Worker-timeout-decreasing-order.js');
+    worker.postMessage('start');
+    worker.onmessage = resolve;
+  }).then(evt => {
+    assert_equals(evt.data, 1);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 2);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 3);
+  });
+}, 'Tests timeouts on the worker are fired in decreasing order.');
+</script>
diff --git a/test/fixtures/wpt/workers/Worker-timeout-increasing-order.html b/test/fixtures/wpt/workers/Worker-timeout-increasing-order.html
new file mode 100644
index 000000000000..34b029466bb2
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker-timeout-increasing-order.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Test setTimeOut,fired in increasing order in Web Workers.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test (t => {
+  let worker;
+
+  return new Promise(resolve => {
+    worker = new Worker('support/Worker-timeout-increasing-order.js');
+    worker.postMessage('start');
+    worker.onmessage = resolve;
+  }).then(evt => {
+    assert_equals(evt.data, 1);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 2);
+    return (new Promise(resolve => worker.onmessage = resolve));
+  }).then(evt => {
+    assert_equals(evt.data, 3);
+  });
+}, 'Tests timeouts on the worker are fired in increasing order.');
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope-close.html b/test/fixtures/wpt/workers/WorkerGlobalScope-close.html
new file mode 100644
index 000000000000..08ab1ca515c6
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope-close.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>Test WorkerGlobalScope.close functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("typeofClose");
+    worker.onmessage = t.step_func_done(function(evt) {
+    assert_equals(evt.data, "typeof close: function");
+    });
+}, 'Test type of close function.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("ping");
+  worker.onmessage = t.step_func(function(evt) {
+    assert_equals(evt.data, "pong");
+    // Tell the worker to close, then send a followup message.
+    worker.postMessage("close");
+
+    // The worker may or may not be closing/closed by this call. If it is, the
+    // message won't be enqueued on the worker's event loop. If it isn't, the
+    // message will be enqueued but shouldn't be handled by the worker because
+    // the prior postMessage will cause the worker to close. In either case,
+    // the worker shouldn't postMessage back "pong".
+    //
+    // This also means that at this point we can't confidently test
+    // postMessage-ing a worker that will close nor a worker that is already
+    // closing/closed.
+    worker.postMessage("ping");
+
+    worker.onmessage = t.step_func(function(evt) {
+      assert_not_equals(evt.data, "pong");
+
+      // The worker should definitely be closed by now, so we can confidently
+      // test postMessage-ing a closed worker. This postMessage shouldn't throw
+      // or cause the worker to postMessage back "pong" (it shouldn't receive
+      // any events after closing).
+      worker.postMessage("ping");
+
+      t.step_timeout(function() { t.done(); }, 500);
+    });
+  });
+}, 'Test sending a message after closing.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("closeWithError");
+  worker.onerror = function(event) {
+    t.done()
+  };
+}, 'Test errors are delivered after close.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("closeWithPendingEvents");
+  worker.onmessage = t.step_func(function(evt) {
+    assert_unreached("Pending events should not fire: " + evt.data);
+  });
+  worker.onerror = t.step_func(function(evt) {
+    assert_unreached("Pending events should not fire:" + evt.message);
+  });
+  t.step_timeout(function() { t.done(); }, 500);
+}, 'Test workers do not deliver pending events.');
+
+async_test(function(t) {
+  var worker = new Worker('support/WorkerGlobalScope-close.js');
+  worker.postMessage("close");
+  worker.onmessage = function(evt) {
+    assert_equals(evt.data, "Should be delivered");
+    // Give worker a chance to close first, then terminate it.
+    t.step_timeout(function() {
+      worker.terminate();
+      t.done();
+    }, 500);
+  };
+}, 'Test terminating a worker after close.');
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_colno.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_colno.htm
new file mode 100644
index 000000000000..793d6c1807b2
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_colno.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: col </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(typeof e.data.colno, "number");
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_filename.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_filename.htm
new file mode 100644
index 000000000000..e165a23f418e
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_filename.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: location </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    var href = location.href;
+    var expected = href.substring(0, href.lastIndexOf('/')) + '/support/ErrorEvent.js';
+    assert_equals(e.data.filename, expected);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_lineno.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_lineno.htm
new file mode 100644
index 000000000000..dfbc51467da5
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_lineno.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: line </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.lineno, 3);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_message.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_message.htm
new file mode 100644
index 000000000000..27d4dda5114c
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_ErrorEvent_message.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope onerror event handler argument: message </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var message = 'Error Message';
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_greater_than(e.data.message.indexOf(message), -1);
+  });
+  worker.onerror = e => e.preventDefault();
+  worker.postMessage(message);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts.htm
new file mode 100644
index 000000000000..1a3616df98bc
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts.htm
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope API: importScripts() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/ImportScripts.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+  worker.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NetworkErr.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NetworkErr.htm
new file mode 100644
index 000000000000..36fe6e0b2d3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NetworkErr.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> importScripts() with non-existent script file </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/ImportScriptsNetworkErr.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
new file mode 100644
index 000000000000..d99cecdc6a51
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<title> importScripts() with nosniff X-Content-Type-Options </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+fetch_tests_from_worker(new Worker('./support/ImportScriptsNosniffErr.js'));
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_requestAnimationFrame.worker.js b/test/fixtures/wpt/workers/WorkerGlobalScope_requestAnimationFrame.worker.js
new file mode 100644
index 000000000000..e1b0b9f15a69
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_requestAnimationFrame.worker.js
@@ -0,0 +1,19 @@
+importScripts("/resources/testharness.js");
+
+async_test(t => {
+  const res = [];
+  requestAnimationFrame(t.step_func(dt => {
+    res.push(dt);
+    requestAnimationFrame(t.step_func(dt => {
+      res.push(dt);
+      requestAnimationFrame(t.step_func_done(dt => {
+        res.push(dt);
+        assert_equals(res.length, 3);
+        assert_less_than(res[0], res[1]);
+        assert_less_than(res[1], res[2]);
+      }));
+    }));
+  }));
+});
+
+done();
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_setInterval.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_setInterval.htm
new file mode 100644
index 000000000000..4e147fbf60f1
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_setInterval.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope API: setInterval() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var result = [];
+  var worker = new Worker('./support/Timer.js');
+  worker.onmessage = t.step_func(function(e) {
+    result.push(e.data);
+    if (result.length == 3) {
+      assert_array_equals(result, ["hello", "worker", "worker"]);
+      worker.onmessage = t.unreached_func('Unexpected message event');
+      setTimeout(t.step_func_done(), 100);
+    }
+  });
+  worker.postMessage("IntervalHandler");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerGlobalScope_setTimeout.htm b/test/fixtures/wpt/workers/WorkerGlobalScope_setTimeout.htm
new file mode 100644
index 000000000000..89fdf3d740a8
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerGlobalScope_setTimeout.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> WorkerGlobalScope API: setTimeout() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var result = [];
+  var worker = new Worker('./support/Timer.js');
+  worker.onmessage = t.step_func(function(e) {
+    result.push(e.data);
+    if (result.length == 3) {
+      assert_array_equals(result, ["hello", "worker", "worker"]);
+      worker.onmessage = t.unreached_func('Unexpected message event');
+      setTimeout(t.step_func_done(), 100);
+    }
+  });
+  worker.postMessage("TimeoutHandler");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation-origin.sub.window.js b/test/fixtures/wpt/workers/WorkerLocation-origin.sub.window.js
new file mode 100644
index 000000000000..7e808105dd79
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation-origin.sub.window.js
@@ -0,0 +1,11 @@
+async_test(t => {
+  const frame = document.createElement("iframe"),
+        asciiOrigin = location.protocol + "//{{domains[天気の良い日]}}:" + location.port,
+        path = new URL("support/WorkerLocation-origin.html", location).pathname;
+  frame.src = asciiOrigin + path;
+  self.onmessage = t.step_func_done(e => {
+    assert_equals(e.data.origin, asciiOrigin);
+  });
+  document.body.appendChild(frame);
+  t.add_cleanup(() => frame.remove());
+}, "workerLocation.origin must use ASCII code points");
diff --git a/test/fixtures/wpt/workers/WorkerLocation.htm b/test/fixtures/wpt/workers/WorkerLocation.htm
new file mode 100644
index 000000000000..a74f13a8b48b
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation.htm
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title> WorkerLocation object </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    var href = window.location.href;
+    var ExpectedResult = href.substring(0, href.lastIndexOf('/')) + '/support/WorkerLocation.js';
+    assert_equals(e.data.location, ExpectedResult);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hash.htm b/test/fixtures/wpt/workers/WorkerLocation_hash.htm
new file mode 100644
index 000000000000..74a424efc3c4
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hash.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: hash </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js#HashString");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hash, "#HashString");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hash_encoding.htm b/test/fixtures/wpt/workers/WorkerLocation_hash_encoding.htm
new file mode 100644
index 000000000000..b2a171a092a6
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hash_encoding.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.hash with url encoding string </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js#question%3f");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hash, "#question%3f");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hash_nonexist.htm b/test/fixtures/wpt/workers/WorkerLocation_hash_nonexist.htm
new file mode 100644
index 000000000000..2d898c075c38
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hash_nonexist.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.hash with no &lt;fragment&gt; component </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hash, "");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_host.htm b/test/fixtures/wpt/workers/WorkerLocation_host.htm
new file mode 100644
index 000000000000..53286ddfc539
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_host.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: host </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.host, location.host);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_hostname.htm b/test/fixtures/wpt/workers/WorkerLocation_hostname.htm
new file mode 100644
index 000000000000..97250805c9f8
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_hostname.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: hostname </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.hostname, location.hostname);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_href.htm b/test/fixtures/wpt/workers/WorkerLocation_href.htm
new file mode 100644
index 000000000000..3ed1dbd4f519
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_href.htm
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title> WorkerLocation href attribute </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js?srch%20#hash");
+  worker.onmessage = t.step_func_done(function(e) {
+    var href = location.href;
+    var expected = href.substring(0, href.lastIndexOf('/')) + "/support/WorkerLocation.js?srch%20#hash";
+    assert_equals(e.data.href, expected);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_pathname.htm b/test/fixtures/wpt/workers/WorkerLocation_pathname.htm
new file mode 100644
index 000000000000..346984511553
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_pathname.htm
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: pathname </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    var pathname = location.pathname;
+    var expected = pathname.substring(0, pathname.lastIndexOf('/')) + '/support/WorkerLocation.js';
+    assert_equals(e.data.pathname, expected);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_port.htm b/test/fixtures/wpt/workers/WorkerLocation_port.htm
new file mode 100644
index 000000000000..ef86cfacb615
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_port.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.port, location.port);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_protocol.htm b/test/fixtures/wpt/workers/WorkerLocation_protocol.htm
new file mode 100644
index 000000000000..f792dee51568
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_protocol.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: protocol </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.protocol, location.protocol);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search.htm b/test/fixtures/wpt/workers/WorkerLocation_search.htm
new file mode 100644
index 000000000000..bc6add8768ae
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation URL decomposition IDL attribute: search </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js?SearchString');
+  worker.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data.search, '?SearchString');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search_empty.htm b/test/fixtures/wpt/workers/WorkerLocation_search_empty.htm
new file mode 100644
index 000000000000..a32d4309128d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search_empty.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.search with empty &lt;query&gt; </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerLocation.js?");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.search, "");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search_fragment.htm b/test/fixtures/wpt/workers/WorkerLocation_search_fragment.htm
new file mode 100644
index 000000000000..3ec4cffa6b5d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search_fragment.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.search with &lt;fragment&gt; in &lt;query&gt; </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js?test#');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.search, "?test");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerLocation_search_nonexist.htm b/test/fixtures/wpt/workers/WorkerLocation_search_nonexist.htm
new file mode 100644
index 000000000000..9907e6473c2d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerLocation_search_nonexist.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerLocation.search  with no &lt;query&gt; component </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker('./support/WorkerLocation.js');
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.search, "");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator-hardware-concurrency.any.js b/test/fixtures/wpt/workers/WorkerNavigator-hardware-concurrency.any.js
new file mode 100644
index 000000000000..49db7503ffb1
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator-hardware-concurrency.any.js
@@ -0,0 +1,4 @@
+// META: global=worker
+test(() => {
+  assert_true(navigator.hardwareConcurrency > 0);
+}, 'Test worker navigator hardware concurrency.');
diff --git a/test/fixtures/wpt/workers/WorkerNavigator.any.js b/test/fixtures/wpt/workers/WorkerNavigator.any.js
new file mode 100644
index 000000000000..a9542af79aa3
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator.any.js
@@ -0,0 +1,12 @@
+// META: global=worker
+test(() => {
+  assert_equals(typeof navigator, "object");
+  assert_true(navigator instanceof WorkerNavigator);
+  assert_equals(navigator.appName, "Netscape");
+  assert_true(navigator.appVersion.indexOf('WebKit') != 0);
+  assert_equals(typeof navigator.platform, "string");
+  assert_true(navigator.userAgent.indexOf('WebKit') != 0);
+  assert_equals(typeof navigator.onLine, "boolean");
+  assert_equals(navigator.appCodeName, 'Mozilla');
+  assert_equals(navigator.product, 'Gecko');
+}, "Testing Navigator properties on workers.");
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_appName.htm b/test/fixtures/wpt/workers/WorkerNavigator_appName.htm
new file mode 100644
index 000000000000..832c46ff5e21
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_appName.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator appName </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.appName, navigator.appName);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_appVersion.htm b/test/fixtures/wpt/workers/WorkerNavigator_appVersion.htm
new file mode 100644
index 000000000000..7deaa4256af2
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_appVersion.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator appVersion </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.appVersion, navigator.appVersion);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_onLine.htm b/test/fixtures/wpt/workers/WorkerNavigator_onLine.htm
new file mode 100644
index 000000000000..f9e819b8aaba
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_onLine.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.onLine </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.onLine, navigator.onLine);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_platform.htm b/test/fixtures/wpt/workers/WorkerNavigator_platform.htm
new file mode 100644
index 000000000000..3a6de80eb96d
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_platform.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.platform </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.platform, navigator.platform);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_userAgent.htm b/test/fixtures/wpt/workers/WorkerNavigator_userAgent.htm
new file mode 100644
index 000000000000..8a34fb480ac5
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_userAgent.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.userAgent </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerNavigator.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data.userAgent, navigator.userAgent);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.http.html b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.http.html
new file mode 100644
index 000000000000..4e8ca34eebcc
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.http.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.userAgentData </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+  promise_test(async () => {
+    const e = await new Promise((resolve, reject) => {
+      const worker = new Worker("./support/WorkerNavigator.js");
+      worker.onmessage = resolve;
+    });
+
+    assert_equals(e.data.brands, undefined);
+    assert_equals(e.data.mobile, undefined);
+    assert_equals(e.data.getHighEntropyValues, undefined);
+  }, "Test that userAgentData is not available in workers in non-secure contexts");
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.https.html b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.https.html
new file mode 100644
index 000000000000..8ca73df3e8cd
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerNavigator_userAgentData.https.html
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<title> WorkerNavigator.userAgentData </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+  promise_test(async () => {
+    const e = await new Promise((resolve, reject) => {
+      const worker = new Worker("./support/WorkerNavigator.js");
+      worker.onmessage = resolve;
+    });
+
+    assert_equals(e.data.brands.length, navigator.userAgentData.brands.length);
+    for (let i = 0; i < e.data.brands.length; ++i) {
+      const workerUA = e.data.brands[i];
+      const windowUA = navigator.userAgentData.brands[i];
+      assert_equals(workerUA.brand, windowUA.brand);
+      assert_equals(workerUA.version, windowUA.version);
+    }
+    assert_equals(e.data.mobile, navigator.userAgentData.mobile);
+    assert_equals(e.data.platform, navigator.userAgentData.platform);
+    const highEntropyValues = await navigator.userAgentData.getHighEntropyValues([
+      "architecture", "bitness", "fullVersionList", "model",
+      "platformVersion", "uaFullVersion", "wow64", "formFactors",
+    ]);
+
+    assert_equals(e.data.fullVersionList.length,
+                  highEntropyValues.fullVersionList.length);
+    for (let i = 0; i < e.data.fullVersionList.length; ++i) {
+      const workerFV = e.data.fullVersionList[i];
+      const windowFV = highEntropyValues.fullVersionList[i];
+      assert_equals(workerFV.brand, windowFV.brand);
+      assert_equals(workerFV.version, windowFV.version);
+    }
+
+    assert_equals(e.data.architecture, highEntropyValues.architecture);
+    assert_equals(e.data.bitness, highEntropyValues.bitness);
+    assert_equals(e.data.model, highEntropyValues.model);
+    assert_equals(e.data.platformVersion, highEntropyValues.platformVersion);
+    assert_equals(e.data.uaFullVersion, highEntropyValues.uaFullVersion);
+    assert_equals(e.data.wow64, highEntropyValues.wow64);
+    assert_equals(e.data.formFactors.join(','), highEntropyValues.formFactors.join(','));
+    assert_equals(e.data.NavigatorUADataExposed, true);
+
+    // Architecture should be one of two permitted values.
+    assert_true(["x86", "arm"].some(arch => arch == e.data.architecture))
+  }, "Test that userAgentData is available in workers in secure contexts");
+
+  promise_test(async () => {
+    const e = await new Promise((resolve) => {
+      const worker = new Worker("./support/WorkerNavigator.js");
+      worker.onmessage = resolve;
+    });
+    const highEntropyValues = await navigator.userAgentData.getHighEntropyValues([
+      "platformVersion", "wow64"
+    ]);
+
+    if (["Fuchsia", "Linux"].includes(navigator.userAgentData.platform)) {
+      assert_true(e.data.platformVersion === "");
+      assert_equals(e.data.wow64, false);
+      assert_true(highEntropyValues.platformVersion === "");
+      assert_equals(highEntropyValues.wow64, false);
+    }
+  }, "Platform version and wow64-ness on Linux and Fuchsia should contain fixed values");
+</script>
diff --git a/test/fixtures/wpt/workers/WorkerPerformanceNow.html b/test/fixtures/wpt/workers/WorkerPerformanceNow.html
new file mode 100644
index 000000000000..286832fd9471
--- /dev/null
+++ b/test/fixtures/wpt/workers/WorkerPerformanceNow.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>performance.now in dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+async_test(function(t) {
+  const worker = new Worker('support/WorkerSendingPerformanceNow.js');
+  worker.onmessage = t.step_func_done(event => {
+    const results = event.data;
+    assert_equals(results.length, 4);
+    assert_equals(results[0], 'undefined',
+      'workerStart not defined on the Worker object');
+    assert_equals(results[1], 'object', "self.performance is defined");
+    assert_equals(results[2], 'function', "self.performance.now is defined");
+    assert_greater_than(results[3], 0, "Time in the worker should be positive");
+    assert_greater_than(window.performance.now(), results[3], "Time in the worker should be before the current time in the main document");
+  });
+  worker.postMessage('');
+}, 'performance.now() exists in dedicated workers and reports reasonable times');
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_bubbles_cancelable.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_bubbles_cancelable.htm
new file mode 100644
index 000000000000..4619ee7b5312
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_bubbles_cancelable.htm
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Web Workers: Worker ErrorEvent - bubbles, cancelable</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_false(e.bubbles, "onerror on worker doesn't bubble");
+    assert_true(e.cancelable, "onerror on worker is cancelable");
+  });
+  worker.postMessage("Error Message");
+}, "ErrorEvent on worker doesn't bubble and is cancelable");
+
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_error.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_error.htm
new file mode 100644
index 000000000000..bb7cea12e040
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_error.htm
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+var t1 = async_test("Error handler outside the worker should not see the error value");
+var t2 = async_test("Error handlers inside a worker should see the error value");
+
+test(function() {
+  var worker = new Worker("support/ErrorEvent-error.js");
+  worker.onerror = t1.step_func_done(function(e) {
+    assert_true(/hello/.test(e.message));
+    assert_equals(e.error, null);
+  });
+
+  var messages = 0;
+  worker.onmessage = t2.step_func(function(e) {
+    ++messages;
+    var data = e.data;
+    assert_in_array(data.source, ["onerror", "event listener"]);
+    assert_equals(data.value, "hello");
+    if (messages == 2) {
+      t2.done();
+    }
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_filename.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_filename.htm
new file mode 100644
index 000000000000..0faef6fea2a8
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_filename.htm
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.filename </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    var href = location.href;
+    var expected = href.substring(0, href.lastIndexOf('/')) + '/support/ErrorEvent.js';
+    assert_equals(e.filename, expected);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_lineno.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_lineno.htm
new file mode 100644
index 000000000000..ad98172960f6
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_lineno.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.lineno </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_equals(e.lineno, 3);
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_message.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_message.htm
new file mode 100644
index 000000000000..5602d9bc02d9
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_message.htm
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.message </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var message = 'Error Message';
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_greater_than(e.message.indexOf(message), -1);
+  });
+  worker.postMessage(message);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_ErrorEvent_type.htm b/test/fixtures/wpt/workers/Worker_ErrorEvent_type.htm
new file mode 100644
index 000000000000..3a0f85ad9b6b
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_ErrorEvent_type.htm
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title> AbstractWorker ErrorEvent.type </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+// The worker events races with the window's load event; if the worker events
+// arrive first, the harness will detect the error event and fail the test.
+setup({ allow_uncaught_exception: true });
+
+async_test(function(t) {
+  var worker = new Worker('./support/ErrorEvent.js');
+  worker.onerror = t.step_func_done(function(e) {
+    assert_class_string(e, 'ErrorEvent');
+    assert_equals(e.type, 'error');
+  });
+  worker.postMessage("Error Message");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_NosniffErr.htm b/test/fixtures/wpt/workers/Worker_NosniffErr.htm
new file mode 100644
index 000000000000..11d4b7c290ad
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_NosniffErr.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> Worker with nosniff X-Content-Type-Options header </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/nosiniff-error-worker.py");
+  worker.onerror = t.step_func_done(function(e) {
+    assert_equals(e.type, 'error');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_basic.htm b/test/fixtures/wpt/workers/Worker_basic.htm
new file mode 100644
index 000000000000..d2b57b4918b0
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_basic.htm
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title> Web Workers Basic Tests </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+function create_worker() {
+  return new Worker('./support/WorkerBasic.js');
+}
+
+test(function() {
+  var worker = create_worker();
+  assert_class_string(worker, "Worker");
+}, "Worker constructor");
+
+async_test(function(t) {
+  var worker = create_worker();
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+  worker.postMessage("start");
+}, "MessageEvent.data");
+
+async_test(function(t) {
+  var worker = create_worker();
+  worker.addEventListener("message", t.step_func_done(function(e) {
+    assert_equals(e.type, "message");
+  }), true);
+  worker.postMessage("start");
+}, "MessageEvent.type");
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_cross_origin_security_err.htm b/test/fixtures/wpt/workers/Worker_cross_origin_security_err.htm
new file mode 100644
index 000000000000..a3e49df79ad4
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_cross_origin_security_err.htm
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<title>Worker cross-origin URL</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+    var w = new Worker("ftp://example.org/support/WorkerBasic.js");
+    w.onerror = t.step_func_done(function(e) {
+      assert_true(e instanceof Event);
+    });
+ }, "Cross-origin classic workers should fail to fetch");
+
+async_test(function(t) {
+    var w = new Worker("ftp://example.org/support/WorkerBasic.js", {type: "module"});
+    w.onerror = t.step_func_done(function(e) {
+      assert_true(e instanceof Event);
+    });
+}, "Cross-origin module workers should fail to fetch");
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_dispatchEvent_ErrorEvent.htm b/test/fixtures/wpt/workers/Worker_dispatchEvent_ErrorEvent.htm
new file mode 100644
index 000000000000..7ba56b89ecf1
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_dispatchEvent_ErrorEvent.htm
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<title> ErrorEvent and Worker.dispatchEvent() </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var event = "error";
+  var filename = './support/ErrorEvent.js';
+  var message = 'Hello Worker';
+  var lineno = 5;
+  var colno = 6;
+  var error = new Error("test");
+  var worker = new Worker(filename);
+  worker.addEventListener(event, t.step_func_done(function(e) {
+    assert_equals(e.type, event, 'type');
+    assert_equals(e.message, message, 'message');
+    assert_equals(e.filename, filename, 'filename');
+    assert_equals(e.lineno, lineno, 'lineno');
+    assert_equals(e.colno, colno, 'colno');
+    assert_equals(e.error, error, 'error');
+  }), true);
+  var e = new ErrorEvent(event, {bubbles:true, cancelable:true, message:message, filename:filename, lineno:lineno, colno:colno, error:error});
+  worker.dispatchEvent(e);
+});
+
+test(function() {
+  var e = new ErrorEvent("error");
+  assert_false("initErrorEvent" in e, "should not be supported");
+}, "initErrorEvent");
+
+test(function() {
+  assert_throws_js(
+    TypeError,
+    () => ErrorEvent(''),
+    "Calling ErrorEvent constructor without 'new' must throw"
+  );
+}, "ErrorEvent constructor called as normal function");
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_script_mimetype.htm b/test/fixtures/wpt/workers/Worker_script_mimetype.htm
new file mode 100644
index 000000000000..d2278d3717c2
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_script_mimetype.htm
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<title>Worker constructor with wrong MIME type scripts</title>
+<meta charset="utf-8">
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+async_test(t => {
+  const worker = new Worker('./support/WorkerText.txt');
+  worker.onmessage = t.unreached_func("Worker should not receive messages");
+  worker.onerror = () => t.done();
+}, "HTTP(S) URLs which respond with text/plain MIME type must not work");
+
+async_test(t => {
+  const worker = new SharedWorker('./support/WorkerText.txt');
+  worker.onmessage = t.unreached_func("Worker should not receive messages");
+  worker.onerror = () => t.done();
+}, "HTTP(S) URLs which respond with text/plain MIME type must not work on SharedWorkers");
+
+async_test(t => {
+  const url = URL.createObjectURL(new Blob(['postMessage("PASS")'])); // no MIME type parameter
+  const worker = new Worker(url);
+  worker.onmessage = () => t.done();
+  worker.onerror = t.unreached_func("Worker should not error");
+}, "blob: URLs should load, despite no MIME type for the backing Blob");
+
+async_test(t => {
+  const url = URL.createObjectURL(new Blob(['postMessage("PASS")'], { type: 'text/plain' }));
+  const worker = new Worker(url);
+  worker.onmessage = () => t.done();
+  worker.onerror = t.unreached_func("Worker should not error");
+}, "blob: URLs should load, despite the wrong MIME type for the backing Blob");
+
+async_test(t => {
+  const url = `data:text/plain,postMessage("PASS");`
+  const worker = new Worker(url);
+  worker.onmessage = () => t.done();
+  worker.onerror = t.unreached_func("Worker should not error");
+}, "data: URLs should load, despite the wrong MIME type");
+
+</script>
diff --git a/test/fixtures/wpt/workers/Worker_terminate_event_queue.htm b/test/fixtures/wpt/workers/Worker_terminate_event_queue.htm
new file mode 100644
index 000000000000..e4f106ad3a86
--- /dev/null
+++ b/test/fixtures/wpt/workers/Worker_terminate_event_queue.htm
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title> AbstractWorker terminate(): clear event queue </title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var testResult;
+  var worker = new Worker('./support/WorkerTerminate.js');
+  worker.onmessage = this.step_func(function(e) {
+    testResult = e.data;
+    if (testResult >= 10000) {
+      worker.terminate();
+      worker.onmessage = this.unreached_func('Unexpected message event');
+      setTimeout(this.step_func_done(function() {
+        assert_equals(testResult, 10000);
+      }), 100);
+    }
+  });
+  worker.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/abrupt-completion.html b/test/fixtures/wpt/workers/abrupt-completion.html
new file mode 100644
index 000000000000..6c09ae4419cc
--- /dev/null
+++ b/test/fixtures/wpt/workers/abrupt-completion.html
@@ -0,0 +1,63 @@
+<!doctype html>
+<meta charset=utf-8>
+<title></title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script>
+
+// Tests that a {Dedicated,Shared}Worker keeps running even if its script
+// evaluation results in an abrupt completion. This corresponds to the "run a
+// worker" algorithm disregarding the return value of "run the {classic,module}
+// script" in its step 24:
+//
+// "If script is a classic script, then run the classic script script.
+// Otherwise, it is a module script; run the module script script."
+
+promise_test(async t => {
+  const worker = new Worker("support/abrupt-completion.js");
+
+  await new Promise(resolve => {
+    worker.onerror = e => {
+      assert_not_equals(e.message.search("uncaught-exception"), -1,
+                        "Correct uncaught exception thrown by worker");
+
+      // Suppress the exception.
+      e.preventDefault();
+
+      resolve();
+    }
+  });
+
+  return new Promise(resolve => {
+    const channel = new MessageChannel();
+
+    channel.port1.onmessage = e => {
+      assert_equals(e.data, "handler-before-throw", "Correct message handler.");
+      resolve();
+    };
+
+    worker.postMessage("", [channel.port2]);
+  });
+}, "DedicatedWorker should correctly handle abrupt completion");
+
+promise_test(async t => {
+  const worker = new SharedWorker("support/abrupt-completion.js");
+
+  // Per spec, runtime errors in shared workers do not propagate to
+  // SharedWorker.onerror (only parse errors do).
+  worker.onerror = t.unreached_func(
+      'onerror should not fire for runtime errors in shared workers');
+
+  return new Promise(resolve => {
+    const channel = new MessageChannel();
+
+    channel.port1.onmessage = e => {
+      assert_equals(e.data, "handler-before-throw", "Correct message handler.");
+      resolve();
+    };
+
+    worker.port.postMessage("", [channel.port2]);
+  });
+}, "SharedWorker should correctly handle abrupt completion");
+
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/WEB_FEATURES.yml b/test/fixtures/wpt/workers/baseurl/alpha/WEB_FEATURES.yml
new file mode 100644
index 000000000000..2d1787baf9a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- importScripts-in-sharedworker.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/import-in-moduleworker.html b/test/fixtures/wpt/workers/baseurl/alpha/import-in-moduleworker.html
new file mode 100644
index 000000000000..2c75dec9ce76
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/import-in-moduleworker.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in module dedicated workers: import</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  var worker = new Worker("../beta/import.py", {type: "module"});
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "gamma/script-module.js");
+  });
+  worker.onerror = this.unreached_func("Got error event");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-sharedworker.html b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-sharedworker.html
new file mode 100644
index 000000000000..6a4111c6c052
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-sharedworker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic shared workers: importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new SharedWorker("../beta/importScripts.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-worker.html b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-worker.html
new file mode 100644
index 000000000000..55907bf4238d
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/importScripts-in-worker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic dedicated workers: importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker("../beta/importScripts.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/worker-in-worker.html b/test/fixtures/wpt/workers/baseurl/alpha/worker-in-worker.html
new file mode 100644
index 000000000000..284425ed3407
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/worker-in-worker.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in workers: new Worker()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  var worker = new Worker("../beta/worker.py");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "gamma");
+  });
+  worker.onerror = this.unreached_func("Got error event");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-moduleworker.html b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-moduleworker.html
new file mode 100644
index 000000000000..7597a1357d1d
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-moduleworker.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in module dedicated workers: XHR</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  var worker = new Worker("../beta/xhr.py", {type: "module"});
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "gamma\n");
+  });
+  worker.onerror = this.unreached_func("Got error event");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-sharedworker.html b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-sharedworker.html
new file mode 100644
index 000000000000..43921b898dcd
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-sharedworker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic shared workers: XHR</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new SharedWorker("../beta/xhr-worker.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-worker.html b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-worker.html
new file mode 100644
index 000000000000..bc58b9b2dd18
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/alpha/xhr-in-worker.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Base URL in classic dedicated workers: XHR</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker("../beta/xhr-worker.py"));
+</script>
diff --git a/test/fixtures/wpt/workers/baseurl/beta/script.js b/test/fixtures/wpt/workers/baseurl/beta/script.js
new file mode 100644
index 000000000000..bef771ff9eba
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/script.js
@@ -0,0 +1 @@
+var result = 'beta/script.js';
diff --git a/test/fixtures/wpt/workers/baseurl/beta/subsharedworker.js b/test/fixtures/wpt/workers/baseurl/beta/subsharedworker.js
new file mode 100644
index 000000000000..de6a8cacaf80
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/subsharedworker.js
@@ -0,0 +1,3 @@
+onconnect = function(e) {
+  e.source.postMessage('beta');
+}
diff --git a/test/fixtures/wpt/workers/baseurl/beta/subworker.js b/test/fixtures/wpt/workers/baseurl/beta/subworker.js
new file mode 100644
index 000000000000..997cecd6ced2
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/subworker.js
@@ -0,0 +1 @@
+postMessage("beta");
diff --git a/test/fixtures/wpt/workers/baseurl/beta/test.txt b/test/fixtures/wpt/workers/baseurl/beta/test.txt
new file mode 100644
index 000000000000..65b2df87f7df
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/beta/test.txt
@@ -0,0 +1 @@
+beta
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/import.js b/test/fixtures/wpt/workers/baseurl/gamma/import.js
new file mode 100644
index 000000000000..1246913a84b7
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/import.js
@@ -0,0 +1,2 @@
+import r from "./script-module.js";
+postMessage(r);
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/importScripts.js b/test/fixtures/wpt/workers/baseurl/gamma/importScripts.js
new file mode 100644
index 000000000000..13820380a83e
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/importScripts.js
@@ -0,0 +1,6 @@
+importScripts('/resources/testharness.js');
+importScripts("script.js");
+test(() => {
+  assert_equals(result, "gamma/script.js");
+});
+done();
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/script-module.js b/test/fixtures/wpt/workers/baseurl/gamma/script-module.js
new file mode 100644
index 000000000000..88d5f82db3e3
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/script-module.js
@@ -0,0 +1 @@
+export default 'gamma/script-module.js';
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/script.js b/test/fixtures/wpt/workers/baseurl/gamma/script.js
new file mode 100644
index 000000000000..0f9ce8eacf4a
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/script.js
@@ -0,0 +1 @@
+var result = 'gamma/script.js';
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/subworker.js b/test/fixtures/wpt/workers/baseurl/gamma/subworker.js
new file mode 100644
index 000000000000..44407358e612
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/subworker.js
@@ -0,0 +1 @@
+postMessage("gamma");
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/test.txt b/test/fixtures/wpt/workers/baseurl/gamma/test.txt
new file mode 100644
index 000000000000..af17f6cc87e4
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/test.txt
@@ -0,0 +1 @@
+gamma
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/worker.js b/test/fixtures/wpt/workers/baseurl/gamma/worker.js
new file mode 100644
index 000000000000..8cfbcaef3129
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/worker.js
@@ -0,0 +1,4 @@
+var worker = new Worker("subworker.js");
+worker.onmessage = function(e) {
+  postMessage(e.data);
+}
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/xhr-worker.js b/test/fixtures/wpt/workers/baseurl/gamma/xhr-worker.js
new file mode 100644
index 000000000000..a9d77827d951
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/xhr-worker.js
@@ -0,0 +1,8 @@
+importScripts('/resources/testharness.js');
+test(t => {
+  var x = new XMLHttpRequest();
+  x.open("GET", "test.txt", false);
+  x.send();
+  assert_equals(x.response, "gamma\n");
+});
+done();
diff --git a/test/fixtures/wpt/workers/baseurl/gamma/xhr.js b/test/fixtures/wpt/workers/baseurl/gamma/xhr.js
new file mode 100644
index 000000000000..70f331565aa6
--- /dev/null
+++ b/test/fixtures/wpt/workers/baseurl/gamma/xhr.js
@@ -0,0 +1,4 @@
+var x = new XMLHttpRequest();
+x.open("GET", "test.txt", false);
+x.send();
+postMessage(x.response);
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/1 b/test/fixtures/wpt/workers/constructors/SharedWorker/1
new file mode 100644
index 000000000000..831434e63990
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/1
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['1', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/1.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/1.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/1.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity
new file mode 100644
index 000000000000..d4c921c5658e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['Infinity', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity-arguments.html
new file mode 100644
index 000000000000..b38e55dc6bae
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>Infinity as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(Infinity, Infinity);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'Infinity', 'first arg (script name)');
+    assert_equals(e.data[1], 'Infinity', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with Infinity');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity.headers
new file mode 100644
index 000000000000..6805c323df5a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/Infinity.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=utf-8
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/NaN b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN
new file mode 100644
index 000000000000..1d06329788c3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['NaN', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/NaN-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN-arguments.html
new file mode 100644
index 000000000000..8a4578a965a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>NaN as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(NaN, NaN);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'NaN', 'first arg (script name)');
+    assert_equals(e.data[1], 'NaN', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with NaN');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/NaN.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN.headers
new file mode 100644
index 000000000000..6805c323df5a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/NaN.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=utf-8
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/SharedWorker-constructor.html b/test/fixtures/wpt/workers/constructors/SharedWorker/SharedWorker-constructor.html
new file mode 100644
index 000000000000..7909eb536953
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/SharedWorker-constructor.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Test SharedWorker constructor functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  assert_throws_js(Error,
+                   function() {
+                     new SharedWorker({toString:function(){throw new Error()}})},
+                   'toString exception should be propagated');
+}, 'Test toString propagation exception.');
+
+test(() => {
+  assert_throws_js(TypeError,
+                   function() { new SharedWorker(); },
+                   'invoking SharedWorker constructor without arguments should result ' +
+                   'in an exception.')
+}, 'Test Sharedworker creation with no arguments');
+
+
+test(() => {
+  assert_throws_dom("SyntaxError",
+                    function() { var Sharedworker = new SharedWorker('http://invalid:123$'); },
+                    'Invoking SharedWorker constructor with invalid script URL should ' +
+                    'result in an exception.');
+}, 'Test invalid script URL.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/URLMismatchError.htm b/test/fixtures/wpt/workers/constructors/SharedWorker/URLMismatchError.htm
new file mode 100644
index 000000000000..683d201ad3a0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/URLMismatchError.htm
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Web Workers: SharedWorker - same name, different URL</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+setup({ single_test: true });
+
+let counter = 0
+const maybeDone = () => {
+  if(counter) {
+    done()
+  }
+  counter++
+}
+
+const worker = new SharedWorker('shared-worker.js', 'name');
+worker.port.postMessage("trigger a response")
+worker.port.onmessage = e => {
+  assert_equals(e.data, "ping")
+  maybeDone()
+}
+
+// This used to throw "URLMismatchError", but the standard changed
+const worker2 = new SharedWorker('1', 'name');
+worker2.port.onmessage = e => {
+  assert_array_equals(e.data, ["1", "name"])
+  maybeDone()
+}
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/WEB_FEATURES.yml b/test/fixtures/wpt/workers/constructors/SharedWorker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..73744331853b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [shared-workers]
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.html b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.html
new file mode 100644
index 000000000000..0ab41d25c906
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>connect event</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('connect-event.js');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_true(e.data[0], "e.data === ''");
+    assert_true(e.data[1], "e instanceof MessageEvent");
+    assert_true(e.data[2], "e.ports.length == 1");
+  });
+}, 'Test connect event for a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.js b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.js
new file mode 100644
index 000000000000..2cf26a723e8e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/connect-event.js
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage([e.data === '', e instanceof MessageEvent, e.ports.length == 1]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-name.html b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-name.html
new file mode 100644
index 000000000000..25277042e21b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-name.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<title>creating a dummy shared worker with name "foo"</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', 'foo');
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.html b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.html
new file mode 100644
index 000000000000..59a449ad7d87
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<title>creating a dummy shared worker</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('dummy-shared-worker.js');
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.js b/test/fixtures/wpt/workers/constructors/SharedWorker/dummy-shared-worker.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/empty-name.html b/test/fixtures/wpt/workers/constructors/SharedWorker/empty-name.html
new file mode 100644
index 000000000000..94771d27c9eb
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/empty-name.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<title>creating a dummy shared worker with explicit name ""</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', '');
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/empty.js b/test/fixtures/wpt/workers/constructors/SharedWorker/empty.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.html b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.html
new file mode 100644
index 000000000000..2da4fc1cee6e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>members of SharedWorkerGlobalScope</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('global-members.js');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, '');
+  });
+}, 'Test if global members exist in a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.js b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.js
new file mode 100644
index 000000000000..453da6aae514
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/global-members.js
@@ -0,0 +1,9 @@
+const expected = 'self location close onerror importScripts navigator addEventListener removeEventListener dispatchEvent name onconnect setTimeout clearTimeout setInterval clearInterval'.split(' ');
+let log = '';
+for (let i = 0; i < expected.length; ++i) {
+  if (!(expected[i] in self))
+    log += expected[i] + ' did not exist\n';
+}
+onconnect = e => {
+  e.ports[0].postMessage(log);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.html b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.html
new file mode 100644
index 000000000000..a8f69981687a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<title>expected interface objects/constructors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const expected = 'XMLHttpRequest WebSocket EventSource MessageChannel Worker'.split(' ');
+  const supported = [];
+  for (let i = 0; i < expected.length; ++i) {
+  if (expected[i] in window)
+     supported.push(expected[i]);
+  }
+  const worker = new SharedWorker('interface-objects.js');
+  worker.port.start();
+  worker.port.postMessage(supported);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 'These were missing: ');
+  });
+}, 'Test if interface objects exist in a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.js b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.js
new file mode 100644
index 000000000000..2a7aaee687a4
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/interface-objects.js
@@ -0,0 +1,13 @@
+let prt;
+const handleCall = e => {
+  const log = [];
+  for (let i = 0; i < e.data.length; ++i) {
+    if (!(e.data[i] in self))
+      log.push(e.data[i]);
+  }
+  prt.postMessage('These were missing: '+log.join(', '));
+};
+onconnect = e => {
+  prt = e.ports[0];
+  prt.onmessage = handleCall;
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/name.html b/test/fixtures/wpt/workers/constructors/SharedWorker/name.html
new file mode 100644
index 000000000000..4531cb1b800b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/name.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>self.name</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('name.js', 'hello');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 'hello');
+  });
+}, 'Test self.name in a shared worker');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/name.js b/test/fixtures/wpt/workers/constructors/SharedWorker/name.js
new file mode 100644
index 000000000000..2bc2a4b18b50
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/name.js
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(self.name);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/no-arguments-ctor.html b/test/fixtures/wpt/workers/constructors/SharedWorker/no-arguments-ctor.html
new file mode 100644
index 000000000000..5a1231d7b596
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/no-arguments-ctor.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>no arguments</title>
+<link rel=help href="http://www.whatwg.org/html/#sharedworker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-interface-call">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  assert_throws_js(TypeError, () => {
+    const worker = new SharedWorker();
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/null b/test/fixtures/wpt/workers/constructors/SharedWorker/null
new file mode 100644
index 000000000000..16f02d513161
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/null
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['null', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/null-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/null-arguments.html
new file mode 100644
index 000000000000..dd5e5773edbb
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/null-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>null as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(null, null);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'null', 'first arg (script name)');
+    assert_equals(e.data[1], '', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with null');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/null.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/null.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/null.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/number-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/number-arguments.html
new file mode 100644
index 000000000000..8f90baa89854
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/number-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>1 as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(1, 1);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], '1', 'first arg (script name)');
+    assert_equals(e.data[1], '1', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with 1');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.html b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.html
new file mode 100644
index 000000000000..706420c5e4a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>worker.port.onmessage</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('port-onmessage.js', '');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_true(e.data);
+  });
+}, 'Test SharedWorker.port.onmessage');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.js b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.js
new file mode 100644
index 000000000000..64ef84df15a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-onmessage.js
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(true);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-properties.html b/test/fixtures/wpt/workers/constructors/SharedWorker/port-properties.html
new file mode 100644
index 000000000000..e2a1d5b2a8f4
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-properties.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<title>worker.port</title>
+<link rel=help href="http://www.whatwg.org/html/#sharedworker">
+<link rel=help href="http://www.whatwg.org/html/#messageport">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', '');
+  assert_true('port' in worker, "port");
+  assert_true('postMessage' in worker.port, "postMessage");
+  assert_true('start' in worker.port, "start");
+  assert_true('close' in worker.port, "close");
+  assert_true('onmessage' in worker.port, "onmessage");
+  assert_true('addEventListener' in worker.port, "addEventListener");
+  assert_true('removeEventListener' in worker.port, "removeEventListener");
+  assert_true('dispatchEvent' in worker.port, "dispatchEvent");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/port-readonly.html b/test/fixtures/wpt/workers/constructors/SharedWorker/port-readonly.html
new file mode 100644
index 000000000000..cfb5f3afa514
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/port-readonly.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setting worker.port</title>
+<link rel=help href="http://www.whatwg.org/html/#sharedworker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#dfn-attribute-setter">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const worker = new SharedWorker('empty.js', '');
+  const x = worker.port;
+  worker.port = 1;
+  assert_equals(worker.port, x);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/same-origin.html b/test/fixtures/wpt/workers/constructors/SharedWorker/same-origin.html
new file mode 100644
index 000000000000..4f1b62a6605b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/same-origin.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<title>same-origin checks</title>
+<meta name="timeout" content="long">
+<link rel=help href="https://html.spec.whatwg.org/multipage/workers.html#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// Needed to prevent a race condition if a worker throws an exception that may or may
+// not propogate to the window before the tests finish
+setup({allow_uncaught_exception: true});
+
+testSharedWorkerHelper = (t, script) => {
+  const worker = new SharedWorker(script, '');
+  worker.onerror = t.step_func_done(e => {
+    assert_true(e instanceof Event);
+  });
+}
+
+test(() => {
+  assert_throws_dom("SyntaxError", () => { new SharedWorker('https://test:test', ''); });
+}, "non-parsable URL");
+
+async_test(t => {
+  // Parses fine as a URL, fails to fetch according to Fetch
+  testSharedWorkerHelper(t, 'unsupported:');
+}, "unsupported_scheme");
+
+async_test(t => {
+  const worker = new SharedWorker('data:,onconnect = e => { e.ports[0].postMessage(1); }', '');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 1);
+  });
+}, "data_url");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'javascript:""');
+}, "javascript_url");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'about:blank');
+}, "about_blank");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'http://www.opera.com/');
+}, "opera_com");
+
+async_test(t => {
+  testSharedWorkerHelper(t, location.protocol+'//'+location.hostname+':81/');
+}, "port_81");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'https://'+location.hostname+':80/');
+}, "https_port_80");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'https://'+location.hostname+':8000/');
+}, "https_port_8000");
+
+async_test(t => {
+  testSharedWorkerHelper(t, 'http://'+location.hostname+':8012/');
+}, "http_port_8012");
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/setting-port-members.html b/test/fixtures/wpt/workers/constructors/SharedWorker/setting-port-members.html
new file mode 100644
index 000000000000..0c53474ff076
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/setting-port-members.html
@@ -0,0 +1,53 @@
+<!doctype html>
+<title>setting members of worker.port</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+setup(() => {
+  window.worker = new SharedWorker('#', '');
+});
+test(() => {
+  worker.port.postMessage = 1;
+  assert_equals(worker.port.postMessage, 1);
+}, 'postMessage');
+test(() => {
+  worker.port.start = 1;
+  assert_equals(worker.port.start, 1);
+}, 'start');
+test(() => {
+  worker.port.close = 1;
+  assert_equals(worker.port.close, 1);
+}, 'close');
+test(() => {
+  const f = () => {};
+  worker.port.onmessage = f;
+  assert_equals(worker.port.onmessage, f, '() => {}');
+  worker.port.onmessage = 1;
+  assert_equals(worker.port.onmessage, null, '1');
+  worker.port.onmessage = f;
+  worker.port.onmessage = ';';
+  assert_equals(worker.port.onmessage, null, '";"');
+  worker.port.onmessage = f;
+  const handler = {handleEvent:() => {}};
+  worker.port.onmessage = handler;
+  assert_equals(worker.port.onmessage, handler, '{handleEvent:() => {}}');
+  worker.port.onmessage = f;
+  worker.port.onmessage = null;
+  assert_equals(worker.port.onmessage, null, 'null');
+  worker.port.onmessage = f;
+  worker.port.onmessage = undefined;
+  assert_equals(worker.port.onmessage, null, 'undefined');
+}, 'onmessage');
+test(() => {
+  worker.port.addEventListener = 1;
+  assert_equals(worker.port.addEventListener, 1);
+}, 'addEventListener');
+test(() => {
+  worker.port.removeEventListener = 1;
+  assert_equals(worker.port.removeEventListener, 1);
+}, 'removeEventListener');
+test(() => {
+  worker.port.despatchEvent = 1;
+  assert_equals(worker.port.despatchEvent, 1);
+}, 'despatchEvent');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/shared-worker.js b/test/fixtures/wpt/workers/constructors/SharedWorker/shared-worker.js
new file mode 100644
index 000000000000..b6d18855da51
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/shared-worker.js
@@ -0,0 +1,6 @@
+onconnect = e => {
+  const port = e.ports[0];
+  port.onmessage = e => {
+    port.postMessage('ping');
+  }
+}
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/undefined b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined
new file mode 100644
index 000000000000..b8462f19118b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined
@@ -0,0 +1,3 @@
+onconnect = e => {
+  e.ports[0].postMessage(['undefined', self.name]);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/undefined-arguments.html b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined-arguments.html
new file mode 100644
index 000000000000..cd4c86e84ab1
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined-arguments.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>undefined as arguments</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker(undefined, undefined);
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data[0], 'undefined', 'first arg (script name)');
+    assert_equals(e.data[1], '', 'second arg (worker name)');
+  });
+}, 'Test constructing a shared worker with undefined');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/undefined.headers b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/undefined.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.html b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.html
new file mode 100644
index 000000000000..522d31ff56bf
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>unexpected members/interface objects/constructors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new SharedWorker('unexpected-global-properties.js');
+  worker.port.onmessage = t.step_func_done(e => {
+    assert_equals(e.data, '');
+  });
+}, 'Test unexpected properties are not in global scope');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.js b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.js
new file mode 100644
index 000000000000..0af893582142
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/unexpected-global-properties.js
@@ -0,0 +1,9 @@
+const unexpected = 'open print stop getComputedStyle getSelection releaseEvents captureEvents alert confirm prompt addEventStream removeEventStream back forward attachEvent detachEvent navigate DOMParser XMLSerializer XPathEvaluator XSLTProcessor opera Image Option frames Audio SVGUnitTypes SVGZoomAndPan java netscape sun Packages ByteArray closed defaultStatus document event frameElement history innerHeight innerWidth opener outerHeight outerWidth pageXOffset pageYOffset parent screen screenLeft screenTop screenX screenY status top window length'.split(' '); // iterated window in opera and removed expected ones
+let log = '';
+for (let i = 0; i < unexpected.length; ++i) {
+  if (unexpected[i] in self)
+    log += unexpected[i] + ' ';
+}
+onconnect = e => {
+  e.ports[0].postMessage(log);
+};
diff --git a/test/fixtures/wpt/workers/constructors/SharedWorker/unresolvable-url.html b/test/fixtures/wpt/workers/constructors/SharedWorker/unresolvable-url.html
new file mode 100644
index 000000000000..c68968d77dd9
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/SharedWorker/unresolvable-url.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>resolving broken url</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-sharedworker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  assert_throws_dom("SyntaxError", () => {
+    const worker = new SharedWorker('http://foo bar');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/1 b/test/fixtures/wpt/workers/constructors/Worker/1
new file mode 100644
index 000000000000..ea0b7c8f4ccb
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/1
@@ -0,0 +1 @@
+postMessage('1');
diff --git a/test/fixtures/wpt/workers/constructors/Worker/1.headers b/test/fixtures/wpt/workers/constructors/Worker/1.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/1.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.html b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.html
new file mode 100644
index 000000000000..b27f278bff8e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<title>AbstractWorker.onerror</title>
+<link rel=help href="https://html.spec.whatwg.org/multipage/#runtime-script-errors-2">
+<link rel=help href="https://html.spec.whatwg.org/multipage/#report-the-error">
+<link rel=help href="https://html.spec.whatwg.org/multipage/#the-event-handler-processing-algorithm">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  var worker = new Worker('AbstractWorker.onerror.js');
+  var error;
+  worker.onerror = this.step_func(function(a, b, c) {
+    error = a;
+    assert_equals('' + a, '[object ErrorEvent]');
+    assert_true("message" in a, 'ErrorEvent.message');
+    assert_equals(typeof a.message, "string", 'ErrorEvent.message');
+    assert_equals(a.filename, document.URL.replace('.html', '.js'), 'ErrorEvent.filename');
+    assert_true("lineno" in a, 'ErrorEvent.lineno');
+    assert_equals(typeof a.lineno, "number", 'ErrorEvent.lineno');
+    assert_equals(b, undefined, 'unexpected second argument to onerror');
+    assert_equals(c, undefined, 'unexpected third argument to onerror');
+  });
+  worker.onmessage = this.step_func(function(e) {
+    assert_unreached('onmessage was invoked but worker script shouldn\'t have compiled');
+  });
+  window.onerror = this.step_func_done(function(a, b, c, d, e, f) {
+    assert_equals(a, error.message, 'message');
+    assert_equals(b, error.filename, 'filename');
+    assert_equals(c, error.lineno, 'lineno');
+    assert_equals(d, error.colno, 'colno');
+    assert_equals(e, error.error, 'error');
+    assert_equals(f, undefined, 'unexpected sixth argument to onerror');
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.js b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.js
new file mode 100644
index 000000000000..1594decd3709
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/AbstractWorker.onerror.js
@@ -0,0 +1,5 @@
+// Throw a runtime error, the UA must report the error for that script.
+// https://html.spec.whatwg.org/#runtime-script-errors-2
+for (;;)
+  throw new Error("error from onerror.js");
+postMessage(1); // shouldn't do anything since the script doesn't compile
diff --git a/test/fixtures/wpt/workers/constructors/Worker/Blob-url.html b/test/fixtures/wpt/workers/constructors/Worker/Blob-url.html
new file mode 100644
index 000000000000..168fc91ae1d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/Blob-url.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Web Workers: Worker - Blob url</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+
+  async_test(function(t) {
+    var blob = new Blob(["onmessage = function(event) { postMessage(event.data); }"], {type: "text/plain"});
+    var worker = new Worker(window.URL.createObjectURL(blob));
+    var data = "Blob URL";
+    worker.postMessage(data);
+    worker.onmessage = t.step_func(function(event) {
+      assert_equals(event.data, data, "event.data");
+      t.done();
+    });
+  }, "Worker supports Blob url");
+
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/DedicatedWorkerGlobalScope-members.worker.js b/test/fixtures/wpt/workers/constructors/Worker/DedicatedWorkerGlobalScope-members.worker.js
new file mode 100644
index 000000000000..2ef466ccdc30
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/DedicatedWorkerGlobalScope-members.worker.js
@@ -0,0 +1,18 @@
+importScripts("/resources/testharness.js");
+
+var expected = [
+  'postMessage', 'onmessage', /* DedicatedWorkerGlobalScope */
+  'self', 'location', 'close', 'onerror', 'onoffline', 'ononline', /* WorkerGlobalScope */
+  'addEventListener', 'removeEventListener', 'dispatchEvent', /* EventListener */
+  'importScripts', 'navigator', /* WorkerUtils */
+  'setTimeout', 'clearTimeout', 'setInterval', 'clearInterval', /* WindowTimers */
+  'btoa', 'atob' /* WindowBase64 */
+];
+for (var i = 0; i < expected.length; ++i) {
+  var property = expected[i];
+  test(function() {
+    assert_true(property in self);
+  }, "existence of " + property);
+}
+
+done();
diff --git a/test/fixtures/wpt/workers/constructors/Worker/WEB_FEATURES.yml b/test/fixtures/wpt/workers/constructors/Worker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..a489fa783e57
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- use-base-url.html: [base]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/constructors/Worker/Worker-constructor.html b/test/fixtures/wpt/workers/constructors/Worker/Worker-constructor.html
new file mode 100644
index 000000000000..6d6843b77b69
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/Worker-constructor.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<title>Test Worker constructor functionality.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+test(() => {
+  assert_throws_js(Error,
+                   function() {
+                     new Worker({toString:function(){throw new Error()}})},
+                   'toString exception should be propagated');
+}, 'Test toString propagation exception.');
+
+test(() => {
+  try {
+    var foo = {toString:function(){new Worker(foo)}};
+    new Worker(foo);
+  } catch(ex) {
+    assert_true(true, 'trying to create workers recursively should result in an: ' +
+                ex + 'exception.')
+  }
+}, 'Test recursive Worker creation.');
+
+test(() => {
+  assert_throws_js(TypeError,
+                   function() { new Worker(); },
+                   'invoking Worker constructor without arguments should result ' +
+                   'in an exception.')
+}, 'Test worker creation with no arguments');
+
+async_test(t => {
+  var worker = new Worker('');
+  worker.onerror = function(e) {
+    e.preventDefault();
+    t.done();
+  }
+}, 'Test Worker creation with empty script URL.');
+
+test(() => {
+  assert_throws_dom("SyntaxError",
+                    function() { var worker = new Worker('http://invalid:123$'); },
+                    'Invoking Worker constructor with invalid script URL should ' +
+                    'result in an exception.');
+}, 'Test invalid script URL.');
+
+async_test(t => {
+  var worker = new Worker('does-not-exist.js');
+  worker.onerror = function(e) {
+    t.done();
+  }
+}, 'Test not existent script URL.');
+
+test(() => {
+  var worker = new Worker('../../support/Worker-common.js');
+  assert_true('postMessage' in worker,
+              'worker.postMessage did not exist.');
+  assert_true('addEventListener' in worker,
+              'worker.addEventListener did not exist.');
+}, 'Test the Worker object defines postMessage() and addEventListener().');
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/constructor-utf16-bom.html b/test/fixtures/wpt/workers/constructors/Worker/constructor-utf16-bom.html
new file mode 100644
index 000000000000..0e423922feaf
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/constructor-utf16-bom.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Worker constructor: UTF-16 BOM should trigger error</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+function test_utf16_bom(url, title) {
+    async_test(t => {
+        const worker = new Worker(url);
+
+        worker.onmessage = t.unreached_func(`${title} should result to a compile error`);
+
+        worker.onerror = t.step_func_done(e => {
+            assert_true(true);
+        });
+    }, title);
+}
+
+test_utf16_bom("script-utf16be.js", "Worker with UTF-16BE BOM");
+test_utf16_bom("script-utf16le.js", "Worker with UTF-16LE BOM");
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/ctor-1.html b/test/fixtures/wpt/workers/constructors/Worker/ctor-1.html
new file mode 100644
index 000000000000..bd865261fc6e
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/ctor-1.html
@@ -0,0 +1,23 @@
+<!--
+postMessage('FAIL');
+/*
+-->
+<!doctype html>
+<title>1 as argument</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-DOMString">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker(1);
+  worker.addEventListener('message', t.step_func_done(function(e) {
+    assert_equals(e.data, '1')
+  }), false);
+});
+</script>
+<!--
+*/
+//-->
diff --git a/test/fixtures/wpt/workers/constructors/Worker/ctor-null.html b/test/fixtures/wpt/workers/constructors/Worker/ctor-null.html
new file mode 100644
index 000000000000..94ab71aeff62
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/ctor-null.html
@@ -0,0 +1,23 @@
+<!--
+postMessage('FAIL');
+/*
+-->
+<!doctype html>
+<title>null as argument</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-DOMString">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker(null);
+  worker.addEventListener('message', t.step_func_done(function(e) {
+    assert_equals(e.data, 'null')
+  }), false);
+});
+</script>
+<!--
+*/
+//-->
diff --git a/test/fixtures/wpt/workers/constructors/Worker/ctor-undefined.html b/test/fixtures/wpt/workers/constructors/Worker/ctor-undefined.html
new file mode 100644
index 000000000000..2d9eb6e65637
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/ctor-undefined.html
@@ -0,0 +1,23 @@
+<!--
+postMessage('FAIL');
+/*
+-->
+<!doctype html>
+<title>undefined as argument</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker">
+<link rel=help href="http://dev.w3.org/2006/webapi/WebIDL/#es-DOMString">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker(undefined);
+  worker.addEventListener('message', t.step_func_done(function(e) {
+    assert_equals(e.data, 'undefined')
+  }), false);
+});
+</script>
+<!--
+*/
+//-->
diff --git a/test/fixtures/wpt/workers/constructors/Worker/expected-self-properties.worker.js b/test/fixtures/wpt/workers/constructors/Worker/expected-self-properties.worker.js
new file mode 100644
index 000000000000..72edf495eb67
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/expected-self-properties.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+var expected = ['XMLHttpRequest', 'WebSocket', 'EventSource', 'MessageChannel', 'Worker'];
+for (var i = 0; i < expected.length; ++i) {
+  var property = expected[i];
+  test(function() {
+    assert_true(property in self);
+  }, "existence of " + property);
+}
+
+done();
diff --git a/test/fixtures/wpt/workers/constructors/Worker/null b/test/fixtures/wpt/workers/constructors/Worker/null
new file mode 100644
index 000000000000..6d079b514cf5
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/null
@@ -0,0 +1 @@
+postMessage('null');
diff --git a/test/fixtures/wpt/workers/constructors/Worker/null.headers b/test/fixtures/wpt/workers/constructors/Worker/null.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/null.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/Worker/same-origin.html b/test/fixtures/wpt/workers/constructors/Worker/same-origin.html
new file mode 100644
index 000000000000..56dbfe3b3f3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/same-origin.html
@@ -0,0 +1,65 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>same-origin checks; the script is in a script element</title>
+<meta name="timeout" content="long">
+<link rel=help href="https://html.spec.whatwg.org/multipage/workers.html#dom-worker">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+// Needed to prevent a race condition if a worker throws an exception that may or may
+// not propogate to the window before the tests finish
+setup({allow_uncaught_exception: true});
+
+function testWorkerHelper(t, script) {
+  var worker = new Worker(script);
+  worker.onerror = t.step_func_done(function(e) {
+    assert_true(e instanceof Event);
+  });
+}
+
+test(function() {
+  assert_throws_dom("SyntaxError", function() { new Worker('https://test:test'); });
+}, "non-parsable URL");
+
+async_test(function(t) {
+  // Parses fine as a URL, fails to fetch according to Fetch
+  testWorkerHelper(t, 'unsupported:');
+}, "unsupported_scheme");
+
+async_test(function() {
+  var worker = new Worker('data:,postMessage(1);');
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, 1);
+  });
+}, "data_url");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'about:blank');
+}, "about_blank");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'http://www.example.invalid/');
+}, "example_invalid");
+
+async_test(function(t) {
+  testWorkerHelper(t, location.protocol+'//'+location.hostname+':81/');
+}, "port_81");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'https://'+location.hostname+':80/');
+}, "https_port_80");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'https://'+location.hostname+':8000/');
+}, "https_port_8000");
+
+async_test(function(t) {
+  testWorkerHelper(t, 'http://'+location.hostname+':8012/');
+}, "http_post_8012");
+
+async_test(function(t) {
+  testWorkerHelper(t,'javascript:""');
+}, "javascript_url");
+
+</script>
diff --git a/test/fixtures/wpt/workers/constructors/Worker/sample_worker/worker.js b/test/fixtures/wpt/workers/constructors/Worker/sample_worker/worker.js
new file mode 100644
index 000000000000..19bbea58e767
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/sample_worker/worker.js
@@ -0,0 +1 @@
+onmessage = function(event) { postMessage(event.data); }
diff --git a/test/fixtures/wpt/workers/constructors/Worker/script-utf16be.js b/test/fixtures/wpt/workers/constructors/Worker/script-utf16be.js
new file mode 100644
index 000000000000..fa15f44bd0a6
Binary files /dev/null and b/test/fixtures/wpt/workers/constructors/Worker/script-utf16be.js differ
diff --git a/test/fixtures/wpt/workers/constructors/Worker/script-utf16le.js b/test/fixtures/wpt/workers/constructors/Worker/script-utf16le.js
new file mode 100644
index 000000000000..6253e4ceac25
Binary files /dev/null and b/test/fixtures/wpt/workers/constructors/Worker/script-utf16le.js differ
diff --git a/test/fixtures/wpt/workers/constructors/Worker/terminate.html b/test/fixtures/wpt/workers/constructors/Worker/terminate.html
new file mode 100644
index 000000000000..b9af76e2fb1b
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/terminate.html
@@ -0,0 +1,34 @@
+<!doctype html>
+<title>terminate()</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-worker-terminate">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var t = async_test();
+t.step(function() {
+  var worker = new Worker('terminate.js');
+  var i = 0;
+  var expected;
+
+  worker.onmessage = t.step_func(function() {
+    i++;
+  });
+
+  setTimeout(t.step_func(function() {
+    expected = i;
+    start_time = Date.now();
+    //Hang the main thread for a bit to give the worker the chance to post some more messages
+    while(Date.now() - start_time < 500) {
+      //pass
+    }
+    worker.terminate();
+
+    setTimeout(t.step_func(function() {
+      assert_equals(i, expected);
+      t.done();
+    }), 100);
+
+  }), 100);
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/terminate.js b/test/fixtures/wpt/workers/constructors/Worker/terminate.js
new file mode 100644
index 000000000000..e6349c3320ee
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/terminate.js
@@ -0,0 +1,4 @@
+(function f() {
+  postMessage(1);
+  setTimeout(f, 0);
+})();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/constructors/Worker/undefined b/test/fixtures/wpt/workers/constructors/Worker/undefined
new file mode 100644
index 000000000000..bc7f482e94ad
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/undefined
@@ -0,0 +1 @@
+postMessage('undefined');
diff --git a/test/fixtures/wpt/workers/constructors/Worker/undefined.headers b/test/fixtures/wpt/workers/constructors/Worker/undefined.headers
new file mode 100644
index 000000000000..e7ec0d6699d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/undefined.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript
diff --git a/test/fixtures/wpt/workers/constructors/Worker/unexpected-self-properties.worker.js b/test/fixtures/wpt/workers/constructors/Worker/unexpected-self-properties.worker.js
new file mode 100644
index 000000000000..acdd0eb303b4
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/unexpected-self-properties.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+var unexpected = ['open', 'print', 'stop', 'getComputedStyle', 'getSelection', 'releaseEvents', 'captureEvents', 'alert', 'confirm', 'prompt', 'addEventStream', 'removeEventStream', 'back', 'forward', 'attachEvent', 'detachEvent', 'navigate', 'DOMParser', 'XMLSerializer', 'XPathEvaluator', 'XSLTProcessor', 'opera', 'Image', 'Option', 'frames', 'Audio', 'SVGUnitTypes', 'SVGZoomAndPan', 'java', 'netscape', 'sun', 'Packages', 'ByteArray', 'closed', 'defaultStatus', 'document', 'event', 'frameElement', 'history', 'innerHeight', 'innerWidth', 'opener', 'outerHeight', 'outerWidth', 'pageXOffset', 'pageYOffset', 'parent', 'screen', 'screenLeft', 'screenTop', 'screenX', 'screenY', 'status', 'top', 'window', 'length', 'SharedWorker']; // iterated window in opera and removed expected ones
+for (var i = 0; i < unexpected.length; ++i) {
+  var property = unexpected[i];
+  test(function() {
+    assert_false(property in self);
+  }, "existence of " + property);
+}
+
+done();
diff --git a/test/fixtures/wpt/workers/constructors/Worker/use-base-url.html b/test/fixtures/wpt/workers/constructors/Worker/use-base-url.html
new file mode 100644
index 000000000000..94ce2a71f142
--- /dev/null
+++ b/test/fixtures/wpt/workers/constructors/Worker/use-base-url.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Use the document base url when resolving worker URLs</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<base href="/workers/constructors/Worker/sample_worker/">
+<script>
+    async_test(function(t) {
+        var worker = new Worker('worker.js');
+        var data = "foo";
+        worker.postMessage(data);
+        worker.onmessage = t.step_func_done(function(event) {
+            assert_equals(event.data, data, "event.data does not match expected data");
+        });
+        worker.onerror = t.unreached_func("received error event");
+    }, "Use the document base url when resolving worker URLs");
+</script>
diff --git a/test/fixtures/wpt/workers/data-url-shared-window.html b/test/fixtures/wpt/workers/data-url-shared-window.html
new file mode 100644
index 000000000000..7459f592861b
--- /dev/null
+++ b/test/fixtures/wpt/workers/data-url-shared-window.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<head>
+<title>data URL shared worker</title>
+</head>
+<body>
+<script>
+onmessage = event => {
+  const port = event.ports[0];
+  // This shared worker counts the total number of connected documents and
+  // notifies the connector of it.
+  const kScript =
+      "onconnect = e => {" +
+      "  if (self.count === undefined)" +
+      "    self.count = 0;" +
+      "  self.count++;" +
+      "  e.ports[0].postMessage(self.count);" +
+      "};";
+  const worker = new SharedWorker('data:application/javascript,' + kScript);
+  worker.port.onmessage = e => port.postMessage(e.data);
+};
+
+window.opener.postMessage('LOADED', '*');
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/data-url-shared.html b/test/fixtures/wpt/workers/data-url-shared.html
new file mode 100644
index 000000000000..aae76d46cd7a
--- /dev/null
+++ b/test/fixtures/wpt/workers/data-url-shared.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<title>data URL shared workers</title>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+function assert_worker_sends_pass(test_desc, mime_type, worker_code) {
+  async_test(function(t) {
+    var w = new SharedWorker(`data:${mime_type},onconnect = function(e) { port = e.ports[0]; ${worker_code}}`);
+    w.port.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data, 'PASS');
+    });
+    w.port.postMessage('SEND_PASS');
+  }, test_desc);
+}
+
+function assert_worker_throws(test_desc, worker_code) {
+  assert_worker_sends_pass(test_desc, '', `try { ${worker_code}; port.postMessage("FAIL"); } catch (e) { port.postMessage("PASS"); }`);
+}
+
+// Any MIME type allowed
+assert_worker_sends_pass('application/javascript MIME allowed', 'application/javascript', 'port.postMessage("PASS")');
+assert_worker_sends_pass('text/plain MIME allowed', 'text/plain', 'port.postMessage("PASS")');
+assert_worker_sends_pass('empty MIME allowed', '', 'port.postMessage("PASS")');
+
+// Communications goes both ways
+assert_worker_sends_pass('communication goes both ways', 'application/javascript', 'port.onmessage = function(e) { port.postMessage("PASS"); }');
+
+// test access to storage APIs
+
+// https://w3c.github.io/IndexedDB/#dom-idbfactory-open
+assert_worker_sends_pass('indexedDB is present', '', 'port.postMessage("indexedDB" in self ? "PASS" : "FAIL")');
+assert_worker_throws('indexedDB is inaccessible', 'self.indexedDB.open("someDBName")');
+// Other standardized storage APIs are either not exposed to workers
+// (e.g. window.localStorage, window.sessionStorage), or are [SecureContext]
+// (e.g. self.caches).
+
+// 'data:' workers are cross-origin
+assert_worker_sends_pass('cross-origin worker', '', 'fetch("/").then(() => port.postMessage("FAIL"), () => port.postMessage("PASS"))');
+
+// 'data:' workers have opaque origin
+assert_worker_sends_pass('worker has opaque origin', 'application/javascript', 'port.postMessage(self.location.origin == "null" ?  "PASS" : "FAIL")');
+
+function openWindow(url) {
+  return new Promise(resolve => {
+    const win = window.open(url, '_blank');
+    add_completion_callback(() => win.close());
+    window.onmessage = e => {
+      assert_equals(e.data, 'LOADED');
+      resolve(win);
+    };
+  });
+}
+
+promise_test(() => {
+  const kWindowURL = 'data-url-shared-window.html';
+  const kRemoteWindowURL = get_host_info().HTTP_REMOTE_ORIGIN +
+                           '/workers/data-url-shared-window.html';
+  return openWindow(kWindowURL)
+    .then(win => {
+        const channel = new MessageChannel;
+        win.postMessage(channel.port1, '*', [channel.port1]);
+        return new Promise(resolve => channel.port2.onmessage = resolve);
+      })
+    .then(msg_event => {
+        assert_equals(msg_event.data, 1);
+        return openWindow(kRemoteWindowURL);
+      })
+    .then(win => {
+        const channel = new MessageChannel;
+        win.postMessage(channel.port1, '*', [channel.port1]);
+        return new Promise(resolve => channel.port2.onmessage = resolve);
+      })
+    .then(msg_event => assert_equals(msg_event.data, 1));
+}, 'A data: URL shared worker should not be shared among origins.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/data-url.html b/test/fixtures/wpt/workers/data-url.html
new file mode 100644
index 000000000000..f8fe65e520c4
--- /dev/null
+++ b/test/fixtures/wpt/workers/data-url.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<title>data URL dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// Helper assert functions -START-
+function assert_worker_sends_pass(test_desc, mime_type, worker_code) {
+  async_test(function(t) {
+    var w = new Worker(`data:${mime_type},${worker_code}`);
+    w.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data, 'PASS');
+    });
+    w.postMessage('SEND_PASS');
+  }, test_desc);
+}
+
+function assert_worker_throws(test_desc, worker_code) {
+  assert_worker_sends_pass(test_desc, '', `try { ${worker_code}; self.postMessage("FAIL"); } catch (e) { self.postMessage("PASS"); }`);
+}
+
+function assert_worker_construction_fails(test_desc, mime_type, worker_code) {
+  async_test(function(t) {
+    var w = new Worker(`data:${mime_type},${worker_code};postMessage("PASS")`);
+    w.onmessage = t.step_func_done(function(e) {
+      assert_unreached('Should not receive any message back.');
+    });
+    w.onerror = t.step_func_done(function(e) {
+      assert_true(true, 'Should throw ' + e.message);
+      // Stop the error from being propagated to the WPT test harness
+      e.preventDefault();
+    });
+  }, test_desc);
+}
+// Helper assert functions -END-
+
+// Actual tests -START-
+
+// Any MIME type allowed
+assert_worker_sends_pass('application/javascript MIME allowed', 'application/javascript', 'self.postMessage("PASS")');
+assert_worker_sends_pass('text/plain MIME allowed', 'text/plain', 'self.postMessage("PASS")');
+assert_worker_sends_pass('empty MIME allowed', '', 'self.postMessage("PASS")');
+
+// Communications goes both ways
+assert_worker_sends_pass('communication goes both ways', 'application/javascript', 'onmessage = function(e) { self.postMessage("PASS"); }');
+
+// test access to storage APIs
+
+// https://w3c.github.io/IndexedDB/#dom-idbfactory-open
+assert_worker_sends_pass('indexedDB is present', '', 'self.postMessage("indexedDB" in self ? "PASS" : "FAIL")');
+assert_worker_throws('indexedDB is inaccessible', 'self.indexedDB.open("someDBName")');
+
+// Other standardized storage APIs are either not exposed to workers
+// (e.g. window.localStorage, window.sessionStorage), or are [SecureContext]
+// (e.g. self.caches).
+
+// 'data:' workers are cross-origin
+assert_worker_sends_pass('cross-origin worker', '', 'fetch("/").then(() => self.postMessage("FAIL"), () => self.postMessage("PASS"))');
+
+// 'data:' workers have opaque origin
+assert_worker_sends_pass('worker has opaque origin', 'application/javascript', 'if (self.location.origin == "null") {postMessage("PASS");} else {postMessage("FAIL");}');
+
+setup({allow_uncaught_exception:true});
+// invalid javascript will trigger an ErrorEvent
+assert_worker_construction_fails('invalid javascript produces error', 'application/javascript', '}x=3');
+
+// Actual tests -END-
+</script>
diff --git a/test/fixtures/wpt/workers/dedicated-worker-from-blob-url.window.js b/test/fixtures/wpt/workers/dedicated-worker-from-blob-url.window.js
new file mode 100644
index 000000000000..61a1c06c246a
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-from-blob-url.window.js
@@ -0,0 +1,47 @@
+function message_from_port(port) {
+  return new Promise((resolve, reject) => {
+    port.onmessage = e => resolve(e.data);
+    port.onerror = e => reject(e);
+  });
+}
+
+promise_test(async t => {
+  const run_result = 'worker_OK';
+  const blob_contents = 'self.postMessage("' + run_result + '");';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new Worker(url);
+  const reply = await message_from_port(worker);
+  assert_equals(reply, run_result);
+}, 'Creating a dedicated worker from a blob URL works.');
+
+promise_test(async t => {
+  const run_result = 'worker_OK';
+  const blob_contents = 'self.postMessage("' + run_result + '");';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new Worker(url);
+  URL.revokeObjectURL(url);
+  const reply = await message_from_port(worker);
+  assert_equals(reply, run_result);
+}, 'Creating a dedicated worker from a blob URL works immediately before revoking.');
+
+promise_test(async t => {
+  const run_result = false;
+  const blob_contents = `
+let constructedRequest = false;
+try {
+  new Request("./file.js");
+  constructedRequest = true;
+} catch (e) {}
+self.postMessage(constructedRequest);
+`;
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new Worker(url);
+  const reply = await message_from_port(worker);
+  assert_equals(reply, run_result, "Should not be able to resolve request with relative file path in blob");
+}, 'Blob URLs should not resolve relative to document base URL.');
diff --git a/test/fixtures/wpt/workers/dedicated-worker-in-data-url-context.window.js b/test/fixtures/wpt/workers/dedicated-worker-in-data-url-context.window.js
new file mode 100644
index 000000000000..124914012dbb
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-in-data-url-context.window.js
@@ -0,0 +1,111 @@
+// META: title=data URL dedicated worker in data URL context
+// META: script=/service-workers/service-worker/resources/test-helpers.sub.js
+const mimeType = 'application/javascript';
+
+// Tests creating a dedicated worker in a data URL iframe.
+promise_test(async t => {
+  const nestedWorkerScriptURL =
+      new URL('/workers/support/post-message-on-load-worker.js', location.href);
+
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a dedicated worker from |nestedWorkerScriptURL|, but that should result in
+  // a failure. This is because the data URL iframe has an opaque origin, and
+  // script fetch is handled as a cross-origin request.
+  const frameCode = `
+      <script>
+      try {
+        const worker = new Worker('${nestedWorkerScriptURL}');
+        worker.onmessage = e => {
+          window.parent.postMessage(
+              'Worker construction unexpectedly succeeded', '*');
+        };
+        worker.onerror = e => window.parent.postMessage('PASS', '*');
+      } catch (e) {
+        // Cross-origin request should asynchronously fail during worker script
+        // fetch because its request mode is 'same-origin'.
+        window.parent.postMessage(
+            'Worker construction unexpectedly synchronously failed', '*');
+      }
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a dedicated worker in a data url frame');
+
+// Tests creating a dedicated worker in a data URL dedicated worker (i.e.,
+// nested dedicated worker).
+promise_test(async t => {
+  const nestedWorkerScriptURL =
+      new URL('/workers/support/post-message-on-load-worker.js', location.href);
+
+  // This code will be executed in a data URL dedicated worker. The worker tries
+  // to create a nested dedicated worker from |nestedWorkerScriptURL|, but that
+  // should result in a failure. This is because the data URL dedicated worker
+  // has an opaque origin, and script fetch is handled as a cross-origin
+  // request.
+  const workerCode = `
+      try {
+        const worker = new Worker('${nestedWorkerScriptURL}');
+        worker.onmessage =
+            e => postMessage('Worker construction unexpectedly succeeded');
+        worker.onerror = e => postMessage('PASS');
+      } catch (e) {
+        // Cross-origin request should asynchronously fail during worker script
+        // fetch because its request mode is 'same-origin'.
+        postMessage('Worker construction unexpectedly synchronously failed');
+      }
+  `;
+
+  const result = await new Promise((resolve, reject) => {
+    const worker = new Worker(`data:${mimeType};base64,${btoa(workerCode)}`);
+    worker.onmessage = e => resolve(e.data);
+    worker.onerror = e => reject(e.message);
+  });
+  assert_equals(result, 'PASS');
+}, 'Create a dedicated worker in a data url dedicated worker');
+
+// Tests creating a data URL dedicated worker in a data URL iframe.
+promise_test(async t => {
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a data URL dedicated worker. Fetching a data URL from the data URL iframe
+  // whose origin is opaque is allowed, so the worker construction should
+  // succeed. The iframe posts the result to the parent frame.
+  const frameCode = `
+      <script>
+      const worker = new Worker('data:${mimeType},postMessage("PASS");');
+      worker.onmessage = e => window.parent.postMessage(e.data, '*');
+      worker.onerror = e => {
+        window.parent.postMessage('FAIL: ' + e.message, '*');
+      };
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a data url dedicated worker in a data url frame');
+
+// Tests creating a data URL dedicated worker in a data URL dedicated worker
+// (i.e., nested dedicated worker).
+promise_test(async t => {
+  // This code will be executed in a data URL dedicated worker. The worker tries
+  // to create a nested data URL dedicated worker. Fetching a data URL from the
+  // data URL dedicated worker is allowed, so the worker construction should
+  // succeed. The worker posts the result to the parent frame.
+  const workerCode = `
+      const worker = new Worker('data:${mimeType},postMessage("PASS");');
+      worker.onmessage = e => postMessage(e.data);
+      worker.onerror = e => postMessage('FAIL: ' + e.message);
+  `;
+
+  const result = await new Promise((resolve, reject) => {
+    const worker = new Worker(`data:${mimeType};base64,${btoa(workerCode)}`);
+    worker.onmessage = e => resolve(e.data);
+    worker.onerror = e => reject(e.message);
+  });
+  assert_equals(result, 'PASS');
+}, 'Create a data url dedicated worker in a data url dedicated worker');
diff --git a/test/fixtures/wpt/workers/dedicated-worker-parse-error-failure.html b/test/fixtures/wpt/workers/dedicated-worker-parse-error-failure.html
new file mode 100644
index 000000000000..ed475dab105f
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-parse-error-failure.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script src="./support/check-error-arguments.js"></script>
+<script>
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/syntax-error.js';
+  const worker = new Worker(scriptURL, { type: 'classic' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Classic worker construction for script with syntax error should dispatch ' +
+   'an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/static-import-worker.js';
+  const worker = new Worker(scriptURL, { type: 'classic' });
+  worker.postMessage('Send message for tests from main script.');
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on classic worker should dispatch an event named error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/dedicated-worker-runtime-error-is-not-parse-error.html b/test/fixtures/wpt/workers/dedicated-worker-runtime-error-is-not-parse-error.html
new file mode 100644
index 000000000000..94e470c5dc0d
--- /dev/null
+++ b/test/fixtures/wpt/workers/dedicated-worker-runtime-error-is-not-parse-error.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: runtime errors are not parse errors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async () => {
+  const worker = new Worker('support/eval-syntax-error.js');
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_true(event instanceof ErrorEvent,
+      'eval() syntax error should dispatch ErrorEvent, not Event');
+}, 'eval() with syntax error dispatches ErrorEvent at Worker');
+
+promise_test(async () => {
+  const worker = new Worker('support/json-parse-error.js');
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_true(event instanceof ErrorEvent,
+      'JSON.parse() error should dispatch ErrorEvent, not Event');
+}, 'JSON.parse() error dispatches ErrorEvent at Worker');
+
+promise_test(async () => {
+  const worker = new Worker('modules/resources/syntax-error.js', { type: 'classic' });
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_equals(event.constructor, Event,
+      'Script parse error should dispatch Event, not ErrorEvent');
+  assert_false(event instanceof ErrorEvent,
+      'Script parse error should not be an ErrorEvent');
+}, 'Script parse error dispatches plain Event at Worker');
+
+</script>
diff --git a/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.html b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.html
new file mode 100644
index 000000000000..5ac765c7eeae
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<!--
+  This file is an example of a hand-written test using
+  fetch_tests_from_worker().
+  Unlike *.any.js or *.worker.js tests, fetch_tests_from_worker.html/js files
+  are manually written and no generated glue code are involved.
+-->
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker("fetch_tests_from_worker.js"));
+
+// If you want to test on SharedWorker,
+// fetch_tests_from_worker(new SharedWorker("fetch_tests_from_worker.js"));
+
+// See ServiceWorkersHandler in
+// https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py
+// for the generated snippet used in .any.js for service workers.
+// Note: when testing service workers, also add ".https." file flag in the
+// main HTML's file name to run the test on HTTPS.
+</script>
diff --git a/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.js b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.js
new file mode 100644
index 000000000000..01ba12a622f3
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/fetch_tests_from_worker.js
@@ -0,0 +1,28 @@
+// This file is an example of a hand-written test using
+// fetch_tests_from_worker().
+// Unlike *.any.js or *.worker.js tests, fetch_tests_from_worker.html/js files
+// are manually written and no generated glue code are involved.
+
+// fetch_tests_from_worker() requires testharness.js both on the parent
+// document and on the worker.
+importScripts("/resources/testharness.js");
+
+// ============================================================================
+
+// Test body.
+test(() => {
+    assert_equals(1, 1, "1 == 1");
+  },
+  "Test that should pass"
+);
+
+// ============================================================================
+
+// `done()` is always needed at the bottom for dedicated workers and shared
+// workers, even if you write `async_test()` or `promise_test()`.
+// `async_test()` and `promise_test()` called before this `done()`
+// will continue and assertions/failures after this `done()` are not ignored.
+// See
+// https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete
+// for details.
+done();
diff --git a/test/fixtures/wpt/workers/examples/general.any.js b/test/fixtures/wpt/workers/examples/general.any.js
new file mode 100644
index 000000000000..cb5d61eafbec
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/general.any.js
@@ -0,0 +1,34 @@
+// META: global=worker
+
+// See
+// https://web-platform-tests.org/writing-tests/testharness.html#multi-global-tests
+// for how to specify in which global scopes to run this tests,
+// how to specify additional scripts needed, etc.
+
+// testharness.js is imported (via importScripts()) by generated glue code by
+// WPT server.
+// See ClassicWorkerHandler in
+// https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py.
+
+// ============================================================================
+
+// Test body.
+// .any.js tests are always testharness.js-based.
+test(() => {
+    assert_equals(1, 1, "1 == 1");
+  },
+  "Test that should pass"
+);
+
+test(() => {
+    // This file is "general.any.js" but the worker top-level script is
+    // "general.any.worker.js", which is generated by the WPT server.
+    assert_equals(location.pathname, "/workers/examples/general.any.worker.js");
+  },
+  "Worker top-level script is a generated script."
+);
+
+// done() is NOT needed in .any.js tests, as it is called by generated
+// glue code by the WPT server.
+// See ClassicWorkerHandler in
+// https://github.com/web-platform-tests/wpt/blob/master/tools/serve/serve.py.
diff --git a/test/fixtures/wpt/workers/examples/general.worker.js b/test/fixtures/wpt/workers/examples/general.worker.js
new file mode 100644
index 000000000000..aeca236781bf
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/general.worker.js
@@ -0,0 +1,35 @@
+// This file is an example of a test using *.worker.js mechanism.
+// The parent document that calls fetch_tests_from_worker() is auto-generated
+// but there are no generated code in the worker side.
+
+// fetch_tests_from_worker() requires testharness.js both on the parent
+// document and on the worker.
+importScripts("/resources/testharness.js");
+
+// ============================================================================
+
+// Test body.
+test(() => {
+    assert_equals(1, 1, "1 == 1");
+  },
+  "Test that should pass"
+);
+
+test(() => {
+    // This file is "general.worker.js" and this file itself is the worker
+    // top-level script (which is different from the .any.js case).
+    assert_equals(location.pathname, "/workers/examples/general.worker.js");
+  },
+  "Worker top-level script is the .worker.js file itself."
+);
+
+// ============================================================================
+
+// `done()` is always needed at the bottom for dedicated workers and shared
+// workers, even if you write `async_test()` or `promise_test()`.
+// `async_test()` and `promise_test()` called before this `done()`
+// will continue and assertions/failures after this `done()` are not ignored.
+// See
+// https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete
+// for details.
+done();
diff --git a/test/fixtures/wpt/workers/examples/onconnect.any.js b/test/fixtures/wpt/workers/examples/onconnect.any.js
new file mode 100644
index 000000000000..d43a9921833d
--- /dev/null
+++ b/test/fixtures/wpt/workers/examples/onconnect.any.js
@@ -0,0 +1,4 @@
+// META: global=sharedworker
+const t = async_test("onconnect is called");
+onconnect = t.step_func_done((event) => {
+});
diff --git a/test/fixtures/wpt/workers/importscripts_mime.any.js b/test/fixtures/wpt/workers/importscripts_mime.any.js
new file mode 100644
index 000000000000..bfdfc191fd3e
--- /dev/null
+++ b/test/fixtures/wpt/workers/importscripts_mime.any.js
@@ -0,0 +1,52 @@
+// META: global=worker
+//
+// Tentative test for https://github.com/whatwg/html/issues/3255
+
+let test_cases = [
+  // Supported mimetypes:
+  ["text/javascript", true],
+  ["application/javascript", true],
+  ["text/ecmascript", true],
+
+  // Blocked mimetpyes:
+  ["image/png", false],
+  ["text/csv", false],
+  ["video/mpeg", false],
+
+  // Legacy mimetypes:
+  ["text/html", false],
+  ["text/plain", false],
+  ["application/xml", false],
+  ["application/octet-stream", false],
+
+  // Potato mimetypes:
+  ["text/potato", false],
+  ["potato/text", false],
+  ["aaa/aaa", false],
+  ["zzz/zzz", false],
+
+  // Parameterized mime types:
+  ["text/javascript; charset=utf-8", true],
+  ["text/javascript;charset=utf-8", true],
+  ["text/javascript;bla;bla", true],
+  ["text/csv; charset=utf-8", false],
+  ["text/csv;charset=utf-8", false],
+  ["text/csv;bla;bla", false],
+
+  // Funky capitalization:
+  ["Text/html", false],
+  ["text/Html", false],
+  ["TeXt/HtMl", false],
+  ["TEXT/HTML", false],
+];
+
+for (const [mimeType, isScriptType] of test_cases) {
+  test(t => {
+    let import_url = "/workers/support/imported_script.py?mime=" + mimeType;
+    if (isScriptType) {
+      assert_equals(undefined, importScripts(import_url));
+    } else {
+      assert_throws_dom("NetworkError", _ => { importScripts(import_url) })
+    }
+  }, "importScripts() requires scripty MIME types: " + mimeType + " is " + (isScriptType ? "allowed" : "blocked") + ".");
+}
diff --git a/test/fixtures/wpt/workers/importscripts_mime_local.any.js b/test/fixtures/wpt/workers/importscripts_mime_local.any.js
new file mode 100644
index 000000000000..62d690d8af0e
--- /dev/null
+++ b/test/fixtures/wpt/workers/importscripts_mime_local.any.js
@@ -0,0 +1,66 @@
+// META: global=dedicatedworker,sharedworker
+//
+// Tests for https://github.com/whatwg/html/issues/8869
+
+importScripts("/resources/testharness.js");
+
+let test_cases = [
+  // Supported mimetypes:
+  ["text/javascript", true],
+  ["application/javascript", true],
+  ["text/ecmascript", true],
+
+  // Blocked mimetpyes:
+  ["image/png", false],
+  ["text/csv", false],
+  ["video/mpeg", false],
+
+  // Legacy mimetypes:
+  ["text/html", false],
+  ["text/plain", false],
+  ["application/xml", false],
+  ["application/octet-stream", false],
+
+  // Potato mimetypes:
+  ["text/potato", false],
+  ["potato/text", false],
+  ["aaa/aaa", false],
+  ["zzz/zzz", false],
+
+  // Parameterized mime types:
+  ["text/javascript; charset=utf-8", true],
+  ["text/javascript;charset=utf-8", true],
+  ["text/javascript;bla;bla", true],
+  ["text/csv; charset=utf-8", false],
+  ["text/csv;charset=utf-8", false],
+  ["text/csv;bla;bla", false],
+
+  // Funky capitalization:
+  ["Text/html", false],
+  ["text/Html", false],
+  ["TeXt/HtMl", false],
+  ["TEXT/HTML", false],
+];
+
+for (const [mimeType, isScriptType] of test_cases) {
+  test(t => {
+    let import_url = `data:${ mimeType },`;
+    if (isScriptType) {
+      assert_equals(undefined, importScripts(import_url));
+    } else {
+      assert_throws_dom("NetworkError", _ => { importScripts(import_url) })
+    }
+  }, "importScripts() requires scripty MIME types for data: URLs: " + mimeType + " is " + (isScriptType ? "allowed" : "blocked") + ".");
+}
+
+for (const [mimeType, isScriptType] of test_cases) {
+  test(t => {
+    let import_url = URL.createObjectURL(new Blob([""], { type: mimeType }));
+    if (isScriptType) {
+      assert_equals(undefined, importScripts(import_url));
+    } else {
+      assert_throws_dom("NetworkError", _ => { importScripts(import_url) })
+    }
+  }, "importScripts() requires scripty MIME types for blob: URLs: " + mimeType + " is " + (isScriptType ? "allowed" : "blocked") + ".");
+}
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/EventTarget.worker.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/EventTarget.worker.js
new file mode 100644
index 000000000000..954c46c07eca
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/EventTarget.worker.js
@@ -0,0 +1,23 @@
+importScripts("/resources/testharness.js");
+
+test(function(t) {
+    var i = 0;
+    addEventListener("message", function listener(evt) {
+        t.step(function() {
+            ++i;
+            removeEventListener("message", listener, true);
+        });
+    }, true);
+    self.dispatchEvent(new Event("message"));
+    self.dispatchEvent(new Event("message"));
+    assert_equals(i, 1);
+}, "removeEventListener");
+
+test(function() {
+    addEventListener("message", this.step_func(function(evt) {
+        assert_equals(evt.target, self);
+    }), true);
+    self.dispatchEvent(new Event("message"));
+}, "target");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b4d9c5323522
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/onmessage.worker.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/onmessage.worker.js
new file mode 100644
index 000000000000..6f285caac385
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/onmessage.worker.js
@@ -0,0 +1,40 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  self.onmessage = 1;
+  assert_equals(self.onmessage, null,
+                "attribute should return null after being set to a primitive");
+}, "Setting onmessage to 1");
+
+test(function() {
+  var object = {
+    handleEvent: this.unreached_func()
+  };
+  self.onmessage = object;
+  assert_equals(self.onmessage, object,
+                "attribute should return the object it was set to.");
+
+  self.dispatchEvent(new Event("message"));
+}, "Setting onmessage to an object");
+
+test(function() {
+  var triggered = false;
+  var f = function(e) { triggered = true; };
+  self.onmessage = f;
+  assert_equals(self.onmessage, f,
+                "attribute should return the function it was set to.");
+
+  self.dispatchEvent(new Event("message"));
+  assert_true(triggered, "event handler should have been triggered");
+}, "Setting onmessage to a function");
+
+
+test(function() {
+  assert_not_equals(self.onmessage, null,
+                    "attribute should not return null after being set to a function");
+  self.onmessage = 1;
+  assert_equals(self.onmessage, null,
+                "attribute should return null after being set to a primitive");
+}, "Setting onmessage to 1 (again)");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/WEB_FEATURES.yml
new file mode 100644
index 000000000000..6eea69ad8a80
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [postmessage]
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.html
new file mode 100644
index 000000000000..be89478786b6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>e.ports in dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('event-ports-dedicated.js');
+  worker.postMessage(1);
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.js
new file mode 100644
index 000000000000..c5cc9f8d9f58
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/event-ports-dedicated.js
@@ -0,0 +1,3 @@
+onmessage = function(e) {
+  postMessage(e.ports instanceof Array && e.ports.length === 0);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.html
new file mode 100644
index 000000000000..7c019a999348
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>posting an imagedata (from a cloned canvas) in an array</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('imagedata-cloned-canvas-in-array.js');
+  var canvas = document.createElement('canvas');
+  var clone = canvas.cloneNode(true);
+  var ctx = clone.getContext('2d');
+  var imagedata = ctx.getImageData(0, 0, 300, 150);
+  worker.postMessage([imagedata]);
+  worker.onmessage = this.step_func(function(e) {
+    var pixeldata = e.data.data;
+    for (var i = 0; i < pixeldata.length; i++) {
+      assert_equals(pixeldata[i], (i % 4 == 0) ? 128 : 0);
+    }
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.js
new file mode 100644
index 000000000000..76eaee366c78
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/imagedata-cloned-canvas-in-array.js
@@ -0,0 +1,10 @@
+onmessage = function(e) {
+  function processPixels(imagedata) {
+    var pixeldata = imagedata.data;
+    for (var i = 0; i < pixeldata.length; i = i+4) {
+      pixeldata[i] = 128;
+    }
+    postMessage(imagedata);
+  }
+  processPixels(e.data[0]);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.html
new file mode 100644
index 000000000000..91ec632685f3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>'message' event properties</title>
+<link rel=help href="http://www.whatwg.org/html/#dom-dedicatedworkerglobalscope-postmessage">
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+async_test("Properties of the 'message' event").step(function() {
+  var worker = new Worker("message-event.js");
+  worker.onmessage = this.step_func_done(function (evt) {
+    assert_class_string(evt, "MessageEvent");
+    assert_equals(evt.type, "message");
+    assert_false(evt.bubbles, "bubbles should be false");
+    assert_false(evt.cancelable, "cancelable should be false");
+    assert_equals(evt.data, "test");
+    assert_equals(evt.origin, "", "origin");
+    assert_equals(evt.lastEventId, "", "lastEventId");
+    assert_equals(evt.source, null, "source");
+    assert_array_equals(evt.ports, [], "ports");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.js
new file mode 100644
index 000000000000..54a250005e8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/message-event.js
@@ -0,0 +1 @@
+postMessage("test");
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/return-value.worker.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/return-value.worker.js
new file mode 100644
index 000000000000..521251699a08
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/return-value.worker.js
@@ -0,0 +1,8 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  var rv = postMessage(1);
+  assert_equals(rv, undefined);
+}, "return value of postMessage");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.html
new file mode 100644
index 000000000000..1749644908f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>Using dictionary as postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-dictionary.js');
+  var ab = new ArrayBuffer(1);
+  worker.postMessage(ab, {transfer: [ab]});
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data.byteLength, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.js
new file mode 100644
index 000000000000..0cb80f8faeb1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-dictionary.js
@@ -0,0 +1,7 @@
+onmessage = (event) => {
+  try {
+    postMessage(event.data, {transfer: [event.data]});
+  } catch(e) {
+    postMessage(''+e);
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.html
new file mode 100644
index 000000000000..8db06b411642
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>Using [null] in postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-null-in-array.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.js
new file mode 100644
index 000000000000..95a094234b7f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null-in-array.js
@@ -0,0 +1,5 @@
+try {
+  postMessage(false, [null]);
+} catch(e) {
+  postMessage(e instanceof TypeError);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.html
new file mode 100644
index 000000000000..68d9caabc50e
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>Using null in postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-null.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(1, e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.js
new file mode 100644
index 000000000000..6f6f9e799ff1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-null.js
@@ -0,0 +1,5 @@
+try {
+  postMessage(1, null);
+} catch(e) {
+  postMessage(e instanceof TypeError);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.html
new file mode 100644
index 000000000000..c7dcb3c5c0f3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>Using undefined in postMessage's second argument</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('second-argument-undefined.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.js
new file mode 100644
index 000000000000..6f11443c4a88
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/second-argument-undefined.js
@@ -0,0 +1,5 @@
+try {
+  postMessage(1, undefined);
+} catch(e) {
+  postMessage(''+e);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.html
new file mode 100644
index 000000000000..5b3e014e1e08
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setting postMessage</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('setting-postMessage.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.js
new file mode 100644
index 000000000000..5426ebde0d4c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/setting-postMessage.js
@@ -0,0 +1,3 @@
+var x = postMessage;
+postMessage = 1;
+x(postMessage == 1);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.html
new file mode 100644
index 000000000000..c7fbb0f9560d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<title>structured clone of ImageData</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+(async_test()).step(function() {
+  var worker = new Worker('structured-clone-imagedata.js');
+  var ctx = document.createElement('canvas').getContext('2d');
+  var imagedata = ctx.getImageData(0, 0, 300, 150);
+  worker.postMessage(imagedata);
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(''+e.data, '[object ImageData]');
+    assert_equals(e.data.data[0], 128);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.js
new file mode 100644
index 000000000000..04cd7eea5ba8
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-imagedata.js
@@ -0,0 +1,5 @@
+onmessage = function(e) {
+  var imagedata = e.data;
+  imagedata.data[0] = 128;
+  postMessage(imagedata);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.html b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.html
new file mode 100644
index 000000000000..edf4fb7e0e5c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<title>structured clone of message</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var wrapper_test = async_test();
+var tests = [
+      {test:async_test('undefined'), check:function(e) { assert_equals(e.data, undefined); }},
+      {test:async_test('null'), check:function(e) { assert_equals(e.data, null); }},
+      {test:async_test('false'), check:function(e) { assert_false(e.data); }},
+      {test:async_test('true'), check:function(e) { assert_true(e.data); }},
+      {test:async_test('1'), check:function(e) { assert_equals(e.data, 1); }},
+      {test:async_test('NaN'), check:function(e) { assert_equals(e.data, NaN); }},
+      {test:async_test('Infinity'), check:function(e) { assert_equals(e.data, Infinity); }},
+      {test:async_test('string'), check:function(e) { assert_equals(e.data, 'foo'); }},
+      {test:async_test('date'), check:function(e) { assert_equals(e.data instanceof Date, true); }},
+      {test:async_test('regexp'), check:function(e) { assert_equals('' + e.data, '/foo/'); assert_equals(e.data instanceof RegExp, true, 'e.data instanceof RegExp'); }},
+      {test:async_test('self'), check:function(e) { assert_equals(e.data, null); }},
+      {test:async_test('array'), check:function(e) { assert_array_equals(e.data, [undefined, null, false, true, 1, NaN, Infinity, 'foo', null, null]); }},
+      {test:async_test('object'), check:function(e) { assert_object_equals(e.data, {a:undefined, b:null, c:false, d:true, e:1, f:NaN, g:Infinity, h:'foo', k:null, n:null}); }},
+      {test:async_test('error'), check:function(e) { assert_equals(e.data, null, 'new Error()'); }},
+      {test:wrapper_test, check:function(e) { assert_unreached(); }}
+];
+// make wrapper_test pass after 500ms
+setTimeout(tests[tests.length-1].test.step_func(function() {
+  this.done();
+}), 500);
+
+wrapper_test.step(function() {
+  var worker = new Worker('structured-clone-message.js');
+  var i = 0;
+  worker.onmessage = function(e) {
+    tests[i].test.step(function() { tests[i].check(e); this.done(); });
+    i++;
+  };
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.js b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.js
new file mode 100644
index 000000000000..db456e1fbaec
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/DedicatedWorkerGlobalScope/postMessage/structured-clone-message.js
@@ -0,0 +1,14 @@
+var err = new Error('foo');
+var date = new Date();
+// commented out bits are either tested elsewhere or not supported yet. or uncloneable.
+var tests = [undefined, null, false, true, 1, NaN, Infinity, 'foo', date, /foo/, /* ImageData, File, FileData, FileList,*/ null/*self*/,
+              [undefined, null, false, true, 1, NaN, Infinity, 'foo', /*date, /foo/,*/ null/*self*/, /*[], {},*/ null/*err*/],
+              {a:undefined, b:null, c:false, d:true, e:1, f:NaN, g:Infinity, h:'foo', /*i:date, j:/foo/,*/ k:null/*self*/, /*l:[], m:{},*/ n:null/*err*/},
+            null/*err*/];
+for (var i = 0; i < tests.length; ++i) {
+  try {
+    postMessage(tests[i]);
+  } catch(e) {
+    postMessage(''+e);
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/WEB_FEATURES.yml
new file mode 100644
index 000000000000..73744331853b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [shared-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.html b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.html
new file mode 100644
index 000000000000..c3a52d12e8a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>getting name</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+var tests = [['getting.js#1', ''], ['getting.js#2', 'a'], ['getting.js#3', -0]];
+tests.forEach(function(t) {
+  async_test(function() {
+    var w = new SharedWorker(t[0], t[1]);
+    w.port.onmessage = this.step_func(function(e) {
+      assert_true(e.data);
+      this.done();
+    });
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.js b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.js
new file mode 100644
index 000000000000..acf89ca6f678
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/getting.js
@@ -0,0 +1,9 @@
+addEventListener('connect', function(e) {
+  var passed;
+  switch (location.hash) {
+    case '#1': passed = name == ''; break;
+    case '#2': passed = name == 'a'; break;
+    case '#3': passed = name == '0'; break;
+  }
+  e.ports[0].postMessage(passed);
+}, false);
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.html b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.html
new file mode 100644
index 000000000000..ddd856971019
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>setting name</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var w1 = new SharedWorker('setting.js#1', 'x');
+  w1.port.addEventListener('message', this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  }), false);
+  w1.port.start();
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.js b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.js
new file mode 100644
index 000000000000..c705e9c40a6d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/name/setting.js
@@ -0,0 +1,4 @@
+addEventListener('connect', function(e) {
+  name = 1;
+  e.ports[0].postMessage(name);
+}, false);
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.html b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.html
new file mode 100644
index 000000000000..8a0f103d40e1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>onconnect</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var w1 = new SharedWorker('onconnect.js', '');
+  w1.port.addEventListener('message', this.step_func(function(e) {
+    assert_array_equals(e.data, ['null', 'null', 'function', '']);
+  }), false);
+  w1.port.start();
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.js b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.js
new file mode 100644
index 000000000000..34a2be51fc47
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/SharedWorkerGlobalScope/onconnect.js
@@ -0,0 +1,19 @@
+var results = [];
+try {
+  self.onconnect = 1;
+  results.push(String(onconnect));
+} catch(e) {
+  results.push(''+e);
+}
+try {
+  self.onconnect = {handleEvent:function(){}};
+  results.push(String(onconnect));
+} catch(e) {
+  results.push(''+e);
+}
+var f = function(e) {
+  results.push(e.data);
+  e.ports[0].postMessage(results);
+};
+onconnect = f;
+results.push(typeof onconnect);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/WEB_FEATURES.yml
new file mode 100644
index 000000000000..bb8d27860d8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- setInterval.html: [setinterval]
+- setTimeout.html: [settimeout]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.html
new file mode 100644
index 000000000000..0905d07661da
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<title>close() and incoming message</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({ single_test: true });
+
+var worker = new Worker('incoming-message.js');
+worker.onmessage = function(e) {
+  assert_unreached("Got message");
+};
+worker.onerror = function(e) {
+  assert_unreached("Got error");
+};
+worker.postMessage(1);
+setTimeout(done, 2000);
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.js
new file mode 100644
index 000000000000..b4f7e7fc0555
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/incoming-message.js
@@ -0,0 +1,5 @@
+onmessage = function(e) {
+  postMessage(1);
+  throw new Error();
+}
+close();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.html
new file mode 100644
index 000000000000..da7da66d25b8
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<title>close() and sending messages</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('sending-messages.js');
+  var i = 0;
+  worker.onmessage = this.step_func(function(e) {
+    i++;
+    assert_equals(e.data, i);
+    if (i == 2) {
+      this.done();
+    }
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.js
new file mode 100644
index 000000000000..2e0a89828880
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/sending-messages.js
@@ -0,0 +1,3 @@
+postMessage(1);
+close();
+postMessage(2);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.html
new file mode 100644
index 000000000000..2f0ba176d494
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>close() and setInterval</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({ single_test: true });
+
+var worker = new Worker('setInterval.js');
+worker.onmessage = function(e) {
+  assert_unreached("Got message");
+};
+worker.onerror = function(e) {
+  assert_unreached("Got error");
+};
+setTimeout(done, 2000);
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.js
new file mode 100644
index 000000000000..d165d20eab47
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setInterval.js
@@ -0,0 +1,11 @@
+var interval1 = setInterval(function() {
+  clearInterval(interval1);
+  postMessage(1);
+  throw new Error();
+}, 10);
+close();
+var interval2 = setInterval(function() {
+  clearInterval(interval2);
+  postMessage(1);
+  throw new Error();
+}, 10);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.html
new file mode 100644
index 000000000000..2bddc0947f63
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>close() and setTimeout</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({ single_test: true });
+
+var worker = new Worker('setTimeout.js');
+worker.onmessage = function(e) {
+  assert_unreached("Got message");
+};
+worker.onerror = function(e) {
+  assert_unreached("Got error");
+};
+setTimeout(done, 2000);
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.js
new file mode 100644
index 000000000000..55eecb05570f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/close/setTimeout.js
@@ -0,0 +1,7 @@
+function x() {
+  postMessage(1);
+  throw new Error();
+}
+setTimeout(x, 0);
+close();
+setTimeout(x, 0);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/WEB_FEATURES.yml
new file mode 100644
index 000000000000..05c5abb31004
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- redirect-sharedworker.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.html
new file mode 100644
index 000000000000..3da6b7484d89
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>members of WorkerLocation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('members.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], null);
+    assert_equals(e.data[1], location.href.replace('.html', '.js'), 'href');
+    assert_equals(e.data[2], location.protocol, 'protocol');
+    assert_equals(e.data[3], location.host, 'host');
+    assert_equals(e.data[4], location.hostname, 'hostname');
+    assert_equals(e.data[5], location.port, 'port');
+    assert_equals(e.data[6], location.pathname.replace('.html', '.js'), 'pathname');
+    assert_equals(e.data[7], location.search, 'search');
+    assert_equals(e.data[8], '', 'hash');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.js
new file mode 100644
index 000000000000..37235eac8319
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/members.js
@@ -0,0 +1,3 @@
+postMessage([null, location.href, location.protocol, location.host,
+             location.hostname, location.port, location.pathname,
+             location.search, location.hash]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/post-location-members.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/post-location-members.js
new file mode 100644
index 000000000000..e850b76b6e5f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/post-location-members.js
@@ -0,0 +1,8 @@
+postMessage([location.href,
+             location.protocol,
+             location.host,
+             location.hostname,
+             location.port,
+             location.pathname,
+             location.search,
+             location.hash]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-module.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-module.html
new file mode 100644
index 000000000000..b1a14be8f751
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-module.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<title>WorkerLocation with redirects: module dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('helper-redirect.py?fail', {type: 'module'});
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data[0], location.href.replace(/\/[^\/]+$/, '/post-location-members.js?a'));
+    assert_equals(e.data[1], location.protocol);
+    assert_equals(e.data[2], location.host);
+    assert_equals(e.data[3], location.hostname);
+    assert_equals(e.data[4], location.port);
+    assert_equals(e.data[5], location.pathname.replace(/\/[^\/]+$/, '/post-location-members.js'));
+    assert_equals(e.data[6], '?a');
+    assert_equals(e.data[7], '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-sharedworker.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-sharedworker.html
new file mode 100644
index 000000000000..978a99ac8c4e
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect-sharedworker.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<title>WorkerLocation with redirects: classic shared workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+fetch_tests_from_worker(
+    new SharedWorker('/common/redirect.py?location=/workers/interfaces/WorkerGlobalScope/location/redirect.js?a'));
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.html
new file mode 100644
index 000000000000..98a0e5476027
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.html
@@ -0,0 +1,28 @@
+<!--
+/*
+-->
+<!doctype html>
+<title>WorkerLocation with redirects: classic dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('helper-redirect.py?fail');
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data[0], location.href.replace(/\/[^\/]+$/, '/post-location-members.js?a'));
+    assert_equals(e.data[1], location.protocol);
+    assert_equals(e.data[2], location.host);
+    assert_equals(e.data[3], location.hostname);
+    assert_equals(e.data[4], location.port);
+    assert_equals(e.data[5], location.pathname.replace(/\/[^\/]+$/, '/post-location-members.js'));
+    assert_equals(e.data[6], '?a');
+    assert_equals(e.data[7], '');
+  });
+});
+</script>
+<!--
+*/
+//-->
+
+
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.js
new file mode 100644
index 000000000000..2db48544a2d7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/redirect.js
@@ -0,0 +1,7 @@
+importScripts('/resources/testharness.js');
+test(t => {
+    assert_equals(location.pathname, '/workers/interfaces/WorkerGlobalScope/location/redirect.js');
+    assert_equals(location.search, '?a');
+    assert_equals(location.hash, '');
+});
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/returns-same-object.any.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/returns-same-object.any.js
new file mode 100644
index 000000000000..dd3560f040cd
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/returns-same-object.any.js
@@ -0,0 +1,5 @@
+// META: global=worker
+
+test(function() {
+  assert_equals(location, location);
+}, 'location === location');
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.html
new file mode 100644
index 000000000000..7ea79b689704
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<title>setting members of WorkerLocation</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('setting-members.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], null);
+    assert_equals(e.data[1], location.href.replace('.html', '.js'), 'href');
+    assert_equals(e.data[2], location.protocol, 'protocol');
+    assert_equals(e.data[3], location.host, 'host');
+    assert_equals(e.data[4], location.hostname, 'hostname');
+    assert_equals(e.data[5], location.port, 'port');
+    assert_equals(e.data[6], location.pathname.replace('.html', '.js'), 'pathname');
+    assert_equals(e.data[7], location.search, 'search');
+    assert_equals(e.data[8], '', 'hash');
+    assert_array_equals(e.data[9], [], 'number of exceptions');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.js
new file mode 100644
index 000000000000..4c5c8a35ae88
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/setting-members.js
@@ -0,0 +1,13 @@
+var exceptions = [];
+try { location.href = 1; } catch(e) { exceptions.push('href'); }
+try { location.protocol = 1; } catch(e) { exceptions.push('protocol'); }
+try { location.host = 1; } catch(e) { exceptions.push('host'); }
+try { location.hostname = 1; } catch(e) { exceptions.push('hostname');}
+try { location.port = 1; } catch(e) { exceptions.push('port'); }
+try { location.pathname = 1; } catch(e) { exceptions.push('pathname'); }
+try { location.search = 1; } catch(e) { exceptions.push('search'); }
+try { location.hash = 1; } catch(e) { exceptions.push('hash'); }
+
+postMessage([null, location.href, location.protocol, location.host,
+             location.hostname, location.port, location.pathname,
+             location.search, location.hash, exceptions]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/worker-separate-file.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/worker-separate-file.html
new file mode 100644
index 000000000000..ac8e64dcc886
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/location/worker-separate-file.html
@@ -0,0 +1,28 @@
+<!--
+/*
+-->
+<!doctype html>
+<title>location with a worker in separate file</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('post-location-members.js?a#b?c');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], location.href.replace(/\/[^\/]+$/, '/post-location-members.js?a#b?c'));
+    assert_equals(e.data[1], location.protocol);
+    assert_equals(e.data[2], location.host);
+    assert_equals(e.data[3], location.hostname);
+    assert_equals(e.data[4], location.port);
+    assert_equals(e.data[5], location.pathname.replace(/\/[^\/]+$/, '/post-location-members.js'));
+    assert_equals(e.data[6], '?a');
+    assert_equals(e.data[7], '#b?c');
+    this.done();
+  });
+});
+</script>
+<!--
+*/
+//-->
+
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b16862ba1c01
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/exception-in-onerror.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/exception-in-onerror.html
new file mode 100644
index 000000000000..5f3999db66a7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/exception-in-onerror.html
@@ -0,0 +1,91 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// 1. Exception is thrown somewhere in a Worker.
+//    Various contexts are tested: from worker initialization,
+//    from setTimeout, from event handlers, etc.
+// 2. WorkerGlobalScope.onerror event handler is called.
+//    (i.e. `onerror` in the worker script)
+// 3. From the event handler, another exception is thrown.
+// 4. Each of Worker.onerror handler (on the parent Document) and
+//            Worker error event listener should be called twice:
+//    once for each of the exceptions thrown in Step 1 and 2, respectively.
+//    (We don't check the ordering of two Worker.onerror calls, because
+//    browsers fires them in different orders)
+
+function prepareHandler(t, messages) {
+  const fired = {};
+  let fired_count = 0;
+  t.step_timeout(() => {
+    if (fired_count < messages.length) {
+      let error_description = 'Worker.onerror not fired for:';
+      for (const message of messages) {
+        if (!fired[message]) {
+          error_description += ' ';
+          error_description += message;
+        }
+      }
+      assert_unreached(error_description);
+    }
+  }, 2000);
+  return t.step_func(e => {
+      e.preventDefault();
+      for (const message of messages) {
+        if (!fired[message] && e.message.indexOf(message) >= 0) {
+          fired[message] = true;
+          ++fired_count;
+          if (fired_count === messages.length) {
+            // Worker.onerror is fired for all messages.
+            t.done();
+          }
+          return;
+        }
+      }
+      assert_unreached("Unexpected worker.onerror message: " + e.message);
+    });
+}
+
+function expectErrors(worker, title, messages) {
+  async_test(t => {
+      worker.addEventListener('error', prepareHandler(t, messages));
+    }, title+ ': listener');
+  async_test(t => {
+      worker.onerror = prepareHandler(t, messages);
+    }, title + ': handler');
+}
+
+for (const type of ['classic', 'module']) {
+  const workerOptions = type === 'module' ? {type: 'module'}: {};
+
+  const worker1 = new Worker(
+      'throw.js?throw-in-toplevel&throw-in-onerror',
+      workerOptions);
+  expectErrors(
+      worker1,
+      'Throw in worker initialization: ' + type,
+      ['Throw in toplevel', 'Throw in error handler']);
+
+  const worker2 = new Worker(
+      'throw.js?throw-in-setTimeout-function&throw-in-onerror', workerOptions);
+  expectErrors(
+      worker2,
+      'Throw in setTimeout(function): ' + type,
+      ['Throw in setTimeout function', 'Throw in error handler']);
+
+  const worker3 = new Worker(
+      'throw.js?throw-in-setTimeout-string&throw-in-onerror', workerOptions);
+  expectErrors(
+      worker3,
+      'Throw in setTimeout(string): ' + type,
+      ['Throw in setTimeout string', 'Throw in error handler']);
+
+  const worker4 = new Worker('throw.js?throw-in-onerror', workerOptions);
+  worker4.postMessage('foo');
+  expectErrors(
+      worker4,
+      'Throw in message handler: ' + type,
+      ['Throw in message handler', 'Throw in error handler']);
+
+}
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.html
new file mode 100644
index 000000000000..7d4b03c6cd35
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>onerror, "handled"</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('handled.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(typeof e.data[0], 'string', 'first argument');
+    assert_equals(e.data[1], document.URL.replace('.html', '.js'), 'second argument');
+    assert_equals(typeof e.data[2], 'number', 'third argument');
+    assert_equals(typeof e.data[3], 'number', 'fourth argument');
+    setTimeout(this.step_func(function() {
+      this.done();
+    }), 100);
+  });
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.js
new file mode 100644
index 000000000000..e58fa4a51521
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/handled.js
@@ -0,0 +1,8 @@
+onerror = function(a, b, c, d) {
+  postMessage([a, b, c, d]);
+  return true; // the error is "handled"
+}
+function x() {
+  y();
+}
+x();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-DOMException.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-DOMException.html
new file mode 100644
index 000000000000..df8c85147509
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-DOMException.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('classic', 'DOMException-TypeError');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-Error.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-Error.html
new file mode 100644
index 000000000000..e026b6ebf09f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-classic-Error.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('classic', 'Error');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-helper.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-helper.js
new file mode 100644
index 000000000000..6271329b0314
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-helper.js
@@ -0,0 +1,61 @@
+// The error's `message` values in Worker error event handlers are tested.
+// While not explicitly specified in the HTML spec, we expect some information
+// about thrown errors (e.g. original message, the string "TypeError", etc.)
+// to appear in the `message`.
+
+function prepareHandler(t, error, expectedCount) {
+  let count = 0;
+  return t.step_func(e => {
+      e.preventDefault();
+
+      assert_regexp_match(
+          e.message,
+          /Throw in/,
+          'e.message should contain the message of the thrown error');
+
+      if (error === 'DOMException-TypeError') {
+        assert_regexp_match(e.message, /TypeError/);
+      }
+
+      ++count;
+      if (count >= expectedCount) {
+        t.done();
+      }
+    });
+}
+
+function expectErrors(worker, error, expectedCount, title) {
+  async_test(t => {
+      worker.addEventListener('error',
+                              prepareHandler(t, error, expectedCount));
+    }, title+ ': listener');
+  async_test(t => {
+      worker.onerror = prepareHandler(t, error, expectedCount);
+    }, title + ': handler');
+}
+
+function runTest(type, error) {
+  for (const location of ['toplevel',
+                          'setTimeout-function',
+                          'setTimeout-string',
+                          'onmessage',
+                          'onerror']) {
+    const worker = new Worker(
+        'throw.js?throw-in-' + location + '&error=' + error,
+        {type});
+    let expectedCount = 1;
+    if (location === 'onmessage') {
+      // This makes the worker's message handler to throw an error.
+      worker.postMessage('foo');
+    }
+    if (location === 'onerror') {
+      // This makes the worker's message handler to throw an error,
+      // AND worker's error handler to throw another error.
+      // Therefore we expect two errors here.
+      worker.postMessage('foo');
+      expectedCount = 2;
+    }
+    expectErrors(worker, error, expectedCount,
+        'Throw ' + error + ' in ' + location + ': ' + type);
+  }
+}
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-DOMException.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-DOMException.html
new file mode 100644
index 000000000000..8ed873bc3227
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-DOMException.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('module', 'DOMException-TypeError');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-Error.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-Error.html
new file mode 100644
index 000000000000..046ff969d6bd
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/message-module-Error.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./message-helper.js"></script>
+<script>
+runTest('module', 'Error');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.html
new file mode 100644
index 000000000000..11d03d728b15
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<title>onerror, "not handled"</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+function createHandler(t) {
+  return t.step_func(function(e) {
+    assert_true(e instanceof ErrorEvent, 'e instanceof ErrorEvent');
+    assert_equals(typeof e.message, 'string', 'typeof e.message');
+    assert_equals(e.filename, document.URL.replace('.html', '.js'), 'e.filename');
+    assert_equals(typeof e.lineno, 'number', 'typeof e.lineno');
+    assert_equals(typeof e.colno, 'number', 'typeof e.column');
+    e.preventDefault(); // "handled"
+    t.done();
+  });
+}
+
+async_test(function(t) {
+  var worker = new Worker('not-handled.js');
+  worker.onerror = createHandler(t);
+}, 'Not handled evaluation error => Worker.onerror handler');
+
+async_test(function(t) {
+  var worker = new Worker('not-handled.js');
+  worker.addEventListener('error', createHandler(t));
+}, 'Not handled evaluation error => Worker error listener');
+</script>
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.js
new file mode 100644
index 000000000000..c3254b0ba7e1
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/not-handled.js
@@ -0,0 +1,7 @@
+onerror = function(a, b, c, d) {
+  return false; // the error is "not handled"
+}
+function x() {
+  y();
+}
+x();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.html b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.html
new file mode 100644
index 000000000000..b3be77267971
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>onerror, "not handled" with only window.onerror defined</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+setup({
+  allow_uncaught_exception: true,
+});
+async_test(function() {
+  var worker = new Worker('propagate-to-window-onerror.js');
+  window.onerror = this.step_func(function(a, b, c, d) {
+    assert_equals(typeof a, 'string', 'first argument');
+    assert_equals(b, document.URL.replace('.html', '.js'), 'second argument');
+    assert_equals(typeof c, 'number', 'third argument');
+    assert_equals(typeof d, 'number', 'fourth argument');
+    this.done();
+    return true; // "handled"
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.js
new file mode 100644
index 000000000000..0daf488d6f52
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/propagate-to-window-onerror.js
@@ -0,0 +1,4 @@
+function x() {
+  y();
+}
+x();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/throw.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/throw.js
new file mode 100644
index 000000000000..704098a6d868
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/onerror/throw.js
@@ -0,0 +1,34 @@
+const params = new URL(self.location.href).searchParams;
+
+self.createError = (message) => {
+  if (params.get('error') === 'DOMException-TypeError') {
+    return new DOMException(message, 'TypeError');
+  } else {
+    return new Error(message);
+  }
+};
+
+onerror = function() {
+  if (params.has('throw-in-onerror')) {
+    throw createError('Throw in error handler');
+  }
+  return false;
+};
+onmessage = function() {
+  throw createError('Throw in message handler');
+  return false;
+};
+
+if (params.has('throw-in-toplevel')) {
+  throw createError('Throw in toplevel');
+}
+
+// We don't use step_timeout() here, because we have to test the behavior of
+// setTimeout() without wrappers.
+if (params.has('throw-in-setTimeout-function')) {
+  setTimeout(() => { throw createError('Throw in setTimeout function') }, 0);
+}
+
+if (params.has('throw-in-setTimeout-string')) {
+  setTimeout("throw createError('Throw in setTimeout string')", 0);
+}
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/self.any.js b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/self.any.js
new file mode 100644
index 000000000000..64b4ee2faefb
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerGlobalScope/self.any.js
@@ -0,0 +1,19 @@
+// META: global=worker
+
+test(function() {
+  assert_equals(self, self);
+}, 'self === self');
+
+test(function() {
+  assert_true(self instanceof WorkerGlobalScope);
+}, 'self instanceof WorkerGlobalScope');
+
+test(function() {
+  assert_true('self' in self);
+}, '\'self\' in self');
+
+test(function() {
+  var x = self;
+  self = 1;
+  assert_equals(self, x);
+}, 'self = 1');
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.html
new file mode 100644
index 000000000000..9fe5e2b1bc7b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setTimeout</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.js
new file mode 100644
index 000000000000..bd5b7c4071c2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/001.js
@@ -0,0 +1 @@
+setTimeout(function() { postMessage(1) }, 10);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.html
new file mode 100644
index 000000000000..1a10b3d0bb8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>clearTimeout</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('002.js');
+  var gotMessage = false;
+  worker.onmessage = function() { gotMessage = true; };
+  setTimeout(this.step_func(function() { assert_false(gotMessage); this.done(); }), 100);
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.js
new file mode 100644
index 000000000000..a96c08844202
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/002.js
@@ -0,0 +1,2 @@
+var t = setTimeout(function() { postMessage(1); }, 10);
+clearTimeout(t);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.html
new file mode 100644
index 000000000000..119d109b5fd2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setInterval</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.js
new file mode 100644
index 000000000000..e64e4e2179f0
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/003.js
@@ -0,0 +1 @@
+setInterval(function() { postMessage(1); }, 10);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.html
new file mode 100644
index 000000000000..83d7bf915fb6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<title>clearInterval</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('004.js');
+  var i = 0;
+  worker.onmessage = function() { i++; }
+  setTimeout(this.step_func(function() { assert_equals(i, 0); this.done(); }), 100);
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.js
new file mode 100644
index 000000000000..e80d79a8e51b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/004.js
@@ -0,0 +1,4 @@
+var t = setInterval(function() {
+  postMessage(1);
+}, 10);
+clearInterval(t);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.html
new file mode 100644
index 000000000000..2a181d55d0d9
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>setInterval when closing</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('005.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.js
new file mode 100644
index 000000000000..125c224e7bcf
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/005.js
@@ -0,0 +1,3 @@
+self.close();
+var t = setInterval(function() {}, 10);
+postMessage(t);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..54493da00f91
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/WindowTimers/WEB_FEATURES.yml
@@ -0,0 +1,6 @@
+rules:
+- 003.html: [setinterval]
+- 004.html: [setinterval]
+- 005.html: [setinterval]
+- 001.html: [settimeout]
+- 002.html: [settimeout]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/001.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/001.worker.js
new file mode 100644
index 000000000000..aa86c8ef1779
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/001.worker.js
@@ -0,0 +1,7 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  importScripts();
+});
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/002.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/002.worker.js
new file mode 100644
index 000000000000..1cacee5ccb5e
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/002.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+test(function() {
+  var ran = false;
+  assert_throws_dom("SyntaxError", function() {
+    importScripts('data:text/javascript,ran=true','http://foo bar');
+  });
+  assert_false(ran, 'first argument to importScripts ran');
+});
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.html
new file mode 100644
index 000000000000..5dcd08aa1546
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>importScripts running scripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, "abc");
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.js
new file mode 100644
index 000000000000..6e378ef20fff
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/003.js
@@ -0,0 +1,8 @@
+var x = 'a';
+try {
+  importScripts('data:text/javascript,x+="b"',
+                'data:text/javascript,x+="c"');
+} catch(e) {
+  x += "d"
+}
+postMessage(x);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.html
new file mode 100644
index 000000000000..62537e088814
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>importScripts broken script</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('004.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], "first script successful. ");
+    assert_true(e.data[1], 'expected SyntaxError');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.js
new file mode 100644
index 000000000000..98040d0d48df
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/004.js
@@ -0,0 +1,13 @@
+var x = '';
+var exception;
+try {
+  importScripts('data:text/javascript,x+="first script successful. "',
+                'data:text/javascript,x+="FAIL (second script). "; for(;) break;', // doesn't compile
+                'data:text/javascript,x+="FAIL (third script)"');
+} catch(ex) {
+  if (ex instanceof SyntaxError)
+    exception = true;
+  else
+    exception = String(ex);
+}
+postMessage([x, exception]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.html
new file mode 100644
index 000000000000..7ebbc1be5594
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>importScripts separate scripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('005.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], undefined);
+    assert_true(e.data[1]);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.js
new file mode 100644
index 000000000000..18c534efa9c9
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/005.js
@@ -0,0 +1,9 @@
+var x;
+var y;
+try {
+  importScripts('data:text/javascript,x={',
+                'data:text/javascript,}');
+} catch(e) {
+  y = true;
+}
+postMessage([x, y]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.html
new file mode 100644
index 000000000000..aec2fb148330
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts uncaught exception</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('006.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data[0], 1);
+    assert_equals(e.data[1], 2);
+    assert_equals(e.data[2], undefined);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.js
new file mode 100644
index 000000000000..fc170f790c74
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/006.js
@@ -0,0 +1,11 @@
+var x;
+var y;
+var z;
+try {
+  importScripts('data:text/javascript,x=1',
+                'data:text/javascript,throw 2',
+                'data:text/javascript,z=3');
+} catch(e) {
+  y = e;
+}
+postMessage([x, y, z]);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.html
new file mode 100644
index 000000000000..37e888365f70
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>postMessage in importScripts</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('007.js');
+  var i = 0;
+  worker.onmessage = this.step_func(function(e) {
+    i++;
+    assert_equals(e.data, i);
+    if (i == 2)
+      this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.js
new file mode 100644
index 000000000000..dc85216f3df7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/007.js
@@ -0,0 +1,2 @@
+importScripts('data:text/javascript,postMessage(1)');
+postMessage(2);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.html
new file mode 100644
index 000000000000..f72b79939c07
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>variables and functions crossing importScripts boundary</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('008.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.js
new file mode 100644
index 000000000000..c957fcd63538
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/008.js
@@ -0,0 +1,3 @@
+var log = postMessage;
+importScripts('data:text/javascript,function run() { log(true) }');
+run();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.html
new file mode 100644
index 000000000000..e0eb5488c2e7
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<title>variables and functions crossing importScripts boundary, take 2</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('009.js');
+  var i = 0;
+  worker.onmessage = this.step_func(function(e) {
+    i++;
+    if (i == 1) {
+      assert_true(e.data);
+    } else {
+      assert_equals(e.data, 1);
+      this.done();
+    }
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.js
new file mode 100644
index 000000000000..4b86f8c30308
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/009.js
@@ -0,0 +1,3 @@
+var log = postMessage;
+importScripts('data:text/javascript,function run() { for(var i = 0; i < 1000; ++i) { if (i == 500) log(true); } return 1; }');
+postMessage(run());
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.html
new file mode 100644
index 000000000000..a6db49c4be94
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts(undefined)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('010.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'undefined');
+    this.done();
+  })
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached(e.message);
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.js
new file mode 100644
index 000000000000..4ec4a3b8c753
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/010.js
@@ -0,0 +1,11 @@
+// prevent recursion
+if ('beenThere' in self) {
+  throw 'undefined stringified to the empty string';
+}
+beenThere = true;
+try {
+  importScripts(undefined);
+  postMessage(got);
+} catch(ex) {
+  postMessage(String(ex));
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.html
new file mode 100644
index 000000000000..1bfb23349756
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts(null)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('011.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'null');
+    this.done();
+  });
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached(e.message);
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.js
new file mode 100644
index 000000000000..bd6fed5c0a37
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/011.js
@@ -0,0 +1,11 @@
+// prevent recursion
+if ('beenThere' in self) {
+  throw 'null stringified to the empty string';
+}
+beenThere = true;
+try {
+  importScripts(null);
+  postMessage(got);
+} catch(ex) {
+  postMessage(String(ex));
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.html
new file mode 100644
index 000000000000..ab0778d0c71f
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>importScripts(1)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+async_test(function() {
+  var worker = new Worker('012.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '1');
+    this.done();
+  });
+  worker.onerror = this.step_func(function(e) {
+    assert_unreached(e.message);
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.js
new file mode 100644
index 000000000000..f4c887f7df4a
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/012.js
@@ -0,0 +1,11 @@
+// prevent recursion
+if ('beenThere' in self) {
+  throw '1 stringified to the empty string';
+}
+beenThere = true;
+try {
+  importScripts(1);
+  postMessage(got);
+} catch(ex) {
+  postMessage(String(ex));
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1 b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1
new file mode 100644
index 000000000000..18cea4ff0f4b
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1
@@ -0,0 +1 @@
+var got = '1';
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1.headers b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/1.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/WEB_FEATURES.yml
new file mode 100644
index 000000000000..4ab206cd6d13
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- "*.any.js": []
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/blob-url.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/blob-url.worker.js
new file mode 100644
index 000000000000..71603bf314f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/blob-url.worker.js
@@ -0,0 +1,40 @@
+importScripts("/resources/testharness.js");
+
+function objectUrlFromScript(script) {
+  const blob = new Blob([script], { type: "text/javascript" });
+  return URL.createObjectURL(blob);
+}
+
+test((t) => {
+  self.run = false;
+  const blobScriptUrl = objectUrlFromScript(`self.run = true;`);
+  t.add_cleanup(() => URL.revokeObjectURL(blobScriptUrl));
+
+  importScripts(blobScriptUrl);
+  assert_true(self.run);
+}, "Blob URLs work on importScripts");
+
+test(() => {
+  self.run = false;
+  const blobScriptUrl = objectUrlFromScript(`self.run = true;`);
+
+  URL.revokeObjectURL(blobScriptUrl);
+
+  assert_throws_dom("NetworkError", () => {
+    importScripts(blobScriptUrl);
+  });
+  assert_false(self.run);
+}, "A revoked blob URL will fail");
+
+test(() => {
+  self.run = false;
+  const runScriptUrl = objectUrlFromScript(`self.run = true;`);
+  const revokeScriptUrl = objectUrlFromScript(
+    `URL.revokeObjectURL(${JSON.stringify(runScriptUrl)});`
+  );
+
+  importScripts(revokeScriptUrl, runScriptUrl);
+  assert_true(self.run);
+}, "Revoking a blob URL in an earlier script will not fail");
+
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/catch.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/catch.sub.any.js
new file mode 100644
index 000000000000..52da60be91f6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/catch.sub.any.js
@@ -0,0 +1,47 @@
+// META: global=worker
+
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+const redirectToCrossOrigin = "/common/redirect.py?location=" + crossOrigin;
+
+test(function() {
+  assert_throws_js(SyntaxError, function() {
+    importScripts("/workers/modules/resources/syntax-error.js");
+  });
+}, "Same-origin syntax error");
+
+test(function() {
+  assert_throws_js(Error, function() {
+    importScripts("/workers/modules/resources/throw.js");
+  });
+}, "Same-origin throw");
+
+// https://html.spec.whatwg.org/C/#run-a-classic-script
+// Step 8.2. If rethrow errors is true and script's muted errors is true, then:
+// Step 8.2.2. Throw a "NetworkError" DOMException.
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(crossOrigin +
+                  "/workers/modules/resources/syntax-error.js");
+  });
+}, "Cross-origin syntax error");
+
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(crossOrigin +
+                  "/workers/modules/resources/throw.js");
+  });
+}, "Cross-origin throw");
+
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(redirectToCrossOrigin +
+                  "/workers/modules/resources/syntax-error.js");
+  });
+}, "Redirect-to-cross-origin syntax error");
+
+test(function() {
+  assert_throws_dom("NetworkError", function() {
+    importScripts(redirectToCrossOrigin +
+                  "/workers/modules/resources/throw.js");
+  });
+}, "Redirect-to-Cross-origin throw");
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null
new file mode 100644
index 000000000000..8e54b66c50ec
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null
@@ -0,0 +1 @@
+var got = 'null';
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null.headers b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/null.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js
new file mode 100644
index 000000000000..4fd8914856b5
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js
@@ -0,0 +1,8 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  crossOrigin + "/workers/modules/resources/syntax-error.js",
+  false,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js
new file mode 100644
index 000000000000..7fc6d0dd64bc
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js
@@ -0,0 +1,80 @@
+setup({ allow_uncaught_exception:true });
+
+// For SyntaxError, the line in doImportScripts() is expected to be reported
+// as `e.lineno` etc. below.
+// doImportScripts() is introduced here to prevent the line number from being
+// affected by changes in runTest(), use of setTimeout(), etc.
+function doImportScripts(url) {
+  importScripts(url);
+}
+
+const t0 = async_test("WorkerGlobalScope error event: error");
+const t1 = async_test("WorkerGlobalScope error event: message");
+const t2 = async_test("WorkerGlobalScope error event: filename");
+const t3 = async_test("WorkerGlobalScope error event: lineno");
+
+function runTest(importScriptUrl, shouldUseSetTimeout, expected) {
+  self.addEventListener("error", e => {
+    if (expected === "NetworkError") {
+      t0.step_func_done(() => {
+        assert_equals(e.error.constructor, DOMException,
+            "e.error should be a DOMException")
+        assert_equals(e.error.name, "NetworkError");
+      })();
+
+      t1.step_func_done(() => {
+        assert_not_equals(e.message, "Script error.",
+            "e.message should not be muted to 'Script error.'");
+      })();
+
+      // filename, lineno etc. should NOT point to the location within
+      // `syntax-error.js` (otherwise parse errors to be muted are
+      // leaked to JavaScript).
+      // we expect they point to the caller of `importScripts()`,
+      // while this is not explicitly stated in the spec.
+      t2.step_func_done(() => {
+        assert_equals(e.filename, self.location.origin +
+            '/workers/interfaces/WorkerUtils/importScripts/report-error-helper.js');
+      })();
+      t3.step_func_done(() => {
+        assert_equals(e.lineno, 8);
+      })();
+      // We don't check `e.colno` for now, because browsers set different
+      // `colno` values.
+    } else if (expected === "SyntaxError") {
+      t0.step_func_done(() => {
+        assert_equals(e.error.constructor, SyntaxError);
+        assert_equals(e.error.name, "SyntaxError");
+      })();
+
+      t1.step_func_done(() => {
+        assert_not_equals(e.message, "Script error.",
+            "e.message should not be muted to 'Script error.'");
+      })();
+
+      // filename, lineno etc. are expected to point to the location within
+      // `syntax-error.js` because it is same-origin,
+      // while this is not explicitly stated in the spec.
+      t2.step_func_done(() => {
+        assert_equals(e.filename, self.location.origin +
+            '/workers/modules/resources/syntax-error.js');
+      })();
+      t3.step_func_done(() => {
+        assert_equals(e.lineno, 1);
+      })();
+      // We don't check `e.colno` for now, because browsers set different
+      // `colno` values.
+    }
+
+    // Because importScripts() throws, we call done() here.
+    done();
+  });
+
+  if (shouldUseSetTimeout) {
+    setTimeout(
+      () => doImportScripts(importScriptUrl),
+      0);
+  } else {
+    doImportScripts(importScriptUrl);
+  }
+}
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js
new file mode 100644
index 000000000000..2b9600973fb8
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js
@@ -0,0 +1,9 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  "/common/redirect.py?location=" + crossOrigin +
+      "/workers/modules/resources/syntax-error.js",
+  false,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js
new file mode 100644
index 000000000000..f7de416e1170
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js
@@ -0,0 +1,7 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+runTest(
+  "/workers/modules/resources/syntax-error.js",
+  false,
+  "SyntaxError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js
new file mode 100644
index 000000000000..a1bbef7bc45a
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js
@@ -0,0 +1,8 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  crossOrigin + "/workers/modules/resources/syntax-error.js",
+  true,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js
new file mode 100644
index 000000000000..2755b337d3da
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js
@@ -0,0 +1,9 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+const crossOrigin = "https://{{hosts[alt][]}}:{{ports[https][0]}}";
+runTest(
+  "/common/redirect.py?location=" + crossOrigin +
+      "/workers/modules/resources/syntax-error.js",
+  true,
+  "NetworkError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js
new file mode 100644
index 000000000000..c4f70ebec973
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js
@@ -0,0 +1,7 @@
+// META: global=dedicatedworker,sharedworker
+// META: script=report-error-helper.js
+runTest(
+  "/workers/modules/resources/syntax-error.js",
+  true,
+  "SyntaxError"
+);
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined
new file mode 100644
index 000000000000..f99ba4be744c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined
@@ -0,0 +1 @@
+var got = 'undefined';
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined.headers b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined.headers
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/importScripts/undefined.headers
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.html
new file mode 100644
index 000000000000..4c76e2b69908
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.appName</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('002.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.appName);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.js
new file mode 100644
index 000000000000..a5af348ef107
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/002.js
@@ -0,0 +1 @@
+postMessage(navigator.appName);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.html
new file mode 100644
index 000000000000..86ab5aee4896
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.appVersion</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.appVersion);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.js
new file mode 100644
index 000000000000..ff92f8aadb8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/003.js
@@ -0,0 +1 @@
+postMessage(navigator.appVersion);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.html
new file mode 100644
index 000000000000..93eee0095712
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.platform</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('004.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.platform);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.js
new file mode 100644
index 000000000000..c1b575e43c99
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/004.js
@@ -0,0 +1 @@
+postMessage(navigator.platform);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.html
new file mode 100644
index 000000000000..ad2899e62ead
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.userAgent</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('005.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.userAgent);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.js
new file mode 100644
index 000000000000..d62252d39b21
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/005.js
@@ -0,0 +1 @@
+postMessage(navigator.userAgent);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.html
new file mode 100644
index 000000000000..e0f7386af31c
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.onLine</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('006.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.onLine);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.js
new file mode 100644
index 000000000000..325fd0fbdec3
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/006.js
@@ -0,0 +1 @@
+postMessage(navigator.onLine);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.html
new file mode 100644
index 000000000000..8f9d38dd857a
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>readonlyness of members of Navigator</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('007.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.js
new file mode 100644
index 000000000000..38849bc8abc6
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/007.js
@@ -0,0 +1,11 @@
+var log = [];
+var neverEncounteredValue = "This is not the value you are looking for.";
+for (x in navigator) {
+  // skip functions, as they are writable
+  if (typeof navigator[x] === 'function') continue;
+  // this should silently fail and not throw per webidl
+  navigator[x] = neverEncounteredValue;
+  if (navigator[x] === neverEncounteredValue)
+    log.push(x);
+}
+postMessage(log.join(', '));
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/008.worker.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/008.worker.js
new file mode 100644
index 000000000000..e539d85d763d
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/008.worker.js
@@ -0,0 +1,12 @@
+"use strict";
+importScripts("/resources/testharness.js");
+test(function () {
+  for (const x in navigator) {
+    // skip functions, as they are settable
+    if (typeof navigator[x] === "function") continue;
+    assert_throws_js(TypeError, () => {
+      navigator[x] = "";
+    }, `navigator.${x} is read-only`);
+  }
+}, "navigator properties are read-only");
+done();
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/WEB_FEATURES.yml b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/WEB_FEATURES.yml
new file mode 100644
index 000000000000..6a7232bd7f27
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/WEB_FEATURES.yml
@@ -0,0 +1,5 @@
+rules:
+- 006.html: [online, dedicated-workers]
+- 005.html: [user-agent-sniffing]
+- language.html: [language, dedicated-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.html b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.html
new file mode 100644
index 000000000000..535ab3a7cb98
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>navigator.language</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('language.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, navigator.language);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.js b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.js
new file mode 100644
index 000000000000..e94ba4dfcf16
--- /dev/null
+++ b/test/fixtures/wpt/workers/interfaces/WorkerUtils/navigator/language.js
@@ -0,0 +1 @@
+postMessage(navigator.language);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/modules/WEB_FEATURES.yml b/test/fixtures/wpt/workers/modules/WEB_FEATURES.yml
new file mode 100644
index 000000000000..6399a3a20323
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- dedicated-worker-*: [js-modules-workers]
+- shared-worker-*: [js-modules-shared-workers]
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-blob-url.any.js b/test/fixtures/wpt/workers/modules/dedicated-worker-import-blob-url.any.js
new file mode 100644
index 000000000000..e5d79add7366
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-blob-url.any.js
@@ -0,0 +1,26 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a dedicated worker loaded from a blob URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_blob_url_test(testCase) {
+  promise_test(async () => {
+    const importURL = new URL(testCase.scriptURL, location.href);
+    const blob = new Blob([`import "${importURL}";`],
+                          { type: 'text/javascript' });
+    const blobURL = URL.createObjectURL(blob);
+    const worker = new Worker(blobURL, { type: 'module'});
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_blob_url_test);
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-csp.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-csp.html
new file mode 100644
index 000000000000..6e0051aa14ed
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-csp.html
@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: CSP for ES Modules</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msg_event = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msg_event.data, 'LOADED');
+  return win;
+}
+
+function import_csp_test(
+    cspHeader, importType, expectedImportedModules, description) {
+  // Append CSP header to windowURL for static import tests since static import
+  // scripts should obey Window's CSP.
+  const windowURL = `resources/new-worker-window.html` +
+      `${importType === 'static'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  // Append CSP header to scriptURL for dynamic import tests since dynamic
+  // import scripts should obey Worker script's response's CSP.
+  const scriptURL = `${importType}-import-remote-origin-script-worker.sub.js` +
+      `${importType === 'dynamic'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  promise_test(async () => {
+    const win = await openWindow(windowURL);
+    // Ask the window to start a dedicated worker.
+    win.postMessage(scriptURL, '*');
+    const msg_event = await new Promise(resolve => window.onmessage = resolve);
+    assert_array_equals(msg_event.data, expectedImportedModules);
+  }, description);
+}
+
+// Tests for static import.
+//
+// Static import should obey the worker-src directive and the script-src
+// directive. If the both directives are specified, the worker-src directive
+// should be prioritized.
+//
+// Step 1: "If the result of executing 6.6.1.11 Get the effective directive for
+// request on request is "worker-src", and policy contains a directive whose
+// name is "worker-src", return "Allowed"."
+// "Note: If worker-src is present, we’ll defer to it when handling worker
+// requests."
+// https://w3c.github.io/webappsec-csp/#script-src-pre-request
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'",
+    "static",
+    ['ERROR'],
+    "worker-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "worker-src * 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should allow cross origin static import.")
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'",
+    "static",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin static import.")
+
+import_csp_test(
+    "worker-src *; script-src 'self' 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should override script-src 'self' directive and " +
+        "allow cross origin static import.");
+
+import_csp_test(
+    "worker-src 'self'; script-src * 'unsafe-inline'",
+    "static",
+    ['ERROR'],
+    "worker-src 'self' directive should override script-src * directive and " +
+        "disallow cross origin static import.");
+
+// For static imports on workers, the effective directive should be 'worker-src'.
+// https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
+//
+// The directive fallback list of 'worker-src' doesn't contain 'script-src-elem'
+// https://w3c.github.io/webappsec-csp/#directive-fallback-list
+import_csp_test(
+    "script-src-elem 'self' 'unsafe-inline'",
+    "static",
+    ["export-on-load-script.js"],
+    "script-src-elem 'self' directive should not take effect on static import.");
+
+// Tests for dynamic import.
+//
+// Dynamic import should obey the script-src directive instead of the worker-src
+// directive according to the specs:
+//
+// Dynamic import has the "script" destination.
+// Step 2.4: "Fetch a module script graph given url, ..., "script", ..."
+// https://html.spec.whatwg.org/multipage/webappapis.html#hostimportmoduledynamically(referencingscriptormodule,-specifier,-promisecapability)
+//
+// The "script" destination should obey the script-src CSP directive.
+// Step 2: "If request's destination is script-like:"
+// https://w3c.github.io/webappsec-csp/#script-src-pre-request
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'",
+    "dynamic",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin dynamic import.");
+
+// For dynamic imports, the effective directive should be 'script-src-elem'.
+// https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
+import_csp_test(
+    "script-src-elem 'self' 'unsafe-inline'",
+    "dynamic",
+    ['ERROR'],
+    "script-src-elem 'self' directive should disallow cross origin dynamic import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'",
+    "dynamic",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin dynamic import.")
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'",
+    "dynamic",
+    ["export-on-load-script.js"],
+    "worker-src 'self' directive should not take effect on dynamic import.");
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url-cross-origin.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url-cross-origin.html
new file mode 100644
index 000000000000..2f790a06a5cd
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url-cross-origin.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: ES modules for data URL workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+const import_from_data_url_worker_test = (importType, isDataURL, expectation) => {
+  promise_test(async () => {
+    const importURL = new URL(`resources/${importType}-import-` +
+        `${isDataURL ? 'data-url' : 'script'}-block-cross-origin.js`,
+        location.href) + '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+    const worker = new Worker(dataURL, { type: 'module' });
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+    assert_array_equals(msgEvent.data,
+        expectation === 'blocked' ? ['ERROR']
+                                  : ['export-block-cross-origin.js']);
+  }, `${importType} import ${isDataURL ? 'data url' : 'script'} from data: ` +
+     `URL should be ${expectation}.`);
+}
+
+// Static import should obey the outside settings.
+// SecurityOrigin of the outside settings is decided by Window.
+import_from_data_url_worker_test('static', true, 'allowed');
+import_from_data_url_worker_test('static', false, 'allowed');
+
+
+// Dynamic import should obey the inside settings.
+// SecurityOrigin of the inside settings is a unique opaque origin.
+//
+// Data url script is cross-origin to the inside settings' SecurityOrigin, but
+// dynamic importing it is allowed.
+// https://fetch.spec.whatwg.org/#concept-main-fetch
+// Step 5: request’s current URL’s scheme is "data" [spec text]
+import_from_data_url_worker_test('dynamic', true, 'allowed');
+
+// Non-data url script is cross-origin to the inside settings' SecurityOrigin.
+// It should be blocked.
+import_from_data_url_worker_test('dynamic', false, 'blocked');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url.any.js b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url.any.js
new file mode 100644
index 000000000000..b837ad67da62
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-data-url.any.js
@@ -0,0 +1,25 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a dedicated worker loaded from a data URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_data_url_test(testCase) {
+  promise_test(async () => {
+    // The Access-Control-Allow-Origin header is necessary because a worker
+    // loaded from a data URL has a null origin and import() on the worker
+    // without the header is blocked.
+    const importURL = new URL(testCase.scriptURL, location.href) +
+        '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+
+    const worker = new Worker(dataURL, { type: 'module'});
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_data_url_test);
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-failure.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-failure.html
new file mode 100644
index 000000000000..8c6beb35d36d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-failure.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: import failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script>
+
+promise_test(async () => {
+  const scriptURL = 'resources/import-scripts-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  const msg_event = await new Promise(resolve => worker.onmessage = resolve);
+  assert_equals(msg_event.data, 'TypeError');
+}, 'importScripts() on module worker should throw an exception.');
+
+promise_test(() => {
+  const scriptURL = 'resources/non-existent-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Worker construction for non-existent script should dispatch an ' +
+   'ErrorEvent.');
+
+promise_test(() => {
+  const scriptURL = 'resources/static-import-non-existent-script-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Static import for non-existent script should dispatch an ErrorEvent.');
+
+promise_test(async () => {
+  const scriptURL = './non-existent-worker.js';
+  const worker = new Worker('resources/dynamic-import-given-url-worker.js',
+                            { type: 'module' });
+  worker.postMessage(scriptURL);
+  const msg_event = await new Promise((resolve, reject) => {
+    worker.onmessage = resolve;
+    worker.onerror = error => {
+      const msg = error instanceof ErrorEvent ? error.message
+                                              : 'unknown error';
+      reject(msg);
+    };
+  });
+  assert_equals(msg_event.data, 'TypeError');
+}, 'Dynamic import for non-existent script should throw an exception.');
+
+test(() => {
+  const scriptURL = 'http://invalid:123$';
+  assert_throws_dom('SyntaxError', () => new Worker(scriptURL, { type: 'module' }));
+}, 'Worker construction for an invalid URL should throw an exception.');
+
+async_test((t) => {
+  const scriptURL = 'file:///static-import-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  worker.onerror = t.step_func_done(function(e) {
+    assert_true(e instanceof Event);
+  });
+}, 'Worker construction for a file URL should fail');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-meta.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-meta.html
new file mode 100644
index 000000000000..97a5da870f8d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-meta.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: import.meta</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const script_url = 'resources/import-meta-url-worker.js';
+  const worker = new Worker(script_url, { type: 'module' });
+  return new Promise((resolve, reject) => {
+        worker.onmessage = resolve;
+        worker.onerror = error => {
+          const msg = error instanceof ErrorEvent ? error.message
+                                                  : 'unknown error';
+          reject(msg);
+        };
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the top-level module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new Worker('resources/dynamic-import-given-url-worker.js',
+                            { type: 'module' });
+  worker.postMessage('./' + script_url);
+  return new Promise((resolve, reject) => {
+        worker.onmessage = resolve;
+        worker.onerror = error => {
+          const msg = error instanceof ErrorEvent ? error.message
+                                                  : 'unknown error';
+          reject(msg);
+        };
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the imported module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new Worker('resources/dynamic-import-given-url-worker.js',
+                            { type: 'module' });
+  worker.postMessage('./' + script_url);
+
+  return new Promise((resolve, reject) => {
+        worker.onmessage = resolve;
+        worker.onerror = error => {
+          const msg = error instanceof ErrorEvent ? error.message
+                                                  : 'unknown error';
+          reject(msg);
+        };
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)))
+      .then(() => {
+        worker.postMessage('./' + script_url + '#1');
+        return new Promise(resolve => worker.onmessage = resolve);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url + "#1")));
+}, 'Test import.meta.url on the imported module script with a fragment.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import-referrer.html b/test/fixtures/wpt/workers/modules/dedicated-worker-import-referrer.html
new file mode 100644
index 000000000000..855df6219436
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import-referrer.html
@@ -0,0 +1,244 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: Referrer</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msg_event = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msg_event.data, 'LOADED');
+  return win;
+}
+
+// Removes URL parameters from the given URL string and returns it.
+function removeParams(url_string) {
+  if (!url_string)
+    return url_string;
+  let url = new URL(url_string);
+  for (var key of url.searchParams.keys())
+    url.searchParams.delete(key);
+  return url.href;
+}
+
+// Generates a referrer given a fetchType, referrer policy, and a request URL
+// (used to determine whether request is remote-origin or not). This function
+// is used to generate expected referrers.
+function generateExpectedReferrer(referrerURL, referrerPolicy, requestURL) {
+  let generatedReferrer = "";
+  if (referrerPolicy === 'no-referrer')
+    generatedReferrer = "";
+  else if (referrerPolicy === 'origin')
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).origin + '/';
+  else if (referrerPolicy === 'same-origin')
+    generatedReferrer = requestURL.includes('remote') ? "" : new URL('resources/' + referrerURL, location.href).href;
+  else
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).href;
+
+  return generatedReferrer;
+}
+
+// Runs a referrer policy test with the given settings. This opens a new window
+// that starts a dedicated worker.
+//
+// |settings| has options as follows:
+//
+//   settings = {
+//     scriptURL: 'resources/referrer-checker.sub.js',
+//     windowReferrerPolicy: 'no-referrer',
+//     workerReferrerPolicy: 'same-origin',
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//   };
+//
+// - |scriptURL| is used for starting a new worker.
+// - |windowReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   window. This policy should be applied to top-level worker module script
+//   loading and static imports.
+// - |workerReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   worker. This policy should be applied to dynamic imports.
+// - |fetchType| indicates a script whose referrer will be tested.
+function import_referrer_test(settings, description) {
+  promise_test(async () => {
+    let windowURL = 'resources/new-worker-window.html';
+    if (settings.windowReferrerPolicy) {
+      windowURL +=
+          `?pipe=header(Referrer-Policy, ${settings.windowReferrerPolicy})`;
+    }
+
+    let scriptURL = settings.scriptURL;
+    if (settings.workerReferrerPolicy) {
+      // 'sub' is necessary even if the |scriptURL| contains the '.sub'
+      // extension because the extension doesn't work with the 'pipe' parameter.
+      // See an issue on the WPT's repository:
+      // https://github.com/web-platform-tests/wpt/issues/9345
+      scriptURL +=
+          `?pipe=sub|header(Referrer-Policy, ${settings.workerReferrerPolicy})`;
+    }
+
+    const win = await openWindow(windowURL);
+    win.postMessage(scriptURL, '*');
+    const msgEvent = await new Promise(resolve => window.onmessage = resolve);
+
+    // Generate the expected referrer, given:
+    //   - The fetchType of the test
+    //   - Referrer URL to be used
+    //   - Relevant referrer policy
+    //   - Request URL
+    let expectedReferrer;
+    if (settings.fetchType === 'top-level') {
+      // Top-level worker requests have their outgoing referrers set given their
+      // containing window's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer('new-worker-window.html', settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-static') {
+      // Static descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and containing
+      // window's referrer policy.
+
+      // In the below cases, the referrer URL and the request URLs are the same
+      // because the initial request (for the top-level worker script) should
+      // act as the referrer for future descendant requests.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-dynamic') {
+      // Dynamic descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.workerReferrerPolicy, settings.scriptURL);
+    }
+
+    // Delete query parameters from the actual referrer to make it easy to match
+    // it with the expected referrer.
+    const actualReferrer = removeParams(msgEvent.data);
+
+    assert_equals(actualReferrer, expectedReferrer);
+  }, description);
+}
+
+// Tests for top-level worker module script loading.
+//
+// Top-level worker module scripts should inherit the containing window's
+// referrer policy when using the containing window's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new Worker)--> [Worker] should respect [windowReferrerPolicy| when
+//                     using [Window]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "no-referrer" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "origin" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "same-origin" referrer ' +
+        'policy');
+
+// Tests for static imports.
+//
+// Static imports should inherit the containing window's referrer policy when
+// using the containing module script's URL as the referrer.
+// Note: This is subject to change in the future; see
+// https://github.com/w3c/webappsec-referrer-policy/issues/111.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new Worker)--> [Worker]
+//     --(static import)--> [Script] should respect |windowReferrerPolicy| when
+//                          using [Worker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "same-origin" referrer policy.');
+
+// Tests for dynamic imports.
+//
+// Dynamic imports should inherit the containing script's referrer policy if
+// set, and use the default referrer policy otherwise, when using the
+// containing script's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window]
+//   --(new Worker)--> [Worker] whose referrer policy is |workerReferrerPolicy|.
+//     --(dynamic import)--> [Script] should respect |workerReferrerPolicy| when
+//                           using [Worker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "same-origin" referrer policy.');
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-import.any.js b/test/fixtures/wpt/workers/modules/dedicated-worker-import.any.js
new file mode 100644
index 000000000000..d5bb6cccbe21
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-import.any.js
@@ -0,0 +1,22 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Starts a dedicated worker for |testCase.scriptURL| and waits until the list
+// of imported modules is sent from the worker. Passes if the list is equal to
+// |testCase.expectation|.
+function import_test(testCase) {
+  promise_test(async () => {
+    const worker = new Worker(testCase.scriptURL, { type: 'module' });
+    worker.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_test);
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html
new file mode 100644
index 000000000000..94916d7ff5d6
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html
@@ -0,0 +1,304 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: WorkerOptions 'credentials'</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+host_info = get_host_info();
+
+// Determines the expected cookie value to be reported by a dedicated worker
+// based on the given option. The worker reports an empty string as the actual
+// cookie value if the cookie wasn't sent to the server. Otherwise, it's the
+// value set by the headers file:
+// "dedicated-worker-options-credentials.html.headers"
+function DetermineExpectedCookieValue(options, config) {
+  // Valid WorkerOptions and test config checking.
+  if (config.origin !== 'same' && config.origin !== 'remote')
+    assert_unreached('Invalid config.origin was specified: ' + config.origin);
+  if (options.credentials && options.credentials !== 'omit' &&
+      options.credentials !== 'same-origin' &&
+      options.credentials !== 'include') {
+    assert_unreached('Invalid credentials option was specified: ' +
+                      options.credentials);
+  }
+  if (options.type !== 'classic' && options.type !== 'module')
+    assert_unreached('Invalid type option was specified: ' + options.type);
+
+  if (options.type === 'classic')
+    return (config.origin === 'same') ? '1' : '';
+
+  if (options.credentials === 'omit')
+    return '';
+  else if (options.credentials === 'include')
+    return '1';
+  else
+    return (config.origin === 'same') ? '1' : '';
+}
+
+// Runs a credentials test with the given WorkerOptions.
+//
+// |options| is a WorkerOptions dict.
+// |config| has options as follows:
+//
+//   config = {
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//     origin: 'remote' or 'same'
+//   };
+//
+// - |config.fetchType| indicates the type of script to load for the test.
+// - |config.origin| indicates same-origin-ness of the script to load.
+function credentials_test(options, config, description) {
+  promise_test(async () => {
+    let workerURL, origin = config.origin;
+    if (config.fetchType === 'top-level') {
+      workerURL = 'resources/postmessage-credentials.py';
+    } else if (config.fetchType === 'descendant-static') {
+      workerURL =
+        `resources/static-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else if (config.fetchType === 'descendant-dynamic') {
+      workerURL =
+        `resources/dynamic-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else {
+      assert_unreached('Invalid config.fetchType: ' + config.fetchType);
+    }
+
+    const worker = new Worker(workerURL, options);
+
+    // Wait until the worker sends the actual cookie value.
+    const msg_event = await new Promise(resolve => worker.onmessage = resolve);
+
+    const expectedCookieValue = DetermineExpectedCookieValue(options, config);
+    assert_equals(msg_event.data, expectedCookieValue);
+  }, description);
+}
+
+function init() {
+  // Same-origin cookie is set up in the .headers file in this directory.
+  promise_test(async () => {
+    return fetch(
+      `${host_info.HTTP_REMOTE_ORIGIN}/cookies/resources/set-cookie.py?name=COOKIE_NAME&path=/workers/modules/`,
+      {
+        mode: 'no-cors',
+        credentials: 'include'
+      });
+  }, 'Test initialization: setting up cross-origin cookie');
+}
+
+init();
+
+// Tests for module workers.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and send the credentials');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and credentials=omit should not send the ' +
+    'credentials');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and credentials=same-origin should send ' +
+    'the credentials');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials');
+
+// Tests for module worker static imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and send the credentials for ' +
+    'same-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and credentials=omit should not send the ' +
+    'credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and credentials=same-origin should send ' +
+    'the credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for same-origin static imports');
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and not send the credentials for ' +
+    'cross-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type-module credentials=omit should not send the ' +
+    'credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type=module and credentials=same-origin should not ' +
+    'send the credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for cross-origin static imports');
+
+// Tests for module worker dynamic imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and send the credentials for ' +
+    'same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and credentials=omit should not send the ' +
+    'credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and credentials=same-origin should send ' +
+    'the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for same-origin dynamic imports');
+
+credentials_test(
+    { type: 'module'},
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=module and default credentials option should ' +
+    'behave as credentials=same-origin and not send the credentials for ' +
+    'cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type-module credentials=omit should not send the ' +
+    'credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=module and credentials=same-origin should not ' +
+    'send the credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=module and credentials=include should send the ' +
+    'credentials for cross-origin dynamic imports');
+
+// Tests for classic workers.
+// TODO(domfarolino): Maybe move classic worker tests up a directory?
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (include).');
+
+// Tests for classic worker dynamic imports.
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option (omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new Worker() with type=classic should always send the credentials for ' +
+    'same-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new Worker() with type=classic should never send the credentials for ' +
+    'cross-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html.headers b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html.headers
new file mode 100644
index 000000000000..8da851ab7363
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-options-credentials.html.headers
@@ -0,0 +1,2 @@
+Set-Cookie: COOKIE_NAME=1
+Access-Control-Allow-Credentials: true
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-options-type.html b/test/fixtures/wpt/workers/modules/dedicated-worker-options-type.html
new file mode 100644
index 000000000000..bb37a18f2cc9
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-options-type.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: WorkerOptions 'type'</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const worker = new Worker('resources/post-message-on-load-worker.js');
+  return new Promise(resolve => worker.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the default worker type.');
+
+promise_test(() => {
+  const worker = new Worker('resources/post-message-on-load-worker.js',
+                            { type: 'classic' });
+  return new Promise(resolve => worker.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "classic" worker type.');
+
+promise_test(() => {
+  const worker = new Worker('resources/post-message-on-load-worker.js',
+                            { type: 'module' });
+  return new Promise(resolve => worker.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "module" worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new Worker('resources/post-message-on-load-worker.js', { type: '' });
+      },
+      'Worker construction with an empty type should throw an exception');
+}, 'Test worker construction with an empty worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new Worker('resources/post-message-on-load-worker.js',
+                   { type: 'unknown' });
+      },
+      'Worker construction with an unknown type should throw an exception');
+}, 'Test worker construction with an unknown worker type.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/dedicated-worker-parse-error-failure.html b/test/fixtures/wpt/workers/modules/dedicated-worker-parse-error-failure.html
new file mode 100644
index 000000000000..343bfe289f30
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/dedicated-worker-parse-error-failure.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script src="../support/check-error-arguments.js"></script>
+<script>
+
+// Check if module scripts are supported on dedicated workers. There is no
+// direct way to detect it, so we assume it's supported when static import is
+// available on the workers.
+//
+// This check is necessary to appropriately test parse error handling because
+// we need to distinguish the parse error invoked by unsupported "import" in
+// the top-level script from the parse error invoked by the statically imported
+// script which is the one we want to check in this test.
+promise_setup(async () => {
+  const scriptURL = 'resources/static-import-worker.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  worker.postMessage('Send message for tests from main script.');
+  const supportsModuleWorkers = await new Promise((resolve, reject) => {
+    worker.onmessage = e => {
+      resolve(e.data.length == 1 && e.data[0] == 'export-on-load-script.js');
+    };
+    worker.onerror = () => resolve(false);
+  });
+  assert_implements(
+    supportsModuleWorkers,
+    "Static import must be supported on module dedicated worker to run this test."
+  );
+});
+
+promise_test(async () => {
+  const scriptURL = 'resources/syntax-error.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Module worker construction for script with syntax error should dispatch ' +
+   'an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'resources/static-import-syntax-error.js';
+  const worker = new Worker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on module worker for script with syntax error should ' +
+   'dispatch an event named error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-and-then-static-import-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-and-then-static-import-worker.js
new file mode 100644
index 000000000000..527702f55117
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-and-then-static-import-worker.js
@@ -0,0 +1,32 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-on-static-import-script.js')
+    .then(module => module.importedModules)
+    .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-data-url-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-data-url-block-cross-origin.js
new file mode 100644
index 000000000000..caa15319c55c
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-data-url-block-cross-origin.js
@@ -0,0 +1,24 @@
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import("data:text/javascript, export const importedModules = ['export-block-cross-origin.js'];")
+    .then(module => module.importedModules)
+    .catch(() => ['ERROR']);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-given-url-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-given-url-worker.js
new file mode 100644
index 000000000000..55102759352c
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-given-url-worker.js
@@ -0,0 +1,21 @@
+// This worker dynamically imports the script URL sent by postMessage(), and
+// sends back an error name if the dynamic import fails.
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = msg_event => {
+    import(msg_event.data)
+        .then(module => postMessage(module.meta_url))
+        .catch(e => postMessage(e.name));
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = connect_event => {
+    const port = connect_event.ports[0];
+    port.onmessage = msg_event => {
+      import(msg_event.data)
+          .then(module => port.postMessage(module.meta_url))
+          .catch(e => port.postMessage(e.name));
+    };
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-credentials-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-credentials-checker-worker.sub.js
new file mode 100644
index 000000000000..3cfbe7c6e4ca
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-credentials-checker-worker.sub.js
@@ -0,0 +1,15 @@
+// Import a remote origin script.
+const import_url =
+    'http://{{domains[www1]}}:{{ports[http][0]}}/workers/modules/resources/export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.cookie));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.cookie));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-referrer-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-referrer-checker-worker.sub.js
new file mode 100644
index 000000000000..014a3467e86c
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-referrer-checker-worker.sub.js
@@ -0,0 +1,16 @@
+// Import a remote origin script.
+const import_url = 'https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/modules/resources/export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.referrer))
+      .catch(error => postMessage(`Import failed: ${error}`));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.referrer))
+        .catch(error => e.ports[0].postMessage(`Import failed: ${error}`));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-script-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-script-worker.sub.js
new file mode 100644
index 000000000000..7ed65438904a
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-remote-origin-script-worker.sub.js
@@ -0,0 +1,17 @@
+// Import a remote origin script.
+const importUrl =
+    'https://{{domains[www1]}}:{{ports[https][0]}}/workers/modules/resources/export-on-load-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(importUrl)
+      .then(module => postMessage(module.importedModules))
+      .catch(e => postMessage(['ERROR']));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(importUrl)
+        .then(module => e.ports[0].postMessage(module.importedModules))
+        .catch(error => e.ports[0].postMessage(['ERROR']));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-credentials-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-credentials-checker-worker.js
new file mode 100644
index 000000000000..24dbd551280f
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-credentials-checker-worker.js
@@ -0,0 +1,13 @@
+const import_url = './export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.cookie));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.cookie));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-referrer-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-referrer-checker-worker.js
new file mode 100644
index 000000000000..56f8a6ffe822
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-same-origin-referrer-checker-worker.js
@@ -0,0 +1,15 @@
+const import_url = './export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  import(import_url)
+      .then(module => postMessage(module.referrer))
+      .catch(error => postMessage(`Import failed: ${error}`));
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    import(import_url)
+        .then(module => e.ports[0].postMessage(module.referrer))
+        .catch(error => e.ports[0].postMessage(`Import failed: ${error}`));
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-script-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-script-block-cross-origin.js
new file mode 100644
index 000000000000..52ec53066359
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-script-block-cross-origin.js
@@ -0,0 +1,24 @@
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-block-cross-origin.js')
+    .then(module => module.importedModules)
+    .catch(() => ['ERROR']);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/dynamic-import-worker.js
new file mode 100644
index 000000000000..2e756fe055e9
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/dynamic-import-worker.js
@@ -0,0 +1,32 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-on-load-script.js')
+    .then(module => module.importedModules)
+    .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/empty-worker.js b/test/fixtures/wpt/workers/modules/resources/empty-worker.js
new file mode 100644
index 000000000000..49ceb2648a93
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/empty-worker.js
@@ -0,0 +1 @@
+// Do nothing.
diff --git a/test/fixtures/wpt/workers/modules/resources/eval-dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/eval-dynamic-import-worker.js
new file mode 100644
index 000000000000..60080d4292a8
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/eval-dynamic-import-worker.js
@@ -0,0 +1,29 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+const code = 'const sourcePromise = new Promise(resolve => {' +
+    '  if (\'DedicatedWorkerGlobalScope\' in self &&' +
+    '      self instanceof DedicatedWorkerGlobalScope) {' +
+    '    self.onmessage = e => {' +
+    '      resolve(e.target);' +
+    '    };' +
+    '  } else if (\'SharedWorkerGlobalScope\' in self &&' +
+    '             self instanceof SharedWorkerGlobalScope) {' +
+    '    self.onconnect = e => {' +
+    '      resolve(e.ports[0]);' +
+    '    };' +
+    '  } else if (\'ServiceWorkerGlobalScope\' in self &&' +
+    '             self instanceof ServiceWorkerGlobalScope) {' +
+    '    self.onmessage = e => {' +
+    '      resolve(e.source);' +
+    '    };' +
+    '  }' +
+    '});' +
+    'const importedModulesPromise =' +
+    '  import(\'./export-on-load-script.js\')' +
+    '    .then(module => module.importedModules)' +
+    '    .catch(error => `Failed to do dynamic import: ${error}`);' +
+    'Promise.all([sourcePromise, importedModulesPromise]).then(results => {' +
+    '  const [source, importedModules] = results;' +
+    '  source.postMessage(importedModules);' +
+    '});';
+eval(code);
diff --git a/test/fixtures/wpt/workers/modules/resources/export-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/export-block-cross-origin.js
new file mode 100644
index 000000000000..a4b513d280e9
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-block-cross-origin.js
@@ -0,0 +1 @@
+export const importedModules = ['export-block-cross-origin.js'];
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js
new file mode 100644
index 000000000000..bab7cb48d249
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js
@@ -0,0 +1,8 @@
+// Export the list of imported modules. It's available after the |ready| promise
+// is resolved.
+export let importedModules = ['export-on-dynamic-import-script.js'];
+export let ready = import('./export-on-load-script.js')
+  .then(module => {
+    Array.prototype.push.apply(importedModules, module.importedModules);
+    return importedModules;
+  });
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js.headers b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js.headers
new file mode 100644
index 000000000000..cb762eff8068
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-dynamic-import-script.js.headers
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js
new file mode 100644
index 000000000000..7d1b122c3225
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js
@@ -0,0 +1 @@
+export const importedModules = ['export-on-load-script.js'];
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js.headers b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js.headers
new file mode 100644
index 000000000000..cb762eff8068
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-load-script.js.headers
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js
new file mode 100644
index 000000000000..3f7174eef0be
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js
@@ -0,0 +1,3 @@
+import * as module from './export-on-load-script.js';
+const filename = 'export-on-static-import-script.js';
+export const importedModules = [filename].concat(module.importedModules);
diff --git a/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js.headers b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js.headers
new file mode 100644
index 000000000000..cb762eff8068
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/export-on-static-import-script.js.headers
@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *
diff --git a/test/fixtures/wpt/workers/modules/resources/import-meta-url-export.js b/test/fixtures/wpt/workers/modules/resources/import-meta-url-export.js
new file mode 100644
index 000000000000..5287b2e9e849
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-meta-url-export.js
@@ -0,0 +1 @@
+export const meta_url = import.meta.url;
diff --git a/test/fixtures/wpt/workers/modules/resources/import-meta-url-worker.js b/test/fixtures/wpt/workers/modules/resources/import-meta-url-worker.js
new file mode 100644
index 000000000000..7887836a6cc1
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-meta-url-worker.js
@@ -0,0 +1,10 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(import.meta.url);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(import.meta.url);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/import-scripts-worker.js b/test/fixtures/wpt/workers/modules/resources/import-scripts-worker.js
new file mode 100644
index 000000000000..d85f573ffe3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-scripts-worker.js
@@ -0,0 +1,33 @@
+try {
+  importScripts('empty-worker.js');
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    postMessage('LOADED');
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    onconnect = e => {
+      e.ports[0].postMessage('LOADED');
+    };
+  }
+} catch (e) {
+  // Post a message instead of propagating an ErrorEvent to the page because
+  // propagated event loses an error name.
+  //
+  // Step 1. "Let notHandled be the result of firing an event named error at the
+  // Worker object associated with the worker, using ErrorEvent, with the
+  // cancelable attribute initialized to true, the message, filename, lineno,
+  // and colno attributes initialized appropriately, and the error attribute
+  // initialized to null."
+  // https://html.spec.whatwg.org/multipage/workers.html#runtime-script-errors-2
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    postMessage(e.name);
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    onconnect = connectEvent => {
+      connectEvent.ports[0].postMessage(e.name);
+    };
+  }
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/import-test-cases.js b/test/fixtures/wpt/workers/modules/resources/import-test-cases.js
new file mode 100644
index 000000000000..8ad89e8fda11
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/import-test-cases.js
@@ -0,0 +1,59 @@
+const testCases = [
+    {
+        scriptURL: '/workers/modules/resources/static-import-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Static import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/static-import-remote-origin-script-worker.sub.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Static import (cross-origin).'
+    },
+    {
+        scriptURL: '/workers/modules/resources/static-import-redirect-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Static import (redirect).'
+    },
+    {
+        scriptURL: '/workers/modules/resources/nested-static-import-worker.js',
+        expectation: [
+            'export-on-static-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Nested static import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/static-import-and-then-dynamic-import-worker.js',
+        expectation: [
+            'export-on-dynamic-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Static import and then dynamic import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/dynamic-import-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'Dynamic import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/nested-dynamic-import-worker.js',
+        expectation: [
+            'export-on-dynamic-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Nested dynamic import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/dynamic-import-and-then-static-import-worker.js',
+        expectation: [
+            'export-on-static-import-script.js',
+            'export-on-load-script.js'
+        ],
+        description: 'Dynamic import and then static import.'
+    },
+    {
+        scriptURL: '/workers/modules/resources/eval-dynamic-import-worker.js',
+        expectation: ['export-on-load-script.js'],
+        description: 'eval(import()).'
+    }
+];
diff --git a/test/fixtures/wpt/workers/modules/resources/nested-dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/nested-dynamic-import-worker.js
new file mode 100644
index 000000000000..00da43c5f078
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/nested-dynamic-import-worker.js
@@ -0,0 +1,34 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+const importedModulesPromise =
+  import('./export-on-dynamic-import-script.js')
+    .then(module => module.ready)
+    .then(importedModules => importedModules)
+    .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/nested-static-import-worker.js b/test/fixtures/wpt/workers/modules/resources/nested-static-import-worker.js
new file mode 100644
index 000000000000..c3a9ff0b799d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/nested-static-import-worker.js
@@ -0,0 +1,21 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './export-on-static-import-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/new-shared-worker-window.html b/test/fixtures/wpt/workers/modules/resources/new-shared-worker-window.html
new file mode 100644
index 000000000000..84564fd7b6e5
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/new-shared-worker-window.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>SharedWorker: new SharedWorker()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+let worker;
+
+// Create a new shared worker for a given script url.
+window.onmessage = e => {
+  worker = new SharedWorker(e.data.scriptURL,
+                            { name: e.data.name, type: 'module' });
+  worker.port.onmessage = msg => window.opener.postMessage(msg.data, '*');
+  worker.onerror = err => {
+    window.opener.postMessage(['ERROR'], '*');
+    err.preventDefault();
+  };
+}
+window.opener.postMessage('LOADED', '*');
+</script>
diff --git a/test/fixtures/wpt/workers/modules/resources/new-worker-window.html b/test/fixtures/wpt/workers/modules/resources/new-worker-window.html
new file mode 100644
index 000000000000..32a89fae0ecd
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/new-worker-window.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>DedicatedWorker: new Worker()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+let worker;
+
+// Creates a new dedicated worker for a given script url.
+window.onmessage = e => {
+  worker = new Worker(e.data, { type: 'module' });
+  worker.postMessage('start');
+  worker.onmessage = msg => window.opener.postMessage(msg.data, '*');
+  worker.onerror = err => {
+      window.opener.postMessage(['ERROR'], '*');
+      err.preventDefault();
+  };
+};
+window.opener.postMessage('LOADED', '*');
+</script>
diff --git a/test/fixtures/wpt/workers/modules/resources/post-message-on-load-worker.js b/test/fixtures/wpt/workers/modules/resources/post-message-on-load-worker.js
new file mode 100644
index 000000000000..e1c547ab6a4d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/post-message-on-load-worker.js
@@ -0,0 +1,10 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage('LOADED');
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage('LOADED');
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-and-then-dynamic-import-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-and-then-dynamic-import-worker.js
new file mode 100644
index 000000000000..2d857a2e90a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-and-then-dynamic-import-worker.js
@@ -0,0 +1,34 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './export-on-dynamic-import-script.js';
+
+const sourcePromise = new Promise(resolve => {
+  if ('DedicatedWorkerGlobalScope' in self &&
+      self instanceof DedicatedWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.target);
+    };
+  } else if (
+      'SharedWorkerGlobalScope' in self &&
+      self instanceof SharedWorkerGlobalScope) {
+    self.onconnect = e => {
+      resolve(e.ports[0]);
+    };
+  } else if (
+      'ServiceWorkerGlobalScope' in self &&
+      self instanceof ServiceWorkerGlobalScope) {
+    self.onmessage = e => {
+      resolve(e.source);
+    };
+  }
+});
+
+export let importedModules = ['export-on-dynamic-import-script.js'];
+const importedModulesPromise = module.ready
+  .then(importedModules => importedModules)
+  .catch(error => `Failed to do dynamic import: ${error}`);
+
+Promise.all([sourcePromise, importedModulesPromise]).then(results => {
+  const [source, importedModules] = results;
+  source.postMessage(importedModules);
+});
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-data-url-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/static-import-data-url-block-cross-origin.js
new file mode 100644
index 000000000000..833348d66cce
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-data-url-block-cross-origin.js
@@ -0,0 +1,14 @@
+import * as module from "data:text/javascript, export const importedModules = ['export-block-cross-origin.js'];";
+
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-non-existent-script-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-non-existent-script-worker.js
new file mode 100644
index 000000000000..16f70e9daf49
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-non-existent-script-worker.js
@@ -0,0 +1 @@
+import './non-existent-script.js';
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-redirect-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-redirect-worker.js
new file mode 100644
index 000000000000..8434c1a34e28
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-redirect-worker.js
@@ -0,0 +1,21 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './redirect.py?location=/workers/modules/resources/export-on-load-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-credentials-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-credentials-checker-worker.sub.js
new file mode 100644
index 000000000000..c543cb496160
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-credentials-checker-worker.sub.js
@@ -0,0 +1,12 @@
+// Import a remote origin script.
+import * as module from 'http://{{domains[www1]}}:{{ports[http][0]}}/workers/modules/resources/export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.cookie);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.cookie);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-referrer-checker-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-referrer-checker-worker.sub.js
new file mode 100644
index 000000000000..c1f8340f36d7
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-referrer-checker-worker.sub.js
@@ -0,0 +1,12 @@
+// Import a remote origin script.
+import * as module from 'https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/modules/resources/export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.referrer);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.referrer);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-script-worker.sub.js b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-script-worker.sub.js
new file mode 100644
index 000000000000..6432dd5d80d0
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-remote-origin-script-worker.sub.js
@@ -0,0 +1,20 @@
+// Import a remote origin script.
+import * as module from 'https://{{domains[www1]}}:{{ports[https][0]}}/workers/modules/resources/export-on-load-script.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-credentials-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-credentials-checker-worker.js
new file mode 100644
index 000000000000..e83dc92070ff
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-credentials-checker-worker.js
@@ -0,0 +1,11 @@
+import * as module from './export-credentials.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.cookie);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.cookie);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-referrer-checker-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-referrer-checker-worker.js
new file mode 100644
index 000000000000..ffcab9e45fdf
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-same-origin-referrer-checker-worker.js
@@ -0,0 +1,11 @@
+import * as module from './export-referrer-checker.py';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage(module.referrer);
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  onconnect = e => {
+    e.ports[0].postMessage(module.referrer);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-script-block-cross-origin.js b/test/fixtures/wpt/workers/modules/resources/static-import-script-block-cross-origin.js
new file mode 100644
index 000000000000..82be8e7ce72e
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-script-block-cross-origin.js
@@ -0,0 +1,14 @@
+import * as module from './export-block-cross-origin.js';
+
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-syntax-error.js b/test/fixtures/wpt/workers/modules/resources/static-import-syntax-error.js
new file mode 100644
index 000000000000..3a20e792c455
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-syntax-error.js
@@ -0,0 +1 @@
+import * as module from './syntax-error.js';
diff --git a/test/fixtures/wpt/workers/modules/resources/static-import-worker.js b/test/fixtures/wpt/workers/modules/resources/static-import-worker.js
new file mode 100644
index 000000000000..19a347999d38
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/static-import-worker.js
@@ -0,0 +1,21 @@
+// This script is meant to be imported by a module worker. It receives a
+// message from the worker and responds with the list of imported modules.
+import * as module from './export-on-load-script.js';
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.target.postMessage(module.importedModules);
+  };
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage(module.importedModules);
+  };
+} else if (
+    'ServiceWorkerGlobalScope' in self &&
+    self instanceof ServiceWorkerGlobalScope) {
+  self.onmessage = e => {
+    e.source.postMessage(module.importedModules);
+  };
+}
diff --git a/test/fixtures/wpt/workers/modules/resources/syntax-error.js b/test/fixtures/wpt/workers/modules/resources/syntax-error.js
new file mode 100644
index 000000000000..8c5c4df671bc
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/syntax-error.js
@@ -0,0 +1 @@
+1 + ;
diff --git a/test/fixtures/wpt/workers/modules/resources/throw.js b/test/fixtures/wpt/workers/modules/resources/throw.js
new file mode 100644
index 000000000000..3d876d43d930
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/resources/throw.js
@@ -0,0 +1 @@
+throw new Error('custom message');
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-blob-url.window.js b/test/fixtures/wpt/workers/modules/shared-worker-import-blob-url.window.js
new file mode 100644
index 000000000000..a79d5725ad87
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-blob-url.window.js
@@ -0,0 +1,26 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a shared worker loaded from a blob URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_blob_url_test(testCase) {
+  promise_test(async () => {
+    const importURL = new URL(testCase.scriptURL, location.href);
+    const blob =
+        new Blob([`import "${importURL}";`], {type: 'text/javascript'});
+    const blobURL = URL.createObjectURL(blob);
+    const worker = new SharedWorker(blobURL, {type: 'module'});
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.port.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_blob_url_test);
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-csp.html b/test/fixtures/wpt/workers/modules/shared-worker-import-csp.html
new file mode 100644
index 000000000000..c7ca37557a1d
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-csp.html
@@ -0,0 +1,128 @@
+<!DOCTYPE html>
+<title>SharedWorker: CSP for ES Modules</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+// This Set is for checking a shared worker in each test is newly created.
+const existingWorkers = new Set();
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msgEvent = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msgEvent.data, 'LOADED');
+  return win;
+}
+
+function import_csp_test(
+    cspHeader, importType, expectedImportedModules, description) {
+  // Append CSP header to windowURL for static import tests since static import
+  // scripts should obey Window's CSP.
+  const windowURL = `resources/new-shared-worker-window.html` +
+      `${importType === 'static'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  // Append CSP header to scriptURL for dynamic import tests since dynamic
+  // import scripts should obey SharedWorker script's responce's CSP.
+  const scriptURL = `${importType}-import-remote-origin-script-worker.sub.js` +
+      `${importType === 'dynamic'
+          ? '?pipe=header(Content-Security-Policy, ' + cspHeader + ')'
+          : ''}`;
+  promise_test(async () => {
+    // Open a window that has the given CSP header.
+    const win = await openWindow(windowURL);
+    // Construct a unique name for SharedWorker.
+    const name = `${cspHeader}_${importType}`;
+    const workerProperties = { scriptURL, name };
+    // Check if this shared worker is newly created.
+    assert_false(existingWorkers.has(workerProperties));
+    existingWorkers.add(workerProperties);
+
+    // Ask the window to start a shared worker with the given CSP header.
+    // The shared worker doesn't inherits the window's CSP header.
+    // https://w3c.github.io/webappsec-csp/#initialize-global-object-csp
+    win.postMessage(workerProperties, '*');
+    const msg_event = await new Promise(resolve => window.onmessage = resolve);
+    assert_array_equals(msg_event.data, expectedImportedModules);
+  }, description);
+}
+
+// Tests for static import.
+//
+// Static import should obey the worker-src directive and the script-src
+// directive. If the both directives are specified, the worker-src directive
+// should be prioritized.
+//
+// "The script-src directive acts as a default fallback for all script-like
+// destinations (including worker-specific destinations if worker-src is not
+// present)."
+// https://w3c.github.io/webappsec-csp/#directive-script-src
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'", "static",
+    ['ERROR'],
+    "worker-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "worker-src * 'unsafe-inline'", "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should allow cross origin static import.");
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'", "static",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin static import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'", "static",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin static import.");
+
+import_csp_test(
+    "worker-src *; script-src 'self' 'unsafe-inline'", "static",
+    ["export-on-load-script.js"],
+    "worker-src * directive should override script-src 'self' directive and " +
+        "allow cross origin static import.");
+
+import_csp_test(
+    "worker-src 'self'; script-src * 'unsafe-inline'", "static",
+    ['ERROR'],
+    "worker-src 'self' directive should override script-src * directive and " +
+        "disallow cross origin static import.");
+
+// Tests for dynamic import.
+//
+// Dynamic import should obey SharedWorker script's CSP instead of parent
+// Window's CSP.
+//
+// Dynamic import should obey the script-src directive instead of the worker-src
+// directive according to the specs:
+//
+// Dynamic import has the "script" destination.
+// Step 3: "Fetch a single module script graph given url, ..., "script", ..."
+// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-an-import()-module-script-graph
+//
+// The "script" destination should obey the script-src CSP directive.
+// "The script-src directive acts as a default fallback for all script-like
+// destinations (including worker-specific destinations if worker-src is not
+// present)."
+// https://w3c.github.io/webappsec-csp/#directive-script-src
+
+import_csp_test(
+    "script-src 'self' 'unsafe-inline'", "dynamic",
+    ['ERROR'],
+    "script-src 'self' directive should disallow cross origin dynamic import.");
+
+import_csp_test(
+    "script-src * 'unsafe-inline'", "dynamic",
+    ["export-on-load-script.js"],
+    "script-src * directive should allow cross origin dynamic import.");
+
+import_csp_test(
+    "worker-src 'self' 'unsafe-inline'", "dynamic",
+    ["export-on-load-script.js"],
+    "worker-src 'self' directive should not take effect on dynamic import.");
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-data-url-cross-origin.html b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url-cross-origin.html
new file mode 100644
index 000000000000..06724a2b9ea5
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url-cross-origin.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<title>SharedWorker: ES modules for data URL workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+const import_from_data_url_worker_test = (importType, isDataURL, expectation) => {
+  promise_test(async () => {
+    const importURL = new URL(`resources/${importType}-import-` +
+        `${isDataURL ? 'data-url' : 'script'}-block-cross-origin.js`,
+        location.href) + '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+    const worker = new SharedWorker(dataURL, { type: 'module' });
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.port.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+
+    assert_array_equals(msgEvent.data,
+        expectation === 'blocked' ? ['ERROR']
+                                  : ['export-block-cross-origin.js']);
+  }, `${importType} import ${isDataURL ? 'data url' : 'script'} from data: ` +
+     `URL should be ${expectation}.`);
+}
+
+// Static import should obey the outside settings.
+// SecurityOrigin of the outside settings is decided by Window.
+import_from_data_url_worker_test('static', true, 'allowed');
+import_from_data_url_worker_test('static', false, 'allowed');
+
+
+// Dynamic import should obey the inside settings.
+// SecurityOrigin of the inside settings is a unique opaque origin.
+//
+// Data url script is cross-origin to the inside settings' SecurityOrigin, but
+// dynamic importing it is allowed.
+// https://fetch.spec.whatwg.org/#concept-main-fetch
+// Step 5: request’s current URL’s scheme is "data" [spec text]
+import_from_data_url_worker_test('dynamic', true, 'allowed');
+
+// Non-data url script is cross-origin to the inside settings' SecurityOrigin.
+// It should be blocked.
+import_from_data_url_worker_test('dynamic', false, 'blocked');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-data-url.window.js b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url.window.js
new file mode 100644
index 000000000000..5c77f6d93661
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-data-url.window.js
@@ -0,0 +1,25 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Imports |testCase.scriptURL| on a shared worker loaded from a data URL,
+// and waits until the list of imported modules is sent from the worker. Passes
+// if the list is equal to |testCase.expectation|.
+function import_data_url_test(testCase) {
+  promise_test(async () => {
+    // The Access-Control-Allow-Origin header is necessary because a worker
+    // loaded from a data URL has a null origin and import() on the worker
+    // without the header is blocked.
+    const importURL = new URL(testCase.scriptURL, location.href) +
+        '?pipe=header(Access-Control-Allow-Origin, *)';
+    const dataURL = `data:text/javascript,import "${importURL}";`;
+
+    const worker = new SharedWorker(dataURL, { type: 'module'});
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) =>{
+        worker.port.onmessage = resolve;
+        worker.onerror = reject;
+    }).catch(e => assert_true(false));
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_data_url_test);
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-failure.html b/test/fixtures/wpt/workers/modules/shared-worker-import-failure.html
new file mode 100644
index 000000000000..c9d166c4fe78
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-failure.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<title>SharedWorker: import failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script> setup({allow_uncaught_exception: true}); </script>
+<script>
+
+// TODO: Factor out the test cases into a separate file.
+// (like import-test-cases.js)
+
+// SharedWorkers doesn't fire error events when runtime script errors occur.
+//
+// "For shared workers, if the error is still not handled afterwards, the error
+// may be reported to a developer console." [spec text]
+// https://html.spec.whatwg.org/C/#runtime-script-errors-2
+
+promise_test(async () => {
+  const scriptURL = 'resources/import-scripts-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const msg_event =
+    await new Promise(resolve => worker.port.onmessage = resolve);
+  assert_equals(msg_event.data, 'TypeError');
+}, 'importScripts() on module worker should throw an exception.');
+
+promise_test(() => {
+  const scriptURL = 'resources/non-existent-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Worker construction for non-existent script should dispatch an ' +
+   'ErrorEvent.');
+
+promise_test(() => {
+  const scriptURL = 'resources/static-import-non-existent-script-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  return new Promise(resolve => worker.onerror = resolve);
+}, 'Static import for non-existent script should dispatch an ErrorEvent.');
+
+promise_test(async () => {
+  const scriptURL = './non-existent-worker.js';
+  const worker =
+      new SharedWorker('resources/dynamic-import-given-url-worker.js',
+                       { type: 'module' });
+  worker.port.postMessage(scriptURL);
+  const msg_event = await new Promise((resolve, reject) => {
+    worker.port.onmessage = resolve;
+    worker.onerror = error => {
+      const msg = error instanceof ErrorEvent ? error.message
+                                              : 'unknown error';
+      reject(msg);
+    };
+  });
+  assert_equals(msg_event.data, 'TypeError');
+}, 'Dynamic import for non-existent script should throw an exception.');
+
+test(() => {
+  const scriptURL = 'http://invalid:123$';
+  assert_throws_dom('SyntaxError',
+                    () => new SharedWorker(scriptURL, { type: 'module' }));
+}, 'SharedWorker construction for an invalid URL should throw an exception.');
+
+async_test((t) => {
+  const scriptURL = 'file:///static-import-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  worker.onerror = t.step_func_done(function(e) {
+    assert_true(e instanceof Event);
+  });
+
+}, 'SharedWorker construction for a file URL should throw an exception.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-meta.html b/test/fixtures/wpt/workers/modules/shared-worker-import-meta.html
new file mode 100644
index 000000000000..e8e9b51f6a50
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-meta.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<title>SharedWorker: import.meta</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const script_url = 'resources/import-meta-url-worker.js';
+  const worker = new SharedWorker(script_url, { type: 'module' });
+  return new Promise((resolve, reject) => {
+        worker.port.onmessage = resolve;
+        worker.onerror = (error) => reject(error && error.message);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the top-level module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new SharedWorker(
+      'resources/dynamic-import-given-url-worker.js',
+      { type: 'module' });
+  worker.port.postMessage('./' + script_url);
+  return new Promise((resolve, reject) => {
+        worker.port.onmessage = resolve;
+        worker.onerror = (error) => reject(error && error.message);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)));
+}, 'Test import.meta.url on the imported module script.');
+
+promise_test(() => {
+  const script_url = 'import-meta-url-export.js';
+  const worker = new SharedWorker(
+      'resources/dynamic-import-given-url-worker.js',
+      { type: 'module' });
+  worker.port.postMessage('./' + script_url);
+
+  return new Promise((resolve, reject) => {
+        worker.port.onmessage = resolve;
+        worker.onerror = (error) => reject(error && error.message);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url)))
+      .then(() => {
+        worker.port.postMessage('./' + script_url + '#1');
+        return new Promise(resolve => worker.port.onmessage = resolve);
+      })
+      .then(msg_event => assert_true(msg_event.data.endsWith(script_url + "#1")));
+}, 'Test import.meta.url on the imported module script with a fragment.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import-referrer.html b/test/fixtures/wpt/workers/modules/shared-worker-import-referrer.html
new file mode 100644
index 000000000000..1096fd2ad872
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import-referrer.html
@@ -0,0 +1,259 @@
+<!DOCTYPE html>
+<title>SharedWorker: Referrer</title>
+<meta name="timeout" content="long" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+// This Set is for checking a shared worker in each test is newly created.
+const existingWorkers = new Set();
+
+async function openWindow(url) {
+  const win = window.open(url, '_blank');
+  add_result_callback(() => win.close());
+  const msg_event = await new Promise(resolve => window.onmessage = resolve);
+  assert_equals(msg_event.data, 'LOADED');
+  return win;
+}
+
+// Removes URL parameters from the given URL string and returns it.
+function removeParams(url_string) {
+  if (!url_string)
+    return url_string;
+  let url = new URL(url_string);
+  for (var key of url.searchParams.keys())
+    url.searchParams.delete(key);
+  return url.href;
+}
+
+// Generates a referrer given a fetchType, referrer policy, and a request URL
+// (used to determine whether request is remote-origin or not). This function
+// is used to generate expected referrers.
+function generateExpectedReferrer(referrerURL, referrerPolicy, requestURL) {
+  let generatedReferrer = "";
+  if (referrerPolicy === 'no-referrer')
+    generatedReferrer = "";
+  else if (referrerPolicy === 'origin')
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).origin + '/';
+  else if (referrerPolicy === 'same-origin')
+    generatedReferrer = requestURL.includes('remote') ? "" : new URL('resources/' + referrerURL, location.href).href;
+  else
+    generatedReferrer = new URL('resources/' + referrerURL, location.href).href;
+
+  return generatedReferrer;
+}
+
+// Runs a referrer policy test with the given settings. This opens a new window
+// that starts a shared worker.
+//
+// |settings| has options as follows:
+//
+//   settings = {
+//     scriptURL: 'resources/referrer-checker.sub.js',
+//     windowReferrerPolicy: 'no-referrer',
+//     workerReferrerPolicy: 'same-origin',
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//   };
+//
+// - |scriptURL| is used for starting a new worker.
+// - |windowReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   window. This policy should be applied to top-level worker module script
+//   loading and static imports.
+// - |workerReferrerPolicy| is to set the ReferrerPolicy HTTP header of the
+//   worker. This policy should be applied to dynamic imports.
+// - |fetchType| indicates a script whose referrer will be tested.
+function import_referrer_test(settings, description) {
+  promise_test(async () => {
+    let windowURL = 'resources/new-shared-worker-window.html';
+    if (settings.windowReferrerPolicy) {
+      windowURL +=
+          `?pipe=header(Referrer-Policy, ${settings.windowReferrerPolicy})`;
+    }
+
+    let scriptURL = settings.scriptURL;
+    if (settings.workerReferrerPolicy) {
+      // 'sub' is necessary even if the |scriptURL| contains the '.sub'
+      // extension because the extension doesn't work with the 'pipe' parameter.
+      // See an issue on the WPT's repository:
+      // https://github.com/web-platform-tests/wpt/issues/9345
+      scriptURL +=
+          `?pipe=sub|header(Referrer-Policy, ${settings.workerReferrerPolicy})`;
+    }
+
+    const win = await openWindow(windowURL);
+    // Construct a unique name for SharedWorker.
+    const name = `${settings.scriptURL}_` +
+        `${settings.windowReferrerPolicy ? settings.windowReferrerPolicy
+                                         : settings.workerReferrerPolicy}` +
+        `_${settings.fetchType}`;
+    const workerProperties = { scriptURL, name };
+    // Check if this shared worker is newly created.
+    assert_false(existingWorkers.has(workerProperties));
+    existingWorkers.add(workerProperties);
+
+    win.postMessage(workerProperties, '*');
+    const msgEvent = await new Promise(resolve => window.onmessage = resolve);
+
+    // Generate the expected referrer, given:
+    //   - The fetchType of the test
+    //   - Referrer URL to be used
+    //   - Relevant referrer policy
+    //   - Request URL
+    let expectedReferrer;
+    if (settings.fetchType === 'top-level') {
+      // Top-level worker requests have their outgoing referrers set given their
+      // containing window's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer('new-shared-worker-window.html', settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-static') {
+      // Static descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and containing
+      // window's referrer policy.
+
+      // In the below cases, the referrer URL and the request URLs are the same
+      // because the initial request (for the top-level worker script) should
+      // act as the referrer for future descendant requests.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.windowReferrerPolicy, settings.scriptURL);
+    } else if (settings.fetchType === 'descendant-dynamic') {
+      // Dynamic descendant script requests from a worker have their outgoing
+      // referrer set given their containing script's URL and referrer policy.
+      expectedReferrer = generateExpectedReferrer(settings.scriptURL, settings.workerReferrerPolicy, settings.scriptURL);
+    }
+
+    // Delete query parameters from the actual referrer to make it easy to match
+    // it with the expected referrer.
+    const actualReferrer = removeParams(msgEvent.data);
+
+    assert_equals(actualReferrer, expectedReferrer);
+  }, description);
+}
+
+// Tests for top-level worker module script loading.
+//
+// Top-level worker module scripts should inherit the containing window's
+// referrer policy when using the containing window's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new SharedWorker)--> [SharedWorker] should respect [windowReferrerPolicy|
+//                           when using [Window]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "no-referrer" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "origin" referrer ' +
+        'policy');
+
+import_referrer_test(
+    { scriptURL: 'postmessage-referrer-checker.py',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'top-level' },
+    'Same-origin top-level module script loading with "same-origin" referrer ' +
+        'policy');
+
+// Tests for static imports.
+//
+// Static imports should inherit the containing window's referrer policy when
+// using the containing module script's URL as the referrer.
+// Note: This is subject to change in the future; see
+// https://github.com/w3c/webappsec-referrer-policy/issues/111.
+//
+// [Current document]
+// --(open)--> [Window] whose referrer policy is |windowReferrerPolicy|.
+//   --(new SharedWorker)--> [SharedWorker]
+//     --(static import)--> [Script] should respect |windowReferrerPolicy| when
+//                          using [SharedWorker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-same-origin-referrer-checker-worker.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Same-origin static import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'static-import-remote-origin-referrer-checker-worker.sub.js',
+      windowReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-static' },
+    'Cross-origin static import with "same-origin" referrer policy.');
+
+// Tests for dynamic imports.
+//
+// Dynamic imports should inherit the containing script's referrer policy if
+// set, and use the default referrer policy otherwise, when using the
+// containing script's URL as the referrer.
+//
+// [Current document]
+// --(open)--> [Window]
+//   --(new SharedWorker)--> [SharedWorker] whose referrer policy is
+//                           |workerReferrerPolicy|.
+//     --(dynamic import)--> [Script] should respect |workerReferrerPolicy| when
+//                           using [SharedWorker]'s URL as the referrer.
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-same-origin-referrer-checker-worker.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Same-origin dynamic import with "same-origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'no-referrer',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "no-referrer" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "origin" referrer policy.');
+
+import_referrer_test(
+    { scriptURL: 'dynamic-import-remote-origin-referrer-checker-worker.sub.js',
+      workerReferrerPolicy: 'same-origin',
+      fetchType: 'descendant-dynamic' },
+    'Cross-origin dynamic import with "same-origin" referrer policy.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-import.window.js b/test/fixtures/wpt/workers/modules/shared-worker-import.window.js
new file mode 100644
index 000000000000..5be49ec12598
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-import.window.js
@@ -0,0 +1,22 @@
+// META: script=/workers/modules/resources/import-test-cases.js
+
+// Starts a shared worker for |testCase.scriptURL| and waits until the list
+// of imported modules is sent from the worker. Passes if the list is equal to
+// |testCase.expectation|.
+function import_test(testCase) {
+  promise_test(async () => {
+    const worker = new SharedWorker(testCase.scriptURL, {type: 'module'});
+    worker.port.postMessage('Send message for tests from main script.');
+    const msgEvent = await new Promise((resolve, reject) => {
+      worker.port.onmessage = resolve;
+      worker.onerror = error => {
+        const msg = error instanceof ErrorEvent ? error.message
+                                                : 'unknown error';
+        reject(msg);
+      };
+    });
+    assert_array_equals(msgEvent.data, testCase.expectation);
+  }, testCase.description);
+}
+
+testCases.forEach(import_test);
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html
new file mode 100644
index 000000000000..221dd01a376f
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html
@@ -0,0 +1,309 @@
+<!DOCTYPE html>
+<title>SharedWorker: WorkerOptions 'credentials'</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script>
+host_info = get_host_info();
+
+// Determines the expected cookie value to be reported by a shared worker
+// based on the given option. The worker reports an empty string as the actual
+// cookie value if the cookie wasn't sent to the server. Otherwise, it's the
+// value set by the headers file:
+// "shared-worker-options-credentials.html.headers"
+function DetermineExpectedCookieValue(options, config) {
+  // Valid WorkerOptions and test config checking.
+  if (config.origin !== 'same' && config.origin !== 'remote')
+    assert_unreached('Invalid config.origin was specified: ' + config.origin);
+  if (options.credentials && options.credentials !== 'omit' &&
+      options.credentials !== 'same-origin' &&
+      options.credentials !== 'include') {
+    assert_unreached('Invalid credentials option was specified: ' +
+                      options.credentials);
+  }
+  if (options.type !== 'classic' && options.type !== 'module')
+    assert_unreached('Invalid type option was specified: ' + options.type);
+
+  if (options.type === 'classic')
+    return (config.origin === 'same') ? '1' : '';
+
+  if (options.credentials === 'omit')
+    return '';
+  else if (options.credentials === 'include')
+    return '1';
+  else
+    return (config.origin === 'same') ? '1' : '';
+}
+
+// Runs a credentials test with the given WorkerOptions.
+//
+// |options| is a WorkerOptions dict.
+// |config| has options as follows:
+//
+//   config = {
+//     fetchType: 'top-level' or 'descendant-static' or 'descendant-dynamic'
+//     origin: 'remote' or 'same'
+//   };
+//
+// - |config.fetchType| indicates the type of script to load for the test.
+// - |config.origin| indicates same-origin-ness of the script to load.
+function credentials_test(options, config, description) {
+  promise_test(async () => {
+    let workerURL, origin = config.origin;
+    if (config.fetchType === 'top-level') {
+      workerURL = 'resources/postmessage-credentials.py';
+    } else if (config.fetchType === 'descendant-static') {
+      workerURL =
+        `resources/static-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else if (config.fetchType === 'descendant-dynamic') {
+      workerURL =
+        `resources/dynamic-import-${origin}-origin-credentials-checker-worker.${origin === 'same' ? '' : 'sub.'}js`;
+    } else {
+      assert_unreached('Invalid config.fetchType: ' + config.fetchType);
+    }
+
+    // Name idetically for each test cases so that it connects to the shared
+    // worker with specified type and credentials.
+    options.name = `${options.type}_${options.credentials || 'default'}_${config.fetchType}_${config.origin}`;
+
+    const worker = new SharedWorker(workerURL, options);
+
+    // Wait until the worker sends the actual cookie value.
+    const msg_event = await new Promise(resolve => worker.port.onmessage = resolve);
+
+    const expectedCookieValue = DetermineExpectedCookieValue(options, config);
+    assert_equals(msg_event.data, expectedCookieValue);
+  }, description);
+}
+
+function init() {
+  // Same-origin cookie is set up in the .headers file in this directory.
+  promise_test(async () => {
+    return fetch(
+      `${host_info.HTTP_REMOTE_ORIGIN}/cookies/resources/set-cookie.py?name=COOKIE_NAME&path=/workers/modules/`,
+      {
+        mode: 'no-cors',
+        credentials: 'include'
+      });
+  }, 'Test initialization: setting up cross-origin cookie');
+}
+
+init();
+
+// Tests for module workers.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and send the credentials');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'send the credentials');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials');
+
+// Tests for module worker static imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and send the credentials for ' +
+    'same-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'send the credentials for same-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for same-origin static imports');
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and not send the credentials ' +
+    'for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'not send the credentials for cross-origin static imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-static', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for cross-origin static imports');
+
+// Tests for module worker dynamic imports.
+
+credentials_test(
+    { type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and send the credentials for ' +
+    'same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'send the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for same-origin dynamic imports');
+
+credentials_test(
+    { type: 'module'},
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and default credentials option ' +
+    'should behave as credentials=same-origin and not send the credentials ' +
+    'for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'omit', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=omit should not ' +
+    'send the credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=same-origin should ' +
+    'not send the credentials for cross-origin dynamic imports');
+
+credentials_test(
+    { credentials: 'include', type: 'module' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=module and credentials=include should send ' +
+    'the credentials for cross-origin dynamic imports');
+
+// Tests for classic workers.
+// TODO(domfarolino): Maybe move classic worker tests up a directory?
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'top-level', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'regardless of the credentials option (include).');
+
+// Tests for classic worker dynamic imports.
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'same' },
+    'new SharedWorker() with type=classic should always send the credentials ' +
+    'for same-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+credentials_test(
+    { type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(default).');
+
+credentials_test(
+    { credentials: 'omit', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(omit).');
+
+credentials_test(
+    { credentials: 'same-origin', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(same-origin).');
+
+credentials_test(
+    { credentials: 'include', type: 'classic' },
+    { fetchType: 'descendant-dynamic', origin: 'remote' },
+    'new SharedWorker() with type=classic should never send the credentials ' +
+    'for cross-origin dynamic imports regardless of the credentials option ' +
+    '(include).');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html.headers b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html.headers
new file mode 100644
index 000000000000..8da851ab7363
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-options-credentials.html.headers
@@ -0,0 +1,2 @@
+Set-Cookie: COOKIE_NAME=1
+Access-Control-Allow-Credentials: true
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-options-type.html b/test/fixtures/wpt/workers/modules/shared-worker-options-type.html
new file mode 100644
index 000000000000..f62eeeb76b9f
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-options-type.html
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<title>SharedWorker: WorkerOptions 'type'</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(() => {
+  const worker = new SharedWorker('resources/post-message-on-load-worker.js',
+                                  'default');
+  return new Promise(resolve => worker.port.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the default worker type.');
+
+promise_test(() => {
+  const worker = new SharedWorker('resources/post-message-on-load-worker.js',
+                                  { name: 'classic', type: 'classic' });
+  return new Promise(resolve => worker.port.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "classic" worker type.');
+
+promise_test(() => {
+  const worker = new SharedWorker('resources/post-message-on-load-worker.js',
+                                  { name: 'module', type: 'module' });
+  return new Promise(resolve => worker.port.onmessage = resolve)
+      .then(msg_event => assert_equals(msg_event.data, 'LOADED'));
+}, 'Test worker construction with the "module" worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new SharedWorker('resources/post-message-on-load-worker.js',
+                         { name: 'blank', type : '' });
+      },
+      'Worker construction with an empty type should throw an exception');
+}, 'Test worker construction with an empty worker type.');
+
+test(() => {
+  assert_throws_js(
+      TypeError,
+      () => {
+        new SharedWorker('resources/post-message-on-load-worker.js',
+                         { name: 'unknown', type : 'unknown' });
+      },
+      'Worker construction with an unknown type should throw an exception');
+}, 'Test worker construction with an unknown worker type.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/modules/shared-worker-parse-error-failure.html b/test/fixtures/wpt/workers/modules/shared-worker-parse-error-failure.html
new file mode 100644
index 000000000000..f197d81e36ac
--- /dev/null
+++ b/test/fixtures/wpt/workers/modules/shared-worker-parse-error-failure.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<title>SharedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../support/check-error-arguments.js"></script>
+<script>
+
+// Use a unique URL fragment to prevent potential interference from other tests
+// which might use the same SharedWorker URL.
+const uniqueFragment = '#shared-worker-parse-error-failure';
+
+// Check if module shared worker is supported.
+// In this test scope, we only use simple non-nested static import as a feature
+// of module shared worker, so we only check if static import is supported.
+//
+// This check is necessary to appropriately test parse error handling because
+// we need to distingusih the parse error invoked by unsupported "import" in
+// the top-level script from the parse error invoked by the statically imported
+// script which is the one we want to check in this test.
+promise_setup(async () => {
+  const scriptURL = 'resources/static-import-worker.js' + uniqueFragment;
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const supportsModuleWorkers = await new Promise((resolve, reject) => {
+    worker.port.onmessage = e => {
+      resolve(e.data.length == 1 && e.data[0] == 'export-on-load-script.js');
+    };
+    worker.onerror = () => resolve(false);
+  });
+  assert_implements(
+    supportsModuleWorkers,
+    "Static import must be supported on module shared worker to run this test."
+  );
+});
+
+promise_test(async () => {
+  const scriptURL = 'resources/syntax-error.js' + uniqueFragment;
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Module shared worker construction for script with syntax error should ' +
+   'dispatch an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'resources/static-import-syntax-error.js' + uniqueFragment;
+  const worker = new SharedWorker(scriptURL, { type: 'module' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on module shared worker for script with syntax error ' +
+   'should dispatch an event named error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/multi-globals/WEB_FEATURES.yml b/test/fixtures/wpt/workers/multi-globals/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b16862ba1c01
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/multi-globals/current/current.html b/test/fixtures/wpt/workers/multi-globals/current/current.html
new file mode 100644
index 000000000000..e6261f83883f
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/current/current.html
@@ -0,0 +1,3 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Current page</title>
diff --git a/test/fixtures/wpt/workers/multi-globals/current/worker.js b/test/fixtures/wpt/workers/multi-globals/current/worker.js
new file mode 100644
index 000000000000..44103842a40d
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/current/worker.js
@@ -0,0 +1 @@
+postMessage('current');
diff --git a/test/fixtures/wpt/workers/multi-globals/incumbent/incumbent.html b/test/fixtures/wpt/workers/multi-globals/incumbent/incumbent.html
new file mode 100644
index 000000000000..d8bd1ae2c0f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/incumbent/incumbent.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Incumbent page</title>
+
+<iframe src="../current/current.html" id="c"></iframe>
+
+<script>
+  const current = document.querySelector("#c").contentWindow;
+
+  window.hello = () => {
+    const worker = new current.Worker('worker.js');
+    worker.onmessage = e => { parent.postMessage(e.data, '*'); }
+  };
+</script>
diff --git a/test/fixtures/wpt/workers/multi-globals/incumbent/worker.js b/test/fixtures/wpt/workers/multi-globals/incumbent/worker.js
new file mode 100644
index 000000000000..03f02a869086
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/incumbent/worker.js
@@ -0,0 +1 @@
+postMessage('incumbent');
diff --git a/test/fixtures/wpt/workers/multi-globals/url-parsing.html b/test/fixtures/wpt/workers/multi-globals/url-parsing.html
new file mode 100644
index 000000000000..27bbc0cb50fe
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/url-parsing.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Multiple globals for Worker constructor: parsing scriptURL</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<!-- This is the entry global -->
+
+<iframe src="incumbent/incumbent.html"></iframe>
+
+<script>
+async_test((t) => {
+  onload = t.step_func(() => {
+    frames[0].hello();
+  });
+  onmessage = t.step_func_done(e => {
+    assert_equals(e.data, 'current');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/multi-globals/worker.js b/test/fixtures/wpt/workers/multi-globals/worker.js
new file mode 100644
index 000000000000..fcc521e31370
--- /dev/null
+++ b/test/fixtures/wpt/workers/multi-globals/worker.js
@@ -0,0 +1 @@
+postMessage('entry');
diff --git a/test/fixtures/wpt/workers/name-property.html b/test/fixtures/wpt/workers/name-property.html
new file mode 100644
index 000000000000..ccc2a9de3a9c
--- /dev/null
+++ b/test/fixtures/wpt/workers/name-property.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test the name property of shared and dedicated workers via the name constructor option</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#concept-workerglobalscope-name">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-sharedworkerglobalscope-name">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-dedicatedworkerglobalscope-name">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+"use strict";
+setup({explicit_done: true});
+
+(async function() {
+  const worker = new Worker("support/name.js", { name: "my name" });
+  await fetch_tests_from_worker(worker);
+
+  const worker2 = new Worker("support/name-as-accidental-global.js");
+  await fetch_tests_from_worker(worker2);
+
+  const sharedWorker = new SharedWorker("support/name.js", { name: "my name" });
+  await fetch_tests_from_worker(sharedWorker);
+
+  const sharedWorker2 = new SharedWorker("support/name-as-accidental-global.js");
+  await fetch_tests_from_worker(sharedWorker2);
+
+  done();
+})();
+</script>
diff --git a/test/fixtures/wpt/workers/nested_worker.worker.js b/test/fixtures/wpt/workers/nested_worker.worker.js
new file mode 100644
index 000000000000..005b3c2f3039
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+    var worker1 = new Worker("support/WorkerBasic.js");
+    worker1.postMessage("ping");
+    worker1.onmessage = this.step_func_done(function(evt) {
+        assert_equals(evt.data, "Pass");
+        worker1.terminate();
+    });
+}, "Nested worker");
+done();
diff --git a/test/fixtures/wpt/workers/nested_worker_close_from_parent_worker.html b/test/fixtures/wpt/workers/nested_worker_close_from_parent_worker.html
new file mode 100644
index 000000000000..57c98517cbd3
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_close_from_parent_worker.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test terminating a nested workers by calling terminate() from its parent worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  const worker = new Worker("support/parent_of_nested_worker.js");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+    done();
+  });
+  worker.postMessage("close");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/nested_worker_close_self.worker.js b/test/fixtures/wpt/workers/nested_worker_close_self.worker.js
new file mode 100644
index 000000000000..73c87f405508
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_close_self.worker.js
@@ -0,0 +1,12 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+  if (!self.Worker)
+    done();
+  const worker = new Worker("support/WorkerClose.js");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "close");
+    done();
+  });
+  worker.postMessage("close");
+}, "Nested work that closes itself");
diff --git a/test/fixtures/wpt/workers/nested_worker_importScripts.worker.js b/test/fixtures/wpt/workers/nested_worker_importScripts.worker.js
new file mode 100644
index 000000000000..a671ee4e1e93
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_importScripts.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+    const worker = new Worker("support/ImportScripts.js");
+    worker.postMessage("ping");
+    worker.onmessage = this.step_func_done(function(evt) {
+        assert_equals(evt.data, "Pass");
+        worker.terminate();
+    });
+}, "Nested worker that calls importScripts()");
+done();
diff --git a/test/fixtures/wpt/workers/nested_worker_sync_xhr.worker.js b/test/fixtures/wpt/workers/nested_worker_sync_xhr.worker.js
new file mode 100644
index 000000000000..609ecc49e16d
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_sync_xhr.worker.js
@@ -0,0 +1,11 @@
+importScripts("/resources/testharness.js");
+
+async_test(function() {
+    const worker = new Worker("support/sync_xhr.js");
+    worker.postMessage("ping");
+    worker.onmessage = this.step_func_done(function(evt) {
+        assert_equals(evt.data, "Pass");
+        worker.terminate();
+    });
+}, "Nested worker that issues a sync XHR");
+done();
diff --git a/test/fixtures/wpt/workers/nested_worker_terminate_from_document.html b/test/fixtures/wpt/workers/nested_worker_terminate_from_document.html
new file mode 100644
index 000000000000..10849b3f6ce8
--- /dev/null
+++ b/test/fixtures/wpt/workers/nested_worker_terminate_from_document.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test terminating a chain of nested workers by calling terminate() from the owning document</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+  const worker = new Worker("support/parent_of_nested_worker.js");
+  worker.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+    worker.terminate();
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/non-automated/WEB_FEATURES.yml b/test/fixtures/wpt/workers/non-automated/WEB_FEATURES.yml
new file mode 100644
index 000000000000..182aad016868
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- navigator-onLine.html: [online]
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-nested.html b/test/fixtures/wpt/workers/non-automated/infinite-nested.html
new file mode 100644
index 000000000000..3ff3edb35348
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-nested.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>infinite nested workers</title>
+<p>There number below should be increasing (ideally never-ending).</p>
+<div>0</div>
+<script>
+var worker = new Worker('infinite-nested.js');
+var div = document.getElementsByTagName('div')[0];
+var i = 0;
+worker.onmessage = function(e) {
+  div.textContent = i++;
+}
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-nested.js b/test/fixtures/wpt/workers/non-automated/infinite-nested.js
new file mode 100644
index 000000000000..137dd0a2e281
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-nested.js
@@ -0,0 +1,5 @@
+postMessage(1);
+var w = new Worker('infinite-nested.js');
+w.onmessage = function(e) {
+  postMessage(e.data);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.html b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.html
new file mode 100644
index 000000000000..463546cc969f
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>infinite sibling and nested workers</title>
+<p>The number below should be increasing (ideally never-ending).</p>
+<div>0</div>
+<script>
+var worker = new Worker('infinite-sibling-and-nested.js');
+var div = document.getElementsByTagName('div')[0];
+var i = 0;
+worker.onmessage = function(e) {
+  div.textContent = i + e.data;
+}
+</script>
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.js b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.js
new file mode 100644
index 000000000000..cf7b794a414d
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling-and-nested.js
@@ -0,0 +1,8 @@
+function createWorker() {
+  var worker = new Worker('infinite-nested.js?' + Math.random());
+  worker.onmessage = function(e) {
+    postMessage(e.data);
+    createWorker();
+  }
+}
+createWorker();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling.html b/test/fixtures/wpt/workers/non-automated/infinite-sibling.html
new file mode 100644
index 000000000000..edcb8d707227
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<title>infinite sibling workers</title>
+<p>The number below should be increasing (ideally never-ending).</p>
+<div>0</div>
+<script>
+var worker = new Worker('infinite-sibling.js');
+var div = document.getElementsByTagName('div')[0];
+var i = 0;
+worker.onmessage = function(e) {
+  div.textContent = i + e.data;
+}
+</script>
diff --git a/test/fixtures/wpt/workers/non-automated/infinite-sibling.js b/test/fixtures/wpt/workers/non-automated/infinite-sibling.js
new file mode 100644
index 000000000000..6424f7009324
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/infinite-sibling.js
@@ -0,0 +1,8 @@
+function createWorker() {
+  var worker = new Worker('post-a-1.js?' + Math.random());
+  worker.onmessage = function(e) {
+    postMessage(e.data);
+    createWorker();
+  }
+}
+createWorker();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/navigator-onLine.html b/test/fixtures/wpt/workers/non-automated/navigator-onLine.html
new file mode 100644
index 000000000000..5f2746b54633
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/navigator-onLine.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<title>navigator.onLine in dedicated worker</title>
+<pre>Log:
+</pre>
+<script>
+var pre = document.querySelector('pre');
+var worker, shared;
+try { worker = new Worker('navigator-onLine.js'); } catch(e) { pre.textContent += '\nnew Worker threw: ' + e.message; }
+try { shared = new SharedWorker('#', ''); } catch(e) { pre.textContent += '\nnew SharedWorker threw: ' + e.message; }
+if (worker) {
+  worker.onmessage = function(e) {
+    pre.textContent += '\ndedicated worker: ' + e.data;
+  }
+}
+if (shared) {
+  shared.port.onmessage = function(e) {
+    pre.textContent += '\nshared worker: ' + e.data;
+  }
+}
+function update() {
+  pre.textContent += '\n\n' + new Date() + '\n<script>: ' + navigator.onLine;
+  if (worker) worker.postMessage(1);
+  if (shared) shared.port.postMessage(1);
+}
+update();
+ononline = onoffline = update;
+</script>
+<p>As you go online and offline, the log should be filled with the correct status of navigator.onLine.</p>
+<p><button onclick="update()">Check navigator.onLine status</button></p>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/navigator-onLine.js b/test/fixtures/wpt/workers/non-automated/navigator-onLine.js
new file mode 100644
index 000000000000..592b286bb352
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/navigator-onLine.js
@@ -0,0 +1,11 @@
+if ('onmessage' in self) { // dedicated worker
+  onmessage = function(e) {
+    postMessage(navigator.onLine);
+  }
+} else { // shared worker
+  onconnect = function(e) {
+    e.ports[0].onmessage = function(e) {
+      this.postMessage(navigator.onLine);
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/non-automated/post-a-1.js b/test/fixtures/wpt/workers/non-automated/post-a-1.js
new file mode 100644
index 000000000000..2318c2e267db
--- /dev/null
+++ b/test/fixtures/wpt/workers/non-automated/post-a-1.js
@@ -0,0 +1 @@
+postMessage(1);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/opaque-origin.html b/test/fixtures/wpt/workers/opaque-origin.html
new file mode 100644
index 000000000000..83574b456fec
--- /dev/null
+++ b/test/fixtures/wpt/workers/opaque-origin.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+// Sandboxed iframe forwards messages from its worker, this translates those
+// messages back to something fetch_tests_from_worker can parse.
+const channel = new MessageChannel();
+onmessage = e => {
+  channel.port2.postMessage(e.data);
+};
+fetch_tests_from_worker(channel.port1);
+channel.port1.start();
+</script>
+<iframe sandbox="allow-scripts" src="support/sandboxed-tests.html?pipe=sub"></iframe>
+</body>
diff --git a/test/fixtures/wpt/workers/postMessage_DataCloneErr.htm b/test/fixtures/wpt/workers/postMessage_DataCloneErr.htm
new file mode 100644
index 000000000000..24093ce4e3e5
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_DataCloneErr.htm
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title> postMessage() with WorkerNavigator </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var worker = new Worker("./support/WorkerDataCloneErr.js");
+  worker.onmessage = t.step_func_done(function(e) {
+    assert_equals(e.data, "Pass");
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_block.https.html b/test/fixtures/wpt/workers/postMessage_block.https.html
new file mode 100644
index 000000000000..c3e69f6193f0
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_block.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+const t = async_test('postMessage and block');
+
+const w = new Worker('support/postMessage_block_worker.js');
+
+w.onmessage = t.step_func_done(() => {
+  const a = new Int32Array(new SharedArrayBuffer(4));
+  w.postMessage(a);
+  while (Atomics.load(a, 0) === 0);
+  assert_equals(Atomics.load(a, 0), 1);
+});
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/postMessage_block.https.html.headers b/test/fixtures/wpt/workers/postMessage_block.https.html.headers
new file mode 100644
index 000000000000..63b60e490f47
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_block.https.html.headers
@@ -0,0 +1,2 @@
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Embedder-Policy: require-corp
diff --git a/test/fixtures/wpt/workers/postMessage_clone_port.htm b/test/fixtures/wpt/workers/postMessage_clone_port.htm
new file mode 100644
index 000000000000..b1d7b84e3c09
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_clone_port.htm
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title> postMessage(): clone a port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var channelA = new MessageChannel();
+  var channelB = new MessageChannel();
+  var originalPort = channelB.port2;
+  channelA.port2.onmessage = t.step_func(function(e) {
+    assert_equals(e.data, "ports");
+    var clonedPort = e.ports[0];
+    assert_not_equals(clonedPort, originalPort, "new cloned port object should not equal to the original port!");
+    clonedPort.onmessage = t.step_func_done(function(e) {
+      assert_equals(e.data, "ping", "Data sent through remote port is received by the new cloned port");
+    });
+  });
+  channelA.port1.postMessage("ports", [channelB.port2]);
+  channelB.port1.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_clone_port_error.htm b/test/fixtures/wpt/workers/postMessage_clone_port_error.htm
new file mode 100644
index 000000000000..3558987476bd
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_clone_port_error.htm
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<title> postMessage(): cloning source port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+test(function() {
+  var channel = new MessageChannel();
+  channel.port1.start();
+  assert_throws_dom("DataCloneError", function() {
+    channel.port1.postMessage("ports", [channel.port1]);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_event_properties.htm b/test/fixtures/wpt/workers/postMessage_event_properties.htm
new file mode 100644
index 000000000000..8122413de40d
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_event_properties.htm
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<title> postMessage(): MessageEvent properties </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var channel = new MessageChannel();
+  var targetPort = channel.port2;
+  targetPort.start();
+  targetPort.addEventListener("message", t.step_func_done(function (evt) {
+    assert_class_string(evt, "MessageEvent");
+    assert_equals(evt.type, "message");
+    assert_false(evt.bubbles, "bubbles should be false");
+    assert_false(evt.cancelable, "cancelable should be false");
+    assert_equals(evt.data, "ping", "data");
+    assert_equals(evt.origin, "", "origin");
+    assert_equals(evt.lastEventId, "", "lastEventId");
+    assert_equals(evt.source, null, "source");
+    assert_array_equals(evt.ports, [], "ports");
+  }), true);
+  channel.port1.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_ports_readonly_array.htm b/test/fixtures/wpt/workers/postMessage_ports_readonly_array.htm
new file mode 100644
index 000000000000..bd833ede9361
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_ports_readonly_array.htm
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title> postMessage(): read-only ports array </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+"use strict";
+async_test(function(t) {
+  var channel = new MessageChannel();
+  var targetPort = channel.port2;
+  targetPort.start();
+  targetPort.addEventListener("message", t.step_func_done(function(e) {
+    var channel3 = new MessageChannel();
+    assert_throws_js(TypeError, () => {
+      e.ports.push(channel3.port1);
+    }, "ports is a frozen object");
+    assert_equals(e.ports.length, 1, "ports is a read only array with length == 1.");
+  }), true);
+  var channel2 = new MessageChannel();
+  channel.port1.postMessage("ports", [channel2.port1]);
+});
+</script>
diff --git a/test/fixtures/wpt/workers/postMessage_target_source.htm b/test/fixtures/wpt/workers/postMessage_target_source.htm
new file mode 100644
index 000000000000..7d684916dde2
--- /dev/null
+++ b/test/fixtures/wpt/workers/postMessage_target_source.htm
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<title> postMessage(): target port and source port </title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var channel = new MessageChannel();
+  var source = channel.port1;
+  var target = channel.port2;
+  target.start();
+  target.addEventListener("message", t.step_func_done(function(e) {
+    assert_equals(e.target, target);
+    assert_not_equals(e.target, source);
+  }), true);
+  source.postMessage("ping");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/resources/shared-worker-memory.js b/test/fixtures/wpt/workers/resources/shared-worker-memory.js
new file mode 100644
index 000000000000..b1504f38c504
--- /dev/null
+++ b/test/fixtures/wpt/workers/resources/shared-worker-memory.js
@@ -0,0 +1,30 @@
+'use strict';
+
+let stored_data = null;
+
+function processMessage(e) {
+  function respond(data) {
+    e.currentTarget.postMessage(Object.assign(data, {reqid: e.data.reqid}));
+  }
+
+  switch (e.data.op) {
+    case 'load': {
+      respond({ack: 'load', status: 'OK', data: stored_data});
+      break;
+    }
+    case 'store': {
+      try {
+        stored_data = e.data.data
+      } catch (err) {
+        respond({ack: 'store', status: 'ERROR', error: err.name});
+        return;
+      }
+      respond({ack: 'store', status: 'OK'});
+      break;
+    }
+  }
+}
+
+self.addEventListener('connect', e => {
+  e.ports[0].onmessage = processMessage;
+});
diff --git a/test/fixtures/wpt/workers/resources/worker-url-encoding.js b/test/fixtures/wpt/workers/resources/worker-url-encoding.js
new file mode 100644
index 000000000000..444a19db4e2d
--- /dev/null
+++ b/test/fixtures/wpt/workers/resources/worker-url-encoding.js
@@ -0,0 +1 @@
+postMessage(location.search);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/same-origin-check.sub.html b/test/fixtures/wpt/workers/same-origin-check.sub.html
new file mode 100644
index 000000000000..7af021b8dbb7
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-origin-check.sub.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+const sameOrigin = 'http://{{host}}:{{ports[http][0]}}';
+const crossOrigin = 'http://{{host}}:{{ports[http][1]}}';
+const workerPath = '/workers/support/post-message-on-load-worker.js?pipe=header(Access-Control-Allow-Origin,*)';
+const redirectPath = '/service-workers/service-worker/resources/redirect.py?ACAOrigin=*&Redirect=';
+const tests = [
+  {
+    name: "cross-origin",
+    url: crossOrigin + workerPath
+  },
+  {
+    name: "cross-origin-to-same-origin-redirect",
+    url: crossOrigin + redirectPath +
+         encodeURIComponent(sameOrigin + workerPath)
+  },
+  {
+    name: "same-origin-to-cross-origin-redirect",
+    url: sameOrigin + redirectPath + encodeURIComponent(crossOrigin + workerPath)
+  },
+  {
+    name: "same-origin-to-cross-origin-to-same-origin-redirect",
+    url: sameOrigin + redirectPath +
+         encodeURIComponent(
+             crossOrigin + redirectPath +
+             encodeURIComponent(sameOrigin + workerPath))
+  },
+];
+
+for (const test of tests) {
+  for (const type of ['classic', 'module']) {
+    promise_test(t => new Promise((resolve, reject) => {
+        try {
+          const worker = new Worker(test.url, {type});
+          worker.onmessage = _ => reject('Worker loaded unexpectedly');
+          worker.onerror = resolve;
+        } catch (e) {
+          resolve();
+        }
+      }), 'Worker: ' + test.name + ' (' + type + ')');
+
+    promise_test(t => new Promise((resolve, reject) => {
+        try {
+          const worker = new SharedWorker(
+              test.url + '&label=' + type + test.name, {type});
+          worker.port.onmessage = _ => reject('Worker loaded unexpectedly');
+          worker.onerror = resolve;
+        } catch (e) {
+          resolve();
+        }
+      }), 'SharedWorker: ' + test.name + ' (' + type + ')');
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/workers/same-site-cookies/first-party.all.tentative.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/first-party.all.tentative.https.window.js
new file mode 100644
index 000000000000..ac6030e65403
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/first-party.all.tentative.https.window.js
@@ -0,0 +1,29 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (window) Set up listener for cookie message and start worker.
+// Step 3 (redirect) Redirect to worker script.
+// Step 4 (worker) Send cookie message to window.
+// Step 5 (window) Receive cookie message and cleanup.
+
+async_test(t => {
+    // Step 1
+    const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+    cookie_set_window.onload =  t.step_func(_ => {
+        // Step 2
+        const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py", {sameSiteCookies: "all"});
+        worker.port.onmessage = t.step_func(e => {
+            // Step 5
+            getCookieNames().then(t.step_func((cookies) => {
+                assert_equals(e.data + cookies, "ReadOnLoad:StrictLaxNone,ReadOnFetch:StrictLaxNone,SetOnRedirectLoad:StrictLaxNone,SetOnLoad:StrictLaxNone,SetOnRedirectFetch:StrictLaxNone,SetOnFetch:StrictLaxNone", "Worker should get/set all cookies");
+                cookie_set_window.close();
+                t.done();
+            }));
+        });
+    });
+}, "Check SharedWorker sameSiteCookies option all for first-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/first-party.default.tentative.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/first-party.default.tentative.https.window.js
new file mode 100644
index 000000000000..2c64ff628f5b
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/first-party.default.tentative.https.window.js
@@ -0,0 +1,29 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (window) Set up listener for cookie message and start worker.
+// Step 3 (redirect) Redirect to worker script.
+// Step 4 (worker) Send cookie message to window.
+// Step 5 (window) Receive cookie message and cleanup.
+
+async_test(t => {
+    // Step 1
+    const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+    cookie_set_window.onload =  t.step_func(_ => {
+        // Step 2
+        const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py");
+        worker.port.onmessage = t.step_func(e => {
+            // Step 5
+            getCookieNames().then(t.step_func((cookies) => {
+                assert_equals(e.data + cookies, "ReadOnLoad:StrictLaxNone,ReadOnFetch:StrictLaxNone,SetOnRedirectLoad:StrictLaxNone,SetOnLoad:StrictLaxNone,SetOnRedirectFetch:StrictLaxNone,SetOnFetch:StrictLaxNone", "Worker should get/set all cookies");
+                cookie_set_window.close();
+                t.done();
+            }));
+        });
+    });
+}, "Check SharedWorker sameSiteCookies option default for first-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/first-party.none.tentative.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/first-party.none.tentative.https.window.js
new file mode 100644
index 000000000000..76a8b1d8bcb5
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/first-party.none.tentative.https.window.js
@@ -0,0 +1,29 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (window) Set up listener for cookie message and start worker.
+// Step 3 (redirect) Redirect to worker script.
+// Step 4 (worker) Send cookie message to window.
+// Step 5 (window) Receive cookie message and cleanup.
+
+async_test(t => {
+    // Step 1
+    const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+    cookie_set_window.onload =  t.step_func(_ => {
+        // Step 2
+        const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py", {sameSiteCookies: "none"});
+        worker.port.onmessage = t.step_func(e => {
+            // Step 5
+            getCookieNames().then(t.step_func((cookies) => {
+                assert_equals(e.data + cookies, "ReadOnLoad:None,ReadOnFetch:None,SetOnRedirectLoad:None,SetOnLoad:None,SetOnRedirectFetch:None,SetOnFetch:None", "Worker should get/set SameSite=None cookies only");
+                cookie_set_window.close();
+                t.done();
+            }));
+        });
+    });
+}, "Check SharedWorker sameSiteCookies option none for first-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/resources/iframe-iframe.html b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe-iframe.html
new file mode 100644
index 000000000000..efd4f3a65468
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe-iframe.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<meta charset="utf-8">
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body>
+<script>
+// Step 4 (workers/same-site-cookies/third-party.{})
+test_driver.set_test_context(window.top);
+const type = (new URLSearchParams(window.location.search)).get("type");
+let options = {};
+switch (type) {
+    case "default":
+        break;
+    case "all":
+        options.sameSiteCookies = "all";
+        break;
+    case "none":
+        options.sameSiteCookies = "none";
+        break;
+}
+// Step 7 (workers/same-site-cookies/third-party.{})
+try {
+    const worker = new SharedWorker("/workers/same-site-cookies/resources/worker_redirect.py", options);
+    worker.port.onmessage = (e) => {
+        window.top.postMessage(e.data, "*");
+    };
+} catch (_) {
+    window.top.postMessage("DidNotStart", "*");
+}
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/same-site-cookies/resources/iframe.sub.html b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe.sub.html
new file mode 100644
index 000000000000..c4724d01d2f5
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/resources/iframe.sub.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset="utf-8">
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body>
+<script>
+// Step 3 (workers/same-site-cookies/third-party.{})
+test_driver.set_test_context(window.top);
+const type = (new URLSearchParams(window.location.search)).get("type");
+let iframe = document.createElement("iframe");
+iframe.src = "https://{{hosts[][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe-iframe.html?type=" + type;
+document.body.appendChild(iframe);
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/same-site-cookies/resources/util.js b/test/fixtures/wpt/workers/same-site-cookies/resources/util.js
new file mode 100644
index 000000000000..67d9ee5c06bf
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/resources/util.js
@@ -0,0 +1,46 @@
+async function getCookieNames() {
+  const cookies = await test_driver.get_all_cookies();
+  const cookie_names = {};
+  cookies.forEach((element) => cookie_names[element["name"]] = true);
+  let message = ",SetOnRedirectLoad:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_redirect_load")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_redirect_load")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_redirect_load")) {
+      message += "None";
+  }
+  message += ",SetOnLoad:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_load")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_load")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_load")) {
+      message += "None";
+  }
+  message += ",SetOnRedirectFetch:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_redirect_fetch")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_redirect_fetch")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_redirect_fetch")) {
+      message += "None";
+  }
+  message += ",SetOnFetch:";
+  if (cookie_names.hasOwnProperty("samesite_strict_set_on_fetch")) {
+    message += "Strict";
+  }
+  if (cookie_names.hasOwnProperty("samesite_lax_set_on_fetch")) {
+      message += "Lax";
+  }
+  if (cookie_names.hasOwnProperty("samesite_none_set_on_fetch")) {
+      message += "None";
+  }
+  return message;
+}
diff --git a/test/fixtures/wpt/workers/same-site-cookies/third-party.all.tentative.sub.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/third-party.all.tentative.sub.https.window.js
new file mode 100644
index 000000000000..21b53819d93f
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/third-party.all.tentative.sub.https.window.js
@@ -0,0 +1,32 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (top-frame) Set up listener for "DidNotStart" message and open cross-site iframe.
+// Step 3 (sub-frame) Open iframe same-site to top-frame.
+// Step 4 (sub-sub-frame) Set up listener for message and start worker.
+// Step 5 (redirect) Skipped.
+// Step 6 (worker) Skipped.
+// Step 7 (sub-sub-frame) Worker failed to start and window messages "DidNotStart".
+// Step 8 (top-frame) Receive "DidNotStart" message and cleanup.
+
+async_test(t => {
+  // Step 1
+  const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+  cookie_set_window.onload =  t.step_func(_ => {
+    // Step 2
+    window.addEventListener("message", t.step_func(e => {
+      // Step 8
+      assert_equals(e.data, "DidNotStart", "Worker should not have started");
+      cookie_set_window.close();
+      t.done();
+    }));
+    let iframe = document.createElement("iframe");
+    iframe.src = "https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe.sub.html?type=all";
+    document.body.appendChild(iframe);
+  });
+}, "Check SharedWorker sameSiteCookies option all for third-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/third-party.default.tentative.sub.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/third-party.default.tentative.sub.https.window.js
new file mode 100644
index 000000000000..bf499c1992c9
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/third-party.default.tentative.sub.https.window.js
@@ -0,0 +1,34 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (top-frame) Set up listener for cookie message and open cross-site iframe.
+// Step 3 (sub-frame) Open iframe same-site to top-frame.
+// Step 4 (sub-sub-frame) Set up listener for message and start worker.
+// Step 5 (redirect) Redirect to worker script.
+// Step 6 (worker) Send cookie message to iframe.
+// Step 7 (sub-sub-frame) Receive message and pass on to window.
+// Step 8 (top-frame) Receive cookie message and cleanup.
+
+async_test(t => {
+  // Step 1
+  const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+  cookie_set_window.onload =  t.step_func(_ => {
+    // Step 2
+    window.addEventListener("message", t.step_func(e => {
+      // Step 8
+      getCookieNames().then(t.step_func((cookies) => {
+        assert_equals(e.data + cookies, "ReadOnLoad:None,ReadOnFetch:None,SetOnRedirectLoad:None,SetOnLoad:None,SetOnRedirectFetch:None,SetOnFetch:None", "Worker should get/set SameSite=None cookies only");
+        cookie_set_window.close();
+        t.done();
+      }));
+    }));
+    let iframe = document.createElement("iframe");
+    iframe.src = "https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe.sub.html?type=default";
+    document.body.appendChild(iframe);
+  });
+}, "Check SharedWorker sameSiteCookies option default for third-party");
diff --git a/test/fixtures/wpt/workers/same-site-cookies/third-party.none.tentative.sub.https.window.js b/test/fixtures/wpt/workers/same-site-cookies/third-party.none.tentative.sub.https.window.js
new file mode 100644
index 000000000000..f00e585f7783
--- /dev/null
+++ b/test/fixtures/wpt/workers/same-site-cookies/third-party.none.tentative.sub.https.window.js
@@ -0,0 +1,34 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+// META: script=/workers/same-site-cookies/resources/util.js
+
+'use strict';
+
+// Here's the set-up for this test:
+// Step 1 (window) Set cookies.
+// Step 2 (top-frame) Set up listener for cookie message and open cross-site iframe.
+// Step 3 (sub-frame) Open iframe same-site to top-frame.
+// Step 4 (sub-sub-frame) Set up listener for message and start worker.
+// Step 5 (redirect) Redirect to worker script.
+// Step 6 (worker) Send cookie message to iframe.
+// Step 7 (sub-sub-frame) Receive message and pass on to window.
+// Step 8 (top-frame) Receive cookie message and cleanup.
+
+async_test(t => {
+  // Step 1
+  const cookie_set_window = window.open("/workers/same-site-cookies/resources/set_cookies.py");
+  cookie_set_window.onload =  t.step_func(_ => {
+    // Step 2
+    window.addEventListener("message", t.step_func(e => {
+      // Step 8
+      getCookieNames().then(t.step_func((cookies) => {
+        assert_equals(e.data + cookies, "ReadOnLoad:None,ReadOnFetch:None,SetOnRedirectLoad:None,SetOnLoad:None,SetOnRedirectFetch:None,SetOnFetch:None", "Worker should get/set SameSite=None cookies only");
+        cookie_set_window.close();
+        t.done();
+      }));
+    }));
+    let iframe = document.createElement("iframe");
+    iframe.src = "https://{{hosts[alt][]}}:{{ports[https][0]}}/workers/same-site-cookies/resources/iframe.sub.html?type=none";
+    document.body.appendChild(iframe);
+  });
+}, "Check SharedWorker sameSiteCookies option none for third-party");
diff --git a/test/fixtures/wpt/workers/semantics/encodings/001.html b/test/fixtures/wpt/workers/semantics/encodings/001.html
new file mode 100644
index 000000000000..05ee5e006b45
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/001.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>encoding, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '\u00e5');
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/001.js b/test/fixtures/wpt/workers/semantics/encodings/001.js
new file mode 100644
index 000000000000..03bc557c33c4
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/001.js
@@ -0,0 +1 @@
+postMessage('å');
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/001.js.headers b/test/fixtures/wpt/workers/semantics/encodings/001.js.headers
new file mode 100644
index 000000000000..5614aaa7f0f5
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/001.js.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=windows-1252
diff --git a/test/fixtures/wpt/workers/semantics/encodings/002.html b/test/fixtures/wpt/workers/semantics/encodings/002.html
new file mode 100644
index 000000000000..fecbffc18da7
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/002.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>encoding, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new SharedWorker('002.js', '');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '\u00e5');
+    this.done();
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/encodings/002.js b/test/fixtures/wpt/workers/semantics/encodings/002.js
new file mode 100644
index 000000000000..9dde7bbda921
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/002.js
@@ -0,0 +1,3 @@
+onconnect = function(e) {
+  e.ports[0].postMessage('å');
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/002.js.headers b/test/fixtures/wpt/workers/semantics/encodings/002.js.headers
new file mode 100644
index 000000000000..5614aaa7f0f5
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/002.js.headers
@@ -0,0 +1 @@
+Content-Type: text/javascript; charset=windows-1252
diff --git a/test/fixtures/wpt/workers/semantics/encodings/003.html b/test/fixtures/wpt/workers/semantics/encodings/003.html
new file mode 100644
index 000000000000..095320e4d147
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/003.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>URL encoding, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('003.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/003.js b/test/fixtures/wpt/workers/semantics/encodings/003.js
new file mode 100644
index 000000000000..35bda8bba88b
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/003.js
@@ -0,0 +1,5 @@
+var xhr = new XMLHttpRequest();
+xhr.open('GET', '003-1.py?x=å', false);
+xhr.send();
+var passed = xhr.responseText == 'PASS';
+postMessage(passed);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/004.html b/test/fixtures/wpt/workers/semantics/encodings/004.html
new file mode 100644
index 000000000000..cd556b8190e7
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/004.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>URL encoding, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new SharedWorker('004.js');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/004.js b/test/fixtures/wpt/workers/semantics/encodings/004.js
new file mode 100644
index 000000000000..5146929a73b5
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/004.js
@@ -0,0 +1,7 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  xhr.open('GET', '003-1.py?x=å', false);
+  xhr.send();
+  var passed = xhr.responseText == 'PASS';
+  e.ports[0].postMessage(passed);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/encodings/004.worker.js b/test/fixtures/wpt/workers/semantics/encodings/004.worker.js
new file mode 100644
index 000000000000..28489a572be1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/004.worker.js
@@ -0,0 +1,5 @@
+importScripts("/resources/testharness.js");
+test(function() {
+  assert_equals("�", "\ufffd");
+}, "Decoding invalid utf-8");
+done();
diff --git a/test/fixtures/wpt/workers/semantics/encodings/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/encodings/WEB_FEATURES.yml
new file mode 100644
index 000000000000..082be9e2a20c
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/encodings/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- 002.html: [shared-workers]
+- 004.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/001.worker.js b/test/fixtures/wpt/workers/semantics/interface-objects/001.worker.js
new file mode 100644
index 000000000000..a95da5638f52
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/001.worker.js
@@ -0,0 +1,82 @@
+importScripts("/resources/testharness.js");
+var expected = [
+  // https://html.spec.whatwg.org/
+  "WorkerGlobalScope",
+  "DedicatedWorkerGlobalScope",
+  "Worker",
+  "MessagePort",
+  "MessageEvent",
+  "WorkerNavigator",
+  "MessageChannel",
+  "WorkerLocation",
+  "ImageData",
+  "ImageBitmap",
+  "CanvasGradient",
+  "CanvasPattern",
+  "TextMetrics",
+  "Path2D",
+  "PromiseRejectionEvent",
+  "EventSource",
+  "BroadcastChannel",
+  // https://websockets.spec.whatwg.org/
+  "WebSocket",
+  "CloseEvent",
+  // https://tc39.github.io/ecma262/
+  "ArrayBuffer",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float16Array",
+  "Float32Array",
+  "Float64Array",
+  "DataView",
+  // https://xhr.spec.whatwg.org/
+  "XMLHttpRequestEventTarget",
+  "XMLHttpRequestUpload",
+  "XMLHttpRequest",
+  "ProgressEvent",
+  "FormData",
+  // https://url.spec.whatwg.org/
+  "URL",
+  "URLSearchParams",
+  // https://w3c.github.io/FileAPI/
+  "File",
+  "Blob",
+  "FileList",
+  "FileReader",
+  "FileReaderSync",
+  // https://dom.spec.whatwg.org/
+  "EventTarget",
+  "ErrorEvent",
+  "Event",
+  "CustomEvent",
+  // https://webidl.spec.whatwg.org/
+  "DOMException",
+  // https://streams.spec.whatwg.org/
+  "ReadableStream",
+  "WritableStream",
+  "ByteLengthQueuingStrategy",
+  "CountQueuingStrategy",
+  // http://w3c.github.io/IndexedDB/
+  "IDBRequest",
+  "IDBOpenDBRequest",
+  "IDBVersionChangeEvent",
+  "IDBFactory",
+  "IDBDatabase",
+  "IDBObjectStore",
+  "IDBIndex",
+  "IDBKeyRange",
+  "IDBCursor",
+  "IDBCursorWithValue",
+  "IDBTransaction",
+];
+for (var i = 0; i < expected.length; ++i) {
+  test(function () {
+    assert_own_property(self, expected[i]);
+  }, "The " + expected[i] + " interface object should be exposed.");
+}
+done();
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/002.worker.js b/test/fixtures/wpt/workers/semantics/interface-objects/002.worker.js
new file mode 100644
index 000000000000..9c8dc6746e07
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/002.worker.js
@@ -0,0 +1,45 @@
+importScripts("/resources/testharness.js");
+var unexpected = [
+  // https://html.spec.whatwg.org/
+  "SharedWorker",
+  "CanvasPath",
+  "SharedWorkerGlobalScope",
+  "AbstractView",
+  "AbstractWorker",
+  "ApplicationCache",
+  "Location",
+  "Navigator",
+  "Audio",
+  "HTMLCanvasElement",
+  "Path",
+  "CanvasProxy",
+  "CanvasRenderingContext2D",
+  "DrawingStyle",
+  "BeforeUnloadEvent",
+  "PopStateEvent",
+  "HashChangeEvent",
+  "PageTransitionEvent",
+  // https://dom.spec.whatwg.org/
+  "DOMImplementation",
+  // http://w3c.github.io/IndexedDB/
+  "IDBEnvironment",
+  // https://www.w3.org/TR/2010/NOTE-webdatabase-20101118/
+  "Database",
+  // https://w3c.github.io/uievents/
+  "UIEvent",
+  "FocusEvent",
+  "MouseEvent",
+  "WheelEvent",
+  "InputEvent",
+  "KeyboardEvent",
+  "CompositionEvent",
+  // https://w3c.github.io/webvtt/
+  "VTTCue",
+  "VTTRegion",
+];
+for (var i = 0; i < unexpected.length; ++i) {
+  test(function () {
+    assert_false(unexpected[i] in self);
+  }, "The " + unexpected[i] + " interface object should not be exposed.");
+}
+done();
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/003.any.js b/test/fixtures/wpt/workers/semantics/interface-objects/003.any.js
new file mode 100644
index 000000000000..9dcc024ab7b3
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/003.any.js
@@ -0,0 +1,82 @@
+// META: global=sharedworker
+
+var expected = [
+  // https://html.spec.whatwg.org/
+  "WorkerGlobalScope",
+  "SharedWorkerGlobalScope",
+  "Worker",
+  "MessagePort",
+  "MessageEvent",
+  "WorkerNavigator",
+  "MessageChannel",
+  "WorkerLocation",
+  "ImageData",
+  "ImageBitmap",
+  "CanvasGradient",
+  "CanvasPattern",
+  "Path2D",
+  "PromiseRejectionEvent",
+  "EventSource",
+  "BroadcastChannel",
+  // https://websockets.spec.whatwg.org/
+  "WebSocket",
+  "CloseEvent",
+  // https://tc39.github.io/ecma262/
+  "ArrayBuffer",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float16Array",
+  "Float32Array",
+  "Float64Array",
+  "DataView",
+  // https://xhr.spec.whatwg.org/
+  "XMLHttpRequestEventTarget",
+  "XMLHttpRequestUpload",
+  "XMLHttpRequest",
+  "ProgressEvent",
+  "FormData",
+  // https://url.spec.whatwg.org/
+  "URL",
+  "URLSearchParams",
+  // https://w3c.github.io/FileAPI/
+  "File",
+  "Blob",
+  "FileList",
+  "FileReader",
+  "FileReaderSync",
+  // https://dom.spec.whatwg.org/
+  "EventTarget",
+  "ErrorEvent",
+  "Event",
+  "CustomEvent",
+  // https://webidl.spec.whatwg.org/
+  "DOMException",
+  // https://streams.spec.whatwg.org/
+  "ReadableStream",
+  "WritableStream",
+  "ByteLengthQueuingStrategy",
+  "CountQueuingStrategy",
+  // http://w3c.github.io/IndexedDB/
+  "IDBRequest",
+  "IDBOpenDBRequest",
+  "IDBVersionChangeEvent",
+  "IDBFactory",
+  "IDBDatabase",
+  "IDBObjectStore",
+  "IDBIndex",
+  "IDBKeyRange",
+  "IDBCursor",
+  "IDBCursorWithValue",
+  "IDBTransaction",
+];
+
+for (var i = 0; i < expected.length; ++i) {
+  test(function() {
+    assert_true(expected[i] in self);
+  }, "The " + expected[i] + " interface object should be exposed");
+}
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/004.any.js b/test/fixtures/wpt/workers/semantics/interface-objects/004.any.js
new file mode 100644
index 000000000000..1b0b93b5df0f
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/004.any.js
@@ -0,0 +1,41 @@
+// META: global=sharedworker
+
+var unexpected = [
+  // https://html.spec.whatwg.org/
+  "ApplicationCache",
+  "SharedWorker",
+  "CanvasPath",
+  "DedicatedWorkerGlobalScope",
+  "AbstractView",
+  "AbstractWorker",
+  "Location",
+  "Navigator",
+  "DOMImplementation",
+  "Audio",
+  "HTMLCanvasElement",
+  "Path",
+  "CanvasProxy",
+  "CanvasRenderingContext2D",
+  "DrawingStyle",
+  "PopStateEvent",
+  "HashChangeEvent",
+  "PageTransitionEvent",
+  // http://w3c.github.io/IndexedDB/
+  "IDBEnvironment",
+  // https://www.w3.org/TR/2010/NOTE-webdatabase-20101118/
+  "Database",
+  // https://w3c.github.io/uievents/
+  "UIEvent",
+  "FocusEvent",
+  "MouseEvent",
+  "WheelEvent",
+  "InputEvent",
+  "KeyboardEvent",
+  "CompositionEvent",
+];
+
+for (var i = 0; i < unexpected.length; ++i) {
+  test(function() {
+    assert_false(unexpected[i] in self);
+  }, "The " + unexpected[i] + " interface object should not be exposed");
+}
diff --git a/test/fixtures/wpt/workers/semantics/interface-objects/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/interface-objects/WEB_FEATURES.yml
new file mode 100644
index 000000000000..601723d1a665
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/interface-objects/WEB_FEATURES.yml
@@ -0,0 +1,7 @@
+rules:
+# These "any.js" tests are limited to the SharedWorker context via the "META"
+# configuration.
+- 003.any.js: [shared-workers]
+- 004.any.js: [shared-workers]
+- 001.worker.js: [dedicated-workers]
+- 002.worker.js: [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/001.html b/test/fixtures/wpt/workers/semantics/multiple-workers/001.html
new file mode 100644
index 000000000000..f9e2bbeabab1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/001.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<title>dedicated and shared worker in same page</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'dedicated');
+    this.done();
+  });
+  worker.postMessage('dedicated');
+}, 'dedicated');
+async_test(function() {
+  var shared = new SharedWorker('001.js', '');
+  shared.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 'shared');
+    this.done();
+  });
+  shared.port.postMessage('shared');
+}, 'shared');
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/001.js b/test/fixtures/wpt/workers/semantics/multiple-workers/001.js
new file mode 100644
index 000000000000..6d51169dea0e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/001.js
@@ -0,0 +1,11 @@
+if ('onmessage' in self) { // dedicated worker
+  onmessage = function(e) {
+    postMessage(e.data);
+  }
+} else { // shared worker
+  onconnect = function(e) {
+    e.ports[0].onmessage = function(e) {
+      this.postMessage(e.data);
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/002.html b/test/fixtures/wpt/workers/semantics/multiple-workers/002.html
new file mode 100644
index 000000000000..aa01e361d806
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/002.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>creating 3 sibling dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  var w1 = new Worker('002.js');
+  var w2 = new Worker('002.js');
+  var w3 = new Worker('002.js');
+  var got = [false, false, false];
+  var check_done = t.step_func(function() {
+                       if (got.every(function(x) {return x})) {
+                           t.done();
+                       }
+                   });
+  w1.onmessage = t.step_func(function(e) {got[0] = true; check_done()});
+  w2.onmessage = t.step_func(function(e) {got[1] = true; check_done()});
+  w3.onmessage = t.step_func(function(e) {got[2] = true; check_done()});
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/002.js b/test/fixtures/wpt/workers/semantics/multiple-workers/002.js
new file mode 100644
index 000000000000..2318c2e267db
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/002.js
@@ -0,0 +1 @@
+postMessage(1);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/003.html b/test/fixtures/wpt/workers/semantics/multiple-workers/003.html
new file mode 100644
index 000000000000..f6e03c75f782
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/003.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>creating 3 nested dedicated workers</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var w1 = new Worker('003.js#1');
+  w1.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '123');
+    this.done();
+  });
+  w1.onerror = this.unreached_func("error");
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/003.js b/test/fixtures/wpt/workers/semantics/multiple-workers/003.js
new file mode 100644
index 000000000000..14a5a614b3d8
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/003.js
@@ -0,0 +1,13 @@
+if (location.hash == '#1') {
+  var w2 = new Worker('003.js#2');
+  w2.onmessage = function(e) {
+    postMessage('1'+e.data);
+  }
+} else if (location.hash == '#2') {
+  var w3 = new Worker('003.js#3');
+  w3.onmessage = function(e) {
+    postMessage('2'+e.data);
+  }
+} else {
+  postMessage('3');
+}
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/004-1.html b/test/fixtures/wpt/workers/semantics/multiple-workers/004-1.html
new file mode 100644
index 000000000000..eac038c5beef
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/004-1.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<title></title>
+<script>
+window.onload = function() {
+  var w=new SharedWorker('004-2.js', 'x');
+};
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/004-2.js b/test/fixtures/wpt/workers/semantics/multiple-workers/004-2.js
new file mode 100644
index 000000000000..e59cd6927e34
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/004-2.js
@@ -0,0 +1,6 @@
+var port;
+onconnect = function(e) {
+  if (!port)
+    port = e.ports[0];
+  port.postMessage(1);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/004.html b/test/fixtures/wpt/workers/semantics/multiple-workers/004.html
new file mode 100644
index 000000000000..552cc8a63340
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/004.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<title>shared worker with multiple documents</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({ single_test: true });
+
+var i = 0;
+var load_count = 0;
+
+var w1 = new SharedWorker('004-2.js', 'x');
+w1.port.onmessage = function(e) {
+  i++;
+  check_result();
+};
+
+
+function iframe_loaded() {
+  load_count++;
+  check_result();
+}
+
+function check_result() {
+  //timeout to allow for extra, unexpected, messages to arrive
+  if (i == 3 && load_count == 2) {
+    setTimeout(function() {
+      assert_equals(load_count, 2);
+      assert_equals(i, 3);
+      done();
+    }, 500);
+  }
+}
+</script>
+<iframe src=004-1.html onload="iframe_loaded()"></iframe>
+<iframe src=004-1.html onload="iframe_loaded()"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/008-1.html b/test/fixtures/wpt/workers/semantics/multiple-workers/008-1.html
new file mode 100644
index 000000000000..d19d7fa3369a
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/008-1.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<title>008-1</title>
+<script>
+var w1 = new SharedWorker('008.js');
+w1.port.onmessage = function(e) {
+  e.ports[0].postMessage(2);
+}
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/008.html b/test/fixtures/wpt/workers/semantics/multiple-workers/008.html
new file mode 100644
index 000000000000..ee38d80866e8
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/008.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<title>messagechannel in shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<iframe src=008-1.html></iframe>
+<script>
+var t = async_test();
+onload = t.step_func(function() {
+  var w1 = new SharedWorker('008.js');
+  w1.port.onmessage = this.step_func(function(e) {
+    e.ports[0].onmessage = this.step_func(function(e) {
+      assert_equals(e.data, 2);
+      this.done();
+    });
+  });
+  w1.onerror = this.unreached_func("error");
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/008.js b/test/fixtures/wpt/workers/semantics/multiple-workers/008.js
new file mode 100644
index 000000000000..92593ebb865f
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/008.js
@@ -0,0 +1,6 @@
+var channel = new MessageChannel();
+var i = 0;
+onconnect = function(e) {
+  i++;
+  e.ports[0].postMessage(1, [channel['port' + i]]);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/multiple-workers/WEB_FEATURES.yml
new file mode 100644
index 000000000000..e3386cc09310
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/WEB_FEATURES.yml
@@ -0,0 +1,4 @@
+rules:
+- 004.html: [shared-workers]
+- 008.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/multiple-workers/exposure.any.js b/test/fixtures/wpt/workers/semantics/multiple-workers/exposure.any.js
new file mode 100644
index 000000000000..7e226a7333fb
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/multiple-workers/exposure.any.js
@@ -0,0 +1,11 @@
+// META: global=window,worker
+
+test(() => {
+  const assert = "ServiceWorkerGlobalScope" in globalThis ? assert_equals : assert_not_equals;
+  assert(globalThis.Worker, undefined);
+}, "Worker exposure");
+
+test(() => {
+  const assert = globalThis.GLOBAL.isWindow() ? assert_not_equals : assert_equals;
+  assert(globalThis.SharedWorker, undefined);
+}, "SharedWorker exposure");
diff --git a/test/fixtures/wpt/workers/semantics/navigation/001-1.html b/test/fixtures/wpt/workers/semantics/navigation/001-1.html
new file mode 100644
index 000000000000..c259c2c839f8
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/001-1.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>001-1</title>
+<script>
+onload = function() {
+  var worker = new Worker('001-1.js');
+  worker.onmessage = function(e) {
+    var started = !!parent.date;
+    parent.date = e.data;
+    if (!started) {
+      parent.start_test()
+    }
+  }
+}
+</script>
+<a href='data:text/html,<title>foo</title><script>onload=function(){window.parent.postMessage({title: window.document.title}, "*")}</script>'>link</a>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/navigation/001-1.js b/test/fixtures/wpt/workers/semantics/navigation/001-1.js
new file mode 100644
index 000000000000..f62c365e3221
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/001-1.js
@@ -0,0 +1 @@
+setInterval(function() { postMessage(new Date()) }, 10)
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/navigation/001.html b/test/fixtures/wpt/workers/semantics/navigation/001.html
new file mode 100644
index 000000000000..f31c2590e58e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/001.html
@@ -0,0 +1,39 @@
+<!--
+
+/*
+-->
+<!doctype html>
+<title>navigating</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({ single_test: true });
+var date;
+var newDate;
+</script>
+<iframe></iframe>
+<script>
+var iframe = document.querySelector('iframe');
+onload = function() {
+  iframe.src = "001-1.html?" + Math.random();
+};
+var start_test = function() {
+  window[0].document.links[0].click();
+};
+var after_load = function(event) {
+  history.back();
+  newDate = new Date();
+  setTimeout(function() {
+    assert_greater_than(Number(date), Number(newDate));
+    assert_equals(window[0].document.title, '001-1');
+    window.removeEventListener("message", after_load);
+    done();
+  }, 2000);
+};
+window.addEventListener("message", after_load);
+</script>
+<!--
+*/
+//-->
+
diff --git a/test/fixtures/wpt/workers/semantics/navigation/002.html b/test/fixtures/wpt/workers/semantics/navigation/002.html
new file mode 100644
index 000000000000..8ea98ef2d44a
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/002.html
@@ -0,0 +1,38 @@
+<!--
+
+/*
+-->
+<!doctype html>
+<title>navigating 2</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var date;
+var newDate;
+</script>
+<iframe></iframe>
+<script>
+var t = async_test();
+var iframe = document.querySelector('iframe');
+onload = t.step_func(function() {
+  iframe.src = "001-1.html?" + Math.random();
+});
+var start_test = t.step_func(function() {
+  window[0].document.links[0].click();
+});
+var after_load = t.step_func(function(event) {
+  newDate = new Date();
+  setTimeout(this.step_func(function() {
+    assert_less_than(Number(date), Number(newDate));
+    assert_equals(event.data.title, 'foo');
+    window.removeEventListener("message", after_load);
+    this.done();
+  }), 500);
+});
+window.addEventListener("message", after_load);
+</script>
+<!--
+*/
+//-->
+
diff --git a/test/fixtures/wpt/workers/semantics/navigation/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/navigation/WEB_FEATURES.yml
new file mode 100644
index 000000000000..b16862ba1c01
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/navigation/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/001.html b/test/fixtures/wpt/workers/semantics/reporting-errors/001.html
new file mode 100644
index 000000000000..d8b17289fe24
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/001.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>shared worker, not handled</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('001.js', '');
+  worker.port.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/001.js b/test/fixtures/wpt/workers/semantics/reporting-errors/001.js
new file mode 100644
index 000000000000..5736666cc3b6
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/001.js
@@ -0,0 +1,28 @@
+var port;
+var timeout;
+onerror = function(a,b,c,d,e) {
+  // will return undefined, thus the error is "not handled"
+  // so error should be reported to the user, but this test doesn't check
+  // that.
+  // just make sure that this method is invoked with five arguments
+  clearTimeout(timeout);
+  var log = '';
+  if (arguments.length != 5)
+    log += 'got ' + arguments.length + ' arguments, expected 5. ';
+  if (typeof a != 'string')
+    log += 'first argument wasn\'t a string. ';
+  if (b != location.href)
+    log += 'second argument was ' + b + ', expected ' + location.href + '. ';
+  if (typeof c != 'number')
+    log += 'third argument wasn\'t a number. ';
+  if (typeof d != 'number')
+    log += 'fourth argument wasn\'t a number. ';
+  if (e != 42)
+    log += 'fifth argument wasn\'t the thrown exception. ';
+  port.postMessage(log);
+}
+onconnect = function (e) {
+  port = e.ports[0];
+  timeout = setTimeout(function() { port.postMessage('self.onerror was not invoked'); }, 250);
+  throw 42; // will "report the error"
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/002.html b/test/fixtures/wpt/workers/semantics/reporting-errors/002.html
new file mode 100644
index 000000000000..4b322a5f07d1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/002.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<title>shared worker, addEventListener</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('002.js', '');
+  worker.port.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/002.js b/test/fixtures/wpt/workers/semantics/reporting-errors/002.js
new file mode 100644
index 000000000000..ff96922634ff
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/002.js
@@ -0,0 +1,34 @@
+var port;
+var timeout;
+addEventListener('error', function(e) {
+  // event is not canceled, thus the error is "not handled"
+  // so error should be reported to the user, but this test doesn't check
+  // that.
+  // just make sure that this event has the right properties
+  clearTimeout(timeout);
+  var log = '';
+  if (!self.ErrorEvent || Object.getPrototypeOf(e) != ErrorEvent.prototype)
+    log += 'event should be an ErrorEvent. ';
+  if (e.bubbles)
+    log += 'event should not bubble. ';
+  if (!e.cancelable)
+    log += 'event should be cancelable. ';
+  if (!e.isTrusted)
+    log += 'event should be trusted. ';
+  if (typeof e.message != 'string')
+    log += 'message wasn\'t a string. ';
+  if (e.filename != location.href)
+    log += 'filename was ' + e.filename + ', expected ' + location.href + '. ';
+  if (typeof e.lineno != 'number')
+    log += 'lineno wasn\'t a number. ';
+  if (typeof e.colno != 'number')
+    log += 'colno argument wasn\'t a number. ';
+  if (e.error != 42)
+    log += 'fifth argument wasn\'t the thrown exception. ';
+  port.postMessage(log);
+}, false);
+onconnect = function (e) {
+  port = e.ports[0];
+  timeout = setTimeout(function() { port.postMessage('No error event fired'); }, 250);
+  throw 42; // will "report the error"
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/003.html b/test/fixtures/wpt/workers/semantics/reporting-errors/003.html
new file mode 100644
index 000000000000..8ea59b810616
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/003.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<title>shared worker, no error event on worker or port</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('003.js', '');
+  worker.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('error on worker');
+  }), false);
+  worker.port.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('error on port');
+  }), false);
+  worker.port.onmessage = this.step_func_done(function(e) {
+    assert_equals(e.data, '');
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/003.js b/test/fixtures/wpt/workers/semantics/reporting-errors/003.js
new file mode 100644
index 000000000000..8a3390bb2490
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/003.js
@@ -0,0 +1,8 @@
+onconnect = function (e) {
+  setTimeout(function() { e.ports[0].postMessage(''); }, 250);
+  y(); // will "report the error"
+  // onerror is null so it'll be "not handled", and the error should be
+  // reported to the user, although we don't test that here
+  // make sure we don't fire an error event on the message port or the
+  // SharedWorker object
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/004-1.html b/test/fixtures/wpt/workers/semantics/reporting-errors/004-1.html
new file mode 100644
index 000000000000..326e1399ec5f
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/004-1.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<script>
+parent.t.step(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('(inner) window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('004.js', '');
+  worker.addEventListener('error', this.step_func(function(e) {
+    parent.assert_unreached('(inner) error on worker');
+  }), false);
+  worker.port.addEventListener('error', this.step_func(function(e) {
+    parent.assert_unreached('(inner) error on port');
+  }), false);
+  worker.port.onmessage = this.step_func_done(function(e) {
+    parent.assert_equals(e.data, 2);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/004.html b/test/fixtures/wpt/workers/semantics/reporting-errors/004.html
new file mode 100644
index 000000000000..8516e52c6fe2
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/004.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<title>shared worker in two documents and window.onerror</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+setup({allow_uncaught_exception:true});
+var t = async_test(function() {
+  window.onerror = this.step_func(function(a) {
+    assert_unreached('(outer) window.onerror invoked: ' + a);
+  });
+  var worker = new SharedWorker('004.js', '');
+  worker.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('(outer) error on worker');
+  }), false);
+  worker.port.addEventListener('error', this.step_func(function(e) {
+    assert_unreached('(outer) error on port');
+  }), false);
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, 1);
+    var iframe = document.createElement('iframe');
+    iframe.src = '004-1.html';
+    document.body.appendChild(iframe);
+  });
+});
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/004.js b/test/fixtures/wpt/workers/semantics/reporting-errors/004.js
new file mode 100644
index 000000000000..a68d2ab01def
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/004.js
@@ -0,0 +1,6 @@
+var i = 0;
+onconnect = function (e) {
+  i++;
+  setTimeout(function() { e.ports[0].postMessage(i); }, 250);
+  y(); // will "report the error"
+}
diff --git a/test/fixtures/wpt/workers/semantics/reporting-errors/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/reporting-errors/WEB_FEATURES.yml
new file mode 100644
index 000000000000..73744331853b
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/reporting-errors/WEB_FEATURES.yml
@@ -0,0 +1,2 @@
+rules:
+- "**": [shared-workers]
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/001.html b/test/fixtures/wpt/workers/semantics/run-a-worker/001.html
new file mode 100644
index 000000000000..71e48c277114
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/001.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>worker global scope, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/001.js b/test/fixtures/wpt/workers/semantics/run-a-worker/001.js
new file mode 100644
index 000000000000..33ed47f1b442
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/001.js
@@ -0,0 +1 @@
+postMessage(this === self);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/002.html b/test/fixtures/wpt/workers/semantics/run-a-worker/002.html
new file mode 100644
index 000000000000..9487d886a67d
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/002.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<title>worker global scope, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+async_test(function() {
+  var worker = new SharedWorker('002.js');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+});
+</script>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/002.js b/test/fixtures/wpt/workers/semantics/run-a-worker/002.js
new file mode 100644
index 000000000000..627272aaefa3
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/002.js
@@ -0,0 +1,4 @@
+var passed = this === self;
+onconnect = function(e) {
+  e.ports[0].postMessage(passed);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/003.html b/test/fixtures/wpt/workers/semantics/run-a-worker/003.html
new file mode 100644
index 000000000000..e96c176f20ab
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/003.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<title>handling for 404 response</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  const worker = new Worker('404_worker');
+  worker.onerror = e => t.done();
+}, 'worker');
+
+async_test(t => {
+  const shared = new SharedWorker('404_shared');
+  shared.onerror = e => t.done();
+}, 'shared');
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/run-a-worker/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/run-a-worker/WEB_FEATURES.yml
new file mode 100644
index 000000000000..fb5bc3756c1e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/run-a-worker/WEB_FEATURES.yml
@@ -0,0 +1,3 @@
+rules:
+- 002.html: [shared-workers]
+- "*": [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/structured-clone/dedicated.html b/test/fixtures/wpt/workers/semantics/structured-clone/dedicated.html
new file mode 100644
index 000000000000..16b6be56f147
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/structured-clone/dedicated.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<title>structured clone to dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src=/common/sab.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-with-transferables.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-harness.js></script>
+<div id=log></div>
+<script>
+  runStructuredCloneBatteryOfTests({
+    setup() {
+      const blob = new Blob([`
+        onmessage = ev => postMessage(ev.data, ev.data.transfer);
+      `], {type: 'text/javascript'});
+      this.blobURL = URL.createObjectURL(blob);
+      this.worker = new Worker(this.blobURL);
+    },
+    structuredClone(data, transfer) {
+      return new Promise(resolve => {
+        this.worker.addEventListener('message', function f(ev) {
+          this.worker.removeEventListener('message', f);
+          resolve(ev.data.data);
+        }.bind(this));
+        this.worker.postMessage({data, transfer}, transfer);
+      });
+    },
+    teardown() {
+      this.worker.terminate();
+      URL.revokeObjectURL(this.blobURL);
+    }
+  });
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/structured-clone/shared.html b/test/fixtures/wpt/workers/semantics/structured-clone/shared.html
new file mode 100644
index 000000000000..eb85499fe283
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/structured-clone/shared.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<title>structured clone to shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src=/common/sab.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-with-transferables.js></script>
+<script src=/html/webappapis/structured-clone/structured-clone-battery-of-tests-harness.js></script>
+<div id=log></div>
+<script>
+  runStructuredCloneBatteryOfTests({
+    setup() {
+      const blob = new Blob([`
+        onconnect = ev => {
+          const port = ev.ports[0];
+          port.onmessage = ev => port.postMessage(ev.data, ev.data.transfer);
+        };
+      `], {type: 'text/javascript'});
+      this.blobURL = URL.createObjectURL(blob);
+      this.worker = new SharedWorker(this.blobURL);
+      this.port = this.worker.port;
+    },
+    structuredClone(data, transfer) {
+      return new Promise(resolve => {
+        this.port.addEventListener('message', function f(ev) {
+          this.port.removeEventListener('message', f);
+          resolve(ev.data.data);
+        }.bind(this));
+        this.port.start();
+        this.port.postMessage({data, transfer}, transfer);
+      });
+    },
+    teardown() {
+      URL.revokeObjectURL(this.blobURL);
+    }
+  });
+</script>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/001-1.xml b/test/fixtures/wpt/workers/semantics/xhr/001-1.xml
new file mode 100644
index 000000000000..5d735bdf6199
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/001-1.xml
@@ -0,0 +1 @@
+<x>foo</x>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/001.html b/test/fixtures/wpt/workers/semantics/xhr/001.html
new file mode 100644
index 000000000000..da59f5ac2d16
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/001.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>async XMLHttpRequest in dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new Worker('001.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/001.js b/test/fixtures/wpt/workers/semantics/xhr/001.js
new file mode 100644
index 000000000000..1cbe98ba470b
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/001.js
@@ -0,0 +1,13 @@
+var xhr = new XMLHttpRequest();
+var log = '';
+xhr.onreadystatechange = function(e) {
+  if (this.readyState == 4) {
+    if (this.responseXML != null)
+      log += 'responseXML was not null. ';
+    if (this.responseText != '<x>foo</x>')
+      log += 'responseText was ' + this.responseText + ', expected <x>foo</x>. ';
+    postMessage(log);
+  }
+}
+xhr.open('GET', '001-1.xml', true);
+xhr.send();
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/002.html b/test/fixtures/wpt/workers/semantics/xhr/002.html
new file mode 100644
index 000000000000..60c0e161cc8e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/002.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>sync XMLHttpRequest in dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new Worker('002.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/002.js b/test/fixtures/wpt/workers/semantics/xhr/002.js
new file mode 100644
index 000000000000..68d7e91d451e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/002.js
@@ -0,0 +1,9 @@
+var xhr = new XMLHttpRequest();
+var log = '';
+xhr.open('GET', '001-1.xml', false);
+xhr.send();
+if (xhr.responseXML != null)
+  log += 'responseXML was not null. ';
+if (xhr.responseText != '<x>foo</x>')
+  log += 'responseText was ' + this.responseText + ', expected <x>foo</x>. ';
+postMessage(log);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/003.html b/test/fixtures/wpt/workers/semantics/xhr/003.html
new file mode 100644
index 000000000000..e3ce36b82cfc
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/003.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>async XMLHttpRequest in shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new SharedWorker('003.js', '');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/003.js b/test/fixtures/wpt/workers/semantics/xhr/003.js
new file mode 100644
index 000000000000..1a9c5a7ee816
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/003.js
@@ -0,0 +1,17 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  var log = '';
+  var port = e.ports[0];
+  var postMessage = port.postMessage;
+  xhr.onreadystatechange = function(e) {
+    if (this.readyState == 4) {
+      if (this.responseXML != null)
+        log += 'responseXML was not null. ';
+      if (this.responseText && this.responseText != '<x>foo</x>')
+        log += 'responseText was ' + this.responseText + ', expected <x>foo</x>. ';
+      postMessage.call(port, log);
+    }
+  }
+  xhr.open('GET', '001-1.xml', true);
+  xhr.send();
+}
diff --git a/test/fixtures/wpt/workers/semantics/xhr/004.html b/test/fixtures/wpt/workers/semantics/xhr/004.html
new file mode 100644
index 000000000000..d11e3dbc1b92
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/004.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<title>sync XMLHttpRequest in shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+function runtest() {
+  var worker = new SharedWorker('004.js', '');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_equals(e.data, '');
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/004.js b/test/fixtures/wpt/workers/semantics/xhr/004.js
new file mode 100644
index 000000000000..1741c8d36a0e
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/004.js
@@ -0,0 +1,11 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  var log = '';
+  xhr.open('GET', '001-1.xml', false);
+  xhr.send();
+  if (xhr.responseXML != null)
+    log += 'responseXML was not null. ';
+  if (xhr.responseText != '<x>foo</x>')
+    log += 'responseText was ' + xhr.responseText + ', expected <x>foo</x>. ';
+  e.ports[0].postMessage(log);
+}
diff --git a/test/fixtures/wpt/workers/semantics/xhr/005.html b/test/fixtures/wpt/workers/semantics/xhr/005.html
new file mode 100644
index 000000000000..84abdb0c4264
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/005.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>base url, dedicated worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+var i = 0;
+function runtest() {
+  i++;
+  if (i != 2)
+    return;
+  var worker = new Worker('support/005-1.js');
+  worker.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
+<iframe src=support/001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/006.html b/test/fixtures/wpt/workers/semantics/xhr/006.html
new file mode 100644
index 000000000000..7411b4baef3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/006.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>base url, shared worker</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+var t = async_test();
+var i = 0;
+function runtest() {
+  i++;
+  if (i != 2)
+    return;
+  var worker = new SharedWorker('support/006-1.js','');
+  worker.port.onmessage = this.step_func(function(e) {
+    assert_true(e.data);
+    this.done();
+  });
+}
+</script>
+<iframe src=001-1.xml onload="t.step(runtest);"></iframe>
+<iframe src=support/001-1.xml onload="t.step(runtest);"></iframe>
diff --git a/test/fixtures/wpt/workers/semantics/xhr/WEB_FEATURES.yml b/test/fixtures/wpt/workers/semantics/xhr/WEB_FEATURES.yml
new file mode 100644
index 000000000000..233f18fee3cf
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/WEB_FEATURES.yml
@@ -0,0 +1,7 @@
+rules:
+- 003.html: [shared-workers]
+- 004.html: [shared-workers]
+- 006.html: [shared-workers]
+- 001.html: [dedicated-workers]
+- 002.html: [dedicated-workers]
+- 005.html: [dedicated-workers]
diff --git a/test/fixtures/wpt/workers/semantics/xhr/support/001-1.xml b/test/fixtures/wpt/workers/semantics/xhr/support/001-1.xml
new file mode 100644
index 000000000000..ecea58a93574
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/support/001-1.xml
@@ -0,0 +1 @@
+<x>bar</x>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/support/005-1.js b/test/fixtures/wpt/workers/semantics/xhr/support/005-1.js
new file mode 100644
index 000000000000..45f6519a2104
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/support/005-1.js
@@ -0,0 +1,5 @@
+var xhr = new XMLHttpRequest();
+xhr.open('GET', '001-1.xml', false);
+xhr.send();
+var passed = xhr.responseText == '<x>bar</x>';
+postMessage(passed);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/semantics/xhr/support/006-1.js b/test/fixtures/wpt/workers/semantics/xhr/support/006-1.js
new file mode 100644
index 000000000000..d446781eb7c1
--- /dev/null
+++ b/test/fixtures/wpt/workers/semantics/xhr/support/006-1.js
@@ -0,0 +1,7 @@
+onconnect = function(e) {
+  var xhr = new XMLHttpRequest();
+  xhr.open('GET', '001-1.xml', false);
+  xhr.send();
+  var passed = xhr.responseText == '<x>bar</x>';
+  e.ports[0].postMessage(passed);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/shared-worker-from-blob-url.window.js b/test/fixtures/wpt/workers/shared-worker-from-blob-url.window.js
new file mode 100644
index 000000000000..d3c6d4fe47f2
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-from-blob-url.window.js
@@ -0,0 +1,73 @@
+function message_from_port(port) {
+  return new Promise(resolve => {
+    port.onmessage = e => resolve(e.data);
+  });
+}
+
+promise_test(async t => {
+  const run_result = 'worker_OK_';
+  const blob_contents =
+    'self.counter = 0; self.onconnect = e => {++self.counter;' +
+    'e.source.postMessage("' + run_result + '" + self.counter); };';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker1 = new SharedWorker(url);
+  const reply1 = await message_from_port(worker1.port);
+  assert_equals(reply1, run_result + '1');
+  const worker2 = new SharedWorker(url);
+  const reply2 = await message_from_port(worker2.port);
+  assert_equals(reply2, run_result + '2');
+}, 'Creating a shared worker from a blob URL works.');
+
+promise_test(async t => {
+  const run_result = 'worker_OK';
+  const blob_contents =
+    'self.onconnect = e => { e.source.postMessage("' + run_result + '"); };';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new SharedWorker(url);
+  URL.revokeObjectURL(url);
+
+  const reply = await message_from_port(worker.port);
+  assert_equals(reply, run_result);
+}, 'Creating a shared worker from a blob URL works immediately before revoking.');
+
+promise_test(async t => {
+  const run_result = 'worker_OK_';
+  const blob_contents =
+    'self.counter = 0; self.onconnect = e => {++self.counter;' +
+    'e.source.postMessage("' + run_result + '" + self.counter); };';
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker1 = new SharedWorker(url);
+  URL.revokeObjectURL(url);
+
+  const reply1 = await message_from_port(worker1.port);
+  assert_equals(reply1, run_result + '1');
+  const worker2 = new SharedWorker(url);
+  const reply2 = await message_from_port(worker2.port);
+  assert_equals(reply2, run_result + '2');
+}, 'Connecting to a shared worker on a revoked blob URL works.');
+
+promise_test(async t => {
+  const run_result = false;
+  const blob_contents = `
+let constructedRequest = false;
+try {
+  new Request("./file.js");
+  constructedRequest = true;
+} catch (e) {}
+self.onconnect = e => {
+  e.source.postMessage(constructedRequest);
+};
+`;
+  const blob = new Blob([blob_contents]);
+  const url = URL.createObjectURL(blob);
+
+  const worker = new SharedWorker(url);
+  const reply = await message_from_port(worker.port);
+  assert_equals(reply, run_result, "Should not be able to resolve request with relative file path in blob");
+}, 'Blob URLs should not resolve relative to document base URL.');
diff --git a/test/fixtures/wpt/workers/shared-worker-in-data-url-context.window.js b/test/fixtures/wpt/workers/shared-worker-in-data-url-context.window.js
new file mode 100644
index 000000000000..b768c815d08d
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-in-data-url-context.window.js
@@ -0,0 +1,65 @@
+// META: title=data URL shared worker in data URL context
+// META: script=/service-workers/service-worker/resources/test-helpers.sub.js
+const mimeType = 'application/javascript';
+
+// Tests creating a data URL shared worker in a data URL iframe.
+promise_test(async t => {
+  const nestedWorkerScriptURL =
+      new URL('/workers/support/post-message-on-load-worker.js', location.href);
+
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a shared worker from |nestedWorkerScriptURL|, but that should result in a
+  // failure. This is because the data URL iframe has an opaque origin, and
+  // script fetch is handled as a cross-origin request.
+  const frameCode = `
+      <script>
+      try {
+        const worker = new SharedWorker('${nestedWorkerScriptURL}');
+        worker.port.onmessage = e => {
+          window.parent.postMessage(
+              'SharedWorker construction unexpectedly succeeded', '*');
+        };
+        worker.onerror = e => window.parent.postMessage('PASS', '*');
+      } catch (e) {
+        // Cross-origin request should asynchronously fail during worker script
+        // fetch because its request mode is 'same-origin'.
+        window.parent.postMessage(
+            'SharedWorker construction unexpectedly synchronously failed', '*');
+      }
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a shared worker in a data url frame');
+
+// Tests creating a data URL shared worker in a data URL iframe.
+promise_test(async t => {
+  const workerCode = `onconnect = e => e.ports[0].postMessage("PASS");`;
+
+  // This code will be executed in a data URL iframe. The iframe tries to create
+  // a data URL shared worker. Fetching a data URL from the data URL shared
+  // worker is allowed, so the worker construction should succeed. The worker
+  // posts the result to the parent frame.
+  const frameCode = `
+      <script>
+      try {
+        const worker = new SharedWorker('data:${mimeType},${workerCode};');
+        worker.port.onmessage = e => window.parent.postMessage(e.data, '*');
+        worker.onerror = e => {
+          window.parent.postMessage('FAIL: ' + e.message, '*');
+        };
+      } catch (e) {
+        window.parent.postMessage(
+            'SharedWorker construction unexpectedly synchronously failed', '*');
+      }
+      </script>
+  `;
+
+  const p = new Promise(r => window.onmessage = e => r(e.data));
+  const frame = await with_iframe(`data:text/html;base64,${btoa(frameCode)}`);
+  const result = await p;
+  assert_equals(result, 'PASS');
+}, 'Create a data url shared worker in a data url frame');
diff --git a/test/fixtures/wpt/workers/shared-worker-name-via-options.html b/test/fixtures/wpt/workers/shared-worker-name-via-options.html
new file mode 100644
index 000000000000..1914d66db748
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-name-via-options.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test the name property of shared workers mixing constructor options and constructor strings</title>
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#concept-workerglobalscope-name">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-sharedworker">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#dom-sharedworkerglobalscope-name">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+"use strict";
+setup({ single_test: true });
+
+const name = "my name";
+
+const worker1 = new SharedWorker("support/shared-name.js", { name });
+worker1.port.onmessage = receiveMessage;
+
+const worker2 = new SharedWorker("support/shared-name.js", { name });
+worker2.port.onmessage = receiveMessage;
+
+const worker3 = new SharedWorker("support/shared-name.js", name);
+worker3.port.onmessage = receiveMessage;
+
+let nextCounterExpected = 1;
+function receiveMessage(e) {
+  const { counter, name: receivedName } = e.data;
+
+  assert_equals(receivedName, name);
+  assert_equals(counter, nextCounterExpected);
+
+  ++nextCounterExpected;
+  if (nextCounterExpected === 4) {
+    done();
+  }
+}
+</script>
diff --git a/test/fixtures/wpt/workers/shared-worker-options-mismatch.html b/test/fixtures/wpt/workers/shared-worker-options-mismatch.html
new file mode 100644
index 000000000000..f4cf6c4192d8
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-options-mismatch.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<title>SharedWorker: type or credentials mismatch failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+const mismatch_test = (testName, firstOptions, secondOptions) => {
+  promise_test(async () => {
+    firstOptions.name = testName;
+    secondOptions.name = testName;
+    const scriptURL = 'support/SharedWorker-common.js';
+    const firstWorker = new SharedWorker(scriptURL, firstOptions);
+    const secondWorker = new SharedWorker(scriptURL, secondOptions);
+    const result = new Promise((resolve, reject) => {
+      secondWorker.onerror = resolve;
+      secondWorker.port.onmessage = () => reject("Worker loaded succesfully");
+    });
+    secondWorker.port.postMessage("ping");
+    await result;
+    firstWorker.port.postMessage("close");
+    secondWorker.port.postMessage("close");
+    return result;
+  }, 'Connecting to shared worker with different options should be blocked: '
+  + testName);
+};
+
+// Tests different type.
+mismatch_test('default to module', {}, { type: 'module' });
+mismatch_test('module to default', { type: 'module' }, {});
+mismatch_test('classic to module', { type: 'classic' }, { type: 'module' });
+mismatch_test('module to classic', { type: 'module' }, { type: 'classic' });
+
+['classic', 'module'].forEach(type => {
+  // Tests different credentials.
+  mismatch_test('default to omit in ' + type,
+                { type },
+                { type, credentials: 'omit' });
+  mismatch_test('default to include in ' + type,
+                { type },
+                { type, credentials: 'include' });
+  mismatch_test('omit to default in ' + type,
+                { type, credentials: 'omit' },
+                { type });
+  mismatch_test('omit to same-origin in ' + type,
+                { type, credentials: 'omit' },
+                { type, credentials: 'same-origin' });
+  mismatch_test('omit to include in ' + type,
+                { type, credentials: 'omit' },
+                { type, credentials: 'include' });
+  mismatch_test('same-origin to omit in ' + type,
+                { type, credentials: 'same-origin'},
+                { type, credentials: 'omit' });
+  mismatch_test('same-origin to include in ' + type,
+                { type, credentials: 'same-origin'},
+                { type, credentials: 'include' });
+  mismatch_test('include to default in ' + type,
+                { type, credentials: 'include' },
+                { type });
+  mismatch_test('include to omit in ' + type,
+                { type, credentials: 'include' },
+                { type, credentials: 'omit' });
+  mismatch_test('include to same-origin in ' + type,
+                { type, credentials: 'include' },
+                { type, credentials: 'same-origin' });
+
+  // Tests different extendedLifetime.
+  mismatch_test('default to extended in ' + type,
+                { type },
+                { type, extendedLifetime: true });
+  mismatch_test('extended to default in ' + type,
+                { type, extendedLifetime: true },
+                { type });
+  mismatch_test('true to false in ' + type,
+                { type, extendedLifetime: true },
+                { type, extendedLifetime: false });
+  mismatch_test('false to true in ' + type,
+                { type, extendedLifetime: false },
+                { type, extendedLifetime: true });
+});
+
+</script>
diff --git a/test/fixtures/wpt/workers/shared-worker-parse-error-failure.html b/test/fixtures/wpt/workers/shared-worker-parse-error-failure.html
new file mode 100644
index 000000000000..3f1b4c5d85f4
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-parse-error-failure.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<title>SharedWorker: parse error failure</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./support/check-error-arguments.js"></script>
+<script>
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/syntax-error.js';
+  const worker = new SharedWorker(scriptURL, { type: 'classic' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Classic shared worker construction for script with syntax error should ' +
+   'dispatch an event named error.');
+
+promise_test(async () => {
+  const scriptURL = 'modules/resources/static-import-worker.js';
+  const worker = new SharedWorker(scriptURL, { type: 'classic' });
+  const args = await new Promise(resolve =>
+      worker.onerror = (...args) => resolve(args));
+  window.checkErrorArguments(args);
+}, 'Static import on classic shared worker should dispatch an event named ' +
+   'error.');
+
+</script>
diff --git a/test/fixtures/wpt/workers/shared-worker-partitioned-cookies.tentative.https.html b/test/fixtures/wpt/workers/shared-worker-partitioned-cookies.tentative.https.html
new file mode 100644
index 000000000000..f17a96449796
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-partitioned-cookies.tentative.https.html
@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>SharedWorker: Partitioned Cookies</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/test-helpers.sub.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="support/shared-worker-partitioned-cookies-helper.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async () => {
+  // Set a Partitioned cookie.
+  document.cookie =
+      '__Host-partitioned=123; Secure; Path=/; SameSite=None; Partitioned;';
+  assert_true(document.cookie.includes('__Host-partitioned=123'));
+
+  // Set an unpartitioned cookie.
+  document.cookie = 'unpartitioned=456; Secure; Path=/; SameSite=None;';
+  assert_true(document.cookie.includes('unpartitioned=456'));
+
+  const worker = new SharedWorker('support/shared-worker-echo-cookies.js');
+  const next_message = worker_message_generator(worker);
+
+  worker.port.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  worker.port.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_true(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Can access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via HTTP');
+
+  worker.port.postMessage({type: 'echo_cookies_import'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_true(msg3.cookies.includes(
+      '__Host-partitioned'),
+      'Can access partitioned cookie via importScripts');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via importScripts');
+
+  const popup = window.open(
+      new URL(
+          `./support/shared-worker-partitioned-cookies-3p-window.html?origin=${
+              encodeURIComponent(self.location.origin)}`,
+          get_host_info().HTTPS_NOTSAMESITE_ORIGIN + self.location.pathname));
+  await fetch_tests_from_window(popup);
+});
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/shared-worker-partitioned.tentative.html b/test/fixtures/wpt/workers/shared-worker-partitioned.tentative.html
new file mode 100644
index 000000000000..0be8479fa9b0
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-partitioned.tentative.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Test partitioning of shared workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+
+<body>
+<script>
+async function onload() {
+  const worker = new SharedWorker("support/shared-name.js");
+
+  let e = await new Promise((r) => {worker.port.onmessage = r});
+  assert_equals(e.data.counter, 1);
+
+  const third_party_url = new URL(
+      'support/window-sw-shared-name.html',
+      get_host_info().HTTP_NOTSAMESITE_ORIGIN + self.location.pathname);
+
+  third_party_window = window.open(third_party_url);
+
+  e = await new Promise((r) => {window.onmessage = r});
+  assert_equals(e.data.counter, 1);
+
+  third_party_window.close();
+}
+
+promise_test(onload);
+</script>
+</body>
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/shared-worker-runtime-error-is-not-parse-error.html b/test/fixtures/wpt/workers/shared-worker-runtime-error-is-not-parse-error.html
new file mode 100644
index 000000000000..da7872f3f709
--- /dev/null
+++ b/test/fixtures/wpt/workers/shared-worker-runtime-error-is-not-parse-error.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<title>SharedWorker: runtime errors are not parse errors</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async t => {
+  const worker = new SharedWorker('support/shared-worker-eval-syntax-error.js');
+  worker.onerror = t.unreached_func(
+      'onerror should not be invoked for eval() runtime error');
+  const data = await new Promise(resolve => worker.port.onmessage = e => resolve(e.data));
+  assert_equals(data, 'onerror-fired',
+      'Error should have fired at the SharedWorkerGlobalScope');
+}, 'eval() with syntax error fires at global scope but not at SharedWorker');
+
+promise_test(async t => {
+  const worker = new SharedWorker('support/shared-worker-json-parse-error.js');
+  worker.onerror = t.unreached_func(
+      'onerror should not be invoked for JSON.parse() runtime error');
+  const data = await new Promise(resolve => worker.port.onmessage = e => resolve(e.data));
+  assert_equals(data, 'onerror-fired',
+      'Error should have fired at the SharedWorkerGlobalScope');
+}, 'JSON.parse() error fires at global scope but not at SharedWorker');
+
+promise_test(async () => {
+  const worker = new SharedWorker('modules/resources/syntax-error.js');
+  const event = await new Promise(resolve => {
+    worker.onerror = e => { e.preventDefault(); resolve(e); };
+  });
+  assert_equals(event.constructor, Event,
+      'Script parse error should dispatch Event, not ErrorEvent');
+  assert_false(event instanceof ErrorEvent,
+      'Script parse error should not be an ErrorEvent');
+}, 'Script parse error dispatches plain Event at SharedWorker');
+
+</script>
diff --git a/test/fixtures/wpt/workers/support/ErrorEvent-error.js b/test/fixtures/wpt/workers/support/ErrorEvent-error.js
new file mode 100644
index 000000000000..930b54c0d588
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ErrorEvent-error.js
@@ -0,0 +1,9 @@
+onerror = function(message, location, line, col, error) {
+  postMessage({ source: "onerror", value: error });
+}
+
+addEventListener("error", function(e) {
+  postMessage({ source: "event listener", value: e.error });
+});
+
+throw "hello";
diff --git a/test/fixtures/wpt/workers/support/ErrorEvent.js b/test/fixtures/wpt/workers/support/ErrorEvent.js
new file mode 100644
index 000000000000..22ea6d4fb515
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ErrorEvent.js
@@ -0,0 +1,10 @@
+onmessage = function(evt)
+{
+    throw(new Error(evt.data));
+}
+
+onerror = function(message, location, line, col)
+{
+    postMessage( {"message": message, "filename": location, "lineno": line, "colno": col} );
+    return false; // "not handled" so the error propagates up to the Worker object
+}
diff --git a/test/fixtures/wpt/workers/support/ImportScripts.js b/test/fixtures/wpt/workers/support/ImportScripts.js
new file mode 100644
index 000000000000..7f2a2bcb552e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ImportScripts.js
@@ -0,0 +1,9 @@
+try
+{
+    importScripts("WorkerBasic.js");
+}
+catch(ex)
+{
+    result = "Fail";
+    postMessage(result);
+}
diff --git a/test/fixtures/wpt/workers/support/ImportScriptsNetworkErr.js b/test/fixtures/wpt/workers/support/ImportScriptsNetworkErr.js
new file mode 100644
index 000000000000..8179c8b10013
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ImportScriptsNetworkErr.js
@@ -0,0 +1,15 @@
+var result = "Fail";
+
+try
+{
+    importScripts("NonExistentFile.js");
+}
+catch(ex)
+{
+    if (ex.code != null && ex.code == ex.NETWORK_ERR)
+    {
+        result = "Pass";
+    }
+}
+
+postMessage(result);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/ImportScriptsNosniffErr.js b/test/fixtures/wpt/workers/support/ImportScriptsNosniffErr.js
new file mode 100644
index 000000000000..22dc9c1ba57c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/ImportScriptsNosniffErr.js
@@ -0,0 +1,9 @@
+importScripts('/resources/testharness.js');
+
+test(t => {
+  assert_throws_dom('NetworkError', () => {
+    importScripts("nosiniff-error-worker.py");
+  });
+}, "importScripts throws on 'nosniff' violation");
+
+done();
diff --git a/test/fixtures/wpt/workers/support/SharedWorker-common.js b/test/fixtures/wpt/workers/support/SharedWorker-common.js
new file mode 100644
index 000000000000..1c1dac39714b
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/SharedWorker-common.js
@@ -0,0 +1,32 @@
+function generateError()
+{
+    // Generate an exception by accessing an undefined variable.
+    foo.bar = 0;
+}
+
+onconnect = function(event) {
+    event.ports[0].onmessage = function(evt) { handleMessage(evt, event.ports[0]); };
+};
+
+function handleMessage(event, port) {
+    self.port = port;
+    if (event.data == "ping")
+        port.postMessage("PASS: Received ping message");
+    else if (event.data == "close")
+        close();
+    else if (event.data == "done")
+        port.postMessage("DONE");
+    else if (event.data == "throw")
+        generateError();
+    else if (event.data == "testingNameAttribute")
+        port.postMessage(self.name);
+    else if (/eval.+/.test(event.data)) {
+        try {
+            port.postMessage(event.data.substr(5) + ": " + eval(event.data.substr(5)));
+        } catch (ex) {
+            port.postMessage(event.data.substr(5) + ": " + ex);
+        }
+    }
+    else
+        port.postMessage("FAILURE: Received unknown message: " + event.data);
+}
diff --git a/test/fixtures/wpt/workers/support/SharedWorker-create-common.js b/test/fixtures/wpt/workers/support/SharedWorker-create-common.js
new file mode 100644
index 000000000000..1d06174f12d8
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/SharedWorker-create-common.js
@@ -0,0 +1,8 @@
+// Make a SharedWorker that has the same external interface as a DedicatedWorker, to use in shared test code.
+function createWorker()
+{
+    var worker = new SharedWorker('support/SharedWorker-common.js', 'name');
+    worker.port.onmessage = function(evt) { worker.onmessage(evt); };
+    worker.postMessage = function(msg, port) { worker.port.postMessage(msg, port); };
+    return worker;
+}
diff --git a/test/fixtures/wpt/workers/support/SharedWorker-script-error.js b/test/fixtures/wpt/workers/support/SharedWorker-script-error.js
new file mode 100644
index 000000000000..0e78949d97bd
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/SharedWorker-script-error.js
@@ -0,0 +1,22 @@
+onconnect = function(event) {
+    event.ports[0].onmessage = function(evt) { handleMessage(evt, event.ports[0]); };
+};
+
+function handleMessage(event, port) {
+    if (event.data == "unhandledError") {
+        // Generate an unhandled error.
+        onerror = null;
+        setTimeout(function() {
+            port.postMessage("SUCCESS: unhandled error generated");
+        }, 100);
+        generateError();  // Undefined function call
+    } else if (event.data == "handledError") {
+        onerror = function() {
+            port.postMessage("SUCCESS: error handled via onerror");
+            return true;
+        };
+        generateError();  // Undefined function call
+    } else {
+        port.postMessage("FAIL: Got unexpected message: " + event.data);
+    }
+};
diff --git a/test/fixtures/wpt/workers/support/Timer.js b/test/fixtures/wpt/workers/support/Timer.js
new file mode 100644
index 000000000000..a86a224dbb41
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Timer.js
@@ -0,0 +1,50 @@
+var count = 0;
+var id;
+
+onmessage = function(evt)
+{
+    try
+    {
+        switch(evt.data)
+        {
+            case "TimeoutHandler":
+                count = 0;
+                id = setTimeout("TimeoutHandler()", 10);
+                postMessage('hello');
+                break;
+            case "IntervalHandler":
+                count = 0;
+                id = setInterval("IntervalHandler()", 10);
+                postMessage('hello');
+                break;
+        }
+    }
+    catch(ex)
+    {
+        postMessage("Fail");
+    }
+}
+
+function TimeoutHandler()
+{
+    count++;
+    postMessage("worker");
+
+    id = setTimeout("TimeoutHandler()", 10);
+
+    if (count >= 2)
+    {
+        clearTimeout(id);
+    }
+}
+
+function IntervalHandler()
+{
+    count++;
+    postMessage("worker");
+
+    if (count >= 2)
+    {
+        clearInterval(id);
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-common.js b/test/fixtures/wpt/workers/support/Worker-common.js
new file mode 100644
index 000000000000..55188fe913c5
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-common.js
@@ -0,0 +1,16 @@
+onmessage = function(evt)
+{
+    if (evt.data == "ping")
+        postMessage("pong");
+    else if (evt.data == "freeze")
+        while (1) {}
+    else if (evt.data == "close")
+        close();
+    else if (/eval.+/.test(evt.data)) {
+        try {
+            postMessage(evt.data.substr(5) + ": " + eval(evt.data.substr(5)));
+        } catch (ex) {
+            postMessage(evt.data.substr(5) + ": " + ex);
+        }
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-create-common.js b/test/fixtures/wpt/workers/support/Worker-create-common.js
new file mode 100644
index 000000000000..f0b8efe46bd8
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-create-common.js
@@ -0,0 +1,4 @@
+function createWorker()
+{
+    return new Worker('support/Worker-common.js');
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js
new file mode 100644
index 000000000000..1e68302a0fc4
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js
@@ -0,0 +1,3 @@
+onmessage = (e) => {
+  e.data[0] = 1;
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js.headers b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js.headers
new file mode 100644
index 000000000000..8249c49c340f
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-creation-happens-in-parallel.js.headers
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/support/Worker-messageport.js b/test/fixtures/wpt/workers/support/Worker-messageport.js
new file mode 100644
index 000000000000..1e01b0a52b58
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-messageport.js
@@ -0,0 +1,40 @@
+onmessage = function(evt) {
+    if (evt.data == "port") {
+        if (evt.ports) {
+            postMessage("PASS: Received message port");
+            evt.ports[0].onmessage = pingBack;
+            evt.ports[0].start();
+        } else {
+            postMessage("FAIL: Did not receive expected MessagePort");
+        }
+    } else if (evt.data == "noport") {
+        if (!evt.ports || evt.ports.length) {
+            postMessage("FAIL: Received message port or null ports array");
+        } else {
+            postMessage("PASS: evt.ports = [] as expected");
+        }
+    } else if (evt.data == "spam") {
+        for (var i = 0 ; i < 1000 ; i++) {
+            evt.ports[0].postMessage(i);
+        }
+        postMessage("spamDone");
+    } else if (evt.data == "getport") {
+        var channel = new MessageChannel();
+        postMessage("port", [channel.port1]);
+        channel.port2.onmessage = pingBack;
+        channel.port2.start();
+    } else {
+        postMessage("Unknown message:" + evt.data);
+    }
+
+}
+
+function pingBack(evt) {
+    // Make sure we got the expected data and send a return message over
+    // the port.
+    if (evt.data == "ping") {
+        evt.target.postMessage("pong");
+    } else {
+        postMessage("FAIL: unknown message: " + evt.data);
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js
new file mode 100644
index 000000000000..48b4c34fe3a6
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js
@@ -0,0 +1,7 @@
+onmessage = (e) => {
+  if (e.data == 'init') {
+    postMessage(0);
+  } else {
+    e.data[0] = 1;
+  }
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js.headers b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js.headers
new file mode 100644
index 000000000000..8249c49c340f
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-postMessage-happens-in-parallel.js.headers
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy:require-corp
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-dynamic-import.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-dynamic-import.js
new file mode 100644
index 000000000000..62840bd5b4ff
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-dynamic-import.js
@@ -0,0 +1,3 @@
+import('./Worker-run-forever.js')
+  .then(r => postMessage('resolved: ' + r))
+  .catch(e => postMessage('rejected: ' + e));
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-importScripts.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-importScripts.js
new file mode 100644
index 000000000000..6a3083f38215
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-importScripts.js
@@ -0,0 +1,4 @@
+importScripts('Worker-run-forever.js');
+
+// This is not expected to run.
+postMessage('after importScripts()');
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-nested-importScripts.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-nested-importScripts.js
new file mode 100644
index 000000000000..aae86a0b0553
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-nested-importScripts.js
@@ -0,0 +1 @@
+importScripts('Worker-run-forever-during-importScripts.js');
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever-during-top-level-await.js b/test/fixtures/wpt/workers/support/Worker-run-forever-during-top-level-await.js
new file mode 100644
index 000000000000..a1c8b32b6197
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever-during-top-level-await.js
@@ -0,0 +1,4 @@
+await 1;
+postMessage('start');
+onerror = () => postMessage('onerror');
+while(1);
diff --git a/test/fixtures/wpt/workers/support/Worker-run-forever.js b/test/fixtures/wpt/workers/support/Worker-run-forever.js
new file mode 100644
index 000000000000..2d822d407f4c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-run-forever.js
@@ -0,0 +1,3 @@
+postMessage('start');
+onerror = () => postMessage('onerror');
+while(1);
diff --git a/test/fixtures/wpt/workers/support/Worker-structure-message.js b/test/fixtures/wpt/workers/support/Worker-structure-message.js
new file mode 100644
index 000000000000..81cd98243b4d
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-structure-message.js
@@ -0,0 +1,15 @@
+self.onmessage = function(evt) {
+    if (evt.data.operation == 'find-edges' &&
+        ArrayBuffer.prototype.isPrototypeOf(evt.data.input) &&
+        evt.data.input.byteLength == 20 &&
+        evt.data.threshold == 0.6) {
+        self.postMessage("PASS: Worker receives correct structure message.");
+        self.postMessage({
+            operation: evt.data.operation,
+            input: evt.data.input,
+            threshold: evt.data.threshold
+        });
+    }
+    else
+        self.postMessage("FAIL: Worker receives error structure message.");
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-termination-with-port-messages.js b/test/fixtures/wpt/workers/support/Worker-termination-with-port-messages.js
new file mode 100644
index 000000000000..a827db357e23
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-termination-with-port-messages.js
@@ -0,0 +1,10 @@
+function echo(evt)
+{
+    evt.target.postMessage(evt.data);
+}
+
+onmessage = function(evt)
+{
+    evt.ports[0].onmessage = echo;
+    evt.ports[0].start();
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-thread-multi-port.js b/test/fixtures/wpt/workers/support/Worker-thread-multi-port.js
new file mode 100644
index 000000000000..2ce7cae596b5
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-thread-multi-port.js
@@ -0,0 +1,43 @@
+onmessage = function(event) {
+  if (event.data == "noport") {
+    if (event.ports && !event.ports.length)
+      testPassed("event.ports is non-null and zero length when no port sent");
+    else
+      testFailed("event.ports is null or non-zero length when no port sent");
+  } else if (event.data == "zero ports") {
+    if (event.ports && !event.ports.length)
+      testPassed("event.ports is non-null and zero length when empty array sent");
+    else
+      testFailed("event.ports is null or non-zero length when empty array sent");
+  } else if (event.data == "two ports") {
+    if (!event.ports) {
+      testFailed("event.ports should be non-null when ports sent");
+      return;
+    }
+    if (event.ports.length == 2)
+      testPassed("event.ports contains two ports when two ports sent");
+    else
+      testFailed("event.ports contained " + event.ports.length + " when two ports sent");
+  } else if (event.data == "failed ports") {
+    if (event.ports.length == 2)
+      testPassed("event.ports contains two ports when two ports re-sent after error");
+    else
+      testFailed("event.ports contained " + event.ports.length + " when two ports re-sent after error");
+  } else if (event.data == "noargs") {
+    try {
+      postMessage();
+      testFailed("postMessage() did not throw");
+    } catch (e) {
+      testPassed("postMessage() threw exception: " + e);
+    }
+  } else
+    testFailed("Received unexpected message: " + event.data);
+};
+
+function testPassed(msg) {
+  postMessage("PASS"+msg);
+}
+
+function testFailed(msg) {
+  postMessage("FAIL"+msg);
+}
diff --git a/test/fixtures/wpt/workers/support/Worker-timeout-cancel-order.js b/test/fixtures/wpt/workers/support/Worker-timeout-cancel-order.js
new file mode 100644
index 000000000000..afc66cf6a0b4
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-timeout-cancel-order.js
@@ -0,0 +1,7 @@
+// The test will create 2 timeouts and cancel the first one. If only the second
+// timeout executes then the test passes.
+self.addEventListener('message', function(e) {
+    var t1 = setTimeout(function () { postMessage(1); }, 5);
+    setTimeout(function () { postMessage(2); }, 10);
+    clearTimeout(t1);
+}, false);
diff --git a/test/fixtures/wpt/workers/support/Worker-timeout-decreasing-order.js b/test/fixtures/wpt/workers/support/Worker-timeout-decreasing-order.js
new file mode 100644
index 000000000000..b93dd5dc771a
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-timeout-decreasing-order.js
@@ -0,0 +1,7 @@
+// The test will create 3 timeouts with their intervals decreasing.
+// If the timeouts execute in order then the test is PASS.
+self.addEventListener('message', function(e) {
+    setTimeout(function () { postMessage(3); }, 15);
+    setTimeout(function () { postMessage(2); }, 10);
+    setTimeout(function () { postMessage(1); }, 5);
+}, false);
diff --git a/test/fixtures/wpt/workers/support/Worker-timeout-increasing-order.js b/test/fixtures/wpt/workers/support/Worker-timeout-increasing-order.js
new file mode 100644
index 000000000000..42f81daa29c0
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/Worker-timeout-increasing-order.js
@@ -0,0 +1,7 @@
+// The test will create 3 timeouts with their intervals increasing.
+// If the timeouts execute in order then the test is PASS.
+self.addEventListener('message', function(e) {
+    setTimeout(function () { postMessage(1); }, 5);
+    setTimeout(function () { postMessage(2); }, 10);
+    setTimeout(function () { postMessage(3); }, 15);
+}, false);
diff --git a/test/fixtures/wpt/workers/support/WorkerBasic.js b/test/fixtures/wpt/workers/support/WorkerBasic.js
new file mode 100644
index 000000000000..6bb6d32b1419
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerBasic.js
@@ -0,0 +1,7 @@
+var result = "Fail";
+
+onmessage = function(evt)
+{
+    result = "Pass";
+    postMessage(result);
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/WorkerClose.js b/test/fixtures/wpt/workers/support/WorkerClose.js
new file mode 100644
index 000000000000..81f99993d81e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerClose.js
@@ -0,0 +1,5 @@
+onmessage = function(evt)
+{
+    postMessage(evt.data);
+    self.close();
+}
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/WorkerDataCloneErr.js b/test/fixtures/wpt/workers/support/WorkerDataCloneErr.js
new file mode 100644
index 000000000000..b7e8b0ae1676
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerDataCloneErr.js
@@ -0,0 +1,15 @@
+var result = "Fail";
+
+try
+{
+    postMessage(navigator);
+}
+catch(ex)
+{
+    if(ex.code != null && ex.code == ex.DATA_CLONE_ERR)
+    {
+        result = "Pass";
+    }
+}
+
+postMessage(result);
\ No newline at end of file
diff --git a/test/fixtures/wpt/workers/support/WorkerFetchURL.js b/test/fixtures/wpt/workers/support/WorkerFetchURL.js
new file mode 100644
index 000000000000..4ad700bcce46
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerFetchURL.js
@@ -0,0 +1,8 @@
+onconnect = e => {
+  let port = e.ports[0];
+  port.onmessage = (e) => {
+    fetch(e.data)
+    .then(response => response.text())
+    .then(text => port.postMessage('Worker reply:' + text));
+  };
+}
diff --git a/test/fixtures/wpt/workers/support/WorkerGlobalScope-close.js b/test/fixtures/wpt/workers/support/WorkerGlobalScope-close.js
new file mode 100644
index 000000000000..e2b1c0a2fddf
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerGlobalScope-close.js
@@ -0,0 +1,43 @@
+// Check to see if the worker handles pending events. Messages after close() will not be sent to the parent page, so we use exceptions instead to report failures after close().
+onmessage = function(evt)
+{
+    if (evt.data == "closeWithPendingEvents") {
+        // Set a timer to generate an event - minimum timeout is 1ms.
+        setTimeout(function() {
+                postMessage("pending event processed");
+                throw "should not be executed";
+            }, 1);
+        var start = new Date().getTime();
+        // Loop for 10 ms so the timer is ready to fire
+        while (new Date().getTime() - start < 100)
+            ;
+        // Now close - timer should not fire
+        close();
+    } else if (evt.data == "typeofClose") {
+        postMessage("typeof close: " + (typeof close));
+    } else if (evt.data == "close") {
+        close();
+        postMessage("Should be delivered");
+    } else if (evt.data == "ping") {
+        postMessage("pong");
+    } else if (evt.data == "throw") {
+        throw "should never be executed";
+    } else if (evt.data == "closeWithError") {
+        close();
+        nonExistentFunction();  // Undefined function - throws exception
+    } else if (evt.data == "close_post_loop") {
+        close();
+        postMessage("closed");
+        while(true) {} // Should loop forever.
+    } else if (evt.data == "take_port") {
+        messagePort = evt.ports[0];
+        messagePort.onmessage = function(event) {
+            close();
+            postMessage("echo_" + event.data);
+        }
+    } else if (evt.data == "start_port") {
+        messagePort.start();
+    } else {
+        postMessage("FAIL: Unknown message type: " + evt.data);
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/WorkerLocation-origin.html b/test/fixtures/wpt/workers/support/WorkerLocation-origin.html
new file mode 100644
index 000000000000..3d948030a79e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerLocation-origin.html
@@ -0,0 +1,6 @@
+<script>
+const w = new Worker("./WorkerLocation.js");
+w.onmessage = e => {
+  parent.postMessage(e.data, "*");
+}
+</script>
diff --git a/test/fixtures/wpt/workers/support/WorkerLocation.js b/test/fixtures/wpt/workers/support/WorkerLocation.js
new file mode 100644
index 000000000000..901e21542a05
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerLocation.js
@@ -0,0 +1,13 @@
+var obj = new Object();
+obj.location = location.toString();
+obj.href     = location.href;
+obj.origin   = location.origin;
+obj.protocol = location.protocol;
+obj.host     = location.host;
+obj.hostname = location.hostname;
+obj.port     = location.port;
+obj.pathname = location.pathname;
+obj.search   = location.search;
+obj.hash     = location.hash;
+
+postMessage(obj);
diff --git a/test/fixtures/wpt/workers/support/WorkerNavigator.js b/test/fixtures/wpt/workers/support/WorkerNavigator.js
new file mode 100644
index 000000000000..4258384ac444
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerNavigator.js
@@ -0,0 +1,27 @@
+(async () => {
+  const obj = new Object();
+  obj.appName    = navigator.appName;
+  obj.appVersion = navigator.appVersion;
+  obj.platform   = navigator.platform;
+  obj.userAgent  = navigator.userAgent;
+  obj.onLine     = navigator.onLine;
+  if (navigator.userAgentData) {
+    obj.brands = navigator.userAgentData.brands;
+    obj.mobile = navigator.userAgentData.mobile;
+    obj.platform = navigator.userAgentData.platform;
+    const highEntropyValues = await navigator.userAgentData.getHighEntropyValues([
+      "architecture", "bitness", "fullVersionList", "model",
+      "platformVersion", "uaFullVersion", "wow64", "formFactors",
+    ]);
+    obj.architecture = highEntropyValues.architecture;
+    obj.bitness = highEntropyValues.bitness;
+    obj.fullVersionList = highEntropyValues.fullVersionList;
+    obj.model = highEntropyValues.model;
+    obj.platformVersion = highEntropyValues.platformVersion;
+    obj.uaFullVersion = highEntropyValues.uaFullVersion;
+    obj.wow64 = highEntropyValues.wow64;
+    obj.formFactors = highEntropyValues.formFactors;
+    obj.NavigatorUADataExposed = (typeof self.NavigatorUAData != "undefined");
+  }
+  postMessage(obj);
+})();
diff --git a/test/fixtures/wpt/workers/support/WorkerSendingPerformanceNow.js b/test/fixtures/wpt/workers/support/WorkerSendingPerformanceNow.js
new file mode 100644
index 000000000000..ac12190efe3a
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerSendingPerformanceNow.js
@@ -0,0 +1,22 @@
+function calcResponse() {
+  const response = [
+    typeof(workerStart),
+    typeof(performance),
+    typeof(performance.now),
+    performance.now()
+  ];
+  return response;
+}
+
+self.onmessage = function(event) {
+  postMessage(calcResponse());
+  self.close();
+}
+
+self.addEventListener("connect", function(event) {
+  const port = event.ports[0];
+  port.onmessage = function(event) {
+    port.postMessage(calcResponse());
+    port.close();
+  };
+});
diff --git a/test/fixtures/wpt/workers/support/WorkerTerminate.js b/test/fixtures/wpt/workers/support/WorkerTerminate.js
new file mode 100644
index 000000000000..7c99e7ec5605
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerTerminate.js
@@ -0,0 +1,10 @@
+onmessage = function(evt)
+{
+    for (var i=0; true; i++)
+    {
+        if (i%1000 == 0)
+        {
+            postMessage(i);
+        }
+    }
+}
diff --git a/test/fixtures/wpt/workers/support/WorkerText.txt b/test/fixtures/wpt/workers/support/WorkerText.txt
new file mode 100644
index 000000000000..e4eeb5391da6
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/WorkerText.txt
@@ -0,0 +1,2 @@
+var result = "Pass";
+postMessage(result);
diff --git a/test/fixtures/wpt/workers/support/abrupt-completion.js b/test/fixtures/wpt/workers/support/abrupt-completion.js
new file mode 100644
index 000000000000..f0884cc1d26a
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/abrupt-completion.js
@@ -0,0 +1,21 @@
+const isSharedWorker =
+  "SharedWorkerGlobalScope" in self && self instanceof SharedWorkerGlobalScope;
+
+function setMessageHandler(response) {
+  onmessage = e => {
+    e.ports[0].postMessage(response);
+  };
+
+  if (isSharedWorker) {
+    onconnect = e => {
+      e.ports[0].onmessage = onmessage;
+    };
+  }
+}
+
+setMessageHandler("handler-before-throw");
+
+throw new Error("uncaught-exception");
+
+// This should never be called because of the uncaught exception above.
+setMessageHandler("handler-after-throw");
diff --git a/test/fixtures/wpt/workers/support/check-error-arguments.js b/test/fixtures/wpt/workers/support/check-error-arguments.js
new file mode 100644
index 000000000000..64441f9225ec
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/check-error-arguments.js
@@ -0,0 +1,4 @@
+window.checkErrorArguments = args => {
+  assert_equals(args.length, 1);
+  assert_equals(args[0].constructor, Event);
+};
diff --git a/test/fixtures/wpt/workers/support/empty-worker.js b/test/fixtures/wpt/workers/support/empty-worker.js
new file mode 100644
index 000000000000..49ceb2648a93
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/empty-worker.js
@@ -0,0 +1 @@
+// Do nothing.
diff --git a/test/fixtures/wpt/workers/support/eval-syntax-error.js b/test/fixtures/wpt/workers/support/eval-syntax-error.js
new file mode 100644
index 000000000000..0c1610aa4037
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/eval-syntax-error.js
@@ -0,0 +1 @@
+eval('1 + ;');
diff --git a/test/fixtures/wpt/workers/support/iframe-sw-shared-name.html b/test/fixtures/wpt/workers/support/iframe-sw-shared-name.html
new file mode 100644
index 000000000000..c1c7a536e13e
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/iframe-sw-shared-name.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<title>Iframe for cross-origin Shared Worker</title>
+<script src="/common/get-host-info.sub.js"></script>
+
+<body>
+<script>
+
+const worker_url = new URL(
+  'shared-name.js',
+  get_host_info().ORIGIN + self.location.pathname);
+
+let worker = new SharedWorker(worker_url);
+worker.port.onmessage = e => {
+  parent.postMessage(e.data, '*');
+}
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/support/iframe_sw_dataUrl.html b/test/fixtures/wpt/workers/support/iframe_sw_dataUrl.html
new file mode 100644
index 000000000000..0fb0ec228079
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/iframe_sw_dataUrl.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Iframe for Shared Worker: Data URL cross-origin checks</title>
+<body>
+<script>
+
+let worker = new SharedWorker('data:text/javascript,let conns=0; onconnect = e => { e.ports[0].postMessage(++conns); }');
+worker.port.onmessage = e => {
+  parent.postMessage(e.data, '*');
+}
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/support/importScripts-1.js b/test/fixtures/wpt/workers/support/importScripts-1.js
new file mode 100644
index 000000000000..8869a4fbcafc
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/importScripts-1.js
@@ -0,0 +1 @@
+importScripts("importScripts-2.js");
diff --git a/test/fixtures/wpt/workers/support/importScripts-2.js b/test/fixtures/wpt/workers/support/importScripts-2.js
new file mode 100644
index 000000000000..7f3f1116e76c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/importScripts-2.js
@@ -0,0 +1 @@
+importScripts("importScripts-3.js");
diff --git a/test/fixtures/wpt/workers/support/importScripts-3.js b/test/fixtures/wpt/workers/support/importScripts-3.js
new file mode 100644
index 000000000000..2d103a0411fe
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/importScripts-3.js
@@ -0,0 +1 @@
+importScripts("invalidScript.js");
diff --git a/test/fixtures/wpt/workers/support/invalidScript.js b/test/fixtures/wpt/workers/support/invalidScript.js
new file mode 100644
index 000000000000..8655d4d1f18c
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/invalidScript.js
@@ -0,0 +1 @@
+SELECT * FROM TABLE; // an invalid script.
diff --git a/test/fixtures/wpt/workers/support/json-parse-error.js b/test/fixtures/wpt/workers/support/json-parse-error.js
new file mode 100644
index 000000000000..ac0c175e21b3
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/json-parse-error.js
@@ -0,0 +1 @@
+JSON.parse('!');
diff --git a/test/fixtures/wpt/workers/support/name-as-accidental-global.js b/test/fixtures/wpt/workers/support/name-as-accidental-global.js
new file mode 100644
index 000000000000..f2c39ea715aa
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/name-as-accidental-global.js
@@ -0,0 +1,9 @@
+"use strict";
+importScripts("/resources/testharness.js");
+
+var name = "something else";
+
+// This just makes the test name not "Untitled"
+test(() => { }, `Declaring name as an accidental global must not cause a harness error for ${self.constructor.name}`);
+
+done();
diff --git a/test/fixtures/wpt/workers/support/name.js b/test/fixtures/wpt/workers/support/name.js
new file mode 100644
index 000000000000..970578e425a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/name.js
@@ -0,0 +1,18 @@
+"use strict";
+importScripts("/resources/testharness.js");
+
+test(() => {
+  assert_true(self.hasOwnProperty("name"), "property exists on the global");
+  assert_equals(self.name, "my name");
+}, `name property value for ${self.constructor.name}`);
+
+test(() => {
+  self.name = "something new";
+  const propDesc = Object.getOwnPropertyDescriptor(self, "name");
+  assert_equals(propDesc.value, "something new", "value");
+  assert_true(propDesc.configurable, "configurable");
+  assert_true(propDesc.writable, "writable");
+  assert_true(propDesc.enumerable, "enumerable");
+}, `name property is replaceable for ${self.constructor.name}`);
+
+done();
diff --git a/test/fixtures/wpt/workers/support/parent_of_nested_worker.js b/test/fixtures/wpt/workers/support/parent_of_nested_worker.js
new file mode 100644
index 000000000000..1f14334290a3
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/parent_of_nested_worker.js
@@ -0,0 +1,14 @@
+try {
+  var worker = new Worker("WorkerBasic.js");
+  worker.onmessage = function(e) {
+    if (e.data == "Pass") {
+      postMessage("Pass");
+    } else if (e.data == "close") {
+      close();
+      postMessage("Pass");
+    }
+  };
+  worker.postMessage("start");
+} catch (e) {
+  postMessage("Fail: " + e);
+}
diff --git a/test/fixtures/wpt/workers/support/post-message-on-load-worker.js b/test/fixtures/wpt/workers/support/post-message-on-load-worker.js
new file mode 100644
index 000000000000..e1c547ab6a4d
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/post-message-on-load-worker.js
@@ -0,0 +1,10 @@
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope) {
+  postMessage('LOADED');
+} else if (
+    'SharedWorkerGlobalScope' in self &&
+    self instanceof SharedWorkerGlobalScope) {
+  self.onconnect = e => {
+    e.ports[0].postMessage('LOADED');
+  };
+}
diff --git a/test/fixtures/wpt/workers/support/postMessage_block_worker.js b/test/fixtures/wpt/workers/support/postMessage_block_worker.js
new file mode 100644
index 000000000000..0c7bcacccaf8
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/postMessage_block_worker.js
@@ -0,0 +1,2 @@
+onmessage = e => Atomics.store(e.data, 0, 1);
+postMessage('ready');
diff --git a/test/fixtures/wpt/workers/support/postMessage_block_worker.js.headers b/test/fixtures/wpt/workers/support/postMessage_block_worker.js.headers
new file mode 100644
index 000000000000..6604450991a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/postMessage_block_worker.js.headers
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy: require-corp
diff --git a/test/fixtures/wpt/workers/support/sandboxed-tests.html b/test/fixtures/wpt/workers/support/sandboxed-tests.html
new file mode 100644
index 000000000000..811c925f56f1
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/sandboxed-tests.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script>
+const channel = new BroadcastChannel('echochannel');
+channel.onmessage = e => channel.postMessage(e.data);
+</script>
+<div id='workersrc' style='display:none'>
+importScripts("http://{{host}}:{{ports[http][0]}}/resources/testharness.js");
+onmessage = e => {
+  const external_blob = e.data.blob;
+  const external_blob_url = e.data.url;
+
+  test(t => {
+      assert_equals('null', self.location.origin);
+    }, 'Worker has an opaque origin.');
+
+  async_test(t => {
+      const r = new FileReader();
+      r.onloadend = t.step_func_done(e => assert_equals(r.result, 'from worker'));
+      r.readAsText(new Blob(['from worker']));
+    }, 'Worker can read its own blobs.');
+
+  async_test(t => {
+      const r = new FileReader();
+      r.onloadend = t.step_func_done(e => assert_equals(r.result, 'from page'));
+      r.readAsText(external_blob);
+    }, 'Worker can read its owners blobs.');
+
+  async_test(t => {
+      const request = new XMLHttpRequest();
+      request.open('GET', external_blob_url);
+      request.onreadystatechange = t.step_func(() => {
+          if (request.readyState == 4) {
+            assert_equals(request.responseText, 'from page');
+            t.done();
+          }
+        });
+      request.send();
+    }, 'Worker can XHR fetch a blob.');
+
+  promise_test(t =>
+      fetch(external_blob_url).then(r => r.text()).then(text => assert_equals(text, 'from page'))
+    , 'Worker can fetch a blob.');
+
+  async_test(t => {
+      const channel = new BroadcastChannel('echochannel');
+      channel.onmessage = t.step_func_done(e => assert_equals('ping', e.data));
+      channel.postMessage('ping');
+    }, 'Worker can access BroadcastChannel');
+  done();
+};
+</div>
+<script>
+// Create a worker with a blob URL to get a same opaque origin worker.
+const b = new Blob([document.getElementById('workersrc').textContent]);
+const url = URL.createObjectURL(b);
+const worker = new Worker(url);
+// Pass back any messages from the worker to our parent to collect test results.
+worker.onmessage = e => {
+  parent.postMessage(e.data, '*');
+};
+
+// Send test data to the worker.
+const b2 = new Blob(['from page']);
+const url2 = URL.createObjectURL(b2);
+worker.postMessage({url: url2, blob: b2});
+</script>
diff --git a/test/fixtures/wpt/workers/support/shared-name.js b/test/fixtures/wpt/workers/support/shared-name.js
new file mode 100644
index 000000000000..f00448271922
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-name.js
@@ -0,0 +1,8 @@
+"use strict";
+
+self.counter = 0;
+
+self.onconnect = e => {
+  ++self.counter;
+  e.source.postMessage({ counter: self.counter, name: self.name });
+};
diff --git a/test/fixtures/wpt/workers/support/shared-worker-echo-cookies.js b/test/fixtures/wpt/workers/support/shared-worker-echo-cookies.js
new file mode 100644
index 000000000000..34dcbc9d260b
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-echo-cookies.js
@@ -0,0 +1,40 @@
+let port;
+
+self.onconnect = e => {
+  port = e.ports[0];
+  port.addEventListener('message', onMessage);
+  port.start();
+};
+
+async function onMessage(e) {
+  switch (e.data.type) {
+    case 'test_message':
+      port.postMessage({ok: true});
+      return;
+    case 'echo_cookies_http':
+      return onEchoCookiesHttp(e);
+    case 'echo_cookies_import':
+      return onEchoCookiesImport();
+    default:
+      throw new Error('Unexpected message type ' + e.data.type);
+  }
+}
+
+async function onEchoCookiesHttp(e) {
+  try {
+    const resp = await fetch(
+        `${self.origin}/cookies/resources/list.py`, {credentials: 'include'});
+    const cookies = await resp.json();
+    port.postMessage({ok: true, cookies: Object.keys(cookies)});
+  } catch (err) {
+    port.postMessage({ok: false});
+  }
+}
+
+// Sets `self._cookies` variable, array of the names of cookies available to
+// the request.
+importScripts(`${self.origin}/cookies/resources/list-cookies-for-script.py`);
+
+function onEchoCookiesImport() {
+  port.postMessage({ok: true, cookies: self._cookies});
+}
diff --git a/test/fixtures/wpt/workers/support/shared-worker-eval-syntax-error.js b/test/fixtures/wpt/workers/support/shared-worker-eval-syntax-error.js
new file mode 100644
index 000000000000..9911bf3cd526
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-eval-syntax-error.js
@@ -0,0 +1,9 @@
+let errorFired = false;
+onerror = () => {
+  errorFired = true;
+  return false;
+};
+onconnect = e => {
+  e.ports[0].postMessage(errorFired ? "onerror-fired" : "no-error");
+};
+eval('1 + ;');
diff --git a/test/fixtures/wpt/workers/support/shared-worker-json-parse-error.js b/test/fixtures/wpt/workers/support/shared-worker-json-parse-error.js
new file mode 100644
index 000000000000..f4bfd43e1891
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-json-parse-error.js
@@ -0,0 +1,9 @@
+let errorFired = false;
+onerror = () => {
+  errorFired = true;
+  return false;
+};
+onconnect = e => {
+  e.ports[0].postMessage(errorFired ? "onerror-fired" : "no-error");
+};
+JSON.parse('!');
diff --git a/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-frame.html b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-frame.html
new file mode 100644
index 000000000000..45c01c8937a1
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-frame.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>Service Worker: Partitioned Cookies 3P Iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="shared-worker-partitioned-cookies-helper.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async () => {
+  const worker = new SharedWorker('./shared-worker-echo-cookies.js');
+  const next_message = worker_message_generator(worker);
+
+  worker.port.postMessage({type: 'test_message'});
+  const msg1 = await next_message();
+  assert_true(msg1.ok, 'Message passing');
+
+  worker.port.postMessage({type: 'echo_cookies_http'});
+  const msg2 = await next_message();
+  assert_true(msg2.ok, 'Get cookies');
+  assert_false(
+      msg2.cookies.includes('__Host-partitioned'),
+      'Cannot access partitioned cookie via HTTP');
+  assert_true(
+      msg2.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via HTTP');
+
+  worker.port.postMessage({type: 'echo_cookies_import'});
+  const msg3 = await next_message();
+  assert_true(msg3.ok, 'Get cookies');
+  assert_false(
+      msg3.cookies.includes('__Host-partitioned'),
+      'Cannot access partitioned cookie via importScripts');
+  assert_true(
+      msg3.cookies.includes('unpartitioned'),
+      'Can access unpartitioned cookie via importScripts');
+});
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-window.html b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-window.html
new file mode 100644
index 000000000000..e37e0a2cc6b6
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-3p-window.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8"/>
+<meta name="timeout" content="long">
+<title>SharedWorker: Partitioned Cookies 3P Window</title>
+<script src="/resources/testharness.js"></script>
+</head>
+
+<body>
+<script>
+
+promise_test(async t => {
+  assert_true(
+      location.search.includes('origin='), 'First party origin passed');
+  const first_party_origin =
+      new URLSearchParams(window.location.search).get('origin');
+  const iframe = document.createElement('iframe');
+  iframe.src = new URL(
+      './shared-worker-partitioned-cookies-3p-frame.html',
+      first_party_origin + location.pathname).href;
+  document.body.appendChild(iframe);
+  await fetch_tests_from_window(iframe.contentWindow);
+});
+
+</script>
+</body>
diff --git a/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-helper.js b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-helper.js
new file mode 100644
index 000000000000..e54d3848ae13
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/shared-worker-partitioned-cookies-helper.js
@@ -0,0 +1,28 @@
+// Return a generator containing the worker's message.
+//
+// Usage:
+//   const worker = new SharedWorker(...);
+//   const nextMessage = worker_message_generator(worker);
+//   const msg_1 = await nextMessage();
+//   const msg_2 = await nextMessage();
+//   const msg_3 = await nextMessage();
+function worker_message_generator(shared_worker) {
+  const buffer = [];
+  let resolve = null;
+
+  shared_worker.port.onmessage = message => {
+    buffer.push(message.data);
+    if (resolve) {
+      resolve();
+    }
+  }
+  shared_worker.port.start();
+
+  return async function() {
+    if (buffer.length != 0) {
+      return buffer.shift();
+    }
+    await new Promise(r => resolve = r);
+    return buffer.shift();
+  }
+}
diff --git a/test/fixtures/wpt/workers/support/sync_xhr.js b/test/fixtures/wpt/workers/support/sync_xhr.js
new file mode 100644
index 000000000000..5de747653738
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/sync_xhr.js
@@ -0,0 +1,13 @@
+try
+{
+  const request = new XMLHttpRequest();
+  request.open("GET", "sync_xhr_target.xml", false);
+  request.send();
+  result = request.responseText == "<foo>sometext</foo>\n" ? "Pass" : "Fail";
+  postMessage(result);
+}
+catch(ex)
+{
+  result = "Fail";
+  postMessage(result);
+}
diff --git a/test/fixtures/wpt/workers/support/sync_xhr_target.xml b/test/fixtures/wpt/workers/support/sync_xhr_target.xml
new file mode 100644
index 000000000000..d31a8c5eb463
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/sync_xhr_target.xml
@@ -0,0 +1 @@
+<foo>sometext</foo>
diff --git a/test/fixtures/wpt/workers/support/throw-on-message-Worker.js b/test/fixtures/wpt/workers/support/throw-on-message-Worker.js
new file mode 100644
index 000000000000..3648f1f47853
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/throw-on-message-Worker.js
@@ -0,0 +1,11 @@
+self.onerror = function(evt) {
+  postMessage('error');
+  return true;
+}
+
+self.onmessage = function(evt) {
+    if (evt.data === "first")
+        throw Error();
+    else
+        postMessage(evt.data);
+}
diff --git a/test/fixtures/wpt/workers/support/window-sw-shared-name.html b/test/fixtures/wpt/workers/support/window-sw-shared-name.html
new file mode 100644
index 000000000000..4a0704f9e4be
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/window-sw-shared-name.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>Window for cross-origin iframe with Shared Worker</title>
+<script src="/common/get-host-info.sub.js"></script>
+
+<body>
+<script>
+
+const iframe_url = new URL(
+  'iframe-sw-shared-name.html',
+    get_host_info().ORIGIN + self.location.pathname);
+
+
+window.onmessage = (e) => {window.opener.postMessage(e.data, '*')};
+
+var frame = document.createElement('iframe');
+frame.src = iframe_url;
+frame.style.position = 'absolute';
+document.body.appendChild(frame);
+
+</script>
+</body>
+</html>
diff --git a/test/fixtures/wpt/workers/support/worker-request-animation-frame.js b/test/fixtures/wpt/workers/support/worker-request-animation-frame.js
new file mode 100644
index 000000000000..b73781244ebd
--- /dev/null
+++ b/test/fixtures/wpt/workers/support/worker-request-animation-frame.js
@@ -0,0 +1,6 @@
+self.onmessage = function(event) {
+  requestAnimationFrame(time => {
+    postMessage(time);
+    self.close();
+  });
+}
diff --git a/test/fixtures/wpt/workers/worker-performance.worker.js b/test/fixtures/wpt/workers/worker-performance.worker.js
new file mode 100644
index 000000000000..c913b2e73750
--- /dev/null
+++ b/test/fixtures/wpt/workers/worker-performance.worker.js
@@ -0,0 +1,129 @@
+"use strict";
+
+// Tests that most of the functionality of the window.performance object is available in web workers.
+
+importScripts("/resources/testharness.js");
+
+function verifyEntry (entry, name, type, duration, assertName) {
+    assert_equals(entry.name, name, assertName + " has the right name");
+    assert_equals(entry.entryType, type, assertName + " has the right type");
+    assert_equals(entry.duration, duration, assertName + "has the right duration");
+}
+
+var start;
+test(function testPerformanceNow () {
+    start = performance.now();
+}, "Can use performance.now in workers");
+
+test(function testPerformanceMark () {
+    while (performance.now() == start) { }
+    performance.mark("mark1");
+     // Stall the minimum amount of time to ensure the marks are separate
+    var now = performance.now();
+    while (performance.now() == now) { }
+    performance.mark("mark2");
+}, "Can use performance.mark in workers");
+
+test(function testPerformanceMeasure () {
+    performance.measure("measure1", "mark1", "mark2");
+}, "Can use performance.measure in workers");
+
+test(function testPerformanceGetEntriesByName () {
+    var mark1s = performance.getEntriesByName("mark1");
+    assert_equals(mark1s.length, 1, "getEntriesByName gave correct number of entries");
+    verifyEntry(mark1s[0], "mark1", "mark", 0, "Entry got by name");
+}, "Can use performance.getEntriesByName in workers");
+
+var marks;
+var measures;
+test(function testPerformanceGetEntriesByType () {
+    marks = performance.getEntriesByType("mark");
+    assert_equals(marks.length, 2, "getEntriesByType gave correct number of entries");
+    verifyEntry(marks[0], "mark1", "mark", 0, "First mark entry");
+    verifyEntry(marks[1], "mark2", "mark", 0, "Second mark entry");
+    measures = performance.getEntriesByType("measure");
+    assert_equals(measures.length, 1, "getEntriesByType(\"measure\") gave correct number of entries");
+    verifyEntry(measures[0], "measure1", "measure", marks[1].startTime - marks[0].startTime, "Measure entry");
+}, "Can use performance.getEntriesByType in workers");
+
+test(function testPerformanceEntryOrder () {
+    assert_greater_than(marks[0].startTime, start, "First mark startTime is after a time before it");
+    assert_greater_than(marks[1].startTime, marks[0].startTime, "Second mark startTime is after first mark startTime");
+    assert_equals(measures[0].startTime, marks[0].startTime, "measure's startTime is the first mark's startTime");
+}, "Performance marks and measures seem to be working correctly in workers");
+
+test(function testPerformanceClearing () {
+    performance.clearMarks();
+    assert_equals(performance.getEntriesByType("mark").length, 0, "clearMarks cleared the marks");
+    performance.clearMeasures();
+    assert_equals(performance.getEntriesByType("measure").length, 0, "clearMeasures cleared the measures");
+}, "Can use clearMarks and clearMeasures in workers");
+
+test(function testPerformanceResourceTiming () {  // Resource timing
+    var start = performance.now();
+    var xhr = new XMLHttpRequest();
+     // Do a synchronous request and add a little artificial delay
+    xhr.open("GET", "/resources/testharness.js?pipe=trickle(d0.25)", false);
+    xhr.send();
+     // The browser might or might not have added a resource performance entry for the importScripts() above; we're only interested in xmlhttprequest entries
+    var entries = performance.getEntriesByType("resource").filter(entry => entry.initiatorType == "xmlhttprequest");
+    assert_equals(entries.length, 1, "getEntriesByType(\"resource\") returns one entry with initiatorType of xmlhttprequest");
+    assert_true(!!entries[0].name.match(/\/resources\/testharness.js/), "Resource entry has loaded url as its name");
+    assert_equals(entries[0].entryType, "resource", "Resource entry has correct entryType");
+    assert_equals(entries[0].initiatorType, "xmlhttprequest", "Resource entry has correct initiatorType");
+    var currentTimestamp = start;
+    var currentTimestampName = "a time before it";
+    [
+        "startTime", "fetchStart", "requestStart", "responseStart", "responseEnd"
+    ].forEach((name) => {
+        var timestamp = entries[0][name];
+        // We want to skip over values that are 0 because of TAO securty rescritions
+        // Or else this test will fail. This can happen for "requestStart", "responseStart".
+        if (timestamp != 0) {
+            assert_greater_than_equal(timestamp, currentTimestamp, "Resource entry " + name + " is after " + currentTimestampName);
+            currentTimestamp = timestamp;
+            currentTimestampName = name;
+        }
+    });
+    assert_greater_than(entries[0].responseEnd, entries[0].startTime, "The resource request should have taken at least some time");
+     // We requested a delay of 250ms, but it could be a little bit less, and could be significantly more.
+    assert_greater_than(entries[0].responseEnd - entries[0].responseStart, 230, "Resource timing numbers reflect reality somewhat");
+}, "Resource timing seems to work in workers");
+
+test(function testPerformanceClearResourceTimings () {
+    performance.clearResourceTimings();
+    assert_equals(performance.getEntriesByType("resource").length, 0, "clearResourceTimings cleared the resource timings");
+}, "performance.clearResourceTimings in workers");
+
+test(function testPerformanceSetResourceTimingBufferSize () {
+    performance.setResourceTimingBufferSize(0);
+    var xhr = new XMLHttpRequest();
+    xhr.open("GET", "/resources/testharness.js", false);  // synchronous request
+    xhr.send();
+    assert_equals(performance.getEntriesByType("resource").length, 0, "setResourceTimingBufferSize(0) prevents resource entries from being added");
+}, "performance.setResourceTimingBufferSize in workers");
+
+test(function testPerformanceHasNoTiming () {
+    assert_equals(typeof(performance.timing), "undefined", "performance.timing is undefined");
+}, "performance.timing is not available in workers");
+
+test(function testPerformanceHasNoNavigation () {
+    assert_equals(typeof(performance.navigation), "undefined", "performance.navigation is undefined");
+}, "performance.navigation is not available in workers");
+
+test(function testPerformanceHasToJSON () {
+    assert_equals(typeof(performance.toJSON), "function", "performance.toJSON is a function");
+}, "performance.toJSON is available in workers");
+
+test(function testPerformanceNoNavigationEntries () {
+    assert_equals(performance.getEntriesByType("navigation").length, 0, "getEntriesByType(\"navigation\") returns nothing");
+    assert_equals(performance.getEntriesByName("document", "navigation").length, 0, "getEntriesByName(\"document\", \"navigation\") returns nothing");
+    assert_equals(performance.getEntriesByName("document").length, 0, "getEntriesByName(\"document\") returns nothing");
+    var hasNavigation = performance.getEntries().some((e,i,a) => {
+        return e.entryType == "navigation";
+    });
+    assert_false(hasNavigation, "getEntries should return no navigation entries.");
+
+}, "There are no navigation type performance entries in workers");
+
+done();
diff --git a/test/fixtures/wpt/workers/worker-request-animation-frame.html b/test/fixtures/wpt/workers/worker-request-animation-frame.html
new file mode 100644
index 000000000000..2d65bc2c4610
--- /dev/null
+++ b/test/fixtures/wpt/workers/worker-request-animation-frame.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>raf time in dedicated workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+  async function waitForMessage(worker) {
+    return new Promise(resolve => {
+      worker.onmessage = event => resolve(event);
+    });
+  }
+
+  promise_test(t => {
+    const worker = new Worker('support/worker-request-animation-frame.js');
+    const message = waitForMessage(worker);
+    worker.postMessage('');
+    message.then((event) => {
+      const raf_time = event.data;
+      assert_true(performance.now() >= raf_time,
+                  'raf time cannot exceed time of page load');
+    });
+    return message;
+  }, 'requestAnimationTime reports frame time relative to worker load');
+</script>
diff --git a/test/fixtures/wpt/workers/worker-url-encoding.html b/test/fixtures/wpt/workers/worker-url-encoding.html
new file mode 100644
index 000000000000..56357a68603e
--- /dev/null
+++ b/test/fixtures/wpt/workers/worker-url-encoding.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset=windows-1252>
+<title>Worker URL is parsed using document encoding</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+  async_test(t => {
+    let worker = new Worker("resources/worker-url-encoding.js?\u00DF");
+    worker.onmessage = t.step_func(e => {
+      assert_equals(e.data, "?%DF");
+      t.done();
+    });
+  }, "Worker URL is parsed using document encoding");
+</script>
\ No newline at end of file
diff --git a/test/message/node_run_list.js b/test/message/node_run_list.js
new file mode 100644
index 000000000000..c4f846e56705
--- /dev/null
+++ b/test/message/node_run_list.js
@@ -0,0 +1,12 @@
+'use strict';
+
+require('../common');
+const { spawnSyncAndExit } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+spawnSyncAndExit(
+  process.execPath,
+  [ '--no-warnings', '--run'],
+  { cwd: fixtures.path('run-script'), encoding: 'utf8', stdio: ['ignore', 'ignore', 'inherit'] },
+  { status: 9, signal: null },
+);
diff --git a/test/message/node_run_list.out b/test/message/node_run_list.out
new file mode 100644
index 000000000000..5f634a03506b
--- /dev/null
+++ b/test/message/node_run_list.out
@@ -0,0 +1,14 @@
+Available scripts are:
+  test: echo "Error: no test specified" && exit 1
+  ada: ada
+  ada-windows: ada.bat
+  positional-args: positional-args
+  positional-args-windows: positional-args.bat
+  custom-env: custom-env
+  custom-env-windows: custom-env.bat
+  path-env: path-env
+  path-env-windows: path-env.bat
+  special-env-variables: special-env-variables
+  special-env-variables-windows: special-env-variables.bat
+  pwd: pwd
+  pwd-windows: cd
diff --git a/test/module-hooks/test-module-hooks-builtin-require.js b/test/module-hooks/test-module-hooks-builtin-require.js
index 2086cbe062b0..e1e137ce1169 100644
--- a/test/module-hooks/test-module-hooks-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-builtin-require.js
@@ -11,6 +11,8 @@ const assert = require('assert');
 const { registerHooks } = require('module');
 
 const schemelessBlockList = new Set([
+  'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/module-hooks/test-module-hooks-load-builtin-require.js b/test/module-hooks/test-module-hooks-load-builtin-require.js
index 962080b3c2c8..946fc1e48766 100644
--- a/test/module-hooks/test-module-hooks-load-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-load-builtin-require.js
@@ -35,6 +35,8 @@ hook.deregister();
 // the one with the `node:` prefix. The one with the prefix
 // stripped for internal lookups should not get passed into the hooks.
 const schemelessBlockList = new Set([
+  'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/node-api/node-api.status b/test/node-api/node-api.status
index 151687e3549f..8dc149486f8a 100644
--- a/test/node-api/node-api.status
+++ b/test/node-api/node-api.status
@@ -21,6 +21,10 @@ test_sea_addon/test: SKIP
 # https://github.com/nodejs/postject/issues/105
 test_sea_addon/test: SKIP
 
+[$system==linux && $arch==riscv64]
+# https://github.com/nodejs/node/issues/61110
+test_sea_addon/test: SKIP
+
 [$system==macos && $arch==x64]
 # https://github.com/nodejs/node/issues/59553
 test_sea_addon/test: SKIP
diff --git a/test/node-api/test_sea_addon/test.js b/test/node-api/test_sea_addon/test.js
index ef5fa118a0a4..eeac7384945d 100644
--- a/test/node-api/test_sea_addon/test.js
+++ b/test/node-api/test_sea_addon/test.js
@@ -2,9 +2,9 @@
 // This tests that SEA can load addons packaged as assets by writing them to disk
 // and loading them via process.dlopen().
 const common = require('../../common');
-const { generateSEA, skipIfSingleExecutableIsNotSupported } = require('../../common/sea');
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../../common/sea');
 
-skipIfSingleExecutableIsNotSupported();
+skipIfBuildSEAIsNotSupported();
 
 const tmpdir = require('../../common/tmpdir');
 const { copyFileSync, rmSync, cpSync } = require('fs');
@@ -27,7 +27,7 @@ cpSync(fixtureDir, tmpdir.path, { recursive: true });
 copyFileSync(addonPath, copiedAddonPath);
 
 // Generate the SEA using the working directory directly (skip copy).
-const outputFile = generateSEA(tmpdir.path, tmpdir.path);
+const outputFile = buildSEA(tmpdir.path);
 
 // Remove the copied addon after it's been packaged into the SEA blob.
 rmSync(copiedAddonPath, { force: true });
diff --git a/test/parallel/test-abortcontroller-internal.js b/test/parallel/test-abortcontroller-internal.js
index 63dd26c36e32..cd6dfb1a74d8 100644
--- a/test/parallel/test-abortcontroller-internal.js
+++ b/test/parallel/test-abortcontroller-internal.js
@@ -30,3 +30,22 @@ test('A weak event listener should not prevent gc', async () => {
   globalThis.gc();
   assert.strictEqual(ref.deref(), undefined);
 });
+
+test('two weak listeners with the same retainer should both run on abort', async () => {
+  // Regression test for https://github.com/nodejs/node/issues/63954
+  const ac = new AbortController();
+  let aRan = false;
+  let bRan = false;
+
+  ac.signal.addEventListener('a', () => { aRan = true; }, { [kWeakHandler]: ac });
+  ac.signal.addEventListener('b', () => { bRan = true; }, { [kWeakHandler]: ac });
+
+  await sleep(10);
+  globalThis.gc();
+
+  ac.signal.dispatchEvent(new Event('a'));
+  ac.signal.dispatchEvent(new Event('b'));
+
+  assert.strictEqual(aRan, true);
+  assert.strictEqual(bRan, true);
+});
diff --git a/test/parallel/test-bench-auto-run.js b/test/parallel/test-bench-auto-run.js
new file mode 100644
index 000000000000..6baf7b327cdc
--- /dev/null
+++ b/test/parallel/test-bench-auto-run.js
@@ -0,0 +1,26 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { bench } = require('node:bench');
+
+const child = spawnSync(process.execPath, [
+  '--no-warnings',
+  '-e',
+  'require("node:bench").bench("failure", () => { throw new Error(); })',
+]);
+assert.strictEqual(child.status, 1);
+
+const completion = bench('automatic execution', common.mustCall((b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+}, 30));
+
+completion.then(common.mustCall((result) => {
+  assert.strictEqual(result.name, 'automatic execution');
+  assert.strictEqual(result.samples.length, 30);
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.skip, undefined);
+  assert.strictEqual(result.summary.mean > 0, true);
+}));
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
new file mode 100644
index 000000000000..8fd05375bb07
--- /dev/null
+++ b/test/parallel/test-bench-cli.js
@@ -0,0 +1,838 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const basicPattern = fixtures.path('bench-runner/[ab].*');
+const spawnTimeout = common.platformTimeout(30_000);
+
+tmpdir.refresh();
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /--bench requires at least one file or glob/);
+}
+
+{
+  const result = spawnBench(['does-not-exist-*.js']);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+if (common.canCreateSymLink()) {
+  const dangling = tmpdir.resolve('dangling.cjs');
+  fs.symlinkSync(tmpdir.resolve('missing.cjs'), dangling);
+  const result = spawnBench([dangling]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+for (const { patterns, message } of [
+  {
+    patterns: [
+      fixtures.path('bench-runner/a.cjs'),
+      fixtures.path('bench-runner/b.mjs'),
+    ],
+    message: /benchmark child process requires exactly one file/,
+  },
+  {
+    patterns: [fixtures.path('bench-runner/missing.cjs')],
+    message: /^Could not find/,
+  },
+]) {
+  const result = spawnNode([
+    '--no-warnings',
+    '--require', fixtures.path('bench-runner/fake-ipc.cjs'),
+    '--bench',
+    ...patterns,
+  ], {
+    __proto__: null,
+    env: { __proto__: null, ...process.env, NODE_BENCH_CONTEXT: 'child' },
+  });
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, message);
+}
+
+{
+  const result = spawnBench(['--bench-reporter=json', basicPattern]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+
+  assert.deepStrictEqual(plans.map(({ name }) => name), ['alpha', 'beta']);
+  assert.deepStrictEqual(completions.map(({ data }) => data.name), [
+    'alpha',
+    'beta',
+  ]);
+  assert.notStrictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.deepStrictEqual(completions.map(({ data }) => data.params.file), [
+    'a',
+    'b',
+  ]);
+  assert.match(completions[0].data.samples[0].duration_ns, /^\d+$/);
+  assert(Number.isFinite(completions[0].data.summary.mean));
+
+  const summaries = records.filter(
+    ({ type }) => type === 'bench:summary');
+  assert.strictEqual(summaries.length, 1);
+  assert.strictEqual(summaries[0].data.file, null);
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    completed: 2,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(plans.length, 2);
+  for (const plan of plans) {
+    const planIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:plan' && data.fileRunId === plan.fileRunId);
+    const startIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:start' && data.fileRunId === plan.fileRunId);
+    assert(planIndex < startIndex);
+  }
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(completions[0].benchId, completions[1].benchId);
+  assert.strictEqual(completions[0].runId, completions[1].runId);
+  assert.strictEqual(completions[0].runId, summary.runId);
+  assert.notStrictEqual(
+    completions[0].fileRunId, completions[1].fileRunId);
+  assert.deepStrictEqual(completions.map(({ entryFile }) => entryFile), [
+    fixtures.path('bench-runner/identity-entry-a.cjs'),
+    fixtures.path('bench-runner/identity-entry-b.cjs'),
+  ]);
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['shared suite', 'shared identity'],
+    ['shared suite', 'shared identity'],
+  ]);
+  assert.strictEqual(summary.fileRunId, null);
+  assert.strictEqual(summary.entryFile, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-suite.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const parentId = JSON.stringify([
+    fixtures.path('bench-runner/identity-suite.cjs'),
+    ['cross-module suite'],
+  ]);
+
+  assert.deepStrictEqual(completions.map(({ name }) => name), [
+    'child a',
+    'child b',
+  ]);
+  assert(completions.every((completion) =>
+    completion.parentId === parentId));
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['cross-module suite', 'child a'],
+    ['cross-module suite', 'child b'],
+  ]);
+  assert(completions.every(({ entryFile }) =>
+    entryFile === fixtures.path('bench-runner/identity-suite.cjs')));
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    '--require', fixtures.path('bench-runner/identity-preload.cjs'),
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const preloads = records.filter(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'preload identity').map(({ data }) => data);
+  assert.strictEqual(preloads.length, isolation === 'process' ? 2 : 1);
+  assert.strictEqual(
+    new Set(preloads.map(({ fileRunId }) => fileRunId)).size,
+    preloads.length,
+  );
+  assert(preloads.every(({ entryFile }) => entryFile === null));
+  assert(preloads.every(
+    ({ runId }) => runId === records.at(-1).data.runId));
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/identity-hook.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.message === 'scoped hook failed').data;
+  const completion = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'scoped hook benchmark').data;
+  assert.strictEqual(diagnostic.entryFile,
+                     fixtures.path('bench-runner/identity-hook.cjs'));
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-isolation=none',
+    basicPattern,
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.strictEqual(records.at(-1).data.file, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-name-pattern=selected',
+    '--bench-samples=2',
+    '--bench-warmup=3',
+    fixtures.path('bench-runner/options.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  assert.deepStrictEqual(samples.map(({ data }) => data.operations), [4, 5]);
+  assert.deepStrictEqual(plans.map((plan) => ({
+    name: plan.name,
+    samples: plan.samples,
+    selected: plan.selected,
+    skip: plan.skip,
+    timeout: plan.timeout,
+    warmup: plan.warmup,
+    yieldBetweenSamples: plan.yieldBetweenSamples,
+  })), [
+    {
+      name: 'selected',
+      samples: 2,
+      selected: true,
+      skip: undefined,
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+    {
+      name: 'filtered out',
+      samples: 2,
+      selected: false,
+      skip: 'name pattern',
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+  ]);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const selected = completions.find(({ data }) => data.name === 'selected').data;
+  assert.deepStrictEqual(selected.params, {
+    boolean: true,
+    number: 42,
+    string: 'value',
+  });
+  assert.strictEqual(selected.samples.length, 2);
+  assert.strictEqual(
+    selected.summary.mean,
+    (selected.samples[0].rate + selected.samples[1].rate) / 2,
+  );
+  assert(Number.isFinite(selected.summary.medianConfidenceInterval.lower));
+
+  const filtered = completions.find(
+    ({ data }) => data.name === 'filtered out').data;
+  assert.strictEqual(filtered.skip, 'name pattern');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/error.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const failure = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(failure.params, { kind: 'structured-error' });
+  assert.strictEqual(failure.error.name, 'Error');
+  assert.strictEqual(failure.error.message, 'benchmark fixture failed');
+  assert.strictEqual(failure.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(failure.error.cause, { value: '42' });
+  assert.match(failure.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/throws-null.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.message, 'null');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/load-error-after-declaration.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'declared before load error');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(completion.name, plan.name);
+  assert.strictEqual(completion.error, undefined);
+  assert.strictEqual(completion.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/recorded-detail.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.samples.length, 1);
+  const { rate, ...sample } = completion.samples[0];
+  assert.deepStrictEqual(sample, {
+    detail: { index: 0, phase: 'measurement', value: '42' },
+    duration_ns: '4',
+    operations: 2,
+  });
+  assert(Math.abs(rate - 500_000_000) < 1);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/diagnostic.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(diagnostic.message, {
+    name: 'node:bench:test:diagnostic',
+    message: { value: '42' },
+  });
+  assert.strictEqual(diagnostic.level, 'info');
+  assert.strictEqual(diagnostic.phase, 'measurement');
+  assert.strictEqual(diagnostic.index, 0);
+  assert.strictEqual(diagnostic.detail, undefined);
+  assert.strictEqual(diagnostic.benchId, completion.benchId);
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+  assert.strictEqual(completion.error, undefined);
+}
+
+for (const { file, status } of [
+  { file: 'a.cjs', status: 0 },
+  { file: 'error.cjs', status: 1 },
+]) {
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/verifying-reporter.cjs')}`,
+    fixtures.path(`bench-runner/${file}`),
+  ]);
+  assert.strictEqual(result.status, status);
+  assert.strictEqual(result.stderr, '');
+  assert.strictEqual(result.stdout, 'verified\n');
+}
+
+{
+  const result = spawnBench([
+    '--require',
+    fixtures.path('bench-runner/preload.cjs'),
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/preloaded.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { preloaded: true });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    '--import', fixtures.fileURL('bench-runner/import.mjs'),
+    fixtures.path('bench-runner/imported.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { imported: 'loaded' });
+}
+
+{
+  const lock = tmpdir.resolve('serial.lock');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/serial-[ab].cjs'),
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_LOCK: lock },
+  });
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.deepStrictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data.name), [
+    'serial a',
+    'serial b',
+  ]);
+  assert.strictEqual(fs.existsSync(lock), false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/ipc.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'user IPC');
+  assert.strictEqual(records.at(-1).data.file,
+                     fixtures.path('bench-runner/ipc.cjs'));
+}
+
+for (const { kind, message } of [
+  { kind: 'sequence', message: /valid record sequence/ },
+  { kind: 'record', message: /not a valid benchmark record/ },
+  { kind: 'identity', message: /not a valid benchmark record/ },
+  { kind: 'name-path', message: /not a valid benchmark record/ },
+  { kind: 'plan', message: /not a valid benchmark plan/ },
+  { kind: 'timeout', message: /not a valid benchmark plan/ },
+  { kind: 'diagnostic', message: /not a valid benchmark diagnostic/ },
+  { kind: 'diagnostic-order', message: /valid lifecycle sequence/ },
+  { kind: 'summary', message: /not a valid benchmark summary/ },
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-record.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_MALFORMED_RECORD: kind,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-plan-order.mjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => /valid lifecycle sequence/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)).data;
+  assert.strictEqual(diagnostic.entryFile, null);
+  assert.strictEqual(diagnostic.fileRunId, null);
+  assert.strictEqual(diagnostic.file, null);
+}
+
+for (const { mode, message } of [
+  { mode: 'code', message: /failed with exit code 2/ },
+  { mode: 'late', message: /failed with exit code 2/ },
+  ...common.isWindows ? [] : [
+    { mode: 'signal', message: /failed with signal SIGTERM/ },
+  ],
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/abrupt-exit.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_EXIT_MODE: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+}
+
+for (const mode of ['callback', 'throw']) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/send-error.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_SEND_ERROR: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const messages = diagnostics.map(({ data }) => data.message).join('');
+  assert.match(messages, /benchmark send/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--random-seed=17',
+    '--stack-trace-limit=17',
+    fixtures.path('bench-runner/v8-option.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'V8 option');
+}
+
+if (common.hasInspector) {
+  const result = spawnBench([
+    '--inspect=0',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/inspector.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic')
+    .map(({ data }) => data.message).join('');
+  assert.match(diagnostics, /Debugger listening on ws:\/\//);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.params.inspectPort, '--inspect-port=0');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stdout, '');
+  const records = parseOutput(result.stderr);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.deepStrictEqual(diagnostics.map(({ data }) => data.stream).sort(), [
+    'stderr',
+    'stdout',
+  ]);
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stdout\n'));
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stderr\n'));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/utf8-output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const output = records.filter(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.stream === 'stdout').map(({ data }) => data.message).join('');
+  assert.strictEqual(output, 'split:\u20ac\n');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/run.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.match(diagnostic.data.message,
+               /run\(\) cannot be called from a file run with --bench/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/failing-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter failed/);
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/slow-reporter.cjs')}`,
+    fixtures.path('bench-runner/many-records.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const report = JSON.parse(result.stdout);
+  assert.strictEqual(report.samples, 30);
+  assert.strictEqual(report.stdout,
+                     Array.from({ length: 30 }, (_, i) => `${i}\n`).join(''));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/acknowledged-records.mjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(diagnostics.every(
+    ({ data }) => /^acknowledged 10\d{3}$/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, true);
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/destroying-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter closed the stream/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=data:text/javascript,export default 0',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /is not a valid reporter/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnNode([
+    '--no-warnings',
+    `--experimental-config-file=${fixtures.path('bench-runner/node.config.json')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.samples.length, 1);
+}
+
+{
+  const destination = tmpdir.resolve('bench.txt');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=spec',
+    `--bench-reporter-destination=${destination}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  parseRecords(result);
+  assert.match(fs.readFileSync(destination, 'utf8'),
+               /^benchmark \| samples \| mean rate/);
+}
+
+{
+  const result = spawnBench([fixtures.path('bench-runner/a.cjs')]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /^benchmark \| samples \| mean rate/);
+  assert.match(result.stdout, /1 completed, 0 failed, 0 skipped/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter=spec',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr,
+               /must match the number of specified '.*destination'/);
+}
+
+for (const { args, message } of [
+  {
+    args: ['--bench-isolation=invalid', 'unused.js'],
+    message: /invalid value for --bench-isolation/,
+  },
+  {
+    args: ['--bench-samples=0', 'unused.js'],
+    message: /--bench-samples must be greater than 0/,
+  },
+  {
+    args: ['--bench-warmup=4294967296', 'unused.js'],
+    message: /--bench-warmup.*out of range/,
+  },
+  {
+    args: ['--bench-samples=2x', 'unused.js'],
+    message: /invalid value for --bench-samples/,
+  },
+  {
+    args: ['--bench-warmup=abc', 'unused.js'],
+    message: /invalid value for --bench-warmup/,
+  },
+  {
+    args: ['--bench-name-pattern=[', 'unused.js'],
+    message: /invalid regular expression/,
+  },
+  {
+    args: ['--eval=1', 'unused.js'],
+    message: /either --bench or --eval can be used, not both/,
+  },
+  {
+    args: ['--interactive', 'unused.js'],
+    message: /either --bench or --interactive can be used, not both/,
+  },
+  {
+    args: ['--watch', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--watch-path=.', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--check', 'unused.js'],
+    message: /either --bench or --check can be used, not both/,
+  },
+  {
+    args: ['--test', 'unused.js'],
+    message: /either --bench or --test can be used, not both/,
+  },
+]) {
+  const result = spawnBench(args);
+  assert.notStrictEqual(result.status, 0);
+  assert.match(result.stderr, message);
+}
diff --git a/test/parallel/test-bench-clock-precision.js b/test/parallel/test-bench-clock-precision.js
new file mode 100644
index 000000000000..93158e51319b
--- /dev/null
+++ b/test/parallel/test-bench-clock-precision.js
@@ -0,0 +1,22 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const originalHrtimeBigint = process.hrtime.bigint;
+process.hrtime.bigint = () => 1n;
+const { bench, run } = require('node:bench');
+process.hrtime.bigint = originalHrtimeBigint;
+
+const completion = bench('zero duration', { samples: 1 }, (b) => {
+  b.start();
+  b.end(1);
+});
+
+(async () => {
+  await run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_INVALID_STATE');
+  assert.match(result.error.message, /insufficient clock precision/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
new file mode 100644
index 000000000000..6ee095f94eae
--- /dev/null
+++ b/test/parallel/test-bench-context-control.js
@@ -0,0 +1,106 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const invocations = [];
+  let closedContext;
+
+  const controlledCompletion = runner.bench('controlled', {
+    samples: 5,
+    warmup: 2,
+  }, common.mustCall((b) => {
+    invocations.push(`${b.phase}:${b.index}`);
+    const detail = { index: b.index, phase: b.phase };
+    const sample = completeSample(b, 2, { detail });
+    detail.index = -1;
+
+    assert.strictEqual(sample.operations, 2);
+    assert.strictEqual(typeof sample.duration_ns, 'bigint');
+    assert.strictEqual(sample.rate > 0, true);
+    assert.notStrictEqual(sample.detail, detail);
+    assert.notStrictEqual(sample.detail.index, -1);
+    sample.operations = 0;
+    sample.rate = NaN;
+    sample.detail.index = -2;
+
+    if (b.phase === 'measurement' && b.index === 1) {
+      b.done();
+      closedContext = b;
+    }
+  }, 4));
+
+  const recordedCompletion = runner.bench(
+    'recorded', { samples: 3 }, common.mustCall((b) => {
+      const detail = { source: 'worker', value: 1n };
+      const sample = b.record({
+        __proto__: null,
+        detail,
+        duration_ns: 20n,
+        operations: 5,
+      });
+      detail.source = 'changed';
+      assert.deepStrictEqual(sample, {
+        __proto__: null,
+        detail: { source: 'worker', value: 1n },
+        duration_ns: 20n,
+        operations: 5,
+        rate: 250_000_000,
+      });
+      sample.operations = 0;
+      sample.rate = NaN;
+      sample.detail.source = 'returned value changed';
+      b.done();
+    }));
+
+  const variableSamples = [
+    { __proto__: null, duration_ns: 1_000_000_000n, operations: 1 },
+    { __proto__: null, duration_ns: 100_000_000n, operations: 100 },
+  ];
+  const variableCompletion = runner.bench('variable batch', {
+    samples: variableSamples.length,
+  }, common.mustCall((b) => {
+    b.record(variableSamples[b.index]);
+  }, variableSamples.length));
+
+  const records = await runner.run().toArray();
+  const [controlled, recorded, variable] = await Promise.all([
+    controlledCompletion,
+    recordedCompletion,
+    variableCompletion,
+  ]);
+
+  assert.deepStrictEqual(invocations, [
+    'warmup:0',
+    'warmup:1',
+    'measurement:0',
+    'measurement:1',
+  ]);
+  assert.strictEqual(controlled.samples.length, 2);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ operations }) => operations), [2, 2]);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ detail }) => detail.index), [0, 1]);
+  assert.strictEqual(controlled.samples.every(({ rate }) => rate > 0), true);
+  assert.strictEqual(recorded.samples.length, 1);
+  assert.deepStrictEqual(recorded.samples[0].detail,
+                         { source: 'worker', value: 1n });
+  assert.deepStrictEqual(variable.samples.map(({ rate }) => rate), [1, 1000]);
+  assert.strictEqual(variable.summary.mean, 500.5);
+  const pooledRate = 1_000_000_000 * 101 / 1_100_000_000;
+  assert.notStrictEqual(variable.summary.mean, pooledRate);
+  assert.strictEqual(
+    records.filter(({ type }) => type === 'bench:sample').length, 5);
+  assert.throws(() => closedContext.start(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.end(1), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.record({
+    duration_ns: 1n,
+    operations: 1,
+  }), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.done(), { code: 'ERR_INVALID_STATE' });
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
new file mode 100644
index 000000000000..995330c5faef
--- /dev/null
+++ b/test/parallel/test-bench-context-errors.js
@@ -0,0 +1,125 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('done during warmup', { samples: 1, warmup: 1 }, (b) => {
+  completeSample(b);
+  b.done();
+});
+runner.bench('invalid record', { samples: 1 }, (b) => b.record(null));
+runner.bench('invalid duration type', { samples: 1 }, (b) => b.record({
+  duration_ns: 1,
+  operations: 1,
+}));
+runner.bench('invalid duration value', { samples: 1 }, (b) => b.record({
+  duration_ns: 0n,
+  operations: 1,
+}));
+runner.bench('duration too large', { samples: 1 }, (b) => b.record({
+  duration_ns: 9_007_199_254_740_992n,
+  operations: 1,
+}));
+runner.bench('invalid operations', { samples: 1 }, (b) => b.record({
+  duration_ns: 1n,
+  operations: 0,
+}));
+runner.bench('mixed timing', { samples: 1 }, (b) => {
+  b.start();
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('start after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.start();
+});
+runner.bench('end after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.end(1);
+});
+runner.bench('duplicate record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('reentrant record', { samples: 1 }, (b) => {
+  const sample = { duration_ns: 1n };
+  Object.defineProperty(sample, 'operations', {
+    get() {
+      b.record({ duration_ns: 1n, operations: 1 });
+      return 1;
+    },
+  });
+  b.record(sample);
+});
+runner.bench('uncloneable detail', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
+});
+runner.bench('uncloneable diagnostic message', { samples: 1 }, (b) => {
+  b.diagnostic(() => {});
+});
+runner.bench('invalid diagnostic level', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { level: 'error' });
+});
+runner.bench('uncloneable diagnostic detail', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { detail: () => {} });
+});
+runner.bench('caught contract violation', { samples: 1 },
+             common.mustCall((b) => {
+               b.start();
+               assert.throws(() => b.start(), { code: 'ERR_INVALID_STATE' });
+               b.end(1);
+             }));
+runner.bench('caught diagnostic violation', { samples: 1 },
+             common.mustCall((b) => {
+               assert.throws(() => b.diagnostic('invalid', {
+                 level: 'error',
+               }), { code: 'ERR_INVALID_ARG_VALUE' });
+               b.record({ duration_ns: 1n, operations: 1 });
+             }));
+
+(async () => {
+  const records = await runner.run().toArray();
+  const completions = records
+    .filter(({ type }) => type === 'bench:complete')
+    .map(({ data }) => data);
+  const byName = new Map(completions.map((result) => [result.name, result]));
+
+  assert.strictEqual(byName.get('done during warmup').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid record').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration type').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration value').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('duration too large').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('invalid operations').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('mixed timing').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('start after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('end after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('reentrant record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('uncloneable detail').error.name,
+                     'DataCloneError');
+  assert.strictEqual(byName.get('uncloneable diagnostic message').error.name,
+                     'DataCloneError');
+  assert.strictEqual(byName.get('invalid diagnostic level').error.code,
+                     'ERR_INVALID_ARG_VALUE');
+  assert.strictEqual(byName.get('uncloneable diagnostic detail').error.name,
+                     'DataCloneError');
+  assert.match(byName.get('caught contract violation').error.message,
+               /violated the context method contract/);
+  assert.match(byName.get('caught diagnostic violation').error.message,
+               /violated the context method contract/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
new file mode 100644
index 000000000000..51474af3d99c
--- /dev/null
+++ b/test/parallel/test-bench-create-runner.js
@@ -0,0 +1,100 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+(async () => {
+  const first = createRunner({ yieldBetweenSamples: false });
+  const second = createRunner({ yieldBetweenSamples: false });
+  let firstCalls = 0;
+  let secondCalls = 0;
+
+  first.before(common.mustCall());
+  second.before(common.mustCall());
+
+  const firstCompletion = first.bench(
+    'same name', { samples: 2 }, common.mustCall((b) => {
+      firstCalls++;
+      completeSample(b);
+    }, 2));
+  const secondCompletion = second.bench(
+    'same name', { samples: 1 }, common.mustCall((b) => {
+      secondCalls++;
+      completeSample(b);
+    }));
+
+  await setImmediate();
+  assert.strictEqual(firstCalls, 0);
+  assert.strictEqual(secondCalls, 0);
+
+  const firstStream = first.run();
+  const secondStream = second.run();
+  assert.throws(() => first.run(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => first.bench('late', common.mustNotCall()),
+                { code: 'ERR_INVALID_STATE' });
+  const [firstRecords, secondRecords] = await Promise.all([
+    firstStream.toArray(),
+    secondStream.toArray(),
+  ]);
+  const [firstResult, secondResult] = await Promise.all([
+    firstCompletion,
+    secondCompletion,
+  ]);
+
+  assert.strictEqual(firstCalls, 2);
+  assert.strictEqual(secondCalls, 1);
+  assert.strictEqual(firstResult.samples.length, 2);
+  assert.strictEqual(secondResult.samples.length, 1);
+  assert.strictEqual(firstResult.error, undefined);
+  assert.strictEqual(secondResult.error, undefined);
+  assert.strictEqual(firstResult.benchId, secondResult.benchId);
+  assert.notStrictEqual(firstResult.runId, secondResult.runId);
+  assert.strictEqual(firstResult.fileRunId, firstResult.runId);
+  assert.strictEqual(secondResult.fileRunId, secondResult.runId);
+  assert.strictEqual(firstResult.entryFile, process.argv[1]);
+  assert.strictEqual(secondResult.entryFile, process.argv[1]);
+  assert.deepStrictEqual(firstResult.namePath, ['same name']);
+  assert.deepStrictEqual(secondResult.namePath, ['same name']);
+  assert(firstRecords.every(({ data }) => data.runId === firstResult.runId));
+  assert(secondRecords.every(({ data }) => data.runId === secondResult.runId));
+  assert.strictEqual(
+    firstRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(
+    secondRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(typeof first.bench.skip, 'function');
+  assert.strictEqual(typeof first.bench.only, 'function');
+  assert.strictEqual(first.describe, first.suite);
+
+  const retry = createRunner({ yieldBetweenSamples: false });
+  retry.bench('not filtered', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+  assert.throws(() => retry.run({
+    namePattern: 'filtered',
+    samples: 0,
+  }), { code: 'ERR_OUT_OF_RANGE' });
+  const retryRecords = await retry.run().toArray();
+  const retryResult = retryRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(retryResult.skip, undefined);
+  assert.strictEqual(retryResult.samples.length, 1);
+
+  const reentrant = createRunner({ yieldBetweenSamples: false });
+  reentrant.bench('reentrant options', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+  const reentrantOptions = {};
+  Object.defineProperty(reentrantOptions, 'samples', {
+    get: common.mustCall(() => reentrant.run()),
+  });
+  assert.throws(() => reentrant.run(reentrantOptions),
+                { code: 'ERR_INVALID_STATE' });
+  const reentrantRecords = await reentrant.run().toArray();
+  const reentrantResult = reentrantRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(reentrantResult.samples.length, 1);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-custom-reporter.js b/test/parallel/test-bench-custom-reporter.js
new file mode 100644
index 000000000000..1d4ec8bed191
--- /dev/null
+++ b/test/parallel/test-bench-custom-reporter.js
@@ -0,0 +1,36 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { Writable } = require('stream');
+const { finished } = require('stream/promises');
+const { bench, run } = require('node:bench');
+
+bench('completed', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+
+async function* customReporter(source) {
+  for await (const { type, data } of source) {
+    if (type !== 'bench:complete') continue;
+    yield `${data.name}:${data.skip === undefined ? 'completed' : 'skipped'}\n`;
+  }
+}
+
+let output = '';
+const destination = new Writable({
+  write(chunk, _encoding, callback) {
+    output += chunk;
+    callback();
+  },
+});
+
+run().compose(customReporter).pipe(destination);
+
+(async () => {
+  await finished(destination);
+  assert.strictEqual(output, 'completed:completed\nskipped:skipped\n');
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostic-channels.js b/test/parallel/test-bench-diagnostic-channels.js
new file mode 100644
index 000000000000..9e1bb2a07024
--- /dev/null
+++ b/test/parallel/test-bench-diagnostic-channels.js
@@ -0,0 +1,119 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const dc = require('diagnostics_channel');
+const { createRunner } = require('node:bench');
+
+const prefix = `node:bench:test:${process.pid}`;
+const inheritedName = `${prefix}:inherited`;
+const nestedName = `${prefix}:nested`;
+const benchmarkName = `${prefix}:benchmark`;
+const unlistedName = `${prefix}:unlisted`;
+const symbolName = Symbol(`${prefix}:symbol`);
+const inheritedChannel = dc.channel(inheritedName);
+const nestedChannel = dc.channel(nestedName);
+const benchmarkChannel = dc.channel(benchmarkName);
+const unlistedChannel = dc.channel(unlistedName);
+const symbolChannel = dc.channel(symbolName);
+
+function recordSample(context) {
+  context.record({ duration_ns: 1n, operations: 1 });
+}
+
+async function testCapture() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.suite('outer', {
+    diagnosticChannels: [inheritedName, symbolName, inheritedName],
+  }, common.mustCall(() => {
+    runner.suite('inner', {
+      diagnosticChannels: [nestedName],
+    }, common.mustCall(() => {
+      runner.bench('captured', {
+        diagnosticChannels: [benchmarkName, nestedName],
+        samples: 1,
+      }, common.mustCall((context) => {
+        const message = { value: 1 };
+        inheritedChannel.publish(message);
+        message.value = 0;
+        nestedChannel.publish({ value: 2 });
+        benchmarkChannel.publish({ value: 3 });
+        unlistedChannel.publish({ value: 4 });
+        symbolChannel.publish({ value: 5 });
+        recordSample(context);
+      }));
+    }));
+  }));
+  runner.bench('not captured', { samples: 1 }, common.mustCall((context) => {
+    inheritedChannel.publish({ value: 6 });
+    recordSample(context);
+  }));
+
+  const records = await runner.run().toArray();
+  const plan = records.find(
+    ({ type, data }) => type === 'bench:plan' && data.name === 'captured').data;
+  assert.deepStrictEqual(plan.diagnosticChannels, [
+    inheritedName,
+    nestedName,
+    benchmarkName,
+  ]);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic').map(({ data }) => data);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { name: inheritedName, message: { value: 1 } },
+    { name: nestedName, message: { value: 2 } },
+    { name: benchmarkName, message: { value: 3 } },
+  ]);
+  assert(diagnostics.every(({ level }) => level === 'info'));
+  assert.strictEqual(inheritedChannel.hasSubscribers, false);
+  assert.strictEqual(nestedChannel.hasSubscribers, false);
+  assert.strictEqual(benchmarkChannel.hasSubscribers, false);
+  assert.strictEqual(symbolChannel.hasSubscribers, false);
+}
+
+async function testUncloneableMessage() {
+  const name = `${prefix}:uncloneable`;
+  const channel = dc.channel(name);
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('uncloneable', {
+    diagnosticChannels: [name],
+    samples: 1,
+  }, common.mustCall((context) => {
+    channel.publish(() => {});
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.name, 'DataCloneError');
+  assert.strictEqual(channel.hasSubscribers, false);
+}
+
+async function testAbortCleanup() {
+  const name = `${prefix}:abort`;
+  const channel = dc.channel(name);
+  const controller = new AbortController();
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('abort', {
+    diagnosticChannels: [name],
+    samples: 1,
+    signal: controller.signal,
+  }, common.mustCall((context) => {
+    controller.abort(new Error('stop'));
+    assert.strictEqual(channel.hasSubscribers, false);
+    channel.publish({ ignored: true });
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:diagnostic'),
+    false,
+  );
+}
+
+(async () => {
+  await testCapture();
+  await testUncloneableMessage();
+  await testAbortCleanup();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostics.js b/test/parallel/test-bench-diagnostics.js
new file mode 100644
index 000000000000..9e33fd56323f
--- /dev/null
+++ b/test/parallel/test-bench-diagnostics.js
@@ -0,0 +1,177 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    duration_ns: 1n,
+    operations: 1,
+  });
+}
+
+async function testListenerFailure(callbackError) {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const listenerError = new Error('diagnostic listener failed');
+  const completion = runner.bench('listener failure', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('listener failure');
+    if (callbackError !== undefined) throw callbackError;
+    recordSample(b);
+  }));
+  const stream = runner.run();
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw listenerError;
+  }));
+  await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error, callbackError ?? listenerError);
+  assert.strictEqual(result.samples.length, callbackError === undefined ? 1 : 0);
+}
+
+async function testAbortDuringDiagnosticDelivery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const abortReason = new Error('stop diagnostic delivery');
+  const controller = new AbortController();
+  const completion = runner.bench('abort diagnostics', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    for (let i = 0; i < 32; i++) b.diagnostic(`diagnostic ${i}`);
+    recordSample(b);
+  }));
+  const stream = runner.run({ signal: controller.signal });
+  const iterator = stream[Symbol.asyncIterator]();
+  const records = [];
+  records.push((await iterator.next()).value);
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+  controller.abort(abortReason);
+  while (true) {
+    const { done, value } = await iterator.next();
+    if (done) break;
+    records.push(value);
+  }
+
+  const result = await completion;
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const completeIndex = records.findIndex(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(records.indexOf(diagnostics.at(-1)) < completeIndex);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, abortReason);
+  assert.strictEqual(result.samples.length, 1);
+}
+
+async function testAfterEachFailurePrecedence() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const callbackError = new Error('callback failed');
+  const afterEachError = new Error('afterEach failed');
+  runner.afterEach(common.mustCall(() => {
+    throw afterEachError;
+  }));
+  const completion = runner.bench('afterEach precedence', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failures');
+    throw callbackError;
+  }));
+  await runner.run().toArray();
+  assert.strictEqual((await completion).error, afterEachError);
+}
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let finalContext;
+  const completed = runner.bench('diagnostics', {
+    samples: 2,
+    warmup: 1,
+  }, common.mustCall((b) => {
+    finalContext = b;
+    const detail = { index: b.index };
+    const message = { index: b.index, phase: b.phase };
+    const level = b.phase === 'warmup' ? 'info' : 'warning';
+    assert.strictEqual(b.diagnostic(message, {
+      detail,
+      level,
+    }), undefined);
+    detail.index = -1;
+    message.index = -1;
+    recordSample(b);
+  }, 3));
+  const expectedError = new Error('benchmark failed');
+  const failed = runner.bench('failed diagnostic', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failure', {
+      detail: { retained: true },
+      level: 'warning',
+    });
+    throw expectedError;
+  }));
+
+  const namedDiagnostics = [];
+  const stream = runner.run();
+  stream.on('bench:diagnostic', (diagnostic) => {
+    namedDiagnostics.push(diagnostic);
+  });
+  const records = await stream.toArray();
+  const completedResult = await completed;
+  const failedResult = await failed;
+  const diagnosticRecords = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const diagnostics = diagnosticRecords.map(({ data }) => data);
+
+  assert.strictEqual(completedResult.error, undefined);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(diagnostics.length, 4);
+  assert.strictEqual(namedDiagnostics.length, diagnostics.length);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { index: 0, phase: 'warmup' },
+    { index: 0, phase: 'measurement' },
+    { index: 1, phase: 'measurement' },
+    'before failure',
+  ]);
+  assert.deepStrictEqual(diagnostics.map(({ phase, index, level }) => ({
+    phase,
+    index,
+    level,
+  })), [
+    { phase: 'warmup', index: 0, level: 'info' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+    { phase: 'measurement', index: 1, level: 'warning' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+  ]);
+  assert.deepStrictEqual(
+    diagnostics.map(({ detail }) => detail),
+    [{ index: 0 }, { index: 0 }, { index: 1 }, { retained: true }]);
+  assert(diagnostics.slice(0, 3).every(
+    ({ benchId }) => benchId === completedResult.benchId));
+  assert.strictEqual(diagnostics[3].benchId, failedResult.benchId);
+  assert.notStrictEqual(namedDiagnostics[0], diagnostics[0]);
+
+  for (let i = 0; i < 2; i++) {
+    const diagnosticIndex = records.indexOf(diagnosticRecords[i + 1]);
+    const sampleIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:sample' && data.benchId === completedResult.benchId &&
+      data.index === i);
+    assert(diagnosticIndex < sampleIndex);
+  }
+  assert.throws(() => finalContext.diagnostic('too late'), {
+    code: 'ERR_INVALID_STATE',
+  });
+  await testListenerFailure(undefined);
+  await testListenerFailure(new Error('callback failed'));
+  await testAbortDuringDiagnosticDelivery();
+  await testAfterEachFailurePrecedence();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
new file mode 100644
index 000000000000..e540d5d847c5
--- /dev/null
+++ b/test/parallel/test-bench-errors.js
@@ -0,0 +1,121 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+const { setTimeout } = require('timers/promises');
+
+const options = { samples: 1 };
+
+bench('missing start', options, () => {});
+bench('missing end', options, (b) => b.start());
+bench('end before start', options, (b) => b.end(1));
+bench('duplicate start', options, (b) => {
+  b.start();
+  b.start();
+});
+bench('duplicate end', options, (b) => {
+  b.start();
+  b.end(1);
+  b.end(1);
+});
+bench('invalid operations', options, (b) => {
+  b.start();
+  b.end(0);
+});
+bench('throws', options, () => {
+  throw new Error('benchmark failure');
+});
+let lateTimeoutActive = false;
+bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
+  lateTimeoutActive = true;
+  try {
+    b.start();
+    await setTimeout(30);
+    b.end(1);
+  } finally {
+    lateTimeoutActive = false;
+  }
+});
+bench('after late timeout', options, common.mustCall((b) => {
+  assert.strictEqual(lateTimeoutActive, false);
+  completeSample(b);
+}));
+
+const signal = AbortSignal.abort(new Error('stop'));
+bench('aborted', { samples: 1, signal }, () => {});
+
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('continues', options, completeSample);
+bench('timeout', { samples: 1, timeout: 10 }, async () => {
+  await new Promise(() => {});
+});
+const suiteCompletion = suite('after unsettled timeout suite', () => {
+  bench('after unsettled timeout', options, common.mustNotCall());
+  bench.skip('skipped after unsettled timeout', options, common.mustNotCall());
+});
+suiteCompletion.then(common.mustCall());
+
+const completions = [];
+const sampleNames = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:sample', (sample) => sampleNames.push(sample.name));
+stream.on('bench:summary', (result) => { summary = result; });
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(completions.length, 16);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 3,
+    failed: 12,
+    skipped: 1,
+    total: 16,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map();
+  for (const result of completions) {
+    const values = byName.get(result.name) ?? [];
+    values.push(result);
+    byName.set(result.name, values);
+  }
+
+  assert.match(byName.get('missing start')[0].error.message,
+               /did not call start/);
+  assert.match(byName.get('missing end')[0].error.message,
+               /did not call end/);
+  assert.match(byName.get('end before start')[0].error.message,
+               /before start/);
+  assert.strictEqual(byName.get('duplicate start')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate end')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid operations')[0].error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('throws')[0].error.message,
+                     'benchmark failure');
+  assert.strictEqual(byName.get('timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('late timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('after late timeout')[0].error, undefined);
+  assert.strictEqual(byName.get('aborted')[0].error.code, 'ABORT_ERR');
+
+  const duplicates = byName.get('duplicate');
+  assert.strictEqual(duplicates[0].error, undefined);
+  assert.match(duplicates[1].error.message, /duplicate benchmark identity/);
+  assert.strictEqual(byName.get('continues')[0].error, undefined);
+  const unsettled = byName.get('after unsettled timeout')[0].error;
+  assert.strictEqual(unsettled.code, 'ABORT_ERR');
+  assert.strictEqual(unsettled.cause.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(
+    byName.get('skipped after unsettled timeout')[0].skip, true);
+  setTimeout(40).then(common.mustCall(() => {
+    assert.strictEqual(sampleNames.includes('late timeout'), false);
+  }));
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-filtering.js b/test/parallel/test-bench-filtering.js
new file mode 100644
index 000000000000..da580dcdafc0
--- /dev/null
+++ b/test/parallel/test-bench-filtering.js
@@ -0,0 +1,61 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+
+const calls = [];
+
+function complete(name) {
+  return (b) => {
+    calls.push(name);
+    completeSample(b);
+  };
+}
+
+suite('selected', { only: true }, () => {
+  bench('included', { samples: 1 }, complete('included'));
+  bench.skip('explicitly skipped', { samples: 1 },
+             common.mustNotCall());
+  bench('pattern filtered', { samples: 1 },
+        common.mustNotCall());
+});
+bench('only filtered', { samples: 1 }, common.mustNotCall());
+
+const results = [];
+const plans = [];
+const namePattern = /^selected (included|explicitly skipped)$/;
+let patternMutated = false;
+const stream = run({ namePattern });
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan);
+  if (!patternMutated) {
+    patternMutated = true;
+    namePattern.compile('only filtered');
+  }
+}, 4));
+stream.on('bench:complete', (result) => results.push(result));
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(calls, ['included']);
+  assert.strictEqual(results.length, 4);
+
+  const byName = new Map(results.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('included').error, undefined);
+  assert.strictEqual(byName.get('explicitly skipped').skip, true);
+  assert.strictEqual(byName.get('pattern filtered').skip, 'name pattern');
+  assert.strictEqual(byName.get('only filtered').skip, 'only');
+  assert.deepStrictEqual(plans.map(({ name, selected, skip }) => ({
+    name,
+    selected,
+    skip,
+  })), [
+    { name: 'included', selected: true, skip: undefined },
+    { name: 'explicitly skipped', selected: false, skip: true },
+    { name: 'pattern filtered', selected: false, skip: 'name pattern' },
+    { name: 'only filtered', selected: false, skip: 'only' },
+  ]);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
new file mode 100644
index 000000000000..4fd6ec739488
--- /dev/null
+++ b/test/parallel/test-bench-harness-errors.js
@@ -0,0 +1,141 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+async function testSynchronousSuiteFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.suite('outer', () => {
+    runner.suite('nested', () => {
+      runner.bench('blocked', { samples: 1 }, common.mustNotCall());
+    });
+    throw new Error('synchronous suite failure');
+  });
+  const records = await runner.run().toArray();
+  await completion;
+  const plan = records.find(
+    ({ type }) => type === 'bench:plan').data;
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'blocked');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(result.name, 'blocked');
+  assert.strictEqual(result.error.message, 'synchronous suite failure');
+}
+
+async function testRunSignal() {
+  const runner = createRunner();
+  const controller = new AbortController();
+  let invocations = 0;
+  let abortPromise;
+  const completion = runner.bench('aborted between samples', {
+    samples: 3,
+  }, (b) => {
+    invocations++;
+    completeSample(b);
+    if (b.index === 0) {
+      abortPromise = setImmediate().then(() => {
+        controller.abort(new Error('run aborted'));
+      });
+    }
+  });
+  await runner.run({ signal: controller.signal }).toArray();
+  const result = await completion;
+  await abortPromise;
+  await setImmediate();
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause.message, 'run aborted');
+  assert.strictEqual(invocations, 1);
+}
+
+async function testRunSignalAfterSample() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const controller = new AbortController();
+  const reason = new Error('sample aborted');
+  const completion = runner.bench('aborted after sample', {
+    samples: 2,
+  }, completeSample);
+  const stream = runner.run({ signal: controller.signal });
+  stream.once('bench:sample', common.mustCall(() => {
+    controller.abort(reason);
+  }));
+  const records = await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, reason);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStringNamePattern() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('included', { samples: 1 }, completeSample);
+  runner.bench('excluded', { samples: 1 }, common.mustNotCall());
+  const records = await runner.run({ namePattern: 'included' }).toArray();
+  const excluded = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'excluded').data;
+  const included = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'included').data;
+  assert.strictEqual(included.error, undefined);
+  assert.strictEqual(included.samples.length, 1);
+  assert.strictEqual(excluded.skip, 'name pattern');
+}
+
+async function testTopLevelRecovery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const suiteCompletion = runner.suite('nested', () => {
+    runner.bench('listener failure', { samples: 1 }, completeSample);
+  });
+  const stream = runner.run();
+  const failure = new Error();
+  failure.message = undefined;
+  stream.on('bench:start', common.mustCall(() => { throw failure; }));
+  const records = await stream.toArray();
+  await suiteCompletion;
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const summary = records.find(({ type }) => type === 'bench:summary').data;
+  assert.strictEqual(diagnostic.message, 'Error');
+  assert.strictEqual(diagnostic.file, undefined);
+  assert.strictEqual(diagnostic.line, undefined);
+  assert.strictEqual(diagnostic.column, undefined);
+  assert.strictEqual(summary.duration_ns, 0n);
+  assert.strictEqual(summary.success, false);
+}
+
+async function testRepeatedReportingFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const original = new Error('start listener failed');
+  const diagnostic = new Error('diagnostic listener failed');
+  const summary = new Error('summary listener failed');
+  const completion = runner.bench('reporting failures', {
+    samples: 1,
+  }, completeSample);
+  const stream = runner.run();
+  stream.on('bench:start', common.mustCall(() => { throw original; }));
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw diagnostic;
+  }, 2));
+  stream.on('bench:summary', common.mustCall(() => { throw summary; }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+  await ended;
+  assert.strictEqual((await completion).error, original);
+}
+
+(async () => {
+  await testSynchronousSuiteFailure();
+  await testRunSignal();
+  await testRunSignalAfterSample();
+  await testStringNamePattern();
+  await testTopLevelRecovery();
+  await testRepeatedReportingFailure();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-hook-errors.js b/test/parallel/test-bench-hook-errors.js
new file mode 100644
index 000000000000..f2977f241deb
--- /dev/null
+++ b/test/parallel/test-bench-hook-errors.js
@@ -0,0 +1,80 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { setImmediate } = require('timers/promises');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+suite('before failure', () => {
+  before(() => { throw new Error('before failure'); });
+  after(common.mustCall());
+  bench('blocked by before', { samples: 1 }, common.mustNotCall());
+});
+
+suite('beforeEach failure', () => {
+  beforeEach(() => { throw new Error('beforeEach failure'); });
+  afterEach(common.mustCall());
+  bench('blocked by beforeEach', { samples: 1 }, common.mustNotCall());
+});
+
+suite('after failure', () => {
+  after(() => { throw new Error('after failure'); });
+  bench('completes before after', { samples: 1 }, completeSample);
+});
+
+suite('build failure', async () => {
+  await setImmediate();
+  throw new Error('build failure');
+});
+
+bench('continues after suite failures', { samples: 1 }, completeSample);
+
+const completions = [];
+const diagnostics = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:diagnostic', (diagnostic) => {
+  diagnostics.push(diagnostic);
+});
+stream.on('bench:summary', (value) => { summary = value; });
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 2,
+    skipped: 0,
+    total: 4,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map(completions.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('blocked by before').error.message,
+                     'before failure');
+  assert.strictEqual(byName.get('blocked by beforeEach').error.message,
+                     'beforeEach failure');
+  assert.strictEqual(byName.get('completes before after').error, undefined);
+  assert.strictEqual(
+    byName.get('continues after suite failures').error, undefined);
+
+  assert.deepStrictEqual(
+    diagnostics.map(({ message }) => message).sort(),
+    ['after failure', 'before failure', 'build failure'],
+  );
+  for (const diagnostic of diagnostics) {
+    assert.strictEqual(typeof diagnostic.file, 'string');
+    assert.strictEqual(typeof diagnostic.line, 'number');
+    assert.strictEqual(typeof diagnostic.column, 'number');
+  }
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-module.mjs b/test/parallel/test-bench-module.mjs
new file mode 100644
index 000000000000..3efe9a1f6151
--- /dev/null
+++ b/test/parallel/test-bench-module.mjs
@@ -0,0 +1,54 @@
+// Flags: --no-warnings
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire, builtinModules, isBuiltin } from 'node:module';
+import benchDefault, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  describe,
+  run,
+  suite,
+} from 'node:bench';
+import { json, spec } from 'node:bench/reporters';
+
+assert.strictEqual(benchDefault, bench);
+assert.strictEqual(describe, suite);
+for (const value of [
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+]) {
+  assert.strictEqual(typeof value, 'function');
+}
+assert.strictEqual(typeof bench.skip, 'function');
+assert.strictEqual(typeof bench.only, 'function');
+assert.strictEqual(typeof json, 'function');
+assert.strictEqual(typeof spec, 'function');
+
+assert.strictEqual(isBuiltin('node:bench'), true);
+assert.strictEqual(isBuiltin('node:bench/reporters'), true);
+assert.strictEqual(isBuiltin('bench'), false);
+assert.strictEqual(isBuiltin('bench/reporters'), false);
+assert.strictEqual(builtinModules.includes('node:bench'), true);
+assert.strictEqual(builtinModules.includes('node:bench/reporters'), true);
+assert.strictEqual(process.getBuiltinModule('node:bench'), benchDefault);
+assert.strictEqual(process.getBuiltinModule('bench'), undefined);
+
+const require = createRequire(import.meta.url);
+const reporters = require('node:bench/reporters');
+assert.strictEqual(reporters.json, json);
+assert.strictEqual(reporters.spec, spec);
+assert.throws(() => require('bench'), { code: 'MODULE_NOT_FOUND' });
+assert.throws(() => require('bench/reporters'), { code: 'MODULE_NOT_FOUND' });
+await assert.rejects(import('bench'), { code: 'ERR_MODULE_NOT_FOUND' });
+await assert.rejects(import('bench/reporters'), {
+  code: 'ERR_MODULE_NOT_FOUND',
+});
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
new file mode 100644
index 000000000000..f383e2cf5213
--- /dev/null
+++ b/test/parallel/test-bench-reporters.js
@@ -0,0 +1,177 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { Readable } = require('stream');
+const { bench, run } = require('node:bench');
+const { json, spec } = require('node:bench/reporters');
+
+bench('json completed', {
+  params: { size: 'small' },
+  samples: 1,
+}, (b) => {
+  completeSample(b);
+});
+
+bench('json failed', { samples: 1 }, () => {
+  const error = new Error('benchmark failed', { cause: 7n });
+  error.code = 'ERR_BENCHMARK_EXAMPLE';
+  throw error;
+});
+
+(async () => {
+  const chunks = await run().compose(json).toArray();
+  const lines = chunks.join('').trim().split('\n');
+  const records = lines.map((line) => JSON.parse(line));
+
+  assert.strictEqual(records.length, 8);
+  const plans = records.filter(({ type }) => type === 'bench:plan');
+  assert.deepStrictEqual(plans.map(({ data }) => data.selected), [true, true]);
+  const sample = records.find(({ type }) => type === 'bench:sample');
+  assert.match(sample.data.duration_ns, /^\d+$/);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const completed = completions.find(
+    ({ data }) => data.name === 'json completed').data;
+  assert.match(completed.samples[0].duration_ns, /^\d+$/);
+
+  const failed = completions.find(
+    ({ data }) => data.name === 'json failed').data;
+  assert.strictEqual(failed.error.name, 'Error');
+  assert.strictEqual(failed.error.message, 'benchmark failed');
+  assert.strictEqual(failed.error.code, 'ERR_BENCHMARK_EXAMPLE');
+  assert.strictEqual(failed.error.cause, '7');
+  assert.match(failed.error.stack, /benchmark failed/);
+
+  const summary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+  assert.match(summary.duration_ns, /^\d+$/);
+  assert.deepStrictEqual(summary.counts, {
+    completed: 1,
+    failed: 1,
+    skipped: 0,
+    total: 2,
+  });
+
+  const synthetic = [
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'fast',
+        params: { size: 'small' },
+        samples: [{}, {}],
+        summary: {
+          mean: 1500,
+          median: 1400,
+          coefficientOfVariation: 0.1,
+          confidenceInterval: { lower: 1000, upper: 2000 },
+          skewness: 2,
+        },
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'later',
+        params: {},
+        samples: [],
+        skip: 'not supported',
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'broken',
+        params: {},
+        samples: [],
+        error: new Error('boom'),
+      },
+    },
+    {
+      type: 'bench:diagnostic',
+      data: { message: 'suite problem' },
+    },
+    {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 1, failed: 1, skipped: 1, total: 3 },
+      },
+    },
+  ];
+  const specChunks = await Readable.from(synthetic).compose(spec).toArray();
+  assert.strictEqual(specChunks.join(''),
+                     'benchmark | samples | mean rate | 95% CI | ' +
+                     'median rate | warning\n' +
+                     'fast [size="small"] | 2 | 1.50k ops/s | ' +
+                     '[1.00k ops/s, 2.00k ops/s] | 1.40k ops/s | ' +
+                     'noisy, skewed\n' +
+                     'later | 0 | - | - | - | skipped: not supported\n' +
+                     'broken | 0 | - | - | - | error: boom\n' +
+                     'diagnostic: suite problem\n\n' +
+                     '1 completed, 1 failed, 1 skipped\n');
+
+  const circular = {};
+  circular.self = circular;
+  const aggregate = new AggregateError([1n], 'aggregate failure');
+  const jsonEdgeChunks = await Readable.from([{
+    type: 'bench:diagnostic',
+    data: { aggregate, circular },
+  }]).compose(json).toArray();
+  const jsonEdge = JSON.parse(jsonEdgeChunks.join(''));
+  assert.deepStrictEqual(jsonEdge.data.aggregate.errors, ['1']);
+  assert.strictEqual(jsonEdge.data.circular.self, '[Circular]');
+
+  async function* undefinedRecord() {
+    yield undefined;
+  }
+  const undefinedChunks = [];
+  for await (const chunk of json(undefinedRecord())) {
+    undefinedChunks.push(chunk);
+  }
+  assert.strictEqual(undefinedChunks.join(''), 'null\n');
+
+  function result(name, rate) {
+    return {
+      type: 'bench:complete',
+      data: {
+        name,
+        params: {},
+        samples: [{}],
+        summary: {
+          mean: rate,
+          median: rate,
+          coefficientOfVariation: 0,
+          confidenceInterval: { lower: rate, upper: rate },
+          skewness: 0,
+        },
+      },
+    };
+  }
+
+  const specEdgeChunks = await Readable.from([
+    result('giga', 1_500_000_000),
+    result('mega', 1_500_000),
+    result('fractional', 0.5),
+    {
+      type: 'bench:complete',
+      data: { name: 'skip', params: {}, samples: [], skip: true },
+    },
+    {
+      type: 'bench:complete',
+      data: { name: 'error', params: {}, samples: [], error: 'failure' },
+    },
+  ]).compose(spec).toArray();
+  const specEdgeOutput = specEdgeChunks.join('');
+  assert.match(specEdgeOutput, /giga \| 1 \| 1\.50G ops\/s/);
+  assert.match(specEdgeOutput, /mega \| 1 \| 1\.50M ops\/s/);
+  assert.match(specEdgeOutput, /fractional \| 1 \| 0\.500 ops\/s/);
+  assert.match(specEdgeOutput, /skip \| 0 \| - \| - \| - \| skipped\n/);
+  assert.match(specEdgeOutput,
+               /error \| 0 \| - \| - \| - \| error: failure/);
+
+  const emptySpecChunks = await Readable.from([]).compose(spec).toArray();
+  assert.deepStrictEqual(emptySpecChunks, []);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-file.js b/test/parallel/test-bench-run-file.js
new file mode 100644
index 000000000000..ec0265ab162c
--- /dev/null
+++ b/test/parallel/test-bench-run-file.js
@@ -0,0 +1,430 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { once } = require('events');
+const path = require('path');
+const { runFile } = require('node:bench');
+
+const fixture = fixtures.path('bench-runner/run-file.cjs');
+const relativeFixture = path.relative(process.cwd(), fixture);
+
+assert.throws(() => runFile(null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, { execArgv: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [1] }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--bench'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [fixture] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e', '0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require', ''] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require='] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [`-r=${fixture}`] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof-process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof_process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, {
+  execArgv: ['--bench_name_pattern=run'],
+}), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => runFile(`${fixture}\0`), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(Buffer.from(`${fixture}\0`)), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 'x\0' } }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: { NODE_CHANNEL_FD: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: {} }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: { aborted: false } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+
+async function testRunFile() {
+  const execArgv = ['--expose-gc', '--no-warnings', '-r', 'fs'];
+  const env = {
+    __proto__: null,
+    ...process.env,
+    NODE_BENCH_CONTEXT: 'not-a-child',
+    NODE_BENCH_OMITTED: undefined,
+    NODE_BENCH_RUN_FILE: 'original',
+    NODE_CHANNEL_FD: '999',
+    NODE_CHANNEL_SERIALIZATION_MODE: 'json',
+  };
+  const stream = runFile(relativeFixture, { env, execArgv });
+  execArgv.length = 0;
+  env.NODE_BENCH_RUN_FILE = 'mutated';
+  const records = await stream.toArray();
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const result = records.find(({ type }) => type === 'bench:complete').data;
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(plan.params.context, 'child');
+  assert.strictEqual(plan.params.exposed, true);
+  assert.strictEqual(plan.params.omitted, true);
+  assert.strictEqual(plan.params.value, 'original');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(typeof result.samples[0].duration_ns, 'bigint');
+  assert.notStrictEqual(result.samples[0].detail.pid, process.pid);
+  assert(result.samples[0].detail.execArgv.includes('--expose-gc'));
+  assert(result.samples[0].detail.execArgv.includes('--no-warnings'));
+  assert(result.samples[0].detail.execArgv.includes('-r'));
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(summary.file, fixture);
+  assert.strictEqual(summary.entryFile, fixture);
+  assert.strictEqual(summary.fileRunId, result.fileRunId);
+  assert.strictEqual(summary.runId, result.runId);
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:summary').length, 1);
+}
+
+async function testConcurrentCalls() {
+  const [cjsRecords, esmRecords] = await Promise.all([
+    runFile(fixtures.fileURL('bench-runner/a.cjs')).toArray(),
+    runFile(Buffer.from(path.relative(
+      process.cwd(),
+      fixtures.path('bench-runner/b.mjs'),
+    ))).toArray(),
+  ]);
+  const cjsResult = cjsRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  const esmResult = esmRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(cjsResult.name, 'alpha');
+  assert.strictEqual(esmResult.name, 'beta');
+  assert.notStrictEqual(cjsResult.params.pid, esmResult.params.pid);
+  assert.notStrictEqual(cjsResult.runId, esmResult.runId);
+  assert.strictEqual(
+    cjsRecords.at(-1).data.file,
+    fixtures.path('bench-runner/a.cjs'),
+  );
+  assert.strictEqual(
+    esmRecords.at(-1).data.file,
+    fixtures.path('bench-runner/b.mjs'),
+  );
+}
+
+async function testLoadFailure() {
+  const missing = path.resolve(fixtures.fixturesDir, 'does-not-exist.cjs');
+  const records = await runFile(missing).toArray();
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => data.level === 'error' && /failed with exit code/.test(
+      data.message)));
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testEvaluationFailure() {
+  const records = await runFile(fixtures.path(
+    'bench-runner/load-error-after-declaration.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.name, 'declared before load error');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStructuredError() {
+  const records = await runFile(
+    fixtures.path('bench-runner/error.cjs')).toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(result.error.cause, { value: 42n });
+  assert.match(result.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testAbort() {
+  const controller = new AbortController();
+  const reason = new Error('cancel run file');
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'),
+    { signal: controller.signal });
+  stream.once('bench:start', common.mustCall(() => controller.abort(reason)));
+  const records = await stream.toArray();
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR').data;
+  assert.strictEqual(diagnostic.error.cause.message, reason.message);
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+  assert.deepStrictEqual(records.at(-1).data.counts, {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 1,
+  });
+}
+
+async function testPartialAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-partial.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:start', ({ name }) => {
+    if (name === 'aborted run file') controller.abort();
+  });
+  const records = await stream.toArray();
+  const summary = records.at(-1).data;
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').length, 1);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 1,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+  assert.strictEqual(summary.success, false);
+}
+
+async function testPostSummaryAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-lingering.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:diagnostic', common.mustCall(({ message, stream }) => {
+    if (stream === 'stdout' && /child disconnected/.test(message)) {
+      controller.abort(new Error('stop lingering child'));
+    }
+  }, 2));
+  const records = await stream.toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR'));
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testExitCode() {
+  const records = await runFile(
+    fixtures.path('bench-runner/exit-code.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testParentExitCode() {
+  process.exitCode = 42;
+  try {
+    const records = await runFile(fixture).toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.exitCode = undefined;
+  }
+}
+
+async function testDefaultExecArgvSnapshot() {
+  const original = Array.from(process.execArgv);
+  try {
+    process.execArgv.push('--bench', '--eval', 'throw new Error()');
+    const stream = runFile(fixture);
+    process.execArgv.push('--require=/does/not/exist.cjs');
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execArgv.length = 0;
+    process.execArgv.push(...original);
+  }
+}
+
+async function testExecPathSnapshot() {
+  const stream = runFile(fixture);
+  const execPath = process.execPath;
+  process.execPath = '/does/not/exist';
+  try {
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execPath = execPath;
+  }
+}
+
+async function testSpawnFailure() {
+  const execPath = process.execPath;
+  let stream;
+  try {
+    process.execPath = fixtures.path('does-not-exist-node');
+    stream = runFile(fixture);
+  } finally {
+    process.execPath = execPath;
+  }
+  const records = await stream.toArray();
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.error.code, 'ENOENT');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+function testEvalParent() {
+  const script = `
+    require('node:bench').runFile(${JSON.stringify(fixture)})
+      .on('bench:summary', (summary) => console.log(summary.success));
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '-e',
+    script,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stdout, 'true\n');
+}
+
+function testPermissions() {
+  const fsReadScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const { pathToFileURL } = require('url');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('child'), true);
+    assert.strictEqual(process.permission.has('fs.read', target), false);
+    Promise.all([
+      target,
+      Buffer.from(target),
+      pathToFileURL(target),
+    ].map(async (input) => {
+      const records = await runFile(input).toArray();
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'FileSystemRead');
+      assert.strictEqual(diagnostic.data.error.resource, target);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    })).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--permission',
+    '--allow-child-process',
+    '-e',
+    fsReadScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+
+  const childProcessScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('fs.read', target), true);
+    assert.strictEqual(process.permission.has('child'), false);
+    runFile(target).toArray().then((records) => {
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'ChildProcess');
+      assert.strictEqual(diagnostic.data.error.resource, process.execPath);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    }).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const childProcessResult = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--permission',
+    `--allow-fs-read=${fixture}`,
+    '-e',
+    childProcessScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(
+    childProcessResult.status,
+    0,
+    childProcessResult.stderr,
+  );
+}
+
+async function testPreAborted() {
+  const records = await runFile(fixture, {
+    signal: AbortSignal.abort(new Error('already cancelled')),
+  }).toArray();
+  assert.strictEqual(records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(records.find(({ type }) =>
+    type === 'bench:diagnostic').data.error.code, 'ABORT_ERR');
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testDestroy() {
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'));
+  stream.once('bench:start', common.mustCall(() => stream.destroy()));
+  await once(stream, 'close');
+  assert.strictEqual(stream.destroyed, true);
+}
+
+(async () => {
+  await testRunFile();
+  await testConcurrentCalls();
+  await testLoadFailure();
+  await testEvaluationFailure();
+  await testStructuredError();
+  await testAbort();
+  await testPartialAbort();
+  await testPostSummaryAbort();
+  await testExitCode();
+  await testParentExitCode();
+  await testDefaultExecArgvSnapshot();
+  await testExecPathSnapshot();
+  await testSpawnFailure();
+  await testPreAborted();
+  await testDestroy();
+  testEvalParent();
+  testPermissions();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-options.js b/test/parallel/test-bench-run-options.js
new file mode 100644
index 000000000000..bbb89f5fdc99
--- /dev/null
+++ b/test/parallel/test-bench-run-options.js
@@ -0,0 +1,47 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run } = require('node:bench');
+
+let invocations = 0;
+const timeout = common.platformTimeout(1000);
+bench('overridden', { samples: 8, timeout, warmup: 8 }, (b) => {
+  invocations++;
+  completeSample(b, invocations);
+});
+
+const plans = [];
+const samples = [];
+const types = [];
+const stream = run({
+  samples: 2,
+  warmup: 3,
+  yieldBetweenSamples: false,
+});
+stream.on('bench:plan', (plan) => plans.push(plan));
+stream.on('bench:sample', ({ operations }) => samples.push(operations));
+stream.on('data', ({ type }) => types.push(type));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(plans.length, 1);
+  assert.deepStrictEqual({
+    samples: plans[0].samples,
+    selected: plans[0].selected,
+    skip: plans[0].skip,
+    timeout: plans[0].timeout,
+    warmup: plans[0].warmup,
+    yieldBetweenSamples: plans[0].yieldBetweenSamples,
+  }, {
+    samples: 2,
+    selected: true,
+    skip: undefined,
+    timeout,
+    warmup: 3,
+    yieldBetweenSamples: false,
+  });
+  assert.deepStrictEqual(samples, [4, 5]);
+  assert.deepStrictEqual(types.slice(0, 2), ['bench:plan', 'bench:start']);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
new file mode 100644
index 000000000000..e79411f83e1d
--- /dev/null
+++ b/test/parallel/test-bench-run.js
@@ -0,0 +1,143 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { setImmediate } = require('timers/promises');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+const calls = [];
+const contexts = new Set();
+let active = false;
+
+before(() => calls.push('root before'));
+after(() => calls.push('root after'));
+beforeEach(() => calls.push('root beforeEach'));
+afterEach(() => calls.push('root afterEach'));
+
+const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
+  await setImmediate();
+
+  before(() => calls.push('suite before'));
+  after(() => calls.push('suite after'));
+  beforeEach(() => calls.push('suite beforeEach'));
+  afterEach(() => calls.push('suite afterEach'));
+
+  bench('sync', {
+    params: { z: 2, a: true },
+    samples: 2,
+    tags: ['SYNC'],
+    warmup: 1,
+  }, common.mustCall((b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('sync sample');
+    assert.deepStrictEqual(b.params, { __proto__: null, a: true, z: 2 });
+    completeSample(b);
+    active = false;
+  }, 3));
+
+  bench('async', { samples: 2 }, common.mustCall(async (b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('async sample');
+    await setImmediate();
+    completeSample(b);
+    await setImmediate();
+    active = false;
+  }, 2));
+
+  bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+});
+
+const records = [];
+const plans = [];
+const stream = run();
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan.name);
+}, 3));
+stream.on('data', (record) => records.push(record));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(active, false);
+  assert.strictEqual(contexts.size, 5);
+
+  const starts = records.filter(({ type }) => type === 'bench:start');
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  const completions = records.filter(({ type }) => type === 'bench:complete');
+  const summaries = records.filter(({ type }) => type === 'bench:summary');
+
+  assert.strictEqual(starts.length, 2);
+  assert.strictEqual(samples.length, 4);
+  assert.strictEqual(completions.length, 3);
+  assert.strictEqual(summaries.length, 1);
+  assert.deepStrictEqual(plans, ['sync', 'async', 'skipped']);
+
+  const sync = completions.find(({ data }) => data.name === 'sync').data;
+  assert.strictEqual(sync.error, undefined);
+  assert.strictEqual(sync.skip, undefined);
+  assert.strictEqual(sync.samples.length, 2);
+  assert.strictEqual(Object.getPrototypeOf(sync), null);
+  assert.strictEqual(Object.getPrototypeOf(sync.params), null);
+  assert.deepStrictEqual(sync.tags, ['group', 'sync']);
+  assert.match(sync.benchId, /\{"a":true,"z":2\}/);
+  assert.notStrictEqual(sync.parentId, null);
+  assert.strictEqual(sync.summary.mean > 0, true);
+  assert.strictEqual(sync.summary.min <= sync.summary.mean, true);
+  assert.strictEqual(sync.summary.mean <= sync.summary.max, true);
+  assert.strictEqual(typeof sync.summary.confidenceInterval.lower, 'number');
+  assert.strictEqual(typeof sync.samples[0].duration_ns, 'bigint');
+
+  const asyncResult = completions.find(
+    ({ data }) => data.name === 'async').data;
+  assert.strictEqual(asyncResult.error, undefined);
+  assert.strictEqual(asyncResult.skip, undefined);
+  assert.strictEqual(asyncResult.samples.length, 2);
+
+  const skipped = completions.find(
+    ({ data }) => data.name === 'skipped').data;
+  assert.strictEqual(skipped.skip, true);
+  assert.deepStrictEqual(skipped.samples, []);
+
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 0,
+    skipped: 1,
+    total: 3,
+  });
+  assert.strictEqual(summaries[0].data.success, true);
+
+  assert.deepStrictEqual(calls, [
+    'root before',
+    'suite before',
+    'root beforeEach',
+    'suite beforeEach',
+    'sync sample',
+    'sync sample',
+    'sync sample',
+    'suite afterEach',
+    'root afterEach',
+    'root beforeEach',
+    'suite beforeEach',
+    'async sample',
+    'async sample',
+    'suite afterEach',
+    'root afterEach',
+    'suite after',
+    'root after',
+  ]);
+}));
+
+suiteCompletion.then(common.mustCall());
diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
new file mode 100644
index 000000000000..9a9eff7b2369
--- /dev/null
+++ b/test/parallel/test-bench-stream.js
@@ -0,0 +1,382 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate, setTimeout } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    operations: 1,
+    duration_ns: 1n,
+  });
+}
+
+async function testReadableBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('bounded stream', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert(calls < sampleCount);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  const result = await completion;
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(records[1].type, 'bench:start');
+  assert.strictEqual(records.length, sampleCount + 4);
+}
+
+async function testPlanBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const benchmarkCount = 32;
+  const completions = [];
+  let calls = 0;
+  for (let i = 0; i < benchmarkCount; i++) {
+    completions.push(runner.bench(`planned ${i}`, { samples: 1 }, (b) => {
+      calls++;
+      recordSample(b);
+    }));
+  }
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert.strictEqual(calls, 0);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  await Promise.all(completions);
+  assert.strictEqual(calls, benchmarkCount);
+  assert.strictEqual(
+    records.slice(0, benchmarkCount).every(({ type }) => type === 'bench:plan'),
+    true,
+  );
+}
+
+async function testDestroyWhileBlocked() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completions = [];
+  for (let i = 0; i < 32; i++) {
+    completions.push(runner.bench(`destroyed ${i}`, {
+      samples: 1,
+    }, recordSample));
+  }
+  const stream = runner.run();
+  const unblocked = stream.waitForDrain();
+  const iterator = stream[Symbol.asyncIterator]();
+  await iterator.next();
+  await unblocked;
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+
+  const draining = stream.waitForDrain();
+  const closed = new Promise((resolve) => stream.once('close', resolve));
+  stream.destroy();
+  await assert.rejects(draining, { code: 'ERR_INVALID_STATE' });
+  await assert.rejects(stream.waitForDrain(), { code: 'ERR_INVALID_STATE' });
+  await closed;
+  await Promise.all(completions);
+}
+
+async function testNamedEventsWithoutReading() {
+  const runner = createRunner();
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('named events', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const summary = await new Promise((resolve) => {
+    stream.once('bench:summary', resolve);
+  });
+  const result = await completion;
+
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(stream.readableLength, sampleCount + 4);
+  assert(stream.readableLength > stream.readableHighWaterMark);
+  stream.destroy();
+}
+
+async function testCancellationCompletesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const first = runner.bench('cancelled stream', { samples: 64 }, recordSample);
+  const second = runner.bench('continues headlessly', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await iterator.return();
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].samples.length, 64);
+  assert.strictEqual(results[1].samples.length, 1);
+}
+
+async function testDeliveryDoesNotConsumeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.bench('slow consumer', {
+    samples: 32,
+    timeout: common.platformTimeout(20),
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await setTimeout(common.platformTimeout(50));
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+  }
+
+  const result = await completion;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 32);
+}
+
+async function testReportingFailureSettlesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('record listener failed');
+  const first = runner.bench('reported', { samples: 1 }, recordSample);
+  const second = runner.bench('settled', { samples: 1 }, recordSample);
+  const stream = runner.run();
+  stream.once('bench:complete', common.mustCall(() => {
+    throw failure;
+  }));
+  stream.resume();
+
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].error, undefined);
+  assert.strictEqual(results[1].error, failure);
+  await setImmediate();
+}
+
+async function testSummaryListenerFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('summary listener failed');
+  const completion = runner.bench('summary failure', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const diagnostics = [];
+  stream.on('bench:diagnostic', (diagnostic) => {
+    diagnostics.push(diagnostic);
+  });
+  stream.once('bench:summary', common.mustCall(() => {
+    throw failure;
+  }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+
+  const result = await completion;
+  await ended;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(diagnostics.length, 1);
+  assert.strictEqual(diagnostics[0].error.message, failure.message);
+}
+
+async function testRecordOwnership() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const expectedError = new Error('expected failure');
+  expectedError.code = 'ERR_EXPECTED';
+  expectedError.cause = expectedError;
+  expectedError.uncloneable = new WeakMap();
+  expectedError.context = {
+    note: 'preserved',
+    callback() {},
+    get accessor() { return 'value'; },
+  };
+  expectedError.customContext = {
+    __proto__: {},
+    note: 'preserved',
+  };
+  expectedError.arrayPayload = [new WeakMap()];
+  const innerError = new Error('inner failure');
+  innerError.code = 'ERR_INNER';
+  const aggregate = new AggregateError([innerError], 'aggregate failure');
+  aggregate.code = 'ERR_AGGREGATE';
+  const causedError = new Error('caused failure', { cause: aggregate });
+  causedError.references = new Map([['self', causedError]]);
+  causedError.members = new Set([causedError]);
+  const measured = runner.bench('owned result', {
+    params: { kind: 'original' },
+    samples: 1,
+  }, (b) => {
+    b.record({
+      __proto__: null,
+      operations: 1,
+      duration_ns: 1n,
+      detail: { value: 'original' },
+    });
+  });
+  const failed = runner.bench('owned error', { samples: 1 }, () => {
+    throw expectedError;
+  });
+  const caused = runner.bench('owned cause', { samples: 1 }, () => {
+    throw causedError;
+  });
+  const throwingNameError = new Error('throwing name');
+  Object.defineProperty(throwingNameError, 'name', {
+    configurable: true,
+    get() { throw new Error('name getter'); },
+  });
+  const throwingName = runner.bench('throwing name', {
+    samples: 1,
+  }, () => {
+    throw throwingNameError;
+  });
+  const thrownValue = new WeakMap();
+  const uncloneable = runner.bench('uncloneable error', {
+    samples: 1,
+  }, () => {
+    throw thrownValue;
+  });
+  const proxyError = new Proxy({}, {
+    getPrototypeOf() {
+      throw new Error('prototype trap');
+    },
+  });
+  const trapped = runner.bench('trapping error', { samples: 1 }, () => {
+    throw proxyError;
+  });
+  const afterTrap = runner.bench('after trapping error', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  let eventSample;
+  let eventComplete;
+  let eventError;
+  let eventSummary;
+
+  stream.on('bench:sample', (sample) => {
+    if (sample.name !== 'owned result') return;
+    eventSample = sample;
+    sample.name = 'changed by event';
+    sample.detail.value = 'changed by event';
+  });
+  stream.on('bench:complete', (result) => {
+    if (result.name === 'owned result') {
+      eventComplete = result;
+      result.params.kind = 'changed by event';
+      result.samples[0].detail.value = 'changed by event';
+    } else if (result.name === 'owned error') {
+      eventError = result.error;
+      result.error.code = 'ERR_CHANGED';
+    }
+  });
+  stream.on('bench:summary', (summary) => {
+    eventSummary = summary;
+    summary.counts.total = 100;
+  });
+
+  const records = await stream.toArray();
+  const measuredResult = await measured;
+  const failedResult = await failed;
+  await caused;
+  const throwingNameResult = await throwingName;
+  const uncloneableResult = await uncloneable;
+  const trappedResult = await trapped;
+  const afterTrapResult = await afterTrap;
+  const streamSample = records.find(
+    ({ type }) => type === 'bench:sample').data;
+  const streamResults = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const streamMeasured = streamResults.find(
+    ({ name }) => name === 'owned result');
+  const streamFailed = streamResults.find(
+    ({ name }) => name === 'owned error');
+  const streamCaused = streamResults.find(
+    ({ name }) => name === 'owned cause');
+  const streamThrowingName = streamResults.find(
+    ({ name }) => name === 'throwing name');
+  const streamSummary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+
+  assert.notStrictEqual(eventSample, streamSample);
+  assert.notStrictEqual(eventComplete, streamMeasured);
+  assert.notStrictEqual(streamMeasured, measuredResult);
+  assert.strictEqual(streamSample.name, 'owned result');
+  assert.strictEqual(streamSample.detail.value, 'original');
+  assert.strictEqual(streamMeasured.params.kind, 'original');
+  assert.strictEqual(streamMeasured.samples[0].detail.value, 'original');
+  assert.strictEqual(measuredResult.params.kind, 'original');
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+
+  streamMeasured.samples[0].detail.value = 'changed by stream';
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+  assert.notStrictEqual(eventError, streamFailed.error);
+  assert.notStrictEqual(streamFailed.error, expectedError);
+  assert.strictEqual(streamFailed.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(streamFailed.error.cause, streamFailed.error);
+  assert.strictEqual(streamFailed.error.context.note, 'preserved');
+  assert.strictEqual(streamFailed.error.context.callback, undefined);
+  assert.strictEqual(streamFailed.error.context.accessor, undefined);
+  assert.strictEqual(streamFailed.error.customContext.note, 'preserved');
+  assert.deepStrictEqual(streamFailed.error.arrayPayload, [undefined]);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(failedResult.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(failedResult.error.cause, failedResult.error);
+  assert.strictEqual(uncloneableResult.error, thrownValue);
+  assert.strictEqual(trappedResult.error, proxyError);
+  assert.strictEqual(afterTrapResult.error, undefined);
+  assert.strictEqual(throwingNameResult.error, throwingNameError);
+  assert.strictEqual(streamThrowingName.error.name, 'Error');
+  assert.strictEqual(streamThrowingName.error.message, 'throwing name');
+  assert(streamCaused.error.cause instanceof AggregateError);
+  assert.strictEqual(streamCaused.error.cause.name, 'AggregateError');
+  assert.strictEqual(streamCaused.error.cause.code, 'ERR_AGGREGATE');
+  assert.strictEqual(streamCaused.error.cause.errors[0].code, 'ERR_INNER');
+  assert.strictEqual(
+    streamCaused.error.references.get('self'), streamCaused.error);
+  assert.strictEqual(streamCaused.error.members.has(streamCaused.error), true);
+  assert.notStrictEqual(eventSummary, streamSummary);
+  assert.strictEqual(streamSummary.counts.total, 7);
+}
+
+(async () => {
+  await testReadableBackpressure();
+  await testPlanBackpressure();
+  await testDestroyWhileBlocked();
+  await testNamedEventsWithoutReading();
+  await testCancellationCompletesBenchmarks();
+  await testDeliveryDoesNotConsumeTimeout();
+  await testReportingFailureSettlesBenchmarks();
+  await testSummaryListenerFailure();
+  await testRecordOwnership();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
new file mode 100644
index 000000000000..39edc5d411cc
--- /dev/null
+++ b/test/parallel/test-bench-validation.js
@@ -0,0 +1,80 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, createRunner, run } = require('node:bench');
+
+const noop = () => {};
+let functionOverloadCalls = 0;
+let objectOverloadCalls = 0;
+
+function functionOverload(b) {
+  functionOverloadCalls++;
+  completeSample(b);
+  b.done();
+}
+
+function objectOverload(b) {
+  objectOverloadCalls++;
+  completeSample(b);
+}
+
+assert.throws(() => bench('', noop), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { samples: 0 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { warmup: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { timeout: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { signal: {} }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: 'channel' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: [1] }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: 'fast' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: [''] }, noop),
+              { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', { params: { value: null } }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { params: { value: NaN } }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { only: 'yes' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { skip: 1 }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ namePattern: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ samples: 0 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ warmup: -1 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner(null),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: null }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+
+bench(functionOverload);
+bench({ samples: 1 }, objectOverload);
+
+bench('valid', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+
+const stream = run();
+stream.on('bench:start', common.mustCall(() => {
+  assert.throws(() => bench('late', noop), { code: 'ERR_INVALID_STATE' });
+}, 3));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(functionOverloadCalls, 1);
+  assert.strictEqual(objectOverloadCalls, 1);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-yield-between-samples.js b/test/parallel/test-bench-yield-between-samples.js
new file mode 100644
index 000000000000..aceb381d1a57
--- /dev/null
+++ b/test/parallel/test-bench-yield-between-samples.js
@@ -0,0 +1,76 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+async function observe(factoryOptions, runOptions) {
+  const runner = createRunner(factoryOptions);
+  const observed = [];
+  let turnOccurred = false;
+  const turn = setImmediate().then(() => {
+    turnOccurred = true;
+  });
+
+  runner.bench('yielding', { samples: 2 }, (b) => {
+    observed.push(turnOccurred);
+    completeSample(b);
+  });
+
+  await runner.run(runOptions).toArray();
+  await turn;
+  return observed;
+}
+
+async function observeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let invocations = 0;
+  const completion = runner.bench('timeout', {
+    samples: 10,
+    timeout: 5,
+  }, (b) => {
+    invocations++;
+    const until = process.hrtime.bigint() + 2_000_000n;
+    b.start();
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+    b.end(1);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(invocations < 10, true);
+}
+
+async function observeAfterEachTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.afterEach(common.mustCall(() => {
+    const until = process.hrtime.bigint() + 10_000_000n;
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+  }));
+  const completion = runner.bench('afterEach timeout', {
+    samples: 1,
+    timeout: 5,
+  }, (b) => {
+    completeSample(b);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+}
+
+(async () => {
+  assert.deepStrictEqual(await observe(undefined, undefined), [false, true]);
+  assert.deepStrictEqual(
+    await observe({ yieldBetweenSamples: false }, undefined), [false, false]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: false },
+    { yieldBetweenSamples: true }), [false, true]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: true },
+    { yieldBetweenSamples: false }), [false, false]);
+  await observeTimeout();
+  await observeAfterEachTimeout();
+})().then(common.mustCall());
diff --git a/test/parallel/test-benchmark-node-bench-tools.js b/test/parallel/test-benchmark-node-bench-tools.js
new file mode 100644
index 000000000000..3d248b45c0e3
--- /dev/null
+++ b/test/parallel/test-benchmark-node-bench-tools.js
@@ -0,0 +1,305 @@
+// Flags: --no-warnings
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+} = require('../../benchmark/_node-bench-analysis.js');
+const { csvEncode } = require('../../benchmark/_node-bench.js');
+
+const compare = path.resolve(__dirname, '../../benchmark/compare-node-bench.js');
+const legacyScatter = path.resolve(__dirname, '../../benchmark/scatter.js');
+const scatter = path.resolve(__dirname, '../../benchmark/scatter-node-bench.js');
+const benchmark = fixtures.path('bench-runner/tools.cjs');
+
+tmpdir.refresh();
+
+assert.strictEqual(csvEncode(true), 'true');
+assert.deepStrictEqual(holmAdjust([0.01, 0.03, 0.04]), [0.03, 0.06, 0.06]);
+assert.strictEqual(isRegressionFailure({
+  ci95: 3,
+  improvement: -12,
+  pThresholdAdjusted: 0.01,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pThresholdAdjusted: 0.06,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pThresholdAdjusted: 0.01,
+}, 10), true);
+
+function comparisonSamples(oldRates, newRates) {
+  const create = (binary, rate) => ({
+    binary,
+    configuration: '',
+    identity: 'comparison',
+    name: 'comparison',
+    rate,
+  });
+  return [
+    ...oldRates.map((rate) => create('old', rate)),
+    ...newRates.map((rate) => create('new', rate)),
+  ];
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [48, 49, 50, 50, 51, 52],
+  ), 1000, 0);
+  assert.strictEqual(result.failed, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted < 0.05, true);
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [93, 94, 95, 95, 96, 97],
+  ), 1000, 10);
+  assert.strictEqual(result.rows[0].pAdjusted < 0.05, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted > 0.05, true);
+  assert.strictEqual(result.failed, false);
+}
+assert.throws(
+  () => analyzeScatter([{
+    observation: 0,
+    params: { size: 1 },
+    rate: 1,
+  }], 'size', 'size', false),
+  /must name different parameters/,
+);
+assert.doesNotMatch(analyzeScatter([0, 1].map((observation) => ({
+  observation,
+  params: { size: 1 },
+  rate: 1_234_567.89,
+})), 'size', undefined, false), /\(!\)/);
+assert.match(analyzeScatter([
+  { observation: 0, params: { method: 'a', size: 1 }, rate: 10 },
+  { observation: 0, params: { method: 'b', size: 1 }, rate: 20 },
+  { observation: 1, params: { method: 'a', size: 1 }, rate: 30 },
+  { observation: 1, params: { method: 'b', size: 1 }, rate: 50 },
+], 'size', undefined, false), /\n\s*1\s+2\s+/);
+
+function run(script, args, options = undefined) {
+  return spawnSync(process.execPath, [script, ...args], {
+    encoding: 'utf8',
+    timeout: 30_000,
+    ...options,
+  });
+}
+
+{
+  const pidLog = tmpdir.resolve('pids');
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_PID_LOG: pidLog },
+  });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"binary","filename","configuration","rate","time"');
+  assert.strictEqual(lines.length, 9);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"old",')).length,
+                     4);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"new",')).length,
+                     4);
+  assert.deepStrictEqual(lines.slice(1).map((line) => line.slice(0, 5)), [
+    '"old"', '"old"', '"new"', '"new"',
+    '"new"', '"new"', '"old"', '"old"',
+  ]);
+  assert(lines.slice(1).every(
+    (line) => line.includes('"tools/simple.js"')));
+  const pids = fs.readFileSync(pidLog, 'utf8').trim().split('\n');
+  assert.strictEqual(new Set(pids).size, 4);
+}
+
+{
+  const result = run(scatter, [
+    '--node', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"filename","method","size","rate","time"');
+  assert.strictEqual(lines.length, 5);
+  assert(lines.slice(1).every(
+    (line) => line.startsWith('"tools/simple.js","loop",')));
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0], '"filename","rate","time"');
+  assert.strictEqual(lines.length, 2);
+  assert.strictEqual(lines[1].split(',').length, 3);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-reserved-param.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /parameter 'rate' is reserved/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /requires one logical benchmark name per file/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /Distinct benchmarks would share the CSV group/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--', fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /set of reported benchmarks changed between runs/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--name-pattern', 'missing',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /No benchmark samples were produced/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', 'invalid',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--runs must be an integer/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--analyze',
+    '--xaxis', 'size',
+    '--category', 'method',
+    '--no-chart',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout,
+               /size\s+method\s+samples\s+rate\s+confidence\.interval/);
+  assert.match(result.stdout, /Change between consecutive size values/);
+  assert.match(result.stdout, /Mann-Whitney U.*Cliff's delta/);
+  assert.doesNotMatch(result.stdout, /"filename","method"/);
+}
+
+{
+  const result = run(scatter, [
+    '--analyze',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--analyze requires --xaxis/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--max-regression', '100',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /Holm-Bonferroni correction/);
+  assert.match(result.stdout, /one-sided p-values against the 100% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--max-regression', '0',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /one-sided p-values against the 0% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const benchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/buffer-compare-offset.js');
+  const nodeBenchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/_buffer-compare-offset.node-bench.js');
+  const legacy = run(legacyScatter, [
+    '--runs', '1',
+    benchmark,
+  ]);
+  const modern = run(scatter, [
+    '--runs', '1',
+    '--', nodeBenchmark,
+  ]);
+  assert.strictEqual(legacy.status, 0, legacy.stderr);
+  assert.strictEqual(modern.status, 0, modern.stderr);
+  const legacyLines = legacy.stdout.trim().split('\n');
+  const modernLines = modern.stdout.trim().split('\n');
+  assert.deepStrictEqual(
+    legacyLines[0].replaceAll(' ', '').split(',').sort(),
+    modernLines[0].split(',').sort(),
+  );
+  assert.strictEqual(modernLines[0],
+                     '"filename","method","n","size","rate","time"');
+  assert.strictEqual(legacyLines.length, 9);
+  assert.strictEqual(modernLines.length, 9);
+  const name = path.join('buffers', 'buffer-compare-offset.js');
+  assert(legacyLines[1].startsWith(`"${name}",`));
+  assert(modernLines[1].startsWith(`"${name}",`));
+}
diff --git a/test/parallel/test-blob-file-backed.js b/test/parallel/test-blob-file-backed.js
index f94eae6d6ed7..c5a5ce14807d 100644
--- a/test/parallel/test-blob-file-backed.js
+++ b/test/parallel/test-blob-file-backed.js
@@ -129,6 +129,19 @@ writeFileSync(testfile5, '');
   await unlink(testfile5);
 })().then(common.mustCall());
 
+(async () => {
+  // A path that cannot be stat'd reports the underlying libuv error rather
+  // than a generic argument error, so ENOENT can be told apart from any other
+  // reason the file could not be used.
+  // Refs: https://github.com/nodejs/node/issues/65514
+  const missing = tmpdir.resolve('does-not-exist.txt');
+  await assert.rejects(async () => openAsBlob(missing), {
+    code: 'ENOENT',
+    syscall: 'stat',
+    path: missing,
+  });
+})().then(common.mustCall());
+
 (async () => {
   // We currently do not allow File-backed blobs to be cloned or transferred
   // across worker threads. This is largely because the underlying FdEntry
diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js
index 08a293bb6a81..f1fc42f6304e 100644
--- a/test/parallel/test-blocklist.js
+++ b/test/parallel/test-blocklist.js
@@ -339,6 +339,34 @@ const util = require('util');
   });
 }
 
+{
+  // addAddresses() and addCIDRs() must throw the same errors for non-array
+  // input regardless of how the checks are implemented internally.
+  const blockList = new BlockList();
+  for (const [value, received] of [
+    ['x', "type string ('x')"],
+    [123, 'type number (123)'],
+    [{}, 'an instance of Object'],
+    [null, 'null'],
+    [undefined, 'undefined'],
+    [1n, 'type bigint (1n)'],
+    [true, 'type boolean (true)'],
+  ]) {
+    assert.throws(() => blockList.addAddresses(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "addresses" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+    assert.throws(() => blockList.addCIDRs(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "cidrs" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+  }
+}
+
 {
   // Test addAddresses() batch insert.
   const blockList = new BlockList();
@@ -927,3 +955,40 @@ const util = require('util');
   assert(!blockList.check('10.2.0.1'));
   assert.strictEqual(blockList.rules.length, 1);
 }
+
+{
+  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
+  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
+  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
+  // in that notation.
+  const bl = new BlockList();
+  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
+  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');
+
+  const expected = [
+    'Address: IPv6 ::ffff:192.0.2.128',
+    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
+    'Subnet: IPv6 ::ffff:10.0.0.0/120',
+  ];
+  assert.deepStrictEqual(bl.toJSON().sort(), expected);
+
+  const restored = new BlockList();
+  restored.fromJSON(bl.toJSON());
+
+  // The restored rules must be identical (lossless round-trip).
+  assert.deepStrictEqual(restored.toJSON().sort(), expected);
+
+  // And it must still match the same addresses as the original.
+  [
+    ['::ffff:192.0.2.128', true],  // the single address
+    ['::ffff:192.0.2.129', false],
+    ['::ffff:10.0.0.50', true],    // inside the subnet
+    ['::ffff:10.0.1.0', false],
+    ['::ffff:172.16.0.5', true],   // inside the range
+    ['::ffff:172.16.0.20', false],
+  ].forEach(([address, result]) => {
+    assert.strictEqual(bl.check(address, 'ipv6'), result);
+    assert.strictEqual(restored.check(address, 'ipv6'), result);
+  });
+}
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index b4827a13fcea..e6a40d45e26f 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -118,12 +118,14 @@ expected.atRunTime = new Set([
 
 const { isMainThread } = require('worker_threads');
 // Binaries built without the snapshot (e.g. cross-compiled) and
-// --no-node-snapshot bootstrap the main context from scratch, like a worker.
-const mainContextFromSnapshot = isMainThread &&
+// --no-node-snapshot bootstrap the context from scratch; so do workers under
+// --no-worker-snapshot.
+const contextFromSnapshot =
   process.config.variables.node_use_node_snapshot &&
-  !process.execArgv.includes('--no-node-snapshot');
+  !process.execArgv.includes('--no-node-snapshot') &&
+  (isMainThread || !process.execArgv.includes('--no-worker-snapshot'));
 
-if (mainContextFromSnapshot) {
+if (contextFromSnapshot) {
   [
     'Internal Binding cjs_lexer',
     'NativeModule internal/modules/esm/assert',
@@ -148,7 +150,8 @@ if (mainContextFromSnapshot) {
 } else if (isMainThread) {
   expected.beforePreExec.delete(getFormatNativeModule);
   expected.atRunTime.add(getFormatNativeModule);
-} else {  // Worker.
+}
+if (!isMainThread) {
   [
     'NativeModule diagnostics_channel',
     'NativeModule internal/abort_controller',
diff --git a/test/parallel/test-buffer-alloc-alignment.js b/test/parallel/test-buffer-alloc-alignment.js
index a1a3890ddc20..a55c3fe5fba8 100644
--- a/test/parallel/test-buffer-alloc-alignment.js
+++ b/test/parallel/test-buffer-alloc-alignment.js
@@ -111,6 +111,24 @@ for (const alloc of [Buffer.allocUnsafe, Buffer.allocUnsafeSlow]) {
   assert.strictEqual(buf.buffer.byteLength, 100);
 }
 
+// The padding an aligned allocation needs does not leave a partial element
+// behind it, so a typed array view running from the buffer to the end of its
+// ArrayBuffer can be created without an explicit length.
+{
+  const bufs = [Buffer.allocUnsafe(8), Buffer.allocUnsafeSlow(4096, 4096)];
+  for (const alignment of alignments) {
+    bufs.push(Buffer.allocUnsafe(8, alignment),
+              Buffer.allocUnsafeSlow(8, alignment));
+  }
+  for (const buf of bufs) {
+    const rest = buf.buffer.byteLength - buf.byteOffset;
+    assert.strictEqual(new BigUint64Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+    assert.strictEqual(new Uint32Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+  }
+}
+
 // Buffer.allocUnsafeSlow() is never pooled, even when aligned.
 {
   const a = Buffer.allocUnsafeSlow(64, 64);
diff --git a/test/parallel/test-buffer-indexof.js b/test/parallel/test-buffer-indexof.js
index 2dd62c91e25c..4bed7f935b87 100644
--- a/test/parallel/test-buffer-indexof.js
+++ b/test/parallel/test-buffer-indexof.js
@@ -619,6 +619,32 @@ assert.strictEqual(reallyLong.lastIndexOf(pattern), 0);
   assert.strictEqual(haystack.lastIndexOf(needle), haystack.length - 3);
 }
 
+// UTF-8 string search should use the same replacement-character semantics
+// as Buffer.from() for unpaired UTF-16 surrogates.
+{
+  const prefix = 'a'.repeat(16);
+  const suffix = 'b'.repeat(16);
+  const needles = [
+    `${prefix}${String.fromCharCode(0xd800)}${suffix}`,
+    `${prefix}${String.fromCharCode(0xdc00)}${suffix}`,
+    JSON.parse(`{"needle":"${prefix}\\ud800${suffix}"}`).needle,
+  ];
+
+  for (const needle of needles) {
+    const needleBuffer = Buffer.from(needle, 'utf8');
+    const haystack = Buffer.concat([
+      Buffer.from('xx'),
+      needleBuffer,
+      Buffer.from('yy'),
+    ]);
+
+    assert.strictEqual(Buffer.byteLength(needle, 'utf8'), needleBuffer.length);
+    assert.strictEqual(haystack.indexOf(needle, 0, 'utf8'), 2);
+    assert.strictEqual(haystack.lastIndexOf(needle, haystack.length - 1, 'utf8'), 2);
+    assert.strictEqual(haystack.includes(needle, 0, 'utf8'), true);
+  }
+}
+
 // Avoid abort because of invalid usage
 // see https://github.com/nodejs/node/issues/32753
 {
diff --git a/test/parallel/test-buffer-tostring-rangeerror.js b/test/parallel/test-buffer-tostring-rangeerror.js
index b34f4c612618..856ed84d21cd 100644
--- a/test/parallel/test-buffer-tostring-rangeerror.js
+++ b/test/parallel/test-buffer-tostring-rangeerror.js
@@ -34,6 +34,12 @@ function test(getBuffer) {
       return;
     }
   }
+  // MAX_STRING_LENGTH counts UTF-16 units, not bytes. Uninitialized memory can
+  // hold multi-byte UTF-8 sequences, which decode to fewer units than they
+  // occupy bytes, and a single one of them is enough to bring the result down
+  // to MAX_STRING_LENGTH or less. ASCII bytes keep the decoded length equal to
+  // the buffer length.
+  buf.fill(0);
   assert.throws(() => { buf.toString('utf8'); }, message);
 }
 
diff --git a/test/parallel/test-child-process-exec-abortcontroller-promisified.js b/test/parallel/test-child-process-exec-abortcontroller-promisified.js
index 04e7b70671b9..84f2cd1ef1f8 100644
--- a/test/parallel/test-child-process-exec-abortcontroller-promisified.js
+++ b/test/parallel/test-child-process-exec-abortcontroller-promisified.js
@@ -10,10 +10,9 @@ const invalidArgTypeError = {
   name: 'TypeError'
 };
 
-const waitCommand = common.isWindows ?
-  // `"` is forbidden for Windows paths, no need for escaping.
-  `"${process.execPath}" -e "setInterval(()=>{}, 99)"` :
-  'sleep 2m';
+// `pause` is a cmd.exe builtin, so killing the shell kills the whole tree.
+// Running an executable here would leave it orphaned.
+const waitCommand = common.isWindows ? 'pause' : 'sleep 2m';
 
 {
   const ac = new AbortController();
diff --git a/test/parallel/test-child-process-fork-closed-channel-segfault.js b/test/parallel/test-child-process-fork-closed-channel-segfault.js
index 73bd118ddce3..779e02205e29 100644
--- a/test/parallel/test-child-process-fork-closed-channel-segfault.js
+++ b/test/parallel/test-child-process-fork-closed-channel-segfault.js
@@ -76,6 +76,7 @@ const server = net
           // Ignore errors when sending the second handle because the worker
           // may already have exited.
           if (err && err.code !== 'ERR_IPC_CHANNEL_CLOSED' &&
+                     err.code !== 'EPIPE' &&
                      err.code !== 'ECONNRESET' &&
                      err.code !== 'ECONNREFUSED' &&
                      err.code !== 'EMFILE') {
diff --git a/test/parallel/test-cli-node-print-help.js b/test/parallel/test-cli-node-print-help.js
index f42129eb1330..84704be2104a 100644
--- a/test/parallel/test-cli-node-print-help.js
+++ b/test/parallel/test-cli-node-print-help.js
@@ -27,7 +27,8 @@ function validateNodePrintHelp() {
     { compileConstant: HAVE_OPENSSL,
       flags: [ '--openssl-config=...', '--tls-cipher-list=...',
                '--use-bundled-ca', '--use-openssl-ca', '--use-system-ca',
-               '--enable-fips', '--force-fips' ] },
+               '--enable-fips', '--enable-fips-indicator-events',
+               '--force-fips' ] },
     { compileConstant: NODE_HAVE_I18N_SUPPORT,
       flags: [ '--icu-data-dir=...', 'NODE_ICU_DATA' ] },
     { compileConstant: HAVE_INSPECTOR,
diff --git a/test/parallel/test-common-wpt-any.js b/test/parallel/test-common-wpt-any.js
new file mode 100644
index 000000000000..c198fd707147
--- /dev/null
+++ b/test/parallel/test-common-wpt-any.js
@@ -0,0 +1,161 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const path = require('path');
+const {
+  getHarnessErrorName,
+  getUnexpectedPasses,
+  isUnexpectedPass,
+  WPTRunner,
+  WPTTestSpec,
+} = require('../common/wpt');
+
+const flakyName = getHarnessErrorName({
+  message: 'this uncaught rejection is expected',
+  stack: 'Error: this uncaught rejection is expected\n    at held.https.any.js:71:14',
+});
+assert.strictEqual(flakyName, 'Error: this uncaught rejection is expected');
+assert.strictEqual(
+  getHarnessErrorName({ message: 'harness failed' }),
+  'harness failed',
+);
+
+const flakySpecs = WPTTestSpec.from(
+  'web-locks',
+  'held.https.any.js',
+  [{
+    key: 'held.https.any.js',
+    requires: [],
+    fail: { flaky: [flakyName] },
+  }],
+);
+assert.strictEqual(flakySpecs.length, 2);
+assert.ok(flakySpecs.every((spec) =>
+  spec.failedTests.includes(flakyName) && spec.flakyTests.includes(flakyName)));
+assert.ok(flakySpecs.every((spec) => !isUnexpectedPass(spec, flakyName)));
+assert.deepStrictEqual(getUnexpectedPasses(flakySpecs, {}), []);
+
+const specs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [],
+);
+
+assert.deepStrictEqual(specs.map((spec) => ({
+  testPath: spec.getTestPath(),
+  isWebWorkerTest: spec.isWebWorkerTest(),
+})), [
+  {
+    testPath: 'WebCryptoAPI/getPublicKey.tentative.https.any.html',
+    isWebWorkerTest: false,
+  },
+  {
+    testPath: 'WebCryptoAPI/getPublicKey.tentative.https.any.worker.html',
+    isWebWorkerTest: true,
+  },
+]);
+
+const runner = new WPTRunner('WebCryptoAPI');
+assert.throws(
+  () => new WPTRunner('WebCryptoAPI', { concurrency: 0 }),
+  /WPT concurrency must be a positive integer/,
+);
+runner.pretendGlobalThisAs('Window');
+assert.match(runner.fullInitScript(specs[0]), /globalThis\.Window/);
+assert.doesNotMatch(runner.fullInitScript(specs[1]), /globalThis\.Window/);
+
+const nonTestDirs = new Set(['resources', 'support', 'tools']);
+const webLocksRunner = new WPTRunner('web-locks');
+assert.ok([...webLocksRunner.specs].every((spec) =>
+  !spec.filename.split(path.sep).some((part) => nonTestDirs.has(part))));
+
+const variantSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'derive_bits_keys/hkdf.https.any.js',
+  [],
+);
+
+assert.strictEqual(variantSpecs.length, 8);
+assert.deepStrictEqual(
+  variantSpecs.filter((spec) => spec.isWebWorkerTest())
+    .map((spec) => spec.getTestPath()),
+  [
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?1-1000',
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?1001-2000',
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?2001-3000',
+    'WebCryptoAPI/derive_bits_keys/hkdf.https.any.worker.html?3001-last',
+  ],
+);
+
+const skippedSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [{ requires: [], skip: 'unsupported' }],
+);
+assert.deepStrictEqual(
+  skippedSpecs.map(({ skipReasons }) => skipReasons),
+  [['unsupported'], ['unsupported']],
+);
+
+const skippedSubtestSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [{ requires: [], skipTests: [/getPublicKey method/] }],
+);
+assert.ok(skippedSubtestSpecs.every(
+  (spec) => spec.isSkippedTest('getPublicKey method is available')));
+
+const scopedSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [],
+  (spec) => (spec.getStatusKey().endsWith('.any.worker.html') ?
+    [{ requires: [], skip: 'worker only' }] : []),
+);
+assert.deepStrictEqual(
+  scopedSpecs.map(({ skipReasons }) => skipReasons),
+  [[], ['worker only']],
+);
+
+const sourceRule = {
+  key: 'getPublicKey.tentative.https.any.js',
+  requires: [],
+  fail: { expected: ['shared failure'] },
+};
+const workerRule = {
+  key: 'getPublicKey.tentative.https.any.worker.html',
+  requires: [],
+  fail: { expected: ['worker failure'] },
+};
+const expectedFailureSpecs = WPTTestSpec.from(
+  'WebCryptoAPI',
+  'getPublicKey.tentative.https.any.js',
+  [sourceRule],
+  (spec) => (spec.isWebWorkerTest() ? [workerRule] : []),
+);
+const expectedResults = {
+  'getPublicKey.tentative.https.any.html': {
+    fail: { expected: ['shared failure'] },
+  },
+  'getPublicKey.tentative.https.any.worker.html': {
+    fail: { expected: ['shared failure', 'worker failure'] },
+  },
+};
+
+assert.deepStrictEqual(
+  getUnexpectedPasses(expectedFailureSpecs, expectedResults),
+  [],
+);
+expectedResults['getPublicKey.tentative.https.any.worker.html'].fail.expected =
+  ['worker failure'];
+assert.deepStrictEqual(
+  getUnexpectedPasses(expectedFailureSpecs, expectedResults),
+  ['getPublicKey.tentative.https.any.worker.html:shared failure'],
+);
+expectedResults['getPublicKey.tentative.https.any.worker.html'].fail.expected =
+  ['shared failure'];
+assert.deepStrictEqual(
+  getUnexpectedPasses(expectedFailureSpecs, expectedResults),
+  ['getPublicKey.tentative.https.any.worker.html:worker failure'],
+);
diff --git a/test/parallel/test-common-wpt-backends.js b/test/parallel/test-common-wpt-backends.js
new file mode 100644
index 000000000000..093ecd4dfd17
--- /dev/null
+++ b/test/parallel/test-common-wpt-backends.js
@@ -0,0 +1,274 @@
+'use strict';
+
+// The WPT runner can run each spec on a worker thread or in a child process.
+// Suites opt into either, and share the status files, so both backends have to
+// report the same things in the same way.
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+const { backends, WPTRunner } = require('../common/wpt');
+
+const queueProbe = process.env.NODE_TEST_WPT_QUEUE_PROBE === '1';
+const backendProbe = process.env.NODE_TEST_WPT_BACKEND_PROBE;
+
+const harnessPath = fixtures.path('wpt', 'resources', 'testharness.js');
+const specPath = fixtures.path('wpt-backends-spec.js');
+const execArgv = ['--experimental-web-worker'];
+
+function payload(throws) {
+  return {
+    testRelativePath: 'backends.any.js',
+    wptRunner: path.join(__dirname, '../common/wpt.js'),
+    wptPath: 'compression',
+    initScript: throws ? 'globalThis.WPT_BACKENDS_THROW = true;' : null,
+    harness: {
+      code: fs.readFileSync(harnessPath, 'utf8'),
+      filename: harnessPath,
+    },
+    scriptsToRun: [{
+      code: fs.readFileSync(specPath, 'utf8'),
+      filename: specPath,
+    }],
+    needsGc: false,
+    // A regular expression only survives the trip to a child process because
+    // the runner forks with advanced serialization.
+    skippedTests: ['skipped by name', /^skipped by pattern$/],
+  };
+}
+
+// Collect what a backend reports for one spec, driving it the way the runner
+// does so that the real spawn options are exercised.
+async function collect(backend, throws) {
+  const events = [];
+  let done = false;
+
+  const handle = backends[backend](execArgv, payload(throws), {
+    message: (message) => {
+      switch (message.type) {
+        case 'result':
+          events.push(`result ${message.result.status} ${message.result.name}`);
+          break;
+        case 'skip':
+          events.push(`skip ${message.name}`);
+          break;
+        case 'completion':
+          events.push(`completion ${message.status.status}`);
+          done = true;
+          handle.kill();
+          break;
+        default:
+          assert.fail(`Unexpected message type: ${message.type}`);
+      }
+    },
+    failure: (failure) => {
+      if (done) {
+        return false;
+      }
+      done = true;
+      events.push(`uncaught ${failure.name} | ${failure.message}`);
+      return true;
+    },
+  });
+
+  const watchdog = setTimeout(
+    common.mustNotCall(`The ${backend} WPT backend did not finish`),
+    common.platformTimeout(10_000),
+  );
+  try {
+    await handle.finished;
+  } finally {
+    clearTimeout(watchdog);
+  }
+  return events;
+}
+
+async function compare(throws) {
+  const comparable = async (backend) => {
+    const events = await collect(backend, throws);
+    // A worker thread keeps delivering messages after it throws, so `events`
+    // is copied here and only the error is compared; what the spec reports
+    // before throwing is covered by the run that completes normally.
+    const wanted = throws ? (event) => event.startsWith('uncaught ') : () => true;
+    return events.filter(wanted).sort();
+  };
+
+  const thread = await comparable('thread');
+  const child = await comparable('process');
+  assert.notStrictEqual(thread.length, 0);
+  assert.deepStrictEqual(thread, child);
+  return thread;
+}
+
+// End to end: the runner's own reporting has to match too. The webidl spec
+// reports an uncaught error whose name the status file matches on.
+function runDriver(driver, spec, backend) {
+  const { child: { stdout } } = spawnSyncAndExitWithoutError(
+    process.execPath,
+    [path.join(__dirname, '../wpt', driver), spec],
+    { env: { ...process.env, WPT_BACKEND: backend }, encoding: 'utf8' },
+  );
+  // Specs run concurrently, so the lines arrive in an arbitrary order.
+  return stdout.split('\n').filter((line) => line.startsWith('[')).sort();
+}
+
+function runQueueProbe() {
+  backends.process = common.mustCall((execArgv, workerData, handlers) => {
+    queueMicrotask(() => handlers.message({
+      type: 'completion',
+      status: { status: 0 },
+    }));
+    return {
+      kill() {},
+      // Model the gap between a spec completing and its process closing. The
+      // close notification alone must not be responsible for keeping the
+      // parent alive long enough to start the next queued spec.
+      finished: new Promise((resolve) => {
+        setTimeout(common.mustCall(resolve), 1).unref();
+      }),
+    };
+  }, 2);
+
+  process.argv[2] = 'compression-bad-chunks.any.js';
+  const runner = new WPTRunner('compression', {
+    backend: 'process',
+    concurrency: 1,
+  });
+  // WPT drivers intentionally do not await this method.
+  runner.runJsTests();
+}
+
+function checkQueuedSpecsKeepRunnerAlive() {
+  const result = spawnSync(process.execPath, [__filename], {
+    env: {
+      ...process.env,
+      NODE_TEST_WPT_QUEUE_PROBE: '1',
+      WPT_BACKEND: 'process',
+    },
+    encoding: 'utf8',
+    timeout: common.platformTimeout(10_000),
+  });
+  const { error, status, stdout, stderr } = result;
+  assert.ifError(error);
+  assert.strictEqual(status, 0, `Queued WPT probe failed:\n${stdout}${stderr}`);
+}
+
+function runDefaultBackendProbe() {
+  const runner = new WPTRunner('compression');
+  assert.strictEqual(runner.runSpec, backends[backendProbe]);
+}
+
+function checkBackendSelection() {
+  const env = { ...process.env };
+  delete env.WPT_BACKEND;
+  delete env.WPT_INSPECT;
+
+  for (const [name, expected, args, overrides] of [
+    ['default', 'thread', [__filename]],
+    ['environment override', 'process', [__filename], { WPT_BACKEND: 'process' }],
+    ['inspect override', 'process', [__filename], {
+      WPT_BACKEND: 'thread',
+      WPT_INSPECT: '1',
+    }],
+  ]) {
+    const result = spawnSync(process.execPath, args, {
+      env: {
+        ...env,
+        ...overrides,
+        NODE_TEST_WPT_BACKEND_PROBE: expected,
+      },
+      encoding: 'utf8',
+      timeout: common.platformTimeout(10_000),
+    });
+    const { error, status, stdout, stderr } = result;
+    assert.ifError(error);
+    assert.strictEqual(
+      status,
+      0,
+      `${name} WPT backend probe failed:\n${stdout}${stderr}`,
+    );
+  }
+}
+
+function checkInspectSelection() {
+  const driver = path.join(__dirname, '../wpt/test-compression.js');
+  const env = { ...process.env, WPT_INSPECT: '1' };
+  delete env.WPT_BACKEND;
+
+  const runFailure = common.mustCall((args, expected) => {
+    const result = spawnSync(process.execPath, [driver, ...args], {
+      env,
+      encoding: 'utf8',
+      timeout: common.platformTimeout(10_000),
+    });
+    const { error, status, stdout, stderr } = result;
+    assert.ifError(error);
+    assert.strictEqual(status, 1, `WPT inspect probe passed:\n${stdout}${stderr}`);
+    assert.match(stderr, expected);
+  }, 3);
+
+  runFailure([], /WPT_INSPECT requires a WPT test path/);
+  runFailure(
+    ['compression-bad-chunks.any.js'],
+    /WPT_INSPECT requires exactly one generated WPT test path; .* matched 2:\r?\ncompression\/compression-bad-chunks\.any\.html\r?\ncompression\/compression-bad-chunks\.any\.worker\.html/,
+  );
+  runFailure(
+    ['compression/compression-bad-chunks.any.worker.html'],
+    /WPT_INSPECT does not support worker tests: compression\/compression-bad-chunks\.any\.worker\.html/,
+  );
+}
+
+async function main() {
+  checkBackendSelection();
+  checkInspectSelection();
+  checkQueuedSpecsKeepRunnerAlive();
+
+  const completed = await compare(false);
+  assert.deepStrictEqual(completed, [
+    'completion 0',
+    'result 0 passes',
+    'result 0 passes asynchronously',
+    'result 1 fails',
+    'skip skipped by name',
+    'skip skipped by pattern',
+  ]);
+
+  const uncaught = await compare(true);
+  assert.deepStrictEqual(uncaught, [
+    'uncaught Error: deliberate uncaught error | deliberate uncaught error',
+  ]);
+
+  for (const [driver, spec] of [
+    ['test-compression.js', 'compression-bad-chunks.any.js'],
+    ['test-webidl.js', 'ecmascript-binding/global-object-implicit-this-value.any.js'],
+  ]) {
+    assert.deepStrictEqual(
+      runDriver(driver, spec, 'thread'),
+      runDriver(driver, spec, 'process'),
+    );
+  }
+
+  const windowResults = runDriver(
+    'test-events.js',
+    'dom/events/Event-constructors.any.html',
+    'thread',
+  );
+  const workerResults = runDriver(
+    'test-events.js',
+    'dom/events/Event-constructors.any.worker.html',
+    'thread',
+  ).map((line) => line.replace('.any.worker.html', '.any.html'));
+  assert.deepStrictEqual(workerResults, windowResults);
+}
+
+if (backendProbe) {
+  runDefaultBackendProbe();
+} else if (queueProbe) {
+  runQueueProbe();
+} else {
+  main().then(common.mustCall());
+}
diff --git a/test/parallel/test-common-wpt-inspect.js b/test/parallel/test-common-wpt-inspect.js
new file mode 100644
index 000000000000..ff53902972c5
--- /dev/null
+++ b/test/parallel/test-common-wpt-inspect.js
@@ -0,0 +1,44 @@
+'use strict';
+
+const common = require('../common');
+common.skipIfInspectorDisabled();
+
+const assert = require('assert');
+const path = require('path');
+const { NodeInstance } = require('../common/inspector-helper');
+
+const driver = path.join(__dirname, '../wpt/test-compression.js');
+
+async function main() {
+  const parent = new NodeInstance([], `
+    delete process.env.WPT_BACKEND;
+    process.env.WPT_INSPECT = '1';
+    process.argv[2] = 'compression/compression-bad-chunks.any.html';
+    require(${JSON.stringify(driver)});
+  `, '', {
+    log() {},
+    error() {},
+  });
+  const stderr = [];
+  parent.on('stderr', (line) => stderr.push(line));
+
+  const session = await parent.connectInspectorSession();
+  await session.send([
+    { method: 'Runtime.enable' },
+    { method: 'Debugger.enable' },
+    { method: 'Runtime.runIfWaitingForDebugger' },
+  ]);
+  await session.waitForNotification('Debugger.paused');
+  await session.send({ method: 'Debugger.resume' });
+  await session.disconnect();
+
+  const { exitCode, signal } = await parent.expectShutdown();
+  assert.strictEqual(signal, null);
+  assert.strictEqual(exitCode, 0);
+  assert.strictEqual(
+    stderr.filter((line) => line.startsWith('Debugger listening on ')).length,
+    1,
+  );
+}
+
+main().then(common.mustCall());
diff --git a/test/parallel/test-common-wpt-webworker-error.js b/test/parallel/test-common-wpt-webworker-error.js
new file mode 100644
index 000000000000..76738303cdf2
--- /dev/null
+++ b/test/parallel/test-common-wpt-webworker-error.js
@@ -0,0 +1,79 @@
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { fork } = require('child_process');
+const { Worker } = require('worker_threads');
+
+const workerPath = path.join(__dirname, '../common/wpt/worker.js');
+const harnessPath = fixtures.path('wpt', 'resources', 'testharness.js');
+const execArgv = ['--experimental-web-worker'];
+const workerData = {
+  testRelativePath: 'workers/error-after-result.any.js',
+  wptRunner: path.join(__dirname, '../common/wpt.js'),
+  wptPath: 'workers',
+  initScript: null,
+  harness: {
+    code: fs.readFileSync(harnessPath, 'utf8'),
+    filename: harnessPath,
+  },
+  scriptsToRun: [],
+  webWorker: {
+    path: fixtures.path('web-worker', 'wpt-error-after-result.js'),
+    isAnyTest: true,
+    initScript: null,
+    variant: '',
+    scripts: [],
+    skippedTests: [],
+  },
+  needsGc: false,
+  skippedTests: [],
+};
+
+// Both backends have to report an error thrown by a Web Worker after a result
+// was already reported, and report it the same way.
+check('thread', () => {
+  const worker = new Worker(workerPath, { execArgv, workerData });
+  return { runner: worker, stop: () => worker.terminate() };
+});
+check('process', () => {
+  const child = fork(workerPath, { execArgv, serialization: 'advanced' });
+  child.send(workerData);
+  return { runner: child, stop: () => child.kill() };
+});
+
+function check(backend, start) {
+  const { runner, stop } = start();
+
+  const timeout = setTimeout(() => {
+    stop();
+    assert.fail(`WPT worker error was not reported on the ${backend} backend`);
+  }, common.platformTimeout(10_000));
+
+  const onCompletion = common.mustCall((status) => {
+    clearTimeout(timeout);
+    assert.strictEqual(status.status, 1);
+    assert.strictEqual(status.message, 'probe error after first result');
+    stop();
+  });
+
+  runner.on('error', common.mustNotCall());
+  // The error reaches the runner straight from the Web Worker while results
+  // travel through the harness, so it can arrive before them.
+  runner.on('message', common.mustCallAtLeast((message) => {
+    switch (message.type) {
+      case 'result':
+        assert.strictEqual(message.result.name, 'reported before error');
+        assert.strictEqual(message.result.status, 0);
+        break;
+      case 'completion':
+        onCompletion(message.status);
+        break;
+      default:
+        assert.fail(`Unexpected message type: ${message.type}`);
+    }
+  }, 1));
+}
diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/parallel/test-crypto-aes-wrap.js
index 951e93d728e3..b6561524dc92 100644
--- a/test/parallel/test-crypto-aes-wrap.js
+++ b/test/parallel/test-crypto-aes-wrap.js
@@ -63,3 +63,146 @@ const key3 = Buffer.from('29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea087
   const msg = decipher.update(cipher.update(text, 'utf8'), 'buffer', 'utf8');
   assert.strictEqual(msg, text, `${algorithm} test case failed`);
 });
+
+const kwIV = Buffer.alloc(8, 0xa6);
+const kwpIV = Buffer.from('a65959a6', 'hex');
+
+// NIST SP 800-38F known-answer vectors.
+[
+  {
+    algorithm: 'aes-128-wrap',
+    key: '000102030405060708090a0b0c0d0e0f',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '1fa68b0a8112b447aef34bd8fb5a7b829d3e862371d2cfe5',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-192-wrap',
+    key: '000102030405060708090a0b0c0d0e0f1011121314151617',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '96778b25ae6ca435f92b5b97c050aed2468ab8a17ad84e5d',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-256-wrap',
+    key: '000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '64e8c3f9ce0f5ba263e9777905818a2a93c8191e7d6e8ae7',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-pad',
+    key: '6decf10a1caf8e3b80c7a4be8c9c84e8',
+    plaintext: '49',
+    ciphertext: '01a7d657fc4a5b216f261cca4d052c2b',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-pad',
+    key: '9ca11078baebc1597a68ce2fe3fc79a201626575252b8860',
+    plaintext: '76',
+    ciphertext: '866bc0ae30e290bb20a0dab31a6e7165',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-pad',
+    key: '95da2700ca6fd9a52554ee2a8df1386f5b94a1a60ed8a4aef60a8d61ab5f225a',
+    plaintext: 'd1',
+    ciphertext: '06ba7ae6f3248cfdcf267507fa001bc4',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-inv',
+    key: 'e88ba734ea243480a6129366753b58eb',
+    plaintext: 'd140ac16a44c1c2b3f47037ea8898a3e',
+    ciphertext: '600861ee14320006f0ae55c46d5e1ebf3303751df7f038df',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-inv',
+    key: '370c715135b44eb3773b1aff833bcd28b59aee866d4a36b3',
+    plaintext: 'eae0f60f1cf33d5b75869e84c764a04e',
+    ciphertext: 'ea4ba4add8add19950ca491d109ffa08f90312693055677a',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-inv',
+    key: 'de982f7c871f78e37462e2f48a62eecb2da81a10799c6ebf2bee8c786b624b0e',
+    plaintext: 'ecafc437d9f1643c7645c2416c14c003',
+    ciphertext: 'aec02ddb3f6de1f99103c6042dfc9001eb3cf56d9c2a11f7',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-pad-inv',
+    key: '1c321a356b0ee25e30de2d618c1facbe',
+    plaintext: '42',
+    ciphertext: '3ddf22da3080a1a5252574c76f833790',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-pad-inv',
+    key: 'fe3fe235bb36dcf03f01cbf32cc98a3abf10ab3d608d3b30',
+    plaintext: '1d2b7fc29991bafaf7',
+    ciphertext: 'c11afb3c0de263dfb9b672a5f81fe0b9acfe9c407691f332',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-pad-inv',
+    key: '148a3fa618a6998c30b9f0f67922354a3747f2fa2e4d2e0b7af9582d6f548fee',
+    plaintext: '441125592acf9e5208dcd558a7ac0034d15530dbad7a2913963da0cbf60aa3',
+    ciphertext: '23f26a9476829885055694062c89b86399e8d6125509c9e88bb0a5b5113f4bfc8d34a62cba3c9eee',
+    iv: kwpIV,
+  },
+].forEach(({ algorithm, key, plaintext, ciphertext, iv }) => {
+  if (!crypto.getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`Skipping unsupported ${algorithm} test case`);
+    return;
+  }
+
+  const keyBuffer = Buffer.from(key, 'hex');
+  const plaintextBuffer = Buffer.from(plaintext, 'hex');
+  const expected = Buffer.from(ciphertext, 'hex');
+  const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);
+  const actual = Buffer.concat([
+    cipher.update(plaintextBuffer),
+    cipher.final(),
+  ]);
+  assert.deepStrictEqual(actual, expected, `${algorithm} wrap failed`);
+
+  const decipher = crypto.createDecipheriv(algorithm, keyBuffer, iv);
+  const unwrapped = Buffer.concat([
+    decipher.update(actual),
+    decipher.final(),
+  ]);
+  assert.deepStrictEqual(
+    unwrapped, plaintextBuffer, `${algorithm} unwrap failed`);
+});
+
+{
+  const algorithm = crypto.getCiphers().includes('aes-128-wrap-inv') ?
+    'aes-128-wrap-inv' : 'aes128-wrap';
+  if (!crypto.getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`Skipping unsupported ${algorithm} state tests`);
+  } else {
+    const key = Buffer.from('e88ba734ea243480a6129366753b58eb', 'hex');
+    const iv = Buffer.alloc(8, 0xa6);
+    const plaintextParts = [Buffer.alloc(16), Buffer.alloc(16, 1)];
+    const wrappedParts = plaintextParts.map((plaintext) => {
+      const cipher = crypto.createCipheriv(algorithm, key, iv);
+      return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    });
+
+    for (const [create, inputParts] of [
+      [crypto.createCipheriv, plaintextParts],
+      [crypto.createDecipheriv, wrappedParts],
+    ]) {
+      const withoutUpdate = create(algorithm, key, iv);
+      assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+      const multipleUpdates = create(algorithm, key, iv);
+      multipleUpdates.update(inputParts[0]);
+      assert.throws(() => multipleUpdates.update(inputParts[1]),
+                    /Trying to add data in unsupported state/);
+    }
+  }
+}
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index f27fcfa22dbf..3ad34729f871 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -63,7 +63,7 @@ for (const test of TEST_CASES) {
     continue;
   }
 
-  const isCCM = /^aes-(128|192|256)-ccm$/.test(test.algo);
+  const isCCM = /^(?:aes-(?:128|192|256)|sm4)-ccm$/.test(test.algo);
   const isOCB = /^aes-(128|192|256)-ocb$/.test(test.algo);
   const isSIV = /^aes-(128|192|256)-siv$/.test(test.algo);
 
@@ -801,14 +801,29 @@ for (const test of TEST_CASES) {
     const iv = Buffer.alloc(12);
     const opts = { authTagLength: 10 };
 
+    const control = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
+    control.update(Buffer.alloc(0));
+    control.final();
+    const expectedTag = control.getAuthTag();
+
     const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
-    assert.throws(() => {
-      cipher.final();
-    }, hasOpenSSL(3) ? {
-      code: 'ERR_OSSL_TAG_NOT_SET'
-    } : {
-      message: /Unsupported state/
-    });
+    let output;
+    try {
+      output = cipher.final();
+    } catch (err) {
+      // OpenSSL without https://github.com/openssl/openssl/pull/32427
+      // cannot finalize an empty CCM message unless update() was called.
+      if (hasOpenSSL(3)) {
+        assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
+      } else {
+        assert.match(err.message, /Unsupported state/);
+      }
+    }
+
+    if (output !== undefined) {
+      assert.deepStrictEqual(output, Buffer.alloc(0));
+      assert.deepStrictEqual(cipher.getAuthTag(), expectedTag);
+    }
   }
 }
 
@@ -963,6 +978,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) {
 if (ciphers.includes('aes-128-ccm')) {
   const key = crypto.randomBytes(16);
   const nonce = crypto.randomBytes(13);
+  const authError = /Unsupported state or unable to authenticate data/;
 
   const cipher = crypto.createCipheriv('aes-128-ccm', key, nonce, {
     authTagLength: 16,
@@ -986,6 +1002,47 @@ if (ciphers.includes('aes-128-ccm')) {
     decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
     decipher.update(new DataView(new ArrayBuffer(0)));
     decipher.final();
+
+    const invalidTag = Buffer.from(tag);
+    invalidTag[0] ^= 0xff;
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(tag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(invalidTag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      decipher.update(Buffer.alloc(0));
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(tag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      decipher.update(Buffer.alloc(0));
+      assert.throws(() => decipher.update(Buffer.alloc(0)), errMessages.state);
+      decipher.final();
+    }
   }
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ccm test');
diff --git a/test/parallel/test-crypto-cipherbase-options-fast-path.js b/test/parallel/test-crypto-cipherbase-options-fast-path.js
new file mode 100644
index 000000000000..9649b61fa7c5
--- /dev/null
+++ b/test/parallel/test-crypto-cipherbase-options-fast-path.js
@@ -0,0 +1,130 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+} = require('crypto');
+
+const key = Buffer.alloc(16);
+const gcmIv = Buffer.alloc(12);
+const cbcIv = Buffer.alloc(16);
+
+for (const create of [createCipheriv, createDecipheriv]) {
+  // None of these supply either of the extended cipher options.
+  create('aes-128-gcm', key, gcmIv);
+  create('aes-128-gcm', key, gcmIv, null);
+  create('aes-128-gcm', key, gcmIv, {});
+  create('aes-128-gcm', key, gcmIv, undefined);
+  create('aes-128-gcm', key, gcmIv, { authTagLength: 16 });
+
+  for (const options of [
+    { ctsMode: null },
+    { ctsMode: undefined },
+    { xtsStandard: null },
+    { xtsStandard: undefined },
+    { ctsMode: null, xtsStandard: undefined },
+  ]) {
+    create('aes-128-gcm', key, gcmIv, options);
+  }
+
+  const accesses = [];
+  create('aes-128-gcm', key, gcmIv, {
+    get authTagLength() {
+      accesses.push('authTagLength');
+      return 16;
+    },
+    get ctsMode() {
+      accesses.push('ctsMode');
+      return null;
+    },
+    get xtsStandard() {
+      accesses.push('xtsStandard');
+      return undefined;
+    },
+  });
+  assert.deepStrictEqual(
+    accesses,
+    ['authTagLength', 'ctsMode', 'xtsStandard']);
+
+  const extendedAccesses = [];
+  assert.throws(
+    () => create('aes-128-cbc', key, cbcIv, {
+      get authTagLength() {
+        extendedAccesses.push('authTagLength');
+        return null;
+      },
+      get ctsMode() {
+        extendedAccesses.push('ctsMode');
+        return 'CS1';
+      },
+      get xtsStandard() {
+        extendedAccesses.push('xtsStandard');
+        return null;
+      },
+    }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  assert.deepStrictEqual(
+    extendedAccesses,
+    ['authTagLength', 'ctsMode', 'xtsStandard']);
+
+  const invalidAuthTagAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get authTagLength() {
+      invalidAuthTagAccesses.push('authTagLength');
+      return -2;
+    },
+    get ctsMode() {
+      invalidAuthTagAccesses.push('ctsMode');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.deepStrictEqual(invalidAuthTagAccesses, ['authTagLength']);
+
+  const invalidCtsTypeAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get ctsMode() {
+      invalidCtsTypeAccesses.push('ctsMode');
+      return 1;
+    },
+    get xtsStandard() {
+      invalidCtsTypeAccesses.push('xtsStandard');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.deepStrictEqual(invalidCtsTypeAccesses, ['ctsMode']);
+
+  const invalidCtsValueAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get ctsMode() {
+      invalidCtsValueAccesses.push('ctsMode');
+      return 'CS4';
+    },
+    get xtsStandard() {
+      invalidCtsValueAccesses.push('xtsStandard');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.deepStrictEqual(
+    invalidCtsValueAccesses,
+    ['ctsMode', 'xtsStandard']);
+
+  assert.throws(
+    () => create('aes-128-cbc', key, cbcIv, { xtsStandard: 'GB' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+
+  for (const ctsMode of ['', 'CS4']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, cbcIv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  for (const xtsStandard of ['', 'IEEE-1619']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, cbcIv, { xtsStandard }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+}
diff --git a/test/parallel/test-crypto-cipheriv-cbc-cts.js b/test/parallel/test-crypto-cipheriv-cbc-cts.js
new file mode 100644
index 000000000000..c3447b2908b3
--- /dev/null
+++ b/test/parallel/test-crypto-cipheriv-cbc-cts.js
@@ -0,0 +1,123 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('crypto');
+
+const algorithm = 'aes-128-cbc-cts';
+const key = Buffer.from('636869636b656e207465726979616b69', 'hex');
+const iv = Buffer.alloc(16);
+
+for (const create of [createCipheriv, createDecipheriv]) {
+  for (const ctsMode of ['cs1', 'CS4', '']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, iv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  for (const ctsMode of [1, true, {}]) {
+    assert.throws(
+      () => create('aes-128-cbc', key, iv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_TYPE' });
+  }
+  assert.throws(
+    () => create('aes-128-cbc', key, iv, { ctsMode: 'CS1' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+}
+
+if (!getCiphers().includes(algorithm)) {
+  common.printSkipMessage(`unsupported ${algorithm}`);
+  return;
+}
+
+// OpenSSL AES-128-CBC-CTS CS1 test vector.
+const plaintext = Buffer.from('4920776f756c64206c696b652074686520',
+                              'hex');
+const expected = Buffer.from('97c6353568f2bf8cb4d8a580362da7ff7f',
+                             'hex');
+
+const cipher = createCipheriv(algorithm, key, iv);
+const ciphertext = Buffer.concat([
+  cipher.update(plaintext),
+  cipher.final(),
+]);
+assert.deepStrictEqual(ciphertext, expected);
+
+const decipher = createDecipheriv(algorithm, key, iv);
+const decrypted = Buffer.concat([
+  decipher.update(ciphertext),
+  decipher.final(),
+]);
+assert.deepStrictEqual(decrypted, plaintext);
+
+const vectors = [
+  {
+    plaintext,
+    ciphertext: {
+      CS1: expected,
+      CS2: Buffer.from('c6353568f2bf8cb4d8a580362da7ff7f97', 'hex'),
+      CS3: Buffer.from('c6353568f2bf8cb4d8a580362da7ff7f97', 'hex'),
+    },
+  },
+  {
+    plaintext: Buffer.from(
+      '4920776f756c64206c696b6520746865' +
+      '2047656e6572616c2047617527732043', 'hex'),
+    ciphertext: {
+      CS1: Buffer.from(
+        '97687268d6ecccc0c07b25e25ecfe584' +
+        '39312523a78662d5be7fcbcc98ebf5a8', 'hex'),
+      CS2: Buffer.from(
+        '97687268d6ecccc0c07b25e25ecfe584' +
+        '39312523a78662d5be7fcbcc98ebf5a8', 'hex'),
+      CS3: Buffer.from(
+        '39312523a78662d5be7fcbcc98ebf5a8' +
+        '97687268d6ecccc0c07b25e25ecfe584', 'hex'),
+    },
+  },
+];
+
+for (const { plaintext, ciphertext } of vectors) {
+  for (const ctsMode of ['CS1', 'CS2', 'CS3']) {
+    const cipher = createCipheriv(algorithm, key, iv, { ctsMode });
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext),
+      cipher.final(),
+    ]);
+    assert.deepStrictEqual(encrypted, ciphertext[ctsMode]);
+
+    const decipher = createDecipheriv(algorithm, key, iv, { ctsMode });
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final(),
+    ]);
+    assert.deepStrictEqual(decrypted, plaintext);
+  }
+}
+
+const tooShort = createCipheriv(algorithm, key, iv);
+assert.throws(() => tooShort.update(Buffer.alloc(15)),
+              /Trying to add data in unsupported state/);
+assert.deepStrictEqual(Buffer.concat([
+  tooShort.update(plaintext),
+  tooShort.final(),
+]), expected);
+
+for (const [create, input] of [
+  [createCipheriv, plaintext],
+  [createDecipheriv, expected],
+]) {
+  const withoutUpdate = create(algorithm, key, iv);
+  assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+  const multipleUpdates = create(algorithm, key, iv);
+  multipleUpdates.update(input.subarray(0, 16));
+  assert.throws(() => multipleUpdates.update(input.subarray(16)),
+                /Trying to add data in unsupported state/);
+}
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index b1965c5a80c1..d2c216924ea8 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -85,6 +85,84 @@ function testCipher3(key, iv) {
          `encryption/decryption with key ${key} and iv ${iv}`);
 }
 
+function testSm4Xts() {
+  const aesKey = Buffer.alloc(16);
+  const aesIv = Buffer.alloc(16);
+  for (const create of [crypto.createCipheriv, crypto.createDecipheriv]) {
+    for (const xtsStandard of ['gb', 'IEEE-1619', '']) {
+      assert.throws(
+        () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard }),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+    for (const xtsStandard of [1, true, {}]) {
+      assert.throws(
+        () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard }),
+        { code: 'ERR_INVALID_ARG_TYPE' });
+    }
+    assert.throws(
+      () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard: 'GB' }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+
+  if (!crypto.getCiphers().includes('sm4-xts')) {
+    common.printSkipMessage('unsupported sm4-xts test');
+    return;
+  }
+
+  // GB/T 17964-2021
+  const key = Buffer.from(
+    '2B7E151628AED2A6ABF7158809CF4F3C' +
+    '000102030405060708090A0B0C0D0E0F', 'hex');
+  const iv = Buffer.from('F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF', 'hex');
+  const plaintext = Buffer.from(
+    '6BC1BEE22E409F96E93D7E117393172A' +
+    'AE2D8A571E03AC9C9EB76FAC45AF8E51' +
+    '30C81C46A35CE411E5FBC1191A0A52EF' +
+    'F69F2445DF4F9B17', 'hex');
+  const vectors = [
+    {
+      options: undefined,
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        '2C5C581BD6242FC51E08964FB4F60FDB' +
+        '0BA42F63499279213D318D2C11F6886E' +
+        '903BE7F93A1B3479', 'hex'),
+    },
+    {
+      options: { xtsStandard: 'GB' },
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        '2C5C581BD6242FC51E08964FB4F60FDB' +
+        '0BA42F63499279213D318D2C11F6886E' +
+        '903BE7F93A1B3479', 'hex'),
+    },
+    {
+      options: { xtsStandard: 'IEEE' },
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        'B3DB1A3E60408C575D63FF7DB39F8326' +
+        '0869F9E2585FEC9F0B863BF8FD784B86' +
+        '27D16C0DB6D2CFC7', 'hex'),
+    },
+  ];
+
+  for (const { options, ciphertext } of vectors) {
+    const cipher = crypto.createCipheriv('sm4-xts', key, iv, options);
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext),
+      cipher.final(),
+    ]);
+    assert.deepStrictEqual(encrypted, ciphertext);
+
+    const decipher = crypto.createDecipheriv('sm4-xts', key, iv, options);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]);
+    assert.deepStrictEqual(decrypted, plaintext);
+  }
+}
+
 {
   const Cipheriv = crypto.Cipheriv;
   const algorithm = fips3 ? 'aes-128-cbc' : 'des-ede3-cbc';
@@ -167,6 +245,7 @@ if (!isFipsEnabled) {
   testCipher3(Buffer.from('000102030405060708090A0B0C0D0E0F', 'hex'),
               Buffer.from('A6A6A6A6A6A6A6A6', 'hex'));
 }
+testSm4Xts();
 
 // Zero-sized IV or null should be accepted in ECB mode.
 crypto.createCipheriv('aes-128-ecb', Buffer.alloc(16), Buffer.alloc(0));
diff --git a/test/parallel/test-crypto-cipheriv-xts.js b/test/parallel/test-crypto-cipheriv-xts.js
new file mode 100644
index 000000000000..236ff578f8f8
--- /dev/null
+++ b/test/parallel/test-crypto-cipheriv-xts.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('crypto');
+
+const iv = Buffer.from('f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff', 'hex');
+const plaintext = Buffer.from(
+  '000102030405060708090a0b0c0d0e0f10', 'hex');
+const cases = [
+  {
+    algorithm: 'aes-128-xts',
+    key: Buffer.from(
+      '000102030405060708090a0b0c0d0e0f' +
+      '101112131415161718191a1b1c1d1e1f', 'hex'),
+  },
+  {
+    algorithm: 'sm4-xts',
+    key: Buffer.from(
+      '2b7e151628aed2a6abf7158809cf4f3c' +
+      '000102030405060708090a0b0c0d0e0f', 'hex'),
+  },
+];
+
+for (const { algorithm, key } of cases) {
+  if (!getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`unsupported ${algorithm} test`);
+    continue;
+  }
+
+  const cipher = createCipheriv(algorithm, key, iv);
+  const ciphertext = cipher.update(plaintext);
+  assert.strictEqual(ciphertext.length, plaintext.length);
+  assert.deepStrictEqual(cipher.final(), Buffer.alloc(0));
+
+  const decipher = createDecipheriv(algorithm, key, iv);
+  assert.deepStrictEqual(decipher.update(ciphertext), plaintext);
+  assert.deepStrictEqual(decipher.final(), Buffer.alloc(0));
+
+  for (const [create, input, expected] of [
+    [createCipheriv, plaintext, ciphertext],
+    [createDecipheriv, ciphertext, plaintext],
+  ]) {
+    const withoutUpdate = create(algorithm, key, iv);
+    assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+    const failedUpdate = create(algorithm, key, iv);
+    assert.throws(() => failedUpdate.update(Buffer.alloc(15)),
+                  /Trying to add data in unsupported state/);
+    assert.throws(() => failedUpdate.final(), /Unsupported state/);
+
+    const retry = create(algorithm, key, iv);
+    assert.throws(() => retry.update(Buffer.alloc(15)),
+                  /Trying to add data in unsupported state/);
+    assert.deepStrictEqual(retry.update(input), expected);
+    assert.deepStrictEqual(retry.final(), Buffer.alloc(0));
+
+    const oneUpdate = create(algorithm, key, iv);
+    assert.deepStrictEqual(oneUpdate.update(input), expected);
+    assert.throws(() => oneUpdate.update(Buffer.alloc(16)),
+                  /Trying to add data in unsupported state/);
+    assert.deepStrictEqual(oneUpdate.final(), Buffer.alloc(0));
+  }
+}
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index ee8849163ae8..f7530aecfc5d 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -144,9 +144,15 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
     ecdh4.setPrivateKey(ecdh1.getPrivateKey());
     ecdh4.setPublicKey(ecdh1.getPublicKey());
 
+    const ecdh4Secret = ecdh4.computeSecret(ecdh2.getPublicKey());
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
+
     assert.throws(() => {
       ecdh4.setPublicKey(ecdh3.getPublicKey());
     }, { message: 'Failed to convert Buffer to EC_POINT' });
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
 
     // Verify that we can use ECDH without having to use newly generated keys.
     const ecdh5 = crypto.createECDH('secp256k1');
@@ -190,6 +196,8 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
                        sharedSecret);
     assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
                        sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
 
     // Verify that we still have the same key pair as before the computation.
     assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
@@ -260,3 +268,31 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
     '-----END EC PRIVATE KEY-----';
   crypto.createSign('SHA256').sign(ecPrivateKey);
 }
+
+if (hasFIPS(3) && availableCurves.has('secp256k1')) {
+  const originalFips = crypto.getFips();
+
+  try {
+    crypto.setFips(0);
+    const local = crypto.createECDH('secp256k1');
+    const peer = crypto.createECDH('secp256k1');
+    local.generateKeys();
+    const peerPublicKey = peer.generateKeys();
+
+    local.computeSecret(peerPublicKey);
+    crypto.setFips(1);
+    assert.throws(() => local.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+
+    const installed = crypto.createECDH('secp256k1');
+    installed.setPrivateKey(Buffer.from('cafebabe'.repeat(8), 'hex'));
+    assert.throws(() => installed.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+  } finally {
+    crypto.setFips(originalFips);
+  }
+}
diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js
new file mode 100644
index 000000000000..cc65d0016269
--- /dev/null
+++ b/test/parallel/test-crypto-fips-indicator-strict.js
@@ -0,0 +1,153 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+if (process.features.openssl_is_boringssl) {
+  common.skip('BoringSSL does not support FIPS');
+}
+
+const assert = require('node:assert');
+const diagnosticsChannel = require('node:diagnostics_channel');
+const { once } = require('node:events');
+const { createHmac, subtle } = require('node:crypto');
+const { Worker } = require('node:worker_threads');
+const {
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+const channelName = 'crypto.fips.indicator';
+const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
+
+if (!hasOpenSSL(3, 4)) {
+  common.skip('OpenSSL 3.4 or later is required');
+} else if (!hasFIPS(3, 4)) {
+  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+} else if (mode === 'provider') {
+  assertSerializedMode(mode);
+  assert.strictEqual(
+    createHmac('sha256', Buffer.alloc(13)).digest().byteLength, 32);
+} else if (mode === 'strict') {
+  assertSerializedMode(mode);
+  const subscriber = common.mustNotCall();
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  assert.throws(
+    () => createHmac('sha256', Buffer.alloc(13)).digest(),
+    { code: /^ERR_OSSL_/ });
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+  }));
+} else if (mode === 'strict-events') {
+  assertSerializedMode('strict');
+  testStrictEvents().then(common.mustCall());
+} else {
+  runParent();
+}
+
+function assertSerializedMode(expected) {
+  const { getOptionsAsFlagsFromBinding } = require('internal/options');
+  assert.ok(getOptionsAsFlagsFromBinding().includes(`--force-fips=${expected}`));
+}
+
+function nextIndicator() {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall((event, name) => {
+    assert.strictEqual(name, channelName);
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    resolve(event);
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  return promise;
+}
+
+function runParent() {
+  try {
+    createHmac('sha256', Buffer.alloc(13)).digest();
+  } catch (error) {
+    assert.match(error.code, /^ERR_OSSL_/);
+    common.printSkipMessage(
+      'the FIPS provider rejects unapproved operations before signaling');
+    return;
+  }
+
+  for (const [args, childMode] of [
+    [['--force-fips'], 'provider'],
+    [['--force-fips=provider'], 'provider'],
+    [['--force-fips=strict'], 'strict'],
+    [[
+      '--force-fips=strict',
+      '--enable-fips-indicator-events',
+    ], 'strict-events'],
+  ]) {
+    spawnSyncAndExitWithoutError(
+      process.execPath, [...args, '--expose-internals', __filename], {
+        env: { ...process.env, NODE_TEST_FIPS_FORCE_MODE: childMode },
+      });
+  }
+}
+
+async function testStrictEvents() {
+  const key = Buffer.alloc(13);
+
+  assert.throws(
+    () => createHmac('sha256', key).digest(),
+    { code: /^ERR_OSSL_/ });
+
+  let eventPromise = nextIndicator();
+  assert.throws(
+    () => createHmac('sha256', key).digest(),
+    { code: /^ERR_OSSL_/ });
+  assert.deepStrictEqual(await eventPromise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: true,
+    count: 1,
+    dropped: 0,
+  });
+
+  const hmacKey = await subtle.importKey(
+    'raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  eventPromise = nextIndicator();
+  await assert.rejects(
+    subtle.sign('HMAC', hmacKey, Buffer.alloc(0)),
+    { name: 'OperationError' });
+  const webCryptoEvent = await eventPromise;
+  assert.strictEqual(webCryptoEvent.operation, 'HMAC');
+  assert.strictEqual(webCryptoEvent.reason, 'keysize');
+  assert.strictEqual(webCryptoEvent.blocked, true);
+
+  eventPromise = nextIndicator();
+  const worker = new Worker(`
+    'use strict';
+    const { createHmac } = require('node:crypto');
+    const { workerData } = require('node:worker_threads');
+    createHmac('sha256', workerData.key).digest();
+  `, {
+    eval: true,
+    workerData: { key },
+  });
+  const errorPromise = once(worker, 'error');
+  const exitPromise = new Promise((resolve) => worker.on('exit', resolve));
+  const [[error], workerEvent] = await Promise.all([
+    errorPromise,
+    eventPromise,
+  ]);
+  assert.match(error.code, /^ERR_OSSL_/);
+  assert.deepStrictEqual(workerEvent, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: true,
+    count: 1,
+    dropped: 0,
+  });
+  const exitCode = await exitPromise;
+  assert.strictEqual(exitCode, 1);
+}
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 8b2e1c9a3649..ea20d895b1c8 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -10,10 +10,11 @@ if (process.features.openssl_is_boringssl)
 const assert = require('assert');
 const spawnSync = require('child_process').spawnSync;
 const path = require('path');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -94,6 +95,45 @@ testHelper(
   'require("crypto").getFips()',
   process.env);
 
+// Explicit provider mode should preserve the behavior of bare --force-fips.
+testHelper(
+  testFipsCrypto() ? 'stdout' : 'stderr',
+  ['--force-fips=provider'],
+  testFipsCrypto() ? kNoFailure : kGenericUserError,
+  testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+  'require("crypto").getFips()',
+  process.env);
+
+{
+  spawnSyncAndAssert(
+    process.execPath, ['--force-fips=invalid', '-e', '0'], {
+      status: 9,
+      stderr: /invalid value for --force-fips; expected 'provider' or 'strict'/,
+    });
+}
+
+if (hasOpenSSL(3, 4)) {
+  testHelper(
+    testFipsCrypto() ? 'stdout' : 'stderr',
+    ['--force-fips=strict'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
+    testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+    'require("crypto").getFips()',
+    process.env);
+} else {
+  spawnSyncAndAssert(
+    process.execPath, ['--enable-fips-indicator-events', '-e', '0'], {
+      status: 9,
+      stderr: /--enable-fips-indicator-events requires OpenSSL 3\.4 or later/,
+    });
+
+  spawnSyncAndAssert(
+    process.execPath, ['--force-fips=strict', '-e', '0'], {
+      status: 9,
+      stderr: /--force-fips=strict requires OpenSSL 3\.4 or later/,
+    });
+}
+
 // By default FIPS should be off in both FIPS and non-FIPS builds
 // unless Node.js was configured using --shared-openssl in
 // which case it may be enabled by the system.
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index 0a984f0ce54e..5afd2e5a4208 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -5,11 +5,12 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const {
+  createCipheriv,
   createHash,
   getCiphers,
   getCipherInfo,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL3 } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -17,6 +18,42 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
+if (hasOpenSSL3) {
+  assert.deepStrictEqual(
+    ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
+  for (const cipher of [
+    'null',
+    'aes-128-cbc-hmac-sha1',
+    'aes-256-cbc-hmac-sha1',
+    'aes-128-cbc-hmac-sha256',
+    'aes-256-cbc-hmac-sha256',
+    'aes-128-cbc-hmac-sha1-etm',
+    'aes-192-cbc-hmac-sha1-etm',
+    'aes-256-cbc-hmac-sha1-etm',
+    'aes-128-cbc-hmac-sha256-etm',
+    'aes-192-cbc-hmac-sha256-etm',
+    'aes-256-cbc-hmac-sha256-etm',
+    'aes-128-cbc-hmac-sha512-etm',
+    'aes-192-cbc-hmac-sha512-etm',
+    'aes-256-cbc-hmac-sha512-etm',
+  ]) {
+    assert(!ciphers.includes(cipher));
+    assert.strictEqual(getCipherInfo(cipher), undefined);
+    assert.throws(
+      () => createCipheriv(cipher, Buffer.alloc(16), Buffer.alloc(16)), {
+        code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+      });
+  }
+}
+
+if (ciphers.includes('aes-128-wrap-inv')) {
+  const alias = 'aes128-wrap-inv';
+  assert(ciphers.includes(alias));
+  assert.deepStrictEqual(getCipherInfo(alias),
+                         getCipherInfo('aes-128-wrap-inv'));
+}
+assert(!ciphers.some((cipher) => /^\d+(?:\.\d+)+$/.test(cipher)));
+
 if (!process.features.openssl_is_boringssl) {
   // A failed provider fetch must not contaminate the OpenSSL error queue.
   assert.throws(() => createHash('sha256', { outputLength: 28 }), {
@@ -96,6 +133,19 @@ if (hasFIPS(3)) {
   common.printSkipMessage('Skipping unsupported aes-128-ocb test cases');
 }
 
+if (ciphers.includes('aes-128-cbc-cts')) {
+  const info = getCipherInfo('aes-128-cbc-cts');
+  assert.strictEqual(info.name, 'aes-128-cbc-cts');
+  assert.strictEqual(info.mode, 'cbc');
+  assert.strictEqual(info.keyLength, 16);
+  assert.strictEqual(info.blockSize, 16);
+  assert.strictEqual(info.ivLength, 16);
+  assert(getCipherInfo('aes-128-cbc-cts', { ivLength: 16 }));
+  assert(!getCipherInfo('aes-128-cbc-cts', { ivLength: 15 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-cbc-cts test cases');
+}
+
 if (ciphers.includes('aes-128-siv')) {
   const info = getCipherInfo('aes-128-siv');
   assert.strictEqual(info.name, 'aes-128-siv');
@@ -119,3 +169,20 @@ if (ciphers.includes('aes-128-gcm-siv')) {
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-gcm-siv test cases');
 }
+
+for (const [name, mode, keyLength, ivLength] of [
+  ['sm4-gcm', 'gcm', 16, 12],
+  ['sm4-ccm', 'ccm', 16, 12],
+  ['sm4-xts', 'xts', 32, 16],
+]) {
+  if (ciphers.includes(name)) {
+    const info = getCipherInfo(name);
+    assert.strictEqual(info.name, name);
+    assert.strictEqual(info.mode, mode);
+    assert.strictEqual(info.nid, undefined);
+    assert.strictEqual(info.keyLength, keyLength);
+    assert.strictEqual(info.ivLength, ivLength);
+  } else {
+    common.printSkipMessage(`Skipping unsupported ${name} test cases`);
+  }
+}
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 29740a2fc247..ca6a424c5293 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -312,6 +312,26 @@ for (let i = 0, l = rfc4231.length; i < l; i++) {
   }
 }
 
+// Calling digest() after the Hmac has already been used as a stream must
+// return an empty buffer (the DEP0206 repeat-digest guard), not uninitialized
+// stack memory. The stream itself must still produce the correct digest.
+// See: https://github.com/nodejs/node/issues/28245
+{
+  const key = 'key';
+  const data = 'some data to hash';
+
+  const streamHmac = crypto.createHmac('sha256', key);
+  streamHmac.end(data);
+  const streamDigest = streamHmac.read();
+
+  // digest() after the stream already finalized must not return garbage.
+  assert.deepStrictEqual(streamHmac.digest(), Buffer.alloc(0));
+
+  // Sanity check: the stream itself produced the correct digest.
+  const expected = crypto.createHmac('sha256', key).update(data).digest();
+  assert.deepStrictEqual(streamDigest, expected);
+}
+
 // Test HMAC-MD5/SHA1 (rfc 2202 Test Cases)
 const rfc2202_md5 = [
   {
diff --git a/test/parallel/test-crypto-keyobject-clone-transfer.js b/test/parallel/test-crypto-keyobject-clone-transfer.js
index 6786df288589..2ac37ca201e7 100644
--- a/test/parallel/test-crypto-keyobject-clone-transfer.js
+++ b/test/parallel/test-crypto-keyobject-clone-transfer.js
@@ -53,23 +53,25 @@ async function roundTripViaMessageChannel(key) {
   return received;
 }
 
-async function roundTripViaWorker(key) {
-  const worker = new Worker(`
-    'use strict';
-    const { parentPort } = require('node:worker_threads');
-    const { types: { isKeyObject } } = require('node:util');
-
-    parentPort.once('message', ({ key, expectedType }) => {
-      try {
-        if (!isKeyObject(key) || key.type !== expectedType) {
-          throw new Error('KeyObject slot mismatch in worker');
-        }
-        parentPort.postMessage({ key });
-      } catch (err) {
-        parentPort.postMessage({ error: err.stack || err.message });
+function workerMain() {
+  const { parentPort } = require('node:worker_threads');
+  const { types: { isKeyObject: workerIsKeyObject } } = require('node:util');
+
+  parentPort.once('message', ({ key, expectedType }) => {
+    try {
+      if (!workerIsKeyObject(key) || key.type !== expectedType) {
+        throw new Error('KeyObject slot mismatch in worker');
       }
-    });
-  `, { eval: true });
+      parentPort.postMessage({ key });
+    } catch (err) {
+      parentPort.postMessage({ error: err.stack || err.message });
+    }
+  });
+}
+
+async function roundTripViaWorker(key) {
+  const worker = new Worker(
+    `'use strict';(${workerMain.toString()})()`, { eval: true });
 
   worker.postMessage({ key, expectedType: key.type });
   const [msg] = await once(worker, 'message');
diff --git a/test/parallel/test-crypto-mac-cache-snapshot.js b/test/parallel/test-crypto-mac-cache-snapshot.js
new file mode 100644
index 000000000000..1fd37367d2a8
--- /dev/null
+++ b/test/parallel/test-crypto-mac-cache-snapshot.js
@@ -0,0 +1,32 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL3 } = require('../common/crypto');
+if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+  common.skip('this test requires OpenSSL 3 EVP_MAC support');
+
+const assert = require('node:assert');
+const { getMacs } = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
+
+if (!getMacs().includes('poly1305'))
+  common.skip('Poly1305 is not supported');
+
+const entry = fixtures.path('snapshot', 'crypto-provider-mac-cache.js');
+const buildEnv = {
+  OPENSSL_CONF: fixtures.path(
+    'openssl3-conf', 'legacy_provider_enabled.cnf'),
+};
+const runEnv = {
+  OPENSSL_CONF: fixtures.path('openssl3-conf', 'default_only.cnf'),
+};
+
+tmpdir.refresh();
+buildSnapshot(entry, buildEnv);
+const { stdout } = runWithSnapshot(undefined, runEnv);
+assert.match(stdout, /provider MAC cache snapshot: ok/);
diff --git a/test/parallel/test-crypto-mac-cache.js b/test/parallel/test-crypto-mac-cache.js
new file mode 100644
index 000000000000..dfe99e943bb2
--- /dev/null
+++ b/test/parallel/test-crypto-mac-cache.js
@@ -0,0 +1,307 @@
+// Flags: --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL3 } = require('../common/crypto');
+if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+  common.skip('this test requires OpenSSL 3 EVP_MAC support');
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  createMac,
+  getFips,
+  getMacs,
+  setFips,
+} = require('node:crypto');
+const { getMacCache } = require('internal/crypto/util');
+const { internalBinding } = require('internal/test/binding');
+const { Worker } = require('node:worker_threads');
+
+const binding = internalBinding('crypto');
+const algorithm = 'poly1305';
+const key = Buffer.from(
+  '85d6be7857556d337f4452fe42d506a8' +
+  '0103808afb0db2fd4abff6af4149f51b',
+  'hex',
+);
+const data = Buffer.from('Cryptographic Forum Research Group');
+const expected = 'a8061dc1305136c6c22b8baf0c0127a9';
+const originalFips = getFips();
+
+function getAliasId(aliases, name) {
+  const normalized = name.toLowerCase();
+  for (const [alias, id] of Object.entries(aliases)) {
+    if (alias.toLowerCase() === normalized) return id;
+  }
+  return undefined;
+}
+
+try {
+  setFips(0);
+} catch {
+  common.skip('FIPS mode cannot be disabled');
+}
+if (getFips() !== 0)
+  common.skip('FIPS mode cannot be disabled');
+
+const initialMacs = getMacs();
+if (!initialMacs.includes(algorithm))
+  common.skip(`${algorithm} is not supported`);
+
+let fipsMacs;
+let canToggleFips = false;
+const generationBeforeFipsProbe = binding.getFipsCryptoGeneration();
+try {
+  setFips(1);
+} catch {
+  // FIPS mode is optional, so the non-FIPS cache checks below still run.
+  assert.strictEqual(
+    binding.getFipsCryptoGeneration(),
+    generationBeforeFipsProbe,
+  );
+}
+if (getFips() === 1) {
+  fipsMacs = getMacs();
+  canToggleFips = true;
+}
+try {
+  setFips(0);
+} catch {
+  canToggleFips = false;
+}
+
+const generation = binding.getFipsCryptoGeneration();
+setFips(0);
+assert.strictEqual(binding.getFipsCryptoGeneration(), generation);
+
+const expectedMacs = getMacs();
+const disposableMacs = getMacs();
+assert.notStrictEqual(disposableMacs, expectedMacs);
+disposableMacs.length = 0;
+disposableMacs.push('not-a-real-mac');
+assert.deepStrictEqual(getMacs(), expectedMacs);
+
+const aliases = binding.getCachedMacAliases();
+const initialAlgorithmId = getAliasId(aliases, algorithm);
+assert.strictEqual(typeof initialAlgorithmId, 'number');
+
+const macCache = getMacCache();
+const cacheName = Object.keys(macCache).find(
+  (name) => name.toLowerCase() === algorithm,
+);
+assert(cacheName);
+const descriptor = Object.getOwnPropertyDescriptor(macCache, cacheName);
+assert(descriptor);
+assert.strictEqual(descriptor.value, initialAlgorithmId);
+const sentinel = new Error('mac cache setter');
+const throwsSentinel = (err) => err === sentinel;
+
+function installThrowingMacCacheEntry(id) {
+  Object.defineProperty(macCache, cacheName, {
+    __proto__: null,
+    configurable: true,
+    enumerable: descriptor.enumerable,
+    get() { return id; },
+    set() { throw sentinel; },
+  });
+}
+
+installThrowingMacCacheEntry(-1);
+assert.throws(() => createMac(cacheName, key), throwsSentinel);
+Object.defineProperty(macCache, cacheName, descriptor);
+
+// OpenSSL exposes two spellings for each KMAC implementation. They must map
+// to the same cached EVP_MAC rather than consume separate cache entries.
+const kmac128Id = getAliasId(aliases, 'kmac128');
+const kmac128HyphenatedId = getAliasId(aliases, 'kmac-128');
+if (kmac128Id === undefined || kmac128HyphenatedId === undefined) {
+  common.printSkipMessage('KMAC-128 aliases are not available');
+} else {
+  assert.strictEqual(kmac128Id, kmac128HyphenatedId);
+  const kmacAlgorithm = 'KMAC128';
+  const hyphenatedAlgorithm = 'KMAC-128';
+  const kmacOptions = { outputLength: 32 };
+  const kmacKey = Buffer.alloc(32, 0x42);
+  const kmacData = Buffer.from('cache alias test');
+  assert.deepStrictEqual(
+    createMac(kmacAlgorithm, kmacKey, kmacOptions)
+      .update(kmacData).final(),
+    createMac(hyphenatedAlgorithm, kmacKey, kmacOptions)
+      .update(kmacData).final(),
+  );
+  const aliasesAfterUse = binding.getCachedMacAliases();
+  assert.strictEqual(getAliasId(aliasesAfterUse, 'kmac128'), kmac128Id);
+  assert.strictEqual(
+    getAliasId(aliasesAfterUse, 'kmac-128'),
+    kmac128Id,
+  );
+}
+
+if (!canToggleFips || fipsMacs.includes(algorithm)) {
+  common.printSkipMessage('FIPS cache invalidation cannot be exercised');
+  try {
+    setFips(originalFips);
+  } catch {
+    // The process is about to exit and FIPS support is optional.
+  }
+} else {
+  const liveMac = createMac(algorithm, key).update(data);
+  const worker = new Worker(`
+    'use strict';
+    const {
+      createMac,
+      getFips,
+      getMacs,
+    } = require('node:crypto');
+    const { internalBinding } = require('internal/test/binding');
+    const { parentPort, workerData } = require('node:worker_threads');
+
+    function getAliasId(aliases, name) {
+      const normalized = name.toLowerCase();
+      for (const [alias, id] of Object.entries(aliases)) {
+        if (alias.toLowerCase() === normalized) return id;
+      }
+      return undefined;
+    }
+
+    const binding = internalBinding('crypto');
+    const key = Buffer.from(workerData.key);
+    const data = Buffer.from(workerData.data);
+    const liveMac = createMac(workerData.algorithm, key).update(data);
+    getMacs();
+    const initialAlgorithmId = getAliasId(
+      binding.getCachedMacAliases(),
+      workerData.algorithm,
+    );
+    parentPort.postMessage({
+      phase: 'warm',
+      algorithmId: initialAlgorithmId,
+      generation: binding.getFipsCryptoGeneration(),
+    });
+
+    parentPort.on('message', (phase) => {
+      if (phase === 'fips-on') {
+        let errorCode;
+        try {
+          createMac(workerData.algorithm, key);
+        } catch (error) {
+          errorCode = error.code;
+        }
+        const macs = getMacs();
+        parentPort.postMessage({
+          phase,
+          algorithmId: getAliasId(
+            binding.getCachedMacAliases(),
+            workerData.algorithm,
+          ),
+          errorCode,
+          fips: getFips(),
+          generation: binding.getFipsCryptoGeneration(),
+          hasAlgorithm: macs.includes(workerData.algorithm),
+          tag: liveMac.final('hex'),
+        });
+      } else if (phase === 'fips-off') {
+        const macs = getMacs();
+        parentPort.postMessage({
+          phase,
+          algorithmId: getAliasId(
+            binding.getCachedMacAliases(),
+            workerData.algorithm,
+          ),
+          fips: getFips(),
+          generation: binding.getFipsCryptoGeneration(),
+          hasAlgorithm: macs.includes(workerData.algorithm),
+          tag: createMac(workerData.algorithm, key)
+            .update(data).final('hex'),
+        });
+      } else {
+        parentPort.close();
+      }
+    });
+  `, {
+    eval: true,
+    workerData: { algorithm, data, key },
+  });
+  worker.on('error', common.mustNotCall());
+
+  (async () => {
+    const exitPromise = once(worker, 'exit');
+    try {
+      const [warm] = await once(worker, 'message');
+      assert.strictEqual(warm.phase, 'warm');
+      assert.strictEqual(typeof warm.algorithmId, 'number');
+      assert.strictEqual(warm.generation, generation);
+
+      installThrowingMacCacheEntry(descriptor.value);
+      try {
+        setFips(1);
+        assert.throws(() => createMac(cacheName, key), throwsSentinel);
+        installThrowingMacCacheEntry(-1);
+        assert.throws(() => createMac(cacheName, key), throwsSentinel);
+      } finally {
+        Object.defineProperty(macCache, cacheName, descriptor);
+      }
+      const enabledGeneration = binding.getFipsCryptoGeneration();
+      assert.strictEqual(enabledGeneration, generation + 1n);
+      assert.strictEqual(getFips(), 1);
+      assert(!getMacs().includes(algorithm));
+      assert.strictEqual(
+        getAliasId(binding.getCachedMacAliases(), algorithm),
+        undefined,
+      );
+      assert.throws(() => createMac(algorithm, key), {
+        code: 'ERR_CRYPTO_INVALID_MAC',
+      });
+      assert.strictEqual(liveMac.final('hex'), expected);
+
+      let responsePromise = once(worker, 'message');
+      worker.postMessage('fips-on');
+      const [enabled] = await responsePromise;
+      assert.strictEqual(enabled.phase, 'fips-on');
+      assert.strictEqual(enabled.algorithmId, undefined);
+      assert.strictEqual(enabled.errorCode, 'ERR_CRYPTO_INVALID_MAC');
+      assert.strictEqual(enabled.fips, 1);
+      assert.strictEqual(enabled.generation, enabledGeneration);
+      assert.strictEqual(enabled.hasAlgorithm, false);
+      assert.strictEqual(enabled.tag, expected);
+
+      setFips(0);
+      const disabledGeneration = binding.getFipsCryptoGeneration();
+      assert.strictEqual(disabledGeneration, enabledGeneration + 1n);
+      assert.strictEqual(getFips(), 0);
+      assert(getMacs().includes(algorithm));
+      const restoredAlgorithmId = getAliasId(
+        binding.getCachedMacAliases(),
+        algorithm,
+      );
+      assert.strictEqual(typeof restoredAlgorithmId, 'number');
+      assert.notStrictEqual(restoredAlgorithmId, initialAlgorithmId);
+      assert.strictEqual(
+        createMac(algorithm, key).update(data).final('hex'),
+        expected,
+      );
+
+      responsePromise = once(worker, 'message');
+      worker.postMessage('fips-off');
+      const [disabled] = await responsePromise;
+      assert.strictEqual(disabled.phase, 'fips-off');
+      assert.strictEqual(disabled.fips, 0);
+      assert.strictEqual(disabled.generation, disabledGeneration);
+      assert.strictEqual(disabled.hasAlgorithm, true);
+      assert.strictEqual(typeof disabled.algorithmId, 'number');
+      assert.notStrictEqual(disabled.algorithmId, warm.algorithmId);
+      assert.strictEqual(disabled.tag, expected);
+
+      worker.postMessage('done');
+      const [code] = await exitPromise;
+      assert.strictEqual(code, 0);
+    } finally {
+      if (worker.threadId !== -1) await worker.terminate();
+      setFips(originalFips);
+    }
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js
new file mode 100644
index 000000000000..43e464bb737e
--- /dev/null
+++ b/test/parallel/test-crypto-mac-errors.js
@@ -0,0 +1,180 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const fixtures = require('../common/fixtures');
+const {
+  createMac,
+  createPublicKey,
+  createSecretKey,
+  getMacs,
+} = require('node:crypto');
+
+const key = Buffer.alloc(32, 0x42);
+const data = Buffer.from('data');
+const availableMacs = new Set(getMacs());
+
+function invalidType(fn) {
+  assert.throws(fn, { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+function invalidValue(fn) {
+  assert.throws(fn, { code: 'ERR_INVALID_ARG_VALUE' });
+}
+
+for (const algorithm of [undefined, null, 1, true, [], {}]) {
+  invalidType(() => createMac(algorithm, key));
+}
+
+for (const algorithm of ['', 'hmac\0sha256']) {
+  invalidValue(() => createMac(algorithm, key));
+}
+
+for (const [algorithm, options] of [
+  ['hmac', { digest: 1 }],
+  ['cmac', { cipher: 1 }],
+  ['gmac', { iv: 'not a BufferSource' }],
+  ['kmac128', { customization: 'not a BufferSource' }],
+  ['blake2bmac', { salt: 'not a BufferSource' }],
+  ['kmac128', { outputLength: '32' }],
+]) {
+  invalidType(() => createMac(algorithm, key, options));
+}
+
+for (const [algorithm, options] of [
+  ['hmac', { digest: 'sha256\0sha512' }],
+  ['cmac', { cipher: 'aes-128-cbc\0aes-256-cbc' }],
+]) {
+  invalidValue(() => createMac(algorithm, key, options));
+}
+
+for (const outputLength of [-1, 0.5, 2 ** 32, Infinity, NaN]) {
+  assert.throws(
+    () => createMac('kmac128', key, { outputLength }),
+    { code: 'ERR_OUT_OF_RANGE' },
+  );
+}
+
+assert.throws(
+  () => createMac('definitely-not-a-mac', key),
+  { code: 'ERR_CRYPTO_INVALID_MAC' },
+);
+
+if (availableMacs.has('siphash')) {
+  assert.throws(() => createMac('siphash', Buffer.alloc(15)), (error) => {
+    assert.strictEqual(error.name, 'Error');
+    assert.strictEqual(error.message, 'Failed to initialize MAC');
+    assert.strictEqual(error.code, 'ERR_CRYPTO_OPERATION_FAILED');
+    for (const property of [
+      'function',
+      'library',
+      'reason',
+      'opensslErrorStack',
+    ]) {
+      assert.ok(!(property in error));
+    }
+    return true;
+  });
+}
+
+if (availableMacs.has('hmac')) {
+  const algorithm = 'hmac';
+  const options = { digest: 'sha256' };
+  assert.throws(
+    () => createMac(algorithm, key, { digest: 'definitely-not-a-digest' }),
+    {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+      library: 'digital envelope routines',
+      reason: 'unsupported',
+    },
+  );
+  const publicKey = createPublicKey(fixtures.readKey('rsa_public.pem'));
+  const cryptoKey = createSecretKey(key).toCryptoKey(
+    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  for (const invalidKey of [
+    undefined,
+    null,
+    'key',
+    {},
+    publicKey,
+    cryptoKey,
+  ]) {
+    invalidType(() => createMac(algorithm, invalidKey, options));
+  }
+
+  for (const invalidData of [
+    undefined,
+    null,
+    1,
+    true,
+    {},
+    new ArrayBuffer(4),
+  ]) {
+    invalidType(() => createMac(algorithm, key, options).update(invalidData));
+  }
+
+  invalidType(() => createMac(algorithm, key, options).update('data', 1));
+  invalidType(() => createMac(algorithm, key, options).final(1));
+  invalidType(() => createMac(algorithm, key, 'hex'));
+
+  invalidValue(() => createMac(algorithm, key, options)
+    .update('data', 'not-an-encoding'));
+  const invalidFinalEncoding = createMac(algorithm, key, options);
+  invalidValue(() => invalidFinalEncoding.final('not-an-encoding'));
+  assert.deepStrictEqual(
+    invalidFinalEncoding.update(data).final(),
+    createMac(algorithm, key, options).update(data).final(),
+  );
+  invalidValue(() => createMac(algorithm, key, options).update('0', 'hex'));
+
+  invalidValue(() => createMac('hmac', key));
+  for (const extra of [
+    { cipher: 'aes-128-cbc' },
+    { iv: Buffer.alloc(12) },
+    { customization: Buffer.alloc(0) },
+    { salt: Buffer.alloc(16) },
+    { outputLength: 16 },
+  ]) {
+    invalidValue(() => createMac('hmac', key, {
+      ...options,
+      ...extra,
+    }));
+  }
+}
+
+if (availableMacs.has('cmac')) {
+  invalidValue(() => createMac('cmac', key));
+  invalidValue(() => createMac('cmac', key, { digest: 'sha256' }));
+  invalidValue(() => createMac('cmac', key, {
+    cipher: 'aes-256-cbc',
+    iv: Buffer.alloc(16),
+  }));
+}
+
+if (availableMacs.has('gmac')) {
+  invalidValue(() => createMac('gmac', key));
+  invalidValue(() => createMac('gmac', key, { cipher: 'aes-256-gcm' }));
+  invalidValue(() => createMac('gmac', key, { iv: Buffer.alloc(12) }));
+  invalidValue(() => createMac('gmac', key, {
+    cipher: 'aes-256-gcm',
+    iv: Buffer.alloc(12),
+    digest: 'sha256',
+  }));
+}
+
+if (availableMacs.has('poly1305')) {
+  invalidValue(() => createMac('poly1305', key, {
+    customization: Buffer.alloc(0),
+  }));
+}
diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js
new file mode 100644
index 000000000000..68bb79f301e5
--- /dev/null
+++ b/test/parallel/test-crypto-mac-unsupported.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (hasOpenSSL3 && !process.features.openssl_is_boringssl) {
+  common.skip('this test requires a build without EVP_MAC support');
+}
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const algorithm = 'hmac';
+const options = { digest: 'sha256' };
+const key = Buffer.from('key');
+
+assert.strictEqual(typeof crypto.createMac, 'function');
+assert.strictEqual(typeof crypto.getMacs, 'function');
+assert.strictEqual(crypto.Mac, undefined);
+assert.deepStrictEqual(crypto.getMacs(), []);
+assert.throws(() => crypto.createMac(algorithm, key, options), {
+  code: 'ERR_CRYPTO_MAC_NOT_SUPPORTED',
+});
+(async () => {
+  const esmCrypto = await import('node:crypto');
+  assert.strictEqual(esmCrypto.createMac, crypto.createMac);
+  assert.strictEqual(esmCrypto.getMacs, crypto.getMacs);
+  assert.strictEqual(esmCrypto.Mac, undefined);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js
new file mode 100644
index 000000000000..ec9f0cffe877
--- /dev/null
+++ b/test/parallel/test-crypto-mac-vectors.js
@@ -0,0 +1,179 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const { encodingsMap } = require('internal/util');
+const {
+  createMac,
+  getCiphers,
+  getMacs,
+} = require('node:crypto');
+
+const availableMacs = new Set(getMacs());
+const availableCiphers = new Set(getCiphers());
+const kmacVectors = require('../fixtures/crypto/kmac')();
+const gmacIVStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.alloc(12),
+  0xff,
+]);
+const blake2bSaltStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex'),
+  0xff,
+]);
+const blake2sSaltStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.from('0001020304050607', 'hex'),
+  0xff,
+]);
+
+const vectors = [
+  {
+    label: 'CMAC-AES-128',
+    algorithm: 'cmac',
+    options: { cipher: 'aes-128-cbc' },
+    key: '2b7e151628aed2a6abf7158809cf4f3c',
+    data: '',
+    expected: 'bb1d6929e95937287fa37d129b756746',
+    cipher: 'aes-128-cbc',
+  },
+  {
+    label: 'GMAC-AES-128',
+    algorithm: 'gmac',
+    options: {
+      cipher: 'aes-128-gcm',
+      iv: new DataView(gmacIVStorage.buffer, 1, 12),
+    },
+    key: '00000000000000000000000000000000',
+    data: '',
+    expected: '58e2fccefa7e3061367f1d57a4e7455a',
+    cipher: 'aes-128-gcm',
+  },
+  {
+    label: 'Poly1305',
+    algorithm: 'poly1305',
+    key: '85d6be7857556d337f4452fe42d506a8' +
+         '0103808afb0db2fd4abff6af4149f51b',
+    data: Buffer.from('Cryptographic Forum Research Group').toString('hex'),
+    expected: 'a8061dc1305136c6c22b8baf0c0127a9',
+  },
+  {
+    label: 'SipHash-2-4',
+    algorithm: 'siphash',
+    options: { outputLength: 8 },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: '',
+    expected: '310e0edd47db6f72',
+  },
+  {
+    label: 'BLAKE2b MAC',
+    algorithm: 'blake2bmac',
+    options: {
+      outputLength: 32,
+      salt: new DataView(blake2bSaltStorage.buffer, 1, 16),
+    },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: Buffer.from('abc').toString('hex'),
+    expected: '6e583b101a126f2d1fb6d1fff9834f3a' +
+              '0d0e23c17b902cca4f1a0d7abfb327fa',
+  },
+  {
+    label: 'BLAKE2s MAC',
+    algorithm: 'blake2smac',
+    options: {
+      outputLength: 16,
+      salt: new DataView(blake2sSaltStorage.buffer, 1, 8),
+    },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: Buffer.from('abc').toString('hex'),
+    expected: '18adff242af55a56c7b7646df6c3d9ba',
+  },
+];
+
+for (const index of [0, 3]) {
+  const vector = kmacVectors[index];
+  const algorithm = vector.algorithm.toLowerCase();
+  const options = {
+    outputLength: vector.outputLength / 8,
+  };
+  if (vector.customization !== undefined) {
+    const storage = Uint8Array.from([
+      0xff,
+      ...vector.customization,
+      0xff,
+    ]);
+    options.customization = new DataView(
+      storage.buffer, 1, vector.customization.length);
+  }
+  vectors.push({
+    label: vector.algorithm,
+    algorithm,
+    options,
+    key: vector.key.toString('hex'),
+    data: vector.data.toString('hex'),
+    expected: vector.expected.toString('hex'),
+  });
+}
+
+for (const vector of vectors) {
+  if (!availableMacs.has(vector.algorithm) ||
+      (vector.cipher !== undefined &&
+       !availableCiphers.has(vector.cipher))) {
+    common.printSkipMessage(`${vector.label} is not available`);
+    continue;
+  }
+
+  const key = Buffer.from(vector.key, 'hex');
+  const data = Buffer.from(vector.data, 'hex');
+  const expected = Buffer.from(vector.expected, 'hex');
+  assert.deepStrictEqual(
+    createMac(vector.algorithm, key, vector.options).update(data).final(),
+    expected,
+  );
+}
+
+if (availableMacs.has('kmac128')) {
+  const vector = kmacVectors[0];
+  const algorithm = 'kmac128';
+  const options = { outputLength: 0 };
+  for (const outputEncoding of Object.keys(encodingsMap)) {
+    if (outputEncoding === 'buffer') continue;
+    assert.strictEqual(
+      createMac(algorithm, vector.key, options)
+        .update(vector.data)
+        .final(outputEncoding),
+      '',
+    );
+  }
+
+  for (const result of [
+    createMac(algorithm, vector.key, options)
+      .update(vector.data)
+      .final(),
+    createMac(algorithm, vector.key, options)
+      .update(vector.data)
+      .final('buffer'),
+  ]) {
+    assert(Buffer.isBuffer(result));
+    assert.deepStrictEqual(result, Buffer.alloc(0));
+  }
+
+  const streamed = createMac(algorithm, vector.key, options);
+  streamed.on('data', common.mustNotCall());
+  streamed.on('end', common.mustCall());
+  streamed.end(vector.data);
+}
diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js
new file mode 100644
index 000000000000..f41bd86509eb
--- /dev/null
+++ b/test/parallel/test-crypto-mac.js
@@ -0,0 +1,225 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const { encodingsMap } = require('internal/util');
+const {
+  createHmac,
+  createMac,
+  createSecretKey,
+  getMacs,
+} = crypto;
+const { finished } = require('node:stream/promises');
+const { Transform } = require('node:stream');
+
+assert.strictEqual(crypto.Mac, undefined);
+
+const firstMacs = getMacs();
+const secondMacs = getMacs();
+
+assert.notStrictEqual(firstMacs, secondMacs);
+assert.deepStrictEqual(firstMacs, [...firstMacs].sort());
+assert.strictEqual(firstMacs.length, new Set(firstMacs).size);
+assert(firstMacs.every((name) => typeof name === 'string'));
+assert(firstMacs.every((name) => name === name.toLowerCase()));
+assert(firstMacs.every((name) => !/^\d+(?:\.\d+)+$/.test(name)));
+
+firstMacs.push('not-a-real-mac');
+assert(!getMacs().includes('not-a-real-mac'));
+
+const availableMacs = new Set(secondMacs);
+if (!availableMacs.has('hmac')) {
+  common.printSkipMessage('HMAC is not available from the active providers');
+} else {
+  const algorithm = 'HMAC';
+  const options = { digest: 'sha256' };
+  const key = Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex');
+  const data = Buffer.from('The quick brown fox jumps over the lazy dog');
+  const expected = createHmac('sha256', key).update(data).digest();
+  const expectedEmpty = createHmac('sha256', key).digest();
+  const expectedEmptyKey = createHmac('sha256', Buffer.alloc(0))
+    .update(data)
+    .digest();
+
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options).update(data.toString()).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options).final(),
+    expectedEmpty,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, Buffer.alloc(0), options).update(data).final(),
+    expectedEmptyKey,
+  );
+
+  const nullPrototypeOptions = Object.assign({ __proto__: null }, options);
+  assert.deepStrictEqual(
+    createMac(algorithm, key, nullPrototypeOptions).update(data).final(),
+    expected,
+  );
+  const inheritedUnknownOptions = Object.assign(
+    { __proto__: { unknown: true } }, options);
+  assert.deepStrictEqual(
+    createMac(algorithm, key, inheritedUnknownOptions).update(data).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, key, { ...options, unknown: true })
+      .update(data)
+      .final(),
+    expected,
+  );
+  const incremental = createMac(algorithm, key, options);
+  assert(incremental instanceof Transform);
+  assert.strictEqual(incremental.update(data.subarray(0, 10)), incremental);
+  assert.strictEqual(incremental.update(Buffer.alloc(0)), incremental);
+  incremental.update(data.subarray(10));
+  assert.deepStrictEqual(incremental.final(), expected);
+  assert.throws(
+    () => incremental.update(Buffer.alloc(0)),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  assert.throws(
+    () => incremental.final(),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+
+  // Input encodings are handled by update(), while final() accepts an output
+  // encoding.
+  assert.strictEqual(
+    createMac(algorithm, key, options)
+      .update(data.toString('hex'), 'hex')
+      .final('hex'),
+    expected.toString('hex'),
+  );
+  assert.strictEqual(
+    createMac(algorithm, key, options)
+      .update(data.toString('base64'), 'base64')
+      .final('base64url'),
+    expected.toString('base64url'),
+  );
+  for (const outputEncoding of Object.keys(encodingsMap)) {
+    if (outputEncoding === 'buffer') continue;
+    assert.strictEqual(
+      createMac(algorithm, key, options)
+        .update(data)
+        .final(outputEncoding),
+      expected.toString(outputEncoding),
+    );
+  }
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options)
+      .update(data, 'not-an-encoding')
+      .final(),
+    expected,
+  );
+  const explicitBuffer = createMac(algorithm, key, options)
+    .update(data)
+    .final('buffer');
+  assert(Buffer.isBuffer(explicitBuffer));
+  assert.deepStrictEqual(explicitBuffer, expected);
+
+  const encodedFinal = createMac(algorithm, key, options).update(data);
+  assert.strictEqual(encodedFinal.final('hex'), expected.toString('hex'));
+  assert.throws(
+    () => encodedFinal.update(data),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  assert.throws(
+    () => encodedFinal.final('hex'),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  // BufferSource keys and data must honor view offsets and lengths.
+  const keyStorage = Uint8Array.from([0xff, ...key, 0xff]);
+  const keyView = new Uint8Array(keyStorage.buffer, 1, key.length);
+  const keyDataView = new DataView(keyStorage.buffer, 1, key.length);
+  const dataStorage = Uint8Array.from([0xff, ...data, 0xff]);
+  const dataView = new DataView(dataStorage.buffer, 1, data.length);
+  assert.deepStrictEqual(
+    createMac(algorithm, keyView, options).update(dataView).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, keyDataView, options).update(dataView).final(),
+    expected,
+  );
+
+  const arrayBufferKey = key.buffer.slice(
+    key.byteOffset,
+    key.byteOffset + key.byteLength,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, arrayBufferKey, options).update(data).final(),
+    expected,
+  );
+  const secretKey = createSecretKey(key);
+  assert.deepStrictEqual(
+    createMac(algorithm, secretKey, options).update(data).final(),
+    expected,
+  );
+
+  (async () => {
+    const esmCrypto = await import('node:crypto');
+    assert.strictEqual(esmCrypto.createMac, createMac);
+    assert.strictEqual(esmCrypto.getMacs, getMacs);
+    assert.strictEqual(esmCrypto.Mac, undefined);
+
+    const emptyStream = createMac(algorithm, key, options);
+    const emptyChunks = [];
+    emptyStream.on(
+      'data', common.mustCall((chunk) => emptyChunks.push(chunk), 1));
+    const emptyFinished = finished(emptyStream);
+    emptyStream.end();
+    await emptyFinished;
+    assert.deepStrictEqual(Buffer.concat(emptyChunks), expectedEmpty);
+
+    const streamed = createMac(algorithm, key, {
+      ...options,
+      highWaterMark: 1,
+    });
+    const chunks = [];
+    streamed.on('data', common.mustCall((chunk) => chunks.push(chunk), 1));
+    assert.strictEqual(streamed.writableHighWaterMark, 1);
+    assert.strictEqual(streamed.readableHighWaterMark, 1);
+    const streamedFinished = finished(streamed);
+    streamed.write(data.subarray(0, 10));
+    streamed.end(data.subarray(10));
+    await streamedFinished;
+    assert.deepStrictEqual(Buffer.concat(chunks), expected);
+    assert.throws(
+      () => streamed.update(Buffer.alloc(0)),
+      { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+    );
+    assert.throws(
+      () => streamed.final(),
+      { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+    );
+
+    // Direct finalization followed by stream finalization fails through the
+    // stream error path and does not emit a second tag.
+    const mixed = createMac(algorithm, key, options);
+    mixed.on('data', common.mustNotCall());
+    const mixedFinished = finished(mixed);
+    assert.deepStrictEqual(mixed.update(data).final(), expected);
+    mixed.end();
+    await assert.rejects(mixedFinished, {
+      code: 'ERR_CRYPTO_MAC_FINALIZED',
+    });
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
new file mode 100644
index 000000000000..1afc5df8d94d
--- /dev/null
+++ b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
@@ -0,0 +1,28 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { hasOpenSSL3 } = require('../common/crypto');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
+
+if (!hasOpenSSL3)
+  common.skip('this test requires OpenSSL 3.x');
+
+const entry = fixtures.path('snapshot', 'crypto-provider-cipher-cache.js');
+const buildEnv = {
+  OPENSSL_CONF: fixtures.path(
+    'openssl3-conf', 'legacy_provider_enabled.cnf'),
+};
+const runEnv = {
+  OPENSSL_CONF: fixtures.path('openssl3-conf', 'default_only.cnf'),
+};
+
+tmpdir.refresh();
+buildSnapshot(entry, buildEnv);
+const { stdout } = runWithSnapshot(undefined, runEnv);
+assert.match(stdout, /provider crypto caches snapshot: ok/);
diff --git a/test/parallel/test-crypto-provider-cipher-cache.js b/test/parallel/test-crypto-provider-cipher-cache.js
new file mode 100644
index 000000000000..bde9988480ed
--- /dev/null
+++ b/test/parallel/test-crypto-provider-cipher-cache.js
@@ -0,0 +1,183 @@
+// Flags: --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL3 } = require('../common/crypto');
+if (!hasOpenSSL3)
+  common.skip('this test requires OpenSSL 3.x');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  getCipherInfo,
+  getCiphers,
+  getFips,
+  getHashes,
+  setFips,
+} = require('crypto');
+const { internalBinding } = require('internal/test/binding');
+const { isMainThread, Worker } = require('worker_threads');
+
+if (!isMainThread)
+  common.skip('crypto.setFips() is not supported in workers');
+
+const algorithm = 'camellia-128-cbc-cts';
+const hashAlgorithm = 'md5';
+const originalFips = getFips();
+setFips(0);
+
+if (!getCiphers().includes(algorithm)) {
+  common.skip(`${algorithm} is not supported`);
+}
+assert(getHashes().includes(hashAlgorithm));
+
+const binding = internalBinding('crypto');
+const generation = binding.getFipsCryptoGeneration();
+setFips(0);
+assert.strictEqual(binding.getFipsCryptoGeneration(), generation);
+
+const ciphers = getCiphers();
+ciphers.length = 0;
+assert(getCiphers().includes(algorithm));
+
+const info = getCipherInfo(algorithm);
+assert(info);
+assert.deepStrictEqual(getCipherInfo(algorithm.toUpperCase()), info);
+assert.deepStrictEqual(getCipherInfo(algorithm), info);
+assert.strictEqual(getCipherInfo('node-test-unknown-provider-cipher'), undefined);
+assert.strictEqual(getCipherInfo('node-test-unknown-provider-cipher'), undefined);
+
+const key = Buffer.alloc(16);
+const iv = Buffer.alloc(16);
+const plaintext = Buffer.alloc(32);
+const liveCipher = createCipheriv(algorithm, key, iv);
+
+const worker = new Worker(`
+  'use strict';
+  const {
+    createHash,
+    createCipheriv,
+    getCipherInfo,
+    getCiphers,
+    getHashes,
+  } = require('crypto');
+  const { internalBinding } = require('internal/test/binding');
+  const { parentPort, workerData } = require('worker_threads');
+
+  const binding = internalBinding('crypto');
+  const key = Buffer.from(workerData.key);
+  const iv = Buffer.from(workerData.iv);
+  const plaintext = Buffer.from(workerData.plaintext);
+  const liveCipher = createCipheriv(workerData.algorithm, key, iv);
+
+  getHashes();
+  getCiphers();
+  getCipherInfo(workerData.algorithm);
+  parentPort.postMessage({
+    phase: 'warm',
+    generation: binding.getFipsCryptoGeneration(),
+  });
+
+  parentPort.on('message', (phase) => {
+    if (phase === 'fips-on') {
+      let errorCode;
+      try {
+        createCipheriv(workerData.algorithm, key, iv);
+      } catch (error) {
+        errorCode = error.code;
+      }
+      const output = Buffer.concat([
+        liveCipher.update(plaintext),
+        liveCipher.final(),
+      ]);
+      parentPort.postMessage({
+        phase,
+        errorCode,
+        generation: binding.getFipsCryptoGeneration(),
+        hasCipher: getCiphers().includes(workerData.algorithm),
+        hasHash: getHashes().includes(workerData.hashAlgorithm),
+        hasInfo: getCipherInfo(workerData.algorithm) !== undefined,
+        outputLength: output.length,
+      });
+    } else if (phase === 'fips-off') {
+      const cipher = createCipheriv(workerData.algorithm, key, iv);
+      const hash = createHash(workerData.hashAlgorithm).digest('hex');
+      const output = Buffer.concat([
+        cipher.update(plaintext),
+        cipher.final(),
+      ]);
+      parentPort.postMessage({
+        phase,
+        generation: binding.getFipsCryptoGeneration(),
+        hasHash: getHashes().includes(workerData.hashAlgorithm),
+        hasCipher: getCiphers().includes(workerData.algorithm),
+        hasInfo: getCipherInfo(workerData.algorithm) !== undefined,
+        hash,
+        outputLength: output.length,
+      });
+    } else {
+      parentPort.close();
+    }
+  });
+`, {
+  eval: true,
+  workerData: { algorithm, hashAlgorithm, key, iv, plaintext },
+});
+
+let enabledGeneration;
+worker.on('message', common.mustCall((message) => {
+  if (message.phase === 'warm') {
+    assert.strictEqual(message.generation, generation);
+
+    setFips(1);
+    enabledGeneration = binding.getFipsCryptoGeneration();
+    assert.strictEqual(enabledGeneration, generation + 1n);
+    assert(!getCiphers().includes(algorithm));
+    assert(!getHashes().includes(hashAlgorithm));
+    assert.strictEqual(getCipherInfo(algorithm), undefined);
+    assert.throws(() => createCipheriv(algorithm, key, iv), {
+      code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+    });
+
+    const output = Buffer.concat([
+      liveCipher.update(plaintext),
+      liveCipher.final(),
+    ]);
+    assert.strictEqual(output.length, plaintext.length);
+    worker.postMessage('fips-on');
+  } else if (message.phase === 'fips-on') {
+    assert.strictEqual(message.generation, enabledGeneration);
+    assert.strictEqual(message.hasCipher, false);
+    assert.strictEqual(message.hasHash, false);
+    assert.strictEqual(message.hasInfo, false);
+    assert.strictEqual(message.errorCode, 'ERR_CRYPTO_UNKNOWN_CIPHER');
+    assert.strictEqual(message.outputLength, plaintext.length);
+
+    setFips(0);
+    assert.strictEqual(
+      binding.getFipsCryptoGeneration(), enabledGeneration + 1n);
+    assert(getHashes().includes(hashAlgorithm));
+    assert(getCiphers().includes(algorithm));
+    assert(getCipherInfo(algorithm));
+    worker.postMessage('fips-off');
+  } else {
+    assert.strictEqual(message.phase, 'fips-off');
+    assert.strictEqual(
+      message.generation, binding.getFipsCryptoGeneration());
+    assert.strictEqual(message.hasCipher, true);
+    assert.strictEqual(message.hasHash, true);
+    assert.strictEqual(message.hasInfo, true);
+    assert.strictEqual(
+      message.hash,
+      'd41d8cd98f00b204e9800998ecf8427e',
+    );
+    assert.strictEqual(message.outputLength, plaintext.length);
+    worker.postMessage('done');
+    setFips(originalFips);
+  }
+}, 3));
+worker.on('error', common.mustNotCall());
+worker.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));
diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js
new file mode 100644
index 000000000000..609d00d7f7b0
--- /dev/null
+++ b/test/parallel/test-crypto-provider-hash-options.js
@@ -0,0 +1,387 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+if (Number(process.versions.openssl.split('.')[0]) < 4 ||
+    process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 4 provider support is required');
+}
+
+const assert = require('node:assert');
+const {
+  createHash,
+  getHashes,
+  hash,
+} = require('node:crypto');
+const { internalBinding } = require('internal/test/binding');
+const {
+  HashJob,
+  kCryptoJobSync,
+  kCryptoJobWebCrypto,
+} = internalBinding('crypto');
+
+const hashes = getHashes();
+const hashNames = new Map(
+  hashes.map((name) => [name.toLowerCase(), name]),
+);
+
+let exercised = false;
+
+function findHash(...names) {
+  for (const name of names) {
+    const result = hashNames.get(name);
+    if (result !== undefined) return result;
+  }
+  return undefined;
+}
+
+function testHashJob(args, expected) {
+  const { 0: err, 1: result } = new HashJob(
+    kCryptoJobSync,
+    ...args,
+  ).run();
+  assert.strictEqual(err, undefined);
+  assert.deepStrictEqual(Buffer.from(result), expected);
+
+  (async () => {
+    const asyncResult = await new HashJob(
+      kCryptoJobWebCrypto,
+      ...args,
+    ).run();
+    assert.deepStrictEqual(Buffer.from(asyncResult), expected);
+  })().then(common.mustCall());
+}
+
+const cshakeVectors = [
+  {
+    names: ['cshake-128', 'cshake128'],
+    shakeNames: ['shake128', 'shake-128'],
+    outputLength: 32,
+    input: Buffer.from('00010203', 'hex'),
+    expected: 'c1c36925b6409a04f1b504fcbca9d82b' +
+              '4017277cb5ed2b2065fc1d3814d5aaf5',
+  },
+  {
+    names: ['cshake-256', 'cshake256'],
+    shakeNames: ['shake256', 'shake-256'],
+    outputLength: 64,
+    input: Buffer.from('00010203', 'hex'),
+    expected: 'd008828e2b80ac9d2218ffee1d070c48' +
+              'b8e4c87bff32c9699d5b6896eee0edd1' +
+              '64020e2be0560858d9c00c037e34a96' +
+              '937c561a74c412bb4c746469527281c8c',
+  },
+];
+
+for (const vector of cshakeVectors) {
+  const algorithm = findHash(...vector.names);
+  if (algorithm === undefined) {
+    common.printSkipMessage(`${vector.names[0]} is not available`);
+    continue;
+  }
+
+  exercised = true;
+
+  const options = {
+    outputLength: vector.outputLength,
+    customization: 'Email Signature',
+  };
+  const streaming = createHash(algorithm, options)
+    .update(vector.input.subarray(0, 2))
+    .update(vector.input.subarray(2))
+    .digest('hex');
+  const partial = createHash(algorithm, options)
+    .update(vector.input.subarray(0, 2));
+  const copyOptionReads = [];
+  const copied = partial.copy({
+    get outputLength() {
+      copyOptionReads.push('outputLength');
+      return vector.outputLength;
+    },
+    get functionName() {
+      copyOptionReads.push('functionName');
+      return undefined;
+    },
+    get customization() {
+      copyOptionReads.push('customization');
+      return undefined;
+    },
+  })
+    .update(vector.input.subarray(2))
+    .digest('hex');
+
+  assert.strictEqual(streaming, vector.expected);
+  assert.strictEqual(copied, vector.expected);
+  assert.deepStrictEqual(copyOptionReads, ['outputLength']);
+  assert.strictEqual(hash(algorithm, vector.input, options), vector.expected);
+
+  // BufferSource parameters have the same semantics as their string form.
+  const bufferOptions = {
+    ...options,
+    customization: Buffer.from(options.customization),
+  };
+  assert.strictEqual(
+    createHash(algorithm, bufferOptions).update(vector.input).digest('hex'),
+    vector.expected,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, bufferOptions),
+    vector.expected,
+  );
+
+  // Without function-name and customization parameters, cSHAKE is SHAKE.
+  const withoutParameters = createHash(algorithm)
+    .update(vector.input)
+    .digest('hex');
+  assert.strictEqual(hash(algorithm, vector.input), withoutParameters);
+
+  // Explicit undefined parameters have the same semantics as omitted ones.
+  const undefinedOptions = {
+    outputLength: vector.outputLength,
+    functionName: undefined,
+    customization: undefined,
+  };
+  assert.strictEqual(
+    createHash(algorithm, undefinedOptions).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, undefinedOptions),
+    withoutParameters,
+  );
+
+  // Empty BufferSource parameters are still supplied to OpenSSL, but cSHAKE
+  // with two empty parameters is equivalent to SHAKE.
+  const emptyOptions = {
+    outputLength: vector.outputLength,
+    functionName: Buffer.alloc(0),
+    customization: new Uint8Array(0),
+  };
+  assert.strictEqual(
+    createHash(algorithm, emptyOptions).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, emptyOptions),
+    withoutParameters,
+  );
+  const emptyFunctionNameOptions = {
+    outputLength: vector.outputLength,
+    functionName: Buffer.alloc(0),
+  };
+  assert.strictEqual(
+    createHash(algorithm, emptyFunctionNameOptions)
+      .update(vector.input)
+      .digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, emptyFunctionNameOptions),
+    withoutParameters,
+  );
+
+  const createHashOptionReads = [];
+  assert.strictEqual(
+    createHash(algorithm, {
+      get outputLength() {
+        createHashOptionReads.push('outputLength');
+        return vector.outputLength;
+      },
+      get functionName() {
+        createHashOptionReads.push('functionName');
+        return undefined;
+      },
+      get customization() {
+        createHashOptionReads.push('customization');
+        return undefined;
+      },
+    }).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.deepStrictEqual(
+    createHashOptionReads,
+    ['outputLength', 'functionName', 'customization'],
+  );
+
+  const hashOptionReads = [];
+  assert.strictEqual(
+    hash(algorithm, vector.input, {
+      get outputLength() {
+        hashOptionReads.push('outputLength');
+        return vector.outputLength;
+      },
+      get outputEncoding() {
+        hashOptionReads.push('outputEncoding');
+        return 'hex';
+      },
+      get functionName() {
+        hashOptionReads.push('functionName');
+        return undefined;
+      },
+      get customization() {
+        hashOptionReads.push('customization');
+        return undefined;
+      },
+    }),
+    withoutParameters,
+  );
+  assert.deepStrictEqual(
+    hashOptionReads,
+    ['outputLength', 'outputEncoding', 'functionName', 'customization'],
+  );
+
+  for (const zeroLengthOptions of [
+    { outputLength: 0 },
+    {
+      outputLength: 0,
+      functionName: Buffer.alloc(0),
+      customization: new Uint8Array(0),
+    },
+  ]) {
+    assert.deepStrictEqual(
+      createHash(algorithm, zeroLengthOptions).update(vector.input).digest(),
+      Buffer.alloc(0),
+    );
+    assert.strictEqual(
+      hash(algorithm, vector.input, zeroLengthOptions),
+      '',
+    );
+  }
+
+  const shake = findHash(...vector.shakeNames);
+  if (shake !== undefined) {
+    assert.strictEqual(
+      withoutParameters,
+      createHash(shake, { outputLength: vector.outputLength })
+        .update(vector.input)
+        .digest('hex'),
+    );
+  }
+
+  const namedOptions = {
+    outputLength: vector.outputLength,
+    functionName: 'KMAC',
+    customization: 'Node.js',
+  };
+  let namedResult;
+  try {
+    namedResult = createHash(algorithm, namedOptions)
+      .update(vector.input)
+      .digest();
+  } catch {
+    common.printSkipMessage(
+      `${algorithm} does not support the KMAC function name`,
+    );
+  }
+  if (namedResult !== undefined) {
+    assert.deepStrictEqual(
+      hash(algorithm, vector.input, {
+        ...namedOptions,
+        outputEncoding: 'buffer',
+      }),
+      namedResult,
+    );
+    assert.deepStrictEqual(
+      createHash(algorithm, {
+        ...namedOptions,
+        functionName: Buffer.from(namedOptions.functionName),
+        customization: new Uint8Array(Buffer.from(namedOptions.customization)),
+      }).update(vector.input).digest(),
+      namedResult,
+    );
+    assert.deepStrictEqual(
+      hash(algorithm, vector.input, {
+        ...namedOptions,
+        functionName: Buffer.from(namedOptions.functionName),
+        customization: new Uint8Array(Buffer.from(namedOptions.customization)),
+        outputEncoding: 'buffer',
+      }),
+      namedResult,
+    );
+  }
+
+  for (const functionName of ['', 'TupleHash', 'ParallelHash', 'KMAC']) {
+    const functionOptions = {
+      outputLength: vector.outputLength,
+      functionName,
+    };
+    let functionResult;
+    try {
+      functionResult = createHash(algorithm, functionOptions)
+        .update(vector.input)
+        .digest();
+    } catch {
+      common.printSkipMessage(
+        `${algorithm} does not support the ${functionName} function name`,
+      );
+      continue;
+    }
+    assert.deepStrictEqual(
+      functionResult,
+      hash(algorithm, vector.input, {
+        ...functionOptions,
+        outputEncoding: 'buffer',
+      }),
+    );
+  }
+
+  testHashJob([
+    algorithm,
+    vector.input,
+    vector.outputLength * 8,
+    undefined,
+    Buffer.from(options.customization),
+  ], Buffer.from(vector.expected, 'hex'));
+
+  for (const invalidOptions of [
+    { functionName: 1 },
+    { customization: {} },
+  ]) {
+    const expected = { code: 'ERR_INVALID_ARG_TYPE' };
+    assert.throws(() => createHash(algorithm, invalidOptions), expected);
+    assert.throws(
+      () => hash(algorithm, vector.input, invalidOptions),
+      expected,
+    );
+  }
+
+  for (const invalidOptions of [
+    { functionName: 'KMAC\0' },
+    { customization: 'Node\0js' },
+    { customization: Buffer.from([0x61, 0x00, 0x62]) },
+  ]) {
+    const expected = { code: 'ERR_INVALID_ARG_VALUE' };
+    assert.throws(() => createHash(algorithm, invalidOptions), expected);
+    assert.throws(
+      () => hash(algorithm, vector.input, invalidOptions),
+      expected,
+    );
+  }
+}
+
+if (cshakeVectors.some(({ names }) => findHash(...names) !== undefined)) {
+  for (const mismatchedOptions of [
+    { functionName: 'KMAC' },
+    { customization: 'Node.js' },
+    { functionName: Buffer.alloc(0) },
+    { customization: new Uint8Array(0) },
+  ]) {
+    assert.throws(
+      () => createHash('sha256', mismatchedOptions),
+      { message: 'Digest method not supported' },
+    );
+    assert.throws(
+      () => hash('sha256', Buffer.from('abc'), mismatchedOptions),
+      { message: 'Digest options are not supported' },
+    );
+  }
+}
+
+if (!exercised) {
+  common.printSkipMessage('cSHAKE is not available');
+}
diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js
new file mode 100644
index 000000000000..166efaa0d7fd
--- /dev/null
+++ b/test/parallel/test-crypto-provider-hashes.js
@@ -0,0 +1,258 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const assert = require('node:assert');
+const {
+  createHash,
+  createHmac,
+  createSign,
+  createVerify,
+  generateKeyPair,
+  generateKeyPairSync,
+  getHashes,
+  hash,
+  hkdf,
+  hkdfSync,
+  pbkdf2,
+  pbkdf2Sync,
+  privateDecrypt,
+  publicEncrypt,
+  sign,
+  verify,
+} = require('node:crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3 || process.features.openssl_is_boringssl) {
+  common.skip('OpenSSL 3 provider support is required');
+}
+
+const { internalBinding } = require('internal/test/binding');
+const {
+  HashJob,
+  kCryptoJobSync,
+  kCryptoJobWebCrypto,
+} = internalBinding('crypto');
+
+const hashes = getHashes();
+const lowercaseHashes = hashes.map((name) => name.toLowerCase());
+const modifiedHashes = getHashes();
+modifiedHashes.length = 0;
+
+assert.deepStrictEqual(hashes, [...hashes].sort());
+assert.deepStrictEqual(getHashes(), hashes);
+assert.strictEqual(new Set(lowercaseHashes).size, hashes.length);
+if (lowercaseHashes.includes('sha1')) {
+  assert(hashes.includes('RSA-SHA1'));
+}
+assert(!lowercaseHashes.includes('null'));
+assert(!lowercaseHashes.includes('ml-dsa-mu'));
+assert(!hashes.some((name) => /^\d+(?:\.\d+)+$/.test(name)));
+
+for (const name of hashes) {
+  try {
+    createHash(name);
+  } catch (err) {
+    assert.strictEqual(err.code, 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH');
+    createHash(name, { outputLength: 32 });
+  }
+}
+
+const input = Buffer.alloc(0);
+assert.throws(
+  () => createHash('ml-dsa-mu'),
+  /Digest method not supported/,
+);
+assert.throws(
+  () => hash('ml-dsa-mu', input),
+  { message: 'Digest method ml-dsa-mu is not supported' },
+);
+
+const providerVectors = {
+  'keccak-kmac-128': {
+    aliases: ['keccak-kmac-128', 'keccak-kmac128'],
+    expected: '83aa04c211dc19d16912571ed0a75130' +
+              'd36aebd58562dd080c1ea84a8c7d73f7',
+    options: { outputLength: 32 },
+  },
+  'keccak-256': {
+    aliases: ['keccak-256'],
+    expected: 'c5d2460186f7233c927e7db2dcc703c0' +
+              'e500b653ca82273b7bfad8045d85a470',
+  },
+  'sha256-192': {
+    aliases: ['sha2-256/192', 'sha-256/192', 'sha256-192'],
+    expected: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934c',
+  },
+};
+
+function testHashVector({ aliases, expected, options }) {
+  for (const alias of aliases) {
+    if (!hashes.includes(alias)) continue;
+    assert(!hashes.includes(alias.toUpperCase()));
+
+    for (const name of [alias, alias.toUpperCase()]) {
+      const streaming = createHash(name, options).update(input).digest('hex');
+      assert.strictEqual(streaming, expected);
+      assert.strictEqual(hash(name, input, options), expected);
+    }
+  }
+}
+
+// These digests are tested when the active provider advertises them.
+for (const name of ['keccak-kmac-128', 'keccak-256', 'sha256-192']) {
+  const vector = providerVectors[name];
+  if (vector.aliases.some((alias) => hashes.includes(alias))) {
+    testHashVector(vector);
+  } else {
+    common.printSkipMessage(`${name} is not available from the active provider`);
+  }
+}
+
+const keccakKmacName = providerVectors['keccak-kmac-128'].aliases
+  .find((alias) => hashes.includes(alias));
+if (keccakKmacName !== undefined) {
+  (async () => {
+    const { expected } = providerVectors['keccak-kmac-128'];
+    const { 0: err, 1: syncResult } = new HashJob(
+      kCryptoJobSync,
+      keccakKmacName,
+      input,
+      256,
+    ).run();
+    assert.strictEqual(err, undefined);
+    assert.strictEqual(Buffer.from(syncResult).toString('hex'), expected);
+
+    const result = await new HashJob(
+      kCryptoJobWebCrypto,
+      keccakKmacName,
+      input,
+      256,
+    ).run();
+    assert.strictEqual(Buffer.from(result).toString('hex'), expected);
+  })().then(common.mustCall());
+}
+
+if (hashes.includes('sha256-192')) {
+  const operationInput = Buffer.from('abc');
+
+  assert.strictEqual(
+    createHmac('sha256-192', 'key').update(operationInput).digest('hex'),
+    'd7774e586190fa2d2f4d4be4bc86ccd459a9170d52c38809',
+  );
+
+  const hkdfExpected = 'ef23757b94b5e1e46c3f981d87828d7aeb0207733ab5c78' +
+                       'c60df321c9e8c88e0ad54b4eecfef8c258ccd';
+  assert.strictEqual(
+    Buffer.from(hkdfSync('sha256-192', 'key', 'salt', 'info', 42))
+      .toString('hex'),
+    hkdfExpected,
+  );
+  hkdf(
+    'sha256-192',
+    'key',
+    'salt',
+    'info',
+    42,
+    common.mustSucceed((result) => {
+      assert.strictEqual(Buffer.from(result).toString('hex'), hkdfExpected);
+    }),
+  );
+
+  const pbkdf2Expected = '1fee3dd5ea13d5b563d3cc88fbc6dcf7' +
+                         '3497aeffc3b3e6358ab3d3d1aa2aa0ee';
+  assert.strictEqual(
+    pbkdf2Sync('password', 'salt', 2, 32, 'sha256-192').toString('hex'),
+    pbkdf2Expected,
+  );
+  pbkdf2(
+    'password',
+    'salt',
+    2,
+    32,
+    'sha256-192',
+    common.mustSucceed((result) => {
+      assert.strictEqual(result.toString('hex'), pbkdf2Expected);
+    }),
+  );
+
+  const { privateKey: ecPrivateKey, publicKey: ecPublicKey } =
+    generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const signature = sign('sha256-192', operationInput, ecPrivateKey);
+  assert(verify('sha256-192', operationInput, ecPublicKey, signature));
+
+  const streamingSignature = createSign('sha256-192')
+    .update(operationInput)
+    .sign(ecPrivateKey);
+  const verifier = createVerify('sha256-192');
+  verifier.update(operationInput);
+  assert(verifier.verify(ecPublicKey, streamingSignature));
+
+  sign(
+    'sha256-192',
+    operationInput,
+    ecPrivateKey,
+    common.mustSucceed((asyncSignature) => {
+      verify(
+        'sha256-192',
+        operationInput,
+        ecPublicKey,
+        asyncSignature,
+        common.mustSucceed((result) => assert(result)),
+      );
+    }),
+  );
+
+  const { privateKey: rsaPrivateKey, publicKey: rsaPublicKey } =
+    generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const plaintext = Buffer.from('provider digest');
+
+  assert.throws(
+    () => sign('sha256-192', plaintext, rsaPrivateKey),
+    { code: 'ERR_OSSL_DIGEST_NOT_ALLOWED' },
+  );
+  assert.deepStrictEqual(
+    privateDecrypt(
+      { key: rsaPrivateKey, oaepHash: 'sha256-192' },
+      publicEncrypt(
+        { key: rsaPublicKey, oaepHash: 'sha256-192' },
+        plaintext,
+      ),
+    ),
+    plaintext,
+  );
+
+  const pssOptions = [
+    {
+      hashAlgorithm: 'sha256-192',
+      modulusLength: 2048,
+    },
+    {
+      hashAlgorithm: 'sha256',
+      mgf1HashAlgorithm: 'sha256-192',
+      modulusLength: 2048,
+    },
+  ];
+  const keyGenerationFailed = { message: 'Key generation job failed' };
+
+  for (const options of pssOptions) {
+    assert.throws(
+      () => generateKeyPairSync('rsa-pss', options),
+      keyGenerationFailed,
+    );
+    generateKeyPair(
+      'rsa-pss',
+      options,
+      common.mustCall((err, publicKey, privateKey) => {
+        assert.strictEqual(err?.message, keyGenerationFailed.message);
+        assert.strictEqual(publicKey, undefined);
+        assert.strictEqual(privateKey, undefined);
+      }),
+    );
+  }
+}
diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js
new file mode 100644
index 000000000000..be434c76e828
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+const {
+  createPrivateKey,
+} = require('crypto');
+const { subtle } = globalThis.crypto;
+
+if (process.features.openssl_is_boringssl)
+  common.skip('multi-prime RSA is not available with BoringSSL');
+if (hasFIPS())
+  common.skip('multi-prime RSA is not available in FIPS mode');
+
+const privateKey = createPrivateKey(
+  fixtures.readKey('rsa_private_2048_3_primes.pem'));
+const pkcs8 = privateKey.export({ format: 'der', type: 'pkcs8' });
+const jwk = privateKey.export({ format: 'jwk' });
+
+assert.strictEqual(jwk.oth.length, 1);
+assert.deepStrictEqual(Object.keys(jwk.oth[0]), ['r', 'd', 't']);
+
+const importedKey = createPrivateKey({ key: jwk, format: 'jwk' });
+assert.deepStrictEqual(importedKey.export({ format: 'jwk' }), jwk);
+assert.deepStrictEqual(
+  importedKey.export({ format: 'der', type: 'pkcs8' }),
+  pkcs8);
+
+for (const field of ['r', 'd', 't']) {
+  const invalidJwk = {
+    ...jwk,
+    oth: [{ ...jwk.oth[0] }],
+  };
+  delete invalidJwk.oth[0][field];
+  assert.throws(
+    () => createPrivateKey({ key: invalidJwk, format: 'jwk' }),
+    { code: 'ERR_CRYPTO_INVALID_JWK' });
+}
+
+(async () => {
+  const algorithm = { name: 'RSA-PSS', hash: 'SHA-256' };
+  const cryptoKey = await subtle.importKey(
+    'pkcs8', pkcs8, algorithm, true, ['sign']);
+  const exportedJwk = await subtle.exportKey('jwk', cryptoKey);
+
+  const exportedKeyMaterial = { ...exportedJwk };
+  delete exportedKeyMaterial.key_ops;
+  delete exportedKeyMaterial.ext;
+  delete exportedKeyMaterial.alg;
+  assert.deepStrictEqual(exportedKeyMaterial, jwk);
+
+  const importedCryptoKey = await subtle.importKey(
+    'jwk', exportedJwk, algorithm, true, ['sign']);
+  assert.deepStrictEqual(
+    Buffer.from(await subtle.exportKey('pkcs8', importedCryptoKey)),
+    pkcs8);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-x509-brand-check.js b/test/parallel/test-crypto-x509-brand-check.js
new file mode 100644
index 000000000000..a0bd64ed8037
--- /dev/null
+++ b/test/parallel/test-crypto-x509-brand-check.js
@@ -0,0 +1,145 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { X509Certificate } = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const fixtures = require('../common/fixtures');
+const {
+  isX509Certificate,
+} = require('internal/crypto/x509');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const cert = new X509Certificate(certData);
+const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+
+const getterNames = [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'issuerCertificate',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+  'raw',
+  'publicKey',
+  'ca',
+];
+
+const methodNames = [
+  'toString',
+  'toJSON',
+  'checkHost',
+  'checkEmail',
+  'checkIP',
+  'checkIssued',
+  'checkPrivateKey',
+  'verify',
+  'toLegacyObject',
+];
+
+assert.strictEqual(isX509Certificate(cert), true);
+assert.strictEqual(cert instanceof X509Certificate, true);
+assert.strictEqual(Object.getPrototypeOf(X509Certificate.prototype),
+                   Object.prototype);
+for (const name of ['pem', 'checkCA', 'getIssuerCert', 'toLegacy']) {
+  assert.strictEqual(name in cert, false);
+}
+
+for (const value of [
+  {},
+  { __proto__: null },
+  1,
+  null,
+  undefined,
+  Buffer.alloc(1),
+  function() {},
+]) {
+  assert.strictEqual(isX509Certificate(value), false);
+  for (const name of getterNames) {
+    const getter = Object.getOwnPropertyDescriptor(
+      X509Certificate.prototype, name).get;
+    assert.throws(() => getter.call(value), invalidThis);
+  }
+  for (const name of methodNames) {
+    assert.throws(
+      () => X509Certificate.prototype[name].call(value),
+      invalidThis);
+  }
+}
+
+const spoofed = { __proto__: X509Certificate.prototype };
+assert.strictEqual(spoofed instanceof X509Certificate, true);
+assert.strictEqual(isX509Certificate(spoofed), false);
+assert.throws(() => spoofed.subject, invalidThis);
+assert.throws(() => spoofed.toString(), invalidThis);
+
+const originalHasInstance =
+  Object.getOwnPropertyDescriptor(X509Certificate, Symbol.hasInstance);
+Object.defineProperty(X509Certificate, Symbol.hasInstance, {
+  configurable: true,
+  value: () => true,
+});
+try {
+  const buffer = Buffer.alloc(1);
+  assert.strictEqual(buffer instanceof X509Certificate, true);
+  assert.strictEqual(isX509Certificate(buffer), false);
+  assert.throws(() => X509Certificate.prototype.toString.call(buffer),
+                invalidThis);
+} finally {
+  if (originalHasInstance === undefined) {
+    delete X509Certificate[Symbol.hasInstance];
+  } else {
+    Object.defineProperty(
+      X509Certificate, Symbol.hasInstance, originalHasInstance);
+  }
+}
+
+class DerivedX509Certificate extends X509Certificate {}
+const derived = new DerivedX509Certificate(certData);
+assert.strictEqual(derived instanceof DerivedX509Certificate, true);
+assert.strictEqual(derived instanceof X509Certificate, true);
+assert.strictEqual(isX509Certificate(derived), true);
+assert.strictEqual(derived.subject, cert.subject);
+
+function PrimitivePrototype() {}
+PrimitivePrototype.prototype = 1;
+const primitivePrototype = Reflect.construct(
+  X509Certificate, [certData], PrimitivePrototype);
+assert.strictEqual(Object.getPrototypeOf(primitivePrototype), Object.prototype);
+assert.strictEqual(isX509Certificate(primitivePrototype), true);
+assert.strictEqual(
+  Object.getOwnPropertyDescriptor(
+    X509Certificate.prototype, 'subject').get.call(primitivePrototype),
+  cert.subject);
+
+const firstPrototype = { __proto__: X509Certificate.prototype };
+const secondPrototype = { __proto__: X509Certificate.prototype };
+let prototypeReads = 0;
+const ProxyNewTarget = new Proxy(function() {}, {
+  get(target, property, receiver) {
+    if (property === 'prototype') {
+      prototypeReads++;
+      return prototypeReads === 1 ? firstPrototype : secondPrototype;
+    }
+    return Reflect.get(target, property, receiver);
+  },
+});
+const proxyNewTarget = Reflect.construct(
+  X509Certificate, [certData], ProxyNewTarget);
+assert.strictEqual(prototypeReads, 1);
+assert.strictEqual(Object.getPrototypeOf(proxyNewTarget), firstPrototype);
+assert.strictEqual(proxyNewTarget.subject, cert.subject);
diff --git a/test/parallel/test-crypto-x509-clone-transfer.js b/test/parallel/test-crypto-x509-clone-transfer.js
new file mode 100644
index 000000000000..4ab6ea59b5f2
--- /dev/null
+++ b/test/parallel/test-crypto-x509-clone-transfer.js
@@ -0,0 +1,119 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  X509Certificate,
+  createPrivateKey,
+} = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const {
+  markAsUncloneable,
+  MessageChannel,
+  Worker,
+} = require('node:worker_threads');
+const fixtures = require('../common/fixtures');
+const {
+  isX509Certificate,
+} = require('internal/crypto/x509');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const keyData = readFileSync(fixtures.path('keys', 'agent1-key.pem'));
+const caData = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
+
+const cert = new X509Certificate(certData);
+const ca = new X509Certificate(caData);
+const privateKey = createPrivateKey(keyData);
+
+const dataCloneError = {
+  code: 25,
+  name: 'DataCloneError',
+};
+
+{
+  const uncloneable = new X509Certificate(certData);
+  markAsUncloneable(uncloneable);
+  assert.throws(() => structuredClone(uncloneable), dataCloneError);
+
+  const { port1, port2 } = new MessageChannel();
+  assert.throws(() => port1.postMessage(uncloneable), dataCloneError);
+  port1.close();
+  port2.close();
+}
+
+function assertSameCertificate(original, clone) {
+  assert.notStrictEqual(clone, original);
+  assert.strictEqual(clone instanceof X509Certificate, true);
+  assert.strictEqual(isX509Certificate(clone), true);
+  assert.strictEqual(clone.subject, original.subject);
+  assert.strictEqual(clone.issuer, original.issuer);
+  assert.strictEqual(clone.fingerprint256, original.fingerprint256);
+  assert.deepStrictEqual(clone.raw, original.raw);
+  assert.deepStrictEqual(Reflect.ownKeys(clone), []);
+  assert.strictEqual(clone.checkPrivateKey(privateKey), true);
+  assert.strictEqual(clone.checkIssued(ca), true);
+  assert.strictEqual(clone.verify(ca.publicKey), true);
+}
+
+async function roundTripViaMessageChannel(value) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(value);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function workerMain() {
+  const {
+    X509Certificate: WorkerX509Certificate,
+  } = require('node:crypto');
+  const { parentPort } = require('node:worker_threads');
+
+  parentPort.once('message', (cert) => {
+    try {
+      if (!(cert instanceof WorkerX509Certificate)) {
+        throw new Error('X509Certificate brand was not preserved');
+      }
+      parentPort.postMessage({
+        cert,
+        ownKeyCount: Reflect.ownKeys(cert).length,
+        subject: cert.subject,
+      });
+    } catch (error) {
+      parentPort.postMessage({ error: error.stack || error.message });
+    }
+  });
+}
+
+async function roundTripViaWorker(value) {
+  const worker = new Worker(
+    `'use strict';(${workerMain.toString()})()`, { eval: true });
+
+  worker.postMessage(value);
+  const [message] = await once(worker, 'message');
+  await worker.terminate();
+  assert.strictEqual(message.error, undefined, message.error);
+  assert.strictEqual(message.ownKeyCount, 0);
+  assert.strictEqual(message.subject, value.subject);
+  return message.cert;
+}
+
+(async () => {
+  const cloned = structuredClone(cert);
+  assertSameCertificate(cert, cloned);
+
+  const viaPort = await roundTripViaMessageChannel(cert);
+  assertSameCertificate(cert, viaPort);
+
+  const clonedAgain = structuredClone(viaPort);
+  assertSameCertificate(cert, clonedAgain);
+
+  const viaWorker = await roundTripViaWorker(cert);
+  assertSameCertificate(cert, viaWorker);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-x509-hidden-slots.js b/test/parallel/test-crypto-x509-hidden-slots.js
new file mode 100644
index 000000000000..fead69935287
--- /dev/null
+++ b/test/parallel/test-crypto-x509-hidden-slots.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const {
+  X509Certificate,
+  createPrivateKey,
+} = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const { inspect } = require('node:util');
+const fixtures = require('../common/fixtures');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const keyData = readFileSync(fixtures.path('keys', 'agent1-key.pem'));
+const caData = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
+
+const cert = new X509Certificate(certData);
+const ca = new X509Certificate(caData);
+const privateKey = createPrivateKey(keyData);
+const expectedPem = cert.toString();
+const expectedSubject = cert.subject;
+
+function assertNoOwnKeys(value) {
+  assert.deepStrictEqual(Object.getOwnPropertyNames(value), []);
+  assert.deepStrictEqual(Object.getOwnPropertySymbols(value), []);
+  assert.deepStrictEqual(Reflect.ownKeys(value), []);
+}
+
+for (const name of [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'issuerCertificate',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+  'raw',
+  'publicKey',
+  'ca',
+]) {
+  // Populate every private lazy-cache entry before checking reflection.
+  Reflect.get(cert, name);
+}
+cert.toString();
+cert.toJSON();
+assertNoOwnKeys(cert);
+
+const getterNames = [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+];
+const originals = new Map();
+for (const name of getterNames) {
+  originals.set(name,
+                Object.getOwnPropertyDescriptor(
+                  X509Certificate.prototype, name));
+  Object.defineProperty(X509Certificate.prototype, name, {
+    configurable: true,
+    get() { return `FORGED-${name}`; },
+  });
+}
+const originalToString =
+  Object.getOwnPropertyDescriptor(X509Certificate.prototype, 'toString');
+Object.defineProperty(X509Certificate.prototype, 'toString', {
+  configurable: true,
+  value() { return 'FORGED-PEM'; },
+});
+
+try {
+  assert.strictEqual(cert.subject, 'FORGED-subject');
+  assert.strictEqual(cert.toString(), 'FORGED-PEM');
+
+  const rendered = inspect(cert, { depth: 4 });
+  assert.match(rendered, /CN=agent1/);
+  assert.doesNotMatch(rendered, /FORGED/);
+  assert.strictEqual(cert.toJSON(), expectedPem);
+  assert.strictEqual(JSON.parse(JSON.stringify(cert)), expectedPem);
+
+  assert.strictEqual(cert.checkIssued(ca), true);
+  assert.strictEqual(cert.checkPrivateKey(privateKey), true);
+  assert.strictEqual(cert.verify(ca.publicKey), true);
+  assertNoOwnKeys(cert);
+} finally {
+  for (const [name, descriptor] of originals) {
+    Object.defineProperty(X509Certificate.prototype, name, descriptor);
+  }
+  Object.defineProperty(
+    X509Certificate.prototype, 'toString', originalToString);
+}
+
+assert.strictEqual(cert.subject, expectedSubject);
+assert.strictEqual(cert.toString(), expectedPem);
diff --git a/test/parallel/test-dgram-udp6-link-local-address.js b/test/parallel/test-dgram-udp6-link-local-address.js
index 5c090acc6b9e..2320d665cfdd 100644
--- a/test/parallel/test-dgram-udp6-link-local-address.js
+++ b/test/parallel/test-dgram-udp6-link-local-address.js
@@ -11,9 +11,9 @@ const { isWindows } = common;
 
 function linklocal() {
   for (const [ifname, entries] of Object.entries(os.networkInterfaces())) {
-    for (const { address, family, scopeid } of entries) {
+    for (const { address, family } of entries) {
       if (family === 'IPv6' && address.startsWith('fe80:')) {
-        return { address, ifname, scopeid };
+        return { address, ifname };
       }
     }
   }
@@ -32,6 +32,12 @@ const client = dgram.createSocket('udp6');
 // Create the server socket listening on the link-local address.
 const server = dgram.createSocket('udp6');
 
+client.on('message', common.mustCall((buf) => {
+  assert.strictEqual(buf.toString(), message);
+  server.close();
+  client.close();
+}));
+
 server.on('listening', common.mustCall(() => {
   const port = server.address().port;
   client.send(message, 0, message.length, port, address);
@@ -40,14 +46,15 @@ server.on('listening', common.mustCall(() => {
 server.on('message', common.mustCall((buf, info) => {
   const received = buf.toString();
   assert.strictEqual(received, message);
-  // Check that the sender address is the one bound,
-  // including the link local scope identifier.
-  assert.strictEqual(
-    info.address,
-    isWindows ? `${iface.address}%${iface.scopeid}` : address
-  );
-  server.close();
-  client.close();
+  // AIX may use `lo0` as the scope ID for a datagram sent to a local interface.
+  // See https://github.com/nodejs/node/issues/46792#issuecomment-1455049522.
+  const scopeIndex = info.address.lastIndexOf('%');
+  assert.notStrictEqual(scopeIndex, -1);
+  assert.strictEqual(info.address.slice(0, scopeIndex), iface.address);
+  assert.notStrictEqual(info.address.slice(scopeIndex + 1), '');
+
+  // Verify that the scoped sender address can be used for a reply.
+  server.send(buf, info.port, info.address);
 }, 1));
 
 server.bind({ address });
diff --git a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
new file mode 100644
index 000000000000..0d7366dd3438
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
@@ -0,0 +1,184 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const assert = require('node:assert');
+const diagnosticsChannel = require('node:diagnostics_channel');
+const { once } = require('node:events');
+const { Worker } = require('node:worker_threads');
+const {
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+const {
+  createHmac,
+  generateKeyPairSync,
+  sign,
+  subtle,
+} = require('node:crypto');
+
+const channelName = 'crypto.fips.indicator';
+
+if (!hasOpenSSL(3, 4)) {
+  common.skip('OpenSSL 3.4 or later is required');
+} else if (!hasFIPS(3, 4)) {
+  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+} else if (!process.execArgv.includes('--enable-fips-indicator-events')) {
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--enable-fips-indicator-events', __filename],
+  );
+} else {
+  run().then(common.mustCall());
+}
+
+function nextIndicator() {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall((event, name) => {
+    assert.strictEqual(name, channelName);
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    resolve(event);
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  return promise;
+}
+
+function testUnsubscribeDuringDrain(key, privateKey) {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall(() => {
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    setImmediate(common.mustCall(resolve));
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  createHmac('sha256', key).digest();
+  sign('sha1', Buffer.alloc(0), privateKey);
+  return promise;
+}
+
+async function testNoStaleIndicator(key) {
+  createHmac('sha256', key).digest();
+  const subscriber = common.mustNotCall();
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.strictEqual(
+    diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+}
+
+async function run() {
+  const key = Buffer.alloc(13);
+
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve: resolveProbe } = Promise.withResolvers();
+  const probeSubscriber = (event) => {
+    clearInterval(keepAlive);
+    diagnosticsChannel.unsubscribe(channelName, probeSubscriber);
+    resolveProbe(event);
+  };
+  diagnosticsChannel.subscribe(channelName, probeSubscriber);
+
+  let output;
+  try {
+    output = createHmac('sha256', key).digest();
+  } catch (error) {
+    clearInterval(keepAlive);
+    diagnosticsChannel.unsubscribe(channelName, probeSubscriber);
+    assert.match(error.code, /^ERR_OSSL_/);
+    common.printSkipMessage(
+      'the FIPS provider rejects unapproved operations before signaling');
+    return;
+  }
+
+  assert.strictEqual(output.byteLength, 32);
+  assert.deepStrictEqual(await promise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 1,
+    dropped: 0,
+  });
+
+  await testNoStaleIndicator(key);
+
+  let eventPromise = nextIndicator();
+  createHmac('sha256', key).digest();
+  createHmac('sha256', key).digest();
+  assert.deepStrictEqual(await eventPromise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 2,
+    dropped: 0,
+  });
+
+  const secondSubscriber = common.mustCall();
+  diagnosticsChannel.subscribe(channelName, secondSubscriber);
+  eventPromise = nextIndicator();
+  createHmac('sha256', key).digest();
+  await eventPromise;
+  assert.strictEqual(
+    diagnosticsChannel.unsubscribe(channelName, secondSubscriber), true);
+
+  const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  await testUnsubscribeDuringDrain(key, privateKey);
+
+  const hmacKey = await subtle.importKey(
+    'raw', Buffer.alloc(13), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  eventPromise = nextIndicator();
+  const [signature, hmacEvent] = await Promise.all([
+    subtle.sign('HMAC', hmacKey, Buffer.alloc(0)),
+    eventPromise,
+  ]);
+  assert.strictEqual(signature.byteLength, 32);
+  assert.strictEqual(hmacEvent.operation, 'HMAC');
+  assert.strictEqual(hmacEvent.reason, 'keysize');
+  assert.strictEqual(hmacEvent.blocked, false);
+
+  eventPromise = nextIndicator();
+  const worker = new Worker(`
+    'use strict';
+    const diagnosticsChannel = require('node:diagnostics_channel');
+    const { parentPort, workerData } = require('node:worker_threads');
+    const { createHmac } = require('node:crypto');
+
+    let indicatorCount = 0;
+    diagnosticsChannel.subscribe('crypto.fips.indicator', () => {
+      indicatorCount++;
+    });
+    const result = createHmac('sha256', workerData.key).digest();
+    setImmediate(() => {
+      parentPort.postMessage({
+        indicatorCount,
+        length: result.byteLength,
+      });
+    });
+  `, {
+    eval: true,
+    workerData: { key },
+  });
+  worker.on('error', common.mustNotCall());
+  const exitPromise = once(worker, 'exit');
+  const [[message], workerEvent] = await Promise.all([
+    once(worker, 'message'),
+    eventPromise,
+  ]);
+  assert.deepStrictEqual(message, { indicatorCount: 0, length: 32 });
+  assert.deepStrictEqual(workerEvent, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 1,
+    dropped: 0,
+  });
+  const [exitCode] = await exitPromise;
+  assert.strictEqual(exitCode, 0);
+}
diff --git a/test/parallel/test-diagnostics-channel-tracing-channel-context.js b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
new file mode 100644
index 000000000000..e0e605854032
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const common = require('../common');
+
+// This test ensures that tracing channels create an independent mutable
+// context for each call while preserving explicitly provided contexts.
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+
+const lengthChannel = dc.tracingChannel('test:length');
+assert.strictEqual(lengthChannel.traceSync.length, 1);
+assert.strictEqual(lengthChannel.tracePromise.length, 1);
+
+function subscribe(channel, contexts, isPromise = false) {
+  let endCalls = 0;
+  let asyncStartCalls = 0;
+  let asyncEndCalls = 0;
+
+  channel.subscribe({
+    start: common.mustCall((context) => {
+      context.invocation = contexts.length;
+      contexts.push(context);
+    }, 4),
+    end: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, endCalls++);
+    }, 4),
+    asyncStart: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncStartCalls++);
+    }, isPromise ? 4 : 0),
+    asyncEnd: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncEndCalls++);
+    }, isPromise ? 4 : 0),
+  });
+}
+
+const syncChannel = dc.tracingChannel('test:sync-context');
+const syncContexts = [];
+subscribe(syncChannel, syncContexts);
+
+const syncProvided = { provided: true };
+assert.strictEqual(syncChannel.traceSync(() => 'omitted'), 'omitted');
+assert.strictEqual(syncChannel.traceSync(() => 'undefined', undefined),
+                   'undefined');
+assert.strictEqual(syncChannel.traceSync(() => 'provided', syncProvided),
+                   'provided');
+
+assert.strictEqual(Object.getPrototypeOf(syncContexts[0]), null);
+assert.strictEqual(Object.getPrototypeOf(syncContexts[1]), null);
+assert.notStrictEqual(syncContexts[0], syncContexts[1]);
+assert.strictEqual(syncContexts[2], syncProvided);
+assert.deepStrictEqual(syncContexts.slice(0, 3).map(({ result }) => result),
+                       ['omitted', 'undefined', 'provided']);
+
+const syncError = new Error('sync');
+assert.throws(() => syncChannel.traceSync(() => {
+  throw syncError;
+}), (error) => error === syncError);
+assert.strictEqual(syncContexts[3].error, syncError);
+
+const promiseChannel = dc.tracingChannel('test:promise-context');
+const promiseContexts = [];
+subscribe(promiseChannel, promiseContexts, true);
+
+const promiseProvided = { provided: true };
+const promiseError = new Error('promise');
+Promise.resolve()
+  .then(() => promiseChannel.tracePromise(() => Promise.resolve('omitted')))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('undefined'), undefined))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('provided'), promiseProvided))
+  .then(() => assert.rejects(
+    promiseChannel.tracePromise(() => Promise.reject(promiseError)),
+    promiseError))
+  .then(common.mustCall(() => {
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[0]), null);
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[1]), null);
+    assert.notStrictEqual(promiseContexts[0], promiseContexts[1]);
+    assert.strictEqual(promiseContexts[2], promiseProvided);
+    assert.deepStrictEqual(
+      promiseContexts.slice(0, 3).map(({ result }) => result),
+      ['omitted', 'undefined', 'provided']);
+    assert.strictEqual(promiseContexts[3].error, promiseError);
+  }));
diff --git a/test/parallel/test-dlopen-binary.js b/test/parallel/test-dlopen-binary.js
new file mode 100644
index 000000000000..8a575a52c975
--- /dev/null
+++ b/test/parallel/test-dlopen-binary.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { internalBinding } = require('internal/test/binding');
+
+// dlopenBinary() loads a native addon from bytes already in memory, for an
+// addon that the dynamic loader cannot open by path (e.g. one served by a
+// virtual file system). It is internal: process.dlopen() keeps its documented
+// (module, filename[, flags]) signature and never takes the bytes.
+const { dlopenBinary } = internalBinding('process_methods');
+assert.strictEqual(typeof dlopenBinary, 'function');
+assert.strictEqual(process.dlopen.length, 0);
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+const bytes = fs.readFileSync(addonPath);
+const flags = (os.constants.dlopen?.RTLD_LAZY) || 0;
+
+// A path that does not exist on disk, as a VFS-resident addon would be.
+const fakePath = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+assert.ok(!fs.existsSync(fakePath));
+
+const m = { exports: {} };
+dlopenBinary(m, fakePath, flags, bytes);
+assert.strictEqual(typeof m.exports.hello, 'function');
+assert.strictEqual(m.exports.hello(), 'world');
+
+// The flags argument may be left undefined when passing bytes.
+const m2 = { exports: {} };
+dlopenBinary(m2, fakePath, undefined, bytes);
+assert.strictEqual(m2.exports.hello(), 'world');
+
+// Without the bytes, that nonexistent path cannot be loaded.
+assert.throws(() => dlopenBinary({ exports: {} }, fakePath, flags),
+              { code: 'ERR_DLOPEN_FAILED' });
+
+// A non-buffer binary is rejected.
+assert.throws(
+  () => dlopenBinary({ exports: {} }, fakePath, flags, 'nope'),
+  { code: 'ERR_INVALID_ARG_TYPE' });
+
+// process.dlopen() ignores a fourth argument rather than loading from it: the
+// public signature is unchanged, so this still fails on the missing path.
+assert.throws(
+  () => process.dlopen({ exports: {} }, fakePath, flags, bytes),
+  { code: 'ERR_DLOPEN_FAILED' });
diff --git a/test/parallel/test-dns-resolver-max-timeout.js b/test/parallel/test-dns-resolver-max-timeout.js
index 7abac39323e1..1a4aaef96c96 100644
--- a/test/parallel/test-dns-resolver-max-timeout.js
+++ b/test/parallel/test-dns-resolver-max-timeout.js
@@ -52,9 +52,11 @@ server.bind(0, common.mustCall(async () => {
 
   // Test that maxTimeout is effective.
   // Without maxTimeout, the timeout will keep increasing when retrying.
-  const timeout1 = await timeout(address, { timeout: 500, tries: 3 });
-  // With maxTimeout, the timeout will always be 500 when retrying.
-  const timeout2 = await timeout(address, { timeout: 500, tries: 3, maxTimeout: 500 });
+  // Expired tries are only noticed on the resolver's `timeout` ms timer tick,
+  // so use enough tries that the doubling run cannot overlap the capped one.
+  const timeout1 = await timeout(address, { timeout: 100, tries: 5 });
+  // With maxTimeout, the timeout will always be 100 when retrying.
+  const timeout2 = await timeout(address, { timeout: 100, tries: 5, maxTimeout: 100 });
   console.log(`timeout1: ${timeout1}, timeout2: ${timeout2}`);
   assert.strictEqual(timeout1 !== undefined && timeout2 !== undefined, true);
   assert.strictEqual(timeout1 > timeout2, true);
diff --git a/test/parallel/test-dtls-accessors.mjs b/test/parallel/test-dtls-accessors.mjs
new file mode 100644
index 000000000000..bb93eeaebe6e
--- /dev/null
+++ b/test/parallel/test-dtls-accessors.mjs
@@ -0,0 +1,101 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLSEndpoint/DTLSSession state fields and callback accessors reflect
+// what is set and the connection lifecycle.
+
+import {
+  hasCrypto, skip, mustCall, mustNotCall, mustCallAtLeast,
+} from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const gotServerSession = Promise.withResolvers();
+
+const server = listen(mustCall((session) => {
+  gotServerSession.resolve(session);
+}), { cert, key, port: 0, host: '127.0.0.1' });
+
+// --- Endpoint state after listen(): bound and listening. ---
+const es = server.state;
+assert.strictEqual(es.bound, true);
+assert.strictEqual(es.listening, true);
+assert.strictEqual(es.closing, false);
+assert.strictEqual(es.destroyed, false);
+assert.strictEqual(es.sessionCount, 0);
+
+// The busy property is settable via the endpoint and reflected in the state view.
+assert.strictEqual(server.busy, false);
+assert.strictEqual(es.busy, false);
+server.busy = true;
+assert.strictEqual(server.busy, true);
+assert.strictEqual(es.busy, true);
+server.busy = false;
+assert.strictEqual(es.busy, false);
+
+// --- Endpoint onerror accessor. ---
+assert.strictEqual(server.onerror, undefined);
+const onEndpointError = mustNotCall();
+server.onerror = onEndpointError;
+assert.strictEqual(server.onerror, onEndpointError);
+
+const client = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+});
+
+// --- Session state during the handshake. ---
+const cs = client.state;
+assert.strictEqual(cs.handshaking, true);
+assert.strictEqual(cs.open, false);
+assert.strictEqual(cs.closing, false);
+assert.strictEqual(cs.destroyed, false);
+assert.strictEqual(cs.hasMessageListener, false);
+
+// --- Session callback accessors: unset, then set. ---
+assert.strictEqual(client.onmessage, undefined);
+assert.strictEqual(client.onerror, undefined);
+assert.strictEqual(client.onhandshake, undefined);
+assert.strictEqual(client.onkeylog, undefined);
+// A connect() session owns its internal endpoint.
+assert.strictEqual(client.ownsEndpoint, true);
+
+client.onmessage = mustNotCall();
+assert.strictEqual(typeof client.onmessage, 'function');
+// Attaching a message listener flips the shared flag.
+assert.strictEqual(cs.hasMessageListener, true);
+
+client.onerror = mustNotCall();
+assert.strictEqual(typeof client.onerror, 'function');
+
+client.onhandshake = mustCall();
+assert.strictEqual(typeof client.onhandshake, 'function');
+
+client.onkeylog = mustCallAtLeast();
+assert.strictEqual(typeof client.onkeylog, 'function');
+
+await client.opened;
+
+// --- Session state after the handshake completes. ---
+assert.strictEqual(cs.handshaking, false);
+assert.strictEqual(cs.open, true);
+
+const serverSession = await gotServerSession.promise;
+await serverSession.opened;
+assert.strictEqual(es.sessionCount, 1);
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-alpn.mjs b/test/parallel/test-dtls-alpn.mjs
new file mode 100644
index 000000000000..01054dd6432b
--- /dev/null
+++ b/test/parallel/test-dtls-alpn.mjs
@@ -0,0 +1,82 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: ALPN negotiation in DTLS.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const serverAlpnChecked = Promise.withResolvers();
+
+const endpoint = listen(mustCall(async (session) => {
+  await session.opened;
+  // Server should see the negotiated ALPN protocol.
+  assert.strictEqual(session.alpnProtocol, 'coap');
+  serverAlpnChecked.resolve();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+  alpn: ['coap', 'h2'],
+});
+
+const session = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+  alpn: ['coap'],
+});
+
+await session.opened;
+
+// Client should see the negotiated protocol.
+assert.strictEqual(session.alpnProtocol, 'coap');
+
+await serverAlpnChecked.promise;
+
+await session.close();
+await endpoint.close();
+
+// ALPN with no protocol in common: the handshake still completes and neither
+// peer reports a negotiated protocol.
+{
+  const gotServerSession = Promise.withResolvers();
+
+  const server = listen(mustCall((s) => gotServerSession.resolve(s)), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+    alpn: ['bar'],
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+    alpn: ['foo'],
+  });
+
+  await client.opened;
+  const serverSession = await gotServerSession.promise;
+  await serverSession.opened;
+
+  assert.strictEqual(client.alpnProtocol, undefined);
+  assert.strictEqual(serverSession.alpnProtocol, undefined);
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-async-dispose.mjs b/test/parallel/test-dtls-async-dispose.mjs
new file mode 100644
index 000000000000..7fdf43445cc1
--- /dev/null
+++ b/test/parallel/test-dtls-async-dispose.mjs
@@ -0,0 +1,47 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Symbol.asyncDispose for DTLSEndpoint and DTLSSession.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustNotCall();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const session = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+await session.opened;
+
+// Test that Symbol.asyncDispose exists.
+assert.strictEqual(typeof session[Symbol.asyncDispose], 'function');
+assert.strictEqual(typeof endpoint[Symbol.asyncDispose], 'function');
+
+// Dispose the session.
+await session[Symbol.asyncDispose]();
+
+// Dispose the endpoint.
+await endpoint[Symbol.asyncDispose]();
diff --git a/test/parallel/test-dtls-basic.mjs b/test/parallel/test-dtls-basic.mjs
new file mode 100644
index 000000000000..9df0eff0dcc6
--- /dev/null
+++ b/test/parallel/test-dtls-basic.mjs
@@ -0,0 +1,87 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Basic DTLS handshake and bidirectional data exchange.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const serverReceivedData = Promise.withResolvers();
+const clientReceivedData = Promise.withResolvers();
+
+let serverHandshakeDone = false;
+let clientHandshakeDone = false;
+
+// Start server.
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), 'hello from client');
+    serverReceivedData.resolve();
+
+    // Send response back to client.
+    session.send('hello from server');
+  });
+
+  session.onhandshake = mustCall((protocol) => {
+    assert.ok(protocol);
+    assert.match(protocol, /DTLS/i);
+    serverHandshakeDone = true;
+  });
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const serverAddress = endpoint.address;
+assert.ok(serverAddress);
+assert.ok(serverAddress.port > 0);
+
+// Connect client.
+const clientSession = connect('127.0.0.1', serverAddress.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+clientSession.onmessage = mustCall((data) => {
+  assert.strictEqual(data.toString(), 'hello from server');
+  clientReceivedData.resolve();
+});
+
+clientSession.onhandshake = mustCall((protocol) => {
+  assert.ok(protocol);
+  clientHandshakeDone = true;
+});
+
+// Wait for handshake.
+const { protocol } = await clientSession.opened;
+assert.match(protocol, /DTLS/i);
+
+// Send data.
+clientSession.send('hello from client');
+
+// Wait for bidirectional exchange.
+await Promise.all([serverReceivedData.promise, clientReceivedData.promise]);
+
+// Verify handshakes completed.
+assert.ok(clientHandshakeDone);
+assert.ok(serverHandshakeDone);
+
+// Clean up.
+await clientSession.close();
+await endpoint.close();
diff --git a/test/parallel/test-dtls-ciphers.mjs b/test/parallel/test-dtls-ciphers.mjs
new file mode 100644
index 000000000000..074c33f64b9b
--- /dev/null
+++ b/test/parallel/test-dtls-ciphers.mjs
@@ -0,0 +1,76 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: cipher and ECDH-curve selection and validation.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const CIPHER = 'ECDHE-RSA-AES128-GCM-SHA256';
+
+// Case 1: a specific cipher is negotiated and reported on both peers.
+{
+  const gotServerSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotServerSession.resolve(session);
+  }), { cert, key, port: 0, host: '127.0.0.1', ciphers: CIPHER });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+    ciphers: CIPHER,
+  });
+
+  await client.opened;
+  const serverSession = await gotServerSession.promise;
+  await serverSession.opened;
+
+  assert.strictEqual(client.cipher.name, CIPHER);
+  assert.strictEqual(serverSession.cipher.name, CIPHER);
+
+  await client.close();
+  await server.close();
+}
+
+// Case 2: an invalid cipher list is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key, port: 0, host: '127.0.0.1', ciphers: 'THIS-IS-NOT-A-CIPHER',
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// Case 3: a valid ECDH curve completes a handshake.
+{
+  const server = listen(mustCall(), {
+    cert, key, port: 0, host: '127.0.0.1', ecdhCurve: 'P-256',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+    ecdhCurve: 'P-256',
+  });
+
+  await client.opened;
+
+  await client.close();
+  await server.close();
+}
+
+// Case 4: an invalid ECDH curve is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key, port: 0, host: '127.0.0.1', ecdhCurve: 'not-a-curve',
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
diff --git a/test/parallel/test-dtls-client-cert.mjs b/test/parallel/test-dtls-client-cert.mjs
new file mode 100644
index 000000000000..271bd7e322ab
--- /dev/null
+++ b/test/parallel/test-dtls-client-cert.mjs
@@ -0,0 +1,70 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS mutual authentication. A server with requestCert verifies the
+// client's certificate; a client that presents no certificate is rejected.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// Case 1: the client presents a certificate the server can verify.
+{
+  const gotServerSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotServerSession.resolve(session);
+  }), {
+    cert, key, ca: [ca], requestCert: true, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    cert, key, ca: [ca], rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  const serverSession = await gotServerSession.promise;
+  await serverSession.opened;
+
+  // The server received and verified the client's certificate.
+  const clientCert = serverSession.peerCertificate;
+  assert.ok(clientCert);
+  assert.ok(clientCert.includes('BEGIN CERTIFICATE'));
+
+  await client.close();
+  await server.close();
+}
+
+// Case 2: the client presents no certificate; the server requires one and
+// rejects the handshake.
+{
+  const server = listen(mustCall(), {
+    cert, key, ca: [ca], requestCert: true, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca], rejectUnauthorized: false,
+  });
+
+  // The exact alert text varies, so assert only that the handshake is rejected.
+  await assert.rejects(client.opened, {
+    message: /handshake failure/
+  });
+
+  // The failed client tears down its internally-owned endpoint.
+  await client.endpoint.closed;
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-close.mjs b/test/parallel/test-dtls-close.mjs
new file mode 100644
index 000000000000..a71e0938b7d0
--- /dev/null
+++ b/test/parallel/test-dtls-close.mjs
@@ -0,0 +1,107 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Graceful close (close_notify) and forced destroy.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+// Test 1: Graceful close from client side.
+{
+  const serverSessionClosed = Promise.withResolvers();
+
+  const endpoint = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+    session.closed.then(mustCall(() => {
+      serverSessionClosed.resolve();
+    }));
+  }), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+  });
+
+  const session = connect('127.0.0.1', endpoint.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  await session.opened;
+
+  // Graceful close.
+  const closedPromise = session.close();
+  assert.ok(closedPromise instanceof Promise);
+  await closedPromise;
+
+  // Wait for server to see the close.
+  await serverSessionClosed.promise;
+
+  endpoint.close();
+  await endpoint.closed;
+}
+
+// Test 2: Forced destroy.
+{
+  const endpoint = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+  }), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+  });
+
+  const session = connect('127.0.0.1', endpoint.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  await session.opened;
+
+  // Forced destroy - no close_notify.
+  session.destroy();
+
+  // After destroy, send should fail.
+  assert.throws(() => {
+    session.send('should fail');
+  }, /destroyed/i);
+
+  endpoint.destroy();
+}
+
+// Test 3: Endpoint close closes all sessions.
+{
+  const endpoint = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+  }), {
+    cert: serverCert.toString(),
+    key: serverKey.toString(),
+    port: 0,
+    host: '127.0.0.1',
+  });
+
+  const session = connect('127.0.0.1', endpoint.address.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  await session.opened;
+
+  // Close the endpoint - this should close all sessions.
+  await endpoint.close();
+}
diff --git a/test/parallel/test-dtls-connect-error-cleanup.mjs b/test/parallel/test-dtls-connect-error-cleanup.mjs
new file mode 100644
index 000000000000..13dcf8da26bc
--- /dev/null
+++ b/test/parallel/test-dtls-connect-error-cleanup.mjs
@@ -0,0 +1,43 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: a client connect() whose handshake fails must tear down its internally
+// owned endpoint, so the event loop can drain. Regression test for a failed
+// connect leaking the endpoint (and hanging the process).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// The client rejects the certificate mid-handshake, so this server session
+// never opens; its opened rejection is handled internally by the library.
+const server = listen(mustCall(), { cert, key, port: 0, host: '127.0.0.1' });
+
+// A servername that does not match the certificate, under rejectUnauthorized,
+// makes the client's handshake fail during verification.
+const session = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: true,
+  servername: 'wrong.example.com',
+});
+
+await assert.rejects(session.opened, /certificate verify failed/i);
+
+// The failed connect must have closed its internally-owned endpoint. Without
+// that, this await never settles and the test times out.
+await session.endpoint.closed;
+
+await server.close();
diff --git a/test/parallel/test-dtls-default-ca.mjs b/test/parallel/test-dtls-default-ca.mjs
new file mode 100644
index 000000000000..7c3475ddbbe9
--- /dev/null
+++ b/test/parallel/test-dtls-default-ca.mjs
@@ -0,0 +1,38 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test that DTLS uses Node's configurable default CA set when no explicit
+// `ca` option is provided.
+
+import { hasCrypto, mustCall, skip } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { connect, listen } = await import('node:dtls');
+const { setDefaultCACertificates } = await import('node:tls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+setDefaultCACertificates([ca]);
+
+const endpoint = listen(mustCall(), {
+  // Also cover the shared certificate-chain loader adopted by DTLS.
+  cert: Buffer.concat([serverCert, ca]),
+  key: serverKey,
+  host: '127.0.0.1',
+  port: 0,
+});
+
+const client = connect('127.0.0.1', endpoint.address.port);
+await client.opened;
+
+await client.close();
+await endpoint.close();
diff --git a/test/parallel/test-dtls-destroy-in-callback.mjs b/test/parallel/test-dtls-destroy-in-callback.mjs
new file mode 100644
index 000000000000..7915742ca01d
--- /dev/null
+++ b/test/parallel/test-dtls-destroy-in-callback.mjs
@@ -0,0 +1,77 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: destroying a DTLS session synchronously from within a callback that is
+// dispatched from the session's own I/O pump must not crash. The endpoint's
+// session table holds the only strong reference to the session, so a reentrant
+// destroy() removes it mid-pump; the implementation must keep the object alive
+// until the pump unwinds (regression test for a use-after-free).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// ---------------------------------------------------------------------------
+// Case 1: destroy the (server) session from inside onmessage. The datagram
+// carrying the message drives receive -> pump -> onmessage -> destroy(), which
+// frees the session's map entry while ClearOut() is still looping over ssl_.
+{
+  const destroyed = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustCall(() => {
+      session.destroy();
+      destroyed.resolve();
+    });
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  client.send('destroy me from onmessage');
+
+  await destroyed.promise;
+
+  await client.close();
+  await server.close();
+}
+
+// ---------------------------------------------------------------------------
+// Case 2: destroy the (server) session from inside onhandshake. Handshake
+// completion is emitted from the middle of the pump (Cycle), so destroying
+// there must not free the session before the pump finishes unwinding.
+{
+  const destroyed = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onhandshake = mustCall(() => {
+      session.destroy();
+      destroyed.resolve();
+    });
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await destroyed.promise;
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-errors.mjs b/test/parallel/test-dtls-errors.mjs
new file mode 100644
index 000000000000..e65c90abd4e0
--- /dev/null
+++ b/test/parallel/test-dtls-errors.mjs
@@ -0,0 +1,45 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS error handling for invalid certificate/key material and endpoint
+// state.
+
+import { hasCrypto, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, DTLSEndpoint } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const mismatchedKey = fixtures.readKey('agent2-key.pem').toString();
+
+// A malformed certificate PEM is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert: 'not a certificate', key, port: 0,
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// A malformed private key PEM is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key: 'not a key', port: 0,
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// A private key that does not match the certificate is rejected.
+assert.throws(() => listen(mustNotCall(), {
+  cert, key: mismatchedKey, port: 0,
+}), { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+
+// Binding the same endpoint twice fails.
+{
+  const endpoint = new DTLSEndpoint();
+  endpoint.bind('127.0.0.1', 0);
+  assert.throws(() => endpoint.bind('127.0.0.1', 0), { code: 'ERR_INVALID_STATE' });
+  await endpoint.close();
+}
diff --git a/test/parallel/test-dtls-keylog.mjs b/test/parallel/test-dtls-keylog.mjs
new file mode 100644
index 000000000000..f32c1142b4c6
--- /dev/null
+++ b/test/parallel/test-dtls-keylog.mjs
@@ -0,0 +1,46 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: the onkeylog callback delivers NSS-format key material during the
+// handshake (useful for decrypting captures in Wireshark).
+
+import { hasCrypto, skip, mustCall, mustCallAtLeast } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const gotKeylog = Promise.withResolvers();
+
+const server = listen(mustCall(), {
+  cert, key, port: 0, host: '127.0.0.1',
+});
+
+const client = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+});
+
+// A keylog line is "<LABEL> <hex> <hex>" (e.g. "CLIENT_RANDOM ...").
+client.onkeylog = mustCallAtLeast((line) => {
+  assert.strictEqual(typeof line, 'string');
+  assert.match(line, /^\S+ [0-9a-f]+ [0-9a-f]+$/i);
+  gotKeylog.resolve();
+});
+
+await client.opened;
+await gotKeylog.promise;
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-mtu.mjs b/test/parallel/test-dtls-mtu.mjs
new file mode 100644
index 000000000000..58bf9098d00e
--- /dev/null
+++ b/test/parallel/test-dtls-mtu.mjs
@@ -0,0 +1,65 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: MTU option validation and that a small (but valid) MTU still completes
+// a handshake and data exchange (exercising DTLS record fragmentation).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect, DTLSEndpoint } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// MTU must be within [256, 65535].
+assert.throws(() => new DTLSEndpoint({ mtu: 255 }), { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => new DTLSEndpoint({ mtu: 65536 }), { code: 'ERR_OUT_OF_RANGE' });
+
+// A valid boundary MTU is accepted.
+{
+  const endpoint = new DTLSEndpoint({ mtu: 256 });
+  await endpoint.close();
+}
+
+// A small valid MTU forces the handshake flights (e.g. the certificate) to be
+// fragmented across records, and the exchange still succeeds.
+{
+  const received = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustCall((data) => {
+      assert.strictEqual(data.toString(), 'hello');
+      session.send('world');
+    });
+  }), {
+    cert, key, port: 0, host: '127.0.0.1', mtu: 256,
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+    mtu: 256,
+  });
+
+  client.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), 'world');
+    received.resolve();
+  });
+
+  await client.opened;
+  client.send('hello');
+  await received.promise;
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-multiple-clients.mjs b/test/parallel/test-dtls-multiple-clients.mjs
new file mode 100644
index 000000000000..6ef5435295d0
--- /dev/null
+++ b/test/parallel/test-dtls-multiple-clients.mjs
@@ -0,0 +1,78 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Multiple clients connecting to the same DTLS server.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const NUM_CLIENTS = 3;
+let sessionsAccepted = 0;
+const allClientsConnected = Promise.withResolvers();
+
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = (data) => {
+    // Echo back with session identifier.
+    session.send(`echo:${data.toString()}`);
+  };
+
+  if (++sessionsAccepted === NUM_CLIENTS) {
+    allClientsConnected.resolve();
+  }
+}, NUM_CLIENTS), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const serverAddress = endpoint.address;
+const clients = [];
+const clientResponses = [];
+
+for (let i = 0; i < NUM_CLIENTS; i++) {
+  const received = Promise.withResolvers();
+  clientResponses.push(received);
+
+  const session = connect('127.0.0.1', serverAddress.port, {
+    ca: [ca.toString()],
+    rejectUnauthorized: false,
+  });
+
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), `echo:client${i}`);
+    received.resolve();
+  });
+
+  clients.push(session);
+}
+
+// Wait for all handshakes.
+await Promise.all(clients.map((c) => c.opened));
+
+// Send data from each client.
+for (let i = 0; i < NUM_CLIENTS; i++) {
+  clients[i].send(`client${i}`);
+}
+
+// Wait for all echoes.
+await Promise.all(clientResponses.map((r) => r.promise));
+
+// Clean up.
+await Promise.all(clients.map((c) => c.close()));
+
+await endpoint.close();
diff --git a/test/parallel/test-dtls-options.mjs b/test/parallel/test-dtls-options.mjs
new file mode 100644
index 000000000000..f071c3adc208
--- /dev/null
+++ b/test/parallel/test-dtls-options.mjs
@@ -0,0 +1,65 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: Option validation for DTLS API.
+
+import { hasCrypto, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+// Test: listen() requires a callback.
+assert.throws(() => {
+  listen(undefined, { cert: 'x', key: 'y', port: 0 });
+}, { code: 'ERR_INVALID_ARG_TYPE' });
+
+// Test: listen() requires cert.
+assert.throws(() => {
+  listen(mustNotCall(), { key: 'y', port: 0 });
+}, { code: 'ERR_MISSING_ARGS' });
+
+// Test: listen() requires key.
+assert.throws(() => {
+  listen(mustNotCall(), { cert: 'x', port: 0 });
+}, { code: 'ERR_MISSING_ARGS' });
+
+// Test: listen() requires port.
+assert.throws(() => {
+  listen(mustNotCall(), { cert: 'x', key: 'y' });
+}, { code: 'ERR_MISSING_ARGS' });
+
+// Test: connect() requires valid host.
+assert.throws(() => {
+  connect(123, 4433);
+}, { code: 'ERR_INVALID_ARG_TYPE' });
+
+// Test: connect() requires valid port.
+assert.throws(() => {
+  connect('localhost', 'invalid');
+}, { code: 'ERR_INVALID_ARG_TYPE' });
+
+// Test: connect() rejects out-of-range port.
+assert.throws(() => {
+  connect('localhost', 99999);
+}, { code: 'ERR_OUT_OF_RANGE' });
+
+// Test: mtu must be an integer within [256, 65535].
+assert.throws(() => {
+  connect('127.0.0.1', 4433, { mtu: 100 });
+}, { code: 'ERR_OUT_OF_RANGE' });
+
+assert.throws(() => {
+  connect('127.0.0.1', 4433, { mtu: 70000 });
+}, { code: 'ERR_OUT_OF_RANGE' });
+
+// Test: alpn must be a string array or Buffer.
+assert.throws(() => {
+  connect('127.0.0.1', 4433, { alpn: 123 });
+}, { code: 'ERR_INVALID_ARG_TYPE' });
diff --git a/test/parallel/test-dtls-reject-unauthorized.mjs b/test/parallel/test-dtls-reject-unauthorized.mjs
new file mode 100644
index 000000000000..3ed625de30cd
--- /dev/null
+++ b/test/parallel/test-dtls-reject-unauthorized.mjs
@@ -0,0 +1,60 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: rejectUnauthorized gates certificate-chain verification. A certificate
+// that does not chain to a trusted CA is rejected when rejectUnauthorized is
+// true and accepted when it is false.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+
+// Case 1: with rejectUnauthorized, a certificate that does not chain to a
+// trusted CA fails verification. The servername matches the certificate, so
+// the failure is the untrusted chain and not an identity mismatch. No `ca` is
+// supplied, so only the system-default CAs are trusted (which do not include
+// this test's CA).
+{
+  const server = listen(mustCall(), {
+    cert, key, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    rejectUnauthorized: true,
+    servername: 'agent1',
+  });
+
+  await assert.rejects(client.opened, /certificate verify failed/i);
+
+  await client.endpoint.closed;
+  await server.close();
+}
+
+// Case 2: the same untrusted certificate is accepted when verification is off.
+{
+  const server = listen(mustCall(), {
+    cert, key, port: 0, host: '127.0.0.1',
+  });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    rejectUnauthorized: false,
+  });
+
+  const { protocol } = await client.opened;
+  assert.match(protocol, /DTLS/i);
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-robustness.mjs b/test/parallel/test-dtls-robustness.mjs
new file mode 100644
index 000000000000..a2bc7c541f23
--- /dev/null
+++ b/test/parallel/test-dtls-robustness.mjs
@@ -0,0 +1,47 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: a listening DTLS server drops a non-DTLS (junk) datagram without
+// crashing, and still accepts a real client afterwards.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import dgram from 'node:dgram';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const server = listen(mustCall((session) => {
+  session.onhandshake = mustCall();
+}), { cert, key, port: 0, host: '127.0.0.1' });
+
+const { port } = server.address;
+
+// Fire a datagram that is not a ClientHello at the server.
+const raw = dgram.createSocket('udp4');
+await new Promise((resolve, reject) => {
+  raw.send(Buffer.from('this is not a DTLS ClientHello'), port, '127.0.0.1',
+           (err) => (err ? reject(err) : resolve()));
+});
+await new Promise((resolve) => raw.close(resolve));
+
+// A real client still completes a handshake against the same server.
+const client = connect('127.0.0.1', port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+});
+
+await client.opened;
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-send.mjs b/test/parallel/test-dtls-send.mjs
new file mode 100644
index 000000000000..7c559eaef75e
--- /dev/null
+++ b/test/parallel/test-dtls-send.mjs
@@ -0,0 +1,67 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLSSession.send() return values and the single-record size limit.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// The largest application payload that fits in a single DTLS record (2^14).
+const MAX_RECORD = 16384;
+
+// Case 1: send() before the handshake returns -1; afterwards it returns the
+// number of bytes written and the message is delivered whole.
+{
+  const received = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustCall((data) => received.resolve(data.length));
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  assert.strictEqual(client.send('before handshake'), -1);
+
+  await client.opened;
+
+  assert.strictEqual(client.send(Buffer.alloc(MAX_RECORD, 0x61)), MAX_RECORD);
+  assert.strictEqual(await received.promise, MAX_RECORD);
+
+  await client.close();
+  await server.close();
+}
+
+// Case 2: a payload larger than a single record cannot be sent.
+{
+  const server = listen(mustCall((session) => {
+    session.onmessage = mustNotCall();
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  assert.strictEqual(client.send(Buffer.alloc(MAX_RECORD + 1, 0x61)), -1);
+
+  await client.close();
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-servername-invalid.mjs b/test/parallel/test-dtls-servername-invalid.mjs
new file mode 100644
index 000000000000..a15752345cc7
--- /dev/null
+++ b/test/parallel/test-dtls-servername-invalid.mjs
@@ -0,0 +1,27 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: connect() surfaces a failure to set the SNI servername (for example a
+// name longer than the TLS maximum of 255 bytes) as an error, rather than
+// silently ignoring it.
+
+import { hasCrypto, skip } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { connect } = await import('node:dtls');
+
+// SNI host names are limited to 255 bytes; a longer one must throw.
+assert.throws(
+  () => connect('127.0.0.1', 12345, {
+    servername: 'a'.repeat(256),
+    rejectUnauthorized: false,
+  }),
+  { code: 'ERR_CRYPTO_OPERATION_FAILED' },
+);
diff --git a/test/parallel/test-dtls-session-properties.mjs b/test/parallel/test-dtls-session-properties.mjs
new file mode 100644
index 000000000000..2089dc6de6c0
--- /dev/null
+++ b/test/parallel/test-dtls-session-properties.mjs
@@ -0,0 +1,61 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLSSession properties after handshake.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustNotCall();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const session = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+await session.opened;
+
+// Protocol should be DTLSv1.2.
+assert.match(session.protocol, /DTLS/i);
+
+// Cipher should be an object with name, standardName, version.
+const cipher = session.cipher;
+assert.strictEqual(typeof cipher?.name, 'string');
+assert.strictEqual(typeof cipher?.standardName, 'string');
+assert.strictEqual(typeof cipher?.version, 'string');
+
+// Remote address should be defined.
+const addr = session.remoteAddress;
+assert.ok(addr);
+
+// Peer certificate should be available (PEM string).
+const peerCert = session.peerCertificate;
+assert.ok(peerCert);
+assert.ok(peerCert.includes('BEGIN CERTIFICATE'));
+
+// State should reflect open connection.
+assert.ok(session.state);
+
+await session.close();
+await endpoint.close();
diff --git a/test/parallel/test-dtls-session-table-cleanup.mjs b/test/parallel/test-dtls-session-table-cleanup.mjs
new file mode 100644
index 000000000000..e6cfd458099a
--- /dev/null
+++ b/test/parallel/test-dtls-session-table-cleanup.mjs
@@ -0,0 +1,74 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: a session is removed from its endpoint's session table when it closes,
+// whether closed locally or by the peer. Regression test for closed sessions
+// leaking in the table (which also blocks reuse of the peer's address).
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// ---------------------------------------------------------------------------
+// Case 1: the server closes its own session -> removed from the table.
+{
+  const gotSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotSession.resolve(session);
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  const session = await gotSession.promise;
+
+  assert.strictEqual(server.state.sessionCount, 1);
+  await session.close();
+  assert.strictEqual(server.state.sessionCount, 0);
+
+  await client.close();
+  await server.close();
+}
+
+// ---------------------------------------------------------------------------
+// Case 2: the client closes -> the server sees the peer close_notify and
+// removes the session from the table.
+{
+  const gotSession = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    gotSession.resolve(session);
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const client = connect('127.0.0.1', server.address.port, {
+    ca: [ca],
+    rejectUnauthorized: false,
+  });
+
+  await client.opened;
+  const session = await gotSession.promise;
+
+  assert.strictEqual(server.state.sessionCount, 1);
+  await client.close();   // Sends close_notify to the server
+  await session.closed;   // Server processes it, detaches, and emits its close
+  assert.strictEqual(server.state.sessionCount, 0);
+
+  await server.close();
+}
diff --git a/test/parallel/test-dtls-srtp.mjs b/test/parallel/test-dtls-srtp.mjs
new file mode 100644
index 000000000000..602ad3552ffd
--- /dev/null
+++ b/test/parallel/test-dtls-srtp.mjs
@@ -0,0 +1,75 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: SRTP profile negotiation and keying-material export (DTLS-SRTP). Both
+// peers must negotiate the same SRTP profile and derive identical keying
+// material from exportKeyingMaterial.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const SRTP_PROFILE = 'SRTP_AEAD_AES_128_GCM';
+
+const gotServerSession = Promise.withResolvers();
+
+const server = listen(mustCall((session) => {
+  gotServerSession.resolve(session);
+}), {
+  cert,
+  key,
+  port: 0,
+  host: '127.0.0.1',
+  srtp: SRTP_PROFILE,
+});
+
+const client = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: false,
+  srtp: SRTP_PROFILE,
+});
+
+await client.opened;
+const serverSession = await gotServerSession.promise;
+await serverSession.opened;
+
+// Both peers negotiate the same SRTP profile.
+assert.strictEqual(client.srtpProfile, SRTP_PROFILE);
+assert.strictEqual(serverSession.srtpProfile, SRTP_PROFILE);
+
+// Both peers derive identical keying material for the same label and length.
+const label = 'EXTRACTOR-dtls_srtp';
+const clientKM = client.exportKeyingMaterial(60, label);
+const serverKM = serverSession.exportKeyingMaterial(60, label);
+assert.strictEqual(clientKM.length, 60);
+assert.deepStrictEqual(clientKM, serverKM);
+
+// The optional context is bound into the derivation: the same context yields
+// the same material on both peers, and a different context yields different
+// material.
+const contextA = Buffer.from('context-a');
+const contextB = Buffer.from('context-b');
+assert.deepStrictEqual(
+  client.exportKeyingMaterial(32, label, contextA),
+  serverSession.exportKeyingMaterial(32, label, contextA),
+);
+assert.notDeepStrictEqual(
+  client.exportKeyingMaterial(32, label, contextA),
+  client.exportKeyingMaterial(32, label, contextB),
+);
+
+await client.close();
+await server.close();
diff --git a/test/parallel/test-dtls-stats.mjs b/test/parallel/test-dtls-stats.mjs
new file mode 100644
index 000000000000..a68c4a1d215e
--- /dev/null
+++ b/test/parallel/test-dtls-stats.mjs
@@ -0,0 +1,151 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS endpoint and session stats increment with data transfer.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+const serverCert = fixtures.readKey('agent1-cert.pem');
+const serverKey = fixtures.readKey('agent1-key.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const serverReceivedData = Promise.withResolvers();
+const clientReceivedData = Promise.withResolvers();
+
+let serverSession;
+
+// Start server.
+const endpoint = listen(mustCall((session) => {
+  serverSession = session;
+
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString(), 'hello from client');
+    session.send('hello from server');
+    serverReceivedData.resolve();
+  });
+
+  session.onhandshake = mustCall();
+}), {
+  cert: serverCert.toString(),
+  key: serverKey.toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+// --- Endpoint stats should be available immediately ---
+
+const epStats = endpoint.stats;
+assert.ok(epStats, 'endpoint.stats should be defined');
+assert.ok(epStats.isConnected, 'stats should be connected');
+assert.ok(epStats.createdAt > 0n, 'createdAt should be set');
+assert.strictEqual(epStats.destroyedAt, 0n);
+assert.strictEqual(epStats.clientSessions, 0n);
+assert.strictEqual(epStats.serverSessions, 0n);
+assert.strictEqual(epStats.serverBusyCount, 0n);
+
+// Connect client.
+const clientSession = connect('127.0.0.1', endpoint.address.port, {
+  ca: [ca.toString()],
+  rejectUnauthorized: false,
+});
+
+clientSession.onmessage = mustCall((data) => {
+  assert.strictEqual(data.toString(), 'hello from server');
+  clientReceivedData.resolve();
+});
+
+clientSession.onhandshake = mustCall();
+
+// Wait for handshake.
+await clientSession.opened;
+
+// --- Client session stats after handshake ---
+
+const csStats = clientSession.stats;
+assert.ok(csStats, 'session.stats should be defined');
+assert.ok(csStats.isConnected, 'session stats should be connected');
+assert.ok(csStats.createdAt > 0n, 'createdAt should be set');
+assert.ok(csStats.handshakeCompletedAt > 0n, 'handshake timestamp should be set');
+assert.ok(csStats.handshakeCompletedAt >= csStats.createdAt,
+          'handshake should complete after creation');
+assert.strictEqual(csStats.closingAt, 0n);
+assert.strictEqual(csStats.destroyedAt, 0n);
+
+// Record bytes before sending application data.
+const csBytesSentBefore = csStats.bytesSent;
+const csMessagesSentBefore = csStats.messagesSent;
+
+// Send data.
+clientSession.send('hello from client');
+
+// Wait for bidirectional exchange.
+await Promise.all([serverReceivedData.promise, clientReceivedData.promise]);
+
+// --- Client session stats after data exchange ---
+
+assert.ok(csStats.bytesSent > csBytesSentBefore,
+          'bytesSent should increase after send');
+assert.ok(csStats.messagesSent > csMessagesSentBefore,
+          'messagesSent should increase after send');
+assert.ok(csStats.bytesReceived > 0n, 'bytesReceived should be non-zero');
+assert.ok(csStats.messagesReceived > 0n, 'messagesReceived should be non-zero');
+
+// --- Server session stats after data exchange ---
+
+assert.ok(serverSession, 'server session should exist');
+const ssStats = serverSession.stats;
+assert.ok(ssStats.bytesReceived > 0n, 'server bytesReceived should be non-zero');
+assert.ok(ssStats.messagesReceived > 0n, 'server messagesReceived should be non-zero');
+assert.ok(ssStats.bytesSent > 0n, 'server bytesSent should be non-zero');
+assert.ok(ssStats.messagesSent > 0n, 'server messagesSent should be non-zero');
+assert.ok(ssStats.handshakeCompletedAt > 0n, 'server handshake timestamp should be set');
+
+// --- Endpoint stats after data exchange ---
+
+assert.ok(epStats.bytesReceived > 0n, 'endpoint bytesReceived should be non-zero');
+assert.ok(epStats.bytesSent > 0n, 'endpoint bytesSent should be non-zero');
+assert.ok(epStats.packetsReceived > 0n, 'endpoint packetsReceived should be non-zero');
+assert.ok(epStats.packetsSent > 0n, 'endpoint packetsSent should be non-zero');
+assert.strictEqual(epStats.serverSessions, 1n);
+
+// The client's own endpoint should track the client session.
+const clientEpStats = clientSession.endpoint.stats;
+assert.strictEqual(clientEpStats.clientSessions, 1n);
+assert.ok(clientEpStats.bytesSent > 0n);
+assert.ok(clientEpStats.bytesReceived > 0n);
+
+// --- toJSON / toString ---
+
+const epJson = epStats.toJSON();
+assert.ok(epJson);
+assert.strictEqual(typeof epJson.bytesReceived, 'string');
+assert.strictEqual(typeof epJson.bytesSent, 'string');
+assert.strictEqual(typeof epJson.connected, 'boolean');
+
+const ssJson = csStats.toJSON();
+assert.ok(ssJson);
+assert.strictEqual(typeof ssJson.handshakeCompletedAt, 'string');
+assert.strictEqual(typeof ssJson.messagesReceived, 'string');
+
+const epStr = epStats.toString();
+assert.ok(typeof epStr === 'string');
+assert.ok(epStr.includes('bytesReceived'));
+
+// Clean up.
+await clientSession.close();
+
+// After close, session closing timestamp should be set.
+assert.notStrictEqual(csStats.closingAt, 0n);
+
+await endpoint.close();
diff --git a/test/parallel/test-dtls-unhandled-rejection.mjs b/test/parallel/test-dtls-unhandled-rejection.mjs
new file mode 100644
index 000000000000..e7cb4e069985
--- /dev/null
+++ b/test/parallel/test-dtls-unhandled-rejection.mjs
@@ -0,0 +1,48 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: using the callback style (onerror) without awaiting opened/closed must
+// not produce an unhandled promise rejection when the session errors.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+// Any unhandled rejection fails the test.
+process.on('unhandledRejection', mustNotCall());
+
+const { listen, connect } = await import('node:dtls');
+
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+const server = listen(mustCall(), {
+  cert, key, port: 0, host: '127.0.0.1',
+});
+
+const errored = Promise.withResolvers();
+
+// A verification failure makes connect() reject its opened promise. Handle the
+// error only through the callback API and never touch opened/closed.
+const session = connect('127.0.0.1', server.address.port, {
+  ca: [ca],
+  rejectUnauthorized: true,
+  servername: 'wrong.example.com',
+});
+session.onerror = mustCall(() => errored.resolve());
+
+await errored.promise;
+
+// The failed session tears itself down; awaiting its closed promise is a real
+// boundary that also gives any (incorrectly) unhandled opened rejection a turn
+// to surface before the process exits.
+await session.closed;
+
+await server.close();
diff --git a/test/parallel/test-dtls-verify-identity.mjs b/test/parallel/test-dtls-verify-identity.mjs
new file mode 100644
index 000000000000..4940f5693a85
--- /dev/null
+++ b/test/parallel/test-dtls-verify-identity.mjs
@@ -0,0 +1,80 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: the DTLS client verifies the server certificate's identity (hostname
+// or IP address) against the expected name, not merely that the certificate
+// chains to a trusted CA. Also exercises that SNI is actually carried in the
+// ClientHello (it is applied before the handshake begins).
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { listen, connect } = await import('node:dtls');
+
+// The agent1 certificate has CN=agent1 and no subjectAltName, so OpenSSL
+// matches the identity "agent1" (via the subject CN) and rejects other names.
+const cert = fixtures.readKey('agent1-cert.pem').toString();
+const key = fixtures.readKey('agent1-key.pem').toString();
+const ca = fixtures.readKey('ca1-cert.pem').toString();
+
+// ---------------------------------------------------------------------------
+// Case 1: a matching servername with rejectUnauthorized succeeds, and the
+// server observes the SNI the client sent (proving it is in the ClientHello).
+{
+  const sawServername = Promise.withResolvers();
+
+  const server = listen(mustCall((session) => {
+    session.onhandshake = mustCall(() => {
+      sawServername.resolve(session.servername);
+    });
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const { port } = server.address;
+
+  const session = connect('127.0.0.1', port, {
+    ca: [ca],
+    rejectUnauthorized: true,
+    servername: 'agent1',
+  });
+
+  const { protocol } = await session.opened;
+  assert.match(protocol, /DTLS/i);
+
+  assert.strictEqual(await sawServername.promise, 'agent1');
+
+  await session.close();
+  await server.close();
+}
+
+// ---------------------------------------------------------------------------
+// Case 2: a servername that does not match the certificate is rejected during
+// the handshake, even though the certificate chain is otherwise valid.
+{
+  const server = listen(mustCall((session) => {
+    // The client aborts after verifying the certificate, so the server-side
+    // handshake never completes.
+    session.onhandshake = mustNotCall();
+  }), { cert, key, port: 0, host: '127.0.0.1' });
+
+  const { port } = server.address;
+
+  const session = connect('127.0.0.1', port, {
+    ca: [ca],
+    rejectUnauthorized: true,
+    servername: 'wrong.example.com',
+  });
+
+  await assert.rejects(session.opened, /certificate verify failed/i);
+
+  // Closing the session tears down the internally-owned client endpoint.
+  await session.close();
+  await server.close();
+}
diff --git a/test/parallel/test-error-value-type-detection.mjs b/test/parallel/test-error-value-type-detection.mjs
index e44b19297a96..cb794514ed39 100644
--- a/test/parallel/test-error-value-type-detection.mjs
+++ b/test/parallel/test-error-value-type-detection.mjs
@@ -209,3 +209,58 @@ assert.strictEqual(
   determineSpecificType(new WeakSet()),
   'an instance of WeakSet',
 );
+
+// Anonymous classes have an empty `name`, so the value is inspected instead.
+// `inspect(..., { depth: -1 })` prints this one as `{}` because it has no own
+// properties; the values below carry a `constructor` property of their own and
+// print as `[Object]`.
+assert.strictEqual(
+  determineSpecificType(new (class {})()),
+  '{}',
+);
+
+// `constructor` is an ordinary, user-controlled property that need not be a
+// function. Describing such a value must not throw.
+assert.strictEqual(
+  determineSpecificType(JSON.parse('{"constructor": 5}')),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: '' } }),
+  '[Object]',
+);
+
+// A `constructor.name` that is not a usable string must not be interpolated
+// into the message.
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: Symbol('x') } }),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: 42 } }),
+  '[Object]',
+);
+
+// `constructor` and its `name` are each read once. Both may be accessors, so
+// repeated reads are observable, and a `name` validated by one read and
+// interpolated from another need not be the same value twice.
+let constructorReads = 0;
+let nameReads = 0;
+const named = {
+  get constructor() {
+    constructorReads++;
+    return { get name() { nameReads++; return 'Foo'; } };
+  },
+};
+assert.strictEqual(determineSpecificType(named), 'an instance of Foo');
+assert.strictEqual(constructorReads, 1);
+assert.strictEqual(nameReads, 1);
+
+// Building the error must not fail when `constructor` is a truthy primitive.
+assert.strictEqual(
+  new errorsModule.codes.ERR_INVALID_ARG_TYPE(
+    'arg', 'string', JSON.parse('{"constructor": 5}')).code,
+  'ERR_INVALID_ARG_TYPE',
+);
diff --git a/test/parallel/test-eslint-no-crypto-class-instanceof.js b/test/parallel/test-eslint-no-crypto-class-instanceof.js
new file mode 100644
index 000000000000..379b133b3818
--- /dev/null
+++ b/test/parallel/test-eslint-no-crypto-class-instanceof.js
@@ -0,0 +1,55 @@
+'use strict';
+
+const common = require('../common');
+common.skipIfEslintMissing();
+
+const RuleTester = require('../../tools/eslint/node_modules/eslint').RuleTester;
+const rule = require('../../tools/eslint-rules/no-crypto-class-instanceof');
+
+new RuleTester().run('no-crypto-class-instanceof', rule, {
+  valid: [
+    'value instanceof Buffer;',
+    'value instanceof KeyObject;',
+    `
+    const { isKeyObject } = require('internal/crypto/keys');
+    isKeyObject(key);
+    `,
+    `
+    function isCryptoKey(value, CryptoKey) {
+      return value instanceof CryptoKey;
+    }
+    `,
+    `
+    function isCryptoKey(value, globalThis) {
+      return value instanceof globalThis.CryptoKey;
+    }
+    `,
+  ],
+  invalid: [
+    {
+      code: `
+      const { KeyObject: KO } = require('internal/crypto/keys');
+      key instanceof KO;
+      `,
+      errors: [{ messageId: 'noKeyObjectInstanceof' }],
+    },
+    {
+      code: `
+      const webcrypto = require('internal/crypto/webcrypto');
+      key instanceof webcrypto.CryptoKey;
+      `,
+      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
+    },
+    {
+      code: 'key instanceof globalThis.CryptoKey;',
+      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
+    },
+    {
+      code: `
+      const { X509Certificate } = require('internal/crypto/x509');
+      cert instanceof X509Certificate;
+      `,
+      errors: [{ messageId: 'noX509CertificateInstanceof' }],
+    },
+  ],
+});
diff --git a/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js b/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js
deleted file mode 100644
index 29b70c9ec58a..000000000000
--- a/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js
+++ /dev/null
@@ -1,78 +0,0 @@
-'use strict';
-
-const common = require('../common');
-common.skipIfEslintMissing();
-
-const RuleTester = require('../../tools/eslint/node_modules/eslint').RuleTester;
-const rule = require('../../tools/eslint-rules/no-keyobject-cryptokey-instanceof');
-
-new RuleTester().run('no-keyobject-cryptokey-instanceof', rule, {
-  valid: [
-    'key instanceof Buffer;',
-    'key instanceof KeyObject;',
-    `
-    const { isKeyObject } = require('internal/crypto/keys');
-    isKeyObject(key);
-    `,
-    `
-    const { isCryptoKey } = require('internal/crypto/keys');
-    isCryptoKey(key);
-    `,
-  ],
-  invalid: [
-    {
-      code: `
-      const { KeyObject } = require('internal/crypto/keys');
-      key instanceof KeyObject;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      const { KeyObject: KO } = require('internal/crypto/keys');
-      key instanceof KO;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      const keys = require('internal/crypto/keys');
-      key instanceof keys.KeyObject;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      key instanceof CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const { CryptoKey } = require('internal/crypto/keys');
-      key instanceof CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const { CryptoKey: CK } = require('internal/crypto/webcrypto');
-      key instanceof CK;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const webcrypto = require('internal/crypto/webcrypto');
-      key instanceof webcrypto.CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      key instanceof globalThis.CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-  ],
-});
diff --git a/test/parallel/test-eventtarget.js b/test/parallel/test-eventtarget.js
index d0b3ad03a1df..ed6590176d31 100644
--- a/test/parallel/test-eventtarget.js
+++ b/test/parallel/test-eventtarget.js
@@ -419,6 +419,20 @@ let asyncTest = Promise.resolve();
   target.removeEventListener('foo', a, { capture: false });
   target.dispatchEvent(new Event('foo'));
 }
+
+{
+  const target = new EventTarget();
+  const a = common.mustCall(3);
+
+  target.addEventListener('foo', a, true);
+  target.addEventListener('foo', a, false);
+
+  target.dispatchEvent(new Event('foo'));
+  target.removeEventListener('foo', a, true);
+  target.dispatchEvent(new Event('foo'));
+  target.removeEventListener('foo', a, false);
+  target.dispatchEvent(new Event('foo'));
+}
 {
   const target = new EventTarget();
   assert.strictEqual(target.toString(), '[object EventTarget]');
@@ -685,7 +699,21 @@ let asyncTest = Promise.resolve();
     et.dispatchEvent(new Event('foo'));
   });
 }
-
+{
+  // Two listeners sharing the same retainer key must NOT evict each
+  // other from the weak retention map — both must survive a GC cycle
+  // and both must be removable independently.
+  // Regression test for https://github.com/nodejs/node/issues/63954
+  const et = new EventTarget();
+  const aCalled = common.mustNotCall();
+  const bCalled = common.mustCall();
+  et.addEventListener('a', aCalled, { [kWeakHandler]: et });
+  et.addEventListener('b', bCalled, { [kWeakHandler]: et });
+  globalThis.gc();
+  et.removeEventListener('a', aCalled);
+  et.dispatchEvent(new Event('a'));
+  et.dispatchEvent(new Event('b'));
+}
 {
   const et = new EventTarget();
 
diff --git a/test/parallel/test-external-memory-reasonable-size.js b/test/parallel/test-external-memory-reasonable-size.js
new file mode 100644
index 000000000000..f9ff1af8e5a1
--- /dev/null
+++ b/test/parallel/test-external-memory-reasonable-size.js
@@ -0,0 +1,34 @@
+'use strict';
+
+// V8 aborts the process when external memory grows by more than
+// --external-memory-max-reasonable-size gigabytes in a single step. Node
+// disables that check by default, but an explicit value on the command line
+// must still be honored.
+// Refs: https://github.com/nodejs/node/issues/65534
+
+const common = require('../common');
+const assert = require('assert');
+const { execSync } = require('child_process');
+const { totalmem } = require('os');
+
+// The smallest limit V8 accepts is 1 GB, so the child has to allocate more
+// than that before the check can fire.
+if (totalmem() < 4 * 1024 ** 3)
+  common.skip('not enough memory to exceed a 1 GB external memory limit');
+
+for (const flag of [
+  '--external-memory-max-reasonable-size=1',
+  '--external_memory_max_reasonable_size=1',
+]) {
+  // The child aborts with over a gigabyte resident, so keep it from writing a
+  // core file; on some hosts that dump alone outlasts the test timeout.
+  const [cmd, opts] = common.escapePOSIXShell`"${process.execPath}" ${flag} -e "new Float64Array(150_000_000)"`;
+  assert.throws(
+    () => execSync(common.isWindows ? cmd : `ulimit -c 0; ${cmd}`, { ...opts, stdio: 'pipe' }),
+    (err) => {
+      assert.notStrictEqual(err.status, 0, `${flag} was not honored, the child exited cleanly`);
+      assert.match(err.stderr.toString(), /kMaxReasonableBytes/);
+      return true;
+    },
+  );
+}
diff --git a/test/parallel/test-fastutf8stream-destroy.js b/test/parallel/test-fastutf8stream-destroy.js
index bdf401f330ef..04f7cad8088f 100644
--- a/test/parallel/test-fastutf8stream-destroy.js
+++ b/test/parallel/test-fastutf8stream-destroy.js
@@ -34,8 +34,11 @@ function getTempFile() {
 
   assert.throws(() => stream.write('hello world\n'), Error);
 
-  readFile(dest, 'utf8', common.mustSucceed((data) => {
-    assert.strictEqual(data, 'hello world\n');
+  // Reading now would race the fs.write() still in flight.
+  stream.once('write', common.mustCall(() => {
+    readFile(dest, 'utf8', common.mustSucceed((data) => {
+      assert.strictEqual(data, 'hello world\n');
+    }));
   }));
 
   stream.on('finish', common.mustNotCall());
diff --git a/test/parallel/test-fastutf8stream-reopen.js b/test/parallel/test-fastutf8stream-reopen.js
index d706a737c2cd..99c62ca267ac 100644
--- a/test/parallel/test-fastutf8stream-reopen.js
+++ b/test/parallel/test-fastutf8stream-reopen.js
@@ -8,6 +8,7 @@ const {
   openSync,
   readFile,
   renameSync,
+  write,
 } = require('node:fs');
 const { Utf8Stream } = require('node:fs');
 const { join } = require('node:path');
@@ -27,6 +28,47 @@ function getTempFile() {
 runTests(false);
 runTests(true);
 
+// A write started by a 'ready' listener after reopen() must complete before
+// 'drain' is emitted. Deferring the reopened file's write by one setImmediate
+// makes the write land after the nextTick on which reopen() used to emit a
+// premature 'drain'. Async mode only: sync mode writes before 'ready'.
+{
+  const dest = getTempFile();
+  const after = dest + '-new';
+  const stream = new Utf8Stream({
+    dest,
+    minLength: 0,
+    sync: false,
+    fs: {
+      write(fd, buf, enc, cb) {
+        if (stream.file === after) {
+          setImmediate(() => write(fd, buf, enc, cb));
+          return;
+        }
+        return write(fd, buf, enc, cb);
+      },
+    },
+  });
+
+  assert.ok(stream.write('hello world\n'));
+
+  stream.once('drain', common.mustCall(() => {
+    stream.reopen(after);
+
+    stream.once('ready', common.mustCall(() => {
+      assert.ok(stream.write('after reopen\n'));
+
+      stream.once('drain', common.mustCall(() => {
+        assert.strictEqual(stream.writing, false);
+        readFile(after, 'utf8', common.mustSucceed((data) => {
+          assert.strictEqual(data, 'after reopen\n');
+          stream.end();
+        }));
+      }));
+    }));
+  }));
+}
+
 function runTests(sync) {
 
   {
@@ -43,9 +85,9 @@ function runTests(sync) {
       stream.reopen();
 
       stream.once('ready', common.mustCall(() => {
-        assert.ok(stream.write('after reopen\n'));
-
-        stream.once('drain', common.mustCall(() => {
+        // 'drain' can come from reopen() before this write completes. 'write'
+        // is emitted synchronously in sync mode, so attach before writing.
+        stream.once('write', common.mustCall(() => {
           readFile(after, 'utf8', common.mustSucceed((data) => {
             assert.strictEqual(data, 'hello world\nsomething else\n');
             readFile(dest, 'utf8', common.mustSucceed((data) => {
@@ -54,6 +96,8 @@ function runTests(sync) {
             }));
           }));
         }));
+
+        assert.ok(stream.write('after reopen\n'));
       }));
     }));
   }
@@ -85,9 +129,8 @@ function runTests(sync) {
       assert.strictEqual(stream.file, after);
 
       stream.once('ready', common.mustCall(() => {
-        assert.ok(stream.write('after reopen\n'));
-
-        stream.once('drain', common.mustCall(() => {
+        // As above: 'drain' can come from reopen() before the write completes.
+        stream.once('write', common.mustCall(() => {
           readFile(dest, 'utf8', common.mustSucceed((data) => {
             assert.strictEqual(data, 'hello world\nsomething else\n');
             readFile(after, 'utf8', common.mustSucceed((data) => {
@@ -96,6 +139,8 @@ function runTests(sync) {
             }));
           }));
         }));
+
+        assert.ok(stream.write('after reopen\n'));
       }));
     }));
   }
diff --git a/test/parallel/test-fs-cp-async-destination-appears-late.mjs b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
new file mode 100644
index 000000000000..40ec15e1ef39
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() into a destination that did not exist when it was
+// checked, but does by the time the copy starts, fails with EEXIST instead
+// of copying through whatever appeared there.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { createHook } from 'node:async_hooks';
+import { existsSync, lstatSync, mkdirSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+const src = nextdir();
+const dest = nextdir();
+const target = nextdir();
+mkdirSync(src);
+mkdirSync(target);
+writeFileSync(join(src, 'file'), 'x');
+
+let injected = false;
+const hook = createHook({
+  init(id, type) {
+    if (!injected && type === 'FSREQCALLBACK' && !existsSync(dest)) {
+      injected = true;
+      symlinkSync(target, dest, 'dir');
+    }
+  },
+}).enable();
+const outcome = await promises.cp(src, dest, { recursive: true }).then(() => null, (err) => err);
+hook.disable();
+assert.ok(injected, 'the hook found no request to inject the symbolic link at');
+assert.strictEqual(outcome?.code, 'EEXIST');
+assert.strictEqual(outcome?.syscall, 'mkdir');
+assert.ok(lstatSync(dest).isSymbolicLink());
+assert.ok(!existsSync(join(target, 'file')));
diff --git a/test/parallel/test-fs-cp-async-file-modes.mjs b/test/parallel/test-fs-cp-async-file-modes.mjs
new file mode 100644
index 000000000000..358f6c339b7b
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-file-modes.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() gives copied files the mode of their source, including
+// the setuid, setgid and sticky bits, as cpSync() does.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('file modes are not meaningful on Windows');
+
+tmpdir.refresh();
+const modes = { suid: 0o4755, sgid: 0o2755, sticky: 0o1755, private: 0o600 };
+const src = nextdir();
+mkdirSync(src);
+for (const [name, mode] of Object.entries(modes)) {
+  writeFileSync(join(src, name), 'x');
+  chmodSync(join(src, name), mode);
+}
+const modesIn = (dir) => Object.fromEntries(
+  Object.keys(modes).map((name) => [name, statSync(join(dir, name)).mode & 0o7777]));
+const expected = modesIn(src);
+
+const viaCp = nextdir();
+await promises.cp(src, viaCp, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCp), expected);
+
+const viaCpTimestamps = nextdir();
+await promises.cp(src, viaCpTimestamps, { recursive: true, preserveTimestamps: true });
+assert.deepStrictEqual(modesIn(viaCpTimestamps), expected);
+
+const viaCpSync = nextdir();
+cpSync(src, viaCpSync, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCpSync), expected);
diff --git a/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs b/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs
new file mode 100644
index 000000000000..ae93a7427e8a
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs
@@ -0,0 +1,43 @@
+// This tests that cp() preserves directory timestamps
+// when preserveTimestamps is true.
+import { mustCall } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cp, mkdirSync, writeFileSync, utimesSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+// Build a source tree with a known past timestamp on directories.
+const src = nextdir();
+mkdirSync(join(src, 'subdir'), { recursive: true });
+writeFileSync(join(src, 'subdir', 'file.txt'), 'hello');
+
+const pastDate = new Date('2020-01-01T00:00:00Z');
+utimesSync(join(src, 'subdir', 'file.txt'), pastDate, pastDate);
+utimesSync(join(src, 'subdir'), pastDate, pastDate);
+utimesSync(src, pastDate, pastDate);
+
+// Copy with preserveTimestamps.
+const dest = nextdir();
+cp(src, dest, {
+  recursive: true,
+  preserveTimestamps: true,
+}, mustCall((err) => {
+  assert.strictEqual(err, null);
+
+  // Verify file timestamps are preserved (existing behaviour).
+  const srcFileStat = statSync(join(src, 'subdir', 'file.txt'));
+  const destFileStat = statSync(join(dest, 'subdir', 'file.txt'));
+  assert.strictEqual(srcFileStat.mtime.getTime(), destFileStat.mtime.getTime());
+
+  // Verify directory timestamps are preserved (the bug fix).
+  const srcDirStat = statSync(join(src, 'subdir'));
+  const destDirStat = statSync(join(dest, 'subdir'));
+  assert.strictEqual(srcDirStat.mtime.getTime(), destDirStat.mtime.getTime());
+
+  const srcRootStat = statSync(src);
+  const destRootStat = statSync(dest);
+  assert.strictEqual(srcRootStat.mtime.getTime(), destRootStat.mtime.getTime());
+}));
diff --git a/test/parallel/test-fs-cp-async-special-files-in-tree.mjs b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
new file mode 100644
index 000000000000..9a028f297caa
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
@@ -0,0 +1,53 @@
+// This tests that cp() rejects a socket or a FIFO found inside the copied
+// tree with the same errors as for a top-level one, while cpSync() skips them.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, writeFileSync, promises } from 'node:fs';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { nextdir } from '../common/fs.js';
+import tmpdir from '../common/tmpdir.js';
+
+if (common.isWindows)
+  common.skip('No socket/FIFO support on Windows');
+if (common.isInsideDirWithUnusualChars)
+  common.skip('Test is broken in directories with unusual characters');
+
+tmpdir.refresh();
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'd'), { recursive: true });
+  writeFileSync(join(src, 'd', 'file'), 'x');
+  const server = createServer();
+  // The socket path can exceed the platform limit in a deep tmpdir; skip then.
+  const listening = await new Promise((resolve) => {
+    server.on('error', () => resolve(false));
+    server.listen(join(src, 'd', 's.sock'), () => resolve(true));
+  });
+  if (!listening) {
+    common.printSkipMessage('socket path too long');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_SOCKET' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'd', 'file')));
+    server.close();
+  }
+}
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'dir'), { recursive: true });
+  writeFileSync(join(src, 'dir', 'file'), 'x');
+  if (spawnSync('mkfifo', [join(src, 'dir', 'fifo')]).status !== 0) {
+    common.printSkipMessage('mkfifo not available');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_FIFO_PIPE' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'dir', 'file')));
+  }
+}
diff --git a/test/parallel/test-fs-cp-async-symlink-targets.mjs b/test/parallel/test-fs-cp-async-symlink-targets.mjs
new file mode 100644
index 000000000000..81e861c90859
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-symlink-targets.mjs
@@ -0,0 +1,29 @@
+// This tests that cp() into a new destination writes the same link targets
+// as path.resolve() of the original ones: relative targets made absolute
+// lexically (intermediate links kept), absolute targets left as they are.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { mkdirSync, readlinkSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join, resolve } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('symbolic links need elevated privileges on Windows');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'real'), { recursive: true });
+writeFileSync(join(src, 'real', 'file'), 'data');
+symlinkSync('real', join(src, 'alias'));
+symlinkSync('alias/file', join(src, 'link'));
+const absoluteTarget = join(tmpdir.path, 'x', '..', 'elsewhere');
+symlinkSync(absoluteTarget, join(src, 'abs'));
+
+for (const filter of [undefined, () => true]) {
+  const dest = nextdir();
+  await promises.cp(src, dest, { recursive: true, filter });
+  assert.strictEqual(readlinkSync(join(dest, 'link')), resolve(src, 'alias/file'));
+  assert.strictEqual(readlinkSync(join(dest, 'alias')), resolve(src, 'real'));
+  assert.strictEqual(readlinkSync(join(dest, 'abs')), absoluteTarget);
+}
diff --git a/test/parallel/test-fs-cp-async-with-mode-flags.mjs b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
index 99f6b5fe09d9..6e10d5859ef1 100644
--- a/test/parallel/test-fs-cp-async-with-mode-flags.mjs
+++ b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
@@ -29,3 +29,14 @@ cp(src, dest, mustNotMutateObjectDeep({
   assert(err.code === 'ENOTSUP' || err.code === 'ENOTTY' ||
     err.code === 'ENOSYS' || err.code === 'EXDEV');
 }));
+
+// The mode flags reach copyFile() whether or not a filter is given.
+{
+  const { promises } = await import('node:fs');
+  const outcome = (filter) => promises.cp(src, nextdir(), {
+    recursive: true,
+    mode: constants.COPYFILE_FICLONE_FORCE,
+    filter,
+  }).then(() => 'copied', (err) => `${err.code} ${err.syscall}`);
+  assert.strictEqual(await outcome(undefined), await outcome(() => true));
+}
diff --git a/test/parallel/test-fs-cp-sync-directory-mode.mjs b/test/parallel/test-fs-cp-sync-directory-mode.mjs
new file mode 100644
index 000000000000..f022af268f1e
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-directory-mode.mjs
@@ -0,0 +1,64 @@
+// This tests that cpSync gives the directories it creates the mode of the
+// corresponding source directory, as cp does.
+import { mustNotMutateObjectDeep, isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import { isMainThread } from 'node:worker_threads';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('directory modes are not meaningful on Windows');
+if (!isMainThread)
+  skip('process.umask() is not available in workers');
+
+tmpdir.refresh();
+const mask = process.umask(0o022);
+
+const src = nextdir();
+mkdirSync(join(src, 'private', 'inner'), { recursive: true, mode: 0o700 });
+mkdirSync(join(src, 'shared'), { mode: 0o775 });
+writeFileSync(join(src, 'private', 'inner', 'file'), 'x', { mode: 0o600 });
+
+function modes(root) {
+  return ['.', 'private', 'private/inner', 'shared', 'private/inner/file']
+    .map((p) => (statSync(join(root, p)).mode & 0o777).toString(8));
+}
+
+const destSync = nextdir();
+cpSync(src, destSync, mustNotMutateObjectDeep({ recursive: true }));
+assert.deepStrictEqual(modes(destSync), modes(src));
+
+const destAsync = nextdir();
+await promises.cp(src, destAsync, { recursive: true });
+assert.deepStrictEqual(modes(destAsync), modes(src));
+
+// A read-only source directory can still be copied; its copy ends up read-only too.
+{
+  const roSrc = nextdir();
+  mkdirSync(join(roSrc, 'sub'), { recursive: true });
+  writeFileSync(join(roSrc, 'sub', 'file'), 'x');
+  chmodSync(join(roSrc, 'sub'), 0o555);
+  chmodSync(roSrc, 0o555);
+  const readOnly = [roSrc, join(roSrc, 'sub')];
+  for (const copy of [(dest) => cpSync(roSrc, dest, { recursive: true }),
+                      (dest) => promises.cp(roSrc, dest, { recursive: true })]) {
+    const dest = nextdir();
+    await copy(dest);
+    assert.strictEqual(statSync(join(dest, 'sub', 'file')).size, 1);
+    assert.deepStrictEqual(
+      [dest, join(dest, 'sub')].map((p) => (statSync(p).mode & 0o777).toString(8)), ['555', '555']);
+    readOnly.push(dest, join(dest, 'sub'));
+  }
+  // Let tmpdir clean up.
+  for (const dir of readOnly) chmodSync(dir, 0o755);
+}
+
+// An existing destination directory keeps its own mode.
+const existing = nextdir();
+mkdirSync(existing, { mode: 0o711 });
+cpSync(src, existing, mustNotMutateObjectDeep({ recursive: true }));
+assert.strictEqual((statSync(existing).mode & 0o777).toString(8), '711');
+assert.deepStrictEqual(modes(existing).slice(1), modes(src).slice(1));
+process.umask(mask);
diff --git a/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs b/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs
new file mode 100644
index 000000000000..20d889075988
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs
@@ -0,0 +1,42 @@
+// This tests that cpSync with a filter preserves directory timestamps
+// when preserveTimestamps is true.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cpSync, mkdirSync, writeFileSync, utimesSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+// Build a source tree with a known past timestamp on directories.
+const src = nextdir();
+mkdirSync(join(src, 'subdir'), { recursive: true });
+writeFileSync(join(src, 'subdir', 'file.txt'), 'hello');
+
+const pastDate = new Date('2020-01-01T00:00:00Z');
+utimesSync(join(src, 'subdir', 'file.txt'), pastDate, pastDate);
+utimesSync(join(src, 'subdir'), pastDate, pastDate);
+utimesSync(src, pastDate, pastDate);
+
+// Copy with preserveTimestamps and a filter (to exercise the JS fallback path).
+const dest = nextdir();
+cpSync(src, dest, {
+  recursive: true,
+  preserveTimestamps: true,
+  filter: () => true,
+});
+
+// Verify file timestamps are preserved (existing behaviour).
+const srcFileStat = statSync(join(src, 'subdir', 'file.txt'));
+const destFileStat = statSync(join(dest, 'subdir', 'file.txt'));
+assert.strictEqual(srcFileStat.mtime.getTime(), destFileStat.mtime.getTime());
+
+// Verify directory timestamps are preserved (the bug fix).
+const srcDirStat = statSync(join(src, 'subdir'));
+const destDirStat = statSync(join(dest, 'subdir'));
+assert.strictEqual(srcDirStat.mtime.getTime(), destDirStat.mtime.getTime());
+
+const srcRootStat = statSync(src);
+const destRootStat = statSync(dest);
+assert.strictEqual(srcRootStat.mtime.getTime(), destRootStat.mtime.getTime());
diff --git a/test/parallel/test-fs-cp-unreadable-directory.mjs b/test/parallel/test-fs-cp-unreadable-directory.mjs
new file mode 100644
index 000000000000..c6343e6b277e
--- /dev/null
+++ b/test/parallel/test-fs-cp-unreadable-directory.mjs
@@ -0,0 +1,33 @@
+// This tests that cp() and cpSync() report an unreadable directory inside the
+// source tree as an error instead of terminating the process.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, readdirSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('no way to make a directory unreadable');
+if (process.getuid() === 0)
+  skip('root can read the directory anyway');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'locked'), { recursive: true });
+writeFileSync(join(src, 'file'), 'x');
+chmodSync(join(src, 'locked'), 0o000);
+try {
+  readdirSync(join(src, 'locked'));
+  chmodSync(join(src, 'locked'), 0o700);
+  skip('the directory is still readable');
+} catch {
+  // Expected: it is unreadable.
+}
+
+try {
+  assert.throws(() => cpSync(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+  await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+} finally {
+  chmodSync(join(src, 'locked'), 0o700);
+}
diff --git a/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs b/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs
new file mode 100644
index 000000000000..b1b3cda8d016
--- /dev/null
+++ b/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs
@@ -0,0 +1,81 @@
+import * as common from '../common/index.mjs';
+import tmpdir from '../common/tmpdir.js';
+import assert from 'node:assert';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { glob as globPromise, mkdir, symlink, writeFile } from 'node:fs/promises';
+import { globSync, glob as asyncGlob } from 'node:fs';
+
+if (common.isWindows) {
+  // Directory symlinks require elevated privileges on Windows.
+  common.skip('symlinks are unreliable on Windows');
+}
+
+tmpdir.refresh();
+
+// Layout:
+//   root/visible.txt
+//   root/link  ->  outside   (outside/ holds files that must NOT be listed)
+const base = tmpdir.resolve('globstar-symlink');
+const root = path.resolve(base, 'workspace');
+const outside = path.resolve(base, 'outside');
+const outsideNested = path.resolve(outside, 'nested');
+
+await mkdir(root, { recursive: true });
+await mkdir(outsideNested, { recursive: true });
+await writeFile(path.resolve(root, 'visible.txt'), 'visible');
+await writeFile(path.resolve(outside, 'secret-one.txt'), 'secret one');
+await writeFile(path.resolve(outsideNested, 'secret-two.txt'), 'secret two');
+await symlink(outside, path.resolve(root, 'link'), 'dir');
+
+const expected = ['link', 'visible.txt'].map((e) => e.replaceAll('/', path.sep)).sort();
+
+// `**/*` must not descend into the symlinked directory, neither by default nor
+// with followSymlinks explicitly disabled.
+assert.deepStrictEqual(globSync('**/*', { cwd: root }).sort(), expected);
+assert.deepStrictEqual(
+  globSync('**/*', { cwd: root, followSymlinks: false }).sort(),
+  expected,
+);
+
+const promiseMatches = [];
+for await (const entry of globPromise('**/*', { cwd: root, followSymlinks: false })) {
+  promiseMatches.push(entry);
+}
+assert.deepStrictEqual(promiseMatches.sort(), expected);
+
+const callbackMatches = await new Promise((resolve, reject) => {
+  asyncGlob('**/*', { cwd: root, followSymlinks: false }, (err, matches) => {
+    if (err) reject(err);
+    else resolve(matches);
+  });
+});
+assert.deepStrictEqual(callbackMatches.sort(), expected);
+
+// Under the permission model, `**/*` must not expose entries from a symlink
+// target that is outside the granted read set.
+if (common.hasCrypto) {
+  const child = `
+    const assert = require('node:assert');
+    const fs = require('node:fs');
+    const path = require('node:path');
+    const root = ${JSON.stringify(root)};
+    const outside = ${JSON.stringify(outside)};
+    const expected = ['link', 'visible.txt'].map((e) => e.replaceAll('/', path.sep)).sort();
+    assert.strictEqual(process.permission.has('fs.read', root), true);
+    assert.strictEqual(process.permission.has('fs.read', outside), false);
+    assert.throws(() => fs.readdirSync(outside), { code: 'ERR_ACCESS_DENIED' });
+    assert.deepStrictEqual(fs.globSync('**/*', { cwd: root }).sort(), expected);
+    assert.deepStrictEqual(
+      fs.globSync('**/*', { cwd: root, followSymlinks: false }).sort(),
+      expected,
+    );
+  `;
+  const { status, stdout, stderr } = spawnSync(process.execPath, [
+    '--permission',
+    `--allow-fs-read=${root}`,
+    '-e',
+    child,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(status, 0, stderr || stdout);
+}
diff --git a/test/parallel/test-fs-glob.mjs b/test/parallel/test-fs-glob.mjs
index 9226e491358d..ed7317508087 100644
--- a/test/parallel/test-fs-glob.mjs
+++ b/test/parallel/test-fs-glob.mjs
@@ -1,9 +1,19 @@
 import * as common from '../common/index.mjs';
 import tmpdir from '../common/tmpdir.js';
-import { spawnSync } from 'node:child_process';
+import { spawnSyncAndExitWithoutError } from '../common/child_process.js';
 import { resolve, dirname, sep, relative, join, isAbsolute } from 'node:path';
 import { mkdir, writeFile, symlink, glob as asyncGlob } from 'node:fs/promises';
-import { glob, globSync, Dirent, chmodSync, writeFileSync, rmSync } from 'node:fs';
+import {
+  glob,
+  globSync,
+  Dirent,
+  chmodSync,
+  writeFileSync,
+  rmSync,
+  realpathSync,
+  mkdirSync,
+  existsSync,
+} from 'node:fs';
 import { test, describe } from 'node:test';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
@@ -16,10 +26,12 @@ function assertDirents(dirents) {
 tmpdir.refresh();
 
 const fixtureDir = tmpdir.resolve('fixtures');
+const caseVariantFixtureDir = tmpdir.resolve('FIXTURES');
 const absDir = tmpdir.resolve('abs');
 
 async function setup() {
   await mkdir(fixtureDir, { recursive: true });
+  await mkdir(caseVariantFixtureDir, { recursive: true });
   await mkdir(absDir, { recursive: true });
   const files = [
     'a/.abcdef/x/y/z/a',
@@ -68,6 +80,21 @@ async function setup() {
 
 await setup();
 
+const isCaseSensitiveFileSystem =
+  realpathSync.native(fixtureDir) !== realpathSync.native(caseVariantFixtureDir);
+
+let differentWindowsVolume;
+if (common.isWindows) {
+  const currentRoot = resolve(fixtureDir).slice(0, 3).toLowerCase();
+  for (let code = 65; code <= 90; code++) {
+    const root = `${String.fromCharCode(code)}:\\`;
+    if (root.toLowerCase() !== currentRoot && existsSync(root)) {
+      differentWindowsVolume = root;
+      break;
+    }
+  }
+}
+
 const patterns = {
   'a/c/d/*/b': ['a/c/d/c/b'],
   'a//c//d//*//b': ['a/c/d/c/b'],
@@ -119,7 +146,7 @@ const patterns = {
     'a/x',
     'a/z',
   ],
-  './**/a': common.isWindows ? ['a'] : ['a', 'a/symlink/a', 'a/symlink/a/b/c/a'],
+  './**/a': common.isWindows ? ['a'] : ['a', 'a/symlink/a'],
   './**/a/**/': [
     'a',
     'a/abcdef',
@@ -139,10 +166,6 @@ const patterns = {
       'a/symlink',
       'a/symlink/a',
       'a/symlink/a/b',
-      'a/symlink/a/b/c',
-      'a/symlink/a/b/c/a',
-      'a/symlink/a/b/c/a/b',
-      'a/symlink/a/b/c/a/b/c',
     ]),
     'a/x',
     'a/z',
@@ -173,9 +196,6 @@ const patterns = {
       'a/symlink/a',
       'a/symlink/a/b',
       'a/symlink/a/b/c',
-      'a/symlink/a/b/c/a',
-      'a/symlink/a/b/c/a/b',
-      'a/symlink/a/b/c/a/b/c',
     ]),
     'a/x',
     'a/z',
@@ -183,13 +203,6 @@ const patterns = {
   './**/a/**/a/**/': common.isWindows ? [] : [
     'a/symlink/a',
     'a/symlink/a/b',
-    'a/symlink/a/b/c',
-    'a/symlink/a/b/c/a',
-    'a/symlink/a/b/c/a/b',
-    'a/symlink/a/b/c/a/b/c',
-    'a/symlink/a/b/c/a/b/c/a',
-    'a/symlink/a/b/c/a/b/c/a/b',
-    'a/symlink/a/b/c/a/b/c/a/b/c',
   ],
   '+(a|b|c)/a{/,bc*}/**': [
     'a/abcdef',
@@ -268,7 +281,6 @@ const patterns = {
   'a/symlink/a/**/*': common.isWindows ? [] : [
     'a/symlink/a/b',
     'a/symlink/a/b/c',
-    'a/symlink/a/b/c/a',
   ],
   'a/!(symlink)/**/..': [
     'a',
@@ -539,6 +551,233 @@ describe('fsPromises glob - exclude', function() {
   }
 });
 
+const maxDepthExpected = [
+  '.',
+  'a',
+  'a/abcdef',
+  'a/abcfed',
+  'a/b',
+  'a/bc',
+  'a/c',
+  'a/cb',
+  ...(common.isWindows ? [] : ['a/symlink']),
+  'a/x',
+  'a/z',
+  'follow',
+  'follow/cycle',
+  'follow/link',
+  'follow/target',
+].map((item) => item.replaceAll('/', sep)).sort();
+
+async function collectAsyncGlob(pattern, options) {
+  const results = [];
+  for await (const item of asyncGlob(pattern, options)) {
+    results.push(item);
+  }
+  return results;
+}
+
+const maxDepthApis = [
+  ['globSync', globSync],
+  ['fsPromises glob', collectAsyncGlob],
+];
+
+for (const [name, runGlob] of maxDepthApis) {
+  describe(`${name} - maxDepth`, function() {
+    test('limits traversal depth', async () => {
+      const actual = (await runGlob('**', { cwd: fixtureDir, maxDepth: 2 })).sort();
+      assert.deepStrictEqual(actual, maxDepthExpected);
+      assert.deepStrictEqual(
+        await runGlob('../**', { cwd: fixtureDir, maxDepth: 0 }),
+        [],
+      );
+    });
+
+    test('limits literal patterns', async () => {
+      assert.deepStrictEqual(
+        await runGlob('a/b/c/d', { cwd: fixtureDir, maxDepth: 3 }),
+        [],
+      );
+      assert.deepStrictEqual(
+        await runGlob(fixtureDir, { cwd: fixtureDir, maxDepth: 0 }),
+        [fixtureDir],
+      );
+
+      const absolutePattern = resolve(fixtureDir, 'a/b/c/d');
+      assert.deepStrictEqual(
+        await runGlob(absolutePattern, { cwd: fixtureDir, maxDepth: 3 }),
+        [],
+      );
+      assert.deepStrictEqual(
+        await runGlob(absolutePattern, { cwd: fixtureDir, maxDepth: 4 }),
+        [absolutePattern],
+      );
+    });
+
+    test('limits absolute wildcard patterns rooted above cwd', async () => {
+      assert.deepStrictEqual(
+        await runGlob(join(dirname(fixtureDir), '*'), {
+          cwd: fixtureDir,
+          maxDepth: 0,
+        }),
+        [fixtureDir],
+      );
+    });
+
+    test('supports case-variant descendants', {
+      skip: isCaseSensitiveFileSystem,
+    }, async () => {
+      const expected = [
+        join(caseVariantFixtureDir, 'a'),
+        join(caseVariantFixtureDir, 'follow'),
+      ].sort();
+      const actual = await runGlob(
+        join(caseVariantFixtureDir, '*'),
+        { cwd: fixtureDir, maxDepth: 1 },
+      );
+      assert.deepStrictEqual(actual.sort(), expected);
+    });
+
+    test('supports absolute alternatives after brace expansion', async () => {
+      const pattern = `{${join(dirname(fixtureDir), '*')},other}`;
+      assert.deepStrictEqual(
+        await runGlob(pattern, { cwd: fixtureDir, maxDepth: 0 }),
+        [fixtureDir],
+      );
+    });
+
+    test('preserves filesystem case sensitivity', {
+      skip: !isCaseSensitiveFileSystem,
+    }, async () => {
+      assert.deepStrictEqual(
+        await runGlob(join(dirname(fixtureDir), '*'), {
+          cwd: fixtureDir,
+          maxDepth: 0,
+        }),
+        [fixtureDir],
+      );
+    });
+
+    test('recognizes equivalent path casing', {
+      skip: isCaseSensitiveFileSystem,
+    }, async () => {
+      assert.deepStrictEqual(
+        await runGlob(caseVariantFixtureDir, {
+          cwd: fixtureDir,
+          maxDepth: 0,
+        }),
+        [caseVariantFixtureDir],
+      );
+    });
+
+    test('rejects paths on a different Windows volume', {
+      skip: differentWindowsVolume === undefined,
+    }, async () => {
+      assert.deepStrictEqual(
+        await runGlob(differentWindowsVolume, {
+          cwd: fixtureDir,
+          maxDepth: 100,
+        }),
+        [],
+      );
+    });
+  });
+}
+
+test('glob forwards maxDepth', async () => {
+  assert.deepStrictEqual(
+    await promisify(glob)('**', { cwd: fixtureDir, maxDepth: 0 }),
+    ['.'],
+  );
+});
+
+function runNodeScript(script) {
+  const { child } = spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--expose-internals', '-e', script],
+    { encoding: 'utf8' },
+  );
+  return child.stdout;
+}
+
+test('async glob does not use synchronous path identity calls', () => {
+  const script = `
+      const fs = require('fs');
+      const path = require('path');
+      const { promisify } = require('util');
+      const fail = () => {
+        throw new Error('unexpected synchronous filesystem call');
+      };
+      fs.lstatSync = fail;
+      fs.realpathSync.native = fail;
+      (async () => {
+        const pattern = path.join(${JSON.stringify(caseVariantFixtureDir)}, '*');
+        const options = {
+          cwd: ${JSON.stringify(fixtureDir)},
+          maxDepth: 1,
+        };
+        await promisify(fs.glob)(pattern, options);
+        for await (const entry of fs.promises.glob(pattern, options)) {
+          void entry;
+        }
+      })().catch((error) => {
+        console.error(error);
+        process.exitCode = 1;
+      });
+    `;
+  runNodeScript(script);
+});
+
+function assertDoesNotTraverse(sibling, cwd) {
+  const script = `
+      const fs = require('fs');
+      const path = require('path');
+      const sibling = ${JSON.stringify(sibling)};
+      const original = fs.readdirSync;
+      let reads = 0;
+      fs.readdirSync = function(pathname, ...args) {
+        const resolved = path.resolve(pathname);
+        if (resolved === sibling || resolved.startsWith(sibling + path.sep)) {
+          reads++;
+        }
+        return Reflect.apply(original, this, [pathname, ...args]);
+      };
+      fs.globSync(path.join(sibling, '**'), {
+        cwd: ${JSON.stringify(cwd)},
+        maxDepth: 0,
+      });
+      process.stdout.write(String(reads));
+    `;
+  assert.strictEqual(runNodeScript(script), '0');
+}
+
+describe('globSync - maxDepth traversal', function() {
+  test('does not traverse absolute sibling subtrees', () => {
+    const siblingDir = tmpdir.resolve('sibling');
+    mkdirSync(join(siblingDir, 'nested'), { recursive: true });
+    assertDoesNotTraverse(siblingDir, fixtureDir);
+  });
+
+  test('does not traverse case-variant sibling subtrees', {
+    skip: !isCaseSensitiveFileSystem,
+  }, () => {
+    assertDoesNotTraverse(caseVariantFixtureDir, join(fixtureDir, 'a'));
+  });
+});
+
+test('globSync validates maxDepth', () => {
+  assert.deepStrictEqual(
+    globSync('a', { cwd: fixtureDir, maxDepth: Infinity }),
+    ['a'],
+  );
+
+  for (const maxDepth of [-1, 1.5, NaN, '1']) {
+    assert.throws(() => globSync('**', { cwd: fixtureDir, maxDepth }), {
+      code: typeof maxDepth === 'string' ? 'ERR_INVALID_ARG_TYPE' : 'ERR_OUT_OF_RANGE',
+    });
+  }
+});
+
 const followSymlinkPattern = 'follow/**';
 const followSymlinkExpected = [
   'follow',
@@ -737,11 +976,38 @@ describe('glob - seen cache', function() {
     `;
 
     const seenDir = tmpdir.resolve('glob-seen');
-    const child = spawnSync(
+    spawnSyncAndExitWithoutError(
       process.execPath,
       ['--expose-internals', '-e', script, seenDir],
       { encoding: 'utf8' },
     );
-    assert.strictEqual(child.status, 0, child.stderr || child.stdout);
+  });
+});
+
+// gh-58991: exclude patterns must apply the same case-sensitivity as include
+// patterns. On case-insensitive filesystems include patterns match entries
+// regardless of case, so literal exclude patterns must match that behavior.
+const skipCaseTests = { skip: !common.isWindows && !common.isMacOS };
+describe('glob - exclude case-insensitive consistency', skipCaseTests, function() {
+  test('literal exclude ignores case (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude matches differently-cased results (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('A/b', { cwd: fixtureDir, exclude: ['a/b'] }), []);
+  });
+  test('literal exclude ignores case (async)', async () => {
+    const promisified = promisify(glob);
+    assert.deepStrictEqual(
+      await promisified('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude ignores case (promise)', async () => {
+    const actual = [];
+    for await (const entry of asyncGlob(
+      'a/b', { cwd: fixtureDir, exclude: ['A/B'] })) {
+      actual.push(entry);
+    }
+    assert.deepStrictEqual(actual, []);
   });
 });
diff --git a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
index 36ebc23491ca..b299a7d5d572 100644
--- a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
@@ -67,7 +67,9 @@ async function checkAggregateError(op) {
   tmpdir.refresh();
   await checkAggregateError((filePath) => truncate(filePath));
   await checkAggregateError((filePath) => readFile(filePath));
-  await checkAggregateError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkAggregateError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkAggregateError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-close-errors.js b/test/parallel/test-fs-promises-file-handle-close-errors.js
index 901e71c15ac5..c368f3acb931 100644
--- a/test/parallel/test-fs-promises-file-handle-close-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-close-errors.js
@@ -62,7 +62,9 @@ async function checkCloseError(op) {
   tmpdir.refresh();
   await checkCloseError((filePath) => truncate(filePath));
   await checkCloseError((filePath) => readFile(filePath));
-  await checkCloseError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkCloseError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkCloseError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-op-errors.js b/test/parallel/test-fs-promises-file-handle-op-errors.js
index 46b4acd0b8ff..d36056227841 100644
--- a/test/parallel/test-fs-promises-file-handle-op-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-op-errors.js
@@ -56,7 +56,9 @@ async function checkOperationError(op) {
   tmpdir.refresh();
   await checkOperationError((filePath) => truncate(filePath));
   await checkOperationError((filePath) => readFile(filePath));
-  await checkOperationError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkOperationError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkOperationError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-writer.js b/test/parallel/test-fs-promises-file-handle-writer.js
index ff90716400ef..d43bababad1e 100644
--- a/test/parallel/test-fs-promises-file-handle-writer.js
+++ b/test/parallel/test-fs-promises-file-handle-writer.js
@@ -1060,6 +1060,27 @@ async function testWriterArgumentValidation() {
   }
 }
 
+async function testWriterWebIDLConversion() {
+  const filePath = path.join(tmpDir, 'writer-webidl.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(await w.end(null), 12);
+  await fh.close();
+
+  assert.strictEqual(fs.readFileSync(filePath, 'utf8'), '42trueobject');
+}
+
 // =============================================================================
 // Run all tests
 // =============================================================================
@@ -1114,4 +1135,5 @@ Promise.all([
   testWriterLimitWritevSync(),
   testWriterLimitAndStart(),
   testWriterArgumentValidation(),
+  testWriterWebIDLConversion(),
 ]).then(common.mustCall());
diff --git a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
similarity index 56%
rename from test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
index 314d6dda9a2d..5231b7248f3a 100644
--- a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs/promises');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }).then(common.mustCall());
diff --git a/test/parallel/test-fs-readdir-recursive-permission.js b/test/parallel/test-fs-readdir-recursive-permission.js
new file mode 100644
index 000000000000..b44454a213ce
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-permission.js
@@ -0,0 +1,89 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const allowed = tmpdir.resolve('allowed');
+const blocked = tmpdir.resolve('blocked');
+fs.mkdirSync(path.join(allowed, 'a', 'b'), { recursive: true });
+fs.mkdirSync(path.join(allowed, 'c'));
+fs.mkdirSync(blocked);
+fs.writeFileSync(path.join(allowed, 'top'), '');
+fs.writeFileSync(path.join(allowed, 'a', '1'), '');
+fs.writeFileSync(path.join(allowed, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(blocked, 'secret'), '');
+if (common.canCreateSymLink()) {
+  fs.symlinkSync(path.join(allowed, 'a'), path.join(allowed, 'c', 'link-to-a'), 'dir');
+}
+
+// Computed without the permission model, so by the native walk.
+const expected = fs.readdirSync(allowed, { recursive: true });
+assert(expected.includes(path.join('a', 'b', '2')));
+
+const { status, stderr } = spawnSync(process.execPath, [
+  '--permission',
+  `--allow-fs-read=${allowed}`,
+  '-e',
+  `
+    const assert = require('assert');
+    const fs = require('fs');
+    const path = require('path');
+    const { ALLOWED, BLOCKED } = process.env;
+    const expected = JSON.parse(process.env.EXPECTED);
+    const denied = {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemRead',
+      resource: path.toNamespacedPath(BLOCKED),
+    };
+
+    function check(result, withFileTypes) {
+      if (!withFileTypes) {
+        assert.deepStrictEqual(result, expected);
+        return;
+      }
+      assert(result.every((dirent) => dirent instanceof fs.Dirent));
+      assert.deepStrictEqual(
+        result.map((dirent) => path.join(path.relative(ALLOWED, dirent.parentPath), dirent.name)),
+        expected,
+      );
+    }
+
+    let pending = 0;
+    process.on('exit', () => assert.strictEqual(pending, 0));
+    for (const withFileTypes of [false, true]) {
+      const options = { recursive: true, withFileTypes };
+      check(fs.readdirSync(ALLOWED, options), withFileTypes);
+      assert.throws(() => fs.readdirSync(BLOCKED, options), denied);
+
+      pending += 4;
+      fs.readdir(ALLOWED, options, (err, result) => {
+        assert.ifError(err);
+        check(result, withFileTypes);
+        pending--;
+      });
+      fs.readdir(BLOCKED, options, (err) => {
+        assert.throws(() => { throw err; }, denied);
+        pending--;
+      });
+      fs.promises.readdir(ALLOWED, options).then((result) => {
+        check(result, withFileTypes);
+        pending--;
+      });
+      assert.rejects(fs.promises.readdir(BLOCKED, options), denied).then(() => pending--);
+    }
+  `,
+], {
+  env: {
+    ...process.env,
+    ALLOWED: allowed,
+    BLOCKED: blocked,
+    EXPECTED: JSON.stringify(expected),
+  },
+});
+assert.strictEqual(status, 0, stderr.toString());
diff --git a/test/parallel/test-fs-readdir-recursive-tree.js b/test/parallel/test-fs-readdir-recursive-tree.js
new file mode 100644
index 000000000000..2c10f63f0748
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-tree.js
@@ -0,0 +1,230 @@
+'use strict';
+
+// Exercises the native recursive readdir (sync, callback and promise forms)
+// against a reference walk built from the non-recursive API.
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const root = tmpdir.resolve('tree');
+fs.mkdirSync(path.join(root, 'a', 'b', 'c'), { recursive: true });
+fs.mkdirSync(path.join(root, 'd'));
+fs.mkdirSync(path.join(root, '.hidden'));
+fs.mkdirSync(path.join(root, 'empty'));
+fs.writeFileSync(path.join(root, 'top'), '');
+fs.writeFileSync(path.join(root, 'a', '1'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', 'c', '3'), '');
+fs.writeFileSync(path.join(root, 'd', '4'), '');
+fs.writeFileSync(path.join(root, '.hidden', '5'), '');
+
+const canSymlink = common.canCreateSymLink();
+if (canSymlink) {
+  fs.symlinkSync(path.join(root, 'a'), path.join(root, 'd', 'link-to-a'), 'dir');
+  fs.symlinkSync(path.join(root, 'a', '1'), path.join(root, 'd', 'link-to-file'));
+  fs.symlinkSync(path.join(root, 'nowhere'), path.join(root, 'd', 'dangling'));
+}
+
+// Reference implementation: breadth-first, entries in readdir order,
+// directory symlinks followed (fs.readdir semantics).
+function reference(basePath) {
+  const entries = [];
+  const queue = [basePath];
+  for (let i = 0; i < queue.length; i++) {
+    const dir = queue[i];
+    for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, dirent.name);
+      entries.push({
+        relative: path.relative(basePath, full),
+        isDirent: true,
+        name: dirent.name,
+        parentPath: dir,
+        isDirectory: dirent.isDirectory(),
+        isSymbolicLink: dirent.isSymbolicLink(),
+        isFile: dirent.isFile(),
+      });
+      let isDir = dirent.isDirectory();
+      if (!isDir && dirent.isSymbolicLink()) {
+        try {
+          isDir = fs.statSync(full).isDirectory();
+        } catch {
+          isDir = false;
+        }
+      }
+      if (isDir) queue.push(full);
+    }
+  }
+  return entries;
+}
+
+function fromDirents(dirents) {
+  return dirents.map((dirent) => {
+    return {
+      isDirent: dirent instanceof fs.Dirent,
+      name: dirent.name,
+      parentPath: dirent.parentPath,
+      isDirectory: dirent.isDirectory(),
+      isSymbolicLink: dirent.isSymbolicLink(),
+      isFile: dirent.isFile(),
+    };
+  });
+}
+
+function stripRelative(entries) {
+  return entries.map(({ relative, ...rest }) => rest);
+}
+
+const expected = reference(root);
+const expectedPaths = expected.map((entry) => entry.relative);
+const expectedDirents = stripRelative(expected);
+
+// The tree is only interesting if symlinks were followed.
+if (canSymlink) {
+  assert(expectedPaths.includes(path.join('d', 'link-to-a', 'b', 'c', '3')));
+  assert(!expectedPaths.includes(path.join('d', 'link-to-file', '1')));
+}
+assert(expectedPaths.includes(path.join('.hidden', '5')));
+assert(expectedPaths.includes('empty'));
+
+// Sync.
+assert.deepStrictEqual(fs.readdirSync(root, { recursive: true }), expectedPaths);
+assert.deepStrictEqual(
+  fromDirents(fs.readdirSync(root, { recursive: true, withFileTypes: true })),
+  expectedDirents,
+);
+
+// Callback.
+fs.readdir(root, { recursive: true }, common.mustSucceed((paths) => {
+  assert.deepStrictEqual(paths, expectedPaths);
+}));
+fs.readdir(root, { recursive: true, withFileTypes: true }, common.mustSucceed((dirents) => {
+  assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+}));
+
+// Promises.
+(async () => {
+  assert.deepStrictEqual(
+    await fs.promises.readdir(root, { recursive: true }),
+    expectedPaths,
+  );
+  assert.deepStrictEqual(
+    fromDirents(await fs.promises.readdir(root, { recursive: true, withFileTypes: true })),
+    expectedDirents,
+  );
+})().then(common.mustCall());
+
+// Mutating the options object after the call must not affect the result.
+{
+  const options = { recursive: true, withFileTypes: true };
+  fs.readdir(root, options, common.mustSucceed((dirents) => {
+    assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+  }));
+  options.withFileTypes = false;
+  options.recursive = false;
+}
+
+// Relative paths are relative to the path as given, while parentPath is the
+// path as given for the top level and a joined path below it.
+{
+  const relativeRoot = path.relative(process.cwd(), root) + path.sep;
+  const paths = fs.readdirSync(relativeRoot, { recursive: true });
+  assert.deepStrictEqual(paths, expectedPaths);
+  const dirents = fs.readdirSync(relativeRoot, { recursive: true, withFileTypes: true });
+  assert.strictEqual(dirents[0].parentPath, relativeRoot);
+  const nested = dirents.find((dirent) => dirent.name === '1');
+  assert.strictEqual(nested.parentPath, path.join(relativeRoot, 'a'));
+}
+
+// Buffer encodings and Buffer paths.
+{
+  const buffers = fs.readdirSync(root, { recursive: true, encoding: 'buffer' });
+  assert(buffers.every((entry) => Buffer.isBuffer(entry)));
+  assert.deepStrictEqual(buffers.map(String), expectedPaths);
+
+  const stringify = (dirent) => ({
+    ...fromDirents([dirent])[0],
+    name: String(dirent.name),
+    parentPath: String(dirent.parentPath),
+  });
+  const dirents = fs.readdirSync(root, { recursive: true, encoding: 'buffer', withFileTypes: true });
+  assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name)));
+  assert(dirents.every((dirent) => dirent.parentPath === root || Buffer.isBuffer(dirent.parentPath)));
+  assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+
+  // A Buffer path keeps parentPath a Buffer, whatever the encoding.
+  const bufferRoot = Buffer.from(root);
+  assert.deepStrictEqual(fs.readdirSync(bufferRoot, { recursive: true }), expectedPaths);
+  const bufferDirents = fs.readdirSync(bufferRoot, { recursive: true, withFileTypes: true });
+  assert(bufferDirents.every((dirent) => typeof dirent.name === 'string'));
+  assert(bufferDirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+  assert.strictEqual(bufferDirents[0].parentPath, bufferRoot);
+  assert.deepStrictEqual(bufferDirents.map(stringify), expectedDirents);
+
+  fs.readdir(bufferRoot, { recursive: true }, common.mustSucceed((paths) => {
+    assert.deepStrictEqual(paths, expectedPaths);
+  }));
+  fs.readdir(bufferRoot, { recursive: true, withFileTypes: true, encoding: 'buffer' }, common.mustSucceed((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name) && Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, encoding: 'buffer' }).then(common.mustCall((paths) => {
+    assert.deepStrictEqual(paths.map(String), expectedPaths);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, withFileTypes: true }).then(common.mustCall((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+}
+
+// Errors carry the directory that failed, for the root and below it.
+{
+  const missing = path.join(root, 'missing');
+  assert.throws(() => fs.readdirSync(missing, { recursive: true }), {
+    code: 'ENOENT',
+    syscall: 'scandir',
+    path: missing,
+  });
+  const file = path.join(root, 'top');
+  assert.throws(() => fs.readdirSync(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  });
+  fs.readdir(missing, { recursive: true }, common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ENOENT');
+    assert.strictEqual(err.syscall, 'scandir');
+    assert.strictEqual(err.path, missing);
+  }));
+  assert.rejects(fs.promises.readdir(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  }).then(common.mustCall());
+}
+
+if (!common.isWindows && !common.isIBMi && process.getuid() !== 0) {
+  const locked = tmpdir.resolve('locked');
+  const inner = path.join(locked, 'inner');
+  fs.mkdirSync(inner, { recursive: true });
+  fs.chmodSync(inner, 0);
+  try {
+    assert.throws(() => fs.readdirSync(locked, { recursive: true }), {
+      code: 'EACCES',
+      syscall: 'scandir',
+      path: inner,
+    });
+    fs.readdir(locked, { recursive: true }, common.mustCall((err) => {
+      assert.strictEqual(err.code, 'EACCES');
+      assert.strictEqual(err.path, inner);
+      fs.chmodSync(inner, 0o755);
+    }));
+  } catch (err) {
+    fs.chmodSync(inner, 0o755);
+    throw err;
+  }
+}
diff --git a/test/known_issues/test-fs-readdir-recursive-with-buffer.js b/test/parallel/test-fs-readdir-recursive-with-buffer.js
similarity index 55%
rename from test/known_issues/test-fs-readdir-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-recursive-with-buffer.js
index c2eae8f428fe..e3e17de10f27 100644
--- a/test/known_issues/test-fs-readdir-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }, common.mustSucceed());
diff --git a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
similarity index 52%
rename from test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
index 0f60c290f15d..1ff966c3b7ea 100644
--- a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 require('../common');
@@ -11,5 +8,5 @@ require('../common');
 const { readdirSync } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdirSync(Buffer.from(testDirPath), { recursive: true });
diff --git a/test/parallel/test-fs-rmSync-special-char-additional-error.js b/test/parallel/test-fs-rmSync-special-char-additional-error.js
new file mode 100644
index 000000000000..9b4de3c84d62
--- /dev/null
+++ b/test/parallel/test-fs-rmSync-special-char-additional-error.js
@@ -0,0 +1,69 @@
+'use strict';
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execSync } = require('child_process');
+
+tmpdir.refresh(); // Prepare a clean temporary directory
+
+function countOccurrences(haystack, needle) {
+  let count = 0;
+  let offset = 0;
+
+  while ((offset = haystack.indexOf(needle, offset)) !== -1) {
+    count++;
+    offset += needle.length;
+  }
+
+  return count;
+}
+
+const dirPath = path.join(tmpdir.path, '速_dir');
+const filePath = path.join(dirPath, 'test_file.txt');
+
+// Create a directory and a file within it
+fs.mkdirSync(dirPath, { recursive: true });
+fs.writeFileSync(filePath, 'This is a test file.');
+
+// Set permissions to simulate a permission denied scenario
+if (process.platform === 'win32') {
+  // Windows: Deny delete permissions
+  execSync(`icacls "${filePath}" /deny Everyone:(D)`);
+} else {
+  // Unix/Linux: Remove write permissions from the directory
+  fs.chmodSync(dirPath, 0o555); // Read and execute permissions only
+}
+
+try {
+  // Attempt to delete the directory which should now fail
+  assert.throws(() => {
+    fs.rmSync(dirPath, { recursive: true });
+  }, (err) => {
+    // Verify that the error is due to permission restrictions
+    let expectedCode = 'EACCES';
+    if (common.isMacOS) {
+      expectedCode = 'ENOTEMPTY';
+    } else if (common.isWindows) {
+      expectedCode = 'EPERM';
+    }
+    assert.strictEqual(err.code, expectedCode);
+    assert.strictEqual(err.syscall, 'rm');
+    assert.strictEqual(err.path, dirPath);
+    assert.strictEqual(countOccurrences(err.message, dirPath), 1);
+    return true;
+  });
+} finally {
+  // Cleanup - resetting permissions and removing the directory safely
+  if (process.platform === 'win32') {
+    // Remove the explicit permissions before attempting to delete
+    execSync(`icacls "${filePath}" /remove:d Everyone`);
+  } else {
+    // Reset permissions to allow deletion
+    fs.chmodSync(dirPath, 0o755); // Restore full permissions to the directory
+  }
+
+  // Attempt to clean up
+  fs.rmSync(dirPath, { recursive: true }); // This should now succeed
+}
diff --git a/test/parallel/test-fs-stat-cancel-inflight.js b/test/parallel/test-fs-stat-cancel-inflight.js
new file mode 100644
index 000000000000..4ed6ed810525
--- /dev/null
+++ b/test/parallel/test-fs-stat-cancel-inflight.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// Aborting a queued stat must cancel the libuv request instead of running it.
+// The threadpool is saturated so the request is still queued when it is
+// cancelled; the queue is FIFO, so the stat cannot start before the blocker.
+
+const common = require('../common');
+
+if (!common.hasCrypto) common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+
+if (process.argv[2] !== 'child') {
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--expose-internals', __filename, 'child'],
+    { env: { ...process.env, UV_THREADPOOL_SIZE: '1' } },
+  );
+  return;
+}
+
+// A single worker is what keeps the stat queued behind the blocker below.
+assert.strictEqual(process.env.UV_THREADPOOL_SIZE, '1');
+
+const { internalBinding } = require('internal/test/binding');
+const binding = internalBinding('fs');
+
+// Occupy the only worker thread so the stat below cannot start.
+crypto.pbkdf2('secret', 'salt', 500_000, 32, 'sha512', common.mustCall());
+
+const req = new binding.FSReqCallback(false);
+req.oncomplete = common.mustCall((err) => {
+  // Without cancellation the stat would run and report success.
+  assert.strictEqual(err?.code, 'ECANCELED');
+});
+binding.stat(__filename, false, req, true);
+req.cancel();
diff --git a/test/parallel/test-fs-watch-enoent.js b/test/parallel/test-fs-watch-enoent.js
index e363b3e9325c..2a4befa72b3c 100644
--- a/test/parallel/test-fs-watch-enoent.js
+++ b/test/parallel/test-fs-watch-enoent.js
@@ -17,6 +17,8 @@ const {
   UV_ENODEV,
   UV_ENOENT
 } = internalBinding('uv');
+const { FSWatcher: RecursiveFSWatcher } = require('internal/fs/recursive_watch');
+const { kFSWatchStart } = require('internal/fs/watchers');
 
 tmpdir.refresh();
 
@@ -66,6 +68,60 @@ tmpdir.refresh();
   }
 }
 
+{
+  assert.throws(
+    () => fs.watch(nonexistentFile, {
+      recursive: true,
+      throwIfNoEntry: true,
+    }, common.mustNotCall()),
+    {
+      path: nonexistentFile,
+      filename: nonexistentFile,
+      code: 'ENOENT',
+    },
+  );
+}
+
+{
+  const watcher = fs.watch(nonexistentFile, {
+    recursive: true,
+    throwIfNoEntry: false,
+  }, common.mustNotCall());
+  watcher.close();
+}
+
+{
+  const directory = tmpdir.resolve('recursive-watch-error');
+  const expected = new Error('recursive watcher failed');
+  const originalWatch = fs.watch;
+  const watcher = new RecursiveFSWatcher({ recursive: true });
+  const close = common.mustCall();
+  let calls = 0;
+
+  expected.code = 'ENOSPC';
+  fs.mkdirSync(`${directory}/subdirectory`, { recursive: true });
+  fs.watch = common.mustCall(() => {
+    if (calls++ === 0) {
+      return { close };
+    }
+    throw expected;
+  }, 2);
+
+  try {
+    assert.throws(
+      () => watcher[kFSWatchStart](directory),
+      (error) => {
+        assert.strictEqual(error, expected);
+        assert.strictEqual(error.filename, directory);
+        return true;
+      },
+    );
+  } finally {
+    fs.watch = originalWatch;
+    watcher.close();
+  }
+}
+
 {
   if (common.isMacOS || common.isWindows) {
     const file = tmpdir.resolve('file-to-watch');
diff --git a/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
new file mode 100644
index 000000000000..2573f582a312
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
@@ -0,0 +1,53 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.isAIX)
+  common.skip('AIX-specific ENODEV handling');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('preserve-watch-error');
+const originalStatSync = fs.statSync;
+const originalWatch = fs.watch;
+const expected = new Error('watch failed');
+const verificationError = new Error('stat failed');
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+const failVerification = common.mustCall(() => {
+  throw verificationError;
+});
+
+expected.code = 'ENODEV';
+verificationError.code = 'EIO';
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  throw expected;
+});
+fs.statSync = (filename, options) => {
+  if (filename === directory && options?.throwIfNoEntry === false) {
+    return failVerification();
+  }
+  return Reflect.apply(originalStatSync, fs, [filename, options]);
+};
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.statSync = originalStatSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js b/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js
new file mode 100644
index 000000000000..bb68893f2d40
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js
@@ -0,0 +1,108 @@
+'use strict';
+const common = require('../common');
+
+// This tests the JavaScript recursive fs.watch() implementation (used where
+// there is no native one, e.g. Linux): handle count, event reporting, ref/unref.
+
+if (!common.isLinux)
+  common.skip('the recursive watcher is native on this platform');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { setTimeout: wait } = require('timers/promises');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const delay = () => wait(common.platformTimeout(100));
+
+function countFSEventHandles() {
+  return process.getActiveResourcesInfo().filter((type) => type === 'FSEventWrap').length;
+}
+
+// Collects events until `done(events)` returns true, then closes the watcher.
+function watchUntil(target, done) {
+  return new Promise((resolve) => {
+    const events = [];
+    const watcher = fs.watch(target, { recursive: true });
+    watcher.on('change', (eventType, filename) => {
+      events.push(`${eventType} ${filename}`);
+      if (done(events)) {
+        watcher.close();
+        resolve(events);
+      }
+    });
+  });
+}
+
+(async () => {
+  const root = tmpdir.resolve('root');
+  fs.mkdirSync(path.join(root, 'sub'), { recursive: true });
+  for (let i = 0; i < 20; i++) {
+    fs.writeFileSync(path.join(root, `file-${i}.txt`), 'x');
+    fs.writeFileSync(path.join(root, 'sub', `file-${i}.txt`), 'x');
+  }
+  fs.symlinkSync(path.join(root, 'sub', 'file-1.txt'), path.join(root, 'link'));
+
+  {
+    // One handle per directory (root, sub) plus one for the symbolic link.
+    const before = countFSEventHandles();
+    const watcher = fs.watch(root, { recursive: true });
+    assert.strictEqual(countFSEventHandles() - before, 3);
+    watcher.unref();
+    watcher.ref();
+    watcher.close();
+  }
+
+  {
+    // A file replaced by rename() keeps being reported.
+    const file = path.join(root, 'sub', 'file-0.txt');
+    const changed = `change ${path.join('sub', 'file-0.txt')}`;
+    const events = watchUntil(root, (seen) => seen.filter((e) => e === changed).length === 2);
+    await delay();
+    fs.writeFileSync(`${file}.tmp`, 'replaced');
+    fs.renameSync(`${file}.tmp`, file);
+    await delay();
+    fs.appendFileSync(file, ' and modified');
+    await events;
+  }
+
+  {
+    // A write behind a symbolic link is reported as a rename of the link, and
+    // touching a known subdirectory itself does not throw or emit.
+    const events = watchUntil(root, (seen) => seen.includes('rename link'));
+    await delay();
+    fs.chmodSync(path.join(root, 'sub'), 0o775);
+    fs.appendFileSync(path.join(root, 'sub', 'file-1.txt'), 'more');
+    assert.ok(!(await events).some((e) => e.endsWith(' sub')));
+  }
+
+  {
+    // Removing the watched root directory is reported.
+    const doomed = tmpdir.resolve('doomed');
+    fs.mkdirSync(doomed);
+    fs.writeFileSync(path.join(doomed, 'inside'), 'x');
+    const events = watchUntil(doomed, (seen) => seen.includes('rename '));
+    await delay();
+    fs.rmSync(doomed, { recursive: true });
+    await events;
+  }
+
+  {
+    // So is removing a watched root that is a file (with an empty filename,
+    // as before).
+    const lone = tmpdir.resolve('lone.txt');
+    fs.writeFileSync(lone, 'x');
+    const events = watchUntil(lone, (seen) => seen.includes('rename '));
+    await delay();
+    fs.rmSync(lone);
+    await events;
+  }
+
+  {
+    const watcher = fs.watch(root, { recursive: true });
+    watcher.unref();
+    // The process exits although this watcher is never closed.
+    process.on('exit', () => assert.ok(watcher));
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
new file mode 100644
index 000000000000..b91dbe625aeb
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
@@ -0,0 +1,54 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-read');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let staleWatcherCloseCalls = 0;
+
+fs.mkdirSync(child, { recursive: true });
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    return { close: () => staleWatcherCloseCalls++ };
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.strictEqual(staleWatcherCloseCalls, 1);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
new file mode 100644
index 000000000000..8f570180a855
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
@@ -0,0 +1,66 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-watch');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const changes = [];
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let watchError;
+
+fs.mkdirSync(child, { recursive: true });
+watcher.on('change', (eventType, filename) => changes.push([eventType, filename]));
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    try {
+      return Reflect.apply(originalWatch, fs, [filename, options, listener]);
+    } catch (error) {
+      watchError = error;
+      throw error;
+    }
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+  assert.deepStrictEqual(changes, [['rename', 'child']]);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
new file mode 100644
index 000000000000..7692c86a3abe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
@@ -0,0 +1,37 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-read');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let closeCalls = 0;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  return { close: () => closeCalls++ };
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    {
+      code: 'ENOENT',
+      filename: directory,
+    },
+  );
+  assert.strictEqual(closeCalls, 1);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
new file mode 100644
index 000000000000..c43f3e275184
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
@@ -0,0 +1,40 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch-no-throw');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
new file mode 100644
index 000000000000..917489004650
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
@@ -0,0 +1,46 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, watchError);
+      assert.match(error.code, /^(ENOENT|ENODEV)$/);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-watch-before-read.js b/test/parallel/test-fs-watch-recursive-watch-before-read.js
new file mode 100644
index 000000000000..4faeb5b8efbe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-watch-before-read.js
@@ -0,0 +1,42 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('watch-before-read');
+const originalReaddirSync = fs.readdirSync;
+const originalWatch = fs.watch;
+const operations = [];
+const watcher = new FSWatcher({ recursive: true });
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  operations.push('watch');
+  return createWatcher();
+});
+fs.readdirSync = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  operations.push('read');
+  return Reflect.apply(originalReaddirSync, fs, [filename, ...args]);
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.deepStrictEqual(operations, ['watch', 'read']);
+} finally {
+  watcher.close();
+  fs.readdirSync = originalReaddirSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-writefile-one-roundtrip.js b/test/parallel/test-fs-writefile-one-roundtrip.js
new file mode 100644
index 000000000000..bab6940eec26
--- /dev/null
+++ b/test/parallel/test-fs-writefile-one-roundtrip.js
@@ -0,0 +1,85 @@
+'use strict';
+// fs.writeFile() and fs.promises.writeFile() with a path perform
+// open + write + close as one thread pool request. This covers what that
+// request must keep doing: honor flags and mode, append, report the
+// failing syscall, accept every ArrayBufferView, write the data as it was at
+// the call even if the buffer is resized or detached right after, and write
+// buffers larger than one write() call in full.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { isMainThread } = require('worker_threads');
+
+tmpdir.refresh();
+let counter = 0;
+const next = () => tmpdir.resolve(`file-${counter++}`);
+
+async function check(write) {
+  {
+    const file = next();
+    await write(file, 'hello');
+    await write(file, ' world', { flag: 'a' });
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'hello world');
+    await assert.rejects(write(file, 'again', { flag: 'wx' }), { code: 'EEXIST', syscall: 'open', path: file });
+  }
+  {
+    const file = path.join(next(), 'missing-dir', 'file');
+    await assert.rejects(write(file, 'x'), { code: 'ENOENT', syscall: 'open', path: file });
+  }
+  {
+    const file = next();
+    await write(file, '');
+    assert.strictEqual(fs.statSync(file).size, 0);
+  }
+  if (!common.isWindows && isMainThread) {
+    const file = next();
+    const mask = process.umask(0o022);
+    await write(file, 'x', { mode: 0o640 });
+    process.umask(mask);
+    assert.strictEqual(fs.statSync(file).mode & 0o777, 0o640);
+  }
+  {
+    const file = next();
+    const units = new Uint16Array([0x6968]);
+    await write(file, units);
+    await write(file, new DataView(new TextEncoder().encode('!?').buffer, 1, 1), { flag: 'a' });
+    assert.deepStrictEqual(fs.readFileSync(file),
+                           Buffer.concat([Buffer.from(units.buffer), Buffer.from('?')]));
+  }
+  if (fs.existsSync('/dev/full')) {
+    // open() succeeds, write() fails.
+    await assert.rejects(write('/dev/full', 'x'), { code: 'ENOSPC', syscall: 'write' });
+  }
+  {
+    const file = next();
+    const resizable = new ArrayBuffer(64 * 1024, { maxByteLength: 128 * 1024 });
+    const view = new Uint8Array(resizable).fill(97);
+    const done = write(file, view);
+    resizable.resize(0);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'a'.repeat(64 * 1024));
+  }
+  {
+    const file = next();
+    const detached = new ArrayBuffer(1024);
+    const done = write(file, new Uint8Array(detached).fill(98));
+    detached.transfer(8);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'b'.repeat(1024));
+  }
+  {
+    const file = next();
+    const big = Buffer.alloc(3 * 1024 * 1024 + 7, 'z');
+    await write(file, big);
+    assert.deepStrictEqual(fs.readFileSync(file), big);
+  }
+}
+
+(async () => {
+  await check((file, data, options) => new Promise((resolve, reject) => {
+    fs.writeFile(file, data, options, (err) => (err ? reject(err) : resolve()));
+  }));
+  await check(fs.promises.writeFile);
+})().then(common.mustCall());
diff --git a/test/parallel/test-http-1.0.js b/test/parallel/test-http-1.0.js
index 639bd228df00..2df00633eafb 100644
--- a/test/parallel/test-http-1.0.js
+++ b/test/parallel/test-http-1.0.js
@@ -127,9 +127,12 @@ function test(handler, request_generator, response_validator) {
     assert.strictEqual(req.httpVersionMinor, 1);
     res.sendDate = false;
     res.writeHead(200, { 'Content-Type': 'text/plain' });
-    res.write('Hello, '); res._send('');
+    assert.throws(() => res.write('ignored', 'invalid'), {
+      code: 'ERR_UNKNOWN_ENCODING',
+    });
+    res.write('Hello, ', common.mustCall()); res._send('');
     res.write('world!'); res._send('');
-    res.end();
+    process.nextTick(() => res.end('X'));
   }
 
   function request_generator() {
@@ -148,10 +151,10 @@ function test(handler, request_generator, response_validator) {
                               'Connection: close\r\n' +
                               'Transfer-Encoding: chunked\r\n' +
                               '\r\n' +
-                              '7\r\n' +
-                              'Hello, \r\n' +
-                              '6\r\n' +
-                              'world!\r\n' +
+                              'd\r\n' +
+                              'Hello, world!\r\n' +
+                              '1\r\n' +
+                              'X\r\n' +
                               '0\r\n' +
                               '\r\n';
 
diff --git a/test/parallel/test-http-byteswritten.js b/test/parallel/test-http-byteswritten.js
index 32495613afa6..003b7dfbd049 100644
--- a/test/parallel/test-http-byteswritten.js
+++ b/test/parallel/test-http-byteswritten.js
@@ -44,10 +44,10 @@ const httpServer = http.createServer(common.mustCall(function(req, res) {
     res.write(bchunk);
     res.write(chunk, 'hex');
   }
-  // Get .bytesWritten while buffer is not empty
-  assert(res.connection.bytesWritten > 0);
-
   res.end(body);
+
+  // Get .bytesWritten while the socket buffer is not empty.
+  assert(res.connection.bytesWritten > 0);
 }));
 
 httpServer.listen(0, function() {
diff --git a/test/parallel/test-http-outgoing-destroyed.js b/test/parallel/test-http-outgoing-destroyed.js
index b60b6594c765..e6f533d22448 100644
--- a/test/parallel/test-http-outgoing-destroyed.js
+++ b/test/parallel/test-http-outgoing-destroyed.js
@@ -66,6 +66,9 @@ const { OutgoingMessage } = require('http');
       });
     }));
     const err = new Error('Destroy test');
+    res.write('x', common.mustCall((writeErr) => {
+      assert.strictEqual(writeErr, err);
+    }));
     res.destroy(err);
     assert.strictEqual(res.errored, err);
   })).listen(0, common.mustCall(() => {
diff --git a/test/parallel/test-http2-async-local-storage.js b/test/parallel/test-http2-async-local-storage.js
index 22ed71388d59..76e42fea1570 100644
--- a/test/parallel/test-http2-async-local-storage.js
+++ b/test/parallel/test-http2-async-local-storage.js
@@ -10,46 +10,56 @@ const async_hooks = require('async_hooks');
 const storage = new async_hooks.AsyncLocalStorage();
 
 const {
-  HTTP2_HEADER_CONTENT_TYPE,
   HTTP2_HEADER_PATH,
   HTTP2_HEADER_STATUS,
 } = http2.constants;
 
-const server = http2.createServer();
-server.on('stream', (stream) => {
-  stream.respond({
-    [HTTP2_HEADER_CONTENT_TYPE]: 'text/plain; charset=utf-8',
-    [HTTP2_HEADER_STATUS]: 200
-  });
-  stream.on('error', common.mustNotCall());
+function runTest(serverHandler) {
+  const server = http2.createServer();
+  server.on('stream', serverHandler);
+
+  server.listen(0, common.mustCall(() => {
+    const client = storage.run({ id: 0 }, () =>
+      http2.connect(`http://localhost:${server.address().port}`));
+
+    let ended = 0;
+    function doReq(id) {
+      const req = client.request({ [HTTP2_HEADER_PATH]: '/' });
+
+      req.on('response', common.mustCall((headers) => {
+        assert.strictEqual(headers[HTTP2_HEADER_STATUS], 200);
+        assert.strictEqual(storage.getStore().id, id);
+      }));
+      req.on('data', common.mustCall(() => {
+        assert.strictEqual(storage.getStore().id, id);
+      }));
+      req.on('end', common.mustCall(() => {
+        assert.strictEqual(storage.getStore().id, id);
+        if (++ended === 2) {
+          server.close();
+          client.close();
+        }
+      }));
+    }
+
+    storage.run({ id: 1 }, () => doReq(1));
+    storage.run({ id: 2 }, () => doReq(2));
+  }));
+}
+
+// Response without trailers: END_STREAM on the DATA frame.
+runTest((stream) => {
+  stream.respond({ [HTTP2_HEADER_STATUS]: 200 });
   stream.end('data');
 });
 
-server.listen(0, common.mustCall(async () => {
-  const client = storage.run({ id: 0 }, () => http2.connect(`http://localhost:${server.address().port}`));
-
-  async function doReq(id) {
-    const req = client.request({ [HTTP2_HEADER_PATH]: '/' });
-
-    req.on('response', common.mustCall((headers) => {
-      assert.strictEqual(headers[HTTP2_HEADER_STATUS], 200);
-      assert.strictEqual(id, storage.getStore().id);
-    }));
-    req.on('data', common.mustCall((data) => {
-      assert.strictEqual(data.toString(), 'data');
-      assert.strictEqual(id, storage.getStore().id);
-    }));
-    req.on('end', common.mustCall(() => {
-      assert.strictEqual(id, storage.getStore().id);
-      server.close();
-      client.close();
-    }));
-  }
-
-  function doReqWith(id) {
-    storage.run({ id }, () => doReq(id));
-  }
-
-  doReqWith(1);
-  doReqWith(2);
-}));
+// Response with trailers (as gRPC uses): END_STREAM on the trailing HEADERS
+// frame. The 'end' event must still run in the request's context.
+runTest((stream) => {
+  stream.respond({ [HTTP2_HEADER_STATUS]: 200 }, { waitForTrailers: true });
+  stream.on('wantTrailers', () => {
+    stream.sendTrailers({ 'grpc-status': '0' });
+  });
+  stream.write('data');
+  stream.end();
+});
diff --git a/test/parallel/test-http2-bidirectional-write-deadlock.js b/test/parallel/test-http2-bidirectional-write-deadlock.js
new file mode 100644
index 000000000000..306dce021cb0
--- /dev/null
+++ b/test/parallel/test-http2-bidirectional-write-deadlock.js
@@ -0,0 +1,109 @@
+'use strict';
+
+// Regression test against deadlocks between two HTTP/2 peers that are both
+// writing at the same time.
+//
+// To bound how much it buffered while output was backed up, an Http2Session
+// used to stop reading from its socket whenever a write was in flight, and
+// resume only once that write completed. When the peer was itself blocked
+// writing, that write never completed, so the session never read again and
+// the connection hung forever with no error and no timeout.
+//
+// Rather than relying on kernel socket buffers filling up - which depends on
+// the platform and configured window sizes - this models one half of that
+// cycle directly. The client's socket forwards a write but does not report it
+// as complete, substituting for a write blocked because the peer is not
+// reading. Only after that write is stalled does the server send its response
+// body. A session that stops reading while writing never sees it.
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const net = require('net');
+const { Duplex } = require('stream');
+
+const BODY = 'the response body';
+
+const heldCallbacks = [];
+let serverStream;
+
+let stallWrites = false;
+
+// Client-side socket that forwards writes to a real connection, but can leave
+// their completion callbacks pending to model a transport-blocked write.
+class StalledClientSocket extends Duplex {
+  constructor(port) {
+    super();
+    this.inner = net.connect(port, common.localhostIPv4);
+    this.inner.on('data', (chunk) => this.push(chunk));
+    this.inner.on('end', () => this.push(null));
+  }
+  _read() {
+    // Incoming data is pushed as it arrives.
+  }
+  _write(chunk, encoding, callback) {
+    this.inner.write(chunk, encoding);
+    if (stallWrites) {
+      heldCallbacks.push(callback);
+      // Avoid writing from the server re-entrantly inside _write(). The
+      // ordering is still explicit: this callback is already held.
+      setImmediate(() => serverStream.end(BODY));
+      return;
+    }
+    callback();
+  }
+  _final(callback) {
+    this.inner.end(callback);
+  }
+  _destroy(err, callback) {
+    this.inner.destroy();
+    callback(err);
+  }
+}
+
+const server = http2.createServer();
+
+server.on('stream', common.mustCall((stream) => {
+  // Send headers first. Their response event starts the stalled client write.
+  stream.respond();
+  serverStream = stream;
+}));
+
+server.listen(0, common.mustCall(() => {
+  const port = server.address().port;
+
+  const client = http2.connect(`http://${common.localhostIPv4}:${port}`, {
+    createConnection: () => new StalledClientSocket(port),
+  });
+
+  const req = client.request({ ':method': 'POST' });
+
+  let received = '';
+
+  req.on('response', common.mustCall(() => {
+    // _write() will schedule the response body only after it has retained the
+    // callback, guaranteeing that the native write is still in progress.
+    stallWrites = true;
+    req.write(Buffer.alloc(256));
+  }));
+
+  req.on('data', (chunk) => {
+    received += chunk;
+  });
+
+  req.on('end', common.mustCall(() => {
+    assert.strictEqual(received, BODY);
+    assert.ok(heldCallbacks.length > 0,
+              'test did not actually stall a socket write');
+
+    // Let the stalled writes complete so that everything can shut down.
+    stallWrites = false;
+    for (const callback of heldCallbacks) callback();
+
+    req.end();
+    client.close();
+    server.close();
+  }));
+}));
diff --git a/test/parallel/test-http2-stream-backpressure-unread-peer.js b/test/parallel/test-http2-stream-backpressure-unread-peer.js
new file mode 100644
index 000000000000..543aba02eba2
--- /dev/null
+++ b/test/parallel/test-http2-stream-backpressure-unread-peer.js
@@ -0,0 +1,133 @@
+'use strict';
+
+// CVE-2019-9517 describes a peer that offers HTTP/2 flow-control credit
+// but then doesn't read from its TCP connection (blocking TCP flow).
+// A streaming response must stop producing data when the resulting server
+// write becomes blocked by the transport.
+
+// We use a raw client here to directly control the flow of requests and
+// stall responses to deterministically reproduce this on all platforms.
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const { Duplex, Readable } = require('stream');
+
+const { MAX_INITIAL_WINDOW_SIZE } = http2.constants;
+
+const FRAME_HEADERS = 1;
+const FRAME_SETTINGS = 4;
+const FRAME_WINDOW_UPDATE = 8;
+const FLAG_END_STREAM = 1;
+const FLAG_END_HEADERS = 4;
+const INITIAL_CONNECTION_WINDOW_SIZE = 65_535;
+
+const preface = Buffer.from('PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n');
+
+function frame(type, flags, streamID, payload = Buffer.alloc(0)) {
+  const header = Buffer.alloc(9);
+  header.writeUIntBE(payload.length, 0, 3);
+  header[3] = type;
+  header[4] = flags;
+  header.writeUInt32BE(streamID, 5);
+  return Buffer.concat([header, payload]);
+}
+
+function settings() {
+  const payload = http2.getPackedSettings({
+    initialWindowSize: MAX_INITIAL_WINDOW_SIZE,
+  });
+  return frame(FRAME_SETTINGS, 0, 0, payload);
+}
+
+function connectionWindowUpdate() {
+  const payload = Buffer.alloc(4);
+  payload.writeUInt32BE(
+    MAX_INITIAL_WINDOW_SIZE - INITIAL_CONNECTION_WINDOW_SIZE, 0);
+  return frame(FRAME_WINDOW_UPDATE, 0, 0, payload);
+}
+
+function request() {
+  return frame(
+    FRAME_HEADERS,
+    FLAG_END_HEADERS | FLAG_END_STREAM,
+    1,
+    Buffer.from([
+      0x82,  // :method: GET
+      0x86,  // :scheme: http
+      0x84,  // :path: /
+      0x41, 0x01, 0x78,  // :authority: x
+    ]));
+}
+
+let onWriteStalled;
+const socket = new Duplex({
+  read() {},
+  write(_data, _encoding, callback) {
+    if (onWriteStalled === undefined) {
+      callback();
+      return;
+    }
+
+    // Leave the write pending to model a peer that has stopped reading.
+    onWriteStalled();
+  },
+});
+
+// The 1MB body is well within the client's stream and connection windows
+// (2^31-1), so HTTP/2 flow control will not limit the response.
+const CHUNK_SIZE = 16 * 1024;
+const RESPONSE_SIZE = 1024 * 1024;
+const chunk = Buffer.alloc(CHUNK_SIZE);
+
+const serverSession = http2.performServerHandshake(socket);
+serverSession.on('stream', common.mustCall((stream) => {
+  let produced = 0;
+
+  // A datasource that produces chunks on demand
+  const source = new Readable({
+    highWaterMark: CHUNK_SIZE,
+    read() {
+      if (produced === RESPONSE_SIZE) {
+        this.push(null);
+        return;
+      }
+      produced += CHUNK_SIZE;
+      this.push(chunk);
+    },
+  });
+
+  // We set this once the stream opens, to stall all future writes once the
+  // initial preface & SETTINGS dance is completed.
+  onWriteStalled = common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      // Backpressure should have been applied to the source when the
+      // socket writable writes stalled, even though there is still
+      // H2 flow-control credit available:
+      assert(source.isPaused());
+      assert(stream.writableNeedDrain);
+
+      // Exact amount produced depends on platform-specific variables but
+      // backpressure must stop the source well before it completes:
+      assert.ok(produced <= RESPONSE_SIZE / 4,
+                `produced ${produced} of ${RESPONSE_SIZE} bytes`);
+
+      serverSession.destroy();
+      socket.destroy();
+      source.destroy();
+    }));
+  });
+
+  stream.respond();
+  source.pipe(stream);
+}));
+
+// Manually send a single request with all required preamble:
+socket.push(Buffer.concat([
+  preface,
+  settings(),
+  connectionWindowUpdate(),
+  request(),
+]));
diff --git a/test/parallel/test-inspect-async-hook-setup-at-inspect.js b/test/parallel/test-inspect-async-hook-setup-at-inspect.js
index 4b43fea96ab3..5d1f276ca5e1 100644
--- a/test/parallel/test-inspect-async-hook-setup-at-inspect.js
+++ b/test/parallel/test-inspect-async-hook-setup-at-inspect.js
@@ -25,6 +25,17 @@ async function waitForInitialSetup(session) {
   await session.waitForBreakOnLine(2, '[eval]');
 }
 
+// Sent only once the target is paused. While the target runs JS the command
+// is dispatched from a V8 interrupt, where Agent::SyncAsyncHookState() cannot
+// call into JS and defers enabling the async hook to an immediate that the
+// pause then blocks, answering the command anyway. Dispatching from the paused
+// message loop enables the hook inline, so the response is a real barrier.
+async function enableAsyncStackTraces(session) {
+  console.error('[test]', 'Enabling async stack traces');
+  await session.send({ 'method': 'Debugger.setAsyncCallStackDepth',
+                       'params': { 'maxDepth': 10 } });
+}
+
 async function setupTimeoutForStackTrace(session) {
   console.error('[test]', 'Setting up timeout for async stack trace');
   await session.send([
@@ -50,13 +61,12 @@ async function runTests() {
   await session.send([
     { 'method': 'Runtime.enable' },
     { 'method': 'Debugger.enable' },
-    { 'method': 'Debugger.setAsyncCallStackDepth',
-      'params': { 'maxDepth': 10 } },
     { 'method': 'Debugger.setBlackboxPatterns',
       'params': { 'patterns': [] } },
   ]);
 
   await waitForInitialSetup(session);
+  await enableAsyncStackTraces(session);
   await setupTimeoutForStackTrace(session);
   await checkAsyncStackTrace(session);
 
diff --git a/test/parallel/test-internal-net-isLoopback.js b/test/parallel/test-internal-net-isLoopback.js
index df63bfc262ea..d54533ec0dd5 100644
--- a/test/parallel/test-internal-net-isLoopback.js
+++ b/test/parallel/test-internal-net-isLoopback.js
@@ -10,7 +10,9 @@ const loopback = [
   '127.0.0.255',
   '127.1.2.3',
   '[::1]',
+  '::1',
   '[0:0:0:0:0:0:0:1]',
+  '0:0:0:0:0:0:0:1',
 ];
 
 const loopbackNot = [
@@ -21,6 +23,10 @@ const loopbackNot = [
   '[2001:db8::1]',
   '[fe80::1]',
   '8.8.8.8',
+  '::2',
+  '[::2]',
+  '0:0:0:0:0:0:0:2',
+  '[0:0:0:0:0:0:0:2]',
 ];
 
 for (const address of loopback) {
diff --git a/test/parallel/test-module-builtin-experimental.js b/test/parallel/test-module-builtin-experimental.js
new file mode 100644
index 000000000000..1257a96e8208
--- /dev/null
+++ b/test/parallel/test-module-builtin-experimental.js
@@ -0,0 +1,46 @@
+'use strict';
+
+const common = require('../common');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const experimentalBuiltins = [
+  ['dtls', '--experimental-dtls', common.hasDtls],
+  ['quic', '--experimental-quic', common.hasQuic],
+  ['vfs', '--experimental-vfs', true],
+].filter(([, , available]) => available);
+
+for (const [id, flag] of experimentalBuiltins) {
+  const builtin = `node:${id}`;
+
+  spawnSyncAndAssert(process.execPath, [
+    '-e', `const m = require('node:module'); if (m.builtinModules.includes('${builtin}')) process.exit(1); try { require('${builtin}'); } catch (e) { if (e.code === 'ERR_UNKNOWN_BUILTIN_MODULE') process.exit(0); } process.exit(1);`,
+  ], { status: 0 });
+
+  spawnSyncAndAssert(process.execPath, [
+    flag,
+    '-e', `const m = require('node:module'); if (!m.builtinModules.includes('${builtin}')) process.exit(1); require('${builtin}');`,
+  ], { status: 0 });
+}
+
+// node:ffi is enabled by default in builds with FFI support and can be
+// disabled with --no-experimental-ffi.
+if (common.hasFFI) {
+  spawnSyncAndAssert(process.execPath, [
+    '--no-experimental-ffi',
+    '-e', `const m = require('node:module'); if (m.builtinModules.includes('node:ffi')) process.exit(1); try { require('node:ffi'); } catch (e) { if (e.code === 'ERR_UNKNOWN_BUILTIN_MODULE') process.exit(0); } process.exit(1);`,
+  ], { status: 0 });
+}
+
+const schemeOnlyBuiltins = ['node:test', 'node:sea'];
+if (common.hasFFI) {
+  schemeOnlyBuiltins.push('node:ffi');
+}
+if (common.hasSQLite) {
+  schemeOnlyBuiltins.push('node:sqlite');
+}
+
+for (const id of schemeOnlyBuiltins) {
+  spawnSyncAndAssert(process.execPath, [
+    '-e', `const m = require('node:module'); if (!m.builtinModules.includes('${id}')) process.exit(1); require('${id}');`,
+  ], { status: 0 });
+}
diff --git a/test/parallel/test-module-isBuiltin.js b/test/parallel/test-module-isBuiltin.js
index a7815a8dfc1c..ccf359c32029 100644
--- a/test/parallel/test-module-isBuiltin.js
+++ b/test/parallel/test-module-isBuiltin.js
@@ -7,10 +7,14 @@ const { isBuiltin } = require('module');
 assert(isBuiltin('http'));
 assert(isBuiltin('sys'));
 assert(isBuiltin('node:fs'));
+assert(isBuiltin('node:bench'));
+assert(isBuiltin('node:bench/reporters'));
 assert(isBuiltin('node:test'));
 
 // Does not include internal modules
 assert(!isBuiltin('internal/errors'));
+assert(!isBuiltin('bench'));
+assert(!isBuiltin('bench/reporters'));
 assert(!isBuiltin('test'));
 assert(!isBuiltin(''));
 assert(!isBuiltin(undefined));
diff --git a/test/parallel/test-module-unreadable-package-json.js b/test/parallel/test-module-unreadable-package-json.js
index 4261dad85580..7de221612d9d 100644
--- a/test/parallel/test-module-unreadable-package-json.js
+++ b/test/parallel/test-module-unreadable-package-json.js
@@ -18,6 +18,7 @@ const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const tmpdir = require('../common/tmpdir');
 
 tmpdir.refresh();
@@ -38,11 +39,10 @@ const entry = tmpdir.resolve('main.mjs');
 fs.writeFileSync(entry, 'import { which } from "dep"; console.log(which);');
 
 // Sanity check: the export resolves while the package config is readable.
-{
-  const child = spawnSync(process.execPath, [entry], { encoding: 'utf8' });
-  assert.strictEqual(child.stdout.trim(), 'real');
-  assert.strictEqual(child.status, 0, child.stderr);
-}
+spawnSyncAndAssert(process.execPath, [entry], { encoding: 'utf8' }, {
+  stdout: 'real',
+  trim: true,
+});
 
 fs.chmodSync(depPackageJson, 0o000);
 
diff --git a/test/parallel/test-node-run.js b/test/parallel/test-node-run.js
index bac90cf5db58..57faa80b9f82 100644
--- a/test/parallel/test-node-run.js
+++ b/test/parallel/test-node-run.js
@@ -301,4 +301,39 @@ describe('node --run [command]', { concurrency: !process.env.TEST_PARALLEL }, ()
     assert.strictEqual(child.stderr, '');
     assert.strictEqual(child.code, 0);
   });
+
+  it('lists available scripts when no command is given', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run'],
+      { cwd: fixtures.path('run-script') },
+    );
+    assert.match(child.stderr, /Available scripts are:/);
+    assert.match(child.stderr, /test: echo "Error: no test specified" && exit 1/);
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.code, 9);
+  });
+
+  it('does not consume a following flag as the script name', async () => {
+    // `--run` followed by a flag lists scripts rather than treating the flag
+    // as a script name.
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run', '--no-warnings'],
+      { cwd: fixtures.path('run-script') },
+    );
+    assert.match(child.stderr, /Available scripts are:/);
+    assert.strictEqual(child.code, 9);
+  });
+
+  it('errors when listing scripts without a package.json', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run'],
+      { cwd: __dirname },
+    );
+    assert.match(child.stderr, /Can't find package\.json/);
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.code, 1);
+  });
 });
diff --git a/test/parallel/test-perf-hooks-histogram-analysis.js b/test/parallel/test-perf-hooks-histogram-analysis.js
index acc2b5a7eb2d..7069ec92ac92 100644
--- a/test/parallel/test-perf-hooks-histogram-analysis.js
+++ b/test/parallel/test-perf-hooks-histogram-analysis.js
@@ -229,7 +229,24 @@ const { inspect } = require('util');
   const unsorted = h.percentilesAt([99, 50, 90]);
   assert.strictEqual(unsorted.get(50), h.percentile(50));
 
-  // Validation
+  // Validation: non-array input must throw the same error regardless of how
+  // the check is implemented internally.
+  for (const [value, received] of [
+    ['x', "type string ('x')"],
+    [123, 'type number (123)'],
+    [{}, 'an instance of Object'],
+    [null, 'null'],
+    [undefined, 'undefined'],
+    [1n, 'type bigint (1n)'],
+    [true, 'type boolean (true)'],
+  ]) {
+    assert.throws(() => h.percentilesAt(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "percentiles" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+  }
   assert.throws(() => h.percentilesAt('not array'),
                 { code: 'ERR_INVALID_ARG_TYPE' });
   assert.throws(() => h.percentilesAt([0]),
diff --git a/test/parallel/test-perf-hooks-histogram-stats.js b/test/parallel/test-perf-hooks-histogram-stats.js
index 9b05a1061682..581579d12686 100644
--- a/test/parallel/test-perf-hooks-histogram-stats.js
+++ b/test/parallel/test-perf-hooks-histogram-stats.js
@@ -3,7 +3,86 @@
 
 require('../common');
 const assert = require('assert');
-const { createHistogram } = require('perf_hooks');
+const { createHistogram, importHistogram } = require('perf_hooks');
+
+// ---------------------------------------------------------------------------
+// meanCI([options]) — confidence interval for the mean
+// ---------------------------------------------------------------------------
+{
+  const empty = createHistogram();
+  const emptyCI = empty.meanCI();
+  assert.strictEqual(Object.getPrototypeOf(emptyCI), null);
+  assert.ok(Number.isNaN(emptyCI.mean));
+  assert.ok(Number.isNaN(emptyCI.lower));
+  assert.ok(Number.isNaN(emptyCI.upper));
+
+  // A confidence interval is undefined with fewer than two samples.
+  const one = createHistogram();
+  one.record(42);
+  const oneCI = one.meanCI();
+  assert.strictEqual(oneCI.mean, 42);
+  assert.ok(Number.isNaN(oneCI.lower));
+  assert.ok(Number.isNaN(oneCI.upper));
+
+  // This known sample has a 95% Student's t confidence interval of
+  // approximately [3.334149, 7.665851].
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+  const ci95 = h.meanCI();
+  assert.strictEqual(ci95.mean, h.mean);
+  assert.ok(Math.abs(ci95.lower - 3.3341494103866087) < 1e-6);
+  assert.ok(Math.abs(ci95.upper - 7.665850589613392) < 1e-6);
+
+  // Higher confidence produces a wider interval.
+  const ci90 = h.meanCI({ confidence: 0.90 });
+  const ci99 = h.meanCI({ confidence: 0.99 });
+  assert.ok((ci99.upper - ci99.lower) > (ci90.upper - ci90.lower));
+
+  // Very low confidence levels retain precision near the center of the
+  // distribution. With two samples, the t-distribution has one degree of
+  // freedom and the expected interval width is tan(pi * confidence / 2).
+  const two = createHistogram();
+  two.record(1);
+  two.record(2);
+  const lowConfidence = 1e-9;
+  const narrowCI = two.meanCI({ confidence: lowConfidence });
+  const expectedWidth = Math.tan(Math.PI * lowConfidence / 2);
+  const actualWidth = narrowCI.upper - narrowCI.lower;
+  assert.ok(Math.abs(actualWidth - expectedWidth) / expectedWidth < 1e-4);
+
+  // Very high confidence levels are not truncated by the quantile search.
+  const extremeCI = two.meanCI({ confidence: 0.9999999 });
+  assert.ok(extremeCI.lower < -3_000_000);
+  assert.ok(extremeCI.upper > 3_000_000);
+
+  const highestCI = two.meanCI({
+    confidence: 1 - Number.EPSILON / 2,
+  });
+  assert.ok(Number.isFinite(highestCI.lower));
+  assert.ok(Number.isFinite(highestCI.upper));
+
+  // Constant values have no sampling uncertainty.
+  const constant = createHistogram();
+  for (let i = 0; i < 100; i++) constant.record(7);
+  assert.deepStrictEqual(constant.meanCI(), {
+    __proto__: null,
+    mean: 7,
+    lower: 7,
+    upper: 7,
+  });
+
+  // Validation.
+  assert.throws(() => h.meanCI({ confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: NaN }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.meanCI(null),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
 
 // ---------------------------------------------------------------------------
 // welchTest(other) — Welch's t-test
@@ -440,6 +519,142 @@ const { createHistogram } = require('perf_hooks');
                 { code: 'ERR_INVALID_ARG_TYPE' });
 }
 
+// ---------------------------------------------------------------------------
+// export() / importHistogram() — CBOR round-trip
+// ---------------------------------------------------------------------------
+{
+  // Basic round-trip
+  const h = createHistogram();
+  for (let i = 1; i <= 1000; i++) h.record(i);
+
+  const buf = h.export();
+  assert.ok(buf instanceof Uint8Array, 'export should return Uint8Array');
+  assert.ok(buf.length > 0, 'export should not be empty');
+
+  const h2 = importHistogram(buf);
+  assert.strictEqual(h2.count, h.count);
+  assert.strictEqual(h2.min, h.min);
+  assert.strictEqual(h2.max, h.max);
+  assert.strictEqual(h2.mean, h.mean);
+  assert.strictEqual(h2.stddev, h.stddev);
+  assert.strictEqual(h2.percentile(50), h.percentile(50));
+  assert.strictEqual(h2.percentile(99), h.percentile(99));
+  assert.strictEqual(h2.percentile(99.9), h.percentile(99.9));
+
+  // Imported histogram is recordable
+  h2.record(9999);
+  assert.strictEqual(h2.count, h.count + 1);
+
+  // Round-trip with EWMA and threshold
+  const h3 = createHistogram({ halfLife: 10, threshold: 500 });
+  for (let i = 1; i <= 200; i++) h3.record(i);
+  const buf3 = h3.export();
+  const h4 = importHistogram(buf3);
+  assert.strictEqual(h4.count, h3.count);
+  assert.strictEqual(h4.ewmaMean, h3.ewmaMean);
+  assert.strictEqual(h4.ewmaStddev, h3.ewmaStddev);
+  assert.strictEqual(h4.ewmaErrorRate, h3.ewmaErrorRate);
+
+  // Empty histogram round-trip
+  const empty = createHistogram();
+  const emptyBuf = empty.export();
+  const empty2 = importHistogram(emptyBuf);
+  assert.strictEqual(empty2.count, 0);
+  assert.strictEqual(empty2.min, 9223372036854776000);  // INT64_MAX as double
+
+  // Sparse: only a few distinct values
+  const sparse = createHistogram();
+  sparse.record(1);
+  sparse.record(1000000);
+  const sparseBuf = sparse.export();
+  const sparse2 = importHistogram(sparseBuf);
+  assert.strictEqual(sparse2.count, 2);
+  assert.strictEqual(sparse2.percentile(1), sparse.percentile(1));
+  assert.strictEqual(sparse2.percentile(100), sparse.percentile(100));
+
+  // Size scales with distinct values, not total bucket count
+  assert.ok(sparseBuf.length < 200,
+            `Sparse export should be small, got ${sparseBuf.length}`);
+
+  // Validation — type and format
+  assert.throws(() => importHistogram('not a uint8array'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => importHistogram(new Uint8Array(0)),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => importHistogram(new Uint8Array([0xff, 0xff])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- hdr_init failures (invalid histogram options) ---
+
+  // lowest=0 violates lowest>=1.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x01, 0x00])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // figures=0 violates figures>=1.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x03, 0x00])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // figures=6 violates figures<=5.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x03, 0x06])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // lowest=100, highest=100: lowest*2 > highest.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa2,                                         // map(2)
+    0x01, 0x18, 100,                              // 1 (lowest) = 100
+    0x02, 0x18, 100,                              // 2 (highest) = 100
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Large values that trigger hdr_init internal overflow
+  // (unit_magnitude + sub_bucket_half_count_magnitude > 61).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa3,                                         // map(3)
+    0x01, 0x1b, 0, 0, 0x20, 0, 0, 0, 0, 0,       // 1 (lowest) = 2**45
+    0x02, 0x1b, 0, 0, 0x40, 0, 0, 0, 0, 0,       // 2 (highest) = 2**46
+    0x03, 0x05,                                   // 3 (figures) = 5
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Structural CBOR validation ---
+
+  // Wrong version number (version=99).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x00, 0x18, 99,                               // 0 (version) = 99
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Unknown top-level key (key=255).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x18, 0xff, 0x00,                             // 255 (unknown) = 0
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Counts array with odd length (must be even: delta/count pairs).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x0a, 0x81, 0x01,                             // 10 (counts) = [1]
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Post-construction validation ---
+
+  // counts_len mismatch: valid options but declared counts_len
+  // doesn't match what hdr_init actually produces.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa2,                                         // map(2)
+    0x09, 0x01,                                   // 9 (countsLen) = 1
+    0x0a, 0x80,                                   // 10 (counts) = []
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Oversized counts array: declared length exceeds remaining buffer.
+  // Without bounds checking, reserve() would OOM-crash.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x0a, 0x9b,                                   // 10 (counts) = array(
+    0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //   2**52 elements)
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Sparse count index out of bounds: lowest=1, highest=100, figures=1
+  // produces counts_len=64. Index 100 exceeds it.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x0a, 0x82, 0x18, 0x64, 0x01,                 // 10 (counts) = [100, 1]
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+}
+
 // ---------------------------------------------------------------------------
 // ERR_INVALID_THIS for all new methods on wrong receiver
 // ---------------------------------------------------------------------------
@@ -450,6 +665,7 @@ const { createHistogram } = require('perf_hooks');
   const wrongThis = {};
 
   const methods = [
+    ['meanCI', []],
     ['welchTest', [h]],
     ['mannWhitneyTest', [h]],
     ['cohensD', [h]],
@@ -497,6 +713,7 @@ const { createHistogram } = require('perf_hooks');
   stub[kHandle] = null;
 
   assert.strictEqual(stub.welchTest(h), undefined);
+  assert.strictEqual(stub.meanCI(), undefined);
   assert.strictEqual(stub.mannWhitneyTest(h), undefined);
   assert.strictEqual(stub.percentileCI(50), undefined);
   assert.strictEqual(stub.burnRate(0.999), undefined);
diff --git a/test/parallel/test-perf-hooks-resourcetiming-attributes.js b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
new file mode 100644
index 000000000000..66fee5265cd4
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
@@ -0,0 +1,116 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const {
+  PerformanceResourceTiming,
+  performance,
+} = require('perf_hooks');
+
+// Covers the IDL attributes finalResponseHeadersStart,
+// firstInterimResponseStart, renderBlockingStatus, contentType and contentEncoding,
+// and the spec requirement that responseStart prefers a non-zero
+// firstInterimResponseStart over finalResponseHeadersStart.
+
+function createTimingInfo(overrides = {}) {
+  return {
+    startTime: 0,
+    redirectStartTime: 0,
+    redirectEndTime: 0,
+    postRedirectStartTime: 0,
+    finalServiceWorkerStartTime: 0,
+    finalNetworkRequestStartTime: 0,
+    finalNetworkResponseStartTime: 0,
+    endTime: 0,
+    encodedBodySize: 0,
+    decodedBodySize: 0,
+    finalConnectionTimingInfo: null,
+    ...overrides,
+  };
+}
+
+function markResourceTiming(timingInfo, bodyInfo) {
+  return performance.markResourceTiming(
+    timingInfo,
+    'http://localhost:8080',
+    'fetch',
+    {},
+    '',
+    bodyInfo,
+    200,
+    '',
+  );
+}
+
+// Default values when no optional timing or body metadata is present.
+{
+  const resource = markResourceTiming(createTimingInfo(), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 0);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 0);
+  assert.strictEqual(resource.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(resource.contentType, '');
+  assert.strictEqual(resource.contentEncoding, '');
+}
+
+// responseStart falls back to the final response when no interim response timing was recorded.
+{
+  const resource = markResourceTiming(createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 0,
+  }), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 123);
+}
+
+// Values reflected from timing info and body info.
+{
+  const timingInfo = createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 45,
+    renderBlocking: true,
+  });
+  const bodyInfo = {
+    contentType: 'text/html',
+    contentEncoding: 'gzip',
+  };
+  const resource = markResourceTiming(timingInfo, bodyInfo);
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 45);
+  assert.strictEqual(resource.responseStart, 45);
+  assert.strictEqual(resource.renderBlockingStatus, 'blocking');
+  assert.strictEqual(resource.contentType, 'text/html');
+  assert.strictEqual(resource.contentEncoding, 'gzip');
+
+  const json = resource.toJSON();
+  assert.strictEqual(json.finalResponseHeadersStart, 123);
+  assert.strictEqual(json.firstInterimResponseStart, 45);
+  assert.strictEqual(json.responseStart, 45);
+  assert.strictEqual(json.renderBlockingStatus, 'blocking');
+  assert.strictEqual(json.contentType, 'text/html');
+  assert.strictEqual(json.contentEncoding, 'gzip');
+}
+
+// The attributes are enumerable getters on the prototype and perform a
+// brand check like the other PerformanceResourceTiming attributes.
+for (const name of [
+  'finalResponseHeadersStart',
+  'firstInterimResponseStart',
+  'renderBlockingStatus',
+  'contentType',
+  'contentEncoding',
+]) {
+  const desc = Object.getOwnPropertyDescriptor(
+    PerformanceResourceTiming.prototype, name);
+  assert.strictEqual(desc.enumerable, true, name);
+  assert.strictEqual(typeof desc.get, 'function', name);
+  assert.throws(() => desc.get.call({}), {
+    code: 'ERR_INVALID_THIS',
+  }, name);
+}
+
+performance.clearResourceTimings();
diff --git a/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
new file mode 100644
index 000000000000..40bcd1184a7d
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
@@ -0,0 +1,67 @@
+// The ESM common wrapper does not export localhostIPv4.
+// eslint-disable-next-line node-core/require-common-first
+import common from '../common/index.js';
+
+import assert from 'node:assert';
+import { once } from 'node:events';
+import { createServer } from 'node:http';
+import {
+  PerformanceResourceTiming,
+  performance,
+} from 'node:perf_hooks';
+
+// This test ensures that built-in fetch creates a PerformanceResourceTiming
+// entry with the resource timing attributes exposed by Node.js.
+
+const responseBody = 'Hello world';
+const server = createServer(common.mustCall((req, res) => {
+  res.end(responseBody);
+}));
+
+server.listen(0, common.localhostIPv4);
+await once(server, 'listening');
+
+async function closeServer() {
+  if (server.listening) {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+try {
+  performance.clearResourceTimings();
+
+  const url = `http://${common.localhostIPv4}:${server.address().port}/`;
+  const response = await fetch(url);
+  assert.strictEqual(await response.text(), responseBody);
+  await closeServer();
+
+  const entries = performance.getEntriesByName(url, 'resource');
+  assert.strictEqual(entries.length, 1);
+
+  const [entry] = entries;
+  assert(entry instanceof PerformanceResourceTiming);
+  assert.strictEqual(entry.initiatorType, 'fetch');
+  assert.strictEqual(entry.responseStatus, 200);
+  assert(entry.finalResponseHeadersStart > 0);
+  assert.strictEqual(entry.firstInterimResponseStart, 0);
+  assert.strictEqual(entry.responseStart, entry.finalResponseHeadersStart);
+  assert(entry.responseEnd >= entry.responseStart);
+  assert.strictEqual(entry.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(entry.contentType, '');
+  assert.strictEqual(entry.contentEncoding, '');
+
+  const json = entry.toJSON();
+  for (const name of [
+    'finalResponseHeadersStart',
+    'firstInterimResponseStart',
+    'responseStart',
+    'renderBlockingStatus',
+    'contentType',
+    'contentEncoding',
+  ]) {
+    assert.strictEqual(json[name], entry[name], name);
+  }
+} finally {
+  performance.clearResourceTimings();
+  await closeServer();
+}
diff --git a/test/parallel/test-perf-hooks-resourcetiming.js b/test/parallel/test-perf-hooks-resourcetiming.js
index f76cd669004e..9a94ba795e95 100644
--- a/test/parallel/test-perf-hooks-resourcetiming.js
+++ b/test/parallel/test-perf-hooks-resourcetiming.js
@@ -174,6 +174,8 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
@@ -181,6 +183,9 @@ function createTimingInfo({
     decodedBodySize: 0,
     responseStatus: 200,
     deliveryType: '',
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: '',
   });
   assert.strictEqual(util.inspect(performance.getEntries()), `[
   PerformanceResourceTiming {
@@ -200,13 +205,18 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
     encodedBodySize: 0,
     decodedBodySize: 0,
     deliveryType: '',
-    responseStatus: 200
+    responseStatus: 200,
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: ''
   }
 ]`);
   assert.strictEqual(util.inspect(resource), `PerformanceResourceTiming {
@@ -226,13 +236,18 @@ function createTimingInfo({
   connectEnd: 0,
   secureConnectionStart: 0,
   requestStart: 0,
+  finalResponseHeadersStart: 0,
+  firstInterimResponseStart: 0,
   responseStart: 0,
   responseEnd: 0,
   transferSize: 0,
   encodedBodySize: 0,
   decodedBodySize: 0,
   deliveryType: '',
-  responseStatus: 200
+  responseStatus: 200,
+  renderBlockingStatus: 'non-blocking',
+  contentType: '',
+  contentEncoding: ''
 }`);
 
   assert(resource instanceof PerformanceEntry);
diff --git a/test/parallel/test-permission-allow-inspector.js b/test/parallel/test-permission-allow-inspector.js
index 7d8b2aba8357..05022ff24044 100644
--- a/test/parallel/test-permission-allow-inspector.js
+++ b/test/parallel/test-permission-allow-inspector.js
@@ -38,7 +38,6 @@ session.connect();
   });
 
   assert.throws(() => {
-    // eslint-disable-next-line no-undef
     new Worker(`
       const child_process = require("node:child_process");
       console.log(child_process.execSync("ls -l").toString());
diff --git a/test/parallel/test-permission-audit-addons-does-not-deny.js b/test/parallel/test-permission-audit-addons-does-not-deny.js
new file mode 100644
index 000000000000..dd08058ab3ff
--- /dev/null
+++ b/test/parallel/test-permission-audit-addons-does-not-deny.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not disable native addon
+// loading. In audit mode process.dlopen() must reach the regular loading
+// path (failing with ERR_DLOPEN_FAILED for a missing file, after publishing
+// the denial to the diagnostics channel) instead of being rejected upfront
+// with ERR_DLOPEN_DISABLED, which is still the expected behavior under
+// --permission.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+
+function run(flag) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:addon', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    try {
+      process.dlopen({ exports: {} }, '/nonexistent/audit-test.node');
+      console.log('RESULT NO_THROW');
+    } catch (e) {
+      console.log('RESULT THREW ' + e.code);
+    }
+    console.log('AUDIT ' + JSON.stringify(msgs));
+  `;
+
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8' },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+test('audit mode reaches the real dlopen and logs the denial', () => {
+  const { result, msgs } = run('--permission-audit');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_FAILED');
+  assert.strictEqual(msgs.length, 1);
+  assert.strictEqual(msgs[0].permission, 'Addon');
+});
+
+test('enforce mode still disables dlopen upfront', () => {
+  const { result } = run('--permission');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_DISABLED');
+});
diff --git a/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
new file mode 100644
index 000000000000..f2d98a0b6f83
--- /dev/null
+++ b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
@@ -0,0 +1,144 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not deny fs.lstat() and
+// fs.symlink(), whose permission checks live in the JavaScript layer, while
+// --permission still denies them. Audit mode must publish the denial through
+// the diagnostics channel and let the operation continue. Each API is covered
+// in its three flavours (sync, callback and promise), since every flavour
+// carries its own copy of the check.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const blockedFile = fixtures.path('permission', 'deny', 'protected-file.md');
+
+function run(flag, { op, name }) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:fs', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    (async () => {
+      try {
+        await (${op});
+        console.log('RESULT NO_THROW');
+      } catch (e) {
+        console.log('RESULT THREW ' + e.code);
+      }
+      console.log('AUDIT ' + JSON.stringify(msgs));
+    })();
+  `;
+
+  const env = {
+    ...process.env,
+    BLOCKED_FILE: blockedFile,
+    LINK_PATH: tmpdir.resolve(`audit-symlink-${flag.replace(/\W/g, '')}-${name}`),
+  };
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8', env },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+const lstatOps = [
+  {
+    name: 'lstatSync',
+    api: 'fs.lstatSync()',
+    op: 'require("node:fs").lstatSync(process.env.BLOCKED_FILE)',
+  },
+  {
+    name: 'lstatCallback',
+    api: 'fs.lstat()',
+    op: 'new Promise((resolve, reject) => require("node:fs").lstat(' +
+      'process.env.BLOCKED_FILE, (err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'lstatPromises',
+    api: 'fsPromises.lstat()',
+    op: 'require("node:fs").promises.lstat(process.env.BLOCKED_FILE)',
+  },
+];
+
+const symlinkOps = [
+  {
+    name: 'symlinkSync',
+    api: 'fs.symlinkSync()',
+    op: 'require("node:fs").symlinkSync(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+  {
+    name: 'symlinkCallback',
+    api: 'fs.symlink()',
+    op: 'new Promise((resolve, reject) => require("node:fs").symlink(' +
+      'process.env.BLOCKED_FILE, process.env.LINK_PATH, ' +
+      '(err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'symlinkPromises',
+    api: 'fsPromises.symlink()',
+    op: 'require("node:fs").promises.symlink(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+];
+
+tmpdir.refresh();
+
+for (const entry of lstatOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, () => {
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.strictEqual(msgs.length, 1);
+    assert.strictEqual(msgs[0].permission, 'FileSystemRead');
+    assert.ok(msgs[0].resource.endsWith('protected-file.md'));
+  });
+
+  test(`enforce mode still denies ${entry.api}`, () => {
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
+
+for (const entry of symlinkOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.ok(
+      msgs.some((m) => m.permission === 'FileSystem'),
+      JSON.stringify(msgs),
+    );
+  });
+
+  test(`enforce mode still denies ${entry.api}`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
diff --git a/test/parallel/test-permission-dlopen-binary.js b/test/parallel/test-permission-dlopen-binary.js
new file mode 100644
index 000000000000..3bf2321564fc
--- /dev/null
+++ b/test/parallel/test-permission-dlopen-binary.js
@@ -0,0 +1,113 @@
+// Flags: --expose-internals
+'use strict';
+
+// Loading an addon from bytes materializes them into an image in the temporary
+// directory, so dlopenBinary() requires file-system write access on top of the
+// addon permission every dlopen already needs. Granting only one of the two is
+// not enough.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+
+// Loads the addon from bytes at a path that does not exist on disk, as an
+// addon served by a virtual file system would be, and reports what happened.
+const child = `
+  const { internalBinding } = require('internal/test/binding');
+  const fs = require('fs');
+  const os = require('os');
+  const path = require('path');
+  const { dlopenBinary } = internalBinding('process_methods');
+  const bytes = fs.readFileSync(${JSON.stringify(addonPath)});
+  const target = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+  const m = { exports: {} };
+  try {
+    dlopenBinary(m, target, undefined, bytes);
+    console.log('LOADED', m.exports.hello());
+  } catch (err) {
+    console.log('DENIED', err.code, err.permission ?? '');
+  }
+`;
+
+function run(...permissions) {
+  return spawnSync(
+    process.execPath,
+    ['--expose-internals', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', child],
+    { encoding: 'utf8' });
+}
+
+// Both permissions granted: the addon loads.
+{
+  const res = run('--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// Addons allowed but no write access: refused by the file-system check, so the
+// bytes are never materialized.
+{
+  const res = run('--allow-addons');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
+
+// Write access but addons disallowed: refused before the bytes are looked at,
+// the same as any other dlopen under the permission model.
+{
+  const res = run('--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_DLOPEN_DISABLED/);
+}
+
+// Without the permission model neither check applies.
+{
+  const res = spawnSync(process.execPath, ['--expose-internals', '-e', child],
+                        { encoding: 'utf8' });
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// The same, reached the way a program actually gets here: an addon inside a
+// mounted VFS. Mounting one under the permission model needs --allow-fs-vfs.
+{
+  const mounted = `
+    const fs = require('fs');
+    const vfs = require('node:vfs');
+    const myVfs = vfs.create();
+    myVfs.writeFileSync('/binding.node',
+                        fs.readFileSync(${JSON.stringify(addonPath)}));
+    const mountPoint = myVfs.mount();
+    try {
+      console.log('LOADED', require(mountPoint + '/binding.node').hello());
+    } catch (err) {
+      console.log('DENIED', err.code, err.permission ?? '');
+    }
+  `;
+  const vfsRun = (...permissions) => spawnSync(
+    process.execPath,
+    ['--experimental-vfs', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', mounted],
+    { encoding: 'utf8' });
+
+  const ok = vfsRun('--allow-fs-vfs', '--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(ok.status, 0, ok.stderr);
+  assert.match(ok.stdout, /LOADED world/);
+
+  // Mounting itself is refused without --allow-fs-vfs.
+  const noVfs = vfsRun('--allow-addons', '--allow-fs-write=*');
+  assert.notStrictEqual(noVfs.status, 0);
+  assert.match(noVfs.stderr, /ERR_INVALID_STATE/);
+  assert.match(noVfs.stderr, /--allow-fs-vfs/);
+
+  // Mounted, addons allowed, but no write access: the addon is refused.
+  const noWrite = vfsRun('--allow-fs-vfs', '--allow-addons');
+  assert.strictEqual(noWrite.status, 0, noWrite.stderr);
+  assert.match(noWrite.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
diff --git a/test/parallel/test-permission-drop-ffi.js b/test/parallel/test-permission-drop-ffi.js
index f0d4093b6d84..84d5877b1e0d 100644
--- a/test/parallel/test-permission-drop-ffi.js
+++ b/test/parallel/test-permission-drop-ffi.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-ffi --experimental-ffi --allow-fs-read=*
+// Flags: --permission --allow-ffi --allow-fs-read=*
 'use strict';
 
 const common = require('../common');
diff --git a/test/parallel/test-permission-fs-filehandle-sync.js b/test/parallel/test-permission-fs-filehandle-sync.js
new file mode 100644
index 000000000000..28e9da734c85
--- /dev/null
+++ b/test/parallel/test-permission-fs-filehandle-sync.js
@@ -0,0 +1,33 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const { open } = require('fs/promises');
+const fixtures = require('../common/fixtures');
+
+const regularFile = fixtures.path('permission', 'deny', 'regular-file.md');
+
+// FileHandle sync operations must be blocked when the permission model is
+// enabled, consistent with fs.fsync() / fs.fsyncSync() and fdatasync variants.
+(async () => {
+  const fh = await open(regularFile, 'r');
+  try {
+    await assert.rejects(
+      fh.sync(),
+      common.expectsError({ code: 'ERR_ACCESS_DENIED' }),
+    );
+    await assert.rejects(
+      fh.datasync(),
+      common.expectsError({ code: 'ERR_ACCESS_DENIED' }),
+    );
+  } finally {
+    await fh.close();
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-permission-fs-write-v8.js b/test/parallel/test-permission-fs-write-v8.js
index a8b8fd4d579b..8e4810e8e2bb 100644
--- a/test/parallel/test-permission-fs-write-v8.js
+++ b/test/parallel/test-permission-fs-write-v8.js
@@ -43,3 +43,12 @@ const path = require('path');
     permission: 'FileSystemWrite',
   }));
 }
+
+{
+  assert.throws(() => {
+    v8.setHeapProfileNearHeapLimit(1);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+}
diff --git a/test/parallel/test-permission-has-reference-types.js b/test/parallel/test-permission-has-reference-types.js
new file mode 100644
index 000000000000..8509046dc5ee
--- /dev/null
+++ b/test/parallel/test-permission-has-reference-types.js
@@ -0,0 +1,48 @@
+'use strict';
+
+// Test that process.permission.has()/drop() accept a URL or Uint8Array reference.
+
+require('../common');
+const { spawnSync } = require('child_process');
+const assert = require('assert');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  process.exit(0);
+}
+
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const fs = require('fs');
+const path = require('path');
+
+tmpdir.refresh();
+
+const allowedDir = path.join(tmpdir.path, 'allowed');
+const deniedDir = path.join(tmpdir.path, 'denied');
+fs.mkdirSync(allowedDir);
+fs.mkdirSync(deniedDir);
+
+const allowedFile = path.join(allowedDir, 'a.txt');
+const deniedFile = path.join(deniedDir, 'b.txt');
+fs.writeFileSync(allowedFile, 'allowed');
+fs.writeFileSync(deniedFile, 'denied');
+
+const { status, stderr } = spawnSync(
+  process.execPath,
+  [
+    '--permission',
+    `--allow-fs-read=${allowedDir}`,
+    fixtures.path('permission', 'has-reference-types.js'),
+  ],
+  {
+    env: {
+      ...process.env,
+      ALLOWED_DIR: allowedDir,
+      ALLOWED_FILE: allowedFile,
+      DENIED_FILE: deniedFile,
+    },
+  },
+);
+
+assert.strictEqual(status, 0, stderr.toString());
diff --git a/test/parallel/test-permission-net-dtls.mjs b/test/parallel/test-permission-net-dtls.mjs
new file mode 100644
index 000000000000..54c6235b3df1
--- /dev/null
+++ b/test/parallel/test-permission-net-dtls.mjs
@@ -0,0 +1,66 @@
+// Flags: --permission --allow-fs-read=* --experimental-dtls --no-warnings
+import { hasCrypto, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const { connect, listen, DTLSEndpoint } = await import('node:dtls');
+
+// Verify that the permission system correctly reports no net access.
+assert.ok(!process.permission.has('net'));
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const fixturesDir = join(__dirname, '..', 'fixtures', 'keys');
+const cert = readFileSync(join(fixturesDir, 'agent1-cert.pem')).toString();
+const key = readFileSync(join(fixturesDir, 'agent1-key.pem')).toString();
+const ca = readFileSync(join(fixturesDir, 'ca1-cert.pem')).toString();
+
+// Test: connect() should throw ERR_ACCESS_DENIED
+{
+  assert.throws(
+    () => connect('127.0.0.1', 12345, { ca: [ca], rejectUnauthorized: false }),
+    {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'Net',
+    },
+  );
+}
+
+// Test: listen() should throw ERR_ACCESS_DENIED
+{
+  assert.throws(
+    () => listen(mustNotCall('onsession should not be called'), {
+      cert,
+      key,
+      port: 0,
+      host: '127.0.0.1',
+    }),
+    {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'Net',
+    },
+  );
+}
+
+// Test: Creating a DTLSEndpoint is allowed (no network I/O at construction
+// time), but bind() requires net permission.
+{
+  const endpoint = new DTLSEndpoint();
+  assert.ok(endpoint);
+  assert.throws(
+    () => endpoint.bind('127.0.0.1', 0),
+    {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'Net',
+    },
+  );
+}
diff --git a/test/parallel/test-permission-net-udp-handle.js b/test/parallel/test-permission-net-udp-handle.js
index b6925421f829..10e90610d0c1 100644
--- a/test/parallel/test-permission-net-udp-handle.js
+++ b/test/parallel/test-permission-net-udp-handle.js
@@ -60,6 +60,7 @@ if (mode === 'ipc-denied') {
   const droppedSocket = dgram.createSocket('udp4');
   const sender = dgram.createSocket('udp4');
   droppedSocket.bind(0, '127.0.0.1', common.mustCall(() => {
+    const { port } = droppedSocket.address();
     const child = fork(__filename, ['ipc-drop'], {
       execArgv: [
         '--permission',
@@ -73,7 +74,10 @@ if (mode === 'ipc-denied') {
       if (message === 'ready') {
         child.send('socket', droppedSocket);
       } else if (message === 'receiving') {
-        const { port } = droppedSocket.address();
+        // Sending the socket over IPC keeps this copy open and receiving, so
+        // both ends compete for incoming datagrams. Stop receiving before the
+        // first one goes out.
+        droppedSocket.close();
         timer = setInterval(() => {
           sender.send('after-drop', port, '127.0.0.1');
         }, 10);
@@ -81,7 +85,6 @@ if (mode === 'ipc-denied') {
         assert.strictEqual(message, 'received');
         clearInterval(timer);
         sender.close();
-        droppedSocket.close();
         child.disconnect();
       }
     }, 3));
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 6028bbab787e..8349d4c3af6f 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -72,6 +72,7 @@ const conditionalOpts = [
         '--secure-heap',
         '--secure-heap-min',
         '--enable-fips',
+        '--enable-fips-indicator-events',
         '--force-fips',
       ].includes(opt);
     }
diff --git a/test/parallel/test-process-features.js b/test/parallel/test-process-features.js
index 2af4808b6c59..e12ae0029080 100644
--- a/test/parallel/test-process-features.js
+++ b/test/parallel/test-process-features.js
@@ -10,6 +10,7 @@ const expectedKeys = new Map([
   ['uv', ['boolean']],
   ['ipv6', ['boolean']],
   ['openssl_is_boringssl', ['boolean']],
+  ['dtls', ['boolean', 'undefined']],
   ['quic', ['boolean', 'undefined']],
   ['tls_alpn', ['boolean']],
   ['tls_sni', ['boolean']],
diff --git a/test/parallel/test-process-get-builtin.mjs b/test/parallel/test-process-get-builtin.mjs
index 5cbf28430109..7dd7b641bbf9 100644
--- a/test/parallel/test-process-get-builtin.mjs
+++ b/test/parallel/test-process-get-builtin.mjs
@@ -36,6 +36,8 @@ if (!hasIntl) {
   publicBuiltins.delete('inspector');
   publicBuiltins.delete('trace_events');
 }
+// TODO(@jasnell): Remove this once node:dtls graduates from unflagged.
+publicBuiltins.delete('node:dtls');
 // TODO(@jasnell): Remove this once node:quic graduates from unflagged.
 publicBuiltins.delete('node:quic');
 // Remove this once node:vfs graduates from unflagged.
@@ -49,9 +51,6 @@ if (!hasSQLite) {
   publicBuiltins.delete('node:sqlite');
 }
 
-// TODO: Remove this once node:ffi graduates from unflagged.
-publicBuiltins.delete('node:ffi');
-
 for (const id of publicBuiltins) {
   assert.strictEqual(process.getBuiltinModule(id), require(id));
 }
diff --git a/test/parallel/test-quic-alpn.mjs b/test/parallel/test-quic-alpn.mjs
index a7680dd05a5a..9ca3d40e4fef 100644
--- a/test/parallel/test-quic-alpn.mjs
+++ b/test/parallel/test-quic-alpn.mjs
@@ -1,6 +1,6 @@
 // Flags: --experimental-quic --no-warnings
 
-import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
 import assert from 'node:assert';
 import * as fixtures from '../common/fixtures.mjs';
 
@@ -44,3 +44,10 @@ const clientSession = await connect(serverEndpoint.address, {
 await Promise.all([serverOpened.promise, checkSession(clientSession)]);
 await clientSession.close();
 await serverEndpoint.close();
+
+// QUIC requires an application protocol, so a server that offers none is
+// rejected when the endpoint is configured rather than at handshake time.
+await assert.rejects(listen(mustNotCall(), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  alpn: [],
+}), { code: 'ERR_INVALID_ARG_VALUE' });
diff --git a/test/parallel/test-quic-early-selection-order.mjs b/test/parallel/test-quic-early-selection-order.mjs
new file mode 100644
index 000000000000..f7cc89fb04c0
--- /dev/null
+++ b/test/parallel/test-quic-early-selection-order.mjs
@@ -0,0 +1,118 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: the server stops the TLS handshake at the ClientHello, so a session
+// reaches JavaScript before anything that belongs to it - even a 0-RTT
+// request the client put in its very first flight. The stop also has to
+// survive the ClientHello being seen more than once.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+// Send two requests, the 2nd via 0RTT, make sure the stream event always
+// fires _after_ the session event has completed (even though 0RTT is
+// delivered already in the first flight - delivery must be deferred).
+{
+  let ticket;
+  let token;
+  const gotTicket = Promise.withResolvers();
+  const gotToken = Promise.withResolvers();
+
+  const endpoint = await listen(mustCall((ss) => {
+    // No streams initially, stream must arrive in the onstream event, for
+    // both the normal and the 0RTT sessions:
+    assert.strictEqual(ss.stats.bidiInStreamCount, 0n);
+    ss.onstream = mustCall(async (stream) => {
+      await stream.closed;
+      ss.close();
+    });
+  }, 2), {
+    alpn: ['h3'],
+    onheaders: mustCall(function() {
+      this.sendHeaders({ ':status': '200' });
+      this.writer.writeSync(encoder.encode('hello'));
+      this.writer.endSync();
+    }, 2),
+  });
+
+  const request = {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  };
+
+  // Open a 1st session, send a request, get session ticket & token:
+  const cs1 = await connect(endpoint.address, {
+    servername: 'localhost',
+    alpn: 'h3',
+    onsessionticket: mustCall((t) => { ticket = t; gotTicket.resolve(); }, 2),
+    onnewtoken: mustCall((t) => { token = t; gotToken.resolve(); }),
+  });
+  await cs1.opened;
+  await Promise.all([gotTicket.promise, gotToken.promise]);
+  const s1 = await cs1.createBidirectionalStream({
+    headers: request,
+    onheaders: mustCall(),
+  });
+  await bytes(s1);
+  await Promise.all([s1.closed, cs1.closed]);
+
+  // Open 2nd session, reusing the ticket & token:
+  const cs2 = await connect(endpoint.address, {
+    servername: 'localhost',
+    alpn: 'h3',
+    sessionTicket: ticket,
+    token,
+  });
+
+  // Send a 0RTT request immediately, before the handshake completes:
+  const s2 = await cs2.createBidirectionalStream({
+    headers: request,
+    onheaders: mustCall(),
+  });
+
+  const info = await cs2.opened;
+  assert.strictEqual(info.earlyDataAccepted, true);
+  assert.strictEqual(decoder.decode(await bytes(s2)), 'hello');
+  await Promise.all([s2.closed, cs2.closed]);
+  await endpoint.close();
+}
+
+// When a handshake does HelloRetryRequest (HRR) and runs the hello flow twice,
+// we must preserve the ALPN and server name selection from the first hello. To
+// trigger this, we send a hello with an offer for X25519 & P-521, but only a
+// key share for X25519 (the *) so an automatic HRR is required.
+{
+  const serverDone = Promise.withResolvers();
+  const endpoint = await listen(mustCall((ss) => {
+    ss.opened.then(mustCall((info) => {
+      assert.strictEqual(info.servername, 'example.test');
+      assert.strictEqual(info.protocol, 'quic-test');
+      serverDone.resolve();
+    }));
+  }), { groups: 'P-521' });
+
+  const cs = await connect(endpoint.address, {
+    servername: 'example.test',
+    groups: '*X25519:P-521',
+  });
+
+  const info = await cs.opened;
+  assert.strictEqual(info.protocol, 'quic-test');
+  // Validate the HRR happened: we fell back to 2nd group
+  assert.strictEqual(cs.ephemeralKeyInfo.name, 'secp521r1');
+
+  await serverDone.promise;
+  cs.close();
+  await endpoint.close();
+}
diff --git a/test/parallel/test-quic-flow-control-bidi-simultaneous-volume.mjs b/test/parallel/test-quic-flow-control-bidi-simultaneous-volume.mjs
new file mode 100644
index 000000000000..24919cea1181
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-bidi-simultaneous-volume.mjs
@@ -0,0 +1,102 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: large simultaneous transfers in both directions on one stream,
+// through constrained windows in both directions.
+//
+// Each direction of a bidirectional stream has its own independent flow
+// control window, governed by different transport parameters:
+//
+//   client -> server  is limited by the server's
+//                     initialMaxStreamDataBidiRemote
+//   server -> client  is limited by the client's
+//                     initialMaxStreamDataBidiLocal
+//
+// Running both directions at volume at the same time means credit is being
+// consumed and returned in both directions concurrently on the same stream.
+// A bug that credits the wrong direction, or that lets one direction's
+// accounting interfere with the other's, shows up here but not in the
+// one-direction-at-a-time tests.
+//
+// This exercises the raw QUIC application: the test helpers negotiate the
+// 'quic-test' ALPN, not HTTP/3. See test-quic-h3-flow-control-volume.mjs for
+// the HTTP/3 equivalent.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const kTotal = 4 * 1024 * 1024;         // per direction
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+assert.ok(kTotal / kConnWindow >= 100,
+          'payload must require >=100 connection window refills');
+
+// Distinct payloads per direction so a direction mixup is detectable.
+const toServer = makePayload(kTotal, 11);
+const toClient = makePayload(kTotal, 22);
+const toServerHash = hashBytes(toServer);
+const toClientHash = hashBytes(toClient);
+
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    // Start sending before reading, so both directions are in flight at
+    // once. If the server read to completion first, the two directions
+    // would be sequential and the test would prove much less.
+    stream.setBody(toClient);
+
+    const received = await bytes(stream);
+    assert.strictEqual(received.byteLength, kTotal);
+    // Must be the client->server payload, not an echo of our own.
+    assert.strictEqual(hashBytes(received), toServerHash);
+
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  transportParams: {
+    // Limits client -> server.
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  transportParams: {
+    // Limits server -> client.
+    initialMaxStreamDataBidiLocal: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+await clientSession.opened;
+
+const stream = await clientSession.createBidirectionalStream();
+stream.setBody(toServer);
+
+// Read the server's payload while our own body is still being sent.
+const received = await bytes(stream);
+assert.strictEqual(received.byteLength, kTotal);
+// Must be the server->client payload, not an echo of our own.
+assert.strictEqual(hashBytes(received), toClientHash);
+
+// Sanity: the two directions carried genuinely different data, so the
+// assertions above could not both be satisfied by one payload echoed back.
+assert.notStrictEqual(toServerHash, toClientHash);
+
+await Promise.all([stream.closed, serverDone.promise]);
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-flow-control-concurrent-volume.mjs b/test/parallel/test-quic-flow-control-concurrent-volume.mjs
new file mode 100644
index 000000000000..b3f2c9a62450
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-concurrent-volume.mjs
@@ -0,0 +1,130 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: many concurrent streams contending for one constrained
+// connection-level flow control window, at volume.
+//
+// The connection-level window (initialMaxData) is shared by every stream on
+// the session, while each stream also has its own window. When several
+// streams are all trying to move data through a connection window smaller
+// than any single stream's payload, the connection-level credit has to be
+// recycled continuously and shared across them.
+//
+// This is the configuration most likely to expose credit accounting errors:
+// per-stream bugs that cancel out on a single stream become visible when
+// several streams draw on the same pool, and any net under-crediting
+// deadlocks every stream at once rather than just slowing one down.
+//
+// This exercises the raw QUIC application: the test helpers negotiate the
+// 'quic-test' ALPN, not HTTP/3. See test-quic-h3-flow-control-volume.mjs for
+// the HTTP/3 equivalent.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const kStreams = 8;
+const kPerStream = 512 * 1024;          // 4 MB total
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;          // Shared by all 8 streams
+
+const kTotal = kStreams * kPerStream;
+
+assert.ok(kConnWindow < kPerStream,
+          'connection window must be smaller than a single stream payload');
+assert.ok(kTotal / kConnWindow >= 100,
+          'aggregate payload must require >=100 connection window refills');
+
+// Distinct payload per stream so a cross-stream mixup is detectable, not
+// just a wrong byte total.
+const payloads = [];
+const hashes = [];
+for (let i = 0; i < kStreams; i++) {
+  const p = makePayload(kPerStream, i + 1);
+  payloads.push(p);
+  hashes.push(hashBytes(p));
+}
+
+// Map each received payload back to the stream that sent it. The server has
+// no ordering guarantee across streams, so match by hash rather than by
+// arrival order.
+const remaining = new Set(hashes);
+const serverDone = Promise.withResolvers();
+let completed = 0;
+
+// Track how many streams are being read at the same time. The whole premise
+// of this test is contention for the shared connection window, so if the
+// streams end up serialized the test still passes but proves much less.
+// Assert the overlap explicitly rather than trusting it.
+let openStreams = 0;
+let maxOpenStreams = 0;
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    openStreams++;
+    maxOpenStreams = Math.max(maxOpenStreams, openStreams);
+
+    const received = await bytes(stream);
+    openStreams--;
+    assert.strictEqual(received.byteLength, kPerStream);
+
+    const h = hashBytes(received);
+    // Each payload must arrive exactly once, intact. This catches data from
+    // one stream being credited or delivered onto another.
+    assert.ok(remaining.has(h),
+              'received payload did not match any expected stream payload');
+    remaining.delete(h);
+
+    stream.writer.endSync();
+    await stream.closed;
+    if (++completed === kStreams) {
+      serverSession.close();
+      serverDone.resolve();
+    }
+  }, kStreams);
+}), {
+  transportParams: {
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+    // Allow all streams to be open at once; the point is contention.
+    initialMaxStreamsBidi: kStreams,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const clientSession = await connect(serverEndpoint.address);
+await clientSession.opened;
+
+// Start every stream before draining any of them, so they genuinely contend
+// for the shared connection window rather than running one after another.
+const streams = [];
+for (let i = 0; i < kStreams; i++) {
+  const stream = await clientSession.createBidirectionalStream();
+  stream.setBody(payloads[i]);
+  streams.push(stream);
+}
+
+await Promise.all(streams.map(async (stream) => {
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await stream.closed;
+}));
+
+await serverDone.promise;
+// Every stream's payload must have arrived exactly once.
+assert.strictEqual(remaining.size, 0);
+// All streams are created before any is drained, so all of them should be
+// open simultaneously. Anything less means they serialized and the window
+// contention this test exists to exercise did not actually happen.
+assert.strictEqual(maxOpenStreams, kStreams,
+                   'all streams must be open simultaneously to contend for ' +
+                   'the shared connection window');
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-flow-control-credit-reclaim.mjs b/test/parallel/test-quic-flow-control-credit-reclaim.mjs
new file mode 100644
index 000000000000..f5dcedad1cce
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-credit-reclaim.mjs
@@ -0,0 +1,98 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: connection-level flow control credit is reclaimed for inbound data
+// that is never consumed.
+//
+// Every byte QUIC delivers to us is charged against both the stream-level
+// and the connection-level receive window. The stream-level window dies with
+// the stream, but the connection-level window (`initialMaxData`) is shared by
+// every stream on the session and is only replenished when we send MAX_DATA.
+//
+// If a stream is destroyed while inbound data is still sitting unread, that
+// credit must still be returned, otherwise the session's receive window
+// shrinks a little on every such stream until the connection deadlocks.
+//
+// This test destroys many streams without reading their responses, moving far
+// more data in total than `initialMaxData` allows to be outstanding at once.
+// It only completes if the credit is reclaimed on destroy.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('../common/quic.mjs');
+
+const encoder = new TextEncoder();
+
+// Each response is 16 KB and the connection-level window is 64 KB, so the
+// session can only ever have 4 unread responses outstanding. Running 20
+// streams pushes 320 KB total -- 5x the window -- which can only work if the
+// window is replenished as each stream is discarded.
+const kPayloadSize = 16 * 1024;
+const kInitialMaxData = 64 * 1024;
+const kStreamCount = 20;
+
+const payload = encoder.encode('a'.repeat(kPayloadSize));
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  // One response per client stream, plus the final health-check stream.
+  serverSession.onstream = mustCall((stream) => {
+    // Respond and immediately finish. We never read the request body.
+    stream.setBody(payload);
+  }, kStreamCount + 1);
+}));
+
+const clientSession = await connect(serverEndpoint.address, {
+  transportParams: {
+    // Connection-level receive window, shared by all streams.
+    initialMaxData: kInitialMaxData,
+    // Give each individual stream enough room for a whole response so that
+    // the connection-level window is the only thing that can throttle us.
+    initialMaxStreamDataBidiLocal: kPayloadSize * 2,
+  },
+});
+await clientSession.opened;
+
+for (let i = 0; i < kStreamCount; i++) {
+  const stream = await clientSession.createBidirectionalStream({
+    body: encoder.encode('request'),
+  });
+
+  // Wait until the whole response has actually been received, so that the
+  // bytes are genuinely holding flow control credit at the point we destroy
+  // the stream. If credit is leaked, this loop is where later iterations
+  // stall: the server runs out of connection-level window and can no longer
+  // send, so bytesReceived never reaches the payload size.
+  while (stream.stats.bytesReceived < kPayloadSize) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+
+  // Destroy with the response still buffered and unread. This is the case
+  // that used to leak: the backpressure listener is detached, so nothing
+  // would ever return the credit for these bytes.
+  stream.destroy();
+}
+
+// Getting here at all is the assertion -- a leak manifests as a timeout
+// above. Verify the session is still healthy and able to move data, which
+// confirms the window was replenished rather than merely limping along.
+{
+  const stream = await clientSession.createBidirectionalStream({
+    body: encoder.encode('request'),
+  });
+  let received = 0;
+  for await (const chunks of stream) {
+    for (const chunk of chunks) received += chunk.byteLength;
+  }
+  assert.strictEqual(received, kPayloadSize);
+}
+
+await clientSession.close();
+await serverEndpoint.close();
+
+// Sanity check that the test actually exercised the intended path.
+assert.ok(kPayloadSize * kStreamCount > kInitialMaxData,
+          'test must move more data than the connection window allows');
diff --git a/test/parallel/test-quic-flow-control-large-constrained.mjs b/test/parallel/test-quic-flow-control-large-constrained.mjs
new file mode 100644
index 000000000000..db73141528b1
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-large-constrained.mjs
@@ -0,0 +1,121 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: high volume transfer through a deliberately constrained flow
+// control window.
+//
+// The existing flow control tests either move a small amount of data through
+// a tiny window, or a large amount of data through the default (large)
+// window. Neither combination stresses the credit accounting: a bug that
+// mis-credits a few bytes per window extension is invisible over 8KB but
+// fatal over several megabytes.
+//
+// Here the payload is orders of magnitude larger than both the stream-level
+// and connection-level receive windows, so completing the transfer requires
+// hundreds of MAX_STREAM_DATA / MAX_DATA extensions. If any extension
+// under-credits, the transfer stalls and the test times out; if any
+// over-credits or misorders data, the hash check fails.
+
+import { hasQuic, skip, mustCall, mustCallAtLeast } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+// 4 MB through a 16 KB stream window and a 32 KB connection window. The
+// windows are capped via maxStreamWindow/maxWindow as well, otherwise
+// ngtcp2's window auto-tuning grows them and the transfer stops being
+// flow-control bound.
+const kTotal = 4 * 1024 * 1024;
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+// Guard: the point of this test is that the window has to be recycled many
+// times over. If someone lowers kTotal or raises the windows to speed the
+// test up, this makes the loss of coverage explicit rather than silent.
+assert.ok(kTotal / kConnWindow >= 100,
+          'payload must require >=100 connection window refills');
+assert.ok(kTotal / kStreamWindow >= 100,
+          'payload must require >=100 stream window refills');
+
+const transportParams = {
+  initialMaxStreamDataBidiRemote: kStreamWindow,
+  initialMaxStreamDataUni: kStreamWindow,
+  initialMaxData: kConnWindow,
+};
+const windowCaps = {
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+};
+
+// Bidirectional: client sends a large body, server verifies it.
+{
+  const payload = makePayload(kTotal);
+  const expectedHash = hashBytes(payload);
+  const serverDone = Promise.withResolvers();
+
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onstream = mustCall(async (stream) => {
+      const received = await bytes(stream);
+      assert.strictEqual(received.byteLength, kTotal);
+      // Order-sensitive hash: catches duplicated, dropped, or reordered
+      // regions that preserve the total length.
+      assert.strictEqual(hashBytes(received), expectedHash);
+      stream.writer.endSync();
+      await stream.closed;
+      serverSession.close();
+      serverDone.resolve();
+    });
+  }), { transportParams, ...windowCaps });
+
+  const clientSession = await connect(serverEndpoint.address);
+  await clientSession.opened;
+
+  const stream = await clientSession.createBidirectionalStream();
+
+  // Assert the sender actually hit the window. Without this the test could
+  // pass trivially if the windows were silently widened, and we would lose
+  // the coverage without noticing.
+  stream.onblocked = mustCallAtLeast(1);
+
+  stream.setBody(payload);
+
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await Promise.all([stream.closed, serverDone.promise]);
+  await clientSession.close();
+  await serverEndpoint.close();
+}
+
+// Unidirectional: same volume, exercises the uni credit path, which uses
+// different transport parameters and a different stream type.
+{
+  const payload = makePayload(kTotal, 7);
+  const expectedHash = hashBytes(payload);
+  const serverDone = Promise.withResolvers();
+
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onstream = mustCall(async (stream) => {
+      const received = await bytes(stream);
+      assert.strictEqual(received.byteLength, kTotal);
+      assert.strictEqual(hashBytes(received), expectedHash);
+      await stream.closed;
+      serverSession.close();
+      serverDone.resolve();
+    });
+  }), { transportParams, ...windowCaps });
+
+  const clientSession = await connect(serverEndpoint.address);
+  await clientSession.opened;
+
+  const stream = await clientSession.createUnidirectionalStream();
+  stream.onblocked = mustCallAtLeast(1);
+  stream.setBody(payload);
+
+  await Promise.all([stream.closed, serverDone.promise]);
+  await clientSession.close();
+  await serverEndpoint.close();
+}
diff --git a/test/parallel/test-quic-flow-control-slow-consumer-volume.mjs b/test/parallel/test-quic-flow-control-slow-consumer-volume.mjs
new file mode 100644
index 000000000000..52e6a92512ef
--- /dev/null
+++ b/test/parallel/test-quic-flow-control-slow-consumer-volume.mjs
@@ -0,0 +1,116 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: a slow consumer keeps buffered data bounded by the flow control
+// window, over a transfer far larger than that window.
+//
+// The existing slow-consumer test only checks that a small transfer still
+// completes and that onblocked fired. The stronger property -- that the
+// receiver never buffers more than the window allows, no matter how far
+// behind the consumer falls -- needs volume to be meaningful, because it is
+// the *repeated* refusal to over-credit that keeps memory bounded.
+//
+// Credit for inbound data is only returned once the consumer actually reads
+// it, so if the receiver ever credited data it had merely buffered, the
+// sender would be free to run arbitrarily far ahead and buffered bytes would
+// grow without bound. Asserting a ceiling on maxBytesAccumulated over a
+// multi-megabyte transfer is a direct check that this does not happen.
+
+import { hasQuic, skip, mustCall, mustCallAtLeast } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload, hashBytes } =
+  await import('../common/quic.mjs');
+const { setImmediate: yieldToLoop } = await import('node:timers/promises');
+
+const kTotal = 4 * 1024 * 1024;
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+// Yield to the event loop every few reads. This lets the sender run as far
+// ahead as flow control permits without adding wall-clock delay to the test.
+const kYieldEvery = 4;
+
+assert.ok(kTotal / kStreamWindow >= 100,
+          'payload must be far larger than the window to be meaningful');
+
+const payload = makePayload(kTotal, 5);
+const expectedHash = hashBytes(payload);
+
+const serverDone = Promise.withResolvers();
+let peakAccumulated = 0;
+let received = 0;
+const parts = [];
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    let reads = 0;
+    for await (const chunks of stream) {
+      for (const chunk of chunks) {
+        received += chunk.byteLength;
+        parts.push(chunk);
+      }
+
+      // maxBytesAccumulated is the high water mark of data that has been
+      // received but not yet consumed.
+      const accumulated = Number(stream.stats.maxBytesAccumulated);
+      if (accumulated > peakAccumulated) peakAccumulated = accumulated;
+
+      if (++reads % kYieldEvery === 0) await yieldToLoop();
+    }
+
+    stream.writer.endSync();
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  transportParams: {
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const clientSession = await connect(serverEndpoint.address);
+await clientSession.opened;
+
+const stream = await clientSession.createBidirectionalStream();
+// The sender must actually hit the window, otherwise the consumer was not
+// slow relative to the sender and the ceiling below proves nothing.
+stream.onblocked = mustCallAtLeast(1);
+stream.setBody(payload);
+
+for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+await Promise.all([stream.closed, serverDone.promise]);
+
+// Integrity first: bounded buffering is only interesting if no data was lost.
+assert.strictEqual(received, kTotal);
+const assembled = new Uint8Array(received);
+let offset = 0;
+for (const part of parts) {
+  assembled.set(part, offset);
+  offset += part.byteLength;
+}
+assert.strictEqual(hashBytes(assembled), expectedHash);
+
+// Upper bound: buffered-but-unread data never exceeded the window, even
+// though the payload was 256x the window. This is the property that keeps
+// receiver memory bounded regardless of consumer speed.
+assert.ok(peakAccumulated <= kStreamWindow,
+          `buffered data (${peakAccumulated}) must stay within the flow ` +
+          `control window (${kStreamWindow})`);
+
+// Lower bound: the buffer genuinely filled up. Without this the ceiling
+// above could be satisfied trivially by a consumer that kept pace with the
+// sender, which would not test the bound at all.
+assert.ok(peakAccumulated > kStreamWindow / 2,
+          `consumer was not slow enough to exercise the bound, peak ` +
+          `buffered was only ${peakAccumulated}`);
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-flow-control-volume.mjs b/test/parallel/test-quic-h3-flow-control-volume.mjs
new file mode 100644
index 000000000000..e422d1a411ad
--- /dev/null
+++ b/test/parallel/test-quic-h3-flow-control-volume.mjs
@@ -0,0 +1,120 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: HTTP/3 high volume transfer through constrained flow control
+// windows, in both directions.
+//
+// HTTP/3 credits inbound flow control differently from raw QUIC. The bytes
+// consumed by nghttp3 frame parsing are credited as soon as they are read,
+// but DATA frame *payload* is deliberately excluded from that and is instead
+// credited later, when the application actually consumes it. That makes the
+// HTTP/3 receive path a genuinely separate code path from raw QUIC rather
+// than a thin wrapper over it, so it needs its own volume coverage: a
+// mis-credit here (either double counting the payload or never crediting it)
+// would not be caught by the raw QUIC tests.
+//
+// A large request body and a large response body are both pushed through
+// windows far smaller than either, so the transfer only completes if the
+// payload is credited exactly once as it is consumed.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { makePayload, hashBytes } = await import('../common/quic.mjs');
+const { bytes } = await import('stream/iter');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const kTotal = 2 * 1024 * 1024;         // per direction
+const kStreamWindow = 16 * 1024;
+const kConnWindow = 32 * 1024;
+
+assert.ok(kTotal / kStreamWindow >= 100,
+          'payload must be far larger than the window to be meaningful');
+
+// Distinct payloads per direction so a direction mixup is detectable.
+const requestBody = makePayload(kTotal, 31);
+const responseBody = makePayload(kTotal, 41);
+const requestHash = hashBytes(requestBody);
+const responseHash = hashBytes(responseBody);
+assert.notStrictEqual(requestHash, responseHash);
+
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall(async (serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    // Read the large request body. This is the path where DATA payload
+    // credit is deferred until consumption.
+    const body = await bytes(stream);
+    assert.strictEqual(body.byteLength, kTotal);
+    // Must be the request body, intact and in order.
+    assert.strictEqual(hashBytes(body), requestHash);
+
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  transportParams: {
+    initialMaxStreamDataBidiRemote: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+  onheaders: mustCall(function(headers) {
+    assert.strictEqual(headers[':method'], 'POST');
+    this.sendHeaders({ ':status': '200', 'content-type': 'application/octet-stream' });
+    // Send a large response body concurrently with reading the request
+    // body, so both directions are flow-control bound at the same time.
+    this.setBody(responseBody);
+  }),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+  transportParams: {
+    initialMaxStreamDataBidiLocal: kStreamWindow,
+    initialMaxData: kConnWindow,
+  },
+  maxStreamWindow: kStreamWindow,
+  maxWindow: kConnWindow,
+});
+
+const info = await clientSession.opened;
+assert.strictEqual(info.protocol, 'h3');
+
+const headersReceived = Promise.withResolvers();
+
+const stream = await clientSession.createBidirectionalStream({
+  headers: {
+    ':method': 'POST',
+    ':path': '/upload',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  },
+  body: requestBody,
+  onheaders: mustCall(function(headers) {
+    assert.strictEqual(headers[':status'], 200);
+    headersReceived.resolve();
+  }),
+});
+
+await headersReceived.promise;
+
+const received = await bytes(stream);
+assert.strictEqual(received.byteLength, kTotal);
+// Must be the response body, intact and in order.
+assert.strictEqual(hashBytes(received), responseHash);
+
+await Promise.all([stream.closed, serverDone.promise]);
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-stream-destroy-no-resurrect.mjs b/test/parallel/test-quic-h3-stream-destroy-no-resurrect.mjs
new file mode 100644
index 000000000000..c9e05eb245b1
--- /dev/null
+++ b/test/parallel/test-quic-h3-stream-destroy-no-resurrect.mjs
@@ -0,0 +1,97 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: HTTP/3 request streams are not resurrected after being destroyed
+// with response DATA still in flight.
+//
+// This is the HTTP/3 counterpart to test-quic-stream-destroy-no-resurrect.
+// The HTTP/3 receive path finds or creates a Stream for each nghttp3
+// callback, so it has to make the same distinction: a locally-initiated
+// request stream that is no longer tracked was destroyed by the application
+// and must not be recreated when the remaining DATA frames arrive.
+//
+// It also has to keep crediting flow control for the payload it discards.
+// nghttp3 hands DATA payload to the application uncredited (it is excluded
+// from the framing bytes credited when the stream data is read), so silently
+// dropping it would permanently shrink the session's shared receive window --
+// which is why this test runs enough requests to outlast a small window.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { makePayload } = await import('../common/quic.mjs');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const kResponseSize = 256 * 1024;
+const kRequests = 12;
+// Deliberately smaller than the aggregate discarded payload, so the run only
+// completes if discarded DATA is still credited back.
+const kConnWindow = 256 * 1024;
+
+const responseBody = makePayload(kResponseSize, 17);
+
+assert.ok(kResponseSize * kRequests > kConnWindow * 4,
+          'aggregate response data must far exceed the connection window');
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall((stream) => {
+    // The client destroys these early; the truncated write is expected.
+    stream.onerror = () => {};
+  }, kRequests);
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  onheaders: mustCall(function() {
+    this.sendHeaders({ ':status': '200' });
+    this.setBody(responseBody);
+  }, kRequests),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+  transportParams: {
+    initialMaxData: kConnWindow,
+    initialMaxStreamDataBidiLocal: kResponseSize * 2,
+  },
+});
+
+// The client opens every stream itself; the server opens none. Any onstream
+// here is a destroyed request stream being resurrected and misreported as
+// peer-initiated.
+clientSession.onstream = mustNotCall(
+  'client must not receive onstream for its own destroyed request streams');
+
+const info = await clientSession.opened;
+assert.strictEqual(info.protocol, 'h3');
+
+for (let i = 0; i < kRequests; i++) {
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': `/${i}`,
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+  });
+
+  // Take one batch of the response, then abandon the rest and destroy, so
+  // DATA frames keep arriving for a stream we no longer track.
+  // eslint-disable-next-line no-unused-vars
+  for await (const _ of stream) break;
+
+  stream.destroy();
+}
+
+// Exactly one locally-opened stream per request.
+assert.strictEqual(Number(clientSession.stats.bidiOutStreamCount), kRequests);
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-uni-stream-teardown.mjs b/test/parallel/test-quic-h3-uni-stream-teardown.mjs
new file mode 100644
index 000000000000..6f93ef73eb2d
--- /dev/null
+++ b/test/parallel/test-quic-h3-uni-stream-teardown.mjs
@@ -0,0 +1,34 @@
+// Flags: --experimental-quic --no-warnings
+
+// Regression test for https://github.com/nodejs/node/issues/65408.
+// A client-created unidirectional stream is not a valid HTTP/3 request stream,
+// but nghttp3 handles it internally. Destroying the endpoint after receiving
+// data on that stream must not crash during process teardown.
+
+import { hasQuic, skip, mustNotCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { createPrivateKey } = await import('node:crypto');
+const { listen, connect } = await import('node:quic');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const endpoint = await listen(mustNotCall(), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+});
+
+const session = await connect(endpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+
+const stream = await session.createUnidirectionalStream();
+stream.writer.writeSync('x');
+
+endpoint.destroy();
+await endpoint.closed;
diff --git a/test/parallel/test-quic-stream-destroy-no-resurrect.mjs b/test/parallel/test-quic-stream-destroy-no-resurrect.mjs
new file mode 100644
index 000000000000..50687472a64c
--- /dev/null
+++ b/test/parallel/test-quic-stream-destroy-no-resurrect.mjs
@@ -0,0 +1,80 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: destroying a locally-initiated stream with data still in flight does
+// not resurrect it.
+//
+// When a stream is destroyed, its ngtcp2 stream user data is cleared. Inbound
+// STREAM frames the peer had already put in flight then arrive for a stream
+// the receiver no longer tracks. Treating "no user data" as "a stream I have
+// not seen before" is wrong for a stream we initiated ourselves: we are the
+// only party that can create it, so the absence of a record means we
+// destroyed it, not that it is new.
+//
+// Getting this wrong is visible from JavaScript in two ways, both asserted
+// here:
+//
+//   * the session reports far more locally-opened streams than were actually
+//     opened, because a fresh Stream is created for every frame still in
+//     flight
+//   * the application receives onstream events for streams it initiated and
+//     already destroyed, which is a contract violation -- onstream is for
+//     peer-initiated streams
+//
+// It also eventually breaks the session outright: the churn exhausts the
+// local stream budget and createBidirectionalStream() starts throwing
+// ERR_QUIC_OPEN_STREAM_FAILED.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, makePayload } = await import('../common/quic.mjs');
+
+// The payload has to be big enough that the server still has plenty in flight
+// when the client walks away, which is what creates the stale frames.
+const kPayloadSize = 256 * 1024;
+const kStreams = 12;
+
+const payload = makePayload(kPayloadSize, 13);
+
+const serverEndpoint = await listen(mustCall((serverSession) => {
+  serverSession.onstream = mustCall((stream) => {
+    // The client destroys these early, so the write is cut short by
+    // STOP_SENDING. That is the scenario under test, not a failure.
+    stream.onerror = () => {};
+    stream.setBody(payload);
+  }, kStreams);
+}));
+
+const clientSession = await connect(serverEndpoint.address);
+
+// The client never expects an incoming stream: it opens every stream itself
+// and the server opens none. Any onstream event here is a resurrected local
+// stream being mistaken for a peer-initiated one.
+clientSession.onstream = mustNotCall(
+  'client must not receive onstream for its own destroyed streams');
+
+await clientSession.opened;
+
+for (let i = 0; i < kStreams; i++) {
+  const stream = await clientSession.createBidirectionalStream({
+    body: new Uint8Array(8),
+  });
+
+  // Read a little, then abandon the rest and destroy. Breaking out of the
+  // loop leaves the server mid-send, so frames keep arriving after destroy.
+  // eslint-disable-next-line no-unused-vars
+  for await (const _ of stream) break;
+
+  stream.destroy();
+}
+
+// Exactly one locally-opened stream per iteration. Before the fix this
+// counted in the hundreds, because every stale frame created a new stream.
+assert.strictEqual(Number(clientSession.stats.bidiOutStreamCount), kStreams);
+
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-stream-writer-api.mjs b/test/parallel/test-quic-stream-writer-api.mjs
index 009cb4ff8a4a..4f19502d8579 100644
--- a/test/parallel/test-quic-stream-writer-api.mjs
+++ b/test/parallel/test-quic-stream-writer-api.mjs
@@ -16,7 +16,7 @@ const { bytes } = await import('stream/iter');
 
 const encoder = new TextEncoder();
 
-const totalStreams = 5;
+const totalStreams = 6;
 const serverResults = [];
 const allDone = Promise.withResolvers();
 
@@ -88,6 +88,25 @@ await clientSession.opened;
   await stream.closed;
 }
 
+// Web IDL Writer argument conversion
+{
+  const stream = await clientSession.createBidirectionalStream();
+  const w = stream.writer;
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(w.endSync(), 12);
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await stream.closed;
+}
+
 {
   const stream = await clientSession.createBidirectionalStream();
   const w = stream.writer;
@@ -139,4 +158,5 @@ assert.strictEqual(decoder.decode(serverResults[0]), 'async write');
 assert.strictEqual(decoder.decode(serverResults[1]), 'hello writev');
 assert.strictEqual(decoder.decode(serverResults[2]), 'async writev');
 assert.strictEqual(decoder.decode(serverResults[3]), 'end async');
-assert.strictEqual(decoder.decode(serverResults[4]), 'capacity');
+assert.strictEqual(decoder.decode(serverResults[4]), '42trueobject');
+assert.strictEqual(decoder.decode(serverResults[5]), 'capacity');
diff --git a/test/parallel/test-readable-from-iterator-closing.js b/test/parallel/test-readable-from-iterator-closing.js
index ef7e54821ace..0ddd222756a1 100644
--- a/test/parallel/test-readable-from-iterator-closing.js
+++ b/test/parallel/test-readable-from-iterator-closing.js
@@ -101,6 +101,40 @@ async function syncRejectedSupport() {
   }
 }
 
+async function syncRejectedAfterResolvedSupport() {
+  const expectedError = new Error('later rejection');
+  const finallyMustCall = mustCall();
+  const bodyMustCall = mustCall((chunk) => {
+    assert.strictEqual(chunk, 'a');
+  });
+  const catchMustCall = mustCall((error) => {
+    assert.strictEqual(error, expectedError);
+  });
+  const thirdNextMustNotCall = mustNotCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve('a');
+      yield Promise.reject(expectedError);
+      thirdNextMustNotCall();
+    } finally {
+      finallyMustCall();
+    }
+  }
+
+  const stream = Readable.from(generate());
+
+  try {
+    for await (const chunk of stream) {
+      bodyMustCall(chunk);
+    }
+  } catch (error) {
+    catchMustCall(error);
+  }
+
+  assert.strictEqual(stream.destroyed, true);
+}
+
 async function noReturnAfterThrow() {
   const returnMustNotCall = mustNotCall();
   const bodyMustNotCall = mustNotCall();
@@ -187,6 +221,7 @@ Promise.all([
   syncSupport(),
   syncPromiseSupport(),
   syncRejectedSupport(),
+  syncRejectedAfterResolvedSupport(),
   noReturnAfterThrow(),
   closeStreamWhileNextIsPending(),
   closeAfterNullYielded(),
diff --git a/test/parallel/test-require-resolve.js b/test/parallel/test-require-resolve.js
index 44422706e186..039e6cd7adf4 100644
--- a/test/parallel/test-require-resolve.js
+++ b/test/parallel/test-require-resolve.js
@@ -62,8 +62,6 @@ require(fixtures.path('resolve-paths', 'default', 'verify-paths.js'));
   builtinModules.forEach((mod) => {
     // TODO(@jasnell): Remove once node:quic is no longer flagged
     if (mod === 'node:quic') return;
-    // TODO: Remove once node:ffi is no longer flagged
-    if (mod === 'node:ffi') return;
     // Remove once node:vfs is no longer flagged
     if (mod === 'node:vfs') return;
     if (mod === 'node:sqlite' && !common.hasSQLite) return;
diff --git a/test/parallel/test-runner-cli.js b/test/parallel/test-runner-cli.js
index 0702c5c1500c..5a5e6b9bdf11 100644
--- a/test/parallel/test-runner-cli.js
+++ b/test/parallel/test-runner-cli.js
@@ -3,6 +3,7 @@
 require('../common');
 const assert = require('assert');
 const { spawnSync } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const { join } = require('path');
 const fixtures = require('../common/fixtures');
 const testFixtures = fixtures.path('test-runner');
@@ -70,16 +71,14 @@ for (const isolation of ['none', 'process']) {
       const args = ['--test', '--test-reporter=tap',
                     '--no-experimental-strip-types',
                     `--test-isolation=${isolation}`, dir];
-      const child = spawnSync(process.execPath, args, { cwd: testFixtures });
-
-      assert.strictEqual(child.status, 0);
-      assert.strictEqual(child.signal, null);
-      assert.strictEqual(child.stderr.toString(), '');
-      const stdout = child.stdout.toString();
-
-      assert.match(stdout, /ok 1 - this should pass/);
-      assert.match(stdout, /ok 2 - this should pass/);
-      assert.match(stdout, /ok 3 - this should pass/);
+      spawnSyncAndAssert(process.execPath, args, { cwd: testFixtures }, {
+        stderr: '',
+        stdout(output) {
+          assert.match(output, /ok 1 - this should pass/);
+          assert.match(output, /ok 2 - this should pass/);
+          assert.match(output, /ok 3 - this should pass/);
+        },
+      });
     }
   }
 
diff --git a/test/parallel/test-runner-coverage-default-exclusion.mjs b/test/parallel/test-runner-coverage-default-exclusion.mjs
index f6080612a37c..acc8c3bbfe96 100644
--- a/test/parallel/test-runner-coverage-default-exclusion.mjs
+++ b/test/parallel/test-runner-coverage-default-exclusion.mjs
@@ -1,10 +1,10 @@
 import '../common/index.mjs';
 import { before, describe, it } from 'node:test';
 import assert from 'node:assert';
-import { spawnSync } from 'node:child_process';
 import { cp } from 'node:fs/promises';
 import tmpdir from '../common/tmpdir.js';
 import fixtures from '../common/fixtures.js';
+import { spawnSyncAndAssert } from '../common/child_process.js';
 const skipIfNoInspector = {
   skip: !process.features.inspector ? 'inspector disabled' : false
 };
@@ -57,14 +57,13 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--test-reporter=tap',
       '--no-experimental-strip-types',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout: new RegExp(RegExp.escape(report)),
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assert(result.stdout.toString().includes(report));
-    assert.strictEqual(result.status, 0);
   });
 
   it('should exclude test files from coverage by default', async () => {
@@ -74,14 +73,13 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--experimental-test-coverage',
       '--test-reporter=tap',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout: assertDefaultExclusions,
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assertDefaultExclusions(result.stdout.toString());
-    assert.strictEqual(result.status, 0);
   });
 
   it('should exclude ts test files', async () => {
@@ -91,14 +89,13 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--disable-warning=ExperimentalWarning',
       '--test-reporter=tap',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout: assertDefaultExclusions,
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assertDefaultExclusions(result.stdout.toString());
-    assert.strictEqual(result.status, 0);
   });
 
   it('should exclude dotfile test files from coverage by default', async () => {
@@ -109,14 +106,15 @@ describe('test runner coverage default exclusion', skipIfNoInspector, () => {
       '--test-reporter=tap',
       'test/.dotfile.cjs',
     ];
-    const result = spawnSync(process.execPath, args, {
+    spawnSyncAndAssert(process.execPath, args, {
       env: { ...process.env, NODE_TEST_TMPDIR: tmpdir.path },
       cwd: tmpdir.path
+    }, {
+      stderr: '',
+      stdout(output) {
+        assertDefaultExclusions(output);
+        assert.doesNotMatch(output, /#\s+\.dotfile\.cjs\s+\|/);
+      },
     });
-
-    assert.strictEqual(result.stderr.toString(), '');
-    assertDefaultExclusions(result.stdout.toString());
-    assert.doesNotMatch(result.stdout.toString(), /#\s+\.dotfile\.cjs\s+\|/);
-    assert.strictEqual(result.status, 0);
   });
 });
diff --git a/test/parallel/test-runner-coverage-thresholds.js b/test/parallel/test-runner-coverage-thresholds.js
index 2742464adf64..20738c54386d 100644
--- a/test/parallel/test-runner-coverage-thresholds.js
+++ b/test/parallel/test-runner-coverage-thresholds.js
@@ -2,6 +2,7 @@
 const common = require('../common');
 const assert = require('node:assert');
 const { spawnSync } = require('node:child_process');
+const { spawnSyncAndExit } = require('../common/child_process');
 const { readdirSync } = require('node:fs');
 const { test } = require('node:test');
 const fixtures = require('../common/fixtures');
@@ -172,23 +173,24 @@ for (const coverage of coverages) {
   });
 
   test(`test failing ${coverage.flag} with dot reporter`, () => {
-    const result = spawnSync(process.execPath, [
+    const { child } = spawnSyncAndExit(process.execPath, [
       '--test',
       '--experimental-test-coverage',
       '--test-coverage-exclude=!test/**',
       `${coverage.flag}=99`,
       '--test-reporter', 'dot',
       fixture,
-    ]);
-
-    const stdout = result.stdout.toString();
-    assert.match(
-      stdout,
-      RegExp(`Error: ${coverage.actual.toFixed(2)}% ${coverage.name} coverage does not meet threshold of 99%`)
-    );
-    assert.match(stdout, /start of coverage report/);
-    assert.match(stdout, /end of coverage report/);
-    assert.strictEqual(result.status, 1);
-    assert(!findCoverageFileForPid(result.pid));
+    ], {
+      status: 1,
+      stdout(output) {
+        assert.match(
+          output,
+          RegExp(`Error: ${coverage.actual.toFixed(2)}% ${coverage.name} coverage does not meet threshold of 99%`)
+        );
+        assert.match(output, /start of coverage report/);
+        assert.match(output, /end of coverage report/);
+      },
+    });
+    assert(!findCoverageFileForPid(child.pid));
   });
 }
diff --git a/test/parallel/test-runner-coverage.js b/test/parallel/test-runner-coverage.js
index bc65221a45f8..fa56c5af3e80 100644
--- a/test/parallel/test-runner-coverage.js
+++ b/test/parallel/test-runner-coverage.js
@@ -116,6 +116,8 @@ test('test coverage report', async (t) => {
 
 test('test tap coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
@@ -154,6 +156,8 @@ test('test tap coverage reporter', skipIfNoInspector, async (t) => {
 
 test('test spec coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
diff --git a/test/parallel/test-sqlite-backup.mjs b/test/parallel/test-sqlite-backup.mjs
index d1e09569e1ca..f995ae3ca72a 100644
--- a/test/parallel/test-sqlite-backup.mjs
+++ b/test/parallel/test-sqlite-backup.mjs
@@ -1,5 +1,10 @@
 // Flags: --expose-gc
-import { isWindows, skipIfSQLiteMissing } from '../common/index.mjs';
+import {
+  isWindows,
+  skipIfSQLiteMissing,
+  spawnPromisified,
+} from '../common/index.mjs';
+import fixtures from '../common/fixtures.js';
 import tmpdir from '../common/tmpdir.js';
 import { join } from 'node:path';
 import { describe, test } from 'node:test';
@@ -364,3 +369,13 @@ test('source database is kept alive while a backup is in flight', async (t) => {
   const rows = backupDb.prepare('SELECT COUNT(*) AS n FROM data').get();
   t.assert.strictEqual(rows.n, 500);
 });
+
+test('backup promise settles when the backup is the last active request', async (t) => {
+  const { code, signal, stderr } = await spawnPromisified(process.execPath, [
+    fixtures.path('sqlite', 'backup-last-request.mjs'),
+    nextDb(),
+  ]);
+
+  t.assert.strictEqual(signal, null);
+  t.assert.strictEqual(code, 0, stderr);
+});
diff --git a/test/parallel/test-sqlite-options-getter-reentry.js b/test/parallel/test-sqlite-options-getter-reentry.js
new file mode 100644
index 000000000000..495b85db92fb
--- /dev/null
+++ b/test/parallel/test-sqlite-options-getter-reentry.js
@@ -0,0 +1,303 @@
+'use strict';
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const tmpdir = require('../common/tmpdir');
+const { join } = require('node:path');
+const { backup, DatabaseSync } = require('node:sqlite');
+const { suite, test } = require('node:test');
+
+tmpdir.refresh();
+
+const invalidState = {
+  code: 'ERR_INVALID_STATE',
+  message: /database is not open/,
+};
+
+// A property getter on the options bag runs arbitrary JavaScript in the middle
+// of the call, so state validated before the options were read can be stale by
+// the time it is used.
+suite('closing the database from an options getter', () => {
+  test('prepare() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.prepare('SELECT 1', {
+        get returnArrays() {
+          db.close();
+          return false;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('function() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.function('fn', {
+        get useBigIntArguments() {
+          db.close();
+          return false;
+        },
+      }, () => 1);
+    }, invalidState);
+  });
+
+  test('function() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const fn = () => 1;
+    Object.defineProperty(fn, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 0;
+      },
+    });
+    t.assert.throws(() => {
+      db.function('fn', fn);
+    }, invalidState);
+  });
+
+  test('aggregate() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.aggregate('agg', {
+        get start() {
+          db.close();
+          return 0;
+        },
+        step: (acc, value) => acc,
+      });
+    }, invalidState);
+  });
+
+  test('aggregate() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const step = (acc, value) => acc;
+    Object.defineProperty(step, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 2;
+      },
+    });
+    t.assert.throws(() => {
+      db.aggregate('agg', { start: 0, step });
+    }, invalidState);
+  });
+
+  test('deserialize() throws instead of using a closed connection', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(image, {
+        get dbName() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('createSession() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.createSession({
+        get db() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('applyChangeset() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    const session = db.createSession();
+    db.exec('INSERT INTO data (key) VALUES (1)');
+    const changeset = session.changeset();
+
+    t.assert.throws(() => {
+      db.applyChangeset(changeset, {
+        get onConflict() {
+          db.close();
+          return undefined;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('backup() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      backup(db, join(tmpdir.path, 'getter-backup.db'), {
+        get rate() {
+          db.close();
+          return 1;
+        },
+      });
+    }, invalidState);
+  });
+});
+
+// The state check runs before the options bag is read, so a call that is
+// already doomed must not execute any of the caller's getters.
+test('options getters do not run on an already-closed database', (t) => {
+  const source = new DatabaseSync(':memory:');
+  source.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  const image = source.serialize();
+  const session = source.createSession();
+  source.exec('INSERT INTO data (key) VALUES (1)');
+  const changeset = session.changeset();
+
+  const cases = {
+    prepare: (db, options) => db.prepare('SELECT 1', options),
+    function: (db, options) => db.function('fn', options, () => 1),
+    aggregate: (db, options) => db.aggregate('agg', options),
+    deserialize: (db, options) => db.deserialize(image, options),
+    createSession: (db, options) => db.createSession(options),
+    applyChangeset: (db, options) => db.applyChangeset(changeset, options),
+    backup: (db, options) =>
+      backup(db, join(tmpdir.path, 'closed-backup.db'), options),
+  };
+
+  // The property each method reads first, and a valid value for it, so that a
+  // getter which does run leaves the "did not run" assertion as the failure
+  // rather than a type error from the returned value.
+  const probes = {
+    prepare: ['returnArrays', false],
+    function: ['useBigIntArguments', false],
+    aggregate: ['start', 0],
+    deserialize: ['dbName', 'main'],
+    createSession: ['db', 'main'],
+    applyChangeset: ['onConflict', undefined],
+    backup: ['rate', 1],
+  };
+
+  for (const [name, invoke] of Object.entries(cases)) {
+    const db = new DatabaseSync(':memory:');
+    db.close();
+
+    const [key, value] = probes[name];
+    let ran = false;
+    const options = {
+      get [key]() {
+        ran = true;
+        return value;
+      },
+    };
+
+    t.assert.throws(() => invoke(db, options), invalidState, name);
+    t.assert.strictEqual(ran, false, `${name} ran an options getter`);
+  }
+});
+
+suite('resizing a deserialize() buffer from an options getter', () => {
+  test('throws rather than handing uninitialized memory to SQLite', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    source.prepare('INSERT INTO data (value) VALUES (?)').run('hello');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength, {
+      maxByteLength: image.byteLength,
+    });
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          buffer.resize(1024);
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+
+  test('throws when the buffer is detached', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength);
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          structuredClone(buffer, { transfer: [buffer] });
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+});
+
+// fn.length is configurable, so it must be validated rather than cast blindly.
+suite('non-integer callback length', () => {
+  const badLengths = ['abc', {}, [], null, undefined, NaN, 1.5, Symbol.iterator,
+                      10n, true, 2 ** 40];
+
+  test('function() rejects a non-integer length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const fn = () => 1;
+      Object.defineProperty(fn, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.function('fn', fn);
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "function\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('aggregate() rejects a non-integer step length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const step = (acc, next) => acc;
+      Object.defineProperty(step, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.aggregate('agg', { start: 0, step, result: (acc) => acc });
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "options\.step\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('aggregate() rejects a non-integer inverse length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const inverse = (acc, next) => acc;
+      Object.defineProperty(inverse, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.aggregate('agg', {
+          start: 0,
+          step: (acc, next) => acc,
+          inverse,
+          result: (acc) => acc,
+        });
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "options\.inverse\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('a normal function length is still accepted', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.function('plus', (a, b) => a + b);
+    t.assert.strictEqual(db.prepare('SELECT plus(1, 2) AS v').get().v, 3);
+  });
+});
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index a8bbaa77d064..c36ed84a0858 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -6,7 +6,8 @@ const {
   DatabaseSync,
   constants,
 } = require('node:sqlite');
-const { test, suite } = require('node:test');
+const { it, test, suite } = require('node:test');
+const dc = require('node:diagnostics_channel');
 const { nextDb } = require('../sqlite/next-db.js');
 const { Worker } = require('worker_threads');
 const { once } = require('events');
@@ -282,6 +283,25 @@ suite('conflict resolution', () => {
       [{ value: 'world' }]);  // unchanged
   });
 
+  test('database.applyChangeset() - changeset detached by onConflict', (t) => {
+    const { database2, changeset } = prepareConflict();
+    const result = database2.applyChangeset(changeset, {
+      onConflict: () => {
+        const transferred = structuredClone(changeset.buffer, {
+          transfer: [changeset.buffer],
+        });
+        new Uint8Array(transferred).fill(0);
+        return constants.SQLITE_CHANGESET_REPLACE;
+      }
+    });
+
+    t.assert.strictEqual(result, true);
+    t.assert.strictEqual(changeset.byteLength, 0);
+    deepStrictEqual(t)(
+      database2.prepare('SELECT * FROM data ORDER BY key').all(),
+      [{ key: 1, value: 'hello' }, { key: 2, value: 'foo' }]);
+  });
+
   test('database.applyChangeset() - SQLITE_CHANGESET_DATA conflict handled with SQLITE_CHANGESET_REPLACE', (t) => {
     const { database2, changeset } = prepareDataConflict();
     let conflictType = null;
@@ -413,6 +433,35 @@ test('filter handler throws', (t) => {
   });
 });
 
+test('database.applyChangeset() - changeset detached by filter', (t) => {
+  const database1 = new DatabaseSync(':memory:');
+  const database2 = new DatabaseSync(':memory:');
+  database1.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  database2.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+
+  const session = database1.createSession();
+  database1.exec('INSERT INTO data VALUES (1), (2), (3)');
+  const changeset = session.changeset();
+
+  const result = database2.applyChangeset(changeset, {
+    filter: () => {
+      const transferred = structuredClone(changeset.buffer, {
+        transfer: [changeset.buffer],
+      });
+      new Uint8Array(transferred).fill(0);
+      return true;
+    }
+  });
+
+  t.assert.strictEqual(result, true);
+  t.assert.strictEqual(changeset.byteLength, 0);
+  deepStrictEqual(t)(database2.prepare('SELECT * FROM data').all(), [
+    { key: 1 },
+    { key: 2 },
+    { key: 3 },
+  ]);
+});
+
 test('database.createSession() - filter changes', (t) => {
   const database1 = new DatabaseSync(':memory:');
   const database2 = new DatabaseSync(':memory:');
@@ -612,26 +661,195 @@ test('session.close() - closing twice', (t) => {
   });
 });
 
-test('session.close() - while generating changes throws exception', (t) => {
-  for (const method of ['changeset', 'patchset']) {
-    const database = new DatabaseSync(':memory:');
-    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+test('session close and dispose - while generating changes throws exception', (t) => {
+  for (const close of ['close', Symbol.dispose]) {
+    for (const method of ['changeset', 'patchset']) {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+
+      const session = database.createSession({ table: 'data' });
+      database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
+      database.setAuthorizer(() => {
+        session[close]();
+        return constants.SQLITE_OK;
+      });
 
-    const session = database.createSession({ table: 'data' });
-    database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
-    database.setAuthorizer(() => {
+      t.assert.throws(() => session[method](), {
+        code: 'ERR_INVALID_STATE',
+        message: 'session is currently in use',
+      });
+
+      database.setAuthorizer(null);
+      t.assert.notStrictEqual(session[method]().length, 0);
+    }
+  }
+});
+
+test('session[Symbol.dispose]() - closed session is a no-op', () => {
+  const database = new DatabaseSync(':memory:');
+  const session = database.createSession();
+  session.close();
+
+  session[Symbol.dispose]();
+});
+
+test('session[Symbol.dispose]() - after closing database is a no-op', () => {
+  const database = new DatabaseSync(':memory:');
+  const session = database.createSession();
+  database.close();
+
+  session[Symbol.dispose]();
+});
+
+// SQLite runs "PRAGMA table_xinfo" from inside its pre-update hook, while it is
+// still walking the connection's session list. Deleting a session from a
+// callback that PRAGMA triggers frees memory the walk is still using, so the
+// close has to be rejected instead.
+suite('session.close() - from a callback', () => {
+  const expectedError =
+    'ERR_INVALID_STATE: session cannot be closed while in a callback';
+
+  for (const method of ['close', 'dispose']) {
+    const closeSession = (session) => {
+      if (method === 'close') {
+        session.close();
+      } else {
+        session[Symbol.dispose]();
+      }
+    };
+
+    it(`rejects ${method} from an authorizer callback`, (t) => {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+      const session = database.createSession();
+      let outcome = 'callback did not run';
+
+      database.setAuthorizer((actionCode, param1) => {
+        if (actionCode === constants.SQLITE_PRAGMA && param1 === 'table_xinfo') {
+          try {
+            closeSession(session);
+            outcome = 'did not throw';
+          } catch (err) {
+            outcome = `${err.code}: ${err.message}`;
+          }
+        }
+        return constants.SQLITE_OK;
+      });
+
+      database.exec('INSERT INTO data VALUES (1)');
+      t.assert.strictEqual(outcome, expectedError);
+
+      // The session survived and kept recording the insert.
+      database.setAuthorizer(null);
+      t.assert.notStrictEqual(session.changeset().length, 0);
       session.close();
-      return constants.SQLITE_OK;
     });
 
-    t.assert.throws(() => session[method](), {
-      code: 'ERR_INVALID_STATE',
-      message: 'session is currently in use',
+    it(`rejects ${method} from a 'sqlite.db.query' subscriber`, (t) => {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+      const session = database.createSession();
+      let outcome = 'callback did not run';
+
+      const handler = ({ sql }) => {
+        if (sql.includes('table_xinfo')) {
+          try {
+            closeSession(session);
+            outcome = 'did not throw';
+          } catch (err) {
+            outcome = `${err.code}: ${err.message}`;
+          }
+        }
+      };
+      dc.subscribe('sqlite.db.query', handler);
+      t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+      database.exec('INSERT INTO data VALUES (1)');
+      t.assert.strictEqual(outcome, expectedError);
+
+      dc.unsubscribe('sqlite.db.query', handler);
+      t.assert.notStrictEqual(session.changeset().length, 0);
+      session.close();
     });
 
-    database.setAuthorizer(null);
-    t.assert.notStrictEqual(session[method]().length, 0);
+    // Deliberately broader than the crash: the pre-update hook is not on the
+    // stack here, so this close is safe today. Node cannot tell whether SQLite
+    // is inside that hook, so every callback is rejected. This pins the
+    // trade-off rather than leaving it to be discovered as a regression.
+    it(`rejects ${method} from a user-defined function`, (t) => {
+      const database = new DatabaseSync(':memory:');
+      database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+      const session = database.createSession();
+      let outcome = 'callback did not run';
+
+      database.function('f', (x) => {
+        try {
+          closeSession(session);
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+        return x;
+      });
+
+      database.exec('SELECT f(1)');
+      t.assert.strictEqual(outcome, expectedError);
+
+      // Still closable once the callback is off the stack.
+      session.close();
+      t.assert.throws(() => session.close(), { message: 'session is not open' });
+    });
   }
+
+  // Rejecting disposal has a cost: a `using` declaration inside a callback
+  // demotes the block's own error to SuppressedError. Accepted for symmetry
+  // with StatementSync's disposal, which throws for a busy statement the same
+  // way. Pinned here so the trade-off is visible rather than surprising.
+  it('demotes a callback error when disposal is rejected', (t) => {
+    const database = new DatabaseSync(':memory:');
+    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    let caught;
+
+    database.function('f', (x) => {
+      try {
+        using session = database.createSession();
+        t.assert.ok(session);
+        throw new Error('callback error');
+      } catch (err) {
+        caught = err;
+      }
+      return x;
+    });
+
+    database.exec('SELECT f(1)');
+    t.assert.ok(caught instanceof SuppressedError);
+    t.assert.strictEqual(caught.suppressed.message, 'callback error');
+    t.assert.strictEqual(
+      caught.error.message,
+      'session cannot be closed while in a callback',
+    );
+  });
+
+  it('leaves an already closed session disposable from a callback', (t) => {
+    const database = new DatabaseSync(':memory:');
+    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    const session = database.createSession();
+    session.close();
+    let outcome = 'callback did not run';
+
+    database.setAuthorizer(() => {
+      try {
+        session[Symbol.dispose]();
+        outcome = 'no-op';
+      } catch (err) {
+        outcome = `${err.code}: ${err.message}`;
+      }
+      return constants.SQLITE_OK;
+    });
+
+    database.exec('INSERT INTO data VALUES (1)');
+    t.assert.strictEqual(outcome, 'no-op');
+  });
 });
 
 test('session - keeps its database alive after the db handle is dropped', async (t) => {
@@ -664,6 +882,50 @@ test('session - keeps its database alive after the db handle is dropped', async
   session.close();
 });
 
+// SQLite runs "PRAGMA table_xinfo" from inside its pre-update hook, while it is
+// still walking the connection's session list. Session objects are weak, so a
+// GC during a callback that the PRAGMA triggers could collect a session that
+// JavaScript no longer references and free memory the walk is still using.
+test('session - survives GC during an authorizer callback', (t) => {
+  const database = new DatabaseSync(':memory:');
+  database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  database.createSession(); // Never referenced again, so it is collectable.
+
+  let ran = false;
+  database.setAuthorizer((actionCode, param1) => {
+    if (actionCode === constants.SQLITE_PRAGMA && param1 === 'table_xinfo') {
+      ran = true;
+      globalThis.gc();
+      globalThis.gc();
+    }
+    return constants.SQLITE_OK;
+  });
+
+  database.exec('INSERT INTO data VALUES (1)');
+  t.assert.ok(ran, 'the authorizer callback never ran');
+});
+
+test("session - survives GC during a 'sqlite.db.query' subscriber", (t) => {
+  const dc = require('node:diagnostics_channel');
+  const database = new DatabaseSync(':memory:');
+  database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  database.createSession(); // Never referenced again, so it is collectable.
+
+  let ran = false;
+  const handler = ({ sql }) => {
+    if (sql.includes('table_xinfo')) {
+      ran = true;
+      globalThis.gc();
+      globalThis.gc();
+    }
+  };
+  dc.subscribe('sqlite.db.query', handler);
+  t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+  database.exec('INSERT INTO data VALUES (1)');
+  t.assert.ok(ran, 'the subscriber never ran');
+});
+
 test('session supports ERM', (t) => {
   const database = new DatabaseSync(':memory:');
   let afterDisposeSession;
diff --git a/test/parallel/test-startup-large-pages.js b/test/parallel/test-startup-large-pages.js
index 9ebe9fa7b668..f84aca074fb0 100644
--- a/test/parallel/test-startup-large-pages.js
+++ b/test/parallel/test-startup-large-pages.js
@@ -1,30 +1,31 @@
 'use strict';
 
-// Make sure that Node.js runs correctly with the --use-largepages option.
+// Tests that the obsolete --use-largepages option is a no-op. It only prints
+// a warning when the value is `on`.
 
 require('../common');
-const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
 
-{
-  const child = spawnSync(process.execPath,
-                          [ '--use-largepages=on', '-p', '42' ],
-                          { stdio: ['inherit', 'pipe', 'inherit'] });
-  const stdout = child.stdout.toString().match(/\S+/g);
-  assert.strictEqual(child.status, 0);
-  assert.strictEqual(child.signal, null);
-  assert.strictEqual(stdout.length, 1);
-  assert.strictEqual(stdout[0], '42');
-}
+spawnSyncAndAssert(process.execPath, ['--use-largepages=on', '-p', '42'], {
+  trim: true,
+  stdout: '42',
+  stderr: /--use-largepages is no longer supported/,
+});
 
-{
-  const child = spawnSync(process.execPath,
-                          [ '--use-largepages=xyzzy', '-p', '42' ]);
-  assert.strictEqual(child.status, 9);
-  assert.strictEqual(child.signal, null);
-  assert.match(child.stderr.toString().trim(),
-               /invalid value for --use-largepages$/);
+for (const mode of ['off', 'silent']) {
+  spawnSyncAndAssert(
+    process.execPath,
+    [`--use-largepages=${mode}`, '-p', '42'],
+    {
+      trim: true,
+      stdout: '42',
+      stderr: '',
+    });
 }
 
-// TODO(gabrielschulhof): Make assertions about the stderr, which may or may not
-// contain a message indicating that mapping to large pages has failed.
+spawnSyncAndAssert(process.execPath, ['--use-largepages=xyzzy', '-p', '42'], {
+  trim: true,
+  status: 9,
+  stdout: '',
+  stderr: /invalid value for --use-largepages/,
+});
diff --git a/test/parallel/test-stream-iter-broadcast-backpressure.js b/test/parallel/test-stream-iter-broadcast-backpressure.js
index 698f1821aeea..6efa7eb54c73 100644
--- a/test/parallel/test-stream-iter-broadcast-backpressure.js
+++ b/test/parallel/test-stream-iter-broadcast-backpressure.js
@@ -3,7 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { broadcast, text } = require('stream/iter');
+const { broadcast, ondrain, text } = require('stream/iter');
 
 // =============================================================================
 // Backpressure policies
@@ -47,6 +47,36 @@ async function testDropNewest() {
   assert.strictEqual(data, 'K'.repeat(16384));
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, broadcast: bc } = broadcast({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = bc.push()[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    bc.cancel();
+  }
+}
+
 // =============================================================================
 // Block backpressure
 // =============================================================================
@@ -269,6 +299,7 @@ async function testEndSyncReturnValue() {
 Promise.all([
   testDropOldest(),
   testDropNewest(),
+  testDropPoliciesReportPhysicalCapacity(),
   testBlockBackpressure(),
   testBlockBackpressureContent(),
   testStrictBackpressureOverflow(),
diff --git a/test/parallel/test-stream-iter-consumers-bytes.js b/test/parallel/test-stream-iter-consumers-bytes.js
index 53d0a3858f87..531917eb9734 100644
--- a/test/parallel/test-stream-iter-consumers-bytes.js
+++ b/test/parallel/test-stream-iter-consumers-bytes.js
@@ -101,6 +101,31 @@ async function testAsyncConsumersAbortPendingNormalization() {
   }
 }
 
+async function testAsyncConsumerSignalPreservesProtocolPrecedence() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    __proto__: null,
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('protocol');
+    },
+    async *[Symbol.asyncIterator]() {
+      iteratorCalls++;
+      yield 'iterator';
+    },
+  };
+
+  const result = await text(source, {
+    __proto__: null,
+    signal: new AbortController().signal,
+  });
+
+  assert.strictEqual(result, 'protocol');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+}
+
 async function testBytesEmpty() {
   const data = await bytes(from([]));
   assert.ok(data instanceof Uint8Array);
@@ -255,6 +280,7 @@ Promise.all([
   testBytesAsyncAbort(),
   testAsyncConsumersAbortPendingNext(),
   testAsyncConsumersAbortPendingNormalization(),
+  testAsyncConsumerSignalPreservesProtocolPrecedence(),
   testBytesEmpty(),
   testArrayBufferSyncBasic(),
   testArrayBufferAsync(),
diff --git a/test/parallel/test-stream-iter-consumers-merge.js b/test/parallel/test-stream-iter-consumers-merge.js
index 84aeb24b6159..becf68ee63a1 100644
--- a/test/parallel/test-stream-iter-consumers-merge.js
+++ b/test/parallel/test-stream-iter-consumers-merge.js
@@ -108,6 +108,109 @@ async function testMergeSourceError() {
   );
 }
 
+async function testMergeFalsySourceErrors() {
+  const reasons = [undefined, null, false, 0, '', NaN];
+
+  for (const reason of reasons) {
+    const noError = { __proto__: null };
+    let actual = noError;
+    try {
+      await text(merge(rejectedSource(reason), from('other')));
+    } catch (error) {
+      actual = error;
+    }
+    assert.strictEqual(Object.is(actual, reason), true);
+  }
+}
+
+function rejectedSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return Promise.reject(reason);
+    },
+  };
+}
+
+function pendingSource() {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return new Promise(() => {});
+    },
+    return() {
+      return new Promise(() => {});
+    },
+  };
+}
+
+async function testMergeSourceErrorDoesNotAwaitCleanup() {
+  const reason = new Error('source failed');
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    text(merge(rejectedSource(reason), pendingSource())).then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(outcome.error, reason);
+}
+
+async function testMergeBreakDoesNotAwaitCleanup() {
+  async function* readySource() {
+    yield [Uint8Array.of(1)];
+  }
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    (async () => {
+      for await (const batch of merge(readySource(), pendingSource())) {
+        assert.deepStrictEqual(batch, [Uint8Array.of(1)]);
+        break;
+      }
+      return true;
+    })(),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.strictEqual(outcome, true);
+}
+
+async function testMergeNaNAbortDoesNotAwaitCleanup() {
+  const ac = new AbortController();
+  const iterator = merge(pendingSource(), pendingSource(), {
+    __proto__: null,
+    signal: ac.signal,
+  })[Symbol.asyncIterator]();
+  const next = iterator.next();
+  await new Promise(setImmediate);
+  ac.abort(NaN);
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    next.then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(Object.is(outcome.error, NaN), true);
+}
+
 async function testMergeConsumerBreak() {
   let source1Return = false;
   let source2Return = false;
@@ -296,9 +399,8 @@ async function testMergeCleanupErrorOnly() {
   );
 }
 
-// Primary error + cleanup error: a source throws during iteration AND
-// iterator.return() also throws. Should get a SuppressedError.
-async function testMergePrimaryAndCleanupError() {
+// A primary source error must not wait for asynchronous cleanup failures.
+async function testMergePrimaryErrorPrecedesCleanupError() {
   async function* badSource() {
     yield [new TextEncoder().encode('x')];
     throw new Error('primary boom');
@@ -319,15 +421,7 @@ async function testMergePrimaryAndCleanupError() {
         // Consume until error
       }
     },
-    (err) => {
-      assert.ok(
-        err instanceof SuppressedError,
-        `Expected SuppressedError, got ${err.constructor.name}`,
-      );
-      assert.strictEqual(err.error.message, 'primary boom');
-      assert.strictEqual(err.suppressed.message, 'cleanup boom');
-      return true;
-    },
+    { message: 'primary boom' },
   );
 }
 
@@ -353,6 +447,27 @@ async function testMergeBreakWithCleanupError() {
   );
 }
 
+async function testMergeMultiSourceBreakWithCleanupError() {
+  async function* failingReturnSource() {
+    try {
+      yield [new TextEncoder().encode('data')];
+    } finally {
+      await Promise.resolve();
+      throwInFinally('async cleanup on break');
+    }
+  }
+
+  await assert.rejects(
+    async () => {
+      // eslint-disable-next-line no-unused-vars
+      for await (const _ of merge(failingReturnSource(), from('other'))) {
+        break;
+      }
+    },
+    { message: 'async cleanup on break' },
+  );
+}
+
 Promise.all([
   testMergeTwoSources(),
   testMergeSingleSource(),
@@ -360,6 +475,10 @@ Promise.all([
   testMergeWithAbortSignal(),
   testMergeSyncSources(),
   testMergeSourceError(),
+  testMergeFalsySourceErrors(),
+  testMergeSourceErrorDoesNotAwaitCleanup(),
+  testMergeBreakDoesNotAwaitCleanup(),
+  testMergeNaNAbortDoesNotAwaitCleanup(),
   testMergeConsumerBreak(),
   testMergeSignalMidIteration(),
   testMergeSignalDuringPendingMultiSourceRead(),
@@ -368,6 +487,7 @@ Promise.all([
   testMergeStringSources(),
   testMergeObjectLikeSources(),
   testMergeCleanupErrorOnly(),
-  testMergePrimaryAndCleanupError(),
+  testMergePrimaryErrorPrecedesCleanupError(),
   testMergeBreakWithCleanupError(),
+  testMergeMultiSourceBreakWithCleanupError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-consumers-text.js b/test/parallel/test-stream-iter-consumers-text.js
index a8fb7a74367f..68be098ff8f6 100644
--- a/test/parallel/test-stream-iter-consumers-text.js
+++ b/test/parallel/test-stream-iter-consumers-text.js
@@ -143,17 +143,17 @@ function testTextSyncUnsupportedEncodingThrowsRangeError() {
   );
 }
 
-async function testTextNonStringEncodingThrowsTypeError() {
+async function testTextConvertedEncodingThrowsRangeError() {
   await assert.rejects(
     () => text(from('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
-function testTextSyncNonStringEncodingThrowsTypeError() {
+function testTextSyncConvertedEncodingThrowsRangeError() {
   assert.throws(
     () => textSync(fromSync('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
@@ -173,6 +173,6 @@ Promise.all([
   testTextSyncBOMStripped(),
   testTextUnsupportedEncodingThrowsRangeError(),
   testTextSyncUnsupportedEncodingThrowsRangeError(),
-  testTextNonStringEncodingThrowsTypeError(),
-  testTextSyncNonStringEncodingThrowsTypeError(),
+  testTextConvertedEncodingThrowsRangeError(),
+  testTextSyncConvertedEncodingThrowsRangeError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-duplex.js b/test/parallel/test-stream-iter-duplex.js
index 0969b91e7d21..354fa28b67a6 100644
--- a/test/parallel/test-stream-iter-duplex.js
+++ b/test/parallel/test-stream-iter-duplex.js
@@ -14,32 +14,26 @@ async function testBasicDuplex() {
 
   // A writes, B reads
   await channelA.writer.write('hello from A');
-  await channelA.close();
-
+  const closing = channelA.close();
   const dataAtB = await text(channelB.readable);
+  await closing;
   assert.strictEqual(dataAtB, 'hello from A');
 }
 
 async function testBidirectional() {
   const [channelA, channelB] = duplex();
 
-  // A writes to B, B writes to A concurrently
-  const writeA = (async () => {
-    await channelA.writer.write('A to B');
-    await channelA.close();
-  })();
-
-  const writeB = (async () => {
-    await channelB.writer.write('B to A');
-    await channelB.close();
-  })();
-
-  const readAtB = text(channelB.readable);
-  const readAtA = text(channelA.readable);
-
-  await Promise.all([writeA, writeB]);
+  await channelA.writer.write('A to B');
+  await channelB.writer.write('B to A');
 
-  const [dataAtA, dataAtB] = await Promise.all([readAtA, readAtB]);
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
+  const [dataAtA, dataAtB] = await Promise.all([
+    text(channelA.readable),
+    text(channelB.readable),
+  ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'A to B');
   assert.strictEqual(dataAtA, 'B to A');
@@ -51,19 +45,29 @@ async function testMultipleWrites() {
   await channelA.writer.write('one');
   await channelA.writer.write('two');
   await channelA.writer.write('three');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'onetwothree');
 }
 
 async function testChannelClose() {
   const [channelA, channelB] = duplex();
-
-  await channelA.close();
-
-  // Should be able to close twice without error
-  await channelA.close();
+  const iteratorA = channelA.readable[Symbol.asyncIterator]();
+  const otherIteratorA = channelA.readable[Symbol.asyncIterator]();
+  const pendingRead = iteratorA.next();
+
+  const closing = channelA.close();
+  assert.strictEqual(channelA.close(), closing);
+  await closing;
+
+  assert.strictEqual((await pendingRead).done, true);
+  assert.strictEqual((await otherIteratorA.next()).done, true);
+  assert.strictEqual(
+    (await channelA.readable[Symbol.asyncIterator]().next()).done, true);
+  await assert.rejects(channelB.writer.write('late'), {
+    code: 'ERR_INVALID_STATE',
+  });
 
   // B's readable should end (A -> B direction is closed)
   const batches = [];
@@ -73,6 +77,20 @@ async function testChannelClose() {
   assert.strictEqual(batches.length, 0);
 }
 
+async function testConcurrentChannelClose() {
+  const [channelA, channelB] = duplex();
+
+  const results = await Promise.allSettled([
+    channelA.close(),
+    channelB.close(),
+  ]);
+
+  assert.deepStrictEqual(results, [
+    { status: 'fulfilled', value: undefined },
+    { status: 'fulfilled', value: undefined },
+  ]);
+}
+
 async function testWithOptions() {
   const [channelA, channelB] = duplex({
     budget: 16384,
@@ -80,9 +98,9 @@ async function testWithOptions() {
   });
 
   await channelA.writer.write('msg');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'msg');
 }
 
@@ -95,15 +113,17 @@ async function testPerChannelOptions() {
   // Channel A -> B direction uses A's options
   // Channel B -> A direction uses B's options
   await channelA.writer.write('from-a');
-  await channelA.close();
-
   await channelB.writer.write('from-b');
-  await channelB.close();
+
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
 
   const [dataAtA, dataAtB] = await Promise.all([
     text(channelA.readable),
     text(channelB.readable),
   ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'from-a');
   assert.strictEqual(dataAtA, 'from-b');
@@ -146,17 +166,39 @@ async function testWriterEndWithPreAbortedSignal() {
 async function testEmptyDuplex() {
   const [channelA, channelB] = duplex();
 
-  // Close without writing
-  await channelA.close();
-  await channelB.close();
+  await channelA.writer.end();
+  await channelB.writer.end();
 
   const dataAtA = await bytes(channelA.readable);
   const dataAtB = await bytes(channelB.readable);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtA.byteLength, 0);
   assert.strictEqual(dataAtB.byteLength, 0);
 }
 
+async function testCloseWaitsForDrain() {
+  const [channelA, channelB] = duplex();
+  await channelA.writer.write('buffered');
+
+  let closed = false;
+  const closing = channelA.close().then(common.mustCall(() => {
+    closed = true;
+  }));
+  await new Promise(setImmediate);
+  assert.strictEqual(closed, false);
+
+  assert.strictEqual(await text(channelB.readable), 'buffered');
+  await closing;
+}
+
+async function testClosePropagatesWriterFailure() {
+  const [channelA] = duplex();
+  const reason = new Error('writer failed');
+  channelA.writer.fail(reason);
+  await assert.rejects(channelA.close(), (error) => error === reason);
+}
+
 // Channel fail propagation
 async function testChannelFail() {
   const [a, b] = duplex();
@@ -195,11 +237,14 @@ Promise.all([
   testBidirectional(),
   testMultipleWrites(),
   testChannelClose(),
+  testConcurrentChannelClose(),
   testWithOptions(),
   testPerChannelOptions(),
   testAbortSignal(),
   testWriterEndWithPreAbortedSignal(),
   testEmptyDuplex(),
+  testCloseWaitsForDrain(),
+  testClosePropagatesWriterFailure(),
   testChannelFail(),
   testAbortSignalBothChannels(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-from-async.js b/test/parallel/test-stream-iter-from-async.js
index 5ef78088bfbd..a4726d633ef0 100644
--- a/test/parallel/test-stream-iter-from-async.js
+++ b/test/parallel/test-stream-iter-from-async.js
@@ -31,6 +31,30 @@ async function testFromAsyncGenerator() {
   assert.deepStrictEqual(batches[1][0], new Uint8Array([30, 40]));
 }
 
+async function testFromBoundsNestedAsyncIterable() {
+  let nestedClosed = false;
+  async function* nested() {
+    try {
+      let value = 0;
+      while (true) yield new Uint8Array([value++]);
+    } finally {
+      nestedClosed = true;
+    }
+  }
+
+  async function* source() {
+    yield nested();
+  }
+
+  const iterator = from(source())[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+  assert.strictEqual(first.value.length, 128);
+
+  await iterator.return();
+  assert.strictEqual(nestedClosed, true);
+}
+
 async function testFromSyncIterableAsAsync() {
   // Sync iterable passed to from() should work
   function* gen() {
@@ -235,6 +259,20 @@ async function testFromTopLevelProtocolOverIterator() {
   assert.strictEqual(result, 'from-protocol');
 }
 
+async function testFromHandlesProtocolRejectionUntilIteration() {
+  const reason = new Error('protocol failed');
+  const iterable = from({
+    [Symbol.for('Stream.toAsyncStreamable')]: common.mustCall(
+      () => Promise.reject(reason)),
+  });
+
+  await new Promise(setImmediate);
+  await assert.rejects(
+    iterable[Symbol.asyncIterator]().next(),
+    (error) => error === reason,
+  );
+}
+
 // DataView input should be converted to Uint8Array (zero-copy)
 async function testFromDataView() {
   const buf = new ArrayBuffer(5);
@@ -260,6 +298,7 @@ function testFromUndefinedThrows() {
 Promise.all([
   testFromString(),
   testFromAsyncGenerator(),
+  testFromBoundsNestedAsyncIterable(),
   testFromSyncIterableAsAsync(),
   testFromSyncIterableAwaitsPromiseValues(),
   testFromSyncIterableRejectsNestedAsyncIterable(),
@@ -279,5 +318,6 @@ Promise.all([
   testFromTopLevelToStreamable(),
   testFromTopLevelAsyncPrecedence(),
   testFromTopLevelProtocolOverIterator(),
+  testFromHandlesProtocolRejectionUntilIteration(),
   testFromDataView(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pipeto-edge.js b/test/parallel/test-stream-iter-pipeto-edge.js
index 3f09c4dfd42d..13223a226a1f 100644
--- a/test/parallel/test-stream-iter-pipeto-edge.js
+++ b/test/parallel/test-stream-iter-pipeto-edge.js
@@ -1,33 +1,41 @@
 // Flags: --experimental-stream-iter
 'use strict';
 
-// Edge case tests for pipeToSync: endSync fallback, preventFail.
+// Edge case tests for pipeToSync close and failure behavior.
 
 const common = require('../common');
 const assert = require('assert');
 const { pipeToSync, fromSync } = require('stream/iter');
 
-// pipeToSync endSync returns negative → falls back to end()
-async function testPipeToSyncEndSyncFallback() {
+// pipeToSync cannot complete when endSync() requires async fallback.
+async function testPipeToSyncEndSyncFailure() {
   let endCalled = false;
   const writer = {
     writeSync() { return true; },
-    endSync() { return -1; }, // Negative → triggers end() fallback
+    endSync() { return -1; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer, { preventFail: true }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual(endCalled, false);
 }
 
-// pipeToSync endSync missing → falls back to end()
+// pipeToSync requires endSync() when closing is enabled.
 async function testPipeToSyncNoEndSync() {
+  let writeCalled = false;
   let endCalled = false;
   const writer = {
-    writeSync() { return true; },
+    writeSync() { writeCalled = true; return true; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(writeCalled, false);
+  assert.strictEqual(endCalled, false);
 }
 
 // pipeToSync with preventFail: true — source error does NOT call fail()
@@ -61,7 +69,7 @@ async function testPipeToSyncPreventClose() {
 }
 
 Promise.all([
-  testPipeToSyncEndSyncFallback(),
+  testPipeToSyncEndSyncFailure(),
   testPipeToSyncNoEndSync(),
   testPipeToSyncPreventFail(),
   testPipeToSyncPreventClose(),
diff --git a/test/parallel/test-stream-iter-pipeto-signal.js b/test/parallel/test-stream-iter-pipeto-signal.js
index ec1324a4e04b..be04c8c635df 100644
--- a/test/parallel/test-stream-iter-pipeto-signal.js
+++ b/test/parallel/test-stream-iter-pipeto-signal.js
@@ -9,6 +9,51 @@ const assert = require('assert');
 const { setTimeout } = require('timers/promises');
 const { pipeTo, from } = require('stream/iter');
 
+async function testPipeToPreAbortedSignalFailsWriter() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustCall((error) => assert.strictEqual(error, reason)),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, { signal: AbortSignal.abort(reason) }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
+async function testPipeToPreAbortedSignalPreventFail() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustNotCall(),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, {
+      signal: AbortSignal.abort(reason),
+      preventFail: true,
+    }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
 // pipeTo with live signal, no transforms — abort mid-stream
 async function testPipeToLiveSignalNoTransforms() {
   const ac = new AbortController();
@@ -116,6 +161,8 @@ async function testPipeToLiveSignalWithTransformsCompletes() {
 }
 
 Promise.all([
+  testPipeToPreAbortedSignalFailsWriter(),
+  testPipeToPreAbortedSignalPreventFail(),
   testPipeToLiveSignalNoTransforms(),
   testPipeToLiveSignalNoTransformsPendingNext(),
   testPipeToLiveSignalWithTransforms(),
diff --git a/test/parallel/test-stream-iter-pipeto.js b/test/parallel/test-stream-iter-pipeto.js
index 5d8b5088f540..4711b291a7af 100644
--- a/test/parallel/test-stream-iter-pipeto.js
+++ b/test/parallel/test-stream-iter-pipeto.js
@@ -71,6 +71,7 @@ async function testPipeToSyncSourceError() {
   let failCalled = false;
   const writer = {
     writeSync() { return true; },
+    endSync: common.mustNotCall(),
     fail(reason) { failCalled = true; },
   };
   function* failingSource() {
@@ -127,6 +128,7 @@ async function testPipeToSyncWithTransforms() {
   const chunks = [];
   const writer = {
     writeSync(chunk) { chunks.push(new TextDecoder().decode(chunk)); return true; },
+    endSync() { return 0; },
   };
   const upper = (batch) => {
     if (batch === null) return null;
@@ -160,6 +162,7 @@ async function testPipeToSyncWriterTransformMethodIgnored() {
       chunks.push(new TextDecoder().decode(chunk));
       return true;
     },
+    endSync() { return 0; },
   };
 
   pipeToSync(fromSync('hello'), writer);
@@ -240,11 +243,11 @@ async function testPipeToSyncMinimalWriter() {
     },
   };
 
-  pipeToSync(fromSync('minimal-sync'), minimalWriter);
+  pipeToSync(fromSync('minimal-sync'), minimalWriter, { preventClose: true });
   assert.strictEqual(chunks.length > 0, true);
 }
 
-async function testPipeToSyncIterableFastPathWritesIncrementally() {
+async function testPipeToSyncIterableUsesFromBatching() {
   let pulled = 0;
   let firstWritePulled = 0;
   const chunks = [];
@@ -267,7 +270,7 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
 
   const totalBytes = await pipeTo(source(), writer);
   assert.strictEqual(totalBytes, 3);
-  assert.strictEqual(firstWritePulled, 1);
+  assert.strictEqual(firstWritePulled, 3);
   assert.deepStrictEqual(chunks, [
     new Uint8Array([0x61]),
     new Uint8Array([0x62]),
@@ -275,7 +278,31 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
   ]);
 }
 
-async function testPipeToSyncIterableFastPathWriteFallback() {
+async function testPipeToSourceNormalizationIndependentOfWriter() {
+  function source() {
+    return {
+      *[Symbol.iterator]() {
+        yield {
+          async *[Symbol.asyncIterator]() {
+            yield 'nested';
+          },
+        };
+      },
+    };
+  }
+
+  for (const hasWriteSync of [false, true]) {
+    const writer = { write: common.mustNotCall() };
+    if (hasWriteSync) writer.writeSync = common.mustNotCall();
+
+    await assert.rejects(
+      pipeTo(source(), writer, { preventClose: true, preventFail: true }),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+    );
+  }
+}
+
+async function testPipeToSyncIterableWriteFallback() {
   const asyncWrites = [];
   const writer = {
     writeSync(chunk) {
@@ -296,7 +323,7 @@ async function testPipeToSyncIterableFastPathWriteFallback() {
   assert.deepStrictEqual(asyncWrites, [new Uint8Array([0x62])]);
 }
 
-async function testPipeToSyncIterableFastPathAsyncValue() {
+async function testPipeToSyncIterableAsyncValue() {
   const chunks = [];
   const writer = {
     write: common.mustNotCall(),
@@ -334,7 +361,8 @@ Promise.all([
   testPipeToSyncPreventClose(),
   testPipeToMinimalWriter(),
   testPipeToSyncMinimalWriter(),
-  testPipeToSyncIterableFastPathWritesIncrementally(),
-  testPipeToSyncIterableFastPathWriteFallback(),
-  testPipeToSyncIterableFastPathAsyncValue(),
+  testPipeToSyncIterableUsesFromBatching(),
+  testPipeToSyncIterableWriteFallback(),
+  testPipeToSyncIterableAsyncValue(),
+  testPipeToSourceNormalizationIndependentOfWriter(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 3159b718f27e..c341cf296ddd 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -3,7 +3,16 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pull, from, text, tap } = require('stream/iter');
+const {
+  broadcast,
+  from,
+  pull,
+  push,
+  share,
+  tap,
+  text,
+  toAsyncStreamable,
+} = require('stream/iter');
 
 async function testPullIdentity() {
   const data = await text(pull(from('hello-async')));
@@ -40,23 +49,72 @@ async function testPullStatefulTransform() {
   assert.strictEqual(data, 'data-ASYNC-END');
 }
 
+async function testPullStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    async function*(source) {
+      assert.strictEqual(this, descriptor);
+      for await (const chunks of source) {
+        yield chunks;
+      }
+    });
+
+  assert.strictEqual(await text(pull(from('receiver'), descriptor)), 'receiver');
+}
+
 async function testPullWithAbortSignal() {
   async function* gen() {
     yield [new Uint8Array([1])];
   }
 
-  const result = pull(gen(), { signal: AbortSignal.abort() });
-  await assert.rejects(
-    async () => {
-      // eslint-disable-next-line no-unused-vars
-      for await (const _ of result) {
-        assert.fail('Should not reach here');
-      }
-    },
+  assert.throws(
+    () => pull(gen(), { signal: AbortSignal.abort() }),
     { name: 'AbortError' },
   );
 }
 
+async function testPullNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return {
+        async *[Symbol.asyncIterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pull(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(await text(result), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+}
+
+function testPullPreAbortOrdering() {
+  const reason = new Error('already aborted');
+  let protocolCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('data');
+    },
+  };
+  const signal = AbortSignal.abort(reason);
+
+  assert.throws(() => pull(source, { signal }), (error) => error === reason);
+  assert.strictEqual(protocolCalls, 1);
+  assert.throws(
+    () => pull(null, { signal }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+}
+
 async function testPullChainedTransforms() {
   const enc = new TextEncoder();
   const transforms = [
@@ -170,6 +228,61 @@ async function testPullSignalAbortWhileSourceNextPending() {
   await assert.rejects(next, { name: 'AbortError' });
 }
 
+async function testPullReturnWhileSourceNextPending() {
+  let startNext;
+  const nextStarted = new Promise((resolve) => { startNext = resolve; });
+  const source = {
+    [Symbol.asyncIterator]() {
+      return {
+        next() {
+          startNext();
+          return new Promise(() => {});
+        },
+      };
+    },
+  };
+
+  const iter = pull(source)[Symbol.asyncIterator]();
+  const next = assert.rejects(iter.next(), { name: 'AbortError' });
+  await nextStarted;
+
+  const timeout = {};
+  const result = await Promise.race([
+    iter.return(),
+    new Promise((resolve) => setImmediate(resolve, timeout)),
+  ]);
+
+  assert.notStrictEqual(result, timeout);
+  assert.deepStrictEqual(result, { value: undefined, done: true });
+  await next;
+}
+
+async function testTransformedConsumerReturnBeforeNext() {
+  const identity = (chunks) => chunks;
+  const pushed = push(identity);
+  const { broadcast: bc } = broadcast();
+  const broadcastConsumer = bc.push(identity);
+  const shared = share(from('shared'));
+  const sharedConsumer = shared.pull(identity);
+
+  assert.strictEqual(bc.consumerCount, 1);
+  assert.strictEqual(shared.consumerCount, 1);
+
+  const cases = [
+    [pushed.readable, common.mustCall(
+      () => assert.strictEqual(pushed.writer.canWrite, null))],
+    [broadcastConsumer, common.mustCall(
+      () => assert.strictEqual(bc.consumerCount, 0))],
+    [sharedConsumer, common.mustCall(
+      () => assert.strictEqual(shared.consumerCount, 0))],
+  ];
+
+  for (const [readable, verify] of cases) {
+    await readable[Symbol.asyncIterator]().return();
+    verify();
+  }
+}
+
 async function testPullSignalAbortWithTransformWhileSourceNextPending() {
   const source = {
     [Symbol.asyncIterator]() {
@@ -411,12 +524,17 @@ async function testTransformOptionsNotShared() {
     testPullIdentity(),
     testPullStatelessTransform(),
     testPullStatefulTransform(),
+    testPullStatefulTransformReceiver(),
     testPullWithAbortSignal(),
+    testPullNormalizesSourceAtCallTime(),
+    testPullPreAbortOrdering(),
     testPullChainedTransforms(),
     testPullSourceError(),
     testTapCallbackError(),
     testPullSignalAbortMidIteration(),
     testPullSignalAbortWhileSourceNextPending(),
+    testPullReturnWhileSourceNextPending(),
+    testTransformedConsumerReturnBeforeNext(),
     testPullSignalAbortWithTransformWhileSourceNextPending(),
     testPullConsumerBreakCleanup(),
     testPullTransformReturnsPromise(),
diff --git a/test/parallel/test-stream-iter-pull-sync.js b/test/parallel/test-stream-iter-pull-sync.js
index c47a6b3f9233..af481dbfa137 100644
--- a/test/parallel/test-stream-iter-pull-sync.js
+++ b/test/parallel/test-stream-iter-pull-sync.js
@@ -3,7 +3,13 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pullSync, fromSync, bytesSync, tapSync } = require('stream/iter');
+const {
+  pullSync,
+  fromSync,
+  bytesSync,
+  tapSync,
+  toStreamable,
+} = require('stream/iter');
 
 function testPullSyncIdentity() {
   // No transforms - just pass through
@@ -11,6 +17,30 @@ function testPullSyncIdentity() {
   assert.deepStrictEqual(data, new TextEncoder().encode('hello'));
 }
 
+function testPullSyncNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toStreamable]() {
+      protocolCalls++;
+      return {
+        *[Symbol.iterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pullSync(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(new TextDecoder().decode(bytesSync(result)), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+  assert.throws(() => pullSync(null), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 function testPullSyncStatelessTransform() {
   const upper = (chunks) => {
     if (chunks === null) return null;
@@ -44,6 +74,20 @@ function testPullSyncStatefulTransform() {
   assert.strictEqual(data, 'data-END');
 }
 
+function testPullSyncStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    function*(source) {
+      assert.strictEqual(this, descriptor);
+      yield* source;
+    });
+
+  assert.strictEqual(
+    new TextDecoder().decode(bytesSync(pullSync(fromSync('receiver'), descriptor))),
+    'receiver',
+  );
+}
+
 function testPullSyncChainedTransforms() {
   const addExcl = (chunks) => {
     if (chunks === null) return null;
@@ -177,8 +221,10 @@ function testPullSyncInvalidTransform() {
 
 Promise.all([
   testPullSyncIdentity(),
+  testPullSyncNormalizesSourceAtCallTime(),
   testPullSyncStatelessTransform(),
   testPullSyncStatefulTransform(),
+  testPullSyncStatefulTransformReceiver(),
   testPullSyncChainedTransforms(),
   testPullSyncSourceError(),
   testPullSyncEmptySource(),
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 8ce555ca9251..854bd69f0ac6 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -19,6 +19,36 @@ async function testOndrain() {
   assert.strictEqual(ondrain(writer), null);
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, readable } = push({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = readable[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    await iterator.return();
+  }
+}
+
 async function testOndrainNonDrainable() {
   // Non-drainable objects return null
   assert.strictEqual(ondrain(null), null);
@@ -54,9 +84,9 @@ async function testWriteWithSignalRejects() {
   await assert.rejects(writePromise, { name: 'AbortError' });
 
   // Clean up
-  writer.end();
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+  const end = writer.end();
+  await text(readable);
+  await end;
 }
 
 async function testWriteWithPreAbortedSignal() {
@@ -70,9 +100,10 @@ async function testWriteWithPreAbortedSignal() {
 
   // Writer should still be usable for other writes
   writer.write('ok');
-  writer.end();
+  const end = writer.end();
   const data = await text(readable);
   assert.strictEqual(data, 'ok');
+  await end;
 }
 
 async function testCancelledWriteRemovedFromQueue() {
@@ -97,7 +128,7 @@ async function testCancelledWriteRemovedFromQueue() {
   // The cancelled write should NOT occupy a pending slot.
   // A new write should succeed now that the buffer has room.
   await writer.write(kChunk);
-  writer.end();
+  const end = writer.end();
 
   const result = await iter.next();
   assert.ok(!result.done);
@@ -106,7 +137,8 @@ async function testCancelledWriteRemovedFromQueue() {
     totalBytes += chunk.byteLength;
   }
   assert.strictEqual(totalBytes, 16384);
-  await iter.return();
+  assert.strictEqual((await iter.next()).done, true);
+  await end;
 }
 
 async function testOndrainResolvesFalseOnConsumerBreak() {
@@ -184,7 +216,7 @@ async function testWritevSyncInvalidChunkDoesNotQueue() {
   const { writer, readable } = push({ budget: 16384 });
 
   assert.throws(
-    () => writer.writevSync([1]),
+    () => writer.writevSync([Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
 
@@ -294,6 +326,21 @@ async function testEndSignalAbortWhileDraining() {
   assert.strictEqual(await completedEnd, 5);
 }
 
+async function testFactorySignalAbortWhileDraining() {
+  const controller = new AbortController();
+  const reason = new Error('stream aborted while draining');
+  const { writer, readable } = push({ signal: controller.signal });
+
+  writer.writeSync('hello');
+  const end = writer.end();
+  const endRejected = assert.rejects(end, (error) => error === reason);
+  controller.abort(reason);
+
+  await endRejected;
+  await assert.rejects(text(readable), (error) => error === reason);
+  await assert.rejects(writer.end(), (error) => error === reason);
+}
+
 async function testEndAfterEndSyncWaitsForDrain() {
   const { writer, readable } = push();
   writer.writeSync('hello');
@@ -424,6 +471,20 @@ async function testConsumerReturnResolvesPendingRead() {
   assert.strictEqual(readResult.done, true);
 }
 
+async function testEndRejectsAfterConsumerReturn() {
+  const { writer, readable } = push();
+  writer.writeSync('data');
+  const iter = readable[Symbol.asyncIterator]();
+
+  await iter.return();
+
+  await assert.rejects(
+    writer.end({ signal: AbortSignal.timeout(common.platformTimeout(100)) }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual((await iter.next()).done, true);
+}
+
 // iterator.throw() rejects a pending read with the thrown error
 async function testConsumerThrowRejectsPendingRead() {
   const { readable } = push();
@@ -446,28 +507,48 @@ async function testConsumerThrowRejectsPendingRead() {
   await readRejects;
 }
 
-// end() while writes are pending rejects those writes
-async function testEndRejectsPendingWrites() {
+// end() drains writes that were already pending, then waits for EOF to be read.
+async function testEndDrainsPendingWrites() {
   const kChunk = new Uint8Array(16384);
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   writer.writeSync(kChunk); // fill budget
 
   // This write blocks on backpressure
   const writePromise = writer.write(kChunk);
+  const endPromise = writer.end();
+  await assert.rejects(writer.write(kChunk), { code: 'ERR_INVALID_STATE' });
 
-  await new Promise(setImmediate);
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
 
-  // Ending should reject the pending write
-  writer.endSync();
+  assert.strictEqual((await iterator.next()).done, false);
+  await writePromise;
+  assert.strictEqual((await iterator.next()).done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
 
-  await assert.rejects(
-    () => writePromise,
-    { code: 'ERR_INVALID_STATE' },
-  );
+  assert.strictEqual((await iterator.next()).done, true);
+  assert.strictEqual(await endPromise, kChunk.byteLength * 2);
+  assert.strictEqual(ended, true);
+}
 
-  // Clean up: drain the readable
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+async function testEndWaitsForEofPull() {
+  const { writer, readable } = push();
+  writer.writeSync('hello');
+  const endPromise = writer.end();
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
+
+  const data = await iterator.next();
+  assert.strictEqual(data.done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
+
+  assert.strictEqual((await iterator.next()).done, true);
+  await endPromise;
+  assert.strictEqual(ended, true);
 }
 
 async function testEndIdempotentWhenClosed() {
@@ -502,6 +583,23 @@ async function testAsyncDispose() {
   }
 }
 
+async function testAsyncDisposeWaitsAfterEndSync() {
+  const { writer, readable } = push({ budget: 16384 });
+  writer.writeSync('hello');
+  assert.strictEqual(writer.endSync(), -1);
+
+  let disposed = false;
+  const disposal = writer[Symbol.asyncDispose]().then(() => {
+    disposed = true;
+  });
+  await Promise.resolve();
+  assert.strictEqual(disposed, false);
+
+  assert.strictEqual(await text(readable), 'hello');
+  await disposal;
+  assert.strictEqual(disposed, true);
+}
+
 async function testSyncDispose() {
   const { writer, readable } = push({ budget: 16384 });
   writer.writeSync('hello');
@@ -572,6 +670,7 @@ async function testFailRejectsPendingReadWithFalsyReason() {
 
 Promise.all([
   testOndrain(),
+  testDropPoliciesReportPhysicalCapacity(),
   testOndrainNonDrainable(),
   testWriteWithSignalRejects(),
   testWriteWithPreAbortedSignal(),
@@ -589,6 +688,7 @@ Promise.all([
   testEndAsyncReturnValue(),
   testEndWithPreAbortedSignal(),
   testEndSignalAbortWhileDraining(),
+  testFactorySignalAbortWhileDraining(),
   testEndAfterEndSyncWaitsForDrain(),
   testWriteUint8Array(),
   testOndrainWaitsForDrain(),
@@ -599,10 +699,13 @@ Promise.all([
   testFailRejectsFutureReadWithFalsyReason(),
   testFailRejectsPendingReadWithFalsyReason(),
   testConsumerReturnResolvesPendingRead(),
+  testEndRejectsAfterConsumerReturn(),
   testConsumerThrowRejectsPendingRead(),
-  testEndRejectsPendingWrites(),
+  testEndDrainsPendingWrites(),
+  testEndWaitsForEofPull(),
   testEndIdempotentWhenClosed(),
   testEndRejectsWhenErrored(),
   testAsyncDispose(),
+  testAsyncDisposeWaitsAfterEndSync(),
   testSyncDispose(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-resizable-buffers.js b/test/parallel/test-stream-iter-resizable-buffers.js
new file mode 100644
index 000000000000..b66973393cac
--- /dev/null
+++ b/test/parallel/test-stream-iter-resizable-buffers.js
@@ -0,0 +1,178 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  array,
+  arraySync,
+  broadcast,
+  pipeTo,
+  pipeToSync,
+  push,
+  share,
+  shareSync,
+} = require('stream/iter');
+
+const kResizeError = {
+  code: 'ERR_INVALID_STATE',
+  message: /resized or detached/,
+};
+
+async function testBufferedViewMutationRejected() {
+  const resizable = new ArrayBuffer(1, { maxByteLength: 2 });
+  const growable = new SharedArrayBuffer(1, { maxByteLength: 2 });
+  const detachable = new ArrayBuffer(1);
+  const cases = [
+    [new Uint8Array(resizable), () => resizable.resize(2)],
+    [new Uint8Array(growable), () => growable.grow(2)],
+    [new Uint8Array(detachable), () => {
+      structuredClone(detachable, { transfer: [detachable] });
+    }],
+  ];
+
+  for (const [view, mutate] of cases) {
+    const { writer, readable } = push();
+    assert.strictEqual(writer.writeSync(view), true);
+    mutate();
+    await assert.rejects(
+      readable[Symbol.asyncIterator]().next(),
+      kResizeError,
+    );
+  }
+}
+
+async function testDropOldestUsesAcceptedByteLength() {
+  const buffer = new ArrayBuffer(16384, { maxByteLength: 16384 });
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'drop-oldest',
+  });
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(0);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(2)), true);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(3)), true);
+  writer.endSync();
+
+  assert.strictEqual((await iterator.next()).value[0][0], 2);
+  assert.strictEqual((await iterator.next()).value[0][0], 3);
+  assert.strictEqual((await iterator.next()).done, true);
+}
+
+async function testPendingWritesRejectResizedViews() {
+  const pushResult = push({ budget: 16384, backpressure: 'unbounded' });
+  assert.strictEqual(
+    pushResult.writer.writeSync(new Uint8Array(16384)), true);
+  const pushBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const pushPending = pushResult.writer.write(new Uint8Array(pushBuffer));
+  const pushRejected = assert.rejects(pushPending, kResizeError);
+  pushBuffer.resize(2);
+  const pushIterator = pushResult.readable[Symbol.asyncIterator]();
+  assert.strictEqual((await pushIterator.next()).done, false);
+  await pushRejected;
+  pushResult.writer.endSync();
+  assert.strictEqual((await pushIterator.next()).done, true);
+
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const broadcastIterator = bc.push()[Symbol.asyncIterator]();
+  assert.strictEqual(writer.writeSync(new Uint8Array(16384)), true);
+  const broadcastBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const broadcastPending = writer.write(new Uint8Array(broadcastBuffer));
+  const broadcastRejected = assert.rejects(broadcastPending, kResizeError);
+  broadcastBuffer.resize(2);
+  assert.strictEqual((await broadcastIterator.next()).done, false);
+  await broadcastRejected;
+  writer.endSync();
+  assert.strictEqual((await broadcastIterator.next()).done, true);
+}
+
+async function testBroadcastRejectsResizedBufferedView() {
+  const buffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const { writer, broadcast: bc } = broadcast();
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(2);
+
+  await assert.rejects(iterator.next(), kResizeError);
+  await assert.rejects(writer.end(), kResizeError);
+}
+
+async function testShareRejectsResizedBufferedView() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const shared = share([[new Uint8Array(asyncBuffer)]]);
+  const first = shared.pull()[Symbol.asyncIterator]();
+  const second = shared.pull()[Symbol.asyncIterator]();
+
+  assert.strictEqual((await first.next()).done, false);
+  asyncBuffer.resize(2);
+  await assert.rejects(second.next(), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const sharedSync = shareSync([[new Uint8Array(syncBuffer)]]);
+  const firstSync = sharedSync.pull()[Symbol.iterator]();
+  const secondSync = sharedSync.pull()[Symbol.iterator]();
+
+  assert.strictEqual(firstSync.next().done, false);
+  syncBuffer.resize(2);
+  assert.throws(() => secondSync.next(), kResizeError);
+}
+
+async function testConsumersRejectResizedViews() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  async function* asyncSource() {
+    yield [new Uint8Array(asyncBuffer)];
+    asyncBuffer.resize(2);
+  }
+  await assert.rejects(array(asyncSource(), { limit: 1 }), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  function* syncSource() {
+    yield [new Uint8Array(syncBuffer)];
+    syncBuffer.resize(2);
+  }
+  assert.throws(() => arraySync(syncSource(), { limit: 1 }), kResizeError);
+}
+
+async function testPipeRejectsWriterResize() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const asyncWriter = {
+    write() {
+      asyncBuffer.resize(2);
+    },
+    fail: common.mustCall(),
+  };
+  await assert.rejects(
+    pipeTo([new Uint8Array(asyncBuffer)], asyncWriter),
+    kResizeError,
+  );
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const syncWriter = {
+    writeSync() {
+      syncBuffer.resize(2);
+      return true;
+    },
+    fail: common.mustCall(),
+  };
+  assert.throws(
+    () => pipeToSync(
+      [new Uint8Array(syncBuffer)], syncWriter, { preventClose: true }),
+    kResizeError,
+  );
+}
+
+Promise.all([
+  testBufferedViewMutationRejected(),
+  testDropOldestUsesAcceptedByteLength(),
+  testPendingWritesRejectResizedViews(),
+  testBroadcastRejectsResizedBufferedView(),
+  testShareRejectsResizedBufferedView(),
+  testConsumersRejectResizedViews(),
+  testPipeRejectsWriterResize(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index c96a0cb0f3c3..dafb157a7512 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -143,6 +143,70 @@ async function testShareCancelWithFalsyReason() {
   }
 }
 
+async function testShareCancelWhileSourcePullPending() {
+  const noReason = { __proto__: null };
+
+  for (const reason of [noReason, 0]) {
+    const sourceStarted = Promise.withResolvers();
+    const sourceNext = Promise.withResolvers();
+    let nextCalls = 0;
+    let returnCalls = 0;
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() {
+            nextCalls++;
+            sourceStarted.resolve();
+            return sourceNext.promise;
+          },
+          async return() {
+            returnCalls++;
+            return { __proto__: null, done: true, value: undefined };
+          },
+        };
+      },
+    };
+    const shared = share(source);
+    const iterator = shared.pull()[Symbol.asyncIterator]();
+    const read = iterator.next().then(
+      (value) => ({ __proto__: null, rejected: false, value }),
+      (error) => ({ __proto__: null, rejected: true, error }),
+    );
+
+    await sourceStarted.promise;
+    if (reason === noReason) {
+      shared.cancel();
+    } else {
+      shared.cancel(reason);
+    }
+
+    const timedOut = { __proto__: null };
+    const outcome = await Promise.race([
+      read,
+      new Promise((resolve) => setImmediate(resolve, timedOut)),
+    ]);
+    assert.notStrictEqual(outcome, timedOut);
+    if (reason === noReason) {
+      assert.strictEqual(outcome.rejected, false);
+      assert.strictEqual(outcome.value.done, true);
+    } else {
+      assert.strictEqual(outcome.rejected, true);
+      assert.strictEqual(outcome.error, reason);
+    }
+    assert.strictEqual(nextCalls, 1);
+
+    sourceNext.resolve({
+      __proto__: null,
+      done: false,
+      value: [Uint8Array.of(1)],
+    });
+    await new Promise(setImmediate);
+    assert.strictEqual(returnCalls, 1);
+  }
+}
+
 async function testShareAbortSignal() {
   const ac = new AbortController();
   const reason = new Error('share aborted');
@@ -272,6 +336,27 @@ async function testShareSourceError() {
   }, { message: 'share source boom' });
 }
 
+async function testShareSourceErrorFollowsBufferedData() {
+  const reason = new Error('share source boom');
+  async function* failingSource() {
+    yield [Uint8Array.of(1)];
+    throw reason;
+  }
+
+  const shared = share(failingSource());
+  const fast = shared.pull()[Symbol.asyncIterator]();
+  const slow = shared.pull()[Symbol.asyncIterator]();
+  const returned = shared.pull()[Symbol.asyncIterator]();
+  await returned.return();
+
+  assert.deepStrictEqual((await fast.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(fast.next(), (error) => error === reason);
+
+  assert.deepStrictEqual((await slow.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(slow.next(), (error) => error === reason);
+  assert.strictEqual((await returned.next()).done, true);
+}
+
 async function testShareLateJoiningConsumer() {
   // A consumer that joins after some data has been consumed should only
   // see data remaining in the buffer (not items already trimmed).
@@ -380,12 +465,14 @@ Promise.all([
   testShareCancelMidIteration(),
   testShareCancelWithReason(),
   testShareCancelWithFalsyReason(),
+  testShareCancelWhileSourcePullPending(),
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
   testSharePullPreAbortedSignalDoesNotAddConsumer(),
   testShareAlreadyAborted(),
   testShareSourceError(),
+  testShareSourceErrorFollowsBufferedData(),
   testShareLateJoiningConsumer(),
   testShareConsumerBreak(),
   testShareMultipleConsumersConcurrentPull(),
diff --git a/test/parallel/test-stream-iter-transform-roundtrip.js b/test/parallel/test-stream-iter-transform-roundtrip.js
index df63483d6c85..d9a745593c27 100644
--- a/test/parallel/test-stream-iter-transform-roundtrip.js
+++ b/test/parallel/test-stream-iter-transform-roundtrip.js
@@ -42,6 +42,18 @@ async function testGzipRoundTrip() {
   assert.strictEqual(result, input);
 }
 
+async function testValidatedTransformReceiver() {
+  const descriptor = compressGzip();
+  const transform = descriptor.transform;
+  descriptor.transform = common.mustCall(function(source, options) {
+    assert.strictEqual(this, descriptor);
+    return Reflect.apply(transform, this, [source, options]);
+  });
+
+  const result = await bytes(pull(from('receiver'), descriptor));
+  assert.ok(result.byteLength > 0);
+}
+
 async function testGzipLargeData() {
   // 100KB of repeated text - exercises multi-chunk path
   const input = 'gzip large data test. '.repeat(5000);
@@ -250,6 +262,7 @@ async function testGzipWithLevel() {
 (async () => {
   // Gzip
   await testGzipRoundTrip();
+  await testValidatedTransformReceiver();
   await testGzipLargeData();
   await testGzipActuallyCompresses();
 
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index 8dcfb46f173f..871c891a6539 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -22,7 +22,7 @@ const {
 // =============================================================================
 
 // Budget must be integer >= 16384
-assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => push({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 // Values < 16384 are rejected
 assert.throws(() => push({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
@@ -68,12 +68,11 @@ assert.throws(() => push('bad', {}), { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
-// Writer.write rejects non-string/non-Uint8Array
+// Writer chunks use the Web IDL (Uint8Array or USVString) conversion.
 {
   const { writer } = push();
-  assert.throws(() => writer.writeSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync({}), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync(true), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writeSync(Symbol()),
+                { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
@@ -87,7 +86,7 @@ assert.throws(() => duplex({ a: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => duplex({ b: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
 
 // Budget validation (cascades through to push())
-assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -99,16 +98,16 @@ assert.throws(() => duplex({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
   const [a, b] = duplex({ budget: Number.MAX_SAFE_INTEGER });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 // Per-direction overrides
 {
   const [a, b] = duplex({ a: { budget: 16384 }, b: { budget: 32768 } });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 assert.throws(() => duplex({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
@@ -129,7 +128,7 @@ assert.throws(() => pullSync(fromSync('a'), 42), { code: 'ERR_INVALID_ARG_TYPE'
 // broadcast() validation
 // =============================================================================
 
-assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -214,7 +213,7 @@ assert.throws(() => Broadcast.from(42), { code: 'ERR_INVALID_ARG_TYPE' });
 // =============================================================================
 
 assert.throws(() => share(42), { code: 'ERR_INVALID_ARG_TYPE' });
-assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -239,7 +238,7 @@ share(from('a'), { budget: Number.MAX_SAFE_INTEGER }).cancel();
 
 assert.throws(() => shareSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 'bad' }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 1.5 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
@@ -274,7 +273,7 @@ assert.throws(() => bytesSync(fromSync('a'), { limit: 'bad' }),
 assert.throws(() => bytesSync(fromSync('a'), { limit: -1 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 42 }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 'bogus' }),
               { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => arrayBufferSync(fromSync('a'), { limit: 'bad' }),
@@ -318,7 +317,7 @@ async function testAsyncValidation() {
   await assert.rejects(
     () => bytes(from('a'), { limit: -1 }), { code: 'ERR_OUT_OF_RANGE' });
   await assert.rejects(
-    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
+    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_VALUE' });
   await assert.rejects(
     () => text(from('a'), { encoding: 'not-a-real-encoding' }),
     { code: 'ERR_INVALID_ARG_VALUE' });
@@ -397,8 +396,8 @@ async function testAsyncValidation() {
 // Duplex with valid options
 {
   const [a, b] = duplex({ budget: 16384 });
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 // Broadcast with valid options
diff --git a/test/parallel/test-stream-iter-webidl.js b/test/parallel/test-stream-iter-webidl.js
new file mode 100644
index 000000000000..904bf77a647f
--- /dev/null
+++ b/test/parallel/test-stream-iter-webidl.js
@@ -0,0 +1,159 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Writable } = require('stream');
+const {
+  Broadcast,
+  broadcast,
+  bytesSync,
+  from,
+  fromWritable,
+  fromSync,
+  pipeTo,
+  pull,
+  push,
+  share,
+  shareSync,
+  text,
+  textSync,
+} = require('stream/iter');
+
+function testDictionaryAndIntegerConversion() {
+  const pushed = push(null);
+  assert.strictEqual(pushed.writer.endSync(), 0);
+  const transformedWithNull = push((chunks) => chunks, null);
+  transformedWithNull.writer.endSync();
+
+  const broadcasted = broadcast(null);
+  assert.strictEqual(broadcasted.writer.endSync(), 0);
+
+  share(from(''), null).cancel();
+  shareSync(fromSync(''), null).cancel();
+
+  assert.deepStrictEqual(bytesSync(fromSync('data'), null),
+                         new TextEncoder().encode('data'));
+  assert.deepStrictEqual(
+    bytesSync(fromSync('data'), { limit: '4.9' }),
+    new TextEncoder().encode('data'),
+  );
+  assert.throws(
+    () => bytesSync(fromSync('data'), { limit: -1 }),
+    { name: 'TypeError', code: 'ERR_OUT_OF_RANGE' },
+  );
+
+  const converted = push({
+    budget: '16384.9',
+    backpressure: { toString: () => 'strict' },
+  });
+  assert.strictEqual(converted.writer.canWrite, true);
+  converted.writer.endSync();
+
+  let signalReads = 0;
+  const transformed = push((chunks) => chunks, {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  transformed.writer.endSync();
+}
+
+async function testUnknownDictionaryMembers() {
+  const source = pull(from('pull'), {
+    transform: 1,
+    write: 1,
+    unknown: true,
+  });
+  assert.strictEqual(await text(source), 'pull');
+
+  let ended = false;
+  const writer = {
+    write() {},
+    end() { ended = true; },
+  };
+  await pipeTo(from('pipe'), writer, {
+    transform: 1,
+    write: 1,
+  });
+  assert.strictEqual(ended, true);
+
+  const options = {
+    get encoding() {
+      throw new Error('unknown member was read');
+    },
+  };
+  assert.deepStrictEqual(bytesSync(fromSync('bytes'), options),
+                         new TextEncoder().encode('bytes'));
+  assert.strictEqual(textSync(fromSync('text'), {
+    encoding: { toString: () => 'utf-8' },
+  }), 'text');
+}
+
+async function testWriterConversion() {
+  const { writer, readable } = push();
+
+  await writer.write(42, null);
+  assert.strictEqual(writer.writevSync(new Set([
+    null,
+    true,
+    { toString: () => 'object' },
+  ])), true);
+
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.writev('not a sequence object'),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+
+  writer.endSync();
+  assert.strictEqual(await text(readable), '42nulltrueobject');
+}
+
+async function testOtherWriterConversions() {
+  const output = [];
+  const writable = new Writable({
+    write(chunk, encoding, callback) {
+      output.push(chunk.toString());
+      callback();
+    },
+  });
+  const classicWriter = fromWritable(writable);
+  await classicWriter.write(42, null);
+  await classicWriter.writev(new Set([false, '!']));
+  await classicWriter.end(null);
+  assert.strictEqual(output.join(''), '42false!');
+
+  const result = broadcast();
+  const source = result.broadcast.push();
+  await result.writer.write(42, null);
+  await result.writer.writev(new Set([true]));
+  result.writer.endSync();
+  assert.strictEqual(await text(source), '42true');
+
+  let signalReads = 0;
+  const fromResult = Broadcast.from(from(''), {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  fromResult.broadcast.cancel();
+}
+
+Promise.all([
+  testDictionaryAndIntegerConversion(),
+  testUnknownDictionaryMembers(),
+  testWriterConversion(),
+  testOtherWriterConversions(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-writable-interop.js b/test/parallel/test-stream-iter-writable-interop.js
index 110e8e0a7d2e..a8ae0a99cad7 100644
--- a/test/parallel/test-stream-iter-writable-interop.js
+++ b/test/parallel/test-stream-iter-writable-interop.js
@@ -511,25 +511,18 @@ async function testAsyncDispose() {
 }
 
 // =============================================================================
-// write() validates chunk type
+// write() rejects values that cannot be converted to USVString
 // =============================================================================
 
-async function testWriteInvalidChunkType() {
+function testWriteInvalidChunkType() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
   const writer = fromWritable(writable);
 
-  await assert.rejects(
-    writer.write(42),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write(null),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write({}),
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
+  writable.destroy();
 }
 
 // =============================================================================
@@ -559,7 +552,7 @@ function testWritevInvalidChunkUncorks() {
   const writer = fromWritable(writable);
 
   assert.throws(
-    () => writer.writev([new Uint8Array([1]), 42]),
+    () => writer.writev([new Uint8Array([1]), Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
   assert.strictEqual(writable.writableCorked, 0);
diff --git a/test/parallel/test-stream-iter-writer-reentrancy.js b/test/parallel/test-stream-iter-writer-reentrancy.js
new file mode 100644
index 000000000000..119bda269239
--- /dev/null
+++ b/test/parallel/test-stream-iter-writer-reentrancy.js
@@ -0,0 +1,65 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { broadcast, push } = require('stream/iter');
+
+const factories = [
+  () => push({ budget: 16384 }),
+  () => {
+    const { writer, broadcast: bc } = broadcast({ budget: 16384 });
+    return { __proto__: null, writer, readable: bc.push() };
+  },
+];
+
+async function testWritevReentrancy() {
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        assert.strictEqual(
+          writer.writeSync(new Uint8Array(16384)), true);
+        return Uint8Array.of(42);
+      }),
+    });
+
+    let resolved = false;
+    const write = writer.writev(chunks).then(common.mustCall(() => {
+      resolved = true;
+    }));
+    await new Promise(setImmediate);
+    assert.strictEqual(resolved, false);
+
+    const iterator = readable[Symbol.asyncIterator]();
+    assert.strictEqual((await iterator.next()).value[0].byteLength, 16384);
+    await write;
+    assert.strictEqual((await iterator.next()).value[0][0], 42);
+    writer.endSync();
+    assert.strictEqual((await iterator.next()).done, true);
+  }
+
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        writer.endSync();
+        return Uint8Array.of(42);
+      }),
+    });
+
+    await assert.rejects(writer.writev(chunks), {
+      code: 'ERR_INVALID_STATE',
+    });
+    assert.strictEqual(
+      (await readable[Symbol.asyncIterator]().next()).done, true);
+  }
+}
+
+testWritevReentrancy().then(common.mustCall());
diff --git a/test/parallel/test-stream-pipeline-http2.js b/test/parallel/test-stream-pipeline-http2.js
index 8ffee7786838..0b26c95b3a4e 100644
--- a/test/parallel/test-stream-pipeline-http2.js
+++ b/test/parallel/test-stream-pipeline-http2.js
@@ -30,8 +30,7 @@ const http2 = require('http2');
     let received = 0;
     req.on('data', (data) => {
       received += data.length;
-      // Bound the data that flows before teardown - bytes per data event vary
-      // by platform, and letting this run longer hangs on macOS.
+      // Use a byte threshold because data event chunking varies by platform.
       if (received >= 32 * 1024) rs.destroy();
     });
   }));
diff --git a/test/parallel/test-stream-pipeline.js b/test/parallel/test-stream-pipeline.js
index 7b4052f2b47d..4e7ff2f8c79d 100644
--- a/test/parallel/test-stream-pipeline.js
+++ b/test/parallel/test-stream-pipeline.js
@@ -243,12 +243,12 @@ tmpdir.refresh();
     pipeline(rs, res, () => {});
   }));
 
-  let cnt = 10;
+  let received = 0;
 
   const badSink = new Writable({
     write(data, enc, cb) {
-      cnt--;
-      if (cnt === 0) cb(new Error('kaboom'));
+      received += data.length;
+      if (received >= 50) cb(new Error('kaboom'));
       else cb();
     }
   });
diff --git a/test/parallel/test-stream-readable-next-no-null.js b/test/parallel/test-stream-readable-next-no-null.js
index 7599e386ca70..b3348c2b9794 100644
--- a/test/parallel/test-stream-readable-next-no-null.js
+++ b/test/parallel/test-stream-readable-next-no-null.js
@@ -1,19 +1,87 @@
 'use strict';
-const { mustNotCall, expectsError } = require('../common');
+const common = require('../common');
+const assert = require('assert');
 const { Readable } = require('stream');
+const { finished } = require('stream/promises');
 
-async function* generate() {
-  yield null;
-}
-
-const stream = Readable.from(generate());
-
-stream.on('error', expectsError({
+const expectedError = {
   code: 'ERR_STREAM_NULL_VALUES',
   name: 'TypeError',
   message: 'May not write null values to stream'
-}));
+};
+
+async function rejectsNull(iterable, expectedChunks = []) {
+  const stream = Readable.from(iterable);
+  const chunks = [];
+  const completion = finished(stream);
+
+  stream.on('data', (chunk) => chunks.push(chunk));
+
+  await assert.rejects(completion, expectedError);
+  assert.deepStrictEqual(chunks, expectedChunks);
+  assert.strictEqual(stream.destroyed, true);
+}
+
+async function asyncIteratorYieldsNull() {
+  const cleanup = common.mustCall();
+
+  async function* generate() {
+    try {
+      yield null;
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
 
-stream.on('data', mustNotCall());
+async function syncIteratorYieldsNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield null;
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
+
+async function firstSyncValueResolvesToNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve(null);
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
+
+async function laterSyncValueResolvesToNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve('first');
+      yield Promise.resolve(null);
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate(), ['first']);
+}
 
-stream.on('end', mustNotCall());
+Promise.all([
+  asyncIteratorYieldsNull(),
+  syncIteratorYieldsNull(),
+  firstSyncValueResolvesToNull(),
+  laterSyncValueResolvesToNull(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-readable-unobserved-eof-readable.js b/test/parallel/test-stream-readable-unobserved-eof-readable.js
new file mode 100644
index 000000000000..5eb6d1b2b631
--- /dev/null
+++ b/test/parallel/test-stream-readable-unobserved-eof-readable.js
@@ -0,0 +1,76 @@
+'use strict';
+const common = require('../common');
+const { Readable } = require('stream');
+const assert = require('assert');
+
+// When a stream reaches its end while nobody is observing it, the
+// end-of-stream 'readable' emission is not scheduled. It is emitted
+// later if a 'readable' listener is attached, and read()/resume()
+// still reach 'end' on their own.
+
+{
+  // Listener attached synchronously after push(null) gets 'readable'
+  // and then 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  let readableEmitted = false;
+  r.on('readable', common.mustCall(() => {
+    readableEmitted = true;
+    assert.strictEqual(r.read(), null);
+  }));
+  r.on('end', common.mustCall(() => {
+    assert.strictEqual(readableEmitted, true);
+  }));
+}
+
+{
+  // Listener attached one macrotask after the unobserved end still gets
+  // the owed 'readable' before 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    let readableEmitted = false;
+    r.on('readable', common.mustCall(() => {
+      readableEmitted = true;
+      assert.strictEqual(r.read(), null);
+    }));
+    r.on('end', common.mustCall(() => {
+      assert.strictEqual(readableEmitted, true);
+    }));
+  }));
+}
+
+{
+  // A stream that ends unobserved still emits 'end' when resumed later.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.resume();
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // read() after an unobserved end consumes the owed notification: a
+  // 'readable' listener attached afterwards does not receive it, but
+  // 'end' is still emitted.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(r.read(), null);
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // A 'data' listener attached after an unobserved end still gets 'end'.
+  const r = new Readable({ read() {} });
+  r.push('x');
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.on('data', common.mustCall((chunk) => {
+      assert.strictEqual(chunk.toString(), 'x');
+    }));
+    r.on('end', common.mustCall());
+  }));
+}
diff --git a/test/parallel/test-tls-peer-certificate-repeated-reads.js b/test/parallel/test-tls-peer-certificate-repeated-reads.js
new file mode 100644
index 000000000000..a50d69687b9c
--- /dev/null
+++ b/test/parallel/test-tls-peer-certificate-repeated-reads.js
@@ -0,0 +1,87 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// Reading the peer certificate must not consume the chain held by the SSL
+// session. getPeerX509Certificate() and getPeerCertificate() have to keep
+// returning the full chain however often, and in whichever order, they are
+// called on either end of the connection (see the #65579 regression, where an
+// internal getPeerX509Certificate() call left getPeerCertificate(true) with
+// only the leaf). On the server this also covers the peer certificate check
+// that runs before 'secureConnection' is emitted.
+
+const assert = require('assert');
+const { X509Certificate } = require('crypto');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+
+// Each peer presents a distinct leaf -> intermediate -> root chain, so the
+// certificate read back has two issuers above the leaf.
+const serverChain = [
+  'leaf-from-intermediate-cert.pem',
+  'intermediate-ca.pem',
+  'fake-startcom-root-cert.pem',
+].map((name) => fixtures.readKey(name));
+const clientChain = [
+  'agent10-cert.pem',
+  'ca4-cert.pem',
+  'ca2-cert.pem',
+].map((name) => fixtures.readKey(name));
+
+function fingerprints(chain) {
+  return chain.map((pem) => new X509Certificate(pem).fingerprint256);
+}
+
+function checkPeerCertificate(socket, chain, side) {
+  assert.strictEqual(socket.authorized, true, side);
+  const [leaf, intermediate, root] = fingerprints(chain);
+
+  // Two rounds, alternating the read methods, so a chain consumed by one read
+  // would be observed by the next.
+  for (let round = 0; round < 2; round++) {
+    const x509 = socket.getPeerX509Certificate();
+    assert.strictEqual(x509.fingerprint256, leaf, side);
+    assert.strictEqual(x509.issuerCertificate.fingerprint256,
+                       intermediate, side);
+
+    const detailed = socket.getPeerCertificate(true);
+    assert.strictEqual(detailed.fingerprint256, leaf, side);
+    assert.strictEqual(detailed.issuerCertificate.fingerprint256,
+                       intermediate, side);
+    assert.strictEqual(
+      detailed.issuerCertificate.issuerCertificate.fingerprint256, root, side);
+
+    assert.strictEqual(socket.getPeerCertificate().fingerprint256, leaf, side);
+  }
+}
+
+const server = tls.createServer({
+  key: fixtures.readKey('leaf-from-intermediate-key.pem'),
+  cert: Buffer.concat(serverChain),
+  ca: clientChain[2],
+  requestCert: true,
+}, common.mustCall((socket) => {
+  checkPeerCertificate(socket, clientChain, 'server');
+  socket.end();
+}));
+
+server.listen(0, common.mustCall(() => {
+  const socket = tls.connect({
+    port: server.address().port,
+    key: fixtures.readKey('agent10-key.pem'),
+    cert: Buffer.concat(clientChain),
+    ca: serverChain[2],
+  }, common.mustCall(() => {
+    checkPeerCertificate(socket, serverChain, 'client');
+
+    // The client receives the server chain verbatim, so its X509 certificate
+    // links all the way to the root, exercising the recursive issuer build
+    // more than one level deep.
+    const [, , root] = fingerprints(serverChain);
+    const x509 = socket.getPeerX509Certificate();
+    assert.strictEqual(x509.issuerCertificate.issuerCertificate.fingerprint256,
+                       root);
+  }));
+  socket.on('close', common.mustCall(() => server.close()));
+}));
diff --git a/test/parallel/test-trace-events-fs-async.js b/test/parallel/test-trace-events-fs-async.js
index 9b8e21b3d560..2a658838b39e 100644
--- a/test/parallel/test-trace-events-fs-async.js
+++ b/test/parallel/test-trace-events-fs-async.js
@@ -47,8 +47,10 @@ function chown({ uid, gid }) {
 
 function close() {
   const fs = require('fs');
-  fs.writeFile('fs3.txt', '123', 'utf8', () => {
-    fs.unlinkSync('fs3.txt');
+  fs.open('fs3.txt', 'w', (err, fd) => {
+    fs.close(fd, () => {
+      fs.unlinkSync('fs3.txt');
+    });
   });
 }
 
@@ -173,7 +175,8 @@ function mktmp() {
 
 function open() {
   const fs = require('fs');
-  fs.writeFile('fs16.txt', '123', 'utf8', () => {
+  fs.open('fs16.txt', 'w', (err, fd) => {
+    fs.closeSync(fd);
     fs.unlinkSync('fs16.txt');
   });
 }
diff --git a/test/parallel/test-urlpattern.js b/test/parallel/test-urlpattern.js
index 42bdd114f43d..0ba84cae3f81 100644
--- a/test/parallel/test-urlpattern.js
+++ b/test/parallel/test-urlpattern.js
@@ -50,3 +50,43 @@ assert.throws(() => {
   assert.strictEqual(result.pathname.input, '/test');
   assert.strictEqual(result.pathname.groups.value, 'test');
 }
+
+{
+  const accessed = [];
+  const expected = [
+    'baseURL',
+    'hash',
+    'hostname',
+    'password',
+    'pathname',
+    'port',
+    'protocol',
+    'search',
+    'username',
+  ];
+  const init = new Proxy({}, {
+    get(target, name, receiver) {
+      accessed.push(name);
+      return Reflect.get(target, name, receiver);
+    },
+  });
+
+  new URLPattern(init);
+  assert.deepStrictEqual(accessed, expected);
+}
+
+{
+  const input = new URLPattern({ pathname: '/x' })
+    .exec({
+      protocol: 'https',
+      pathname: '/x',
+      username: undefined,
+    }).inputs[0];
+
+  assert.deepStrictEqual(Object.keys(input), ['pathname', 'protocol']);
+  assert.strictEqual('username' in input, false);
+  assert.deepStrictEqual({ ...input }, {
+    pathname: '/x',
+    protocol: 'https',
+  });
+}
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
index 989f6907da69..ae5289cc721c 100644
--- a/test/parallel/test-util-inspect.js
+++ b/test/parallel/test-util-inspect.js
@@ -1475,11 +1475,11 @@ if (typeof Symbol !== 'undefined') {
   assert.strictEqual(util.inspect(new ArraySubclass(1, 2, 3)),
                      'ArraySubclass(3) [ 1, 2, 3 ]');
   assert.strictEqual(util.inspect(new SetSubclass([1, 2, 3])),
-                     'SetSubclass(3) { 1, 2, 3 }');
+                     'SetSubclass(3) [Set] { 1, 2, 3 }');
   assert.strictEqual(util.inspect(new MapSubclass([['foo', 42]])),
-                     "MapSubclass(1) { 'foo' => 42 }");
+                     "MapSubclass(1) [Map] { 'foo' => 42 }");
   assert.strictEqual(util.inspect(new PromiseSubclass(() => {})),
-                     'PromiseSubclass { <pending> }');
+                     'PromiseSubclass [Promise] { <pending> }');
   assert.strictEqual(util.inspect(new SymbolNameClass()),
                      'Symbol(name) {}');
   assert.strictEqual(
@@ -1490,29 +1490,6 @@ if (typeof Symbol !== 'undefined') {
     util.inspect(Object.setPrototypeOf(x, null)),
     '[ObjectSubclass: null prototype] { foo: 42 }'
   );
-
-  class MiddleErrorPart extends Error {}
-  assert(util.inspect(new MiddleErrorPart('foo')).includes('MiddleErrorPart: foo'));
-
-  class MapClass extends Map {}
-  assert.strictEqual(util.inspect(new MapClass([['key', 'value']])),
-                     "MapClass(1) { 'key' => 'value' }");
-
-  class AbcMap extends Map {}
-  assert.strictEqual(util.inspect(new AbcMap([['key', 'value']])),
-                     "AbcMap(1) { 'key' => 'value' }");
-
-  class SetAbc extends Set {}
-  assert.strictEqual(util.inspect(new SetAbc([1, 2, 3])),
-                     'SetAbc(3) { 1, 2, 3 }');
-
-  class FooSet extends Set {}
-  assert.strictEqual(util.inspect(new FooSet([1, 2, 3])),
-                     'FooSet(3) { 1, 2, 3 }');
-
-  class Settings extends Set {}
-  assert.strictEqual(util.inspect(new Settings([1, 2, 3])),
-                     'Settings(3) [Set] { 1, 2, 3 }');
 }
 
 // Empty and circular before depth.
@@ -4070,3 +4047,16 @@ ${error.stack.split('\n').slice(1).join('\n')}`,
   const expected = "{ a: 'short string', b: [ 1, 2 ], c: { d: true } }";
   assert.strictEqual(util.inspect(obj, { breakLength: Infinity }), expected);
 }
+
+{
+  class Class {
+    get [Symbol.toStringTag]() {
+      return 'Namespaced.Class';
+    }
+  }
+
+  class DerivedClass extends Class {}
+
+  assert.strictEqual(inspect(new Class()), 'Namespaced.Class {}');
+  assert.strictEqual(inspect(new DerivedClass()), 'DerivedClass [Namespaced.Class] {}');
+}
diff --git a/test/parallel/test-v8-heap-profile.js b/test/parallel/test-v8-heap-profile.js
index d1c611212509..a8068b1a59ce 100644
--- a/test/parallel/test-v8-heap-profile.js
+++ b/test/parallel/test-v8-heap-profile.js
@@ -44,6 +44,12 @@ assert.throws(
     code: 'ERR_INVALID_ARG_TYPE',
   });
 
+const invalidLimits = [-1, 0, '', {}, NaN, undefined];
+for (const value of invalidLimits) {
+  assert.throws(() => v8.setHeapProfileNearHeapLimit(value),
+                /ERR_INVALID_ARG_TYPE|ERR_OUT_OF_RANGE/);
+}
+
 // Default params.
 {
   const handle = v8.startHeapProfile();
@@ -73,3 +79,11 @@ assert.throws(
   JSON.parse(handle.stop());
   assert.strictEqual(handle.stop(), undefined);
 }
+
+// Profile and snapshot near-heap-limit callbacks coexist.
+{
+  v8.setHeapProfileNearHeapLimit(1);
+  v8.setHeapProfileNearHeapLimit(1);   // no-op
+  v8.setHeapSnapshotNearHeapLimit(1);
+  v8.setHeapSnapshotNearHeapLimit(1);  // no-op
+}
diff --git a/test/parallel/test-vfs-addon.js b/test/parallel/test-vfs-addon.js
new file mode 100644
index 000000000000..1c138a187d0a
--- /dev/null
+++ b/test/parallel/test-vfs-addon.js
@@ -0,0 +1,37 @@
+// Flags: --experimental-vfs
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vfs = require('node:vfs');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) {
+  common.skip('the hello-world addon is not built');
+}
+
+// A native addon inside a mounted VFS can be require()d: dlopen() cannot open
+// the reserved mount path, so the loader hands the addon's bytes to
+// process.dlopen's `binary` option, which loads them from a private temporary
+// image (an in-memory memfd on Linux).
+const myVfs = vfs.create();
+myVfs.writeFileSync('/binding.node', fs.readFileSync(addonPath));
+const mountPoint = myVfs.mount();
+
+const before = new Set(fs.readdirSync(os.tmpdir()));
+const addon = require(path.join(mountPoint, 'binding.node'));
+assert.strictEqual(addon.hello(), 'world');
+
+// On Linux the memfd path never touches the filesystem; on other POSIX the
+// temp image is unlinked right after loading, so no addon temp file lingers.
+// (Windows keeps a delete-on-close file until exit, so skip the check there.)
+if (process.platform !== 'win32') {
+  const leaked = fs.readdirSync(os.tmpdir())
+    .filter((f) => f.startsWith('node-addon') && !before.has(f));
+  assert.deepStrictEqual(leaked, [], `addon temp not cleaned up: ${leaked}`);
+}
+
+myVfs.unmount();
diff --git a/test/parallel/test-vfs-destructuring.js b/test/parallel/test-vfs-destructuring.js
index 11422cf4eda8..e38d15bbb734 100644
--- a/test/parallel/test-vfs-destructuring.js
+++ b/test/parallel/test-vfs-destructuring.js
@@ -18,17 +18,13 @@ const {
   realpathSync,
 } = require('fs');
 
-// path.resolve here so the mount point and the assertion targets are in the
-// platform's native form (e.g. 'D:\vfs_destr' on Windows). VirtualFileSystem
-// stores the mount point via path.resolve internally, so we mirror that.
-const MOUNT = path.resolve('/vfs_destr');
-const FILE = path.join(MOUNT, 'file.txt');
-
 const myVfs = vfs.create();
 myVfs.mkdirSync('/sub', { recursive: true });
 myVfs.writeFileSync('/file.txt', 'hello from vfs');
 myVfs.writeFileSync('/sub/nested.txt', 'nested content');
-myVfs.mount(MOUNT);
+
+const MOUNT = myVfs.mount();
+const FILE = path.join(MOUNT, 'file.txt');
 
 {
   const content = readFileSync(FILE, 'utf8');
diff --git a/test/parallel/test-vfs-fs-accessSync.js b/test/parallel/test-vfs-fs-accessSync.js
index a05bfd132823..9d3469608ecc 100644
--- a/test/parallel/test-vfs-fs-accessSync.js
+++ b/test/parallel/test-vfs-fs-accessSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-accessSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Existing path succeeds
 fs.accessSync(path.join(mountPoint, 'src/hello.txt'));
diff --git a/test/parallel/test-vfs-fs-callback-error-paths.js b/test/parallel/test-vfs-fs-callback-error-paths.js
index 8a9bf95980e5..5cff379eda66 100644
--- a/test/parallel/test-vfs-fs-callback-error-paths.js
+++ b/test/parallel/test-vfs-fs-callback-error-paths.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-cb-err-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-chmod-callback.js b/test/parallel/test-vfs-fs-chmod-callback.js
index 72523a3bd7e8..44f86833c397 100644
--- a/test/parallel/test-vfs-fs-chmod-callback.js
+++ b/test/parallel/test-vfs-fs-chmod-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-chmod-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const target = path.join(mountPoint, 'src/hello.txt');
 const uid = process.getuid?.() ?? 0;
diff --git a/test/parallel/test-vfs-fs-chmodSync.js b/test/parallel/test-vfs-fs-chmodSync.js
index f4403d370872..91a63c36129e 100644
--- a/test/parallel/test-vfs-fs-chmodSync.js
+++ b/test/parallel/test-vfs-fs-chmodSync.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-chmodSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const target = path.join(mountPoint, 'src/hello.txt');
 const uid = process.getuid?.() ?? 0;
diff --git a/test/parallel/test-vfs-fs-copyFileSync.js b/test/parallel/test-vfs-fs-copyFileSync.js
index 9f97421329c5..3383b460862c 100644
--- a/test/parallel/test-vfs-fs-copyFileSync.js
+++ b/test/parallel/test-vfs-fs-copyFileSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-copyFileSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.copyFileSync(
   path.join(mountPoint, 'src/hello.txt'),
diff --git a/test/parallel/test-vfs-fs-createReadStream.js b/test/parallel/test-vfs-fs-createReadStream.js
index 08303a361e1f..357d7db2b923 100644
--- a/test/parallel/test-vfs-fs-createReadStream.js
+++ b/test/parallel/test-vfs-fs-createReadStream.js
@@ -10,14 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-createReadStream-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-createWriteStream.js b/test/parallel/test-vfs-fs-createWriteStream.js
index 42660acb7f63..495d4108db37 100644
--- a/test/parallel/test-vfs-fs-createWriteStream.js
+++ b/test/parallel/test-vfs-fs-createWriteStream.js
@@ -10,15 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve(
-  '/tmp/vfs-createWriteStream-' + process.pid,
-);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-existsSync.js b/test/parallel/test-vfs-fs-existsSync.js
index 190304a154ca..5bb6df4c1c20 100644
--- a/test/parallel/test-vfs-fs-existsSync.js
+++ b/test/parallel/test-vfs-fs-existsSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-existsSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 assert.strictEqual(fs.existsSync(path.join(mountPoint, 'src/hello.txt')), true);
 assert.strictEqual(fs.existsSync(path.join(mountPoint, 'src')), true);
diff --git a/test/parallel/test-vfs-fs-fchmod-callback.js b/test/parallel/test-vfs-fs-fchmod-callback.js
index fa55c934f36f..e46fd27af424 100644
--- a/test/parallel/test-vfs-fs-fchmod-callback.js
+++ b/test/parallel/test-vfs-fs-fchmod-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-fchmod-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const fd = fs.openSync(path.join(mountPoint, 'src/hello.txt'), 'r+');
 const uid = process.getuid?.() ?? 0;
diff --git a/test/parallel/test-vfs-fs-linkSync.js b/test/parallel/test-vfs-fs-linkSync.js
index f8090b24720d..e73bcc76df00 100644
--- a/test/parallel/test-vfs-fs-linkSync.js
+++ b/test/parallel/test-vfs-fs-linkSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-linkSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.linkSync(
   path.join(mountPoint, 'src/hello.txt'),
diff --git a/test/parallel/test-vfs-fs-mkdir-callback.js b/test/parallel/test-vfs-fs-mkdir-callback.js
index e354cc94d01b..4caccda70f6d 100644
--- a/test/parallel/test-vfs-fs-mkdir-callback.js
+++ b/test/parallel/test-vfs-fs-mkdir-callback.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-mkdir-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-mkdirSync.js b/test/parallel/test-vfs-fs-mkdirSync.js
index de3959a06e3b..83942b8856be 100644
--- a/test/parallel/test-vfs-fs-mkdirSync.js
+++ b/test/parallel/test-vfs-fs-mkdirSync.js
@@ -9,10 +9,9 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-mkdirSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Plain mkdir
 fs.mkdirSync(path.join(mountPoint, 'src/d1'));
diff --git a/test/parallel/test-vfs-fs-mkdtempSync.js b/test/parallel/test-vfs-fs-mkdtempSync.js
index ba837b716cb6..2fd1e81d7093 100644
--- a/test/parallel/test-vfs-fs-mkdtempSync.js
+++ b/test/parallel/test-vfs-fs-mkdtempSync.js
@@ -10,10 +10,9 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-mkdtempSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const prefix = path.join(mountPoint, 'src/tmp-');
 
diff --git a/test/parallel/test-vfs-fs-open-callback.js b/test/parallel/test-vfs-fs-open-callback.js
index b1cacb11d921..23a4f8ccadb9 100644
--- a/test/parallel/test-vfs-fs-open-callback.js
+++ b/test/parallel/test-vfs-fs-open-callback.js
@@ -10,14 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-open-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-openAsBlob.js b/test/parallel/test-vfs-fs-openAsBlob.js
index 1c8d175c8f99..663472269156 100644
--- a/test/parallel/test-vfs-fs-openAsBlob.js
+++ b/test/parallel/test-vfs-fs-openAsBlob.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-openAsBlob-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.openAsBlob(path.join(mountPoint, 'src/hello.txt'))
   .then(async (blob) => {
diff --git a/test/parallel/test-vfs-fs-openSync.js b/test/parallel/test-vfs-fs-openSync.js
index 28fa17d28b3c..d1155e36cb14 100644
--- a/test/parallel/test-vfs-fs-openSync.js
+++ b/test/parallel/test-vfs-fs-openSync.js
@@ -12,11 +12,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-openSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // openSync + fstatSync + readSync + closeSync
 {
diff --git a/test/parallel/test-vfs-fs-opendir-callback.js b/test/parallel/test-vfs-fs-opendir-callback.js
index 36b8ef81d74e..6b1f6fe5f884 100644
--- a/test/parallel/test-vfs-fs-opendir-callback.js
+++ b/test/parallel/test-vfs-fs-opendir-callback.js
@@ -10,15 +10,12 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-opendir-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
   myVfs.writeFileSync('/src/data.json', '{}');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-opendirSync.js b/test/parallel/test-vfs-fs-opendirSync.js
index 18ba4c49dd21..260b3114d104 100644
--- a/test/parallel/test-vfs-fs-opendirSync.js
+++ b/test/parallel/test-vfs-fs-opendirSync.js
@@ -9,12 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-opendirSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src/subdir', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
 myVfs.writeFileSync('/src/data.json', '{}');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const dir = fs.opendirSync(path.join(mountPoint, 'src'));
 const names = [];
diff --git a/test/parallel/test-vfs-fs-promises-buffer-encoding.js b/test/parallel/test-vfs-fs-promises-buffer-encoding.js
index cfb38787ab46..0c371c9c4587 100644
--- a/test/parallel/test-vfs-fs-promises-buffer-encoding.js
+++ b/test/parallel/test-vfs-fs-promises-buffer-encoding.js
@@ -10,14 +10,11 @@ const fsp = require('fs/promises');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-buf-enc-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-promises-stat-no-throw.js b/test/parallel/test-vfs-fs-promises-stat-no-throw.js
index 6bd0c546a02d..0b9b28ea1012 100644
--- a/test/parallel/test-vfs-fs-promises-stat-no-throw.js
+++ b/test/parallel/test-vfs-fs-promises-stat-no-throw.js
@@ -11,11 +11,10 @@ const path = require('path');
 const vfs = require('node:vfs');
 
 (async () => {
-  const mountPoint = path.resolve('/tmp/vfs-stat-no-throw-' + process.pid);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
 
   // Missing file -> undefined
   const missing = await fsp.stat(path.join(mountPoint, 'src/nope'),
diff --git a/test/parallel/test-vfs-fs-promises.js b/test/parallel/test-vfs-fs-promises.js
index 0f09c96f83ae..a5761d4ca5dd 100644
--- a/test/parallel/test-vfs-fs-promises.js
+++ b/test/parallel/test-vfs-fs-promises.js
@@ -12,11 +12,10 @@ const path = require('path');
 const vfs = require('node:vfs');
 
 (async () => {
-  const mountPoint = path.resolve('/tmp/vfs-promises-' + process.pid);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   const p = (s) => path.join(mountPoint, s);
 
   // Path-based reads
diff --git a/test/parallel/test-vfs-fs-readFile-callback.js b/test/parallel/test-vfs-fs-readFile-callback.js
index 5902f399b30a..653e79e395a2 100644
--- a/test/parallel/test-vfs-fs-readFile-callback.js
+++ b/test/parallel/test-vfs-fs-readFile-callback.js
@@ -10,14 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-readFile-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-readFileSync.js b/test/parallel/test-vfs-fs-readFileSync.js
index 1ca906b2a057..297a88551014 100644
--- a/test/parallel/test-vfs-fs-readFileSync.js
+++ b/test/parallel/test-vfs-fs-readFileSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-readFileSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Default (buffer) result
 {
@@ -48,15 +47,12 @@ myVfs.unmount();
 // is renamed.
 {
   const root = path.join('/tmp', 'vfs-real-readFileSync-' + process.pid);
-  const realMountPoint = path.join('/tmp', 'vfs-real-readFileSync-mount-' + process.pid);
   fs.rmSync(root, { recursive: true, force: true });
-  fs.rmSync(realMountPoint, { recursive: true, force: true });
   fs.mkdirSync(root, { recursive: true });
-  fs.mkdirSync(realMountPoint, { recursive: true });
 
-  const realVfs = vfs
-    .create(new vfs.RealFSProvider(root), { emitExperimentalWarning: false })
-    .mount(realMountPoint);
+  const realVfs = vfs.create(new vfs.RealFSProvider(root),
+                             { emitExperimentalWarning: false });
+  const realMountPoint = realVfs.mount();
   try {
     fs.writeFileSync(path.join(root, 'a.txt'), 'still readable');
     const fd = fs.openSync(path.join(realMountPoint, 'a.txt'), 'r');
@@ -69,6 +65,5 @@ myVfs.unmount();
   } finally {
     realVfs.unmount();
     fs.rmSync(root, { recursive: true, force: true });
-    fs.rmSync(realMountPoint, { recursive: true, force: true });
   }
 }
diff --git a/test/parallel/test-vfs-fs-readdirSync.js b/test/parallel/test-vfs-fs-readdirSync.js
index 9a7955481339..ee1a1a258b3c 100644
--- a/test/parallel/test-vfs-fs-readdirSync.js
+++ b/test/parallel/test-vfs-fs-readdirSync.js
@@ -10,12 +10,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-readdirSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src/subdir', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
 myVfs.writeFileSync('/src/data.json', '{}');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // Default (utf8 string array)
 {
diff --git a/test/parallel/test-vfs-fs-realpathSync.js b/test/parallel/test-vfs-fs-realpathSync.js
index 77d028877616..2d87b1e87d3b 100644
--- a/test/parallel/test-vfs-fs-realpathSync.js
+++ b/test/parallel/test-vfs-fs-realpathSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-realpathSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const p = path.join(mountPoint, 'src/hello.txt');
 
diff --git a/test/parallel/test-vfs-fs-rename-callback.js b/test/parallel/test-vfs-fs-rename-callback.js
index ccf6cccdd56e..dd426c181e4a 100644
--- a/test/parallel/test-vfs-fs-rename-callback.js
+++ b/test/parallel/test-vfs-fs-rename-callback.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-rename-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-renameSync.js b/test/parallel/test-vfs-fs-renameSync.js
index 88c3f17eef5c..1f1cbf6b394d 100644
--- a/test/parallel/test-vfs-fs-renameSync.js
+++ b/test/parallel/test-vfs-fs-renameSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-renameSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.renameSync(
   path.join(mountPoint, 'src/hello.txt'),
diff --git a/test/parallel/test-vfs-fs-rmSync.js b/test/parallel/test-vfs-fs-rmSync.js
index a6b77a66bc41..4f3af281d61a 100644
--- a/test/parallel/test-vfs-fs-rmSync.js
+++ b/test/parallel/test-vfs-fs-rmSync.js
@@ -9,13 +9,12 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-rmSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src/subdir', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
 myVfs.writeFileSync('/src/subdir/inside.txt', 'inside');
 myVfs.mkdirSync('/empty');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // rmdirSync on an empty directory
 fs.rmdirSync(path.join(mountPoint, 'empty'));
diff --git a/test/parallel/test-vfs-fs-stat-callback.js b/test/parallel/test-vfs-fs-stat-callback.js
index 873d27e14445..bd3494b73fec 100644
--- a/test/parallel/test-vfs-fs-stat-callback.js
+++ b/test/parallel/test-vfs-fs-stat-callback.js
@@ -9,14 +9,11 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-stat-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-statSync.js b/test/parallel/test-vfs-fs-statSync.js
index e952dfab9ad5..5a48c4e426fa 100644
--- a/test/parallel/test-vfs-fs-statSync.js
+++ b/test/parallel/test-vfs-fs-statSync.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-statSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 // statSync on a regular file
 {
diff --git a/test/parallel/test-vfs-fs-symlink-callback.js b/test/parallel/test-vfs-fs-symlink-callback.js
index 004745e0fb97..e35eeb38b980 100644
--- a/test/parallel/test-vfs-fs-symlink-callback.js
+++ b/test/parallel/test-vfs-fs-symlink-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-symlink-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.symlink('hello.txt', path.join(mountPoint, 'src/lnk.txt'),
            common.mustSucceed(() => {
diff --git a/test/parallel/test-vfs-fs-symlinkSync.js b/test/parallel/test-vfs-fs-symlinkSync.js
index 6d043c59a98a..5a39cc281e05 100644
--- a/test/parallel/test-vfs-fs-symlinkSync.js
+++ b/test/parallel/test-vfs-fs-symlinkSync.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-symlinkSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.symlinkSync('hello.txt', path.join(mountPoint, 'src/link.txt'));
 assert.strictEqual(
diff --git a/test/parallel/test-vfs-fs-truncate-callback.js b/test/parallel/test-vfs-fs-truncate-callback.js
index e33ed7e4d614..1399bf6ed149 100644
--- a/test/parallel/test-vfs-fs-truncate-callback.js
+++ b/test/parallel/test-vfs-fs-truncate-callback.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-truncate-cb-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.truncate(path.join(mountPoint, 'src/hello.txt'), 5,
             common.mustSucceed(() => {
diff --git a/test/parallel/test-vfs-fs-truncateSync.js b/test/parallel/test-vfs-fs-truncateSync.js
index 1c15f5647a47..d4ed16f8fb87 100644
--- a/test/parallel/test-vfs-fs-truncateSync.js
+++ b/test/parallel/test-vfs-fs-truncateSync.js
@@ -9,11 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-truncateSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello world');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 fs.truncateSync(path.join(mountPoint, 'src/hello.txt'), 5);
 assert.strictEqual(
diff --git a/test/parallel/test-vfs-fs-watch-dispatch.js b/test/parallel/test-vfs-fs-watch-dispatch.js
index 6d528d6fef7c..e9952919193b 100644
--- a/test/parallel/test-vfs-fs-watch-dispatch.js
+++ b/test/parallel/test-vfs-fs-watch-dispatch.js
@@ -10,11 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-watch-dispatch-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
 myVfs.writeFileSync('/src/hello.txt', 'hello');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const watcher = fs.watch(path.join(mountPoint, 'src/hello.txt'));
 assert.ok(watcher);
diff --git a/test/parallel/test-vfs-fs-writeFile-callback.js b/test/parallel/test-vfs-fs-writeFile-callback.js
index a02dc686b0e0..ce22b6b8811a 100644
--- a/test/parallel/test-vfs-fs-writeFile-callback.js
+++ b/test/parallel/test-vfs-fs-writeFile-callback.js
@@ -9,13 +9,10 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseMountPoint = path.resolve('/tmp/vfs-writeFile-cb-' + process.pid);
-let counter = 0;
 function mounted() {
-  const mountPoint = baseMountPoint + '-' + (counter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
diff --git a/test/parallel/test-vfs-fs-writeFileSync.js b/test/parallel/test-vfs-fs-writeFileSync.js
index eeed2a685f08..7bde5f6c7b85 100644
--- a/test/parallel/test-vfs-fs-writeFileSync.js
+++ b/test/parallel/test-vfs-fs-writeFileSync.js
@@ -9,10 +9,9 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-writeFileSync-' + process.pid);
 const myVfs = vfs.create();
 myVfs.mkdirSync('/src', { recursive: true });
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 const target = path.join(mountPoint, 'src/new.txt');
 
@@ -58,15 +57,12 @@ myVfs.unmount();
 // after the backing path is renamed.
 {
   const root = path.join('/tmp', 'vfs-real-writeFileSync-' + process.pid);
-  const realMountPoint = path.join('/tmp', 'vfs-real-writeFileSync-mount-' + process.pid);
   fs.rmSync(root, { recursive: true, force: true });
-  fs.rmSync(realMountPoint, { recursive: true, force: true });
   fs.mkdirSync(root, { recursive: true });
-  fs.mkdirSync(realMountPoint, { recursive: true });
 
-  const realVfs = vfs
-    .create(new vfs.RealFSProvider(root), { emitExperimentalWarning: false })
-    .mount(realMountPoint);
+  const realVfs = vfs.create(
+    new vfs.RealFSProvider(root), { emitExperimentalWarning: false });
+  const realMountPoint = realVfs.mount();
   try {
     const mountedFile = path.join(realMountPoint, 'a.txt');
     fs.writeFileSync(path.join(root, 'a.txt'), 'old');
@@ -83,6 +79,5 @@ myVfs.unmount();
   } finally {
     realVfs.unmount();
     fs.rmSync(root, { recursive: true, force: true });
-    fs.rmSync(realMountPoint, { recursive: true, force: true });
   }
 }
diff --git a/test/parallel/test-vfs-import.mjs b/test/parallel/test-vfs-import.mjs
new file mode 100644
index 000000000000..03e1047c7b79
--- /dev/null
+++ b/test/parallel/test-vfs-import.mjs
@@ -0,0 +1,139 @@
+// Flags: --experimental-vfs
+import '../common/index.mjs';
+import assert from 'assert';
+import { pathToFileURL } from 'node:url';
+import vfs from 'node:vfs';
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// ESM imports are cached by URL and unmounting does not clear the V8 module
+// cache; each vfs.create() gets its own layer id so mount points are unique.
+
+// Test importing a simple virtual ES module
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/hello.mjs', 'export const message = "hello from vfs";');
+  const mountPoint = myVfs.mount();
+
+  const { message } = await import(vfsImport(`${mountPoint}/hello.mjs`));
+  assert.strictEqual(message, 'hello from vfs');
+
+  myVfs.unmount();
+}
+
+// Test importing a virtual module with default export
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/default.mjs', 'export default { name: "test", value: 42 };');
+  const mountPoint = myVfs.mount();
+
+  const mod = await import(vfsImport(`${mountPoint}/default.mjs`));
+  assert.strictEqual(mod.default.name, 'test');
+  assert.strictEqual(mod.default.value, 42);
+
+  myVfs.unmount();
+}
+
+// Test importing a virtual module that imports another virtual module.
+// Mount first so the embedded absolute specifier can use the mount point.
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/utils.mjs`,
+                      'export function add(a, b) { return a + b; }');
+  myVfs.writeFileSync(`${mountPoint}/main.mjs`, `
+    import { add } from ${JSON.stringify(vfsImport(`${mountPoint}/utils.mjs`))};
+    export const result = add(10, 20);
+  `);
+
+  const { result } = await import(vfsImport(`${mountPoint}/main.mjs`));
+  assert.strictEqual(result, 30);
+
+  myVfs.unmount();
+}
+
+// Test importing with relative paths
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/lib', { recursive: true });
+  myVfs.writeFileSync('/lib/helper.mjs', 'export const helper = () => "helped";');
+  myVfs.writeFileSync('/lib/index.mjs', `
+    import { helper } from './helper.mjs';
+    export const output = helper();
+  `);
+  const mountPoint = myVfs.mount();
+
+  const { output } = await import(vfsImport(`${mountPoint}/lib/index.mjs`));
+  assert.strictEqual(output, 'helped');
+
+  myVfs.unmount();
+}
+
+// Test importing JSON from VFS (with import assertion)
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.json', JSON.stringify({ items: [1, 2, 3], enabled: true }));
+  const mountPoint = myVfs.mount();
+
+  const data = await import(vfsImport(`${mountPoint}/data.json`), { with: { type: 'json' } });
+  assert.deepStrictEqual(data.default.items, [1, 2, 3]);
+  assert.strictEqual(data.default.enabled, true);
+
+  myVfs.unmount();
+}
+
+// Test that real modules still work when VFS is mounted
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/test.mjs', 'export const x = 1;');
+  myVfs.mount();
+
+  const assertMod = await import('node:assert');
+  assert.strictEqual(typeof assertMod.strictEqual, 'function');
+
+  myVfs.unmount();
+}
+
+// Test mixed CJS and ESM - ESM importing from VFS while CJS also works
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/esm-module.mjs', 'export const esmValue = "esm";');
+  myVfs.writeFileSync('/cjs-module.js', 'module.exports = { cjsValue: "cjs" };');
+  const mountPoint = myVfs.mount();
+
+  const { esmValue } = await import(vfsImport(`${mountPoint}/esm-module.mjs`));
+  assert.strictEqual(esmValue, 'esm');
+
+  const { createRequire } = await import('module');
+  const require = createRequire(import.meta.url);
+  const { cjsValue } = require(`${mountPoint}/cjs-module.js`);
+  assert.strictEqual(cjsValue, 'cjs');
+
+  myVfs.unmount();
+}
+
+// Test ESM bare specifier resolution from VFS node_modules.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/my-vfs-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/my-vfs-pkg/package.json', JSON.stringify({
+    name: 'my-vfs-pkg',
+    type: 'module',
+    exports: { '.': './index.mjs' },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/my-vfs-pkg/index.mjs',
+    'export const fromVfs = true;',
+  );
+  // Importing module must live in the VFS mount so node_modules walk stays inside VFS.
+  myVfs.writeFileSync(
+    '/app/entry.mjs',
+    "export { fromVfs } from 'my-vfs-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const { fromVfs } = await import(vfsImport(`${mountPoint}/app/entry.mjs`));
+  assert.strictEqual(fromVfs, true);
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-invalid-package-json.js b/test/parallel/test-vfs-invalid-package-json.js
new file mode 100644
index 000000000000..99589d16afbb
--- /dev/null
+++ b/test/parallel/test-vfs-invalid-package-json.js
@@ -0,0 +1,76 @@
+// Flags: --experimental-vfs --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const vfs = require('node:vfs');
+
+// Malformed package.json in VFS throws ERR_INVALID_PACKAGE_CONFIG
+// (matches native CJS behavior after nodejs/node#48606).
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg', { recursive: true });
+  myVfs.writeFileSync('/pkg/package.json', '{ invalid json');
+  myVfs.writeFileSync('/pkg/index.js', 'module.exports = 42;');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(`${mountPoint}/pkg`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+// Valid package.json still works
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg2', { recursive: true });
+  myVfs.writeFileSync('/pkg2/package.json', '{"main": "lib.js"}');
+  myVfs.writeFileSync('/pkg2/lib.js', 'module.exports = 99;');
+  const mountPoint = myVfs.mount();
+
+  assert.strictEqual(require(`${mountPoint}/pkg2`), 99);
+
+  myVfs.unmount();
+}
+
+// Missing package.json (ENOENT) still falls through to index.js
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg3', { recursive: true });
+  myVfs.writeFileSync('/pkg3/index.js', 'module.exports = 77;');
+  const mountPoint = myVfs.mount();
+
+  assert.strictEqual(require(`${mountPoint}/pkg3`), 77);
+
+  myVfs.unmount();
+}
+
+// A malformed ancestor package.json aborts the scope walk with
+// ERR_INVALID_PACKAGE_CONFIG for both CJS and ESM.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/outer/inner', { recursive: true });
+  myVfs.writeFileSync('/outer/package.json', '{ bad }');
+  myVfs.writeFileSync('/outer/inner/mod.js', 'module.exports = 1;');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(`${mountPoint}/outer/inner/mod.js`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+(async () => {
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/outer2/inner', { recursive: true });
+  myVfs.writeFileSync('/outer2/package.json', '{ bad }');
+  myVfs.writeFileSync('/outer2/inner/mod.js', 'export const x = 1;');
+  myVfs.mount();
+
+  await assert.rejects(
+    () => import(`${myVfs.mountPointURL}/outer2/inner/mod.js`),
+    { code: 'ERR_INVALID_PACKAGE_CONFIG' },
+  );
+
+  myVfs.unmount();
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-layer-tag-prefix.mjs b/test/parallel/test-vfs-layer-tag-prefix.mjs
new file mode 100644
index 000000000000..8c751cee73f9
--- /dev/null
+++ b/test/parallel/test-vfs-layer-tag-prefix.mjs
@@ -0,0 +1,45 @@
+// Flags: --experimental-vfs
+
+// Regression: unmounting a layer whose id is a decimal prefix of another
+// (e.g. layer 1 vs layer 10) must not purge the other's ESM cache entries.
+// Mount points look like `${os.devNull}/vfs/<id>`, so we create instances
+// until the returned mount points exhibit the prefix collision, then
+// verify the survivor's cache lives on.
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { pathToFileURL } from 'node:url';
+import vfs from 'node:vfs';
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// Layer ids are per-process and increment on every `vfs.create()`, so the
+// second construction lands at id 1 and the eleventh at id 10.
+const instances = [];
+for (let i = 0; i < 11; i++) instances.push(vfs.create());
+const layerOne = instances[1];
+const layerTen = instances[10];
+
+layerOne.writeFileSync('/m.mjs', 'export const tag = "one";');
+const mountOne = layerOne.mount();
+
+layerTen.writeFileSync('/m.mjs', 'export const tag = "ten";');
+const mountTen = layerTen.mount();
+
+assert.notStrictEqual(mountOne, mountTen);
+assert.ok(mountTen.startsWith(mountOne),
+          'test scaffolding: expected layerTen mount to start with layerOne mount');
+
+const oneA = await import(vfsImport(`${mountOne}/m.mjs`));
+const tenA = await import(vfsImport(`${mountTen}/m.mjs`));
+assert.strictEqual(oneA.tag, 'one');
+assert.strictEqual(tenA.tag, 'ten');
+
+layerOne.unmount();
+
+// Layer 10 still mounted: re-import must hit the cache and return the same
+// namespace object. A prefix-based purge would evict it and cause re-eval.
+const tenB = await import(vfsImport(`${mountTen}/m.mjs`));
+assert.strictEqual(tenA, tenB);
+
+layerTen.unmount();
diff --git a/test/parallel/test-vfs-lchown-symlink.js b/test/parallel/test-vfs-lchown-symlink.js
index 5eda47432eeb..6154e9fb2de9 100644
--- a/test/parallel/test-vfs-lchown-symlink.js
+++ b/test/parallel/test-vfs-lchown-symlink.js
@@ -8,7 +8,6 @@ const fsp = require('fs/promises');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const mountPoint = path.resolve('/tmp/vfs-lchown-' + process.pid);
 const myVfs = vfs.create();
 myVfs.writeFileSync('/sync-target.txt', 'target');
 myVfs.symlinkSync('/sync-target.txt', '/sync-link.txt');
@@ -16,7 +15,7 @@ myVfs.writeFileSync('/async-target.txt', 'target');
 myVfs.symlinkSync('/async-target.txt', '/async-link.txt');
 myVfs.writeFileSync('/promise-target.txt', 'target');
 myVfs.symlinkSync('/promise-target.txt', '/promise-link.txt');
-myVfs.mount(mountPoint);
+const mountPoint = myVfs.mount();
 
 function assertOwnership(filePath, uid, gid) {
   const stats = fs.lstatSync(path.join(mountPoint, filePath));
diff --git a/test/parallel/test-vfs-memory-provider-dynamic.js b/test/parallel/test-vfs-memory-provider-dynamic.js
index 9ddd105a5a55..13ed609820e7 100644
--- a/test/parallel/test-vfs-memory-provider-dynamic.js
+++ b/test/parallel/test-vfs-memory-provider-dynamic.js
@@ -46,35 +46,43 @@ function makeFileEntry(prototypeFrom, contentProvider) {
   return fileEntry;
 }
 
-// ===== Lazy-populated directory =====
-{
-  const provider = new MemoryProvider();
-  const root = getRoot(provider);
-
-  const dir = {
-    __proto__: Object.getPrototypeOf(root),
+function makeDirEntry(prototypeFrom, populate) {
+  const t = Date.now();
+  const dirEntry = { __proto__: Object.getPrototypeOf(prototypeFrom) };
+  Object.assign(dirEntry, {
     type: 1,           // TYPE_DIR
     mode: 0o755,
     children: new Map(),
-    populate: (scoped) => {
-      scoped.addFile('hello.txt', 'lazy hello');
-      scoped.addFile('dyn.txt', () => 'dynamic-string');
-      scoped.addDirectory('subdir', null);
-      scoped.addSymlink('link.txt', '/lazy/hello.txt');
-    },
+    populate,
     populated: false,
     nlink: 1,
     uid: 0,
     gid: 0,
-  };
-  const t = Date.now();
-  dir.atime = t; dir.mtime = t; dir.ctime = t; dir.birthtime = t;
-  dir.isFile = root.isFile.bind(dir);
-  dir.isDirectory = root.isDirectory.bind(dir);
-  dir.isSymbolicLink = root.isSymbolicLink.bind(dir);
-  dir.isDynamic = root.isDynamic.bind(dir);
-  dir.getContentSync = root.getContentSync.bind(dir);
-  dir.getContentAsync = root.getContentAsync.bind(dir);
+    atime: t,
+    mtime: t,
+    ctime: t,
+    birthtime: t,
+  });
+  dirEntry.isFile = prototypeFrom.isFile.bind(dirEntry);
+  dirEntry.isDirectory = prototypeFrom.isDirectory.bind(dirEntry);
+  dirEntry.isSymbolicLink = prototypeFrom.isSymbolicLink.bind(dirEntry);
+  dirEntry.isDynamic = prototypeFrom.isDynamic.bind(dirEntry);
+  dirEntry.getContentSync = prototypeFrom.getContentSync.bind(dirEntry);
+  dirEntry.getContentAsync = prototypeFrom.getContentAsync.bind(dirEntry);
+  return dirEntry;
+}
+
+// ===== Lazy-populated directory =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+
+  const dir = makeDirEntry(root, (scoped) => {
+    scoped.addFile('hello.txt', 'lazy hello');
+    scoped.addFile('dyn.txt', () => 'dynamic-string');
+    scoped.addDirectory('subdir', null);
+    scoped.addSymlink('link.txt', '/lazy/hello.txt');
+  });
   root.children.set('lazy', dir);
 
   const myVfs = vfs.create(provider);
@@ -125,3 +133,19 @@ function makeFileEntry(prototypeFrom, contentProvider) {
     assert.strictEqual(s, 'async-only');
   }));
 }
+
+// ===== Renaming over a lazy directory does not discard its entries =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+  root.children.set('lazy', makeDirEntry(root, (scoped) => {
+    scoped.addFile('keep.txt', 'keep');
+  }));
+
+  const myVfs = vfs.create(provider);
+  myVfs.mkdirSync('/src');
+
+  assert.throws(() => myVfs.renameSync('/src', '/lazy'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+  assert.strictEqual(myVfs.readFileSync('/lazy/keep.txt', 'utf8'), 'keep');
+}
diff --git a/test/parallel/test-vfs-module-hooks-cleanup.js b/test/parallel/test-vfs-module-hooks-cleanup.js
new file mode 100644
index 000000000000..825957497d1e
--- /dev/null
+++ b/test/parallel/test-vfs-module-hooks-cleanup.js
@@ -0,0 +1,123 @@
+// Flags: --experimental-vfs
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { pathToFileURL } = require('node:url');
+const vfs = require('node:vfs');
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// After a full deregister, a fresh register re-installs hooks cleanly.
+{
+  const a = vfs.create();
+  a.writeFileSync('/m1.js', 'module.exports = "first"');
+  const mountA = a.mount();
+  assert.strictEqual(require(`${mountA}/m1.js`), 'first');
+  a.unmount();
+
+  const b = vfs.create();
+  b.writeFileSync('/m2.js', 'module.exports = "second"');
+  const mountB = b.mount();
+  assert.strictEqual(require(`${mountB}/m2.js`), 'second');
+  b.unmount();
+}
+
+// After the last VFS is removed, real-fs require still works.
+{
+  const v = vfs.create();
+  v.writeFileSync('/x.js', 'module.exports = 1');
+  const mountPoint = v.mount();
+  require(`${mountPoint}/x.js`);
+  v.unmount();
+  const fs = require('fs');
+  assert.strictEqual(typeof fs.readFileSync, 'function');
+}
+
+// Top-level non-object package.json is rejected with ERR_INVALID_PACKAGE_CONFIG
+// (matches the native binding's throw_invalid_package_config path).
+{
+  const v = vfs.create();
+  v.mkdirSync('/pkg');
+  v.writeFileSync('/pkg/package.json', 'null');
+  v.writeFileSync('/pkg/index.js', 'module.exports = 1');
+  const mountPoint = v.mount();
+  assert.throws(
+    () => require(`${mountPoint}/pkg`),
+    { code: 'ERR_INVALID_PACKAGE_CONFIG' },
+  );
+  v.unmount();
+}
+
+// Non-string `main` is silently omitted, matching the native binding
+// (`USE(value.get_string(...))` in src/node_modules.cc).
+{
+  const v = vfs.create();
+  v.mkdirSync('/pkg');
+  v.writeFileSync('/pkg/package.json', '{"main": 42}');
+  v.writeFileSync('/pkg/index.js', 'module.exports = "via-index"');
+  const mountPoint = v.mount();
+  assert.strictEqual(require(`${mountPoint}/pkg`), 'via-index');
+  v.unmount();
+}
+
+// Partial deregister of a multi-mount setup leaves the still-mounted
+// VFS fully functional.
+{
+  const a = vfs.create();
+  a.writeFileSync('/a.js', 'module.exports = "a"');
+  const mountA = a.mount();
+  const b = vfs.create();
+  b.writeFileSync('/b.js', 'module.exports = "b"');
+  const mountB = b.mount();
+
+  assert.strictEqual(require(`${mountA}/a.js`), 'a');
+  assert.strictEqual(require(`${mountB}/b.js`), 'b');
+
+  a.unmount();
+  assert.strictEqual(require(`${mountB}/b.js`), 'b');
+
+  b.unmount();
+}
+
+// ESM legacyMainResolve override produces ERR_MODULE_NOT_FOUND with the
+// resolved candidate path when `main` points at a missing file, and err.url
+// is undefined (regression: previously 'package' leaked into err.url).
+(async () => {
+  const v = vfs.create();
+  v.mkdirSync('/app/node_modules/badpkg', { recursive: true });
+  v.writeFileSync(
+    '/app/node_modules/badpkg/package.json', '{"main": "./nope.js"}');
+  v.writeFileSync('/app/entry.mjs', "import 'badpkg';");
+  const mountPoint = v.mount();
+  await assert.rejects(
+    () => import(vfsImport(`${mountPoint}/app/entry.mjs`)),
+    (err) => {
+      assert.strictEqual(err.code, 'ERR_MODULE_NOT_FOUND');
+      assert.match(err.message, /nope\.js/);
+      assert.match(err.message, /^Cannot find package /);
+      assert.strictEqual(err.url, undefined);
+      return true;
+    },
+  );
+  v.unmount();
+})().then(common.mustCall());
+
+// Symlink inside a VFS: unmount purges cache entries recorded under the
+// resolved realpath too. Remounting the same instance at the same prefix
+// reuses the same mount point, so a stale entry would be revived.
+{
+  const v = vfs.create();
+  v.mkdirSync('/real', { recursive: true });
+  v.writeFileSync('/real/mod.js', 'module.exports = "one"');
+  v.symlinkSync('/real/mod.js', '/link.js');
+  const mountPoint = v.mount();
+  assert.strictEqual(require(`${mountPoint}/link.js`), 'one');
+  v.unmount();
+
+  v.writeFileSync('/real/mod.js', 'module.exports = "two"');
+  const mountPoint2 = v.mount();
+  assert.strictEqual(mountPoint2, mountPoint);
+  assert.strictEqual(require(`${mountPoint2}/link.js`), 'two');
+  v.unmount();
+}
diff --git a/test/parallel/test-vfs-module-hooks.mjs b/test/parallel/test-vfs-module-hooks.mjs
new file mode 100644
index 000000000000..9629b3bdbaf6
--- /dev/null
+++ b/test/parallel/test-vfs-module-hooks.mjs
@@ -0,0 +1,657 @@
+// Flags: --experimental-vfs
+import '../common/index.mjs';
+import assert from 'assert';
+import { createRequire } from 'module';
+import { pathToFileURL } from 'node:url';
+import vfs from 'node:vfs';
+
+const require = createRequire(import.meta.url);
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// mount() returns the actual mount point (reserved under os.devNull);
+// each test captures it and uses it for requires/imports.
+
+// Test: CJS bare specifier resolution with exports string shorthand
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/str-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/str-pkg/package.json', JSON.stringify({
+    name: 'str-pkg',
+    exports: './main.js',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/str-pkg/main.js',
+    'module.exports = { strExport: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry.js',
+    "module.exports = require('str-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry.js`);
+  assert.strictEqual(result.strExport, true);
+
+  myVfs.unmount();
+}
+
+// Test: Conditional exports with import/require/default conditions
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/cond-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/cond-pkg/package.json', JSON.stringify({
+    name: 'cond-pkg',
+    exports: {
+      import: './esm.mjs',
+      require: './cjs.js',
+      default: './default.js',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/cond-pkg/esm.mjs',
+    'export const source = "esm";',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/cond-pkg/cjs.js',
+    'module.exports = { source: "cjs" };',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/cond-pkg/default.js',
+    'module.exports = { source: "default" };',
+  );
+  myVfs.writeFileSync(
+    '/app/esm-entry.mjs',
+    "export { source } from 'cond-pkg';",
+  );
+  myVfs.writeFileSync(
+    '/app/cjs-entry.js',
+    "module.exports = require('cond-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const esmResult = await import(vfsImport(`${mountPoint}/app/esm-entry.mjs`));
+  assert.strictEqual(esmResult.source, 'esm');
+
+  const cjsResult = require(`${mountPoint}/app/cjs-entry.js`);
+  assert.strictEqual(cjsResult.source, 'cjs');
+
+  myVfs.unmount();
+}
+
+// Test: Subpath exports map
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/sub-pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/sub-pkg/package.json', JSON.stringify({
+    name: 'sub-pkg',
+    exports: {
+      '.': './lib/index.mjs',
+      './feature': './lib/feature.mjs',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-pkg/lib/index.mjs',
+    'export const main = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-pkg/lib/feature.mjs',
+    'export const feature = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/entry.mjs',
+    `
+    import { main } from 'sub-pkg';
+    import { feature } from 'sub-pkg/feature';
+    export { main, feature };
+    `,
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry.mjs`));
+  assert.strictEqual(result.main, true);
+  assert.strictEqual(result.feature, true);
+
+  myVfs.unmount();
+}
+
+// Test: Subpath exports with conditional object target
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/sub-cond-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/sub-cond-pkg/package.json', JSON.stringify({
+    name: 'sub-cond-pkg',
+    exports: {
+      '.': {
+        import: './esm.mjs',
+        require: './cjs.js',
+      },
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-cond-pkg/esm.mjs',
+    'export const fromSubCond = "esm";',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/sub-cond-pkg/cjs.js',
+    'module.exports = { fromSubCond: "cjs" };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry2.mjs',
+    "export { fromSubCond } from 'sub-cond-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry2.mjs`));
+  assert.strictEqual(result.fromSubCond, 'esm');
+
+  myVfs.unmount();
+}
+
+// Test: Nested conditional exports (e.g. node -> import/require)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/nested-cond-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/nested-cond-pkg/package.json', JSON.stringify({
+    name: 'nested-cond-pkg',
+    exports: {
+      node: {
+        import: './node-esm.mjs',
+        require: './node-cjs.js',
+      },
+      default: './fallback.js',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/nested-cond-pkg/node-esm.mjs',
+    'export const nested = "node-esm";',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/nested-cond-pkg/node-cjs.js',
+    'module.exports = { nested: "node-cjs" };',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/nested-cond-pkg/fallback.js',
+    'module.exports = { nested: "fallback" };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry3.mjs',
+    "export { nested } from 'nested-cond-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry3.mjs`));
+  assert.strictEqual(result.nested, 'node-esm');
+
+  myVfs.unmount();
+}
+
+// Test: Package without exports, using main field
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/main-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/main-pkg/package.json', JSON.stringify({
+    name: 'main-pkg',
+    main: './lib/entry.js',
+  }));
+  myVfs.mkdirSync('/app/node_modules/main-pkg/lib', { recursive: true });
+  myVfs.writeFileSync(
+    '/app/node_modules/main-pkg/lib/entry.js',
+    'module.exports = { fromMain: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry4.js',
+    "module.exports = require('main-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry4.js`);
+  assert.strictEqual(result.fromMain, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package without exports/main, fallback to index.js
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/index-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/index-pkg/package.json', JSON.stringify({
+    name: 'index-pkg',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/index-pkg/index.js',
+    'module.exports = { fromIndex: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry5.js',
+    "module.exports = require('index-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry5.js`);
+  assert.strictEqual(result.fromIndex, true);
+
+  myVfs.unmount();
+}
+
+// Test: Extension resolution (require without file extension)
+{
+  const myVfs = vfs.create();
+  // The embedded specifier must be an absolute mounted path, so mount first.
+  const mountPoint = myVfs.mount();
+  myVfs.mkdirSync(`${mountPoint}/lib`, { recursive: true });
+  myVfs.writeFileSync(`${mountPoint}/lib/utils.js`, 'module.exports = { ext: "js" };');
+  myVfs.writeFileSync(
+    `${mountPoint}/lib/main.js`,
+    `module.exports = require(${JSON.stringify(`${mountPoint}/lib/utils`)});`,
+  );
+
+  const result = require(`${mountPoint}/lib/main.js`);
+  assert.strictEqual(result.ext, 'js');
+
+  myVfs.unmount();
+}
+
+// Test: Extension resolution with .json
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/data.json`, JSON.stringify({ ext: 'json' }));
+  myVfs.writeFileSync(
+    `${mountPoint}/reader.js`,
+    `module.exports = require(${JSON.stringify(`${mountPoint}/data`)});`,
+  );
+
+  const result = require(`${mountPoint}/reader.js`);
+  assert.strictEqual(result.ext, 'json');
+
+  myVfs.unmount();
+}
+
+// Test: Scoped package resolution (@scope/pkg)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/@myorg/mylib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/@myorg/mylib/package.json', JSON.stringify({
+    name: '@myorg/mylib',
+    type: 'module',
+    exports: './index.mjs',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/@myorg/mylib/index.mjs',
+    'export const scoped = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/scoped-entry.mjs',
+    "export { scoped } from '@myorg/mylib';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/scoped-entry.mjs`));
+  assert.strictEqual(result.scoped, true);
+
+  myVfs.unmount();
+}
+
+// Test: Scoped package with subpath
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/@myorg/utils/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/@myorg/utils/package.json', JSON.stringify({
+    name: '@myorg/utils',
+    exports: {
+      '.': './lib/index.mjs',
+      './helpers': './lib/helpers.mjs',
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/@myorg/utils/lib/index.mjs',
+    'export const main = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/node_modules/@myorg/utils/lib/helpers.mjs',
+    'export const helpers = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/scoped-sub-entry.mjs',
+    `
+    import { helpers } from '@myorg/utils/helpers';
+    export { helpers };
+    `,
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/scoped-sub-entry.mjs`));
+  assert.strictEqual(result.helpers, true);
+
+  myVfs.unmount();
+}
+
+// Test: .js file with type: module in package.json -> ESM format
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', JSON.stringify({ type: 'module' }));
+  myVfs.writeFileSync('/mod.js', 'export const fromModule = true;');
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/mod.js`));
+  assert.strictEqual(result.fromModule, true);
+
+  myVfs.unmount();
+}
+
+// Test: .cjs always treated as CommonJS regardless of package type
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/package.json`, JSON.stringify({ type: 'module' }));
+  myVfs.writeFileSync(`${mountPoint}/helper.cjs`, 'module.exports = { cjsAlways: true };');
+  myVfs.writeFileSync(
+    `${mountPoint}/use-cjs.js`,
+    `
+    import { createRequire } from 'module';
+    const require = createRequire(import.meta.url);
+    const result = require(${JSON.stringify(`${mountPoint}/helper.cjs`)});
+    export const cjsAlways = result.cjsAlways;
+    `,
+  );
+
+  const result = await import(vfsImport(`${mountPoint}/use-cjs.js`));
+  assert.strictEqual(result.cjsAlways, true);
+
+  myVfs.unmount();
+}
+
+// Test: file: URL specifier
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/fileurl.mjs', 'export const fromFileUrl = true;');
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/fileurl.mjs`));
+  assert.strictEqual(result.fromFileUrl, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package with main field requiring extension resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/dir-pkg', { recursive: true });
+  myVfs.writeFileSync('/dir-pkg/package.json', JSON.stringify({
+    name: 'dir-pkg',
+    main: './entry',
+  }));
+  myVfs.writeFileSync(
+    '/dir-pkg/entry.js',
+    'module.exports = { dirPkg: true };',
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/dir-pkg`);
+  assert.strictEqual(result.dirPkg, true);
+
+  myVfs.unmount();
+}
+
+// Test: Bare specifier with package subpath (no exports, direct file)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/direct-pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/direct-pkg/package.json', JSON.stringify({
+    name: 'direct-pkg',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/direct-pkg/lib/util.js',
+    'module.exports = { directSub: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-sub.js',
+    "module.exports = require('direct-pkg/lib/util.js');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-sub.js`);
+  assert.strictEqual(result.directSub, true);
+
+  myVfs.unmount();
+}
+
+// Test: Bare specifier subpath with extension resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/ext-pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/ext-pkg/package.json', JSON.stringify({
+    name: 'ext-pkg',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/ext-pkg/lib/util.js',
+    'module.exports = { extSub: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-ext.js',
+    "module.exports = require('ext-pkg/lib/util');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-ext.js`);
+  assert.strictEqual(result.extSub, true);
+
+  myVfs.unmount();
+}
+
+// Test: Bare specifier main field with extension resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/main-ext-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/main-ext-pkg/package.json', JSON.stringify({
+    name: 'main-ext-pkg',
+    main: './entry',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/main-ext-pkg/entry.js',
+    'module.exports = { mainExt: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-main-ext.js',
+    "module.exports = require('main-ext-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-main-ext.js`);
+  assert.strictEqual(result.mainExt, true);
+
+  myVfs.unmount();
+}
+
+// Test: exports with array value (fallback array)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/arr-exp-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/arr-exp-pkg/package.json', JSON.stringify({
+    name: 'arr-exp-pkg',
+    exports: {
+      '.': ['./index.js', './fallback.js'],
+    },
+    main: './index.js',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/arr-exp-pkg/index.js',
+    'module.exports = { arrExport: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-arr.js',
+    "module.exports = require('arr-exp-pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-arr.js`);
+  assert.strictEqual(result.arrExport, true);
+
+  myVfs.unmount();
+}
+
+// Test: Exports with "default" condition
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/default-pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/default-pkg/package.json', JSON.stringify({
+    name: 'default-pkg',
+    exports: {
+      '.': {
+        browser: './browser.js',
+        default: './default.mjs',
+      },
+    },
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/default-pkg/default.mjs',
+    'export const fromDefault = true;',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-default.mjs',
+    "export { fromDefault } from 'default-pkg';",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/app/entry-default.mjs`));
+  assert.strictEqual(result.fromDefault, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package.json type "commonjs" explicitly set for .js
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', JSON.stringify({ type: 'commonjs' }));
+  myVfs.writeFileSync('/explicit-cjs.js', 'module.exports = { explicitCjs: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/explicit-cjs.js`);
+  assert.strictEqual(result.explicitCjs, true);
+
+  myVfs.unmount();
+}
+
+// Test: .js file with no package.json -> defaults to commonjs
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/no-pkg.js', 'module.exports = { noPkg: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/no-pkg.js`);
+  assert.strictEqual(result.noPkg, true);
+
+  myVfs.unmount();
+}
+
+// Test: Package.json type walk stops at node_modules boundary
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', JSON.stringify({ type: 'module' }));
+  myVfs.mkdirSync('/node_modules/inner', { recursive: true });
+  myVfs.writeFileSync(
+    '/node_modules/inner/index.js',
+    'module.exports = { inner: true };',
+  );
+  const mountPoint = myVfs.mount();
+
+  // Walk stops at node_modules; type:module from root is not inherited.
+  const result = require(`${mountPoint}/node_modules/inner/index.js`);
+  assert.strictEqual(result.inner, true);
+
+  myVfs.unmount();
+}
+
+// Test: Invalid package.json in directory resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/bad-json-dir', { recursive: true });
+  myVfs.writeFileSync('/bad-json-dir/package.json', '{ invalid json }');
+  myVfs.writeFileSync(
+    '/bad-json-dir/index.js',
+    'module.exports = { fallbackIndex: true };',
+  );
+  const mountPoint = myVfs.mount();
+
+  // Malformed package.json raises ERR_INVALID_PACKAGE_CONFIG after nodejs/node#48606.
+  assert.throws(() => require(`${mountPoint}/bad-json-dir`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+// Test: Invalid package.json in type walk-up
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/package.json', '{ broken json }');
+  myVfs.writeFileSync('/no-type.js', 'module.exports = { noType: true };');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(`${mountPoint}/no-type.js`),
+                { code: 'ERR_INVALID_PACKAGE_CONFIG' });
+
+  myVfs.unmount();
+}
+
+// Test: Scoped package without slash (just @scope/name)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/@solo/pkg', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/@solo/pkg/package.json', JSON.stringify({
+    name: '@solo/pkg',
+    main: './index.js',
+  }));
+  myVfs.writeFileSync(
+    '/app/node_modules/@solo/pkg/index.js',
+    'module.exports = { solo: true };',
+  );
+  myVfs.writeFileSync(
+    '/app/entry-solo.js',
+    "module.exports = require('@solo/pkg');",
+  );
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/app/entry-solo.js`);
+  assert.strictEqual(result.solo, true);
+
+  myVfs.unmount();
+}
+
+// Test: node: builtin passthrough
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/use-builtin.mjs', `
+    import path from 'node:path';
+    export const sep = path.sep;
+  `);
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/use-builtin.mjs`));
+  assert.strictEqual(typeof result.sep, 'string');
+
+  myVfs.unmount();
+}
+
+// Test: JSON import with type assertion
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.json', JSON.stringify({ preformat: true }));
+  const mountPoint = myVfs.mount();
+
+  const result = await import(vfsImport(`${mountPoint}/data.json`), { with: { type: 'json' } });
+  assert.strictEqual(result.default.preformat, true);
+
+  myVfs.unmount();
+}
+
+// Test: File with unknown extension -> defaults to commonjs
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.txt', 'module.exports = { txt: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/data.txt`);
+  assert.strictEqual(result.txt, true);
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-module-paths.js b/test/parallel/test-vfs-module-paths.js
new file mode 100644
index 000000000000..25c0ce0ba26a
--- /dev/null
+++ b/test/parallel/test-vfs-module-paths.js
@@ -0,0 +1,106 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// The `node_modules` lookup for modules inside a mounted VFS stops at the
+// mount point: no candidate directories above the mount root are generated,
+// while the legacy CommonJS global folders (NODE_PATH etc.) still apply.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('url');
+const { execFileSync } = require('child_process');
+const Module = require('module');
+const vfs = require('node:vfs');
+const tmpdir = require('../common/tmpdir');
+
+// Test: module.paths for a CJS module inside a mounted VFS ends at the
+// mount root.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/foo/bar', { recursive: true });
+  myVfs.writeFileSync('/foo/bar/main.cjs', 'module.exports = module.paths;');
+  const mountPoint = myVfs.mount();
+
+  const paths = require(path.join(mountPoint, 'foo/bar/main.cjs'));
+  assert.deepStrictEqual(paths, [
+    path.join(mountPoint, 'foo/bar/node_modules'),
+    path.join(mountPoint, 'foo/node_modules'),
+    path.join(mountPoint, 'node_modules'),
+  ]);
+
+  myVfs.unmount();
+}
+
+// Test: Module._nodeModulePaths for real paths still walks to the file
+// system root.
+{
+  const paths = Module._nodeModulePaths(__dirname);
+  const root = path.parse(__dirname).root;
+  assert.strictEqual(paths[paths.length - 1],
+                     path.join(root, 'node_modules'));
+}
+
+// Test: bare specifiers resolve through node_modules directories inside
+// the VFS, for both require() and import.
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/dep', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/dep/package.json',
+                      '{"name":"dep","main":"index.js"}');
+  myVfs.writeFileSync('/app/node_modules/dep/index.js',
+                      'module.exports = "dep-from-vfs";');
+  myVfs.writeFileSync('/app/main.cjs', 'module.exports = require("dep");');
+  myVfs.writeFileSync('/app/main.mjs',
+                      'import dep from "dep"; export default dep;');
+  const mountPoint = myVfs.mount();
+
+  assert.strictEqual(require(path.join(mountPoint, 'app/main.cjs')),
+                     'dep-from-vfs');
+
+  import(pathToFileURL(path.join(mountPoint, 'app/main.mjs')).href)
+    .then(common.mustCall((ns) => {
+      assert.strictEqual(ns.default, 'dep-from-vfs');
+      myVfs.unmount();
+    }));
+}
+
+// Test: a bare specifier that exists nowhere fails for both loaders.
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/missing.cjs', 'require("missing-pkg-xyz");');
+  myVfs.writeFileSync('/missing.mjs', 'import "missing-pkg-xyz";');
+  const mountPoint = myVfs.mount();
+
+  assert.throws(() => require(path.join(mountPoint, 'missing.cjs')),
+                { code: 'MODULE_NOT_FOUND' });
+
+  assert.rejects(
+    import(pathToFileURL(path.join(mountPoint, 'missing.mjs')).href),
+    { code: 'ERR_MODULE_NOT_FOUND' },
+  ).then(() => myVfs.unmount()).then(common.mustCall());
+}
+
+// Test: the legacy CommonJS global folders still apply to require() from
+// inside a VFS: a NODE_PATH directory provides the fallback.
+{
+  tmpdir.refresh();
+  const globalDir = tmpdir.resolve('gpath');
+  fs.mkdirSync(path.join(globalDir, 'gdep'), { recursive: true });
+  fs.writeFileSync(path.join(globalDir, 'gdep', 'index.js'),
+                   'module.exports = "from-node-path";');
+
+  const out = execFileSync(process.execPath, ['--experimental-vfs', '-e', `
+    const vfs = require('node:vfs');
+    const path = require('path');
+    const myVfs = vfs.create();
+    myVfs.writeFileSync('/main.cjs', 'console.log(require("gdep"));');
+    const mountPoint = myVfs.mount();
+    require(path.join(mountPoint, 'main.cjs'));
+  `], {
+    encoding: 'utf8',
+    env: { ...process.env, NODE_PATH: globalDir, NODE_NO_WARNINGS: '1' },
+  });
+  assert.strictEqual(out.trim(), 'from-node-path');
+}
diff --git a/test/parallel/test-vfs-mount-errors.js b/test/parallel/test-vfs-mount-errors.js
index 905f1c6d0683..dd0fef606421 100644
--- a/test/parallel/test-vfs-mount-errors.js
+++ b/test/parallel/test-vfs-mount-errors.js
@@ -3,30 +3,25 @@
 
 // Error paths in the VFS mount layer:
 // - EXDEV when renaming/linking across different VFS instances or VFS<->real
-// - lastunmount handler cleanup (vfsState.handlers becomes null again)
-// - rename of root mount point is rejected as overlapping
+// - last-unmount handler cleanup (vfsState.handlers becomes null again)
+// - namespace isolation between layers
 
 require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const vfs = require('node:vfs');
 const { vfsState } = require('internal/fs/utils');
 
-const baseMountPoint = path.resolve('/tmp/vfs-mount-errors-' + process.pid);
-let mountCounter = 0;
-const nextMount = () => baseMountPoint + '-' + (mountCounter++);
-
 // EXDEV: rename across two different VFS instances
 {
-  const mountA = nextMount();
-  const mountB = nextMount();
   const a = vfs.create();
   const b = vfs.create();
   a.writeFileSync('/file.txt', 'a');
   b.mkdirSync('/x', { recursive: true });
-  a.mount(mountA);
-  b.mount(mountB);
+  const mountA = a.mount();
+  const mountB = b.mount();
 
   assert.throws(
     () => fs.renameSync(path.join(mountA, 'file.txt'),
@@ -39,14 +34,12 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 
 // EXDEV: copyFileSync across two different VFS instances
 {
-  const mountA = nextMount();
-  const mountB = nextMount();
   const a = vfs.create();
   const b = vfs.create();
   a.writeFileSync('/file.txt', 'a');
   b.mkdirSync('/x', { recursive: true });
-  a.mount(mountA);
-  b.mount(mountB);
+  const mountA = a.mount();
+  const mountB = b.mount();
 
   assert.throws(
     () => fs.copyFileSync(path.join(mountA, 'file.txt'),
@@ -59,14 +52,12 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 
 // EXDEV: linkSync across two different VFS instances
 {
-  const mountA = nextMount();
-  const mountB = nextMount();
   const a = vfs.create();
   const b = vfs.create();
   a.writeFileSync('/file.txt', 'a');
   b.mkdirSync('/x', { recursive: true });
-  a.mount(mountA);
-  b.mount(mountB);
+  const mountA = a.mount();
+  const mountB = b.mount();
 
   assert.throws(
     () => fs.linkSync(path.join(mountA, 'file.txt'),
@@ -79,10 +70,9 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 
 // EXDEV: rename from VFS to a real-fs path
 {
-  const mountA = nextMount();
   const a = vfs.create();
   a.writeFileSync('/file.txt', 'a');
-  a.mount(mountA);
+  const mountA = a.mount();
 
   const tmpReal = '/tmp/vfs-mount-real-' + process.pid + '.txt';
   assert.throws(
@@ -96,25 +86,25 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
 {
   assert.strictEqual(vfsState.handlers, null);
   const x = vfs.create();
-  x.mount(nextMount());
+  x.mount();
   assert.notStrictEqual(vfsState.handlers, null);
   x.unmount();
   assert.strictEqual(vfsState.handlers, null);
 
   // And it re-installs on a subsequent mount
   const y = vfs.create();
-  y.mount(nextMount());
+  y.mount();
   assert.notStrictEqual(vfsState.handlers, null);
   y.unmount();
   assert.strictEqual(vfsState.handlers, null);
 }
 
-// Two parallel non-overlapping mounts both register, last-out clears handlers
+// Two parallel mounts both register, last-out clears handlers
 {
   const a = vfs.create();
   const b = vfs.create();
-  a.mount(nextMount());
-  b.mount(nextMount());
+  a.mount();
+  b.mount();
   assert.notStrictEqual(vfsState.handlers, null);
   a.unmount();
   assert.notStrictEqual(vfsState.handlers, null);
@@ -122,38 +112,30 @@ const nextMount = () => baseMountPoint + '-' + (mountCounter++);
   assert.strictEqual(vfsState.handlers, null);
 }
 
-// Overlap detection: nested-under and parent-of both rejected
+// Namespace isolation: a path in an unmounted (or never-mounted) layer
+// namespace is not served by other active layers.
 {
-  const parent = nextMount();
-  const child = path.join(parent, 'child');
   const a = vfs.create();
   const b = vfs.create();
-  a.mount(parent);
-  assert.throws(() => b.mount(child), { code: 'ERR_INVALID_STATE' });
-  a.unmount();
-
-  // Reverse direction: child first, then parent rejected
-  const c = vfs.create();
-  const d = vfs.create();
-  c.mount(child);
-  assert.throws(() => d.mount(parent), { code: 'ERR_INVALID_STATE' });
-  c.unmount();
-}
-
-// Equal mount points: second one rejected
-{
-  const m = nextMount();
-  const a = vfs.create();
-  const b = vfs.create();
-  a.mount(m);
-  assert.throws(() => b.mount(m), { code: 'ERR_INVALID_STATE' });
+  a.writeFileSync('/f.txt', 'a');
+  b.writeFileSync('/f.txt', 'b');
+  const mountA = a.mount();
+  const mountB = b.mount();
+  assert.notStrictEqual(mountA, mountB);
+  b.unmount();
+  // B's namespace is dead even though A is still mounted.
+  assert.strictEqual(fs.existsSync(path.join(mountB, 'f.txt')), false);
+  assert.strictEqual(fs.readFileSync(path.join(mountA, 'f.txt'), 'utf8'), 'a');
+  // A malformed layer segment under the VFS root is not served either.
+  const bogus = path.join(os.devNull, 'vfs', 'not-a-number', 'f.txt');
+  assert.strictEqual(fs.existsSync(bogus), false);
   a.unmount();
 }
 
 // Double-mount of same instance rejected
 {
   const a = vfs.create();
-  a.mount(nextMount());
-  assert.throws(() => a.mount(nextMount()), { code: 'ERR_INVALID_STATE' });
+  a.mount();
+  assert.throws(() => a.mount(), { code: 'ERR_INVALID_STATE' });
   a.unmount();
 }
diff --git a/test/parallel/test-vfs-mount-point-url.js b/test/parallel/test-vfs-mount-point-url.js
new file mode 100644
index 000000000000..717919a26909
--- /dev/null
+++ b/test/parallel/test-vfs-mount-point-url.js
@@ -0,0 +1,41 @@
+// Flags: --experimental-vfs
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const { pathToFileURL } = require('url');
+const vfs = require('node:vfs');
+
+// Test: null while not mounted.
+{
+  const myVfs = vfs.create();
+  assert.strictEqual(myVfs.mountPointURL, null);
+}
+
+// Test: file: URL string of the mount point while mounted, null again
+// after unmounting.
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+
+  const url = myVfs.mountPointURL;
+  assert.strictEqual(typeof url, 'string');
+  assert.ok(url.startsWith('file:'));
+  assert.strictEqual(url, pathToFileURL(mountPoint).href);
+
+  myVfs.unmount();
+  assert.strictEqual(myVfs.mountPointURL, null);
+}
+
+// Test: the URL is usable to address files in the mounted VFS.
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.txt', 'hello url');
+  myVfs.mount();
+
+  const fileURL = new URL(`${myVfs.mountPointURL}/data.txt`);
+  assert.strictEqual(fs.readFileSync(fileURL, 'utf8'), 'hello url');
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-mount.js b/test/parallel/test-vfs-mount.js
index e59e39eef971..2334e7d1e7ec 100644
--- a/test/parallel/test-vfs-mount.js
+++ b/test/parallel/test-vfs-mount.js
@@ -5,32 +5,37 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const vfs = require('node:vfs');
 
-// Basic mount/unmount API and dispatch through node:vfs from the public fs.
+// Mount points look like `${os.devNull}/vfs/<id>` where `<id>` is a decimal
+// integer segment. This regex captures that structural invariant without
+// tying the tests to a specific id.
+const mountPointShape = new RegExp(
+  `^${os.devNull.replace(/[\\^$.*+?()[\]{}|/\\\\]/g, '\\$&')}` +
+  `\\${path.sep}vfs\\${path.sep}\\d+$`,
+);
 
-const baseMountPoint = path.resolve('/tmp/vfs-mount-' + process.pid);
-let mountCounter = 0;
+// Basic mount/unmount API and dispatch through node:vfs from the public fs.
 
 function createMountedVfs() {
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
   const myVfs = vfs.create();
   myVfs.mkdirSync('/src', { recursive: true });
   myVfs.writeFileSync('/src/hello.txt', 'hello world');
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   return { myVfs, mountPoint };
 }
 
-// Test: mounted/mountPoint getters
+// Test: mounted/mountPoint getters; mount() returns a path under os.devNull.
 {
   const myVfs = vfs.create();
   assert.strictEqual(myVfs.mounted, false);
   assert.strictEqual(myVfs.mountPoint, null);
 
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  myVfs.mount(mountPoint);
+  const mountPoint = myVfs.mount();
   assert.strictEqual(myVfs.mounted, true);
   assert.strictEqual(myVfs.mountPoint, mountPoint);
+  assert.match(mountPoint, mountPointShape);
 
   myVfs.unmount();
   assert.strictEqual(myVfs.mounted, false);
@@ -40,22 +45,26 @@ function createMountedVfs() {
 // Test: double-mount throws
 {
   const myVfs = vfs.create();
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  myVfs.mount(mountPoint);
-  assert.throws(() => myVfs.mount(mountPoint), { code: 'ERR_INVALID_STATE' });
+  myVfs.mount();
+  assert.throws(() => myVfs.mount(), { code: 'ERR_INVALID_STATE' });
   myVfs.unmount();
 }
 
-// Test: overlapping mounts throw
+// Test: two instances get distinct mount points in their own layer namespace.
 {
   const a = vfs.create();
   const b = vfs.create();
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  a.mount(mountPoint);
-  assert.throws(() => b.mount(mountPoint), { code: 'ERR_INVALID_STATE' });
-  assert.throws(() => b.mount(path.join(mountPoint, 'inner')),
-                { code: 'ERR_INVALID_STATE' });
+  a.writeFileSync('/f.txt', 'A');
+  b.writeFileSync('/f.txt', 'B');
+  const mountA = a.mount();
+  const mountB = b.mount();
+  assert.notStrictEqual(mountA, mountB);
+  assert.match(mountA, mountPointShape);
+  assert.match(mountB, mountPointShape);
+  assert.strictEqual(fs.readFileSync(path.join(mountA, 'f.txt'), 'utf8'), 'A');
+  assert.strictEqual(fs.readFileSync(path.join(mountB, 'f.txt'), 'utf8'), 'B');
   a.unmount();
+  b.unmount();
 }
 
 // Test: fs.readFileSync intercepted
@@ -165,8 +174,7 @@ function createMountedVfs() {
 // Test: Symbol.dispose unmounts
 {
   const myVfs = vfs.create();
-  const mountPoint = baseMountPoint + '-' + (mountCounter++);
-  myVfs.mount(mountPoint);
+  myVfs.mount();
   assert.strictEqual(myVfs.mounted, true);
   myVfs[Symbol.dispose]();
   assert.strictEqual(myVfs.mounted, false);
diff --git a/test/parallel/test-vfs-multi-mount.js b/test/parallel/test-vfs-multi-mount.js
index 879f7cfcbf2b..7539c0a6f028 100644
--- a/test/parallel/test-vfs-multi-mount.js
+++ b/test/parallel/test-vfs-multi-mount.js
@@ -1,8 +1,8 @@
 // Flags: --experimental-vfs
 'use strict';
 
-// Two concurrent non-overlapping mounts must each route to its own VFS without
-// interference. Also exercises that the handler registry iterates and routes
+// Two concurrent mounts must each route to its own VFS without
+// interference. Also exercises that the layer registry routes
 // correctly when more than one VFS is active.
 
 require('../common');
@@ -11,9 +11,6 @@ const fs = require('fs');
 const path = require('path');
 const vfs = require('node:vfs');
 
-const baseA = path.resolve('/tmp/vfs-multi-a-' + process.pid);
-const baseB = path.resolve('/tmp/vfs-multi-b-' + process.pid);
-
 const a = vfs.create();
 a.writeFileSync('/file.txt', 'from-a');
 a.mkdirSync('/dir', { recursive: true });
@@ -24,8 +21,8 @@ b.writeFileSync('/file.txt', 'from-b');
 b.mkdirSync('/dir', { recursive: true });
 b.writeFileSync('/dir/inside.txt', 'b-inside');
 
-a.mount(baseA);
-b.mount(baseB);
+const baseA = a.mount();
+const baseB = b.mount();
 
 // Each mount sees its own content
 assert.strictEqual(fs.readFileSync(path.join(baseA, 'file.txt'), 'utf8'),
diff --git a/test/parallel/test-vfs-package-json-cache.js b/test/parallel/test-vfs-package-json-cache.js
new file mode 100644
index 000000000000..7a787d613fc2
--- /dev/null
+++ b/test/parallel/test-vfs-package-json-cache.js
@@ -0,0 +1,40 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Package.json caches must be cleared on VFS unmount.
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const vfs = require('node:vfs');
+
+const myVfs = vfs.create();
+myVfs.mkdirSync('/pkg');
+myVfs.writeFileSync('/pkg/package.json', '{"name":"test","type":"module"}');
+myVfs.writeFileSync('/pkg/index.js', 'module.exports = 42');
+const mountPoint = myVfs.mount();
+
+assert.ok(fs.existsSync(`${mountPoint}/pkg/package.json`));
+
+myVfs.unmount();
+
+assert.strictEqual(fs.existsSync(`${mountPoint}/pkg/package.json`), false);
+
+// Remounting the same instance reuses the same mount point; a package.json
+// whose `type` changed between mounts must be re-read, not served from the
+// nearest-parent caches populated during the first mount.
+{
+  const remountVfs = vfs.create();
+  remountVfs.mkdirSync('/scope');
+  remountVfs.writeFileSync('/scope/package.json', '{"type":"commonjs"}');
+  remountVfs.writeFileSync('/scope/index.js', 'module.exports = 42;');
+  const mp = remountVfs.mount();
+  assert.strictEqual(require(`${mp}/scope/index.js`), 42);
+  remountVfs.unmount();
+
+  remountVfs.writeFileSync('/scope/package.json', '{"type":"module"}');
+  remountVfs.writeFileSync('/scope/index.js', 'export default 43;');
+  assert.strictEqual(remountVfs.mount(), mp);
+  assert.strictEqual(require(`${mp}/scope/index.js`).default, 43);
+  remountVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-package-json.js b/test/parallel/test-vfs-package-json.js
new file mode 100644
index 000000000000..9b8dbe868123
--- /dev/null
+++ b/test/parallel/test-vfs-package-json.js
@@ -0,0 +1,183 @@
+// Flags: --experimental-vfs --expose-internals
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const path = require('path');
+const vfs = require('node:vfs');
+
+// read() reads package.json from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg', { recursive: true });
+  myVfs.writeFileSync('/pkg/package.json', JSON.stringify({
+    name: 'test-pkg',
+    type: 'module',
+    main: './index.js',
+    exports: { '.': './index.js' },
+  }));
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const result = packageJsonReader.read(
+    path.join(mountPoint, 'pkg', 'package.json'), {},
+  );
+
+  assert.strictEqual(result.exists, true);
+  assert.strictEqual(result.name, 'test-pkg');
+  assert.strictEqual(result.type, 'module');
+  assert.strictEqual(result.main, './index.js');
+  assert.deepStrictEqual(result.exports, { '.': './index.js' });
+  assert.strictEqual(
+    result.pjsonPath,
+    path.join(mountPoint, 'pkg', 'package.json'),
+  );
+
+  // Non-existent package.json returns exists: false
+  const missing = packageJsonReader.read(
+    path.join(mountPoint, 'nope', 'package.json'), {},
+  );
+  assert.strictEqual(missing.exists, false);
+
+  myVfs.unmount();
+}
+
+// getNearestParentPackageJSON() walks up VFS directories
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/src/lib/deep', { recursive: true });
+  myVfs.writeFileSync('/app/package.json', JSON.stringify({
+    name: 'my-app',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/app/src/lib/deep/module.js', '');
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const result = packageJsonReader.getNearestParentPackageJSON(
+    path.join(mountPoint, 'app', 'src', 'lib', 'deep', 'module.js'),
+  );
+
+  assert.ok(result);
+  assert.strictEqual(result.exists, true);
+  assert.strictEqual(result.data.name, 'my-app');
+  assert.strictEqual(result.data.type, 'module');
+  assert.strictEqual(
+    result.path,
+    path.join(mountPoint, 'app', 'package.json'),
+  );
+
+  myVfs.unmount();
+}
+
+// getPackageScopeConfig() returns correct scope from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/project/src', { recursive: true });
+  myVfs.writeFileSync('/project/package.json', JSON.stringify({
+    name: 'my-project',
+    type: 'commonjs',
+    exports: { '.': './main.js' },
+  }));
+  myVfs.writeFileSync('/project/src/index.js', '');
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const { pathToFileURL } = require('url');
+  const scopeUrl = pathToFileURL(
+    path.join(mountPoint, 'project', 'src', 'index.js'),
+  ).href;
+  const result = packageJsonReader.getPackageScopeConfig(scopeUrl);
+
+  assert.strictEqual(result.exists, true);
+  assert.strictEqual(result.type, 'commonjs');
+  assert.strictEqual(result.name, 'my-project');
+  assert.strictEqual(
+    result.pjsonPath,
+    path.join(mountPoint, 'project', 'package.json'),
+  );
+
+  // Path with no package.json returns exists: false
+  const myVfs2 = vfs.create();
+  myVfs2.mkdirSync('/empty/src', { recursive: true });
+  myVfs2.writeFileSync('/empty/src/file.js', '');
+  const mountPoint2 = myVfs2.mount();
+
+  const emptyUrl = pathToFileURL(
+    path.join(mountPoint2, 'empty', 'src', 'file.js'),
+  ).href;
+  const emptyResult = packageJsonReader.getPackageScopeConfig(emptyUrl);
+  assert.strictEqual(emptyResult.exists, false);
+
+  myVfs2.unmount();
+  myVfs.unmount();
+}
+
+// getPackageType() returns correct type from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/esm-app', { recursive: true });
+  myVfs.writeFileSync('/esm-app/package.json', JSON.stringify({
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/esm-app/index.js', '');
+  const mountPoint = myVfs.mount();
+
+  const packageJsonReader = require('internal/modules/package_json_reader');
+  const { pathToFileURL } = require('url');
+  const typeUrl = pathToFileURL(
+    path.join(mountPoint, 'esm-app', 'index.js'),
+  ).href;
+  const type = packageJsonReader.getPackageType(typeUrl);
+  assert.strictEqual(type, 'module');
+
+  // No package.json => 'none'
+  const myVfs2 = vfs.create();
+  myVfs2.mkdirSync('/bare', { recursive: true });
+  myVfs2.writeFileSync('/bare/file.js', '');
+  const mountPoint2 = myVfs2.mount();
+
+  const noneUrl = pathToFileURL(
+    path.join(mountPoint2, 'bare', 'file.js'),
+  ).href;
+  const noneType = packageJsonReader.getPackageType(noneUrl);
+  assert.strictEqual(noneType, 'none');
+
+  myVfs2.unmount();
+  myVfs.unmount();
+}
+
+// End-to-end CJS require with package.json type detection
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/cjs-app', { recursive: true });
+  myVfs.writeFileSync('/cjs-app/package.json', JSON.stringify({
+    name: 'cjs-app',
+    type: 'commonjs',
+  }));
+  myVfs.writeFileSync('/cjs-app/main.js',
+                      'module.exports = { format: "cjs", ok: true };');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/cjs-app/main.js`);
+  assert.strictEqual(result.format, 'cjs');
+  assert.strictEqual(result.ok, true);
+
+  myVfs.unmount();
+}
+
+// End-to-end ESM import with VFS package type
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/esm', { recursive: true });
+  myVfs.writeFileSync('/esm/package.json', JSON.stringify({
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/esm/mod.mjs', 'export const x = 42;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/esm/mod.mjs`);
+  assert.strictEqual(mod.x, 42);
+
+  myVfs.unmount();
+}
diff --git a/test/parallel/test-vfs-rename.js b/test/parallel/test-vfs-rename.js
index 69daba43c11d..b1ca98dc684e 100644
--- a/test/parallel/test-vfs-rename.js
+++ b/test/parallel/test-vfs-rename.js
@@ -58,3 +58,67 @@ const vfs = require('node:vfs');
   assert.strictEqual(myVfs.existsSync('/a/b/c'), false);
   assert.strictEqual(myVfs.readFileSync('/a/file.txt', 'utf8'), 'data');
 }
+
+// Renaming a directory onto a non-empty directory throws ENOTEMPTY
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.mkdirSync('/dst');
+  myVfs.writeFileSync('/dst/keep.txt', 'keep');
+
+  assert.throws(() => myVfs.renameSync('/src', '/dst'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.readFileSync('/dst/keep.txt', 'utf8'), 'keep');
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+}
+
+// Renaming a directory onto an empty directory succeeds
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.writeFileSync('/src/a.txt', 'a');
+  myVfs.mkdirSync('/dst');
+
+  myVfs.renameSync('/src', '/dst');
+  assert.strictEqual(myVfs.existsSync('/src'), false);
+  assert.strictEqual(myVfs.readFileSync('/dst/a.txt', 'utf8'), 'a');
+}
+
+// Overwriting a file drops one of its links
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.writeFileSync('/b.txt', 'b');
+  myVfs.linkSync('/b.txt', '/b-link.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 2);
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 1);
+  assert.strictEqual(myVfs.readFileSync('/b-link.txt', 'utf8'), 'b');
+}
+
+// Renaming a path onto itself is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.mkdirSync('/d');
+  myVfs.writeFileSync('/d/keep.txt', 'keep');
+
+  myVfs.renameSync('/a.txt', '/a.txt');
+  assert.strictEqual(myVfs.readFileSync('/a.txt', 'utf8'), 'a');
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 1);
+
+  myVfs.renameSync('/d', '/d');
+  assert.strictEqual(myVfs.readFileSync('/d/keep.txt', 'utf8'), 'keep');
+}
+
+// Renaming a hard link onto another link to the same file is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.linkSync('/a.txt', '/b.txt');
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.existsSync('/a.txt'), true);
+  assert.strictEqual(myVfs.existsSync('/b.txt'), true);
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 2);
+}
diff --git a/test/parallel/test-vfs-require.js b/test/parallel/test-vfs-require.js
new file mode 100644
index 000000000000..3e6869672272
--- /dev/null
+++ b/test/parallel/test-vfs-require.js
@@ -0,0 +1,411 @@
+// Flags: --experimental-vfs
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('node:url');
+const vfs = require('node:vfs');
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// Test requiring a simple virtual module
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/hello.js', 'module.exports = "hello from vfs";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/hello.js`);
+  assert.strictEqual(result, 'hello from vfs');
+
+  myVfs.unmount();
+}
+
+// Test requiring a virtual module that exports an object
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/config.js', `
+    module.exports = {
+      name: 'test-config',
+      version: '1.0.0',
+      getValue: function() { return 42; }
+    };
+  `);
+  const mountPoint = myVfs.mount();
+
+  const config = require(`${mountPoint}/config.js`);
+  assert.strictEqual(config.name, 'test-config');
+  assert.strictEqual(config.version, '1.0.0');
+  assert.strictEqual(config.getValue(), 42);
+
+  myVfs.unmount();
+}
+
+// Test requiring a virtual module that requires another virtual module.
+// Mount first so the embedded absolute specifier can use the mount point.
+{
+  const myVfs = vfs.create();
+  const mountPoint = myVfs.mount();
+  myVfs.writeFileSync(`${mountPoint}/utils.js`, `
+    module.exports = {
+      add: function(a, b) { return a + b; }
+    };
+  `);
+  myVfs.writeFileSync(`${mountPoint}/main.js`, `
+    const utils = require(${JSON.stringify(`${mountPoint}/utils.js`)});
+    module.exports = {
+      sum: utils.add(10, 20)
+    };
+  `);
+
+  const main = require(`${mountPoint}/main.js`);
+  assert.strictEqual(main.sum, 30);
+
+  myVfs.unmount();
+}
+
+// Test requiring a JSON file from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/data.json', JSON.stringify({
+    items: [1, 2, 3],
+    enabled: true,
+  }));
+  const mountPoint = myVfs.mount();
+
+  const data = require(`${mountPoint}/data.json`);
+  assert.deepStrictEqual(data.items, [1, 2, 3]);
+  assert.strictEqual(data.enabled, true);
+
+  myVfs.unmount();
+}
+
+// Test virtual package.json resolution
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/my-package', { recursive: true });
+  myVfs.writeFileSync('/my-package/package.json', JSON.stringify({
+    name: 'my-package',
+    main: 'index.js',
+  }));
+  myVfs.writeFileSync('/my-package/index.js', `
+    module.exports = { loaded: true };
+  `);
+  const mountPoint = myVfs.mount();
+
+  const pkg = require(`${mountPoint}/my-package`);
+  assert.strictEqual(pkg.loaded, true);
+
+  myVfs.unmount();
+}
+
+// Test that real modules still work when VFS is mounted
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/test.js', 'module.exports = 1;');
+  myVfs.mount();
+
+  assert.strictEqual(typeof assert.strictEqual, 'function');
+
+  const commonMod = require('../common');
+  assert.ok(commonMod);
+
+  myVfs.unmount();
+}
+
+// Test require with relative paths inside VFS module
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/lib', { recursive: true });
+  myVfs.writeFileSync('/lib/helper.js', `
+    module.exports = { help: function() { return 'helped'; } };
+  `);
+  myVfs.writeFileSync('/lib/index.js', `
+    const helper = require('./helper.js');
+    module.exports = helper.help();
+  `);
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/lib/index.js`);
+  assert.strictEqual(result, 'helped');
+
+  myVfs.unmount();
+}
+
+// Test fs.readFileSync interception when VFS is active
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/file.txt', 'virtual content');
+  const mountPoint = myVfs.mount();
+
+  const content = fs.readFileSync(`${mountPoint}/file.txt`, 'utf8');
+  assert.strictEqual(content, 'virtual content');
+
+  myVfs.unmount();
+}
+
+// Test requiring an ESM .mjs module from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/esm.mjs', 'export const msg = "hello from esm";');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/esm.mjs`);
+  assert.strictEqual(mod.msg, 'hello from esm');
+
+  myVfs.unmount();
+}
+
+// Test requiring an ESM .mjs module with default export from VFS
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/esm-default.mjs', 'export default function() { return 42; }');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/esm-default.mjs`);
+  assert.strictEqual(mod.default(), 42);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .js file detected as ESM via VFS package.json type:module
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app', { recursive: true });
+  myVfs.writeFileSync('/app/package.json', JSON.stringify({
+    name: 'esm-app',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/app/lib.js',
+                      'export const value = 42;' +
+                      ' export function hello() { return "hi"; }');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/app/lib.js`);
+  assert.strictEqual(mod.value, 42);
+  assert.strictEqual(mod.hello(), 'hi');
+
+  myVfs.unmount();
+}
+
+// Test require(esm): nested .js walks up to parent package.json in VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/project/src/utils', { recursive: true });
+  myVfs.writeFileSync('/project/package.json', JSON.stringify({
+    name: 'nested-esm',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/project/src/utils/math.js',
+                      'export const add = (a, b) => a + b;' +
+                      ' export default 99;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/project/src/utils/math.js`);
+  assert.strictEqual(mod.add(3, 4), 7);
+  assert.strictEqual(mod.default, 99);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .js without type field stays CJS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/cjs-app', { recursive: true });
+  myVfs.writeFileSync('/cjs-app/package.json', JSON.stringify({
+    name: 'cjs-app',
+  }));
+  myVfs.writeFileSync('/cjs-app/index.js',
+                      'module.exports = { cjs: true };');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/cjs-app/index.js`);
+  assert.strictEqual(mod.cjs, true);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): ESM .js that imports another ESM .js in VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/multi/src', { recursive: true });
+  myVfs.writeFileSync('/multi/package.json', JSON.stringify({
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/multi/src/dep.js', 'export const X = 100;');
+  myVfs.writeFileSync('/multi/src/main.js',
+                      'import { X } from "./dep.js";' +
+                      ' export const result = X + 1;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/multi/src/main.js`);
+  assert.strictEqual(mod.result, 101);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .mjs without any package.json loads as ESM
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/no-pkg.mjs',
+                      'export const x = 1; export default "hello";');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/no-pkg.mjs`);
+  assert.strictEqual(mod.x, 1);
+  assert.strictEqual(mod.default, 'hello');
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .mjs with package.json that has no type field
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app', { recursive: true });
+  myVfs.writeFileSync('/app/package.json',
+                      JSON.stringify({ name: 'no-type' }));
+  myVfs.writeFileSync('/app/lib.mjs', 'export const val = 42;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/app/lib.mjs`);
+  assert.strictEqual(mod.val, 42);
+
+  myVfs.unmount();
+}
+
+// Test require(esm): .mjs in type:commonjs package still loads as ESM
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/cjs-pkg', { recursive: true });
+  myVfs.writeFileSync('/cjs-pkg/package.json', JSON.stringify({
+    name: 'cjs-pkg',
+    type: 'commonjs',
+  }));
+  myVfs.writeFileSync('/cjs-pkg/esm.mjs', 'export const z = 99;');
+  const mountPoint = myVfs.mount();
+
+  const mod = require(`${mountPoint}/cjs-pkg/esm.mjs`);
+  assert.strictEqual(mod.z, 99);
+
+  myVfs.unmount();
+}
+
+// Test CJS: package with "main" field resolves through VFS
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg/lib', { recursive: true });
+  myVfs.writeFileSync('/pkg/package.json', JSON.stringify({
+    name: 'legacy-main-pkg',
+    main: './lib/entry',
+  }));
+  myVfs.writeFileSync('/pkg/lib/entry.js', 'module.exports = "legacy-main";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/pkg`);
+  assert.strictEqual(result, 'legacy-main');
+
+  myVfs.unmount();
+}
+
+// Test CJS: package with no "main" field resolves index.js
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/pkg2', { recursive: true });
+  myVfs.writeFileSync('/pkg2/package.json', JSON.stringify({
+    name: 'no-main-pkg',
+  }));
+  myVfs.writeFileSync('/pkg2/index.js', 'module.exports = "index-fallback";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/pkg2`);
+  assert.strictEqual(result, 'index-fallback');
+
+  myVfs.unmount();
+}
+
+// Test ESM legacyMainResolve: import() a VFS package with "main" (no "exports")
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app/node_modules/esm-legacy-main/lib', { recursive: true });
+  myVfs.writeFileSync('/app/node_modules/esm-legacy-main/package.json', JSON.stringify({
+    name: 'esm-legacy-main',
+    type: 'module',
+    main: './lib/entry.js',
+  }));
+  myVfs.writeFileSync('/app/node_modules/esm-legacy-main/lib/entry.js',
+                      'export const value = "esm-legacy-main";');
+  myVfs.writeFileSync('/app/main.mjs',
+                      'export { value } from "esm-legacy-main";');
+  const mountPoint = myVfs.mount();
+
+  import(vfsImport(`${mountPoint}/app/main.mjs`)).then(common.mustCall((mod) => {
+    assert.strictEqual(mod.value, 'esm-legacy-main');
+    myVfs.unmount();
+  }));
+}
+
+// Test ESM legacyMainResolve: import() a VFS package with no "main" (index.js fallback)
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/app2/node_modules/esm-nomain', { recursive: true });
+  myVfs.writeFileSync('/app2/node_modules/esm-nomain/package.json', JSON.stringify({
+    name: 'esm-nomain',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/app2/node_modules/esm-nomain/index.js',
+                      'export const value = "esm-index-fallback";');
+  myVfs.writeFileSync('/app2/main.mjs',
+                      'export { value } from "esm-nomain";');
+  const mountPoint = myVfs.mount();
+
+  import(vfsImport(`${mountPoint}/app2/main.mjs`)).then(common.mustCall((mod) => {
+    assert.strictEqual(mod.value, 'esm-index-fallback');
+    myVfs.unmount();
+  }));
+}
+
+// Test getFormatOfExtensionlessFile: extensionless JS file in type:module package
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/esm-pkg', { recursive: true });
+  myVfs.writeFileSync('/esm-pkg/package.json', JSON.stringify({
+    name: 'esm-pkg',
+    type: 'module',
+  }));
+  myVfs.writeFileSync('/esm-pkg/entry', 'export const x = 123;');
+  const mountPoint = myVfs.mount();
+
+  import(vfsImport(`${mountPoint}/esm-pkg/entry`)).then(common.mustCall((mod) => {
+    assert.strictEqual(mod.x, 123);
+    myVfs.unmount();
+  }));
+}
+
+// Test that unmounting stops interception
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/unmount-test.js', 'module.exports = "before unmount";');
+  const mountPoint = myVfs.mount();
+
+  const result = require(`${mountPoint}/unmount-test.js`);
+  assert.strictEqual(result, 'before unmount');
+
+  myVfs.unmount();
+
+  // On Windows, the native loader may surface the NUL-backed former mount
+  // path as ERR_INVALID_PACKAGE_CONFIG while probing for package.json.
+  assert.throws(() => {
+    delete require.cache[path.join(mountPoint, 'unmount-test.js')];
+    require(`${mountPoint}/unmount-test.js`);
+  }, (err) => {
+    if (common.isWindows) {
+      assert.ok(
+        ['ERR_INVALID_PACKAGE_CONFIG', 'MODULE_NOT_FOUND'].includes(err.code),
+      );
+    } else {
+      assert.strictEqual(err.code, 'MODULE_NOT_FOUND');
+    }
+    return true;
+  });
+}
diff --git a/test/parallel/test-vfs-router.js b/test/parallel/test-vfs-router.js
index 864a684f5c2d..292e33e7379a 100644
--- a/test/parallel/test-vfs-router.js
+++ b/test/parallel/test-vfs-router.js
@@ -9,38 +9,11 @@
 require('../common');
 const assert = require('assert');
 const path = require('path');
-const { isUnderMountPoint, getRelativePath, isAbsolutePath } =
-  require('internal/vfs/router');
+const { getRelativePath } = require('internal/vfs/router');
 
 const mount = path.resolve('/app');
 const nested = path.join(mount, 'src', 'index.js');
 
-// isUnderMountPoint: equal paths are always considered "under"
-assert.strictEqual(isUnderMountPoint(mount, mount), true);
-
-// isUnderMountPoint: nested paths
-assert.strictEqual(isUnderMountPoint(nested, mount), true);
-
-// isUnderMountPoint: rejects sibling paths that share the prefix string
-assert.strictEqual(
-  isUnderMountPoint(path.resolve('/app2/index.js'), mount), false,
-);
-assert.strictEqual(isUnderMountPoint(path.resolve('/applebrick'), mount),
-                   false);
-
-// isUnderMountPoint: rejects an unrelated absolute path
-assert.strictEqual(isUnderMountPoint(path.resolve('/other'), mount), false);
-
-// isUnderMountPoint: root mount matches any absolute path on POSIX.
-// On Windows the root mount '/' resolves to a drive-letter root, so the
-// special-case in router.js only applies when mountPoint === '/'. Skip the
-// root-mount checks where they would not be representative on Windows.
-if (process.platform !== 'win32') {
-  assert.strictEqual(isUnderMountPoint('/anywhere', '/'), true);
-  assert.strictEqual(isUnderMountPoint('/', '/'), true);
-  assert.strictEqual(isUnderMountPoint('/a/b/c', '/'), true);
-}
-
 // getRelativePath: equal => '/'
 assert.strictEqual(getRelativePath(mount, mount), '/');
 
@@ -48,16 +21,7 @@ assert.strictEqual(getRelativePath(mount, mount), '/');
 // the platform-native input separators.
 assert.strictEqual(getRelativePath(nested, mount), '/src/index.js');
 
-// getRelativePath: root mount returns the original (already absolute) path
-if (process.platform !== 'win32') {
-  assert.strictEqual(getRelativePath('/foo/bar', '/'), '/foo/bar');
-}
-
 // getRelativePath: deeper nesting
 const mountA = path.resolve('/m/a');
 const deep = path.join(mountA, 'b', 'c', 'd');
 assert.strictEqual(getRelativePath(deep, mountA), '/b/c/d');
-
-// isAbsolutePath is re-exported from node:path
-assert.strictEqual(isAbsolutePath(path.resolve('/foo')), true);
-assert.strictEqual(isAbsolutePath('foo'), false);
diff --git a/test/parallel/test-vfs-scoped-cache-purge.js b/test/parallel/test-vfs-scoped-cache-purge.js
new file mode 100644
index 000000000000..104089cd4a23
--- /dev/null
+++ b/test/parallel/test-vfs-scoped-cache-purge.js
@@ -0,0 +1,57 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Deregistering one VFS must scope-purge loader caches: entries under the
+// unmounted mount point are dropped, entries from other VFSes are kept.
+
+const common = require('../common');
+const assert = require('assert');
+const { pathToFileURL } = require('node:url');
+const vfs = require('node:vfs');
+
+const vfsImport = (path) => pathToFileURL(path).href;
+
+// Multi-mount: deregistering one VFS keeps the other's CJS require.cache warm.
+{
+  const a = vfs.create();
+  a.writeFileSync('/value.js', 'module.exports = "a-cached"');
+  const mountA = a.mount();
+
+  const b = vfs.create();
+  b.writeFileSync('/value.js', 'module.exports = "b-cached"');
+  const mountB = b.mount();
+
+  assert.strictEqual(require(`${mountA}/value.js`), 'a-cached');
+  assert.strictEqual(require(`${mountB}/value.js`), 'b-cached');
+
+  const bKey = require.resolve(`${mountB}/value.js`);
+  assert.ok(bKey in require.cache, 'b should be cached before unmount');
+
+  a.unmount();
+  assert.ok(
+    bKey in require.cache,
+    'unmounting a different VFS must not evict b\'s cache entry',
+  );
+
+  assert.strictEqual(require(`${mountB}/value.js`), 'b-cached');
+
+  b.unmount();
+}
+
+// import.meta.url is the plain file URL under the mount point, and repeated
+// dynamic imports (including via import.meta.resolve) return the same namespace.
+(async () => {
+  const v = vfs.create();
+  v.writeFileSync('/m.mjs',
+                  'export const url = import.meta.url;\n' +
+                  'export const resolved = import.meta.resolve("./m.mjs");');
+  const mountPoint = v.mount();
+
+  const ns = await import(vfsImport(`${mountPoint}/m.mjs`));
+  assert.strictEqual(ns.url, pathToFileURL(`${mountPoint}/m.mjs`).href);
+
+  const nsAgain = await import(ns.resolved);
+  assert.strictEqual(ns, nsAgain);
+
+  v.unmount();
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-zip-provider-dispose.js b/test/parallel/test-vfs-zip-provider-dispose.js
new file mode 100644
index 000000000000..b93ed914a701
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider-dispose.js
@@ -0,0 +1,93 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Exercises ZipProvider's Symbol.dispose / Symbol.asyncDispose aliases:
+// disposing a provider closes its backing archive (a ZipFile releases its
+// file descriptor; a ZipBuffer has nothing to close, so disposal is a no-op),
+// and the aliases work with the `using` / `await using` declarations.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const path = require('path');
+const fsPromises = require('fs/promises');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+
+tmpdir.refresh();
+
+async function buildArchive(entries) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+async function writeArchive(name) {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, name);
+  await fsPromises.writeFile(filePath, archive);
+  return filePath;
+}
+
+(async () => {
+  // Symbol.asyncDispose closes a ZipFile-backed provider's archive.
+  {
+    const zip = await zlib.ZipFile.open(await writeArchive('dispose-async.zip'));
+    let closed = 0;
+    const original = zip.close.bind(zip);
+    zip.close = async (...args) => { closed++; return original(...args); };
+
+    const provider = new vfs.ZipProvider(zip);
+    await provider[Symbol.asyncDispose]();
+    assert.strictEqual(closed, 1);
+  }
+
+  // Symbol.dispose closes a ZipFile-backed provider's archive synchronously.
+  {
+    const zip = zlib.ZipFile.openSync(await writeArchive('dispose-sync.zip'));
+    let closed = 0;
+    const original = zip.closeSync.bind(zip);
+    zip.closeSync = (...args) => { closed++; return original(...args); };
+
+    const provider = new vfs.ZipProvider(zip);
+    provider[Symbol.dispose]();
+    assert.strictEqual(closed, 1);
+  }
+
+  // `await using` disposes the provider (and closes the archive) at block exit.
+  {
+    const zip = await zlib.ZipFile.open(await writeArchive('dispose-await-using.zip'));
+    let closed = 0;
+    const original = zip.close.bind(zip);
+    zip.close = async (...args) => { closed++; return original(...args); };
+
+    {
+      await using provider = new vfs.ZipProvider(zip);
+      assert.strictEqual(provider.readonly, true);
+      assert.strictEqual(closed, 0); // Not yet disposed.
+    }
+    assert.strictEqual(closed, 1); // Disposed at block exit.
+  }
+
+  // `using` disposes the provider synchronously at block exit.
+  {
+    const zip = zlib.ZipFile.openSync(await writeArchive('dispose-using.zip'));
+    let closed = 0;
+    const original = zip.closeSync.bind(zip);
+    zip.closeSync = (...args) => { closed++; return original(...args); };
+
+    {
+      using provider = new vfs.ZipProvider(zip);
+      assert.strictEqual(provider.readonly, true);
+    }
+    assert.strictEqual(closed, 1);
+  }
+
+  // A ZipBuffer has nothing to close: both aliases are safe no-ops.
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const provider = new vfs.ZipProvider(new zlib.ZipBuffer(archive));
+    provider[Symbol.dispose](); // Does not throw.
+    await provider[Symbol.asyncDispose](); // Does not throw.
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-zip-provider-handle.js b/test/parallel/test-vfs-zip-provider-handle.js
new file mode 100644
index 000000000000..3c88eacbb8c9
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider-handle.js
@@ -0,0 +1,514 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Additional ZipProvider coverage beyond test-vfs-zip-provider.js:
+// direct ZipFileHandle read/write/stat/truncate (both explicit and
+// current position, append-mode positioning, buffer growth), readFile/
+// writeFile encoding and data-type variants, compression-method-preserving
+// rename() (methodOption()), ZipFile-backed synchronous delete, an explicit
+// empty-directory open() EISDIR, the readdir child-directory dedup path, and
+// a few error branches (EROFS on open(), ENOTDIR on rmdir(), ENOENT on
+// rename()) not exercised by the base test.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const path = require('path');
+const fs = require('fs');
+const fsPromises = require('fs/promises');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+
+tmpdir.refresh();
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+function buildArchiveSync(entries, comment) {
+  return Buffer.concat([...zlib.createZipArchiveSync(entries, comment)]);
+}
+
+// --- direct ZipFileHandle read/write/stat/truncate (async) -------------
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('hello world')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = await provider.open('/a.txt', 'r+');
+
+  // Explicit position leaves the handle's own position untouched.
+  const buf = Buffer.alloc(5);
+  const { bytesRead } = await handle.read(buf, 0, 5, 0);
+  assert.strictEqual(bytesRead, 5);
+  assert.strictEqual(buf.toString(), 'hello');
+  assert.strictEqual(handle.position, 0);
+
+  // Current position (undefined/null/-1) advances the handle's position.
+  const buf2 = Buffer.alloc(5);
+  await handle.read(buf2, 0, 5, null);
+  assert.strictEqual(buf2.toString(), 'hello');
+  assert.strictEqual(handle.position, 5);
+  const buf3 = Buffer.alloc(1);
+  await handle.read(buf3, 0, 1, -1);
+  assert.strictEqual(buf3.toString(), ' ');
+  assert.strictEqual(handle.position, 6);
+
+  // Reading past EOF yields 0 bytes without advancing further than available.
+  const tail = Buffer.alloc(100);
+  const { bytesRead: tailRead } = await handle.read(tail, 0, 100, 6);
+  assert.strictEqual(tailRead, 5); // 'world'.length
+
+  // write() at an explicit position (overwrite), then at the current
+  // position (append past the buffer's current size, forcing growth).
+  await handle.write(Buffer.from('HELLO'), 0, 5, 0);
+  const stat1 = await handle.stat();
+  assert.strictEqual(stat1.size, 11);
+
+  handle.position = 11;
+  await handle.write(Buffer.from('!!!'), 0, 3, null);
+  const stat2 = await handle.stat();
+  assert.strictEqual(stat2.size, 14);
+
+  await handle.truncate(5);
+  const stat3 = await handle.stat();
+  assert.strictEqual(stat3.size, 5);
+
+  await handle.truncate(8);
+  const stat4 = await handle.stat();
+  assert.strictEqual(stat4.size, 8);
+
+  await handle.close();
+
+  const archiveVfs = vfs.create(provider);
+  const final = await archiveVfs.promises.readFile('/a.txt');
+  assert.strictEqual(final.length, 8);
+  assert.strictEqual(final.subarray(0, 5).toString(), 'HELLO');
+})().then(common.mustCall());
+
+// --- direct ZipFileHandle read/write/stat/truncate (sync) --------------
+(() => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('b.txt', Buffer.from('0123456789'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const handle = provider.openSync('/b.txt', 'r+');
+
+  const buf = Buffer.alloc(4);
+  const { bytesRead } = handle.readSync(buf, 0, 4, 2);
+  assert.strictEqual(bytesRead, 4);
+  assert.strictEqual(buf.toString(), '2345');
+
+  handle.writeSync(Buffer.from('AB'), 0, 2, 0);
+  assert.strictEqual(handle.statSync().size, 10);
+
+  // A write growing well beyond current capacity exercises #ensureCapacity's
+  // doubling path.
+  handle.writeSync(Buffer.alloc(1000, 0x58 /* 'X' */), 0, 1000, 10);
+  assert.strictEqual(handle.statSync().size, 1010);
+
+  handle.truncateSync(3);
+  assert.strictEqual(handle.statSync().size, 3);
+  assert.strictEqual(handle.readFileSync('utf8'), 'AB2');
+
+  handle.closeSync();
+})();
+
+// --- append-mode positioning: writes always land at the current end -------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('c.txt', Buffer.from('xy'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = await provider.open('/c.txt', 'a');
+  assert.strictEqual(handle.position, 2); // Positioned at EOF on open
+
+  // Even with an explicit (wrong) position, append mode writes at the end.
+  await handle.write(Buffer.from('z'), 0, 1, 0);
+  assert.strictEqual((await handle.stat()).size, 3);
+  await handle.close();
+
+  const archiveVfs = vfs.create(provider);
+  assert.strictEqual(await archiveVfs.promises.readFile('/c.txt', 'utf8'), 'xyz');
+})().then(common.mustCall());
+
+// --- readFile/readFileSync encoding variants + writeFile data types --------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('d.txt', Buffer.from('café'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = await provider.open('/d.txt', 'r');
+  const asBuffer = await handle.readFile();
+  assert.ok(Buffer.isBuffer(asBuffer));
+  const asStringShorthand = await handle.readFile('utf8');
+  assert.strictEqual(asStringShorthand, 'café');
+  const asStringOption = await handle.readFile({ encoding: 'utf8' });
+  assert.strictEqual(asStringOption, 'café');
+  const asExplicitBuffer = await handle.readFile({ encoding: 'buffer' });
+  assert.ok(Buffer.isBuffer(asExplicitBuffer));
+  await handle.close();
+
+  const writeHandle = await provider.open('/e.txt', 'w');
+  await writeHandle.writeFile(Buffer.from('buffer-data'));
+  await writeHandle.close();
+  assert.strictEqual(await (await provider.open('/e.txt', 'r')).readFile('utf8'), 'buffer-data');
+
+  const writeHandle2 = await provider.open('/f.txt', 'w');
+  await writeHandle2.writeFile('string-data', { encoding: 'utf8' });
+  await writeHandle2.close();
+  assert.strictEqual(await (await provider.open('/f.txt', 'r')).readFile('utf8'), 'string-data');
+})().then(common.mustCall());
+
+(() => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('g.txt', Buffer.from('sync-café'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const handle = provider.openSync('/g.txt', 'r');
+  assert.ok(Buffer.isBuffer(handle.readFileSync()));
+  assert.strictEqual(handle.readFileSync('utf8'), 'sync-café');
+  assert.strictEqual(handle.readFileSync({ encoding: 'utf8' }), 'sync-café');
+  assert.ok(Buffer.isBuffer(handle.readFileSync({ encoding: 'buffer' })));
+  handle.closeSync();
+
+  const writeHandle = provider.openSync('/h.txt', 'w');
+  writeHandle.writeFileSync(Buffer.from('sync-buffer-data'));
+  writeHandle.closeSync();
+  assert.strictEqual(provider.openSync('/h.txt', 'r').readFileSync('utf8'), 'sync-buffer-data');
+})();
+
+// --- rename() preserves the original compression method (methodOption) ----
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('store.bin', Buffer.from('a'.repeat(100)), { method: 'store' }),
+    await zlib.ZipEntry.create('deflate.bin', Buffer.from('b'.repeat(100)), { method: 'deflate' }),
+    await zlib.ZipEntry.create('zstd.bin', Buffer.from('c'.repeat(100)), { method: 'zstd' }),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  const methodsBefore = new Map([
+    ['store.bin', zip.get('store.bin').method],
+    ['deflate.bin', zip.get('deflate.bin').method],
+    ['zstd.bin', zip.get('zstd.bin').method],
+  ]);
+
+  await archiveVfs.promises.rename('/store.bin', '/store-renamed.bin');
+  await archiveVfs.promises.rename('/deflate.bin', '/deflate-renamed.bin');
+  await archiveVfs.promises.rename('/zstd.bin', '/zstd-renamed.bin');
+
+  assert.strictEqual(zip.get('store-renamed.bin').method, methodsBefore.get('store.bin'));
+  assert.strictEqual(zip.get('deflate-renamed.bin').method, methodsBefore.get('deflate.bin'));
+  assert.strictEqual(zip.get('zstd-renamed.bin').method, methodsBefore.get('zstd.bin'));
+
+  // Content must still round-trip correctly under the reproduced method.
+  assert.strictEqual((await zip.get('store-renamed.bin').content()).toString(), 'a'.repeat(100));
+  assert.strictEqual((await zip.get('deflate-renamed.bin').content()).toString(), 'b'.repeat(100));
+  assert.strictEqual((await zip.get('zstd-renamed.bin').content()).toString(), 'c'.repeat(100));
+})().then(common.mustCall());
+
+(() => {
+  const archive = buildArchiveSync([
+    zlib.ZipEntry.createSync('store.bin', Buffer.from('a'.repeat(100)), { method: 'store' }),
+    zlib.ZipEntry.createSync('zstd.bin', Buffer.from('c'.repeat(100)), { method: 'zstd' }),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  const storeMethod = zip.get('store.bin').method;
+  const zstdMethod = zip.get('zstd.bin').method;
+  archiveVfs.renameSync('/store.bin', '/store-renamed.bin');
+  archiveVfs.renameSync('/zstd.bin', '/zstd-renamed.bin');
+  assert.strictEqual(zip.get('store-renamed.bin').method, storeMethod);
+  assert.strictEqual(zip.get('zstd-renamed.bin').method, zstdMethod);
+})();
+
+// --- rename() with a missing source is rejected with ENOENT ---------------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('only.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  await assert.rejects(
+    archiveVfs.promises.rename('/missing.txt', '/renamed.txt'),
+    { code: 'ENOENT' },
+  );
+  assert.throws(
+    () => archiveVfs.renameSync('/missing.txt', '/renamed.txt'),
+    { code: 'ENOENT' },
+  );
+})().then(common.mustCall());
+
+// --- rmdir() on a plain file is rejected with ENOTDIR ----------------------
+// (called on the provider directly: the vfs router validates directory-ness
+// itself before delegating for some operations, which would otherwise never
+// exercise ZipProvider's own check).
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('file.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.rmdir('/file.txt'), { code: 'ENOTDIR' });
+  assert.throws(() => provider.rmdirSync('/file.txt'), { code: 'ENOTDIR' });
+})().then(common.mustCall());
+
+// --- open(): EEXIST/ENOENT/EISDIR-on-wrong-direction, called directly on
+// the provider so the router can't short-circuit before delegating ---------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.open('/a.txt', 'wx'), { code: 'EEXIST' });
+  assert.throws(() => provider.openSync('/a.txt', 'wx'), { code: 'EEXIST' });
+  await assert.rejects(provider.open('/missing.txt', 'r'), { code: 'ENOENT' });
+  assert.throws(() => provider.openSync('/missing.txt', 'r'), { code: 'ENOENT' });
+
+  // A handle opened write-only can't be read from, and vice versa.
+  const writeOnly = await provider.open('/w.txt', 'w');
+  await assert.rejects(writeOnly.read(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await writeOnly.close();
+  const readOnly = await provider.open('/a.txt', 'r');
+  await assert.rejects(readOnly.write(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await readOnly.close();
+})().then(common.mustCall());
+
+// --- normalize(): a path without a leading slash is used as-is ------------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  const stats = await provider.stat('a.txt');
+  assert.strictEqual(stats.isFile(), true);
+})().then(common.mustCall());
+
+// --- mkdir(): both the with-options and no-options shapes, called
+// directly on the provider ---------------------------------------------
+(async () => {
+  const archive = await buildArchive([]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await provider.mkdir('/no-opts');
+  assert.strictEqual((await provider.stat('/no-opts')).isDirectory(), true);
+  await provider.mkdir('/with-opts', { mode: 0o700 });
+  assert.strictEqual((await provider.stat('/with-opts')).isDirectory(), true);
+
+  provider.mkdirSync('/no-opts-sync');
+  assert.strictEqual(provider.statSync('/no-opts-sync').isDirectory(), true);
+  provider.mkdirSync('/with-opts-sync', { mode: 0o700 });
+  assert.strictEqual(provider.statSync('/with-opts-sync').isDirectory(), true);
+})().then(common.mustCall());
+
+// --- readdir() skips a directory's own explicit entry when listing it -----
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('dir/', Buffer.alloc(0)),
+    await zlib.ZipEntry.create('dir/child.txt', Buffer.from('x')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  const entries = await archiveVfs.promises.readdir('/dir');
+  assert.deepStrictEqual(entries, ['child.txt']);
+})().then(common.mustCall());
+
+// --- an entry not made by a Unix zip tool reports mode 0, so stat() and
+// rename() fall back to their documented defaults --------------------------
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('foreign.txt', Buffer.from('x')),
+    await zlib.ZipEntry.create('foreign-dir/', Buffer.alloc(0)),
+  ]);
+  const tampered = Buffer.from(archive);
+  // The central header's "version made by" high byte selects the platform;
+  // anything other than 3 (Unix) makes `mode` report 0 (see zip.js's
+  // `CentralFileHeader.prototype.mode`).
+  // The central directory follows *all* entries' local sections, and each
+  // entry's central header follows the previous entries' central headers.
+  const localSectionsLength = (30 + 'foreign.txt'.length + 'x'.length) +
+    (30 + 'foreign-dir/'.length + 0);
+  const fileHeaderStart = localSectionsLength;
+  const dirHeaderStart = fileHeaderStart + (46 + 'foreign.txt'.length);
+  const fileMadeByOffset = fileHeaderStart + 5;
+  const dirMadeByOffset = dirHeaderStart + 5;
+  assert.strictEqual(tampered[fileMadeByOffset], 3); // sanity: was Unix-made
+  assert.strictEqual(tampered[dirMadeByOffset], 3);
+  tampered[fileMadeByOffset] = 0; // MS-DOS/FAT
+  tampered[dirMadeByOffset] = 0;
+
+  const zip = new zlib.ZipBuffer(tampered);
+  assert.strictEqual(zip.get('foreign.txt').mode, 0);
+  assert.strictEqual(zip.get('foreign-dir/').mode, 0);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  // stat()'s `entry.mode || <default>` fallback, for both a file and an
+  // (explicit) directory entry.
+  const fileStats = await archiveVfs.promises.stat('/foreign.txt');
+  assert.strictEqual(fileStats.mode & 0o777, 0o644);
+  const dirStats = await archiveVfs.promises.stat('/foreign-dir');
+  assert.strictEqual(dirStats.mode & 0o777, 0o755);
+  assert.strictEqual(archiveVfs.statSync('/foreign.txt').mode & 0o777, 0o644);
+  assert.strictEqual(archiveVfs.statSync('/foreign-dir').mode & 0o777, 0o755);
+
+  // rename()'s `mode: entry.mode || undefined` fallback (undefined lets
+  // ZipEntry.create() pick its own default mode instead of reproducing 0).
+  await archiveVfs.promises.rename('/foreign.txt', '/renamed.txt');
+  assert.strictEqual((await archiveVfs.promises.stat('/renamed.txt')).mode & 0o777, 0o644);
+})().then(common.mustCall());
+
+(() => {
+  const archive = buildArchiveSync([zlib.ZipEntry.createSync('foreign.txt', Buffer.from('x'))]);
+  const tampered = Buffer.from(archive);
+  const centralHeaderStart = 30 + 'foreign.txt'.length + 'x'.length;
+  const madeByOffset = centralHeaderStart + 5;
+  tampered[madeByOffset] = 0;
+
+  const zip = new zlib.ZipBuffer(tampered);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  archiveVfs.renameSync('/foreign.txt', '/renamed.txt');
+  assert.strictEqual(archiveVfs.statSync('/renamed.txt').mode & 0o777, 0o644);
+})();
+
+// --- opening an explicit (empty) directory entry is rejected with EISDIR --
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('empty-dir/', Buffer.alloc(0))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.open('/empty-dir', 'r'), { code: 'EISDIR' });
+  assert.throws(() => provider.openSync('/empty-dir', 'r'), { code: 'EISDIR' });
+})().then(common.mustCall());
+
+// --- readdir dedups a child directory reached through multiple entries ----
+(async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('dir/one.txt', Buffer.from('1')),
+    await zlib.ZipEntry.create('dir/two.txt', Buffer.from('2')),
+  ]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  // Both entries imply the same 'dir' child at the root; it must appear once.
+  const rootEntries = await archiveVfs.promises.readdir('/');
+  assert.deepStrictEqual(rootEntries, ['dir']);
+  const dirEntries = await archiveVfs.promises.readdir('/dir');
+  assert.deepStrictEqual(dirEntries.sort(), ['one.txt', 'two.txt']);
+})().then(common.mustCall());
+
+// --- open() with a write flag against a readonly (ZipFile) archive: EROFS --
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, 'vfs-archive-handle-readonly.zip');
+  await fsPromises.writeFile(filePath, archive);
+  const zip = await zlib.ZipFile.open(filePath);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.open('/new.txt', 'w'), { code: 'EROFS' });
+  assert.throws(() => provider.openSync('/new.txt', 'w'), { code: 'EROFS' });
+
+  await zip.close();
+})().then(common.mustCall());
+
+// --- ZipFile-backed writable archive: sync unlink/rmdir (deleteSync) ------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, 'vfs-archive-handle-writable-sync.zip');
+  await fsPromises.writeFile(filePath, archive);
+  const zip = await zlib.ZipFile.open(filePath, { writable: true });
+  const provider = new vfs.ZipProvider(zip);
+  const archiveVfs = vfs.create(provider);
+
+  archiveVfs.mkdirSync('/somedir');
+  assert.strictEqual(archiveVfs.statSync('/somedir').isDirectory(), true);
+  archiveVfs.rmdirSync('/somedir');
+  assert.throws(() => archiveVfs.statSync('/somedir'), { code: 'ENOENT' });
+
+  archiveVfs.unlinkSync('/a.txt');
+  assert.throws(() => archiveVfs.statSync('/a.txt'), { code: 'ENOENT' });
+
+  await zip.close();
+})().then(common.mustCall());
+
+// --- numeric open flags are normalized like node:fs (O_* constants) --------
+(async () => {
+  const { O_RDONLY, O_WRONLY, O_CREAT, O_TRUNC } = fs.constants;
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('hello'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  // A numeric read-only flag reads the existing entry.
+  const rh = await provider.open('/a.txt', O_RDONLY);
+  assert.strictEqual(await rh.readFile('utf8'), 'hello');
+  await rh.close();
+
+  // A numeric write+create+truncate flag creates and commits a new entry.
+  const wh = await provider.open('/num.txt', O_WRONLY | O_CREAT | O_TRUNC);
+  await wh.writeFile('written via numeric flags');
+  await wh.close();
+  assert.strictEqual(await provider.readFile('/num.txt', 'utf8'), 'written via numeric flags');
+
+  // The synchronous surface normalizes numeric flags identically.
+  const sh = provider.openSync('/a.txt', O_RDONLY);
+  assert.strictEqual(sh.readFileSync('utf8'), 'hello');
+  sh.closeSync();
+  const swh = provider.openSync('/num-sync.txt', O_WRONLY | O_CREAT | O_TRUNC);
+  swh.writeFileSync('sync numeric');
+  swh.closeSync();
+  assert.strictEqual(provider.readFileSync('/num-sync.txt', 'utf8'), 'sync numeric');
+})().then(common.mustCall());
+
+// --- readonly archive: any writable open flag (including 'r+' and numeric
+// O_RDWR) is rejected with EROFS, matching MemoryProvider/real fs -----------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const filePath = path.join(tmpdir.path, 'vfs-archive-handle-rplus-readonly.zip');
+  await fsPromises.writeFile(filePath, archive);
+  const zip = await zlib.ZipFile.open(filePath); // read-only
+  const provider = new vfs.ZipProvider(zip);
+
+  // 'r+' opens for writing, so it is refused even though it also reads.
+  await assert.rejects(provider.open('/a.txt', 'r+'), { code: 'EROFS' });
+  assert.throws(() => provider.openSync('/a.txt', 'r+'), { code: 'EROFS' });
+
+  // Numeric O_RDWR is likewise a writable flag.
+  await assert.rejects(provider.open('/a.txt', fs.constants.O_RDWR), { code: 'EROFS' });
+  assert.throws(() => provider.openSync('/a.txt', fs.constants.O_RDWR), { code: 'EROFS' });
+
+  // Plain read access is still allowed.
+  const h = await provider.open('/a.txt', 'r');
+  assert.strictEqual(await h.readFile('utf8'), 'x');
+  await h.close();
+
+  await zip.close();
+})().then(common.mustCall());
+
+// --- mkdir({ recursive: true }) over an existing FILE still throws EEXIST;
+// over an existing DIRECTORY it stays a no-op -------------------------------
+(async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+  const zip = new zlib.ZipBuffer(archive);
+  const provider = new vfs.ZipProvider(zip);
+
+  await assert.rejects(provider.mkdir('/a.txt', { recursive: true }), { code: 'EEXIST' });
+  assert.throws(() => provider.mkdirSync('/a.txt', { recursive: true }), { code: 'EEXIST' });
+
+  // Recursive mkdir over an existing directory remains a no-op (no throw).
+  await provider.mkdir('/d');
+  await provider.mkdir('/d', { recursive: true });
+  provider.mkdirSync('/d', { recursive: true });
+  assert.strictEqual((await provider.stat('/d')).isDirectory(), true);
+})().then(common.mustCall());
diff --git a/test/parallel/test-vfs-zip-provider.js b/test/parallel/test-vfs-zip-provider.js
new file mode 100644
index 000000000000..ad137457f7a3
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider.js
@@ -0,0 +1,243 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Exercises ZipProvider (node:vfs backed by node:zlib's ZipBuffer/
+// ZipFile): construction validation, readonly reflecting the archive's own
+// writability, stat/readdir over explicit and implicit directories, and the
+// full async and synchronous CRUD surface, against both a ZipBuffer and a
+// ZipFile (opened both via open() and openSync()) source.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const path = require('path');
+const fsPromises = require('fs/promises');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+
+tmpdir.refresh();
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+(async () => {
+  // Construction validation.
+  assert.throws(() => new vfs.ZipProvider({}), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => new vfs.ZipProvider(null), { code: 'ERR_INVALID_ARG_TYPE' });
+
+  // --- ZipBuffer-backed: always writable ------------------------------------
+  {
+    const archive = await buildArchive([
+      await zlib.ZipEntry.create('a.txt', Buffer.from('hello')),
+      await zlib.ZipEntry.create('dir/b.txt', Buffer.from('nested')),
+      await zlib.ZipEntry.create('empty-dir/', Buffer.alloc(0)),
+    ]);
+    const zip = new zlib.ZipBuffer(archive);
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, false);
+    assert.strictEqual(provider.supportsSymlinks, false);
+    assert.strictEqual(provider.supportsWatch, false);
+
+    const archiveVfs = vfs.create(provider);
+
+    // stat: file, implicit directory, explicit directory, root.
+    const fileStat = await archiveVfs.promises.stat('/a.txt');
+    assert.strictEqual(fileStat.isFile(), true);
+    assert.strictEqual(fileStat.size, 5);
+
+    const implicitDirStat = await archiveVfs.promises.stat('/dir');
+    assert.strictEqual(implicitDirStat.isDirectory(), true);
+
+    const explicitDirStat = await archiveVfs.promises.stat('/empty-dir');
+    assert.strictEqual(explicitDirStat.isDirectory(), true);
+
+    const rootStat = await archiveVfs.promises.stat('/');
+    assert.strictEqual(rootStat.isDirectory(), true);
+
+    await assert.rejects(archiveVfs.promises.stat('/missing.txt'), { code: 'ENOENT' });
+
+    // readdir: root lists both files and directories, deduped.
+    const rootEntries = await archiveVfs.promises.readdir('/');
+    assert.deepStrictEqual(rootEntries.sort(), ['a.txt', 'dir', 'empty-dir']);
+
+    const dirEntries = await archiveVfs.promises.readdir('/dir');
+    assert.deepStrictEqual(dirEntries, ['b.txt']);
+
+    const withTypes = await archiveVfs.promises.readdir('/', { withFileTypes: true });
+    const byName = new Map(withTypes.map((d) => [d.name, d]));
+    assert.strictEqual(byName.get('a.txt').isFile(), true);
+    assert.strictEqual(byName.get('dir').isDirectory(), true);
+
+    await assert.rejects(archiveVfs.promises.readdir('/a.txt'), { code: 'ENOTDIR' });
+    await assert.rejects(
+      archiveVfs.promises.readdir('/', { recursive: true }),
+      { code: 'ERR_METHOD_NOT_IMPLEMENTED' },
+    );
+
+    // readFile / writeFile round trip (new file).
+    assert.strictEqual(await archiveVfs.promises.readFile('/a.txt', 'utf8'), 'hello');
+    await archiveVfs.promises.writeFile('/new.txt', 'brand new');
+    assert.strictEqual(await archiveVfs.promises.readFile('/new.txt', 'utf8'), 'brand new');
+    assert.strictEqual(zip.has('new.txt'), true);
+
+    // Overwriting an existing file.
+    await archiveVfs.promises.writeFile('/a.txt', 'overwritten');
+    assert.strictEqual(await archiveVfs.promises.readFile('/a.txt', 'utf8'), 'overwritten');
+
+    // appendFile.
+    await archiveVfs.promises.writeFile('/append.txt', 'ab');
+    await archiveVfs.promises.appendFile('/append.txt', 'cd');
+    assert.strictEqual(await archiveVfs.promises.readFile('/append.txt', 'utf8'), 'abcd');
+
+    // mkdir + rmdir.
+    await archiveVfs.promises.mkdir('/newdir');
+    assert.strictEqual((await archiveVfs.promises.stat('/newdir')).isDirectory(), true);
+    await assert.rejects(archiveVfs.promises.mkdir('/newdir'), { code: 'EEXIST' });
+    await archiveVfs.promises.mkdir('/newdir', { recursive: true }); // No throw, already exists
+    await archiveVfs.promises.rmdir('/newdir');
+    await assert.rejects(archiveVfs.promises.stat('/newdir'), { code: 'ENOENT' });
+
+    // Rmdir refuses a non-empty directory.
+    await assert.rejects(archiveVfs.promises.rmdir('/dir'), { code: 'ENOTEMPTY' });
+
+    // unlink.
+    await archiveVfs.promises.unlink('/append.txt');
+    await assert.rejects(archiveVfs.promises.stat('/append.txt'), { code: 'ENOENT' });
+    await assert.rejects(archiveVfs.promises.unlink('/missing.txt'), { code: 'ENOENT' });
+    await assert.rejects(archiveVfs.promises.unlink('/dir'), { code: 'EISDIR' });
+
+    // rename.
+    await archiveVfs.promises.writeFile('/rename-me.txt', 'content');
+    await archiveVfs.promises.rename('/rename-me.txt', '/renamed.txt');
+    assert.strictEqual(zip.has('rename-me.txt'), false);
+    assert.strictEqual(await archiveVfs.promises.readFile('/renamed.txt', 'utf8'), 'content');
+
+    // open() flag semantics.
+    await assert.rejects(archiveVfs.promises.open('/does-not-exist.txt', 'r'), { code: 'ENOENT' });
+    await assert.rejects(archiveVfs.promises.open('/a.txt', 'wx'), { code: 'EEXIST' });
+    await assert.rejects(archiveVfs.promises.open('/dir', 'r'), { code: 'EISDIR' });
+  }
+
+  // --- ZipFile-backed, read-only: writes rejected with EROFS ----------------
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const filePath = path.join(tmpdir.path, 'vfs-archive-readonly.zip');
+    await fsPromises.writeFile(filePath, archive);
+    const zip = await zlib.ZipFile.open(filePath);
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, true);
+    const archiveVfs = vfs.create(provider);
+
+    assert.strictEqual(await archiveVfs.promises.readFile('/a.txt', 'utf8'), 'x');
+    await assert.rejects(archiveVfs.promises.writeFile('/new.txt', 'y'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.unlink('/a.txt'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.mkdir('/newdir'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.rmdir('/newdir'), { code: 'EROFS' });
+    await assert.rejects(archiveVfs.promises.rename('/a.txt', '/b.txt'), { code: 'EROFS' });
+
+    // The synchronous surface rejects the same way.
+    assert.strictEqual(archiveVfs.readFileSync('/a.txt', 'utf8'), 'x');
+    assert.throws(() => archiveVfs.writeFileSync('/new.txt', 'y'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.unlinkSync('/a.txt'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.mkdirSync('/newdir'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.rmdirSync('/newdir'), { code: 'EROFS' });
+    assert.throws(() => archiveVfs.renameSync('/a.txt', '/b.txt'), { code: 'EROFS' });
+
+    await zip.close();
+  }
+
+  // --- ZipFile-backed, opened writable: mutations persist to disk ----------
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const filePath = path.join(tmpdir.path, 'vfs-archive-writable.zip');
+    await fsPromises.writeFile(filePath, archive);
+    const zip = await zlib.ZipFile.open(filePath, { writable: true });
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, false);
+    const archiveVfs = vfs.create(provider);
+
+    await archiveVfs.promises.writeFile('/b.txt', 'new content');
+    await zip.close();
+
+    const reopened = await zlib.ZipFile.open(filePath);
+    assert.strictEqual((await (await reopened.get('b.txt')).content()).toString(), 'new content');
+    await reopened.close();
+  }
+
+  // --- ZipBuffer-backed, fully synchronous CRUD ------------------------------
+  {
+    const archive = await buildArchive([
+      await zlib.ZipEntry.create('a.txt', Buffer.from('hello')),
+      await zlib.ZipEntry.create('dir/b.txt', Buffer.from('nested')),
+    ]);
+    const zip = new zlib.ZipBuffer(archive);
+    const provider = new vfs.ZipProvider(zip);
+    const archiveVfs = vfs.create(provider);
+
+    // stat/readdir.
+    assert.strictEqual(archiveVfs.statSync('/a.txt').isFile(), true);
+    assert.strictEqual(archiveVfs.statSync('/dir').isDirectory(), true);
+    assert.throws(() => archiveVfs.statSync('/missing.txt'), { code: 'ENOENT' });
+    assert.deepStrictEqual(archiveVfs.readdirSync('/').sort(), ['a.txt', 'dir']);
+    assert.throws(() => archiveVfs.readdirSync('/a.txt'), { code: 'ENOTDIR' });
+    assert.throws(
+      () => archiveVfs.readdirSync('/', { recursive: true }),
+      { code: 'ERR_METHOD_NOT_IMPLEMENTED' },
+    );
+
+    // readFile/writeFile/appendFile round trip.
+    assert.strictEqual(archiveVfs.readFileSync('/a.txt', 'utf8'), 'hello');
+    archiveVfs.writeFileSync('/new.txt', 'brand new');
+    assert.strictEqual(archiveVfs.readFileSync('/new.txt', 'utf8'), 'brand new');
+    archiveVfs.appendFileSync('/new.txt', '!');
+    assert.strictEqual(archiveVfs.readFileSync('/new.txt', 'utf8'), 'brand new!');
+
+    // mkdir/rmdir.
+    archiveVfs.mkdirSync('/newdir');
+    assert.strictEqual(archiveVfs.statSync('/newdir').isDirectory(), true);
+    assert.throws(() => archiveVfs.mkdirSync('/newdir'), { code: 'EEXIST' });
+    archiveVfs.mkdirSync('/newdir', { recursive: true }); // No throw, already exists.
+    archiveVfs.rmdirSync('/newdir');
+    assert.throws(() => archiveVfs.statSync('/newdir'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.rmdirSync('/dir'), { code: 'ENOTEMPTY' });
+
+    // unlink.
+    archiveVfs.unlinkSync('/new.txt');
+    assert.throws(() => archiveVfs.statSync('/new.txt'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.unlinkSync('/missing.txt'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.unlinkSync('/dir'), { code: 'EISDIR' });
+
+    // rename.
+    archiveVfs.writeFileSync('/rename-me.txt', 'content');
+    archiveVfs.renameSync('/rename-me.txt', '/renamed.txt');
+    assert.strictEqual(zip.has('rename-me.txt'), false);
+    assert.strictEqual(archiveVfs.readFileSync('/renamed.txt', 'utf8'), 'content');
+
+    // open() flag semantics.
+    assert.throws(() => archiveVfs.openSync('/does-not-exist.txt', 'r'), { code: 'ENOENT' });
+    assert.throws(() => archiveVfs.openSync('/a.txt', 'wx'), { code: 'EEXIST' });
+    assert.throws(() => archiveVfs.openSync('/dir', 'r'), { code: 'EISDIR' });
+  }
+
+  // --- ZipFile-backed via openSync: sync-only round trip on disk -----------
+  {
+    const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
+    const filePath = path.join(tmpdir.path, 'vfs-archive-opensync.zip');
+    await fsPromises.writeFile(filePath, archive);
+    const zip = zlib.ZipFile.openSync(filePath, { writable: true });
+    const provider = new vfs.ZipProvider(zip);
+    assert.strictEqual(provider.readonly, false);
+    const archiveVfs = vfs.create(provider);
+
+    assert.strictEqual(archiveVfs.readFileSync('/a.txt', 'utf8'), 'x');
+    archiveVfs.writeFileSync('/b.txt', 'new content');
+    zip.closeSync();
+
+    const reopened = zlib.ZipFile.openSync(filePath);
+    assert.strictEqual(reopened.getSync('b.txt').contentSync().toString(), 'new content');
+    reopened.closeSync();
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-web-locks-no-livelock.js b/test/parallel/test-web-locks-no-livelock.js
new file mode 100644
index 000000000000..d654acb2b353
--- /dev/null
+++ b/test/parallel/test-web-locks-no-livelock.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+// Regression test for https://github.com/nodejs/node/issues/62644.
+'use strict';
+
+const common = require('../common');
+if (!common.isDebug) {
+  common.skip('Only works in debug mode');
+}
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  isMainThread,
+  parentPort,
+  workerData,
+  Worker,
+} = require('node:worker_threads');
+
+const resource = `web-locks-no-livelock`;
+
+if (!isMainThread) {
+  // A pending lock request alone does not keep the worker alive, so keep a
+  // message listener until the parent terminates this Environment.
+  parentPort.on('message', () => {});
+  navigator.locks.request(workerData, () => {});
+  parentPort.postMessage('ready');
+} else {
+  const { internalBinding } = require('internal/test/binding');
+  const { getGenericUsageCount } = internalBinding('debug');
+  const wakeCounter = 'LockManager.WakeEnvironment';
+
+  (async () => {
+    let worker;
+    let pendingInMain;
+    await navigator.locks.request(resource, common.mustCall(async () => {
+      // The worker queues an exclusive request for the resource held above.
+      worker = new Worker(__filename, { workerData: resource });
+      await once(worker, 'message');
+
+      // Queueing a second blocked request must not wake the worker: its
+      // request cannot make progress, so the two Environments would wake
+      // each other forever (livelock).
+      const wakeCount = getGenericUsageCount(wakeCounter);
+      pendingInMain = navigator.locks.request(resource, common.mustCall());
+      assert.strictEqual(getGenericUsageCount(wakeCounter), wakeCount);
+    }));
+
+    await pendingInMain;
+    await worker.terminate();
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js
index 0ff7c61bdc68..fb8014840f34 100644
--- a/test/parallel/test-webcrypto-export-import-cfrg.js
+++ b/test/parallel/test-webcrypto-export-import-cfrg.js
@@ -432,6 +432,41 @@ async function testImportRaw({ name, publicUsages }) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const jwk = keyData[name].jwk;
+    const publicJwk = {
+      kty: jwk.kty,
+      crv: jwk.crv,
+      x: jwk.x,
+    };
+    const isKeyAgreement = name.startsWith('X');
+    const invalidUsage = isKeyAgreement ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = isKeyAgreement ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const rsaPublic = crypto.createPublicKey(
     fixtures.readKey('rsa_public_2048.pem'));
diff --git a/test/parallel/test-webcrypto-export-import-ec.js b/test/parallel/test-webcrypto-export-import-ec.js
index f6157bff2b69..f4f36ceeff5a 100644
--- a/test/parallel/test-webcrypto-export-import-ec.js
+++ b/test/parallel/test-webcrypto-export-import-ec.js
@@ -120,6 +120,12 @@ async function testImportSpki({ name, publicUsages }, namedCurve, extractable) {
     assert.strictEqual(
       Buffer.from(spki).toString('hex'),
       keyData[namedCurve].spki.toString('hex'));
+
+    await assert.rejects(
+      subtle.exportKey('pkcs8', key), {
+        message: 'Key must be a private key',
+        name: 'InvalidAccessError',
+      });
   } else {
     await assert.rejects(
       subtle.exportKey('spki', key), {
@@ -163,6 +169,12 @@ async function testImportPkcs8(
     assert.strictEqual(
       Buffer.from(pkcs8).toString('hex'),
       keyData[namedCurve].pkcs8.toString('hex'));
+
+    await assert.rejects(
+      subtle.exportKey('spki', key), {
+        message: 'Key must be a public key',
+        name: 'InvalidAccessError',
+      });
   } else {
     await assert.rejects(
       subtle.exportKey('pkcs8', key), {
@@ -406,6 +418,42 @@ async function testImportRaw({ name, publicUsages }, namedCurve) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const jwk = keyData['P-256'].jwk;
+  const publicJwk = {
+    kty: jwk.kty,
+    crv: jwk.crv,
+    x: jwk.x,
+    y: jwk.y,
+  };
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const invalidUsage = name === 'ECDH' ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = name === 'ECDH' ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 
 // https://github.com/nodejs/node/issues/45859
 (async function() {
diff --git a/test/parallel/test-webcrypto-export-import-ml-dsa.js b/test/parallel/test-webcrypto-export-import-ml-dsa.js
index 20d46870e430..9c6e04da053c 100644
--- a/test/parallel/test-webcrypto-export-import-ml-dsa.js
+++ b/test/parallel/test-webcrypto-export-import-ml-dsa.js
@@ -491,6 +491,40 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   });
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData['ML-DSA-65'].jwk;
+  const publicJwk = { ...privateJwk, priv: undefined };
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'verify'],
+    [publicJwk, 'sign'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'sign'],
+    [publicJwk, 'verify'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+})().then(common.mustCall());
+
 if (!process.features.openssl_is_boringssl) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
index cd05224969c8..862eea96726d 100644
--- a/test/parallel/test-webcrypto-export-import-ml-kem.js
+++ b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -496,13 +496,29 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
   });
 })().then(common.mustCall());
 
-// Regression test: JWK `key_ops` validation must recognize ML-KEM operations
-// (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits) so that
-// duplicate entries are rejected
+// JWK key usage validation precedes `key_ops` validation.
 (async function() {
-  for (const op of ['encapsulateKey', 'encapsulateBits',
-                    'decapsulateKey', 'decapsulateBits']) {
-    const jwk = { ...keyData['ML-KEM-768'].jwk, key_ops: [op, op] };
+  const privateJwk = keyData['ML-KEM-768'].jwk;
+  const encapsulationOps = ['encapsulateKey', 'encapsulateBits'];
+  const decapsulationOps = ['decapsulateKey', 'decapsulateBits'];
+
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  // Duplicate entries are still rejected when the requested usages are valid.
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, priv: undefined, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+
+  for (const op of decapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
     await assert.rejects(
       subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
       { name: 'DataError', message: /Duplicate key operation/ });
diff --git a/test/parallel/test-webcrypto-export-import-rsa.js b/test/parallel/test-webcrypto-export-import-rsa.js
index 8808fcbe6b1f..294baff544a6 100644
--- a/test/parallel/test-webcrypto-export-import-rsa.js
+++ b/test/parallel/test-webcrypto-export-import-rsa.js
@@ -651,6 +651,35 @@ const testVectors = [
   await Promise.all(variations);
 })().then(common.mustCall());
 
+// Type-specific JWK usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData[1024].jwk;
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const algorithm = { name, hash: 'SHA-256' };
+    const invalidUsage = publicUsages[0];
+    const validUsage = privateUsages[0];
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [invalidUsage, invalidUsage] },
+        algorithm,
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [validUsage, validUsage] },
+        algorithm,
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const ecPublic = crypto.createPublicKey(
     fixtures.readKey('ec_p256_public.pem'));
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 62e9cbe7826a..12633cd50de2 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -227,22 +227,26 @@ async function testSaltLength(keyLength, hash, hLen) {
 
   const signature = await subtle.sign(
     { name: 'RSA-PSS', saltLength: max }, privateKey, data);
-  await assert.rejects(
-    subtle.sign({ name: 'RSA-PSS', saltLength: max + 1 }, privateKey, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause?.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
-      return true;
-    });
-  await subtle.verify(
-    { name: 'RSA-PSS', saltLength: max }, publicKey, signature, data);
-  await assert.rejects(
-    subtle.verify({ name: 'RSA-PSS', saltLength: max + 1 }, publicKey, signature, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause?.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
-      return true;
-    });
+  assert.strictEqual(await subtle.verify(
+    { name: 'RSA-PSS', saltLength: max }, publicKey, signature, data), true);
+
+  for (const saltLength of [max + 1, 0x7fffffff]) {
+    await assert.rejects(
+      subtle.sign({ name: 'RSA-PSS', saltLength }, privateKey, data), {
+        name: 'OperationError',
+      });
+    assert.strictEqual(await subtle.verify(
+      { name: 'RSA-PSS', saltLength }, publicKey, signature, data), false);
+  }
+
+  for (const saltLength of [0x80000000, 0xffffffff]) {
+    await assert.rejects(
+      subtle.sign({ name: 'RSA-PSS', saltLength }, privateKey, data), {
+        name: 'OperationError',
+      });
+    assert.strictEqual(await subtle.verify(
+      { name: 'RSA-PSS', saltLength }, publicKey, signature, data), false);
+  }
 }
 
 (async function() {
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index c2c089ed0ffa..5ffffe230ac6 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -506,7 +506,7 @@ async function testNonByteLengthWrapUnwrap({
 // Test that wrapKey/unwrapKey validate the wrapping/unwrapping key's
 // algorithm and usage before proceeding.
 // Spec: https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
-// Steps 9-10 (wrapping key checks) must precede step 12 (exportKey).
+// Steps 9-10 (wrapping key checks) must precede step 13 (export operation).
 (async function() {
   const hmacKey = await subtle.generateKey(
     { name: 'HMAC', hash: 'SHA-256' },
@@ -551,7 +551,7 @@ async function testNonByteLengthWrapUnwrap({
     });
 
   // Correct wrapping key algorithm and usage results in the expected
-  // exportKey error (not the wrapping key validation error).
+  // export operation error (not the wrapping key validation error).
   const wrapKey = await subtle.generateKey(
     { name: 'AES-GCM', length: 128 },
     true,
@@ -563,8 +563,19 @@ async function testNonByteLengthWrapUnwrap({
       name: 'AES-GCM',
       iv: new Uint8Array(12),
     }), {
-      // exportKey('spki', privateKey) throws NotSupportedError
-      name: 'NotSupportedError',
+      message: 'Key must be a public key',
+      name: 'InvalidAccessError',
+    });
+
+  // Symmetric case: exporting a public key as 'pkcs8' must also fail with
+  // InvalidAccessError, not the generic NotSupportedError.
+  await assert.rejects(
+    subtle.wrapKey('pkcs8', ecKey.publicKey, wrapKey, {
+      name: 'AES-GCM',
+      iv: new Uint8Array(12),
+    }), {
+      message: 'Key must be a private key',
+      name: 'InvalidAccessError',
     });
 
   // --- unwrapKey validation tests ---
diff --git a/test/parallel/test-webstreams-pipeline.js b/test/parallel/test-webstreams-pipeline.js
index a4bf579f5f11..5643524449ad 100644
--- a/test/parallel/test-webstreams-pipeline.js
+++ b/test/parallel/test-webstreams-pipeline.js
@@ -212,7 +212,7 @@ const http = require('http');
         values.push(chunk?.toString());
       });
       res.on('end', common.mustCall(() => {
-        assert.deepStrictEqual(values, ['hello', 'world']);
+        assert.strictEqual(values.join(''), 'helloworld');
         server.close();
       }));
     }));
diff --git a/test/parallel/test-webworker-ref-unref.js b/test/parallel/test-webworker-ref-unref.js
new file mode 100644
index 000000000000..cff2bb5d097f
--- /dev/null
+++ b/test/parallel/test-webworker-ref-unref.js
@@ -0,0 +1,29 @@
+// Flags: --experimental-web-worker
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+
+{
+  // Both are no-ops on a worker whose script could not be loaded.
+  const worker = new Worker(fixtures.fileURL('web-worker', 'nonexistent.js').href);
+  worker.addEventListener('error', common.mustCall());
+  process.unref(worker);
+  process.ref(worker);
+}
+
+const worker = new Worker(fixtures.fileURL('web-worker', 'echo.js').href);
+
+worker.addEventListener('error', common.mustNotCall('worker failed'));
+worker.addEventListener('message', common.mustCall(({ data }) => {
+  assert.strictEqual(data, 'hello');
+  worker.terminate();
+}));
+
+process.once('beforeExit', common.mustCall(() => {
+  process.ref(worker);
+  worker.postMessage('hello');
+}));
+
+process.unref(worker);
diff --git a/test/parallel/test-worker-heap-profile.js b/test/parallel/test-worker-heap-profile.js
index 2a466dc2f186..b3332831621a 100644
--- a/test/parallel/test-worker-heap-profile.js
+++ b/test/parallel/test-worker-heap-profile.js
@@ -63,11 +63,10 @@ worker.on('online', common.mustCall(async () => {
 
   {
     const handle = await worker.startHeapProfile();
-    try {
-      await worker.startHeapProfile();
-    } catch (err) {
-      assert.strictEqual(err.code, 'ERR_HEAP_PROFILE_HAVE_BEEN_STARTED');
-    }
+
+    await assert.rejects(worker.startHeapProfile(), {
+      code: 'ERR_HEAP_PROFILE_HAVE_BEEN_STARTED',
+    });
     JSON.parse(await handle.stop());
   }
 
diff --git a/test/parallel/test-worker-spec-differences.js b/test/parallel/test-worker-spec-differences.js
new file mode 100644
index 000000000000..871745b99e04
--- /dev/null
+++ b/test/parallel/test-worker-spec-differences.js
@@ -0,0 +1,134 @@
+// Flags: --experimental-web-worker
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const path = require('path');
+
+function workerURL(name) {
+  return fixtures.fileURL('web-worker', name).href;
+}
+
+// Asserts that `worker` posts exactly one message and terminates it. A worker
+// is kept alive by its message port, so it never exits on its own.
+function expectMessage(worker, check) {
+  worker.addEventListener('error', common.mustNotCall('worker failed'));
+  worker.addEventListener('message', common.mustCall(({ data }) => {
+    check(data);
+    worker.terminate();
+  }));
+}
+
+// Asserts that `worker` fails to run and fires an error event.
+function expectError(worker, check) {
+  worker.addEventListener('message', common.mustNotCall('worker succeeded'));
+  worker.addEventListener('error', check);
+}
+
+process.on('uncaughtException', common.mustNotCall(
+  'worker errors must not be reported on the main thread'));
+
+// The only supported schemes are 'file:', 'blob:', and 'data:'
+for (const unsupported of [
+  'https://nodejs.org/worker.js',
+  'http://localhost/worker.js',
+  'about:blank',
+  'node:worker_threads',
+]) {
+  assert.throws(() => new Worker(unsupported), { name: 'NotSupportedError' });
+}
+
+// Same as above, for `importScripts`
+expectMessage(new Worker(workerURL('import-scheme.js')),
+              common.mustCall((data) => assert.strictEqual(data, 'NetworkError')));
+
+// Rejection events are emitted on the process
+expectMessage(new Worker(workerURL('no-events.js')), common.mustCall((data) => {
+  assert.deepStrictEqual(data.dispatched, []);
+  assert.strictEqual(data.processEvents, 1);
+}));
+
+{
+  // Calling close() immediately terminates the worker
+  const worker = new Worker(workerURL('close.js'));
+  worker.addEventListener('error', common.mustNotCall('worker failed'));
+  worker.addEventListener('message', common.mustCall(({ data }) => {
+    assert.strictEqual(data, 'before-close');
+  }, 1));
+}
+
+{
+  // Relative imports
+  const target = fixtures.path('web-worker', 'relative.js');
+  const relative =
+    path.relative(process.cwd(), target).replaceAll(path.sep, '/');
+  expectMessage(new Worker(relative.startsWith('.') ? relative : `./${relative}`),
+                common.mustCall((data) => assert.strictEqual(data, 'relative')));
+}
+
+{
+  // The classic type takes precedence over the file extension.
+  expectMessage(new Worker(workerURL('classic.mjs'), { type: 'classic' }),
+                common.mustCall((data) => assert.deepStrictEqual(data, {
+                  binding: 'classic',
+                  requireType: 'function',
+                  thisIsGlobal: true,
+                })));
+}
+
+{
+  // The module type takes precedence over the file extension and preserves
+  // the file URL as the base for relative imports.
+  expectMessage(new Worker(workerURL('module.cjs'), { type: 'module' }),
+                common.mustCall((data) => assert.deepStrictEqual(data, {
+                  requireType: 'undefined',
+                  thisIsUndefined: true,
+                  value: 'module',
+                })));
+}
+
+if (common.hasCrypto) {
+  {
+    // MIME validation must use the Blob's internal type, not its public getter.
+    const blob = new Blob(['postMessage("unexpected")'], { type: 'text/plain' });
+    const url = URL.createObjectURL(blob);
+    const typeDescriptor = Object.getOwnPropertyDescriptor(Blob.prototype, 'type');
+    Object.defineProperty(Blob.prototype, 'type', {
+      configurable: true,
+      get() { return 'text/javascript'; },
+    });
+    let worker;
+    try {
+      worker = new Worker(url);
+    } finally {
+      Object.defineProperty(Blob.prototype, 'type', typeDescriptor);
+    }
+    expectError(worker, common.mustCall(({ message }) => {
+      assert.match(message, /^Failed to fetch the worker script:/);
+      URL.revokeObjectURL(url);
+    }));
+  }
+
+  {
+    // Module source encoding must not call mutable Buffer prototype methods.
+    const blob = new Blob(['postMessage("original")'], {
+      type: 'text/javascript',
+    });
+    const url = URL.createObjectURL(blob);
+    const bufferToString = Buffer.prototype.toString;
+    Buffer.prototype.toString = common.mustNotCall();
+    let worker;
+    try {
+      worker = new Worker(url, { type: 'module' });
+    } finally {
+      Buffer.prototype.toString = bufferToString;
+    }
+    expectMessage(worker, common.mustCall((data) => {
+      assert.strictEqual(data, 'original');
+      URL.revokeObjectURL(url);
+    }));
+  }
+} else {
+  common.printSkipMessage('skipping Blob tests due to lack of randomUUID()');
+}
diff --git a/test/parallel/test-zlib-zip-file-lifecycle.js b/test/parallel/test-zlib-zip-file-lifecycle.js
index 85a06f86b75e..ad5d4b6237da 100644
--- a/test/parallel/test-zlib-zip-file-lifecycle.js
+++ b/test/parallel/test-zlib-zip-file-lifecycle.js
@@ -44,6 +44,21 @@ test('close() waits for an in-flight read instead of closing under it', async ()
   assert.ok(data.equals(payload));
 });
 
+test('close() resolves with a paused contentIterator()', async () => {
+  tmpdir.refresh();
+  const file = tmpdir.resolve('paused-iterator.zip');
+  const payload = Buffer.alloc(8 * 1024 * 1024, 0x61);
+  writeArchive(file, [zlib.ZipEntry.createSync('big', payload, { method: 'store' })]);
+
+  const zf = zlib.ZipFile.openSync(file);
+  const iterator = zf.getSync('big').contentIterator();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+
+  await zf.close();
+  await assert.rejects(iterator.next(), { code: 'ERR_INVALID_STATE' });
+});
+
 // 2. A failed central-directory rewrite during add() is rolled back.
 test('a failed directory rewrite during addEntrySync is rolled back', () => {
   tmpdir.refresh();
diff --git a/test/parallel/test-zlib-zip-vfs.js b/test/parallel/test-zlib-zip-vfs.js
new file mode 100644
index 000000000000..213dcad0f286
--- /dev/null
+++ b/test/parallel/test-zlib-zip-vfs.js
@@ -0,0 +1,180 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// Exercises the node:zlib ZipFile read/write surface over a node:vfs virtual
+// file descriptor. An in-memory archive is placed in a mounted MemoryProvider
+// VFS and opened with ZipFile through its mounted path, so every fd operation
+// ZipFile performs - positional read/write, fstat, ftruncate, open/close, in
+// both the asynchronous and the synchronous flavour - is served by the VFS
+// rather than a real OS fd. This validates that ZipFile's fd abstraction is
+// complete enough to run unchanged on a purely virtual descriptor.
+
+require('../common');
+
+const assert = require('node:assert');
+const zlib = require('node:zlib');
+const fs = require('node:fs');
+const { test } = require('node:test');
+const vfs = require('node:vfs');
+
+async function buildArchive(entries, comment) {
+  const chunks = [];
+  for await (const chunk of zlib.createZipArchive(entries, comment)) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+// Places `archive` in a freshly mounted in-memory VFS and returns the mounted
+// path of the archive file plus a cleanup that unmounts the VFS. mount() picks
+// the mount point itself, inside a reserved namespace.
+function mountArchive(archive) {
+  const memfs = vfs.create();
+  memfs.writeFileSync('/archive.zip', archive); // provider-relative, before mount
+  const mountPoint = memfs.mount();
+  return { vpath: `${mountPoint}/archive.zip`, cleanup: () => memfs.unmount() };
+}
+
+test('ZipFile.open() reads a VFS-backed archive through an async virtual fd', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('hello vfs')),
+    await zlib.ZipEntry.create('dir/b.bin', Buffer.from([1, 2, 3, 4]), { method: 'store' }),
+    await zlib.ZipEntry.create('z.txt', Buffer.from('Z'.repeat(4096)), { method: 'zstd' }),
+  ]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const zf = await zlib.ZipFile.open(vpath);
+    try {
+      assert.strictEqual(zf.size, 3);
+      assert.deepStrictEqual([...zf.keys()].sort(), ['a.txt', 'dir/b.bin', 'z.txt']);
+
+      // A lazy, file-backed entry: it retains no content and reads straight
+      // from the virtual fd on demand.
+      const a = await zf.get('a.txt');
+      assert.strictEqual(a.rawContent, null);
+      assert.strictEqual((await a.content()).toString(), 'hello vfs');
+      assert.strictEqual(await zf.get('a.txt'), a); // Cached handle identity
+
+      // The contentIterator() streams (decompressing on the way) from the fd.
+      const chunks = [];
+      for await (const c of (await zf.get('z.txt')).contentIterator()) chunks.push(c);
+      assert.strictEqual(Buffer.concat(chunks).toString(), 'Z'.repeat(4096));
+
+      // stream() resolves to a Readable over the virtual fd.
+      const rs = await zf.stream('dir/b.bin');
+      const out = [];
+      for await (const c of rs) out.push(c);
+      assert.deepStrictEqual(Buffer.concat(out), Buffer.from([1, 2, 3, 4]));
+    } finally {
+      await zf.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile.openSync() reads a VFS-backed archive through a synchronous virtual fd', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('a.txt', Buffer.from('sync hello')),
+    await zlib.ZipEntry.create('b.bin', Buffer.from([9, 8, 7]), { method: 'store' }),
+  ]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const zf = zlib.ZipFile.openSync(vpath);
+    try {
+      assert.strictEqual(zf.getSync('a.txt').contentSync().toString(), 'sync hello');
+      assert.deepStrictEqual([...zf.getSync('b.bin').contentSync()], [9, 8, 7]);
+      assert.deepStrictEqual([...zf.valuesSync()].map((e) => e.name).sort(), ['a.txt', 'b.bin']);
+    } finally {
+      zf.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile writable mutations run against an async virtual fd', async () => {
+  const archive = await buildArchive([
+    await zlib.ZipEntry.create('keep.txt', Buffer.from('keep')),
+    await zlib.ZipEntry.create('drop.txt', Buffer.from('drop')),
+  ]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const sizeBefore = fs.statSync(vpath).size;
+    const zw = await zlib.ZipFile.open(vpath, { writable: true });
+    try {
+      await zw.add('added.txt', Buffer.from('a new member over vfs'));
+      assert.strictEqual(await zw.delete('drop.txt'), true);
+    } finally {
+      await zw.close();
+    }
+    // Positional writes + ftruncate actually altered the virtual file.
+    assert.notStrictEqual(fs.statSync(vpath).size, sizeBefore);
+
+    const zr = await zlib.ZipFile.open(vpath);
+    try {
+      assert.deepStrictEqual([...zr.keys()].sort(), ['added.txt', 'keep.txt']);
+      assert.strictEqual((await (await zr.get('added.txt')).content()).toString(), 'a new member over vfs');
+      assert.strictEqual(zr.has('drop.txt'), false);
+    } finally {
+      await zr.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('ZipFile sync mutations (addEntrySync) run against a synchronous virtual fd', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('a'))]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const zw = zlib.ZipFile.openSync(vpath, { writable: true });
+    try {
+      zw.addSync('b.txt', Buffer.from('b sync'));
+      assert.deepStrictEqual([...zw.keys()].sort(), ['a.txt', 'b.txt']);
+    } finally {
+      zw.closeSync();
+    }
+    const zr = zlib.ZipFile.openSync(vpath);
+    try {
+      assert.strictEqual(zr.getSync('b.txt').contentSync().toString(), 'b sync');
+    } finally {
+      zr.closeSync();
+    }
+  } finally {
+    cleanup();
+  }
+});
+
+test('addEntry() promotes a streaming entry to file-backed on a virtual fd', async () => {
+  const archive = await buildArchive([await zlib.ZipEntry.create('seed.txt', Buffer.from('seed'))]);
+  const { vpath, cleanup } = mountArchive(archive);
+  try {
+    const payload = 'streamed over vfs'.repeat(32);
+    const zw = await zlib.ZipFile.open(vpath, { writable: true });
+    try {
+      async function* source() {
+        yield Buffer.from(payload.slice(0, 5));
+        yield Buffer.from(payload.slice(5));
+      }
+      const streamEntry = zlib.ZipEntry.createStream('s.txt', source());
+      const returned = await zw.addEntry(streamEntry);
+      assert.strictEqual(returned, streamEntry);
+
+      // Promoted in place against the virtual fd: now readable and re-streamable.
+      assert.strictEqual((await streamEntry.content()).toString(), payload);
+      const it = [];
+      for await (const c of streamEntry.contentIterator()) it.push(c);
+      assert.strictEqual(Buffer.concat(it).toString(), payload);
+    } finally {
+      await zw.close();
+    }
+
+    const zr = await zlib.ZipFile.open(vpath);
+    try {
+      assert.strictEqual((await (await zr.get('s.txt')).content()).toString(), payload);
+    } finally {
+      await zr.close();
+    }
+  } finally {
+    cleanup();
+  }
+});
diff --git a/test/pseudo-tty/test-set-raw-mode-modes.js b/test/pseudo-tty/test-set-raw-mode-modes.js
index 8280aacb0a85..fa11b25f3c1c 100644
--- a/test/pseudo-tty/test-set-raw-mode-modes.js
+++ b/test/pseudo-tty/test-set-raw-mode-modes.js
@@ -1,15 +1,14 @@
 'use strict';
 require('../common');
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
 
 function isOnlcrEnabled() {
-  const { stdout, stderr, status } = spawnSync('stty', ['-a'], {
+  const { child: { stdout } } = spawnSyncAndExitWithoutError('stty', ['-a'], {
     encoding: 'utf8',
     stdio: ['inherit', 'pipe', 'pipe'],
   });
 
-  assert.strictEqual(status, 0, stderr);
   return /(?:^|[\s;])onlcr(?:[\s;]|$)/.test(stdout);
 }
 
diff --git a/test/pummel/test-heap-profile-and-snapshot-near-heap-limit.js b/test/pummel/test-heap-profile-and-snapshot-near-heap-limit.js
new file mode 100644
index 000000000000..f7dec66d9060
--- /dev/null
+++ b/test/pummel/test-heap-profile-and-snapshot-near-heap-limit.js
@@ -0,0 +1,33 @@
+'use strict';
+
+const common = require('../common');
+
+if (common.isPi()) {
+  common.skip('Too slow for Raspberry Pi devices');
+}
+
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+const fs = require('fs');
+
+tmpdir.refresh();
+const child = spawnSync(process.execPath, [
+  '--max-old-space-size=50',
+  fixtures.path('workload', 'heap-profile-and-snapshot-near-heap-limit.js'),
+], {
+  cwd: tmpdir.path,
+});
+
+const stderr = child.stderr.toString();
+assert(common.nodeProcessAborted(child.status, child.signal),
+       'process should have aborted, but did not');
+
+const files = fs.readdirSync(tmpdir.path);
+const snapshots = files.filter((f) => f.endsWith('.heapsnapshot'));
+const profiles = files.filter((f) => f.endsWith('.heapprofile'));
+
+assert(snapshots.length === 1 ||
+       stderr.includes('Not generating snapshots because it\'s too risky'));
+assert.strictEqual(profiles.length, 1);
diff --git a/test/pummel/test-heap-profile-near-heap-limit.js b/test/pummel/test-heap-profile-near-heap-limit.js
new file mode 100644
index 000000000000..522b01c54c7c
--- /dev/null
+++ b/test/pummel/test-heap-profile-near-heap-limit.js
@@ -0,0 +1,33 @@
+'use strict';
+
+const common = require('../common');
+
+if (common.isPi()) {
+  common.skip('Too slow for Raspberry Pi devices');
+}
+
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+const fs = require('fs');
+
+tmpdir.refresh();
+const child = spawnSync(process.execPath, [
+  '--max-old-space-size=50',
+  fixtures.path('workload', 'heap-profile-near-heap-limit.js'),
+], {
+  cwd: tmpdir.path,
+});
+
+assert(common.nodeProcessAborted(child.status, child.signal),
+       'process should have aborted, but did not');
+
+const profiles = fs.readdirSync(tmpdir.path)
+  .filter((file) => file.endsWith('.heapprofile'));
+assert.strictEqual(profiles.length, 1);
+
+const profile = JSON.parse(
+  fs.readFileSync(tmpdir.resolve(profiles[0]), 'utf8'));
+assert(profile.head);
+assert(profile.samples.length > 0);
diff --git a/test/sea/test-build-sea-elf-segments.js b/test/sea/test-build-sea-elf-segments.js
new file mode 100644
index 000000000000..3772352380c0
--- /dev/null
+++ b/test/sea/test-build-sea-elf-segments.js
@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+  common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2);  // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+  const at = phoff + i * phentsize;
+  if (elf.readUInt32LE(at) !== 1) continue;  // PT_LOAD
+  const vaddr = elf.readBigUInt64LE(at + 0x10);
+  const memsz = elf.readBigUInt64LE(at + 0x28);
+  if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+  assert(loads[i].first > loads[i - 1].last,
+         `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+         `which PT_LOAD ${i - 1} already covers`);
+}
diff --git a/test/sea/test-build-sea-vfs-incompatible-options.js b/test/sea/test-build-sea-vfs-incompatible-options.js
new file mode 100644
index 000000000000..3f76beff087d
--- /dev/null
+++ b/test/sea/test-build-sea-vfs-incompatible-options.js
@@ -0,0 +1,77 @@
+// This tests that --build-sea rejects "useVfs" combined with options it
+// does not support.
+
+'use strict';
+
+require('../common');
+const tmpdir = require('../common/tmpdir');
+const { skipIfBuildSEAIsNotSupported } = require('../common/sea');
+const { writeFileSync } = require('fs');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+skipIfBuildSEAIsNotSupported();
+
+// Test: "useVfs" is not a Boolean
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('invalid-useVfs.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": "true"
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" field of .*invalid-useVfs\.json is not a Boolean/,
+    });
+}
+
+// Test: "useVfs" with "useSnapshot"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-snapshot.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useSnapshot": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useSnapshot" is true/,
+    });
+}
+
+// Test: "useVfs" with "useCodeCache"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-code-cache.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useCodeCache": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useCodeCache" is true/,
+    });
+}
diff --git a/test/sea/test-single-executable-application-vfs-esm.js b/test/sea/test-single-executable-application-vfs-esm.js
new file mode 100644
index 000000000000..b591f6e9d62b
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs-esm.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// This tests the SEA VFS integration with an ESM entry point - the bundled
+// assets are mounted as a virtual file system and the ESM main script runs
+// from inside the mount through the ESM loader.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs-esm'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS ESM tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sea/test-single-executable-application-vfs.js b/test/sea/test-single-executable-application-vfs.js
new file mode 100644
index 000000000000..46a50cd79f86
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// This tests the SEA VFS integration - the bundled assets are mounted as a
+// virtual file system and the main script runs from inside the mount.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sea/test-single-executable-application.js b/test/sea/test-single-executable-application.js
index f9f92958921f..ae49156451a3 100644
--- a/test/sea/test-single-executable-application.js
+++ b/test/sea/test-single-executable-application.js
@@ -3,11 +3,11 @@
 require('../common');
 
 const {
-  generateSEA,
-  skipIfSingleExecutableIsNotSupported,
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
 } = require('../common/sea');
 
-skipIfSingleExecutableIsNotSupported();
+skipIfBuildSEAIsNotSupported();
 
 // This tests the creation of a single executable application.
 
@@ -18,7 +18,7 @@ const fixtures = require('../common/fixtures');
 
 tmpdir.refresh();
 
-const outputFile = generateSEA(fixtures.path('sea', 'simple'));
+const outputFile = buildSEA(fixtures.path('sea', 'simple'));
 
 spawnSyncAndAssert(
   outputFile,
diff --git a/test/sequential/sequential.status b/test/sequential/sequential.status
index 01a021130c15..6b5714500b23 100644
--- a/test/sequential/sequential.status
+++ b/test/sequential/sequential.status
@@ -13,6 +13,10 @@ test-watch-mode-inspect: PASS, FLAKY
 # https://github.com/nodejs/node/issues/47409
 test-http2-large-file: PASS, FLAKY
 
+[$system==win32]
+# https://github.com/nodejs/node/issues/63212#issuecomment-5423558796
+test-debugger-pid: PASS, FLAKY
+
 [$system==linux]
 # https://github.com/nodejs/node/issues/54817
 test-http-server-request-timeouts-mixed: PASS, FLAKY
diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
index ef48f457a878..0842f8fdfa98 100644
--- a/test/sequential/test-async-wrap-getasyncid.js
+++ b/test/sequential/test-async-wrap-getasyncid.js
@@ -76,6 +76,8 @@ const { getSystemErrorName } = require('util');
     delete providers.QUIC_SESSION;
     delete providers.QUIC_STREAM;
     delete providers.LOCKS;
+    delete providers.DTLS_ENDPOINT;
+    delete providers.DTLS_SESSION;
 
     const objKeys = Object.keys(providers);
     if (objKeys.length > 0)
diff --git a/test/sequential/test-dtls-interop-openssl-client.mjs b/test/sequential/test-dtls-interop-openssl-client.mjs
new file mode 100644
index 000000000000..580cc0401a18
--- /dev/null
+++ b/test/sequential/test-dtls-interop-openssl-client.mjs
@@ -0,0 +1,103 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS interop -- Node.js DTLS server with OpenSSL s_client.
+// Verifies that an external DTLS client (OpenSSL CLI) can complete a
+// handshake with Node's DTLS server and exchange application data.
+
+import { hasCrypto, skip, mustCall } from '../common/index.mjs';
+import { createRequire } from 'module';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const require = createRequire(import.meta.url);
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  skip('missing openssl-cli');
+}
+
+const { listen } = await import('node:dtls');
+
+const reply = 'I AM THE WALRUS'; // Something recognizable
+const serverReceivedData = Promise.withResolvers();
+
+// Start Node.js DTLS server.
+const endpoint = listen(mustCall((session) => {
+  session.onmessage = mustCall((data) => {
+    assert.strictEqual(data.toString().trim(), 'hello from openssl');
+    session.send(reply);
+    serverReceivedData.resolve();
+  });
+  session.onhandshake = mustCall();
+}), {
+  cert: fixtures.readKey('agent1-cert.pem').toString(),
+  key: fixtures.readKey('agent1-key.pem').toString(),
+  port: 0,
+  host: '127.0.0.1',
+});
+
+const { port } = endpoint.address;
+
+// Spawn OpenSSL s_client to connect to the Node.js server.
+const args = [
+  's_client',
+  '-dtls',
+  '-connect', `127.0.0.1:${port}`,
+  '-CAfile', fixtures.path('keys/ca1-cert.pem'),
+];
+
+const client = spawn(opensslCli, args, { stdio: 'pipe' });
+
+let stdout = '';
+client.stdout.on('data', (data) => { stdout += data; });
+
+let stderr = '';
+client.stderr.on('data', (data) => { stderr += data; });
+
+const timeout = setTimeout(() => {
+  client.kill();
+  endpoint.close();
+  assert.fail('Test timed out');
+}, 10000);
+
+// Wait for the handshake to start (s_client writes TLS info to stdout),
+// then send data.
+await new Promise((resolve) => client.stdout.once('data', resolve));
+await sleep(500);
+
+client.stdin.write('hello from openssl\n');
+
+// Wait for the server to receive and reply.
+await serverReceivedData.promise;
+await sleep(500);
+
+// Close stdin so s_client exits.
+client.stdin.end();
+
+// Wait for s_client to exit.
+const code = await new Promise((resolve) => client.on('close', resolve));
+clearTimeout(timeout);
+
+// s_client should exit cleanly.
+assert.strictEqual(code, 0,
+                   `openssl s_client exited with code ${code}\n${stderr}`);
+
+// Verify the reply from Node's server appeared in s_client's stdout.
+assert(stdout.includes(reply),
+       `Expected stdout to include "${reply}"\n${stdout}`);
+
+// Verify it was a DTLS connection.
+assert(stdout.includes('DTLS'),
+       `Expected stdout to include "DTLS"\n${stdout}`);
+
+await endpoint.close();
diff --git a/test/sequential/test-dtls-interop-openssl-server.mjs b/test/sequential/test-dtls-interop-openssl-server.mjs
new file mode 100644
index 000000000000..26e66710611f
--- /dev/null
+++ b/test/sequential/test-dtls-interop-openssl-server.mjs
@@ -0,0 +1,95 @@
+// Flags: --experimental-dtls --no-warnings
+
+// Test: DTLS interop -- OpenSSL s_server with Node.js DTLS client.
+// Verifies that Node's DTLS client can complete a handshake with an
+// external DTLS server (OpenSSL CLI) and exchange application data.
+
+import { hasCrypto, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import { createRequire } from 'module';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasCrypto) {
+  skip('missing crypto');
+}
+
+if (!process.features.dtls) {
+  skip('DTLS is not enabled');
+}
+
+const require = createRequire(import.meta.url);
+const common = require('../common');
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  skip('missing openssl-cli');
+}
+
+const { connect } = await import('node:dtls');
+
+const reply = 'I AM THE WALRUS'; // Something recognizable
+
+// Start OpenSSL DTLS server.
+const server = spawn(opensslCli, [
+  's_server',
+  '-dtls1_2',
+  '-accept', String(common.PORT),
+  '-cert', fixtures.path('keys/agent1-cert.pem'),
+  '-key', fixtures.path('keys/agent1-key.pem'),
+  '-listen',
+], { stdio: 'pipe' });
+
+let serverOut = '';
+server.stdout.on('data', (data) => { serverOut += data; });
+let serverErr = '';
+server.stderr.on('data', (data) => { serverErr += data; });
+server.on('error', mustNotCall());
+
+const timeout = setTimeout(() => {
+  server.kill();
+  assert.fail(`Test timed out\nstdout: ${serverOut}\nstderr: ${serverErr}`);
+}, 10000);
+
+// Wait for "ACCEPT" on stdout -- this means s_server is ready.
+await new Promise((resolve) => {
+  server.stdout.on('data', function onReady() {
+    if (!serverOut.includes('ACCEPT')) return;
+    server.stdout.removeListener('data', onReady);
+    resolve();
+  });
+});
+
+// Connect Node.js DTLS client.
+const session = connect('127.0.0.1', common.PORT, {
+  ca: [fixtures.readKey('ca1-cert.pem').toString()],
+  rejectUnauthorized: false,
+});
+
+const { protocol } = await session.opened;
+assert.match(protocol, /DTLS/i);
+
+// Send data from Node to OpenSSL server.
+session.send('hello from node');
+
+// Send data from OpenSSL server to Node client via s_server stdin.
+// s_server forwards its stdin to the connected client.
+server.stdin.write(reply + '\n');
+
+// Wait for Node client to receive the message.
+const data = await new Promise((resolve) => {
+  session.onmessage = mustCall(resolve);
+});
+assert.strictEqual(data.toString().trim(), reply);
+
+// Clean up.
+await session.close();
+await session.endpoint.close();
+clearTimeout(timeout);
+server.kill();
+
+// Wait for server to exit.
+const [, signal] = await new Promise((resolve) => {
+  server.on('exit', mustCall((...args) => resolve(args)));
+});
+assert.strictEqual(signal, 'SIGTERM');
diff --git a/test/sequential/test-error-serdes.js b/test/sequential/test-error-serdes.js
index acd08903efab..75a37b376ca1 100644
--- a/test/sequential/test-error-serdes.js
+++ b/test/sequential/test-error-serdes.js
@@ -39,6 +39,10 @@ assert.strictEqual(cycle(new ReferenceError('foo')).name, 'ReferenceError');
 assert.strictEqual(cycle(new URIError('foo')).name, 'URIError');
 assert.strictEqual(cycle(new EvalError('foo')).name, 'EvalError');
 assert.strictEqual(cycle(new SyntaxError('foo')).name, 'SyntaxError');
+const aggregate = cycle(new AggregateError([new Error('inner')], 'aggregate'));
+assert(aggregate instanceof AggregateError);
+assert.strictEqual(aggregate.message, 'aggregate');
+assert.strictEqual(aggregate.errors[0].message, 'inner');
 
 class SubError extends Error {}
 
diff --git a/test/sequential/test-watch-mode-restart-esm-loading-error.mjs b/test/sequential/test-watch-mode-restart-esm-loading-error.mjs
index 1d1b954588c5..73299a73bfc4 100644
--- a/test/sequential/test-watch-mode-restart-esm-loading-error.mjs
+++ b/test/sequential/test-watch-mode-restart-esm-loading-error.mjs
@@ -74,7 +74,7 @@ function runInBackground({ args = [], options = {}, completed = 'Completed runni
       future.resolve();
       return { stdout, stderr };
     },
-    restart(timeout = 1000) {
+    restart(timeout = common.platformTimeout(10_000)) {
       if (!child) {
         run();
       }
@@ -113,7 +113,7 @@ try {
 
   // Update file with syntax error
   const syntaxErrorContent = `console.log('hello, wor`;
-  const failedRestart = restart(common.platformTimeout(10_000));
+  const failedRestart = restart();
   writeFileSync(file, syntaxErrorContent);
   await sleep(common.platformTimeout(1000));
   // Wait for the failed restart
@@ -125,7 +125,7 @@ try {
     `Failed running ${inspect(file)}. Waiting for file changes before restarting...`,
   ]);
 
-  const successfulRestart = restart(common.platformTimeout(10_000));
+  const successfulRestart = restart();
   writeFileSync(file, `console.log('hello again, world');`);
   await sleep(common.platformTimeout(1000));
   const { stderr: stderr3, stdout: stdout3 } = await successfulRestart;
diff --git a/test/test-runner/test-run-watch-emit-restarted.mjs b/test/test-runner/test-run-watch-emit-restarted.mjs
index 200231c69043..fd596bd818ca 100644
--- a/test/test-runner/test-run-watch-emit-restarted.mjs
+++ b/test/test-runner/test-run-watch-emit-restarted.mjs
@@ -1,5 +1,5 @@
 // Test run({ watch: true }) emits test:watch:restarted when file is updated
-import * as common from '../common/index.mjs';
+import '../common/index.mjs';
 import { run } from 'node:test';
 import assert from 'node:assert';
 import { writeFileSync } from 'node:fs';
@@ -11,9 +11,8 @@ import { refreshForTestRunnerWatch, skipIfNoWatch, fixtureContent } from '../com
 skipIfNoWatch();
 refreshForTestRunnerWatch();
 
-let alreadyDrained = false;
 const events = [];
-const testWatchRestarted = common.mustCall(1);
+let written = false;
 
 const controller = new AbortController();
 const stream = run({
@@ -21,27 +20,24 @@ const stream = run({
   watch: true,
   signal: controller.signal,
 }).on('data', function({ type }) {
-  events.push(type);
-  if (type === 'test:watch:restarted') {
-    testWatchRestarted();
+  if (type !== 'test:watch:restarted' && type !== 'test:watch:drained') {
+    return;
   }
-  if (type === 'test:watch:drained') {
-    if (alreadyDrained) {
-      controller.abort();
-    }
-    alreadyDrained = true;
+  events.push(type);
+  // Watchers with latency (FSEvents) can still report the fixture setup after
+  // the first run has started, so only a restart after the write below counts.
+  if (written && type === 'test:watch:drained' && events.at(-2) === 'test:watch:restarted') {
+    controller.abort();
   }
 });
 
 await once(stream, 'test:watch:drained');
 
+events.length = 0;
+written = true;
 writeFileSync(join(tmpdir.path, 'test.js'), fixtureContent['test.js']);
 
 // eslint-disable-next-line no-unused-vars
 for await (const _ of stream);
 
-assert.partialDeepStrictEqual(events, [
-  'test:watch:drained',
-  'test:watch:restarted',
-  'test:watch:drained',
-]);
+assert.deepStrictEqual(events.slice(-2), ['test:watch:restarted', 'test:watch:drained']);
diff --git a/test/test-runner/test-runner.status b/test/test-runner/test-runner.status
index e8b4ff2d3224..7d2d59d3540c 100644
--- a/test/test-runner/test-runner.status
+++ b/test/test-runner/test-runner.status
@@ -9,3 +9,8 @@ prefix test-runner
 # https://github.com/nodejs/node/pull/54888#issuecomment-2351128116
 # TODO(pmarchini): This test is failing when isolation is set to none and must be fixed.
 test-watch-create-isolation-none: SKIP
+
+[$system==macos && $arch==x64]
+# https://github.com/nodejs/node/issues/54534#issuecomment-5423551021
+test-run-watch-cwd-isolation-none: PASS, FLAKY
+test-run-watch-cwd-isolation-none-argv: PASS, FLAKY
diff --git a/test/wasi/c/poll.c b/test/wasi/c/poll.c
index ba12f442654b..f65cf2c7056f 100644
--- a/test/wasi/c/poll.c
+++ b/test/wasi/c/poll.c
@@ -1,13 +1,24 @@
 #include <assert.h>
 #include <poll.h>
+#include <stdint.h>
 #include <time.h>
 #include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
 
+#define NANOS_PER_SECOND 1000000000LL
+// Timer granularity can make a timeout expire slightly early.
+#define TIMEOUT_TOLERANCE_NS 100000000LL
+
+static int64_t elapsed_nanoseconds(const struct timespec* before,
+                                   const struct timespec* after) {
+  return (after->tv_sec - before->tv_sec) * NANOS_PER_SECOND +
+         after->tv_nsec - before->tv_nsec;
+}
+
 int main(void) {
   struct pollfd fds[4];
-  time_t before, now;
+  struct timespec before, now;
   int ret;
   char* platform;
   int is_aix_or_os400;
@@ -18,18 +29,20 @@ int main(void) {
   is_win = platform != NULL && 0 == strcmp(platform, "win32");
 
   // Test sleep() behavior.
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   sleep(1);
-  time(&now);
-  assert(now - before >= 1);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   // Test poll() timeout behavior.
   fds[0] = (struct pollfd){.fd = -1, .events = 0, .revents = 0};
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   ret = poll(fds, 1, 2000);
-  time(&now);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
   assert(ret == 0);
-  assert(now - before >= 2);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         2 * NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   // V8 has a bug that allows unsupported parts of this test to run,
   // causing the test to fail. poll_win.c is a workaround.
diff --git a/test/wasi/c/poll_win.c b/test/wasi/c/poll_win.c
index 9a22082f0eeb..e8e41ffd6a7e 100644
--- a/test/wasi/c/poll_win.c
+++ b/test/wasi/c/poll_win.c
@@ -1,26 +1,39 @@
 #include <assert.h>
 #include <poll.h>
+#include <stdint.h>
 #include <time.h>
 #include <unistd.h>
 
+#define NANOS_PER_SECOND 1000000000LL
+// Timer granularity can make a timeout expire slightly early.
+#define TIMEOUT_TOLERANCE_NS 100000000LL
+
+static int64_t elapsed_nanoseconds(const struct timespec* before,
+                                   const struct timespec* after) {
+  return (after->tv_sec - before->tv_sec) * NANOS_PER_SECOND +
+         after->tv_nsec - before->tv_nsec;
+}
+
 int main(void) {
   struct pollfd fds[4];
-  time_t before, now;
+  struct timespec before, now;
   int ret;
 
   // Test sleep() behavior.
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   sleep(1);
-  time(&now);
-  assert(now - before >= 1);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   // Test poll() timeout behavior.
   fds[0] = (struct pollfd){.fd = -1, .events = 0, .revents = 0};
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   ret = poll(fds, 1, 2000);
-  time(&now);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
   assert(ret == 0);
-  assert(now - before >= 2);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         2 * NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   return 0;
 }
diff --git a/test/wasi/wasi.status b/test/wasi/wasi.status
index d88bd60ae4dc..a26617e01367 100644
--- a/test/wasi/wasi.status
+++ b/test/wasi/wasi.status
@@ -15,6 +15,3 @@ test-wasi-getrusage: SKIP
 # Unsupported on Windows and Android
 test-wasi-readdir: SKIP
 
-[$system==linux]
-# https://github.com/nodejs/node/issues/59146
-test-wasi-pthread: PASS, FLAKY
diff --git a/test/wasi/wasm/poll.wasm b/test/wasi/wasm/poll.wasm
index 07e09ddd39ab..d1863d1351bf 100755
Binary files a/test/wasi/wasm/poll.wasm and b/test/wasi/wasm/poll.wasm differ
diff --git a/test/wasi/wasm/poll_win.wasm b/test/wasi/wasm/poll_win.wasm
index f1f06db75469..f26d0c8a0a6e 100644
Binary files a/test/wasi/wasm/poll_win.wasm and b/test/wasi/wasm/poll_win.wasm differ
diff --git a/test/wpt/README.md b/test/wpt/README.md
index aba1b8617f90..ac96e3b247ba 100644
--- a/test/wpt/README.md
+++ b/test/wpt/README.md
@@ -12,6 +12,50 @@ declares build requirements, expected failures, and tests to skip.
 See [`test/fixtures/wpt/README.md`][] for the pinned WPT commit
 hashes for each module.
 
+## Running tests
+
+Run a WPT module through the Python test runner:
+
+```bash
+tools/test.py wpt/test-url
+```
+
+Pass a source file to its module runner to run all globals and variants
+generated from that file:
+
+```bash
+node test/wpt/test-url.js url-searchparams.any.js
+```
+
+Pass a generated path, as printed in the test output, to run only that test:
+
+```bash
+node test/wpt/test-url.js 'url/url-searchparams.any.html'
+```
+
+### Execution backends
+
+By default, each test runs in a worker thread. Set `WPT_BACKEND=process` to run
+tests in child processes instead:
+
+```bash
+WPT_BACKEND=process tools/test.py wpt
+```
+
+### Debugging a test
+
+Set `WPT_INSPECT=1` to run one generated main-thread test in a child process
+with `--inspect-brk` on an available port:
+
+```bash
+WPT_INSPECT=1 out/Release/node test/wpt/test-compression.js \
+  'compression/compression-bad-chunks.any.html'
+```
+
+Connect an inspector client to the URL printed on stderr. A source file that
+generates multiple tests is rejected with the exact paths to choose from.
+Worker tests are not supported by inspect mode.
+
 <a id="add-tests"></a>
 
 ## How to add tests for a new module
@@ -53,8 +97,8 @@ runner.runJsTests();
 ```
 
 The runner loads the tests from `test/fixtures/wpt/url`, applies the
-status rules from `test/wpt/status/url.cjs`, and runs them using
-worker threads.
+status rules from `test/wpt/status/url.cjs`, and runs them using the
+selected backend.
 
 #### `new WPTRunner(path[, options])`
 
@@ -64,15 +108,18 @@ worker threads.
   * `concurrency` {number} Number of tests to run in parallel.
     Defaults to `os.availableParallelism() - 1`. Set to `1` for tests
     that require sequential execution (e.g. web-locks, webstorage).
+  * `backend` {string} Test execution backend. Must be either `'thread'` or
+    `'process'`. Defaults to `'thread'`. `WPT_BACKEND` overrides this option.
+    `WPT_INSPECT` always uses `'process'`.
 
 #### `runner.setFlags(flags)`
 
-* `flags` {string\[]} Node.js CLI flags passed to each worker thread
+* `flags` {string\[]} Node.js CLI flags passed to each test process or worker
   (e.g. `['--expose-internals']`).
 
 #### `runner.setInitScript(script)`
 
-* `script` {string} JavaScript code executed in the worker before
+* `script` {string} JavaScript code executed before
   the tests run. Useful for setting up globals needed by the tests.
 
 #### `runner.setScriptModifier(modifier)`
@@ -94,19 +141,7 @@ Starts running the tests. Must be called last, after all configuration.
 
 ### 4. Run the tests
 
-Run the test using `tools/test.py` and see if there are any failures.
-For example, to run all the URL tests under `test/fixtures/wpt/url`:
-
-```bash
-tools/test.py wpt/test-url
-```
-
-To run a specific test in WPT, for example, `url/url-searchparams.any.js`,
-pass the file name as argument to the corresponding test runner:
-
-```bash
-node test/wpt/test-url.js url-searchparams.any.js
-```
+Run the module as described in [Running tests](#running-tests).
 
 If there are any failures, update the corresponding status file
 (in this case, `test/wpt/status/url.cjs`) to make the test pass.
@@ -201,6 +236,10 @@ that has not been ported to the Node.js runner. Use `fail` instead when
 the test can run but produces incorrect results due to an implementation
 bug or missing feature.
 
+For a multi-global `.any.js` test, a source file key applies to every generated
+test. Use a generated URL key such as `something.any.worker.html` to apply a
+rule only to the dedicated worker test.
+
 ### Skipping individual subtests
 
 To skip specific subtests within a file (rather than skipping the entire file),
diff --git a/test/wpt/status/FileAPI/blob.cjs b/test/wpt/status/FileAPI/blob.cjs
index bf40df1b8425..6f8599dc8b4e 100644
--- a/test/wpt/status/FileAPI/blob.cjs
+++ b/test/wpt/status/FileAPI/blob.cjs
@@ -33,7 +33,4 @@ module.exports = {
       ],
     },
   },
-  'Blob-in-worker.worker.js': {
-    skip: 'Depends on Web Workers API',
-  },
 };
diff --git a/test/wpt/status/dom/events.json b/test/wpt/status/dom/events.json
index 8109e2372adf..f621431c9fc2 100644
--- a/test/wpt/status/dom/events.json
+++ b/test/wpt/status/dom/events.json
@@ -21,9 +21,6 @@
   "event-global-set-before-handleEvent-lookup.window.js": {
     "skip": "window is not defined"
   },
-  "event-global.worker.js": {
-    "skip": "importScripts is not defined"
-  },
   "legacy-pre-activation-behavior.window.js": {
     "skip": "document is not defined"
   },
diff --git a/test/wpt/status/hr-time.cjs b/test/wpt/status/hr-time.cjs
index c426eeeb8e92..35b82c87a1ea 100644
--- a/test/wpt/status/hr-time.cjs
+++ b/test/wpt/status/hr-time.cjs
@@ -19,7 +19,7 @@ module.exports = {
     },
   } : {}),
 
-  'idlharness.any.js': {
+  'idlharness.any.html': {
     fail: {
       expected: [
         'Window interface: attribute performance',
diff --git a/test/wpt/status/resource-timing.json b/test/wpt/status/resource-timing.json
index 74de815387ed..0299d6652047 100644
--- a/test/wpt/status/resource-timing.json
+++ b/test/wpt/status/resource-timing.json
@@ -23,25 +23,15 @@
   "idlharness.any.js": {
     "fail": {
       "expected": [
-        "PerformanceResourceTiming interface: attribute firstInterimResponseStart",
-        "PerformanceResourceTiming interface: attribute finalResponseHeadersStart",
-        "PerformanceResourceTiming interface: resource must inherit property \"finalResponseHeadersStart\" with the proper type",
-        "PerformanceResourceTiming interface: attribute renderBlockingStatus",
-        "PerformanceResourceTiming interface: attribute contentType",
-        "PerformanceResourceTiming interface: resource must inherit property \"firstInterimResponseStart\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"renderBlockingStatus\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentType\" with the proper type",
         "PerformanceResourceTiming interface: default toJSON operation on resource",
         "PerformanceResourceTiming interface: attribute workerRouterEvaluationStart",
         "PerformanceResourceTiming interface: attribute workerCacheLookupStart",
         "PerformanceResourceTiming interface: attribute workerMatchedRouterSource",
         "PerformanceResourceTiming interface: attribute workerFinalRouterSource",
-        "PerformanceResourceTiming interface: attribute contentEncoding",
         "PerformanceResourceTiming interface: resource must inherit property \"workerRouterEvaluationStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerCacheLookupStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerMatchedRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentEncoding\" with the proper type"
+        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type"
       ]
     }
   }
diff --git a/test/wpt/status/streams.json b/test/wpt/status/streams.json
index 968b33597651..5be444999b00 100644
--- a/test/wpt/status/streams.json
+++ b/test/wpt/status/streams.json
@@ -8,7 +8,14 @@
   "readable-streams/cross-realm-crash.window.js": {
     "skip": "Browser-specific test"
   },
-  "readable-streams/owning-type-message-port.any.js": {
+  "readable-streams/from.any.js": {
+    "fail": {
+      "expected": [
+        "ReadableStream.from throws on invalid iterables; specifically a string"
+      ]
+    }
+  },
+  "readable-streams/owning-type-message-port.tentative.any.js": {
     "fail": {
       "note": "Readable streams with type owning are not yet supported",
       "expected": [
@@ -17,10 +24,10 @@
       ]
     }
   },
-  "readable-streams/owning-type-video-frame.any.js": {
+  "readable-streams/owning-type-video-frame.tentative.any.js": {
     "skip": "Browser-specific test"
   },
-  "readable-streams/owning-type.any.js": {
+  "readable-streams/owning-type.tentative.any.js": {
     "fail": {
       "note": "Readable streams with type owning are not yet supported",
       "expected": [
diff --git a/test/wpt/status/url.cjs b/test/wpt/status/url.cjs
index d7cd8a8666b2..1ee0ce90071b 100644
--- a/test/wpt/status/url.cjs
+++ b/test/wpt/status/url.cjs
@@ -1,7 +1,7 @@
 'use strict';
 
 module.exports = {
-  'historical.any.js': {
+  'historical.any.html': {
     'fail': {
       'expected': [
         'searchParams on location object',
diff --git a/test/wpt/status/webidl.json b/test/wpt/status/webidl.json
index 26a6e44f4841..8dcbe1b247c8 100644
--- a/test/wpt/status/webidl.json
+++ b/test/wpt/status/webidl.json
@@ -6,6 +6,18 @@
       ]
     }
   },
+  "ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js": {
+    "fail": {
+      "note": "needs a V8 update, see https://github.com/nodejs/node/issues/63579",
+      "expected": [
+        "DOMException instance does not have an own stack property",
+        "Error.prototype.stack is an accessor property with correct attributes",
+        "Error.prototype.stack getter works on DOMException instances",
+        "Error.prototype.stack setter installs own data property on DOMException instances",
+        "Error.prototype.stack setter ignores Error.prototype itself"
+      ]
+    }
+  },
   "ecmascript-binding/global-immutable-prototype.any.js": {
     "fail": {
       "expected": [
@@ -27,11 +39,24 @@
         "Global object's setter throws when called on incompatible object",
         "Global object's operation throws when called on incompatible object",
         "Global object's getter works when called on null / undefined",
-        "Global object's setter works when called on null / undefined",
+        "Global object's setter works when called on null / undefined"
+      ]
+    }
+  },
+  "ecmascript-binding/global-object-implicit-this-value.any.html": {
+    "fail": {
+      "expected": [
         "ReferenceError: addEventListener is not defined"
       ]
     }
   },
+  "ecmascript-binding/global-object-implicit-this-value.any.worker.html": {
+    "fail": {
+      "expected": [
+        "Global object's operation works when called on null / undefined"
+      ]
+    }
+  },
   "ecmascript-binding/legacy-factor-function-subclass.window.js": {
     "fail": {
       "expected": [
@@ -46,7 +71,7 @@
       ]
     }
   },
-  "ecmascript-binding/no-regexp-special-casing.any.js": {
+  "ecmascript-binding/no-regexp-special-casing.any.html": {
     "fail": {
       "expected": [
         "Can be used as an object implementing a callback interface"
diff --git a/test/wpt/status/workers.json b/test/wpt/status/workers.json
new file mode 100644
index 000000000000..015ac98d0084
--- /dev/null
+++ b/test/wpt/status/workers.json
@@ -0,0 +1,170 @@
+{
+  "SharedWorker-MessageEvent-source.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "SharedWorker-replace-EventHandler.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "Worker-location.sub.any.js": {
+    "skip": "Server substitution (.sub) is not supported"
+  },
+  "WorkerLocation-origin.sub.window.js": {
+    "skip": "Needs a document and a WPT server"
+  },
+  "constructors/Worker/AbstractWorker.onerror.js": {
+    "skip": "Not a test file; used as a worker script by .html tests"
+  },
+  "constructors/Worker/expected-self-properties.worker.js": {
+    "fail": {
+      "note": "XMLHttpRequest and EventSource are not implemented",
+      "expected": [
+        "existence of XMLHttpRequest",
+        "existence of EventSource"
+      ]
+    }
+  },
+  "dedicated-worker-from-blob-url.window.js": {
+    "note": "crypto.randomUUID() is used to generate blob URL identifiers",
+    "requires": ["crypto"]
+  },
+  "dedicated-worker-in-data-url-context.window.js": {
+    "skip": "Needs a document to create iframes"
+  },
+  "examples/onconnect.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "importscripts_mime.any.js": {
+    "skip": "Needs a WPT server to serve scripts with arbitrary MIME types"
+  },
+  "importscripts_mime_local.any.js": {
+    "note": "crypto.randomUUID() is used to generate blob URL identifiers",
+    "requires": ["crypto"]
+  },
+  "interfaces/WorkerUtils/importScripts/catch.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/blob-url.worker.js": {
+    "note": "crypto.randomUUID() is used to generate blob URL identifiers",
+    "requires": ["crypto"]
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.js": {
+    "skip": "Needs a WPT server; tests cross-origin importScripts()"
+  },
+  "modules/dedicated-worker-import-blob-url.any.js": {
+    "skip": "Modules are imported from http(s): URLs served by a WPT server"
+  },
+  "modules/dedicated-worker-import-data-url.any.js": {
+    "skip": "Modules are imported from http(s): URLs served by a WPT server"
+  },
+  "modules/dedicated-worker-import.any.js": {
+    "fail": {
+      "note": "Needs a WPT server; tests cross-origin and redirected imports",
+      "expected": [
+        "Static import (cross-origin).",
+        "Static import (redirect)."
+      ]
+    }
+  },
+  "modules/shared-worker-import-blob-url.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "modules/shared-worker-import-data-url.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "modules/shared-worker-import.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "nested_worker_sync_xhr.worker.js": {
+    "skip": "XMLHttpRequest is not implemented"
+  },
+  "same-site-cookies/first-party.all.tentative.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/first-party.default.tentative.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/first-party.none.tentative.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/third-party.all.tentative.sub.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/third-party.default.tentative.sub.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "same-site-cookies/third-party.none.tentative.sub.https.window.js": {
+    "skip": "Needs a document and an https WPT server"
+  },
+  "semantics/interface-objects/001.worker.js": {
+    "fail": {
+      "note": "Canvas, XHR, EventSource, PromiseRejectionEvent, ProgressEvent, the File API reader classes and IndexedDB are not implemented",
+      "expected": [
+        "The ImageData interface object should be exposed.",
+        "The ImageBitmap interface object should be exposed.",
+        "The CanvasGradient interface object should be exposed.",
+        "The CanvasPattern interface object should be exposed.",
+        "The TextMetrics interface object should be exposed.",
+        "The Path2D interface object should be exposed.",
+        "The PromiseRejectionEvent interface object should be exposed.",
+        "The EventSource interface object should be exposed.",
+        "The XMLHttpRequestEventTarget interface object should be exposed.",
+        "The XMLHttpRequestUpload interface object should be exposed.",
+        "The XMLHttpRequest interface object should be exposed.",
+        "The ProgressEvent interface object should be exposed.",
+        "The FileList interface object should be exposed.",
+        "The FileReader interface object should be exposed.",
+        "The FileReaderSync interface object should be exposed.",
+        "The IDBRequest interface object should be exposed.",
+        "The IDBOpenDBRequest interface object should be exposed.",
+        "The IDBVersionChangeEvent interface object should be exposed.",
+        "The IDBFactory interface object should be exposed.",
+        "The IDBDatabase interface object should be exposed.",
+        "The IDBObjectStore interface object should be exposed.",
+        "The IDBIndex interface object should be exposed.",
+        "The IDBKeyRange interface object should be exposed.",
+        "The IDBCursor interface object should be exposed.",
+        "The IDBCursorWithValue interface object should be exposed.",
+        "The IDBTransaction interface object should be exposed."
+      ]
+    }
+  },
+  "semantics/interface-objects/003.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "semantics/interface-objects/004.any.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "shared-worker-from-blob-url.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "shared-worker-in-data-url-context.window.js": {
+    "skip": "SharedWorker is not implemented"
+  },
+  "worker-performance.worker.js": {
+    "fail": {
+      "note": "XMLHttpRequest is not implemented",
+      "expected": [
+        "Resource timing seems to work in workers",
+        "performance.setResourceTimingBufferSize in workers"
+      ]
+    }
+  },
+  "WorkerGlobalScope_requestAnimationFrame.worker.js": {
+    "skip": "requestAnimationFrame is not implemented in workers"
+  }
+}
diff --git a/test/wpt/test-compression.js b/test/wpt/test-compression.js
index 23800734922a..404cb23687ca 100644
--- a/test/wpt/test-compression.js
+++ b/test/wpt/test-compression.js
@@ -2,7 +2,8 @@
 
 const { WPTRunner } = require('../common/wpt');
 
-const runner = new WPTRunner('compression');
+// Runs each spec in its own process; this suite has crashed the runner in CI.
+const runner = new WPTRunner('compression', { backend: 'process' });
 
 runner.pretendGlobalThisAs('Window');
 
diff --git a/test/wpt/test-hr-time.js b/test/wpt/test-hr-time.js
index 9e7303d3e20c..13b35e3ac139 100644
--- a/test/wpt/test-hr-time.js
+++ b/test/wpt/test-hr-time.js
@@ -5,7 +5,9 @@ const { WPTRunner } = require('../common/wpt');
 const runner = new WPTRunner('hr-time');
 
 runner.setInitScript(`
-  self.GLOBAL.isWorker = () => false;
+  if (!globalThis.DedicatedWorkerGlobalScope) {
+    self.GLOBAL.isWorker = () => false;
+  }
 `);
 runner.pretendGlobalThisAs('Window');
 
diff --git a/test/wpt/test-streams.js b/test/wpt/test-streams.js
index 71c25fbd56b2..e9d23348db07 100644
--- a/test/wpt/test-streams.js
+++ b/test/wpt/test-streams.js
@@ -2,7 +2,8 @@
 
 const { WPTRunner } = require('../common/wpt');
 
-const runner = new WPTRunner('streams');
+// Runs each spec in its own process; this suite has crashed the runner in CI.
+const runner = new WPTRunner('streams', { backend: 'process' });
 
 // Set a script that will be executed in the worker before running the tests.
 runner.pretendGlobalThisAs('Window');
diff --git a/test/wpt/test-wasm-jsapi.mjs b/test/wpt/test-wasm-jsapi.mjs
index 4e53da5bdd88..67050e67cf7b 100644
--- a/test/wpt/test-wasm-jsapi.mjs
+++ b/test/wpt/test-wasm-jsapi.mjs
@@ -15,7 +15,8 @@ try {
 }
 
 if (supportsSimd) {
-  const runner = new WPTRunner('wasm/jsapi');
+  // Runs each spec in its own process; this suite has crashed the runner in CI.
+  const runner = new WPTRunner('wasm/jsapi', { backend: 'process' });
   runner.setFlags(['--experimental-wasm-modules']);
 
   runner.runJsTests();
diff --git a/test/wpt/test-webcrypto.js b/test/wpt/test-webcrypto.js
index 409b94451ba1..a435d429af9f 100644
--- a/test/wpt/test-webcrypto.js
+++ b/test/wpt/test-webcrypto.js
@@ -6,7 +6,8 @@ if (!common.hasCrypto)
 
 const { WPTRunner } = require('../common/wpt');
 
-const runner = new WPTRunner('WebCryptoAPI');
+// Runs each spec in its own process; this suite has crashed the runner in CI.
+const runner = new WPTRunner('WebCryptoAPI', { backend: 'process' });
 
 // Experimental warnings drown out the actual test output.
 runner.setFlags(['--disable-warning=ExperimentalWarning']);
diff --git a/test/wpt/test-workers.js b/test/wpt/test-workers.js
new file mode 100644
index 000000000000..21ec86057b6e
--- /dev/null
+++ b/test/wpt/test-workers.js
@@ -0,0 +1,9 @@
+'use strict';
+
+require('../common');
+const { WPTRunner } = require('../common/wpt');
+
+const runner = new WPTRunner('workers');
+
+runner.pretendGlobalThisAs('Window');
+runner.runJsTests();
diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index 9fb74ed9cad8..e260773d14a5 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -7,6 +7,7 @@ DEFAULT_BRANCH=main
 
 COMMIT_QUEUE_LABEL="commit-queue"
 COMMIT_QUEUE_FAILED_LABEL="commit-queue-failed"
+LACKS_SECOND_APPROVAL_LABEL="lacks-second-approval"
 
 cqurl="${GITHUB_SERVER_URL:?}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID:?}"
 
@@ -24,11 +25,43 @@ escape_code_block_or_line() {
   printf '%s%s%s%s%s\n' "$fence" "$sep" "$1" "$sep" "$fence"
 }
 
+edit_pr_labels() {
+  pr=$1
+  failure_mode=$2
+  shift 2
+  if gh -R "$GITHUB_REPOSITORY" pr edit "$pr" "$@"; then
+    return
+  fi
+  if [ "$failure_mode" = warn ]; then
+    echo "::warning::Failed to update labels for PR $pr"
+    return
+  fi
+  return 1
+}
+
+remove_labels_if_present() {
+  pr=$1
+  shift
+  labels=
+  for label in "$@"; do
+    if jq -e --arg label "$label" \
+        'map(.name) | index($label)' < labels.json > /dev/null; then
+      labels="${labels}${labels:+,}${label}"
+    fi
+  done
+
+  if [ -n "$labels" ]; then
+    edit_pr_labels "$pr" warn --remove-label "$labels"
+  fi
+}
+
 commit_queue_failed() {
   pr=$1
   reported_failure=${2:-}
 
-  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
+  edit_pr_labels "$pr" required --add-label "$COMMIT_QUEUE_FAILED_LABEL" \
+    --remove-label "$COMMIT_QUEUE_LABEL"
+  remove_labels_if_present "$pr" "$LACKS_SECOND_APPROVAL_LABEL"
 
   last_output_line=$(awk 'NF { line = $0 } END { sub(/^[[:space:]]*/, "", line); print line }' output)
   # shellcheck disable=SC2016
@@ -145,8 +178,9 @@ for pr in "$@"; do
 
   [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh -R "$GITHUB_REPOSITORY" pr close "$pr"
 
-  # Delete the commit queue label (but ignore errors, it's no big deal if a closed PR still has the label)
-  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
+  # Delete the commit queue labels (but ignore errors, it's no big deal if a closed PR still has them)
+  remove_labels_if_present "$pr" "$COMMIT_QUEUE_LABEL" \
+    "$LACKS_SECOND_APPROVAL_LABEL"
 done
 
 rm -f labels.json
diff --git a/tools/eslint-rules/no-crypto-class-instanceof.js b/tools/eslint-rules/no-crypto-class-instanceof.js
new file mode 100644
index 000000000000..e54bfc0299cc
--- /dev/null
+++ b/tools/eslint-rules/no-crypto-class-instanceof.js
@@ -0,0 +1,179 @@
+/**
+ * @file Prevent internal code from brand-checking crypto classes with
+ *   instanceof.
+ */
+'use strict';
+
+const { isRequireCall, isString } = require('./rules-utils.js');
+
+const moduleClasses = new Map([
+  ['internal/crypto/keys', new Set([
+    'KeyObject',
+    'SecretKeyObject',
+    'AsymmetricKeyObject',
+    'PublicKeyObject',
+    'PrivateKeyObject',
+    'CryptoKey',
+    'InternalCryptoKey',
+  ])],
+  ['internal/crypto/webcrypto', new Set(['CryptoKey'])],
+  ['internal/crypto/x509', new Set([
+    'X509Certificate',
+    'InternalX509Certificate',
+  ])],
+]);
+
+const knownClassNames = new Set();
+for (const classes of moduleClasses.values()) {
+  for (const name of classes) knownClassNames.add(name);
+}
+
+function getRequiredModule(node) {
+  if (node?.type !== 'CallExpression' ||
+      !isRequireCall(node) ||
+      !isString(node.arguments[0])) {
+    return undefined;
+  }
+  return node.arguments[0].value;
+}
+
+function getPropertyName(node) {
+  if (!node) return undefined;
+  if (node.computed) {
+    return node.property.type === 'Literal' ? node.property.value : undefined;
+  }
+  return node.property.name;
+}
+
+module.exports = {
+  meta: {
+    messages: {
+      noCryptoClassInstanceof:
+        'Do not use `instanceof` to brand-check {{name}}; use its native or private brand.',
+      noCryptoKeyInstanceof:
+        'Use `isCryptoKey(value)` instead of `value instanceof CryptoKey`.',
+      noKeyObjectInstanceof:
+        'Use `isKeyObject(value)` instead of `value instanceof KeyObject`.',
+      noX509CertificateInstanceof:
+        'Use `isX509Certificate(value)` instead of `value instanceof X509Certificate`.',
+    },
+    schema: [],
+  },
+
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const constructorNames = new Map();
+    const namespaceClasses = new Map();
+
+    function registerVariable(node, name, map, value) {
+      const variables = sourceCode.scopeManager.getDeclaredVariables(node);
+      for (const variable of variables) {
+        if (variable.name === name) map.set(variable, value);
+      }
+    }
+
+    function resolveVariable(node) {
+      let scope = sourceCode.getScope(node);
+      while (scope !== null) {
+        const variable = scope.set.get(node.name);
+        if (variable !== undefined) return variable;
+        scope = scope.upper;
+      }
+      return undefined;
+    }
+
+    function isGlobalReference(node) {
+      const variable = resolveVariable(node);
+      return variable === undefined || variable.defs.length === 0;
+    }
+
+    function registerRequire(node) {
+      const module = getRequiredModule(node.init);
+      const classes = moduleClasses.get(module);
+      if (classes === undefined) return;
+
+      if (node.id.type === 'Identifier') {
+        registerVariable(node, node.id.name, namespaceClasses, classes);
+        return;
+      }
+
+      if (node.id.type !== 'ObjectPattern') return;
+      for (const property of node.id.properties) {
+        if (property.type !== 'Property' ||
+            property.value.type !== 'Identifier') {
+          continue;
+        }
+        const importedName = property.key.name ?? property.key.value;
+        if (classes.has(importedName)) {
+          registerVariable(
+            node, property.value.name, constructorNames, importedName);
+        }
+      }
+    }
+
+    function declarationName(variable) {
+      if (!knownClassNames.has(variable.name)) return undefined;
+      for (const definition of variable.defs) {
+        if (definition.type === 'ClassName' ||
+            definition.type === 'FunctionName') {
+          return variable.name;
+        }
+      }
+      return undefined;
+    }
+
+    function constructorName(node) {
+      if (node.type === 'Identifier') {
+        const variable = resolveVariable(node);
+        if (variable !== undefined) {
+          const name = constructorNames.get(variable) ??
+            declarationName(variable);
+          if (name !== undefined) return name;
+        }
+        if (node.name === 'CryptoKey' && isGlobalReference(node)) {
+          return 'CryptoKey';
+        }
+        return undefined;
+      }
+      if (node.type !== 'MemberExpression') return undefined;
+
+      const property = getPropertyName(node);
+      if (node.object.type !== 'Identifier') return undefined;
+      if (node.object.name === 'globalThis' &&
+          property === 'CryptoKey' &&
+          isGlobalReference(node.object)) {
+        return 'CryptoKey';
+      }
+
+      const variable = resolveVariable(node.object);
+      const classes = namespaceClasses.get(variable);
+      return classes?.has(property) ? property : undefined;
+    }
+
+    return {
+      VariableDeclarator: registerRequire,
+
+      BinaryExpression(node) {
+        if (node.operator !== 'instanceof') return;
+
+        const name = constructorName(node.right);
+        if (name === undefined) return;
+
+        let messageId = 'noCryptoClassInstanceof';
+        if (name === 'CryptoKey' || name === 'InternalCryptoKey') {
+          messageId = 'noCryptoKeyInstanceof';
+        } else if (name.endsWith('KeyObject')) {
+          messageId = 'noKeyObjectInstanceof';
+        } else if (name.endsWith('X509Certificate')) {
+          messageId = 'noX509CertificateInstanceof';
+        }
+
+        context.report({
+          node,
+          messageId,
+          data: { name },
+        });
+      },
+    };
+  },
+};
diff --git a/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js b/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js
deleted file mode 100644
index 19e13437247a..000000000000
--- a/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * @file Prevent internal code from brand-checking keys with instanceof.
- */
-'use strict';
-
-const { isRequireCall, isString } = require('./rules-utils.js');
-
-const CRYPTO_KEYS_MODULE = 'internal/crypto/keys';
-const WEBCRYPTO_MODULE = 'internal/crypto/webcrypto';
-
-const keyObjectClassNames = new Set([
-  'KeyObject',
-  'SecretKeyObject',
-  'AsymmetricKeyObject',
-  'PublicKeyObject',
-  'PrivateKeyObject',
-]);
-
-const cryptoKeyClassNames = new Set([
-  'CryptoKey',
-  'InternalCryptoKey',
-]);
-
-function isKeyModuleRequire(node) {
-  return node?.type === 'CallExpression' &&
-         isRequireCall(node) &&
-         isString(node.arguments[0]) &&
-         (node.arguments[0].value === CRYPTO_KEYS_MODULE ||
-          node.arguments[0].value === WEBCRYPTO_MODULE);
-}
-
-function getPropertyName(node) {
-  if (!node) return undefined;
-  if (node.computed) {
-    return node.property.type === 'Literal' ? node.property.value : undefined;
-  }
-  return node.property.name;
-}
-
-module.exports = {
-  meta: {
-    messages: {
-      noKeyObjectInstanceof: 'Use `isKeyObject(value)` instead of `value instanceof KeyObject`.',
-      noCryptoKeyInstanceof: 'Use `isCryptoKey(value)` instead of `value instanceof CryptoKey`.',
-    },
-    schema: [],
-  },
-
-  create(context) {
-    const namespaceNames = new Set();
-    const keyObjectConstructorNames = new Set();
-    const cryptoKeyConstructorNames = new Set(['CryptoKey']);
-
-    function registerRequire(node) {
-      if (!isKeyModuleRequire(node.init)) return;
-
-      if (node.id.type === 'Identifier') {
-        namespaceNames.add(node.id.name);
-        return;
-      }
-
-      if (node.id.type !== 'ObjectPattern') return;
-
-      for (const property of node.id.properties) {
-        if (property.type !== 'Property') continue;
-        const keyName = property.key.name ?? property.key.value;
-        if (property.value.type !== 'Identifier') continue;
-        const localName = property.value.name;
-        if (keyObjectClassNames.has(keyName)) {
-          keyObjectConstructorNames.add(localName);
-        } else if (cryptoKeyClassNames.has(keyName)) {
-          cryptoKeyConstructorNames.add(localName);
-        }
-      }
-    }
-
-    function constructorKind(node) {
-      if (node.type === 'Identifier') {
-        if (keyObjectConstructorNames.has(node.name)) return 'KeyObject';
-        if (cryptoKeyConstructorNames.has(node.name)) return 'CryptoKey';
-        return undefined;
-      }
-
-      if (node.type !== 'MemberExpression') return undefined;
-
-      const property = getPropertyName(node);
-      if (node.object.type === 'Identifier') {
-        if (namespaceNames.has(node.object.name)) {
-          if (keyObjectClassNames.has(property)) return 'KeyObject';
-          if (cryptoKeyClassNames.has(property)) return 'CryptoKey';
-        }
-        if (node.object.name === 'globalThis' &&
-            cryptoKeyClassNames.has(property)) {
-          return 'CryptoKey';
-        }
-      }
-
-      return undefined;
-    }
-
-    return {
-      VariableDeclarator: registerRequire,
-
-      BinaryExpression(node) {
-        if (node.operator !== 'instanceof') return;
-
-        const kind = constructorKind(node.right);
-        if (kind === 'KeyObject') {
-          context.report({
-            node,
-            messageId: 'noKeyObjectInstanceof',
-          });
-        } else if (kind === 'CryptoKey') {
-          context.report({
-            node,
-            messageId: 'noCryptoKeyInstanceof',
-          });
-        }
-      },
-    };
-  },
-};
diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index fc7840daff98..d9f1b6c5e682 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -15,11 +15,11 @@
         "@eslint/js": "^10.0.1",
         "@eslint/markdown": "^8.0.3",
         "@stylistic/eslint-plugin": "^5.10.0",
-        "eslint": "^10.8.0",
+        "eslint": "^10.9.1",
         "eslint-formatter-tap": "^9.0.1",
-        "eslint-plugin-jsdoc": "^63.3.1",
-        "eslint-plugin-regexp": "^3.1.1",
-        "globals": "^17.8.0"
+        "eslint-plugin-jsdoc": "^64.2.1",
+        "eslint-plugin-regexp": "^3.2.0",
+        "globals": "^17.11.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -278,19 +278,31 @@
       }
     },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.90.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.90.0.tgz",
-      "integrity": "sha512-51x9KxyTAN6guZOCd+lmcDdkhgdMdP/6iMMtg9dyhCWDc3+iSUyoB7f/9WAM/yGHmGFq25Vd6bXRR7CZcB+tog==",
+      "version": "0.95.1",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.95.1.tgz",
+      "integrity": "sha512-LO/RI08Fo9bhXwB7Od9G+1j3eSNq63+ZS5CQO8YLXHbDg6kx6S/DhTeY0+Fc9uZrjK1zZSyTx8Sg5gv5DIoCnA==",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.65.0",
-        "comment-parser": "1.4.7",
+        "@typescript-eslint/types": "^8.67.0",
+        "comment-parser": "1.4.8",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~7.3.0"
+        "jsdoc-type-pratt-parser": "~9.1.2"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
+      }
+    },
+    "node_modules/@es-joy/jsdoccomment/node_modules/jsdoc-type-pratt-parser": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.1.2.tgz",
+      "integrity": "sha512-9EXymowgk1mb9RY1VxuwKc+AhaxfBk2CV0dWxgGM+l5RURTtiUoAx7MlKwcsiVcEXK5HEPa7FeH/tsRpqjEPRg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9"
+      },
+      "engines": {
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/@es-joy/resolve.exports": {
@@ -447,27 +459,40 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -642,6 +667,15 @@
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
+    "node_modules/@types/node": {
+      "version": "26.4.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz",
+      "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -649,9 +683,9 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.65.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz",
-      "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+      "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -699,12 +733,12 @@
       }
     },
     "node_modules/are-docs-informative": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.0.2.tgz",
-      "integrity": "sha512-ixiS0nLNNG5jNQzgZJNoUpBKdo9yTYZMGJ+QgT2jmjR7G7+QHRCc4v6LQ3NgE7EBJq+o0ams3waJwkrlBom8Ig==",
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.1.1.tgz",
+      "integrity": "sha512-sqRsNQBwbKLRX0jV5Cu5uzmtflf892n4Vukz7T659ebL4pz3mpOqCMU7lxMoBTFwnp10E3YB5ZcyHM41W5bcDA==",
       "license": "MIT",
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
     "node_modules/argparse": {
@@ -723,9 +757,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.40",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
-      "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -747,9 +781,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
-      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "funding": [
         {
           "type": "opencollective",
@@ -766,11 +800,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.38",
-        "caniuse-lite": "^1.0.30001799",
-        "electron-to-chromium": "^1.5.376",
-        "node-releases": "^2.0.48",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -780,9 +814,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001800",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
-      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "funding": [
         {
           "type": "opencollective",
@@ -829,9 +863,9 @@
       }
     },
     "node_modules/comment-parser": {
-      "version": "1.4.7",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.7.tgz",
-      "integrity": "sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==",
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.8.tgz",
+      "integrity": "sha512-rKZTGo4fzKYna8UcL0isTg5wkBNla7bxTypLwZQXjIdi++IdP1OJ41rI5Mti3/jltkPujbu4i9LIARYA+zpotQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12.0.0"
@@ -916,9 +950,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.383",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.383.tgz",
-      "integrity": "sha512-I2484/KkAvl8lm9VyjH2JnbOIV0d/UCqT7gbzs6l+o6Vmn9wgB66uVcKX+Vk6HrXtY6fbWTOEXuv8waDTuFNCw==",
+      "version": "1.5.420",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
+      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
       "license": "ISC"
     },
     "node_modules/empathic": {
@@ -952,9 +986,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.8.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.0.tgz",
-      "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==",
+      "version": "10.9.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.1.tgz",
+      "integrity": "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A==",
       "license": "MIT",
       "workspaces": [
         "packages/*"
@@ -1022,17 +1056,17 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "63.3.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.3.1.tgz",
-      "integrity": "sha512-yVyTPtOY2tA8EjTwUtaM3pFxj9i/3m4/FSPMv5gMnDHSSleCpzIYQLyV8KnVmEIkkPpNhDlkDQ99mTfjxgqLxA==",
+      "version": "64.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.2.1.tgz",
+      "integrity": "sha512-6GpSYxLPcbMw38S94Cngrgs1Zv8yLinQS1O17OxJVZ6deLbrMRCERUYQKceweSqEuG2kx5Amn4l3aKPkCp4geQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/jsdoccomment": "~0.90.0",
+        "@es-joy/jsdoccomment": "~0.95.1",
         "@es-joy/resolve.exports": "1.2.0",
-        "are-docs-informative": "^0.0.2",
-        "comment-parser": "1.4.7",
+        "are-docs-informative": "^0.1.1",
+        "comment-parser": "1.4.8",
         "debug": "^4.4.3",
-        "escape-string-regexp": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
         "espree": "^11.2.0",
         "esquery": "^1.7.0",
         "html-entities": "^2.6.0",
@@ -1043,12 +1077,24 @@
         "to-valid-identifier": "^1.0.0"
       },
       "engines": {
-        "node": "^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
       },
       "peerDependencies": {
         "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
       }
     },
+    "node_modules/eslint-plugin-jsdoc/node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/eslint-plugin-jsdoc/node_modules/espree": {
       "version": "11.2.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
@@ -1067,15 +1113,15 @@
       }
     },
     "node_modules/eslint-plugin-regexp": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.1.1.tgz",
-      "integrity": "sha512-MxR5nqoQCtVWmJwia0D2+NlXX1xzdpkslsVOZLEYQ4PQWEaL65PCZXURxaBc3lPnkNFpNxzMIRmYVxdl8giXRA==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.2.0.tgz",
+      "integrity": "sha512-4yq47CnLxyfHFKJEo5kvNaiJ0aDtBxSJWk4M2LiamplUXdWxdlzDYqImb/ZVCp+2BqkQjBAmw4Xc07Q8SXVDZg==",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "comment-parser": "^1.4.0",
-        "jsdoc-type-pratt-parser": "^7.0.0",
+        "jsdoc-type-pratt-parser": "^9.0.0",
         "refa": "^0.12.1",
         "regexp-ast-analysis": "^0.7.1",
         "scslre": "^0.3.0"
@@ -1319,9 +1365,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.8.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz",
-      "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==",
+      "version": "17.11.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.11.0.tgz",
+      "integrity": "sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -1430,12 +1476,16 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.3.0.tgz",
-      "integrity": "sha512-DoyJXo7x/n48M3NsGOs9QnEws0ft0tV3YsSgvWMNxz2hZtz+Q6fpqUD96lVYX4a+jcEkzHeFNDJOn68TzXfbdA==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.1.tgz",
+      "integrity": "sha512-V4Ww4EHnTcTLSOMoB0FsF72JhQvcAsriCm/LWnxJeGWoxIjEL2l9na11abQok5SYShq8m0Gl02el/xAbTCulvQ==",
       "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9",
+        "@types/node": "^26.4.0"
+      },
       "engines": {
-        "node": ">=20.0.0"
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/jsesc": {
@@ -2438,9 +2488,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.50",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
-      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -2715,6 +2765,12 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "license": "MIT"
+    },
     "node_modules/unist-util-is": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
@@ -2785,9 +2841,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "funding": [
         {
           "type": "opencollective",
diff --git a/tools/eslint/package.json b/tools/eslint/package.json
index 30b0aa50c84c..c91990303d39 100644
--- a/tools/eslint/package.json
+++ b/tools/eslint/package.json
@@ -10,10 +10,10 @@
     "@eslint/js": "^10.0.1",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.8.0",
+    "eslint": "^10.9.1",
     "eslint-formatter-tap": "^9.0.1",
-    "eslint-plugin-jsdoc": "^63.3.1",
-    "eslint-plugin-regexp": "^3.1.1",
-    "globals": "^17.8.0"
+    "eslint-plugin-jsdoc": "^64.2.1",
+    "eslint-plugin-regexp": "^3.2.0",
+    "globals": "^17.11.0"
   }
 }
diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
index 436767e633e1..d464d4b5859c 100755
--- a/tools/generate_config_gypi.py
+++ b/tools/generate_config_gypi.py
@@ -68,18 +68,19 @@ def translate_config(out_dir, config, v8_config):
           bool_string_to_number(config['node_enable_inspector']),
       'shlib_suffix': 'dylib' if sys.platform == 'darwin' else 'so',
       'tsan': bool_string_to_number(config['is_tsan']),
-      # TODO(zcbenz): Shared components are not supported in GN config yet.
       'node_shared': 'false',
-      'node_shared_brotli': 'false',
-      'node_shared_cares': 'false',
-      'node_shared_http_parser': 'false',
-      'node_shared_libuv': 'false',
-      'node_shared_nghttp2': 'false',
+      'node_shared_brotli': config['node_shared_brotli'],
+      'node_shared_cares': config['node_shared_cares'],
+      'node_shared_hdr_histogram': config['node_shared_hdr_histogram'],
+      'node_shared_http_parser': config['node_shared_http_parser'],
+      'node_shared_libuv': config['node_shared_libuv'],
+      'node_shared_nghttp2': config['node_shared_nghttp2'],
       'node_shared_nghttp3': 'false',
       'node_shared_ngtcp2': 'false',
       'node_shared_openssl': 'false',
-      'node_shared_sqlite': 'false',
+      'node_shared_sqlite': config['node_shared_sqlite'],
       'node_shared_zlib': 'false',
+      'node_shared_zstd': config['node_shared_zstd'],
     }
   }
   config_gypi['variables'].update(v8_config)
diff --git a/tools/license-builder.sh b/tools/license-builder.sh
index d4f4382ca655..e758857390c1 100755
--- a/tools/license-builder.sh
+++ b/tools/license-builder.sh
@@ -120,10 +120,6 @@ addlicense "gtest" "deps/googletest" "$licenseText"
 licenseText="$(cat "${rootdir}/deps/nghttp2/COPYING")"
 addlicense "nghttp2" "deps/nghttp2" "$licenseText"
 
-# large_pages
-licenseText="$(sed -e '/SPDX-License-Identifier/,$d' -e 's/^\/\///' "${rootdir}/src/large_pages/node_large_page.h")"
-addlicense "large_pages" "src/large_pages" "$licenseText"
-
 # deep_freeze
 licenseText="$(sed -e '/SPDX-License-Identifier/,$d' -e 's/^\/\///' "${rootdir}/lib/internal/freeze_intrinsics.js")"
 addlicense "caja" "lib/internal/freeze_intrinsics.js" "$licenseText"
diff --git a/tools/nix/devTools.nix b/tools/nix/devTools.nix
index 474e365ceb4e..e33ae720785c 100644
--- a/tools/nix/devTools.nix
+++ b/tools/nix/devTools.nix
@@ -7,7 +7,9 @@
   pkgs.gh
   pkgs.git
   pkgs.jq
+  pkgs.ruff
   pkgs.shellcheck
+  pkgs.yamllint
 ]
 ++ (
   if (ncu-path == null) then
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 788e9efedeb8..585ceae637ef 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -5,6 +5,7 @@
   withSQLite ? true,
   withSSL ? true,
   withFFI ? true,
+  withPerfetto ? false,
   withTemporal ? false,
 }:
 {
@@ -21,8 +22,10 @@
     zlib
     zstd
     ;
+  abseil = pkgs.abseil-cpp;
   cares = pkgs.c-ares;
   hdr-histogram = pkgs.hdrhistogram_c;
+  highway = pkgs.libhwy;
   http-parser = pkgs.llhttp;
   nghttp2 = pkgs.nghttp2.overrideAttrs {
     version = "1.69.0";
@@ -50,6 +53,13 @@
 // (pkgs.lib.optionalAttrs withSSL ({
   inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
 }))
+// (pkgs.lib.optionalAttrs withPerfetto {
+  perfetto =
+    (pkgs.callPackage (builtins.fetchurl {
+      url = "https://github.com/NixOS/nixpkgs/raw/c19db427a1fdfc7591c0b0baeb4665dcef2c61da/pkgs/by-name/pe/perfetto/package.nix";
+      sha256 = "0wc4p96kwxpqr8g2a6lmlfjsffrm3dc824m7hiy0q21r2papc0ik";
+    }) { }).sdk;
+})
 // (pkgs.lib.optionalAttrs withTemporal {
   inherit (pkgs) temporal_capi;
 })
diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix
index 90dadd336c8d..3c3c3ab47347 100644
--- a/tools/nix/v8.nix
+++ b/tools/nix/v8.nix
@@ -23,6 +23,8 @@
 }:
 
 let
+  useSharedAbseil = builtins.elem "--shared-abseil" configureFlags;
+  useSharedHighway = builtins.elem "--shared-highway" configureFlags;
   src =
     let
       inherit (lib) fileset;
@@ -35,7 +37,6 @@ let
         ../../node.gypi
         ../../tools/gyp/pylib
         ../../tools/gyp_node.py
-        ../../tools/v8_gypfiles/abseil.gyp
         ../../tools/v8_gypfiles/features.gypi
         ../../tools/v8_gypfiles/ForEachFormat.py
         ../../tools/v8_gypfiles/ForEachReplace.py
@@ -44,9 +45,12 @@ let
         ../../tools/v8_gypfiles/toolchain.gypi
         ../../tools/v8_gypfiles/v8.gyp
       ]
-      ++ lib.optionals (builtins.elem "--with-perfetto" configureFlags) [
-        ../../deps/perfetto
-      ]
+      ++ lib.optional (!useSharedAbseil) ../../tools/v8_gypfiles/abseil.gyp
+      ++ lib.optional (!useSharedHighway) ../../tools/v8_gypfiles/highway.gyp
+      ++ lib.optional (
+        builtins.elem "--with-perfetto" configureFlags
+        && !(builtins.elem "--shared-perfetto" configureFlags)
+      ) ../../deps/perfetto
       ++ lib.optionals (icu != null) [
         ../../tools/icu/icu_versions.json
         ../../tools/icu/icu-system.gyp
@@ -63,12 +67,16 @@ let
       potentiallyAlreadyRemovedFiles =
         # Files that are removed in the release tarball (see Makefile $(TARBALL) target)
         [ (fileset.difference ../../deps/v8/test ../../deps/v8/test/torque) ]
-        ++ (builtins.filter builtins.pathExists [
-          ../../deps/v8/samples
-          ../../deps/v8/tools/profviz
-          ../../deps/v8/tools/run-tests.py
-          ../../deps/v8/third_party/ittapi
-        ]);
+        ++ (builtins.filter builtins.pathExists (
+          [
+            ../../deps/v8/samples
+            ../../deps/v8/tools/profviz
+            ../../deps/v8/tools/run-tests.py
+            ../../deps/v8/third_party/ittapi
+          ]
+          ++ lib.optional useSharedAbseil ../../deps/v8/third_party/abseil-cpp
+          ++ lib.optional useSharedHighway ../../deps/v8/third_party/highway
+        ));
       trackedFiles =
         ({
           # This line is being modified by Makefile $(TARBALL) target, any change to it should be sync
@@ -197,9 +205,11 @@ stdenv.mkDerivation (finalAttrs: {
     find deps/v8/include -name '*.h' -print0 | while read -r -d "" file; do
       install -Dm644 "$file" -T "$out/include/''${file#deps/v8/include/}"
     done
-    find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
-      install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
-    done
+    ${lib.optionalString (!useSharedAbseil) ''
+      find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
+        install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
+      done
+    ''}
 
     mkdir -p $out/lib/pkgconfig
     cat -> $out/lib/pkgconfig/v8.pc << EOF
diff --git a/tools/v8_gypfiles/d8.gyp b/tools/v8_gypfiles/d8.gyp
index 5b47ebf180dd..f59a155b169c 100644
--- a/tools/v8_gypfiles/d8.gyp
+++ b/tools/v8_gypfiles/d8.gyp
@@ -16,7 +16,6 @@
       'target_name': 'd8',
       'type': 'executable',
       'dependencies': [
-        'abseil.gyp:abseil',
         'v8.gyp:v8',
         'v8.gyp:v8_libbase',
         'v8.gyp:v8_libplatform',
@@ -77,6 +76,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },
   ],
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index a5227687d22d..d656c7492dec 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -161,6 +161,9 @@
     'v8_enable_pointer_compression_shared_cage%': 0,
     'v8_enable_31bit_smis_on_64bit_arch%': 0,
 
+    # Size of the contiguous read-only space reservation in the shared cage.
+    'v8_contiguous_compressed_ro_space_size_mb%': 16,
+
     # Sets -dV8_SHORT_BUILTIN_CALLS
     'v8_enable_short_builtin_calls%': 0,
 
@@ -365,7 +368,11 @@
         'defines': ['V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES'],
       }],
       ['v8_enable_pointer_compression_shared_cage==1', {
-        'defines': ['V8_COMPRESS_POINTERS_IN_SHARED_CAGE'],
+        'defines': [
+          'V8_COMPRESS_POINTERS_IN_SHARED_CAGE',
+          'V8_CONTIGUOUS_COMPRESSED_RO_SPACE',
+          'V8_CONTIGUOUS_COMPRESSED_RO_SPACE_SIZE_MB=<(v8_contiguous_compressed_ro_space_size_mb)',
+        ],
       }],
       ['v8_enable_pointer_compression==1 or v8_enable_31bit_smis_on_64bit_arch==1', {
         'defines': ['V8_31BIT_SMIS_ON_64BIT_ARCH',],
diff --git a/tools/v8_gypfiles/highway.gyp b/tools/v8_gypfiles/highway.gyp
new file mode 100644
index 000000000000..c7f915b76e2f
--- /dev/null
+++ b/tools/v8_gypfiles/highway.gyp
@@ -0,0 +1,58 @@
+{
+  'includes': ['toolchain.gypi'],
+  'targets': [
+    {
+      'target_name': 'highway',
+      'type': 'static_library',
+      'toolsets': ['host', 'target'],
+      'variables': {
+        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
+      },
+      'all_dependent_settings': {
+        'include_dirs': [
+          '<(HIGHWAY_ROOT)/src',
+        ],
+        'conditions': [
+          ['v8_target_arch=="ia32"', {
+            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+          }],
+          ['v8_target_arch=="arm64"', {
+            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+          }],
+          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+          }],
+          ['v8_target_arch=="s390x"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['OS in "aix os400"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['v8_target_arch=="arm" and arm_version==7', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+        ],
+      },
+      'include_dirs': [
+        '<(HIGHWAY_ROOT)/src',
+      ],
+      'conditions': [
+        ['v8_target_arch=="ia32"', {
+          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+        }],
+        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+        }],
+        ['v8_target_arch=="riscv64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
+      ],
+    },  # highway
+  ],
+}
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 32fc99e2af9f..819dffb88984 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -62,7 +62,9 @@
           'BUILDING_V8_PLATFORM_SHARED',  # Make V8_PLATFORM_EXPORT visible.
         ]
       }],
-      ['node_shared=="true"', {
+      # The V8 static libraries get linked into libv8_debug_helper too, and
+      # the local-exec TLS model is only valid in an executable.
+      ['node_shared=="true" or node_enable_v8debughelper=="true"', {
         'defines': [
           'V8_TLS_USED_IN_LIBRARY',  # Enable V8_TLS_LIBRARY_MODE.
         ],
@@ -288,17 +290,19 @@
         'v8_base_without_compiler',
         'v8_initializers',
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<(V8_ROOT)/src/init/setup-isolate-full.cc',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_init
     {
@@ -310,7 +314,6 @@
         'v8_base_without_compiler',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'include_dirs': [
         '<(SHARED_INTERMEDIATE_DIR)',
@@ -320,7 +323,7 @@
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_initializers.*?sources = ")',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -390,6 +393,9 @@
              '<(V8_ROOT)/src/builtins/builtins-intl-gen.cc',
            ],
          }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_initializers
     {
@@ -492,7 +498,7 @@
         },
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -508,7 +514,6 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }, {
           'dependencies': [
@@ -521,9 +526,11 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
         ['OS=="win" and clang==1', {
           'actions': [
             {
@@ -636,8 +643,14 @@
         'run_torque',
         'v8_libbase',
         'fp16',
-        'highway',
-        'abseil.gyp:abseil',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        ['node_shared_highway=="false"', {
+          'dependencies': ['highway.gyp:highway'],
+        }]
       ],
       'direct_dependent_settings': {
         'sources': [
@@ -983,10 +996,9 @@
         'v8_libbase',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1001,6 +1013,9 @@
         }, {
           'sources': ['<(V8_ROOT)/src/compiler/turbofan-disabled.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_compiler
     {
@@ -1104,7 +1119,6 @@
         'v8_zlib',
         'v8_pch',
         'simdutf',
-        'abseil.gyp:abseil',
       ],
       'includes': ['inspector.gypi'],
       'direct_dependent_settings': {
@@ -1125,8 +1139,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_base_without_compiler.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_snapshot_compression==1', {
@@ -1391,6 +1409,9 @@
             'libraries': ['-latomic', ],
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_base_without_compiler
     {
@@ -1412,7 +1433,6 @@
       'dependencies': [
         'v8_shared_internal_headers',
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1438,6 +1458,9 @@
           'cflags!': ['-O3'],
           'sources': ['<(V8_ROOT)/src/torque/implementation-visitor.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # torque_base
     {
@@ -1477,7 +1500,6 @@
 
       'dependencies': [
         'v8_headers',
-        'abseil.gyp:abseil',
       ],
 
       'conditions': [
@@ -1718,6 +1740,9 @@
           ],
         }
          ],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_libbase
     {
@@ -1726,7 +1751,6 @@
       'toolsets': ['host', 'target'],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?sources = ")',
@@ -1745,8 +1769,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_system_instrumentation==1 and is_win', {
@@ -1761,6 +1789,9 @@
             '<(V8_ROOT)/src/libplatform/tracing/recorder-mac.cc',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'direct_dependent_settings': {
         'include_dirs': [
@@ -1801,6 +1832,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         'BUILDING_V8_SHARED=1',
@@ -1808,7 +1842,6 @@
       ],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1831,7 +1864,6 @@
         'v8_libplatform',
         'v8_maybe_icu',
         'v8_pch',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1856,7 +1888,7 @@
         },
       },
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1878,6 +1910,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # mksnapshot
     {
@@ -1885,7 +1920,6 @@
       'type': 'executable',
       'dependencies': [
         'torque_base',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'conditions': [
@@ -1906,6 +1940,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1983,7 +2020,6 @@
         'v8_libbase',
         # "build/win:default_exe_manifest",
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
         ['want_separate_host_toolset', {
@@ -2003,6 +2039,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'sources': [
         "<(V8_ROOT)/src/regexp/gen-regexp-special-case.cc",
@@ -2440,56 +2479,6 @@
         ],
       },
     },  # fp16
-    {
-      'target_name': 'highway',
-      'type': 'static_library',
-      'toolsets': ['host', 'target'],
-      'variables': {
-        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
-      },
-      'all_dependent_settings': {
-        'include_dirs': [
-          '<(HIGHWAY_ROOT)/src',
-        ],
-        'conditions': [
-          ['v8_target_arch=="ia32"', {
-            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-          }],
-          ['v8_target_arch=="arm64"', {
-            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-          }],
-          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-          }],
-          ['v8_target_arch=="s390x"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['OS in "aix os400"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['v8_target_arch=="arm" and arm_version==7', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-        ],
-      },
-      'include_dirs': [
-        '<(HIGHWAY_ROOT)/src',
-      ],
-      'conditions': [
-        ['v8_target_arch=="ia32"', {
-          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-        }],
-        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-        }],
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
-      ],
-    },  # highway
     {
       'target_name': 'simdutf',
       'type': 'static_library',
diff --git a/tools/v8_gypfiles/v8_debug_helper.gyp b/tools/v8_gypfiles/v8_debug_helper.gyp
new file mode 100644
index 000000000000..e869cb4f9771
--- /dev/null
+++ b/tools/v8_gypfiles/v8_debug_helper.gyp
@@ -0,0 +1,177 @@
+{
+  'variables': {
+    'V8_ROOT': '../../deps/v8',
+    'v8_code': 1,
+    # v8windbg links the helper statically. When the helper is the requested
+    # artifact it is built as a shared library instead, so a debugger
+    # extension can load it on its own.
+    'v8_debug_helper_type%': 'static_library',
+    'conditions': [
+      [ 'node_enable_v8debughelper=="true"', {
+        'v8_debug_helper_type': 'shared_library',
+      }],
+    ],
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      # Intermediate target to build the debug helper. dependencies_traverse
+      # stops gyp from propagating the library up to node.gypi as a link
+      # input. The library is only supposed to be loaded by a debugger.
+      'target_name': 'build_v8_debug_helper',
+      'type': 'none',
+      'dependencies_traverse': 0,
+      'hard_dependency': 1,
+      'dependencies': [
+        'v8_debug_helper',
+      ],
+    },  # build_v8_debug_helper
+    {
+      'target_name': 'v8_debug_helper',
+      'type': '<(v8_debug_helper_type)',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'gen_heap_constants',
+
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_snapshot',
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
+      ],
+      # Enable RTTI //build/config/compiler:rtti
+      'cflags_cc': [ '-frtti' ],
+      'cflags_cc!': [ '-fno-rtti' ],
+      'xcode_settings': {
+        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
+      },
+      'msvs_settings': {
+        'VCCLCompilerTool': {
+          'RuntimeTypeInfo': 'true',
+        },
+      },
+      'configurations': {
+        'Release': { # Override target_defaults.Release in common.gypi
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              'RuntimeTypeInfo': 'true',
+            },
+          },
+        },
+      },
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        [ 'v8_enable_temporal_support==1 and node_shared_temporal_capi=="false"', {
+          'dependencies': [
+            '../../deps/crates/crates.gyp:temporal_capi',
+          ],
+        }],
+        [ 'v8_debug_helper_type=="shared_library"', {
+          # The entry points in debug-helper.h are only given default
+          # visibility, or dllexport on Windows, when this is defined. Node
+          # builds with hidden visibility, so without it the library exports
+          # nothing.
+          'defines': [ 'BUILDING_V8_DEBUG_HELPER' ],
+          'direct_dependent_settings': {
+            'defines': [ 'USING_V8_DEBUG_HELPER' ],
+          },
+        }],
+      ],
+    },  # v8_debug_helper
+    {
+      'target_name': 'gen_heap_constants',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'run_mkgrokdump',
+      ],
+      'direct_dependent_settings': {
+        'sources': [
+          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+            '<(SHARED_INTERMEDIATE_DIR)',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # gen_heap_constants
+    {
+      'target_name': 'run_mkgrokdump',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'mkgrokdump',
+      ],
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/run.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/run.py',
+            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
+            '--outfile',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # run_mkgrokdump
+    {
+      'target_name': 'mkgrokdump',
+      'type': 'executable',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'v8.gyp:v8_snapshot',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
+      ]
+    },  # mkgrokdump
+  ],
+}
diff --git a/tools/v8_gypfiles/v8windbg.gyp b/tools/v8_gypfiles/v8windbg.gyp
index 13d4306f224e..14823f60c0cb 100644
--- a/tools/v8_gypfiles/v8windbg.gyp
+++ b/tools/v8_gypfiles/v8windbg.gyp
@@ -24,7 +24,7 @@
         '<(V8_ROOT)/include',
       ],
       'dependencies': [
-        'v8_debug_helper',
+        'v8_debug_helper.gyp:v8_debug_helper',
         'v8.gyp:v8_libbase',
       ],
       'sources': [
@@ -40,129 +40,5 @@
         ],
       },
     },  # v8windbg
-    {
-      'target_name': 'v8_debug_helper',
-      'type': 'static_library',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'gen_heap_constants',
-
-        'abseil.gyp:abseil',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_snapshot',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
-      ],
-      # Enable RTTI //build/config/compiler:rtti
-      'cflags_cc': [ '-frtti' ],
-      'cflags_cc!': [ '-fno-rtti' ],
-      'xcode_settings': {
-        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
-      },
-      'msvs_settings': {
-        'VCCLCompilerTool': {
-          'RuntimeTypeInfo': 'true',
-        },
-      },
-      'configurations': {
-        'Release': { # Override target_defaults.Release in common.gypi
-          'msvs_settings': {
-            'VCCLCompilerTool': {
-              'RuntimeTypeInfo': 'true',
-            },
-          },
-        },
-      },
-    },  # v8_debug_helper
-    {
-      'target_name': 'gen_heap_constants',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'run_mkgrokdump',
-      ],
-      'direct_dependent_settings': {
-        'sources': [
-          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-            '<(SHARED_INTERMEDIATE_DIR)',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # gen_heap_constants
-    {
-      'target_name': 'run_mkgrokdump',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'mkgrokdump',
-      ],
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/run.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/run.py',
-            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
-            '--outfile',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # run_mkgrokdump
-    {
-      'target_name': 'mkgrokdump',
-      'type': 'executable',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'abseil.gyp:abseil',
-        'v8.gyp:v8_snapshot',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_libplatform',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
-      ]
-    },  # mkgrokdump
   ],
 }
diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index e64b8e6d89fc..d8270a6a7fea 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -10,8 +10,10 @@ import { CryptoBinding } from './internalBinding/crypto';
 import { DebugBinding } from './internalBinding/debug';
 import { DiagnosticsChannelBinding } from './internalBinding/diagnostics_channel';
 import { EncodingBinding } from './internalBinding/encoding_binding';
+import { FFIBinding } from './internalBinding/ffi';
 import { FsBinding } from './internalBinding/fs';
 import { FsDirBinding } from './internalBinding/fs_dir';
+import { FsEventWrapBinding } from './internalBinding/fs_event_wrap';
 import { HeapUtilsBinding } from './internalBinding/heap_utils';
 import { HttpParserBinding } from './internalBinding/http_parser';
 import { ICUBinding } from './internalBinding/icu';
@@ -23,11 +25,15 @@ import { MessagingBinding } from './internalBinding/messaging';
 import { ModulesBinding } from './internalBinding/modules';
 import { OptionsBinding } from './internalBinding/options';
 import { OSBinding } from './internalBinding/os';
+import { PerformanceBinding } from './internalBinding/performance';
+import { PermissionBinding } from './internalBinding/permission';
 import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
+import { ProfilerBinding } from './internalBinding/profiler';
 import { SeaBinding } from './internalBinding/sea';
 import { SerdesBinding } from './internalBinding/serdes';
 import { SignalWrapBinding } from './internalBinding/signal_wrap';
+import { StreamPipeBinding } from './internalBinding/stream_pipe';
 import { StringDecoderBinding } from './internalBinding/string_decoder';
 import { SymbolsBinding } from './internalBinding/symbols';
 import { TimersBinding } from './internalBinding/timers';
@@ -54,8 +60,10 @@ interface InternalBindingMap {
   debug: DebugBinding;
   diagnostics_channel: DiagnosticsChannelBinding;
   encoding_binding: EncodingBinding;
+  ffi: FFIBinding;
   fs: FsBinding;
   fs_dir: FsDirBinding;
+  fs_event_wrap: FsEventWrapBinding;
   heap_utils: HeapUtilsBinding;
   http_parser: HttpParserBinding;
   icu: ICUBinding;
@@ -67,11 +75,15 @@ interface InternalBindingMap {
   modules: ModulesBinding;
   options: OptionsBinding;
   os: OSBinding;
+  performance: PerformanceBinding;
+  permission: PermissionBinding;
   process: ProcessBinding;
   process_wrap: ProcessWrapBinding;
+  profiler: ProfilerBinding;
   sea: SeaBinding;
   serdes: SerdesBinding;
   signal_wrap: SignalWrapBinding;
+  stream_pipe: StreamPipeBinding;
   string_decoder: StringDecoderBinding;
   symbols: SymbolsBinding;
   timers: TimersBinding;
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index f532cf6a0c75..eb40d33c513c 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -1,6 +1,8 @@
 declare namespace InternalCryptoBinding {
   type Buffer = Uint8Array;
-  type ByteSource = string | ArrayBuffer | SharedArrayBuffer | ArrayBufferView;
+  type BufferSource = ArrayBuffer | SharedArrayBuffer | ArrayBufferView;
+  type OptionalBufferSource = BufferSource | undefined;
+  type ByteSource = string | BufferSource;
   type OptionalByteSource = ByteSource | undefined;
   type JwkKey = Record<string, string | string[] | boolean | undefined>;
   type KeyFormatDER = 0;
@@ -300,6 +302,8 @@ declare namespace InternalCryptoBinding {
       algorithm: string,
       data: ByteSource,
       outputLength?: number,
+      functionName?: OptionalBufferSource,
+      customization?: OptionalBufferSource,
     ): CryptoJobForMode<M, ArrayBuffer>;
   }
 
@@ -640,6 +644,11 @@ declare namespace InternalCryptoBinding {
     digest(encoding?: string): string | Buffer;
   }
 
+  interface MacHandle {
+    update(data: ByteSource, encoding?: string): boolean;
+    final(encoding?: string): string | Buffer;
+  }
+
   interface CipherBaseHandle {
     update(data: ByteSource, inputEncoding?: string): Buffer;
     final(): Buffer;
@@ -751,6 +760,27 @@ declare namespace InternalCryptoBinding {
     toLegacy(): object;
   }
 
+  interface NativeX509CertificateConstructor {
+    readonly prototype: X509CertificateHandle;
+    new(value: X509CertificateHandle | ArrayBufferView): X509CertificateHandle;
+  }
+
+  interface X509CertificateConstructor {
+    readonly prototype: object;
+    new(buffer: string | ArrayBufferView): object;
+  }
+
+  interface InternalX509CertificateConstructor {
+    readonly prototype: object;
+    new(value: X509CertificateHandle | ArrayBufferView): object;
+  }
+
+  type CreateX509CertificateClassCallback =
+    (NativeX509Certificate: NativeX509CertificateConstructor) => [
+      X509Certificate: X509CertificateConstructor,
+      InternalX509Certificate: InternalX509CertificateConstructor,
+    ];
+
   interface CipherInfo {
     name: string;
     nid: number;
@@ -806,6 +836,8 @@ export interface CryptoBinding {
     credential: InternalCryptoBinding.PreparedSecretKeyData,
     iv: InternalCryptoBinding.ByteSource | null,
     authTagLength?: number,
+    ctsMode?: 'CS1' | 'CS2' | 'CS3',
+    xtsStandard?: 'GB' | 'IEEE',
   ) => InternalCryptoBinding.CipherBaseHandle;
   DiffieHellman: new (
     sizeOrKey: number | InternalCryptoBinding.ByteSource,
@@ -818,8 +850,22 @@ export interface CryptoBinding {
     xofLen?: number,
     algorithmId?: number,
     algorithmCache?: Record<string, number>,
+    functionName?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
   ) => InternalCryptoBinding.HashHandle;
   Hmac: new () => InternalCryptoBinding.HmacHandle;
+  Mac: new (
+    algorithm: string,
+    algorithmId: number,
+    algorithmCache: Record<string, number>,
+    key: InternalCryptoBinding.PreparedSecretKeyData,
+    digest?: string,
+    cipher?: string,
+    iv?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
+    salt?: InternalCryptoBinding.OptionalBufferSource,
+    outputLength?: number,
+  ) => InternalCryptoBinding.MacHandle;
   KeyObjectHandle: new () => InternalCryptoBinding.KeyObjectHandle;
   SecureContext: new () => InternalCryptoBinding.SecureContextHandle;
   Sign: new () => InternalCryptoBinding.SignHandle;
@@ -926,8 +972,15 @@ export interface CryptoBinding {
     PublicKeyObject: InternalCryptoBinding.KeyObjectSubtypeConstructor,
     PrivateKeyObject: InternalCryptoBinding.KeyObjectSubtypeConstructor,
   ];
+  createX509CertificateClass(
+    callback: InternalCryptoBinding.CreateX509CertificateClassCallback,
+  ): [
+    X509Certificate: InternalCryptoBinding.X509CertificateConstructor,
+    InternalX509Certificate: InternalCryptoBinding.InternalX509CertificateConstructor,
+  ];
   getBundledRootCertificates(): string[];
   getCachedAliases(): Record<string, number>;
+  getCachedMacAliases(): Record<string, number>;
   getCertificateCompressionAlgorithms(): string[];
   getCipherInfo(
     nameOrNid: string | number,
@@ -939,7 +992,12 @@ export interface CryptoBinding {
   getCurves(): string[];
   getExtraCACertificates(): string[];
   getFipsCrypto(): 0 | 1;
+  getFipsCryptoGeneration(): bigint;
   getHashes(): string[];
+  getMacs(): string[];
+  isCryptoKey(key: unknown): boolean;
+  isKeyObject(key: unknown): boolean;
+  isX509Certificate(value: unknown): boolean;
   getKeyObjectSlots(key: object): InternalCryptoBinding.KeyObjectSlots;
   getOpenSSLSecLevelCrypto(): number | undefined;
   getSSLCiphers(): string[];
@@ -953,6 +1011,8 @@ export interface CryptoBinding {
     outputEncoding: string,
     outputEncodingId?: number,
     outputLength?: number,
+    functionName?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
   ): string | InternalCryptoBinding.Buffer;
   parseX509(data: InternalCryptoBinding.ByteSource): InternalCryptoBinding.X509CertificateHandle;
   privateDecrypt: InternalCryptoBinding.PublicKeyCipher;
@@ -963,6 +1023,7 @@ export interface CryptoBinding {
   secureBuffer(length: number): Uint8Array | undefined;
   secureHeapUsed(): bigint | undefined;
   setEngine?(engine: string, flags: number): void;
+  setupFipsIndicatorChannel(): void;
   setFipsCrypto(fips: boolean | number): void;
   startLoadingCertificatesOffThread(): void;
   testFipsCrypto(): 0 | 1;
diff --git a/typings/internalBinding/encoding_binding.d.ts b/typings/internalBinding/encoding_binding.d.ts
index 0774a21f25e2..70d6d51172e7 100644
--- a/typings/internalBinding/encoding_binding.d.ts
+++ b/typings/internalBinding/encoding_binding.d.ts
@@ -1,5 +1,6 @@
 export interface EncodingBinding {
   encodeInto(source: string, dest: Uint8Array): void;
+  encodeIntoResults: Uint32Array;
   encodeUtf8String(str: string): Uint8Array;
   decodeUTF8(buffer: ArrayBufferView | ArrayBuffer | SharedArrayBuffer, ignoreBOM?: boolean, hasFatal?: boolean): string;
   toASCII(input: string): string;
diff --git a/typings/internalBinding/ffi.d.ts b/typings/internalBinding/ffi.d.ts
new file mode 100644
index 000000000000..0294d1987b03
--- /dev/null
+++ b/typings/internalBinding/ffi.d.ts
@@ -0,0 +1,101 @@
+declare namespace InternalFFIBinding {
+  type Buffer = Uint8Array;
+  type BufferSource = Buffer | ArrayBuffer | ArrayBufferView | SharedArrayBuffer;
+  type VoidType = 'void';
+  type NumberType =
+    | 'char'
+    | 'int8' | 'i8'
+    | 'uint8' | 'u8' | 'bool'
+    | 'int16' | 'i16'
+    | 'uint16' | 'u16'
+    | 'int32' | 'i32'
+    | 'uint32' | 'u32'
+    | 'float32' | 'f32' | 'float'
+    | 'float64' | 'f64' | 'double';
+  type BigIntType = 'int64' | 'i64' | 'uint64' | 'u64';
+  type PointerType =
+    | 'pointer' | 'ptr'
+    | 'string' | 'str'
+    | 'buffer' | 'arraybuffer'
+    | 'function';
+  type ValueType = NumberType | BigIntType | PointerType;
+  type ReturnType = VoidType | ValueType;
+  type FFICallback = (...args: any[]) => unknown;
+
+  interface FFIFunction {
+    (...args: unknown[]): unknown;
+    pointer: bigint;
+  }
+  interface FunctionSignature {
+    arguments?: readonly ValueType[];
+    return?: ReturnType;
+  }
+
+  class DynamicLibrary {
+    constructor(path: string | null);
+
+    readonly path: string;
+    readonly symbols: Record<string, bigint>;
+    readonly functions: Record<string, FFIFunction>;
+
+    close(): void;
+    getFunction(name: string, signature: FunctionSignature): FFIFunction;
+    getFunctions(): Record<string, FFIFunction>;
+    getFunctions(
+      definitions: Record<string, FunctionSignature>,
+    ): Record<string, FFIFunction>;
+    getSymbol(name: string): bigint;
+    getSymbols(): Record<string, bigint>;
+    registerCallback(callback: FFICallback): bigint;
+    registerCallback(
+      signature: FunctionSignature,
+      callback: FFICallback
+    ): bigint;
+    unregisterCallback(pointer: bigint): void;
+    refCallback(pointer: bigint): void;
+    unrefCallback(pointer: bigint): void;
+    [Symbol.dispose](): void;
+  }
+}
+export interface FFIBinding {
+  DynamicLibrary: typeof InternalFFIBinding.DynamicLibrary;
+  toString(pointer: bigint): string | null;
+  toBuffer(pointer: bigint, length: number, copy?: boolean): InternalFFIBinding.Buffer;
+  toArrayBuffer(pointer: bigint, length: number, copy?: boolean): ArrayBuffer;
+
+  exportBytes(source: InternalFFIBinding.BufferSource, pointer: bigint, length: number): void;
+  getRawPointer(source: InternalFFIBinding.BufferSource): bigint;
+  getCurrentEventLoop(): bigint;
+
+  getInt8(pointer: bigint, offset?: number): number;
+  getUint8(pointer: bigint, offset?: number): number;
+  getInt16(pointer: bigint, offset?: number): number;
+  getUint16(pointer: bigint, offset?: number): number;
+  getInt32(pointer: bigint, offset?: number): number;
+  getUint32(pointer: bigint, offset?: number): number;
+  getInt64(pointer: bigint, offset?: number): bigint;
+  getUint64(pointer: bigint, offset?: number): bigint;
+  getFloat32(pointer: bigint, offset?: number): number;
+  getFloat64(pointer: bigint, offset?: number): number;
+
+  setInt8(pointer: bigint, offset: number, value: number): void;
+  setUint8(pointer: bigint, offset: number, value: number): void;
+  setInt16(pointer: bigint, offset: number, value: number): void;
+  setUint16(pointer: bigint, offset: number, value: number): void;
+  setInt32(pointer: bigint, offset: number, value: number): void;
+  setUint32(pointer: bigint, offset: number, value: number): void;
+  setInt64(pointer: bigint, offset: number, value: number | bigint): void;
+  setUint64(pointer: bigint, offset: number, value: number | bigint): void;
+  setFloat32(pointer: bigint, offset: number, value: number): void;
+  setFloat64(pointer: bigint, offset: number, value: number): void;
+
+  charIsSigned: boolean;
+  uintptrMax: bigint;
+
+  kSbSharedBuffer: symbol;
+  kSbInvokeSlow: symbol;
+  kSbArguments: symbol;
+  kSbReturn: symbol;
+  kFastArguments: symbol;
+  kFastBufferInvoke: symbol;
+}
diff --git a/typings/internalBinding/fs_event_wrap.d.ts b/typings/internalBinding/fs_event_wrap.d.ts
new file mode 100644
index 000000000000..b1b815e8a35e
--- /dev/null
+++ b/typings/internalBinding/fs_event_wrap.d.ts
@@ -0,0 +1,28 @@
+import { owner_symbol } from './symbols';
+
+declare namespace InternalFsEventWrapBinding {
+  class FSEvent {
+    constructor();
+    [owner_symbol]?: object;
+    readonly initialized: boolean;
+    onchange?: (
+      status: number,
+      eventType: string,
+      filename: string | Uint8Array | null,
+    ) => void;
+    start(
+      filename: string | Uint8Array,
+      persistent: boolean,
+      recursive: boolean,
+      encoding: string,
+    ): number;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+  }
+}
+
+export interface FsEventWrapBinding {
+  FSEvent: typeof InternalFsEventWrapBinding.FSEvent;
+}
diff --git a/typings/internalBinding/performance.d.ts b/typings/internalBinding/performance.d.ts
new file mode 100644
index 000000000000..fa9a3810fc7a
--- /dev/null
+++ b/typings/internalBinding/performance.d.ts
@@ -0,0 +1,134 @@
+declare namespace InternalPerformanceBinding {
+  interface HistogramBase {
+    count(): number;
+    countBigInt(): bigint;
+    min(): number;
+    minBigInt(): bigint;
+    max(): number;
+    maxBigInt(): bigint;
+    mean(): number;
+    exceeds(): number;
+    exceedsBigInt(): bigint;
+    stddev(): number;
+    percentile(percentile: number): number;
+    percentileBigInt(percentile: number): bigint;
+    percentiles(percentiles: Map<number, number>): void;
+    percentilesBigInt(percentiles: Map<number, bigint>): void;
+    reset(): void;
+    skewness(): number;
+    kurtosis(): number;
+    cdf(value: number): number;
+    countAt(value: number): number;
+    ksTest(other: HistogramBase): number;
+    percentilesAt(
+      percentiles: Map<number, number>,
+      values: Float64Array,
+    ): void;
+    linearBuckets(stepSize: number, buckets: Map<number, number>): void;
+    logBuckets(
+      firstBucket: number,
+      base: number,
+      buckets: Map<number, number>,
+    ): void;
+    welchTest(
+      other: HistogramBase,
+      confidence: number,
+    ): [number, number, number, number, number];
+    mannWhitneyTest(other: HistogramBase): [number, number, number];
+    cohensD(other: HistogramBase): number;
+    cliffsD(other: HistogramBase): number;
+    percentileCI(percentile: number, confidence: number): [number, number, number];
+    ewmaMean(): number;
+    ewmaStddev(): number;
+    ewmaErrorRate(): number;
+  }
+
+  interface ELDHistogram extends HistogramBase {
+    start(reset?: boolean): void;
+    stop(): void;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+    getAsyncId(): number;
+    asyncReset(resource: object, executionAsyncId?: number): void;
+    getAsyncContextFrameForDebuggingOnly(): unknown;
+    getProviderType(): number;
+  }
+
+  interface Histogram extends HistogramBase {}
+
+  class Histogram {
+    constructor(
+      lowest: number | bigint,
+      highest: number | bigint,
+      figures: number,
+      halfLife?: number,
+      threshold?: number,
+    );
+    record(value: number | bigint): void;
+    recordDelta(): void;
+    recordCorrected(
+      value: number | bigint,
+      expectedInterval: number | bigint,
+    ): void;
+    add(other: Histogram): number;
+    subtract(other: Histogram): number;
+  }
+
+  interface Constants {
+    NODE_PERFORMANCE_GC_MAJOR: number;
+    NODE_PERFORMANCE_GC_MINOR: number;
+    NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP: number;
+    NODE_PERFORMANCE_GC_INCREMENTAL: number;
+    NODE_PERFORMANCE_GC_WEAKCB: number;
+    NODE_PERFORMANCE_GC_FLAGS_NO: number;
+    NODE_PERFORMANCE_GC_FLAGS_CONSTRUCT_RETAINED: number;
+    NODE_PERFORMANCE_GC_FLAGS_FORCED: number;
+    NODE_PERFORMANCE_GC_FLAGS_SYNCHRONOUS_PHANTOM_PROCESSING: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_AVAILABLE_GARBAGE: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_EXTERNAL_MEMORY: number;
+    NODE_PERFORMANCE_GC_FLAGS_SCHEDULE_IDLE: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_GC: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP2: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_NET: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_DNS: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_QUIC: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN_TIMESTAMP: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN: number;
+    NODE_PERFORMANCE_MILESTONE_ENVIRONMENT: number;
+    NODE_PERFORMANCE_MILESTONE_NODE_START: number;
+    NODE_PERFORMANCE_MILESTONE_V8_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_EXIT: number;
+    NODE_PERFORMANCE_MILESTONE_BOOTSTRAP_COMPLETE: number;
+  }
+}
+
+type PerformanceObserverCallback =
+  | ((name: string,
+      type: string,
+      startTime: number,
+      duration: number,
+      details: unknown) => void)
+  | ((entry: unknown) => void);
+
+export interface PerformanceBinding {
+  Histogram: typeof InternalPerformanceBinding.Histogram;
+  constants: InternalPerformanceBinding.Constants;
+  observerCounts: Uint32Array;
+  milestones: Float64Array;
+  setupObservers(callback: PerformanceObserverCallback): void;
+  installGarbageCollectionTracking(): void;
+  removeGarbageCollectionTracking(): void;
+  notify(type: string, entry: unknown): void;
+  loopIdleTime(): number;
+  createELDHistogram(
+    interval: number,
+    samplePerIteration: boolean,
+  ): InternalPerformanceBinding.ELDHistogram;
+  markBootstrapComplete(): void;
+  uvMetricsInfo(): [number, number, number];
+  now(): number;
+}
diff --git a/typings/internalBinding/permission.d.ts b/typings/internalBinding/permission.d.ts
new file mode 100644
index 000000000000..5fe422d1820b
--- /dev/null
+++ b/typings/internalBinding/permission.d.ts
@@ -0,0 +1,6 @@
+type Buffer = Uint8Array;
+
+export interface PermissionBinding {
+  has(scope: string, reference?: string | Buffer | null): boolean;
+  drop(scope: string, reference?: string | Buffer | null): void;
+}
diff --git a/typings/internalBinding/profiler.d.ts b/typings/internalBinding/profiler.d.ts
new file mode 100644
index 000000000000..67e5dca87696
--- /dev/null
+++ b/typings/internalBinding/profiler.d.ts
@@ -0,0 +1,8 @@
+export interface ProfilerBinding {
+  setCoverageDirectory(directory: string): void;
+  setSourceMapCacheGetter(getter: () => object | undefined): void;
+  startCoverage(): void;
+  takeCoverage(): void;
+  stopCoverage(): void;
+  endCoverage(): void;
+}
diff --git a/typings/internalBinding/stream_pipe.d.ts b/typings/internalBinding/stream_pipe.d.ts
new file mode 100644
index 000000000000..17568409af54
--- /dev/null
+++ b/typings/internalBinding/stream_pipe.d.ts
@@ -0,0 +1,17 @@
+declare namespace InternalStreamPipeBinding {
+  class StreamPipe {
+    constructor(source: object, sink: object);
+    readonly source: object | null;
+    readonly sink: object | null;
+    onunpipe?: () => void;
+    oncomplete?: () => void;
+    unpipe(): void;
+    start(): void;
+    isClosed(): boolean;
+    pendingWrites(): number;
+  }
+}
+
+export interface StreamPipeBinding {
+  StreamPipe: typeof InternalStreamPipeBinding.StreamPipe;
+}
diff --git a/typings/internalBinding/zlib.d.ts b/typings/internalBinding/zlib.d.ts
index 3f937df22503..706337eb45a7 100644
--- a/typings/internalBinding/zlib.d.ts
+++ b/typings/internalBinding/zlib.d.ts
@@ -15,7 +15,7 @@ declare namespace InternalZlibBinding {
     writeSync(flushFlag: number, input: TypedArray, inputOff: number, inputLen: number, out: TypedArray, outOff: number, outLen: number): void;
   }
 
-  class Zlib extends ZlibBase{
+  class Zlib extends ZlibBase {
     constructor(mode: number)
     init(windowBits: number, level: number, memLevel: number, strategy: number, writeState: Uint32Array, callback: VoidFunction, dictionary: Uint32Array): number;
   }
@@ -29,10 +29,24 @@ declare namespace InternalZlibBinding {
     constructor(mode: number);
     init(initParamsArray: Uint32Array, writeState: Uint32Array, callback: VoidFunction): boolean;
   }
+
+  class ZstdCompress extends ZlibBase {
+    constructor();
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView): void;
+  }
+
+  class ZstdDecompress extends ZlibBase {
+    constructor();
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView): void;
+  }
 }
 
 export interface ZlibBinding {
   BrotliDecoder: typeof InternalZlibBinding.BrotliDecoder;
   BrotliEncoder: typeof InternalZlibBinding.BrotliEncoder;
+  ZLIB_VERSION: string;
   Zlib: typeof InternalZlibBinding.Zlib;
+  ZstdCompress: typeof InternalZlibBinding.ZstdCompress;
+  ZstdDecompress: typeof InternalZlibBinding.ZstdDecompress;
+  crc32(data: string | ArrayBufferView, value: number): number;
 }
diff --git a/unofficial.gni b/unofficial.gni
index 16bf46acb0f8..5878f079d94e 100644
--- a/unofficial.gni
+++ b/unofficial.gni
@@ -105,7 +105,7 @@ template("node_gn_build") {
       "-Wno-unused-function",
     ]
 
-    if (current_cpu == "x86") {
+    if (target_cpu == "x86") {
       node_arch = "ia32"
     } else {
       node_arch = target_cpu
diff --git a/vcbuild.bat b/vcbuild.bat
index 28494815df1d..681c92d285fb 100644
--- a/vcbuild.bat
+++ b/vcbuild.bat
@@ -199,8 +199,6 @@ if defined build_release (
   set projgen=1
   set cctest=1
   set thin_lto=1
-  @REM Parallel LTO link jobs can cause OOM issues, so we limit it to 2 by default for release builds in the release CI.
-  set lto_jobs=2
 )
 
 :: LTO mutual exclusion